AliasVault Password Manager and Email Aliases on AWS User Guide

Overview

This guide covers the deployment and configuration of AliasVault on AWS using cloudimg AWS Marketplace AMIs. AliasVault is an open source, self hosted password manager combined with a private email alias service. For every website you sign up to, it can generate a unique identity and a unique email alias, receive email for that alias through its own built in mail server, and store the login in a zero knowledge vault. Your master password derives your encryption key in your browser and never leaves your device, so the server only ever holds encrypted data.

The cloudimg image ships the free and open source, AGPL-3.0 licensed AliasVault, run the officially supported way as the upstream containers pinned to the release. The bundled PostgreSQL database, the web vault client, the admin panel, the REST API, the mail server and a background task runner all run under one systemd service on a private container network, fronted by an nginx reverse proxy that terminates TLS on ports 80 and 443. Every image is captured into the AMI, so your instance starts in seconds. Because a password manager holds your most sensitive data, nothing here ships with a known secret: a unique admin password, JWT signing key, data protection key and database password, plus a fresh self signed TLS certificate, are generated for each instance on first boot, before the ports are reachable. Backed by 24/7 cloudimg support.

AliasVault is a trademark of its respective owner. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by AliasVault. It ships the free and open source AGPL-3.0 licensed self hosted software, unmodified; the verbatim licence text and a pointer to the corresponding source ship inside the image under /usr/share/doc/cloudimg/third-party-licences.

What is included:

• AliasVault v0.30.1, the full open source stack, pinned to the upstream release
• A bundled PostgreSQL database, reachable only inside the private container network (never published to a host port)
• A web vault client, an admin panel and a REST API behind an nginx reverse proxy that terminates TLS
• A built in mail server listening on ports 25 and 587 for receiving alias email
• A unique admin password, JWT key, data protection key and database password generated per instance on first boot
• A fresh self signed TLS certificate generated per instance
• 24/7 cloudimg support

Connecting to your instance

This listing offers one or more operating-system variants. Connect over SSH as that variant's default login user, using your EC2 key pair:

Step 1: Subscribe and launch from AWS Marketplace

1. On the product page in AWS Marketplace, choose Continue to Subscribe, accept the terms, then Continue to Configuration.
2. Choose the region and the m5.large instance type (recommended), then Continue to Launch.
3. Under Network settings, attach a security group that allows inbound TCP 22 (SSH) from your IP, TCP 443 (the web vault) and TCP 80 (which redirects to 443). If you intend to receive alias email, also allow TCP 25 and TCP 587 to the mail server.
4. Select your EC2 key pair and launch.

Step 2: Launch from the AWS CLI (alternative)

You can also launch the subscribed AMI directly. Replace the AMI id, key name, security group and subnet with your own:

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids <sg-id> \
  --subnet-id <subnet-id> \
  --metadata-options "HttpTokens=required" \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=aliasvault}]'

Then connect over SSH as ubuntu (see the table above).

Step 3: Confirm the services are running

SSH in as ubuntu and confirm Docker and the AliasVault stack are active:

systemctl is-active docker.service aliasvault.service

All three of the core units report active:

sudo docker ps --format '{{.Names}}  {{.Status}}'

You should see seven containers running: postgres, client, api, admin, smtp, reverse-proxy and task-runner. PostgreSQL is deliberately not published to a host port; only the reverse proxy (80/443) and the mail server (25/587) listen externally:

sudo ss -tln | grep -E ':(80|443|25|587) '

Step 4: Retrieve your per instance credentials

A unique admin-panel password and the four cryptographic secrets are generated on the first boot of every instance and written to a root-only file:

sudo cat /root/aliasvault-credentials.txt

The file (mode 0600 root:root) holds ALIASVAULT_URL and ALIASVAULT_ADMIN_URL, plus ALIASVAULT_ADMIN_USERNAME (admin) and ALIASVAULT_ADMIN_PASSWORD (the password for the admin panel). None of these ship in the image; every value is unique to this instance, so no two instances share a credential and there is no default login. The vault master password you choose in the next step is never written here, because it never leaves your browser.

