ArcadeDB Multi-Model Database on AWS User Guide

Overview

This guide covers deploying and using ArcadeDB from the cloudimg AWS Marketplace listing. ArcadeDB is an open source multi-model database that stores graph, document, key-value, time-series and vector data in a single engine, and queries it with SQL, Cypher, Apache Gremlin and GraphQL, plus MongoDB and Redis protocol compatibility. It ships a built-in Studio web workbench for modelling schema, running queries and browsing graphs. ArcadeDB is a conceptual fork of OrientDB and is released under the Apache License 2.0.

The image installs the official ArcadeDB server distribution (version 26.7.2 at build time) to /opt/arcadedb, running under OpenJDK 21. The ArcadeDB HTTP listener (Studio plus the REST API) is bound to loopback only and fronted by nginx on port 80, so the only public surface is a single standard HTTP port. Database storage lives on a dedicated EBS data volume mounted at /var/lib/arcadedb, independent of the OS disk and independently resizable. At first boot, arcadedb-firstboot.service generates a unique per-instance root password (there is no default login baked into the image), starts the server, seeds a small Demo graph, proves an authenticated round-trip against the HTTP API, and writes the password to /root/arcadedb-credentials.txt (mode 0600, root only).

What is included:

• ArcadeDB 26.7.2 server (full distribution, all query engines and Studio) from the official GitHub release, pinned and sha256 verified

• OpenJDK 21 JRE headless (ArcadeDB requires Java 17 or newer)

• arcadedb.service systemd unit running the server as the unprivileged arcadedb user

• arcadedb-firstboot.service systemd oneshot that generates the per-instance root password, starts the server, seeds the Demo graph and writes /root/arcadedb-credentials.txt

• nginx on port 80 reverse-proxying to the loopback-bound ArcadeDB HTTP listener, with an unauthenticated /healthz for load-balancer probes

• ArcadeDB Studio web UI, the multi-model query workbench, reachable at http://<instance-public-ip>/

• Database storage on a dedicated 30 GiB EBS data volume mounted at /var/lib/arcadedb, captured into the AMI so every instance is provisioned with it

• Ubuntu 24.04 LTS base with the latest security patches

Connecting to your instance

Connect over SSH on port 22 using the key pair you selected at launch. The login user depends on the OS variant you subscribed to:

ssh -i /path/to/your-key.pem ubuntu@<public-ip>

Both arcadedb.service and nginx.service are started automatically once arcadedb-firstboot.service has generated the per-instance root password on the first boot.

Prerequisites

• An AWS account and a subscription to the ArcadeDB listing on AWS Marketplace

• A VPC with a subnet, and an EC2 key pair in the target region

• A security group allowing inbound TCP 22 from your management IP and TCP 80 from your trusted client networks

Recommended instance type: m5.large (2 vCPU, 8 GB RAM) for production. t3.medium is fine for evaluation. For heavier graph and document workloads use a larger instance and raise the JVM heap in /etc/default/arcadedb (ARCADEDB_OPTS_MEMORY=-Xms1G -Xmx8G).

Step 1: Launch from the AWS Console

In the AWS Marketplace, subscribe to the ArcadeDB listing, then click Continue to Launch. Choose your instance type, VPC/subnet, key pair, and a security group that allows TCP 22 from your management IP and TCP 80 from your trusted client networks. The ArcadeDB HTTP listener is bound to loopback, so only nginx on port 80 is exposed. Do not expose port 80 to the public internet without a TLS-terminating reverse proxy in front.

Step 2: Launch from the AWS CLI

aws ec2 run-instances \
  --image-id <arcadedb-ami-id> \
  --instance-type m5.large \
  --key-name <your-key> \
  --security-group-ids <your-sg> \
  --subnet-id <your-subnet> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=arcadedb-01}]'

Step 3: Verify the ArcadeDB service

sudo systemctl is-active arcadedb.service nginx.service
sudo test -f /var/lib/cloudimg/arcadedb-firstboot.done && echo FIRSTBOOT_DONE

Both services should report active, and the first-boot sentinel should be present:

active
active
FIRSTBOOT_DONE

Step 4: Inspect the listeners and version

The ArcadeDB HTTP listener is bound to 127.0.0.1:2480 and nginx serves it on port 80. There is no open JMX or management port.

sudo journalctl -u arcadedb.service --no-pager | grep -E 'ArcadeDB Server started|Available query languages' | tail -2
sudo ss -tln | grep -E ':2480|:80 '

You will see ArcadeDB reporting its available query languages and the listeners on loopback 2480 and port 80:

Available query languages: [js, java, sql, sqlscript, opencypher, mongo, graphql, redis, cypher, gremlin]
ArcadeDB Server started in 'development' mode (CPUs=2 MAXRAM=1024.00MB)
LISTEN 0   511          0.0.0.0:80       0.0.0.0:*
LISTEN 0   1000  [::ffff:127.0.0.1]:2480       *:*

