Baby Buddy on AWS User Guide

Overview

This image runs Baby Buddy 2.9.2, the open source self-hosted web application for tracking a baby's daily activities and growth, on Ubuntu 24.04 LTS. Baby Buddy records feedings, sleep, diaper changes, tummy time, pumping, temperature and measurements, and presents them as an at-a-glance dashboard of cards, a chronological timeline and a set of reporting charts.

Baby Buddy is a Django application. It is served by gunicorn on the loopback address 127.0.0.1:8000 by design and is never exposed directly, run by an unprivileged babybuddy system account under a systemd service that starts it on boot and restarts it on failure. nginx is installed as a reverse proxy on port 80 that forwards requests to gunicorn, serves the static and media assets directly, and answers an unauthenticated /healthz endpoint for load-balancer probes.

Baby Buddy has its own built-in authentication, so the whole application sits behind a Django login. On the first boot of every deployed instance a one-shot service generates a fresh Django secret key and creates the admin account with a unique, randomly generated password, then writes it to /root/babybuddy-credentials.txt (mode 0600, readable only by root). Two instances launched from the same AMI never share a password, and no default admin/admin account ships in the image.

The persistent data - the SQLite database (db.sqlite3) and any uploaded media - lives under /var/lib/babybuddy on a dedicated, independently resizable EBS data volume kept separate from the operating system disk. A demo child with several weeks of sample entries ships so the dashboard, timeline and charts are populated the moment you sign in; you delete it and add your own child whenever you are ready.

The default security group for this listing opens port 22 (SSH) and port 80 (HTTP) only.

Prerequisites

• An AWS account subscribed to this product in AWS Marketplace.
• An EC2 key pair in your target region for SSH access.
• A security group allowing inbound TCP 22 (SSH) from your IP and TCP 80 (HTTP) from your users.
• Recommended instance type: m5.large or larger.

Connecting to your instance

SSH in as the default login user for your operating system variant, using the key pair you launched with.

Step 1 - Launch from the AWS Marketplace console

1. Open the product page in AWS Marketplace and choose Continue to Subscribe, then Continue to Configuration.
2. Select the software version and your AWS Region, then choose Continue to Launch.
3. Choose an instance type (m5.large or larger), your VPC subnet, the security group described above, and your EC2 key pair.
4. Launch the instance and wait for it to reach the running state with status checks passed.

Step 2 - Launch from the AWS CLI (alternative)

Replace the AMI id, key name, security group and subnet with your own values:

aws ec2 run-instances \
  --image-id ami-xxxxxxxxxxxxxxxxx \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --metadata-options "HttpTokens=required" \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=baby-buddy}]'

Step 3 - Retrieve the per-instance admin password

SSH into the instance and read the credentials file that first boot generated. It contains the URL, the admin username and the unique password for this instance:

sudo cat /root/babybuddy-credentials.txt

The BABYBUDDY_PASSWORD value is unique to this instance. Store it somewhere safe.

Step 4 - Sign in

Browse to the instance over HTTP and sign in with the admin username and the password from Step 3:

http://<instance-public-ip>/

After signing in you land on the dashboard, which is already populated from the pre-loaded demo child so you can see feedings, sleep, diaper changes and more at a glance.

The Timeline and each child's page show every tracked entry in chronological order, with tags, so patterns become easy to spot.

Step 5 - Change the admin password and add caregivers

For production use, change the generated password after your first sign-in. Open the User menu (top right) and choose Settings to update your profile, language, timezone and dashboard preferences, then use Change Password. You can add more caregiver accounts from the Users area.

Step 6 - Add your own child and remove the demo data

The image ships with one demo child so the dashboard is not empty on first launch. When you are ready:

1. Open the Children menu and choose Add Child to create your own child's profile.
2. Start recording real entries from the Activities and Measurements menus, or start a Timer for a live feeding or sleep session.
3. To remove the sample data, open the demo child from the Children list, choose Edit, then Delete Child - this removes the child and all of its sample entries.

Verifying the deployment

The two systemd services that make up the application should both be active:

systemctl is-active babybuddy.service nginx.service

The unauthenticated health endpoint served by nginx returns HTTP 200 and is safe to use for load-balancer and uptime probes:

curl -fsS -o /dev/null -w 'healthz: HTTP %{http_code}\n' http://127.0.0.1/healthz

A bundled helper proves the full login round-trip end to end - it confirms the dashboard requires authentication, that a wrong password is rejected, and that the per-instance admin password signs in successfully:

sudo bash /usr/local/sbin/babybuddy-verify-login.sh

It prints OK when the round-trip succeeds.

Data, configuration and services

• Application code: /opt/babybuddy/app (Django project), running in a dedicated Python virtual environment at /opt/babybuddy/venv.
• Database and media: /var/lib/babybuddy on the dedicated EBS data volume - the SQLite database is /var/lib/babybuddy/data/db.sqlite3 and uploads are under /var/lib/babybuddy/media.
• Environment file: /opt/babybuddy/babybuddy.env holds the per-instance Django secret key and host settings (written on first boot).
• Services: manage with systemctl - babybuddy.service (gunicorn) and nginx.service.

Because the data lives on its own EBS volume, you can grow it independently of the OS disk: expand the volume in the EC2 console, then grow the filesystem on the instance.

Backups

Baby Buddy stores everything in the single SQLite database on the data volume. Take a consistent copy with the bundled SQLite tooling, or simply snapshot the EBS data volume from the EC2 console. A simple file copy of the database to a backup location, for example:

sudo cp /var/lib/babybuddy/data/db.sqlite3 /your-backup-location/babybuddy-$(date +%F).sqlite3

For scheduled, off-instance backups, create an Amazon EBS snapshot of the data volume (or a Data Lifecycle Manager policy) so your history is protected independently of the instance.

Step 7 - Enable HTTPS (recommended for production)

Baby Buddy is served over plain HTTP on port 80 by default. For production, put it behind TLS. The simplest options are:

• Terminate TLS at an AWS Application Load Balancer or CloudFront in front of the instance, or
• Point a domain at the instance and obtain a free Let's Encrypt certificate with certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

The application already reads its trusted-origin settings from the environment and trusts the X-Forwarded-Proto header from nginx, so sign-in works correctly once TLS is terminated in front of it. Add your domain to CSRF_TRUSTED_ORIGINS in /opt/babybuddy/babybuddy.env if you front the instance with a custom hostname, then restart the service.

Support

24/7 technical support is included with this product. Email support@cloudimg.co.uk for help with deployment, first sign-in, adding children and caregivers, removing the demo data, TLS termination, backups, resizing the data volume, and software updates.