Step 5: Create your vault

Open the web vault in your browser at https://<instance-public-ip>/. The certificate is a per instance self signed certificate, so your browser will warn once; accept it to continue. Choose Create new vault, accept the terms, pick a username and set a strong master password.

Your master password encrypts your vault and cannot be recovered. AliasVault derives your encryption key from it in your browser (Argon2id), so if you forget it, your data is permanently inaccessible. Store it in a safe place.

Once your vault is initialised you land on the vault view, where your logins and aliases are listed:

Step 6: Generate an identity and email alias

Choose + New to add an item. AliasVault can store a Login, generate a full Alias (a random identity with its own private email address), or hold a Card or Note. For a new sign-up, generate an alias so the site never sees your real identity or email address:

Step 7: Receive email at your aliases

The Emails view lists every message received by your private alias addresses. To receive real mail, point DNS for your own domain at this instance, add the domain to PRIVATE_EMAIL_DOMAINS in /opt/aliasvault/.env, and make sure inbound TCP 25 is open to the mail server:

Step 8: The admin panel

The built in admin panel is served at https://<instance-public-ip>/admin. Sign in with the username admin and the per instance ALIASVAULT_ADMIN_PASSWORD from your credentials file. The panel shows server activity, registered users, mail and logs, and lets you manage server settings:

Step 9: Lock down open registration

Public registration is enabled by default so you can create your own vault account on first use. Once your account exists, disable open sign-up so no one else can register on your server:

sudo /opt/aliasvault/install.sh configure-registration

Alternatively, set PUBLIC_REGISTRATION_ENABLED=false in /opt/aliasvault/.env and restart the stack:

cd /opt/aliasvault && sudo docker compose up -d

Step 10: Use a trusted TLS certificate

The image ships a per instance self signed certificate so HTTPS works out of the box. For production, front the instance with a domain name and a trusted certificate. Point DNS at the instance, then either terminate TLS at an AWS load balancer in front of the instance, or configure a certificate for AliasVault directly with the vendored management CLI:

sudo /opt/aliasvault/install.sh configure-ssl

Security model

• No known credential ships. On first boot, before the ports are reachable, AliasVault generates a unique admin password, JWT signing key, data protection key and database password for this instance, and a fresh self signed TLS certificate.
• Zero knowledge vault. Your master password derives your encryption key in your browser (Argon2id + SRP). The server stores only encrypted data and never sees your master password or your vault key.
• PostgreSQL is never exposed. The database listens only inside the private container network; only the reverse proxy (80/443) and the mail server (25/587) are reachable from outside.
• Clean first boot. Build-time state is wiped before the image is captured, so the database, vault, mail, secrets and TLS key are all created fresh on your instance.

You can confirm the front door end to end at any time. The reverse proxy redirects HTTP to HTTPS, serves the web client over HTTPS, and the API reports healthy (which proves the database is reachable and migrations have been applied):

curl -sk -o /dev/null -w 'web: HTTP %{http_code}\n' https://127.0.0.1/

Managing the service

• Check status: systemctl status aliasvault.service
• Configuration and per instance secrets live under /opt/aliasvault (.env, secrets/, docker-compose.yml)
• The bundled AliasVault management CLI is at /opt/aliasvault/install.sh (configure-registration, configure-ssl, configure-hostname, reset-admin-password, update)
• The AGPL-3.0 licence text and source pointer ship at /usr/share/doc/cloudimg/third-party-licences

Support

cloudimg provides 24/7 technical support for this product by email and live chat, with a one-hour average response for critical issues. We help with deployment, DNS and mail configuration, TLS termination, backups, user management and scaling.

• Email: support@cloudimg.co.uk
• Live chat: available 24/7

AliasVault is free and open source under the GNU Affero General Public License v3.0. There is no per-seat fee for the software; the cloudimg charge covers packaging, security patching, image maintenance and 24/7 support.