Comentario on AWS User Guide

Overview

Comentario is a fast, flexible and powerful free comment server for web pages, a privacy-focused, self-hosted alternative to hosted commenting services. A single Go service serves both the embeddable comments widget you drop into any site and a full Angular administration UI, backed by PostgreSQL. The cloudimg image runs Comentario directly on TCP 80 as a dedicated non-root service user, with PostgreSQL as the datastore bound to loopback, and generates a unique owner and administrator login on the first boot of every instance. Backed by 24/7 cloudimg support.

What is included:

• Comentario 3.17 as a single self-contained Go binary at /usr/bin/comentario, with its Angular frontend at /usr/lib/comentario/frontend
• The Comentario service on :80, running as the dedicated non-root comentario system user (with CAP_NET_BIND_SERVICE to bind the privileged port)
• PostgreSQL as the datastore, bound to 127.0.0.1 only, on a dedicated EBS data volume mounted at /var/lib/postgresql
• Per-instance owner/superuser and PostgreSQL passwords generated at first boot, in a root-only file - the image ships with an empty database and no working credentials
• comentario.service and postgresql.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and inbound ports 80 (and 443 once you enable HTTPS) from the networks that will load your comment widget and reach the admin UI
• The AWS CLI version 2 installed locally if you plan to deploy from the command line
• Outbound internet access from the instance for package updates and the embed widget

m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type - Comentario is lightweight, so a smaller type also works for low-traffic sites.

Connecting to your instance

Connect over SSH on port 22 as the default login user for your OS variant:

The examples below use ubuntu; substitute your variant's user from the table.

Step 1: Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for Comentario. Select the cloudimg listing, choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialisation - database setup, secret rotation and owner creation - completes within about a minute of the instance state becoming Running and the status checks passing.

Step 2: Launch the Instance from the AWS CLI

The following block launches an instance from the cloudimg Comentario Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --associate-public-ip-address \
  --metadata-options 'HttpTokens=required' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=comentario}]'

Step 3: Connect to your instance

ssh -i /path/to/<key-name>.pem ubuntu@<instance-public-ip>

Step 4: Confirm the services are running

systemctl is-active comentario.service postgresql.service
curl -s -o /dev/null -w 'instance config: HTTP %{http_code}\n' http://127.0.0.1/api/config

Both services report active and the public instance-config endpoint returns HTTP 200, which confirms the Comentario service and PostgreSQL are serving:

active
active
instance config: HTTP 200

Step 5: Retrieve your owner login

The instance owner account and the PostgreSQL password are generated uniquely on the first boot of your instance and written to a root-only file. Read it with:

sudo cat /root/comentario-credentials.txt

The comentario.owner.email and comentario.owner.pass values are your sign-in for the administration UI - the owner is a Comentario superuser (instance administrator). The PostgreSQL password is rotated at the same time and never shared between instances. You can confirm the file is present and root-only without printing the secrets:

test -f /root/comentario-credentials.txt && echo "credentials file present, mode 0$(stat -c '%a' /root/comentario-credentials.txt)"
grep -c '^comentario.owner' /root/comentario-credentials.txt

credentials file present, mode 0600
2

Step 6: First sign-in

Open a web browser and navigate to http://<instance-public-ip>/. Comentario redirects to its sign-in page. Enter the comentario.owner.email and comentario.owner.pass from the credentials file, then select Sign in.

The Comentario sign-in, served on first boot with a per-instance owner login.

Step 7: The administration dashboard

After signing in you land on the dashboard, which summarises domains, pages, comments and commenters, with a comment-activity chart over the last 30 days. The left-hand navigation gives you Domains, Users, Configuration and your account. As the instance owner you are a superuser with full administrative control.

The Comentario administration dashboard with per-instance statistics.

Step 8: Add your first domain and embed the widget

Select Domains, then New domain, and enter the host of the website you want to add comments to (for example blog.example.com). Comentario registers the domain and gives you a small snippet of HTML to embed. Paste the <script> and <comentario-comments> tags into your page template where you want the comment thread to appear, pointing the script at your instance. Readers can then comment on that page.

The domains manager - as a superuser you see and manage every domain on the instance.

Step 9: Moderate comments

Open Comments under a domain to read and moderate every thread from one place. Approve, reject or delete comments, work through the pending-moderation queue, and see comment scores from voting. Markdown, threaded replies and multiple sign-in options are supported out of the box.

The comments view - approve, reject or delete, with a pending-moderation queue and comment scores.

