Skip to content

Operations

How the instance is secured, how to manage its services, and how to back up, update and get help.

Security model

  • Loopback only. Uptime Kuma listens on 127.0.0.1:3001 and nginx on 127.0.0.1:8443 and [::1]:8443. No service listens on a public interface.
  • Per-instance secrets. First boot creates the TLS key and the admin password on the instance. They are not in the image.
  • File permissions. The password file and the TLS private key are owned by root with mode 0600. The ubuntu user can read the certificate but not the key or the password.
  • Dedicated user. Uptime Kuma runs as the uptime-kuma system user, with write access only to /var/lib/uptime-kuma.
  • SSH. Password login and root login are disabled. Use Session Manager, or SSH with a key pair from your administrative network only.
  • No AWS permissions needed. The image does not call AWS APIs. Attach an IAM role beyond Session Manager only if a monitor or notification you add needs one, and scope it to those actions and resources.
  • Update check off. On first start Uptime Kuma may check https://uptime.kuma.pet/version once. The image then turns that check off.

Services

Unit What it does
sushi-uptime-kuma-firstboot.service Creates the TLS material, password and data directory. Runs before the others.
uptime-kuma.service Uptime Kuma itself
nginx HTTPS proxy on port 8443
sushi-uptime-kuma-admin.service Creates the admin account once Uptime Kuma is ready

Check and restart them with systemctl:

systemctl status uptime-kuma.service nginx
sudo systemctl restart uptime-kuma.service

Logs

sudo journalctl -u uptime-kuma.service -n 100 --no-pager
sudo journalctl -u nginx -n 100 --no-pager

Backups

Back up /var/lib/uptime-kuma/ together with /etc/uptime-kuma/.

To take a consistent copy of the database while Uptime Kuma is running:

sudo sqlite3 /var/lib/uptime-kuma/kuma.db ".backup /var/backups/kuma-backup.db"

If you copy the whole data directory with cp instead, stop the service first:

sudo systemctl stop uptime-kuma.service
sudo cp -a /var/lib/uptime-kuma /var/backups/uptime-kuma
sudo systemctl start uptime-kuma.service

EBS snapshots of the root volume are another option.

Updates

  • Ubuntu security updates install automatically through unattended upgrades.
  • Uptime Kuma and Node.js stay on the versions in the image. New versions ship as new image versions.

A new image version does not update a running instance. To move to it, launch the new version, copy /var/lib/uptime-kuma/ and /etc/uptime-kuma/ across with the services stopped, and point your users or DNS name at the new instance. Uptime Kuma applies its own database migrations on startup. Try the move on a test instance first.

Support

Software Sushi provides packaging and setup guidance for this image. Email info@softwaresushi.com with your instance ID and a description of the problem. Do not send the admin password or private keys. This offer does not include support from Louis Lam or the Uptime Kuma project.