Step 5: Retrieve the root password

The per-instance root password is generated at first boot and stored in a root-only file:

sudo cat /root/arcadedb-credentials.txt

You will see the root user, the per-instance password, and the endpoint URLs:

ARCADEDB_ROOT_USER=root
ARCADEDB_ROOT_PASSWORD=<ARCADEDB_PASSWORD>
ARCADEDB_STUDIO_URL=http://<instance-public-ip>/
ARCADEDB_HTTP_API_URL=http://<instance-public-ip>/api/v1/
ARCADEDB_DEMO_DATABASE=Demo

Step 6: Query the HTTP REST API

ArcadeDB exposes a full REST API. Extract the password into a shell variable and run an authenticated query against the seeded Demo database:

PW=$(sudo grep '^ARCADEDB_ROOT_PASSWORD=' /root/arcadedb-credentials.txt | cut -d= -f2-)
curl -s -u "root:$PW" http://127.0.0.1/api/v1/databases
curl -s -u "root:$PW" -H 'Content-Type: application/json' -X POST http://127.0.0.1/api/v1/command/Demo \
  -d '{"language":"sql","command":"SELECT name, role FROM Person ORDER BY name"}'

The first call lists the databases (Demo); the second returns the three Person records from the sample graph:

{"version":"26.7.2 ...","user":"root","result":["Demo"]}
{"user":"root","result":[{"name":"Alice","role":"Engineer"},{"name":"Bob","role":"Designer"},{"name":"Carol","role":"Analyst"}]}

An unauthenticated request is refused with HTTP 401 and a wrong password with HTTP 403, so the API is never open without valid credentials.

Step 7: Open ArcadeDB Studio

ArcadeDB Studio is the built-in web workbench. Open http://<instance-public-ip>/ from your workstation (assuming the security group allows TCP 80 from your address). The sign-in page shows the multi-model overview and asks for a username and password:

Sign in with user root and the per-instance password from /root/arcadedb-credentials.txt. Studio connects to the Demo database and shows the Database Info panel with the seeded schema, Person vertices and Knows edges, plus the query editor:

Step 8: Run a query in Studio

Type a query into the editor, choose a language (SQL, Open Cypher, Gremlin, GraphQL, MongoDB and Redis are available), and press Run. The Table view shows the returned records:

Step 9: Browse the graph

Switch the result view to Graph to explore vertices and their relationships visually. The Demo graph shows the Person vertices connected by directed Knows edges, with a toolbar for redraw, select, crop, import and export:

Step 10: Multi-model query examples

ArcadeDB runs several query languages against the same data. Try Cypher against the Demo graph:

PW=$(sudo grep '^ARCADEDB_ROOT_PASSWORD=' /root/arcadedb-credentials.txt | cut -d= -f2-)
curl -s -u "root:$PW" -H 'Content-Type: application/json' -X POST http://127.0.0.1/api/v1/command/Demo \
  -d '{"language":"cypher","command":"MATCH (p:Person)-[:Knows]->(f:Person) RETURN p.name, f.name"}'

The response traverses the Knows relationships:

{"user":"root","result":[{"p.name":"Alice","f.name":"Bob"},{"p.name":"Bob","f.name":"Carol"},{"p.name":"Carol","f.name":"Alice"}]}

The same graph can be traversed with SQL (SELECT expand(out('Knows')) FROM Person) or with Gremlin (g.V().hasLabel('Person').out('Knows').values('name')). ArcadeDB also speaks the MongoDB and Redis wire protocols for document and key-value access.

Step 11: Server components

Step 12: Managing the ArcadeDB service

sudo systemctl status arcadedb.service --no-pager | head -6
sudo journalctl -u arcadedb.service --no-pager | tail -5

To restart the service after a configuration change, run sudo systemctl restart arcadedb.service.

Step 13: Security recommendations

• Rotate the root password in Studio (Security tab) or via the API, and store it in AWS Secrets Manager

• Keep the HTTP listener on loopback as shipped; expose only nginx on port 80, and put TLS in front of it (an Application Load Balancer, or nginx with a real certificate)

• Restrict the security group so port 80 only reaches trusted client networks, never the public internet without TLS

• Create per-application users and roles in the Security tab instead of using the root account for application traffic

• Back up the databases directory at /var/lib/arcadedb/databases, or snapshot the EBS data volume

• Patch the OS monthly with sudo apt-get update && sudo apt-get upgrade && sudo reboot

Step 14: Support and licensing

ArcadeDB is licensed under the Apache License 2.0. There are no per-node, per-CPU, or per-GB fees for the software. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by Arcade Data Ltd; ArcadeDB is a trademark of its respective owner and is used here only to describe the software included in the image.

cloudimg provides commercial support for this image separately from the upstream project.

• Email: support@cloudimg.co.uk

• Website: www.cloudimg.co.uk

• Support hours: 24/7 with guaranteed 24-hour response SLA

Need Help?

Our support team is available 24/7.

support@cloudimg.co.uk