Accent Translation and Localization Management on AWS User Guide

Overview

Accent is an open source, developer-oriented translation and localization management platform. Developers sync an application's translation files in and out through an API and CLI, and translators manage, review, lint and collaborate on strings through a web UI, with full version history and a review workflow. Under the hood Accent is an Elixir and Phoenix GraphQL API backed by PostgreSQL, with a compiled JavaScript web frontend.

This cloudimg image runs Accent as the official upstream mirego/accent container, pinned by digest, alongside a bundled PostgreSQL, orchestrated by docker compose under a single systemd service on a private container network. Accent binds to the loopback interface only, and PostgreSQL is never published to a host port. A host nginx reverse proxy terminates TLS on port 443 with a per-instance self-signed certificate and enforces HTTP Basic authentication; plain HTTP on port 80 redirects to HTTPS. Docker Engine and its entire data root, including the pre-pulled digest-pinned images and the translation database, live on a dedicated data volume mounted at /var/lib/docker, so your translation data survives OS-disk changes and is resizable independently.

Security is enforced from first boot. Accent has no built-in password authentication of its own, and upstream ships published defaults for its Phoenix secret key base, session signing salt and encryption vault key. This image never uses those defaults: before Accent starts, a unique value for each, plus the PostgreSQL password, the per-instance web credential and the self-signed TLS certificate, are all generated for the individual instance. Backed by 24/7 cloudimg support.

What is included:

• Accent v1.30.4, the BSD-3-Clause licensed translation platform, shipped as the official mirego/accent image pinned by digest
• A bundled PostgreSQL, pinned by digest and reachable only inside a private container network
• Docker Engine with Accent on the loopback interface behind nginx over TLS on port 443
• A per-instance web credential, PostgreSQL password, Phoenix secret key base, session signing salt and encryption vault key generated on first boot
• A per-instance administrator bootstrapped through Accent's own login flow, written to a root-only file
• The Docker data root and translation database on a dedicated data volume at /var/lib/docker
• docker.service, accent.service and nginx.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An AWS account, an EC2 key pair in the target region, and a VPC with a public subnet. m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type. Security group inbound: allow 22/tcp from your management network for SSH and 443/tcp for the web UI.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace, then launch an instance from the AMI into your VPC with the security group described above. Choose the m5.large instance type and attach your EC2 key pair. The image keeps the pre-pulled container images on the dedicated data volume, so the Accent stack comes up within a few minutes of first boot with no image re-pull while it runs its database migrations and language seeds.

Step 2 - Connect to your instance

Connect over SSH as the default login user for the operating system variant you launched. The login user differs per OS, so use the row for your variant:

ssh -i your-key.pem ubuntu@<public-ip>

Step 3 - Read your unique credentials

On first boot the instance generates a per-instance web credential and bootstraps a per-instance administrator, writing them along with the resolved web URL to a root-only file. Read it with sudo:

sudo cat /root/accent-credentials.txt

You will see the web URL, the HTTP Basic credential (WEB_USER / WEB_PASSWORD) and the Accent administrator email (ADMIN_EMAIL) for this instance. There is no default or shared login anywhere in the image; every secret is unique to this instance.

Step 4 - Verify the security model from the command line

Before opening a browser, confirm the front door is closed to anyone without the per-instance credential. The nginx TLS proxy on port 443 uses a self-signed certificate, so pass curl -k to accept it. An unauthenticated request is refused with 401:

curl -sk -o /dev/null -w 'no credential -> %{http_code}\n' https://127.0.0.1/

The same request with the per-instance web credential is served with 200:

curl -sk -o /dev/null -w 'with credential -> %{http_code}\n' -u '<WEB_USER>:<WEB_PASSWORD>' https://127.0.0.1/

Confirm that plain HTTP redirects to HTTPS:

curl -sk -o /dev/null -w 'http :80 -> %{http_code}\n' http://127.0.0.1/

Accent itself listens only on the loopback interface, and the bundled PostgreSQL is never published to a host port. Confirm neither is exposed to the network:

ss -tln | grep -qE '0\.0\.0\.0:4000|\[::\]:4000' && echo 'WARNING: Accent exposed beyond loopback' || echo 'Accent is loopback-only (127.0.0.1:4000)'
ss -tln | grep -q ':5432 ' && echo 'WARNING: PostgreSQL exposed on a host port' || echo 'PostgreSQL is not exposed on any host port'

Confirm the services are active and the translation database lives on the dedicated data volume:

systemctl is-active docker.service accent.service nginx.service
findmnt -no SOURCE,TARGET,FSTYPE /var/lib/docker

Step 5 - Sign in to the web UI over TLS

Open the web URL from your credentials file in a browser:

https://<instance-public-ip>/

The instance uses a per-instance self-signed TLS certificate, so accept the browser certificate warning (or front the instance with your own domain and certificate). You then sign in twice, by design:

1. Answer the browser HTTP Basic prompt with WEB_USER and WEB_PASSWORD from your credentials file. This is the per-instance front-door gate that keeps a public instance from being an open door.
2. On the Accent sign-in page, choose the email login and enter the ADMIN_EMAIL from your credentials file.

