ArozOS Cloud Desktop and File Platform on AWS User Guide

Overview

This image runs ArozOS, a self hosted web desktop operating system and cloud file platform. Open the instance in a browser and you get a complete desktop environment, with a start menu, a task bar and draggable windows, running over a virtual file system that you own. Its core is a drag and drop File Manager for uploading, organising, previewing and sharing files, alongside a built in text and code editor, media streaming, and a per user static web server. ArozOS is multi user from the ground up, with accounts, permission groups and storage quotas, and optional built in FTP, WebDAV, SFTP and TFTP file servers.

ArozOS is installed from the official prebuilt Go binary at /usr/local/bin/arozos and runs as a systemd service that serves the web desktop directly on port 8080. There is no external database: ArozOS uses an embedded key value store. All runtime state, the web assets, the account store, the device identity, the per instance file server host key and every user's files, lives on a dedicated, independently resizable EBS data volume mounted at /opt/arozos.

The image is secure by default and ships with no user account. Because the account store is empty, the first person to reach the web desktop is served the first run create administrator form and chooses their own username and password, so two instances launched from the same Amazon Machine Image never share a login and no default credential ships. The official ArozOS release archive contains a fixed private key that every installation otherwise reuses as its built in file server host key; this image removes that shared key entirely and generates a fresh, stronger key on the first boot of each instance.

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and port 8080 for the web desktop, scoped to your own IP address
• The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Step 1: Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for ArozOS. Select the cloudimg listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group that opens port 22 from your management network and port 8080 scoped to your own IP address for the web desktop. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass.

Step 2: Launch the Instance from the AWS CLI

The following block launches an instance from the cloudimg ArozOS Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 8080 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=arozos}]'

Step 3: Connecting to Your Instance

Connect over SSH on port 22 as the default login user for your operating system variant. The login user is listed per variant in the table below.

Replace <public-ip> with the public IP address of your instance and your-key.pem with your EC2 private key file.

ssh -i your-key.pem ubuntu@<public-ip>

Step 4: Reach the Web Desktop and Create Your Administrator

The ArozOS web desktop is served on port 8080. In a browser, open http://<instance-public-ip>:8080/. Because the account store ships empty, ArozOS serves its first run create administrator form: choose your own username and password and select Create.

An informational note with the resolved desktop URL is written on the first boot of every instance. It contains no password (you set the administrator password yourself on the create administrator form) and is readable only by the root user. Retrieve it over SSH:

sudo cat /root/arozos-credentials.txt

You will see the resolved web desktop URL for this instance:

# ArozOS on Ubuntu 24.04 LTS (cloudimg AWS Marketplace image)
# SECURE BY DEFAULT: no user account ships with this image.
# Create the first administrator on first visit at the URL below.

arozos.url=http://<instance-public-ip>:8080/

Important: the create administrator form is open to whoever reaches port 8080 first. Scope the inbound security group rule for port 8080 to your own IP address, and complete the create administrator form immediately after the instance boots.

Step 5: Sign In

Once your administrator account exists, ArozOS presents the sign in page. Enter your username and password and select Sign In.

Step 6: The Web Desktop

After signing in you land on the ArozOS web desktop, with desktop icons for the File Manager, System Settings and Trash Bin, a start menu in the bottom left corner, and a task bar. Double click an icon to open its application in a draggable window.

Step 7: The File Manager

Open the File Manager to work with your files. Upload and download files, create folders, and share items using the toolbar. The sidebar lists your storage pools, including your personal space (user:/). Everything you store here lives on the dedicated data volume.

Step 8: Users, Groups and System Settings

Open System Settings to administer the server. From here an administrator manages Users and Groups, storage quotas and permission groups, Disk and Storage, Network and Connection, and Security and Auth. The Host Info tab shows the server specifications.

To add a user, open Users and Groups, create the account, assign it to a permission group, and optionally set a storage quota. Each user receives their own private file space and a shareable public space.

Step 9: Built In File Servers

ArozOS can expose the same storage over FTP, WebDAV, SFTP and TFTP for desktop clients and legacy devices. These servers are disabled by default and are enabled by an administrator from the settings interface. If you enable the SFTP server, it uses the fresh per instance RSA 4096 host key that this image generated on first boot, so it is not the shared key that ships in the upstream release. Open the relevant port in your security group only when you enable a server, and scope it to the clients that need it.

Step 10: The Data Volume

The ArozOS working directory at /opt/arozos is a dedicated EBS data volume. It holds the web assets, the embedded account and settings store, the device identity, the per instance file server host key and every user's files, so your data is independently resizable and survives instance replacement. Confirm the volume is mounted:

findmnt /opt/arozos

TARGET      SOURCE       FSTYPE OPTIONS
/opt/arozos /dev/nvme1n1 ext4   rw,relatime

Check its free space:

df -h /opt/arozos

Step 11: Verify the Service

ArozOS runs as the arozos systemd service. Confirm it is active and healthy:

systemctl is-active arozos.service

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1:8080/system/id/ping

The health endpoint returns HTTP 200. You can inspect service logs with journalctl:

sudo journalctl -u arozos.service -n 30 --no-pager

Step 12: Enabling HTTPS

ArozOS can terminate TLS itself. To serve the desktop over HTTPS, provide a certificate and key and restart the service with the -tls, -cert and -key flags. If you want a publicly trusted certificate, obtain one for your own domain (for example with certbot) and point the flags at the issued files, then open port 443 in your security group scoped to your clients.

Backup and Maintenance

Because all state lives under /opt/arozos, backing up ArozOS means backing up that volume. Take periodic EBS snapshots of the data volume, or copy /opt/arozos to object storage. The operating system base is fully patched at build time with unattended security upgrades enabled, so the instance keeps receiving OS security updates.

Support

This image is provided by cloudimg with 24/7 technical support by email and chat. We can help with deployment, user and permission group management, storage quotas, the built in FTP, WebDAV and SFTP file servers, mounting additional storage, enabling TLS, and backing up the data volume.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.