Step 10: Per-domain settings

Each domain has its own settings: comment sorting, voting, RSS feeds, Markdown options (images, links, tables), moderation rules and authentication providers. Open a domain and select Edit to configure how comments behave on that website.

Per-domain settings for comment behaviour, moderation and authentication.

Step 11: Instance configuration

Under Configuration you manage instance-wide dynamic settings - registration and email-confirmation policy, default comment behaviour and integrations - which apply across every domain unless overridden per domain.

Instance-wide dynamic configuration, applied across domains.

Step 12: Prove the owner login through the API

Comentario is API-driven: its own frontend signs in through POST /api/auth/login, which is XSRF-protected exactly as a browser expects (seed the XSRF-TOKEN cookie, echo it in the X-Xsrf-Token header, and send an Origin matching the instance base URL). From an SSH session on the instance you can prove the round trip with the per-instance owner password:

CREDS=/root/comentario-credentials.txt
EMAIL=$(grep '^comentario.owner.email=' "$CREDS" | cut -d= -f2-)
PASS=$(grep '^comentario.owner.pass=' "$CREDS" | cut -d= -f2-)
HOST=$(grep '^BASE_URL=' /etc/comentario/comentario.conf | sed -E 's#^BASE_URL=https?://##; s#/.*$##')
JAR=$(mktemp)
curl -s -o /dev/null -c "$JAR" http://127.0.0.1/api/config
TOK=$(awk '$6=="XSRF-TOKEN"{print $7}' "$JAR")
curl -s -o /dev/null -w 'owner login: HTTP %{http_code}\n' -b "$JAR" \
  -H "X-Xsrf-Token: $TOK" -H "Origin: http://$HOST" -H 'Content-Type: application/json' \
  -d "{\"email\":\"$EMAIL\",\"password\":\"$PASS\"}" http://127.0.0.1/api/auth/login
rm -f "$JAR"

An owner login: HTTP 200 response confirms the API accepts the generated owner credentials:

owner login: HTTP 200

Step 13: Confirm the runtime and security posture

The Comentario package version, the dedicated non-root service user, and the loopback-only PostgreSQL with the open :80:

dpkg-query -W -f='${Package} ${Version}\n' comentario
id comentario
ss -tlnp | grep -E ':80 |:5432 '

comentario 3.17.0
uid=997(comentario) gid=987(comentario) groups=987(comentario)
LISTEN 0  200  127.0.0.1:5432  0.0.0.0:*
LISTEN 0  4096         *:80          *:*

Comentario listens on all interfaces on port 80, while PostgreSQL is bound to loopback only.

Enabling HTTPS

For any production deployment serve Comentario over HTTPS so logins and comments cannot be intercepted. Terminate TLS with a reverse proxy such as nginx or Caddy in front of Comentario, or use an Application Load Balancer with an ACM certificate. The following installs nginx and certbot and assumes a DNS record pointing your fully qualified domain name at the instance's public IP, and port 443 open in the security group:

sudo apt-get update && sudo apt-get install -y nginx certbot python3-certbot-nginx
# Proxy nginx :443 -> Comentario, then rebind Comentario to loopback:
sudo sed -i 's|^HOST=.*|HOST=127.0.0.1|; s|^PORT=.*|PORT=8080|; s|^BASE_URL=.*|BASE_URL=https://comments.your-domain.example/|' /etc/comentario/comentario.conf
sudo certbot --nginx -d comments.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example --redirect
sudo systemctl restart comentario

Setting BASE_URL to your HTTPS domain is important: Comentario validates the request Origin against it, and generated links and the embed widget use it.

Backup and maintenance

Comentario keeps all of its state - domains, pages, users, comments and configuration - in PostgreSQL, on the dedicated /var/lib/postgresql EBS volume. Back it up regularly:

sudo -u postgres pg_dump comentario > <backup-dir>/comentario-db-$(date +%F).sql

Ship the dump to Amazon S3 or another object store, and consider EBS snapshots of the data volume. Ubuntu's unattended-upgrades is enabled by default; keep the OS patched with sudo apt update && sudo apt upgrade. To upgrade Comentario, install a newer release package and restart the service - database migrations run automatically on start. See https://docs.comentario.app.

Support

This image is backed by 24/7 cloudimg support. Contact us by email and chat for help with deployment, embedding the widget, integrations, upgrades, TLS termination and database administration. Guaranteed response within 24 hours, one hour average for critical issues. Contact support@cloudimg.co.uk.

For general Comentario questions consult the documentation at https://docs.comentario.app. Comentario is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.