Once signed in you land on the projects dashboard, where you create and open projects.

Open a project to reach the string editor, where every translation key and its text is listed with its review status, ready to edit, review and lint.

Each project shows its overall translation progress and per-language review status, with sync, add-translations and export actions and a live activity feed.

The activity view records every file sync, new string, conflict and review, filterable by collaborator, version and activity type, so the whole team can follow the localization history.

Step 6 - Sync a translation file through the API

Developers keep translation files in step with the codebase through Accent's file sync and export endpoints, which sit behind the same TLS front door. Create a project in the UI, note its master language, then push a simple_json file of source strings. The example below authenticates with the per-instance web credential and imports a small file:

cat > /tmp/en.json <<'JSON'
{ "app.title": "My Application", "button.save": "Save changes", "auth.sign_in": "Sign in" }
JSON
curl -sk -u '<WEB_USER>:<WEB_PASSWORD>' -b /tmp/accent.jar -c /tmp/accent.jar \
  "https://127.0.0.1/auth/dummy/callback?email=<ADMIN_EMAIL>" -o /dev/null
echo "Signed in as <ADMIN_EMAIL>; create a project in the UI, then POST a file to https://<instance-public-ip>/sync with project_id, document_path, document_format=simple_json and language."

You then pull the reviewed, exported files back out at release time through the /export endpoint. Point the Accent CLI at https://<instance-public-ip>/ with the same per-instance web credential to script this from your build pipeline.

Step 7 - Wire up your own single sign-on (optional)

Accent has no password authentication of its own; its zero-configuration login is a password-less provider, which is why this image keeps it behind the per-instance HTTP Basic gate. To move to real single sign-on, register an OAuth or OIDC application with your own provider (GitHub, GitLab, Google, Slack, Discord, Microsoft or any generic OIDC issuer), add its client id and secret to /etc/accent/accent.env and the matching environment keys to /etc/accent/compose.yaml, then restart Accent:

sudo systemctl restart accent.service

Once your own single sign-on is verified, you can remove the basic-auth gate from the nginx site at /etc/nginx/sites-available/accent and reload nginx. No third-party credentials are shipped in this image, and no single sign-on is configured out of the box.

Step 8 - Data volume and backups

The Docker data root at /var/lib/docker is a dedicated EBS volume, so the pre-pulled images and the PostgreSQL translation database are independent of the OS disk. Back it up with EBS snapshots or AWS Backup, and grow it independently as your string catalog expands. The mount is defined in /etc/fstab by filesystem UUID, so it survives reboots and re-attachment.

Security model

• No default or shared credentials. The Phoenix secret key base, session signing salt and encryption vault key that upstream ships as published defaults are never used; a unique value for each is generated on every instance's first boot.
• Per-instance secrets. The web credential, the PostgreSQL password and the self-signed TLS certificate are generated per instance on first boot and written only to the root-only /root/accent-credentials.txt.
• Closed front door. nginx enforces a per-instance HTTP Basic credential over TLS, so a scanner or passer-by cannot reach or self-register with the password-less provider.
• Network isolation. Accent binds only to the loopback interface; PostgreSQL is never published to a host port; only the nginx TLS reverse proxy is exposed.
• Fresh database on first boot. The captured image carries no database, no user accounts and no secrets; every instance re-initializes a clean database with freshly generated secrets.

Troubleshooting

• The stack is still starting. On first boot Accent runs its database migrations and language seeds, which can take a few minutes. Check progress with systemctl status accent.service and sudo docker compose -f /etc/accent/compose.yaml logs --tail 100.
• Browser certificate warning. The instance uses a self-signed certificate. Accept it in the browser, or terminate TLS at your own load balancer or reverse proxy with your own certificate.
• Forgot the credential. Re-read sudo cat /root/accent-credentials.txt.

Support

cloudimg provides 24/7 technical support for this product by email and live chat at support@cloudimg.co.uk. We help with deployment, wiring up your own OAuth or OIDC single sign-on and retiring the basic-auth gate, reverse-proxy termination with your own domain and certificate, and backup planning for your translation database.

Accent is open source software licensed under the BSD-3-Clause license. This image is not affiliated with, endorsed by, or sponsored by Mirego or the Accent project; the Accent name is used nominatively to identify the open source software shipped in this image.