Dashy Self-Hosted Dashboard on AWS User Guide

Overview

Dashy is a popular open source, self-hosted dashboard for your homelab, servers and applications. It brings all of your links, apps and bookmarks together on one customizable start page, organised into sections with icons, themes, search, keyboard shortcuts, live status checks and a built-in visual editor for changing the layout from the browser. The cloudimg image builds Dashy from source at a pinned stable release and ships it secure by default: Dashy binds to the loopback interface only and is fronted by an nginx reverse proxy that terminates TLS and enforces HTTP basic authentication on every request, with a unique admin credential generated on each instance's first boot. Backed by 24/7 cloudimg support.

What is included:

• Dashy 4.4.5 built from source into /opt/dashy, run as the unprivileged dashy system user by dashy.service on the Node.js runtime, bound to 127.0.0.1:4000
• An nginx reverse proxy on :443 that terminates TLS (a self-signed certificate regenerated per instance on first boot) and enforces HTTP basic authentication, with :80 redirecting to HTTPS
• A per-instance admin credential minted on first boot; only its bcrypt hash is written to /etc/nginx/dashy.htpasswd, and the plaintext is placed in a root-only note at /root/dashy-credentials.txt
• An unauthenticated /healthz endpoint for load-balancer health checks, plus a protected config-save endpoint
• A round-trip self-test at /usr/local/bin/dashy-selftest that proves the appliance end to end
• 24/7 cloudimg support

Prerequisites

An AWS account, an EC2 key pair in the target region, and a VPC with a public subnet. m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type. Security group inbound: allow 22/tcp from your management network for SSH, and 443/tcp (and 80/tcp for the HTTPS redirect) for the dashboard.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace, choose Continue to Launch, and launch through the EC2 console or the AWS CLI. Select the m5.large instance type, your key pair, and a security group that opens ports 22, 80 and 443.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <security-group-id> \
  --subnet-id <subnet-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=dashy}]'

Step 2 - Connect to your instance

Connect over SSH as the default login user for the OS variant you launched. This listing may ship more than one OS variant; use the matching login user below.

Step 3 - Confirm the services are running

Dashy runs behind nginx, with a one-shot first-boot service that mints the per-instance credential and TLS certificate. Confirm the two long-running services are healthy:

systemctl is-active dashy.service nginx.service

Both report active.

Step 4 - Verify the stack and endpoints

Confirm the baked Dashy version, that the dashboard is bound to the loopback interface only, that the unauthenticated health probe answers, and that the dashboard itself refuses anonymous access:

cat /opt/dashy/VERSION
ss -tln | grep 4000
curl -sk -o /dev/null -w 'healthz: HTTP %{http_code}\n' https://127.0.0.1/healthz
curl -sk -o /dev/null -w 'unauthenticated dashboard: HTTP %{http_code}\n' https://127.0.0.1/

Dashy is bound to 127.0.0.1:4000 only, /healthz returns 200, and the dashboard returns 401 because nginx enforces basic authentication on every path.

Step 5 - Read your per-instance admin credential

The image ships no shared or default login. On first boot a unique admin credential is generated for this instance; only its bcrypt hash is stored on the server, and the plaintext is written to a root-only file. Read it (and confirm the file permissions and the resolved URL):

sudo stat -c '%a %U:%G' /root/dashy-credentials.txt
sudo grep -E '^DASHY_(USER|URL)=' /root/dashy-credentials.txt

The file is 600 root:root, DASHY_USER is your admin username, and DASHY_URL is the HTTPS address to open in your browser. Run sudo cat /root/dashy-credentials.txt to also see the password.

Step 6 - Prove the appliance end to end

A bundled self-test exercises the whole appliance over TLS: the unauthenticated health probe, that anonymous access and the config-save endpoint are refused, that the authenticated dashboard renders, and that a known configuration item loads.

sudo /usr/local/bin/dashy-selftest

It prints OK dashy self-test passed: ....

Step 7 - Open the dashboard

Browse to https://<instance-public-ip>/ (the value of DASHY_URL). The certificate is self-signed per instance, so your browser shows a one-time warning; accept it, then sign in with the admin username and password from the credentials file. The dashboard loads with the cloudimg starter configuration: a Getting Started section linking to this guide and the Dashy docs, and an Example Services section to replace with your own.

Step 8 - Theme, layout and options

Click the Options icon (top right) to change the theme, switch between the grid, list and column layouts, adjust the item size, or jump between the default, minimal and workspace views. Everything is applied instantly from the browser, with nothing to edit on disk.

Step 9 - Customize with the built-in visual editor

From Options, choose Config, then the Edit Config tab, to edit the dashboard's YAML directly in the browser with live validation. Add your own sections and items - each with a title, description, icon and URL - and Dashy validates the document as you type. Save it back to the instance to make the change permanent.

You can also edit the configuration file on the instance directly at /opt/dashy/user-data/conf.yml and apply it with sudo systemctl restart dashy.

Maintenance

• Configuration: the dashboard configuration lives at /opt/dashy/user-data/conf.yml. Edit it there or through the built-in editor, then restart Dashy with sudo systemctl restart dashy.
• Credential: the per-instance admin credential is in /root/dashy-credentials.txt. To rotate it, generate a new password and write it into the basic-auth file with sudo /usr/local/sbin/dashy-write-htpasswd admin <new-password>.
• TLS: the image serves HTTPS with a self-signed certificate generated per instance. For production, place your own domain and a CA-signed certificate in front of the instance, or replace the certificate in /etc/nginx/tls.
• Status checks and widgets: enable Dashy's live status checks and widgets by adding them to your configuration; see the Dashy documentation at https://dashy.to/docs.
• Restart: sudo systemctl restart dashy.service nginx.service if you need to bounce the stack.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.

This image packages the open source Dashy software (MIT License) for convenient deployment on AWS. cloudimg is not affiliated with, endorsed by, or sponsored by the Dashy project.