Storage AWS

Erugo File Transfer on AWS User Guide

| Product: Erugo Self-Hosted File Transfer

Overview

Erugo is an open-source file sharing and file transfer platform for teams who would rather not push client work, design assets or datasets through a public consumer service. You sign in, drag in the files you want to send, and Erugo hands you a single tidy link to pass on. Recipients need no account and no software: they open the link in a browser and download. Uploads are resumable, so a large transfer survives a dropped connection, and every share can carry an expiry date and an optional password.

The cloudimg image installs Erugo 0.2.15 with its Vue frontend compiled at build time, serves it over HTTPS with a per-instance self-signed certificate, runs the resumable-upload service and the background queue worker as managed systemd units, and keeps the application, its database and all uploaded content on a dedicated EBS data volume. A single administrator account is created during the build, and its password, along with the application key, the JWT signing secret and the TLS certificate, is regenerated uniquely on the first boot of every instance. Backed by 24/7 cloudimg support.

Erugo is a trademark of its respective owner. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by the Erugo project. It ships the free and open source, MIT-licensed self-hosted software, unmodified.

What is included:

  • Erugo 0.2.15 served over HTTPS on port 443 by nginx with a per-instance self-signed certificate, and an HTTP-to-HTTPS redirect on port 80
  • PHP 8.3 with php8.3-fpm, and SQLite as the metadata database, matching the configuration Erugo ships and tests upstream
  • erugo-tusd.service, the resumable-upload service, bound to loopback and reverse-proxied at /files/
  • erugo-queue.service, the queue worker that packages shares for download and sends notifications
  • erugo-scheduler.timer, which runs share expiry, cleanup and log pruning every minute
  • A dedicated EBS data volume at /var/www holding the application, the database and all uploaded files, independently resizable and separate from the OS disk
  • A single administrator account whose password, along with the application key, the JWT signing secret and the TLS certificate, is regenerated on the first boot of every instance
  • 24/7 cloudimg support

Prerequisites

An AWS account, an EC2 key pair in the target region, and a VPC with a subnet. m5.large (2 vCPU / 8 GiB RAM) is a good starting point; choose a larger size if many people will upload at once. Size the data volume for the volume of files you intend to hold. Security group inbound: allow 22/tcp from your management network, 443/tcp for the Erugo web interface, and 80/tcp for the HTTP-to-HTTPS redirect.

Connecting to your instance

Connect over SSH as the default login user for your operating system variant:

Variant SSH login user
Ubuntu 24.04 ubuntu

Step 1 - Subscribe and launch from AWS Marketplace

Open the product in AWS Marketplace, choose Continue to Subscribe, accept the terms, then Continue to Configuration. Pick the software version and your region, then Continue to Launch. Under Launch this software choose Launch through EC2, select an instance type (m5.large is recommended), your VPC and subnet, and your EC2 key pair. For the security group, allow SSH (22) from your management network, plus HTTPS (443) and HTTP (80). Launch the instance.

Step 2 - Launch from the AWS CLI

Subscribe in the AWS Marketplace console first, then launch the subscribed AMI. Replace the AMI id with the one shown on the Marketplace launch page for your region:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=erugo}]'

Step 3 - Connect to your instance

ssh ubuntu@<public-ip>

Step 4 - Confirm the Erugo stack is running

On first boot Erugo generates a fresh application key, a fresh JWT signing secret, a fresh administrator password and a per-instance TLS certificate, sets its public URL to your instance address (discovered via EC2 IMDSv2), and then starts the web stack. All four services report active:

systemctl is-active nginx php8.3-fpm erugo-tusd erugo-queue

The scheduler runs share expiry, cleanup and log pruning once a minute:

systemctl list-timers erugo-scheduler.timer --no-pager

The API health endpoint answers, and reports the configured maximum share size:

curl -sk https://127.0.0.1/api/health

Note that erugo-tusd listens on 127.0.0.1:8080 only. It is never exposed directly: nginx reverse-proxies it at /files/ so that resumable uploads travel over the same TLS connection as the rest of the application.

Step 5 - Retrieve the administrator password

The administrator account is unique to your instance. Its password is generated on first boot and written to a root-only file:

sudo cat /root/erugo-credentials.txt

The file contains the administrator e-mail address, a unique password, and the https://<public-ip>/ URL for your instance. No two cloudimg Erugo instances share a password, and no default credential ships in the image.

Step 6 - Sign in to Erugo

Browse to https://<public-ip>/ and accept the self-signed certificate warning, then sign in with the e-mail address and password from the credentials file.

The Erugo sign-in page, with the email and password fields and a Login button, served over HTTPS

Erugo is gated: there is no anonymous access to the application itself, and the first-run setup wizard that would otherwise let a passer-by claim the administrator account is already sealed in this image.

Step 7 - Send your first share

After signing in you land on the create-share view. Choose Add Files or Add Folders, give the share a name and an optional message for the recipient, and set how long the link should live. The running total against your maximum share size is shown as you add files.

The Erugo create-share view with Add Files and Add Folders buttons, a share name and recipient message field, an expiry selector and the upload area

Press Upload to start the transfer. Uploads run through the resumable-upload service, so if a connection drops mid-transfer you can select the same files again and Erugo continues from where it stopped rather than starting over. When the upload finishes, Erugo generates the share link. Copy it and send it to your recipient, who needs no account to download. If you add recipients by e-mail instead of taking a link, Erugo mails them the link for you once you have configured SMTP under System settings.

Step 8 - Administer your instance

Administrators reach the full management surface from the settings menu: System settings covers the application name, the login message, share limits and expiry defaults, SMTP, authentication and database backups.

The Erugo System settings admin panel showing General settings including the application name, application URL, login message and default language, with a left-hand nav for Shares, Notifications, SMTP, Auth and Database Backups

Users lists every account, with actions to add a user, edit, view their shares, reset a password or delete. Self registration is disabled by default, so only accounts you create can sign in. My Shares and All Shares list what has been sent, with per-share download counters, expiry and deletion dates, and actions to expire a share immediately or extend it. Branding & UI and Email templates let you theme the instance and customise notification e-mails.

The Erugo Users admin panel showing the user table with the administrator account, the account type and created date, an Add User button and per-user Edit, View shares, Reset password and Delete actions

Data on the dedicated data volume

The application, the SQLite metadata database and every uploaded file live on the dedicated EBS data volume mounted at /var/www, separate from the OS disk and independently resizable:

df -h /var/www
findmnt -no SOURCE,TARGET,FSTYPE /var/www

Uploaded content is held under /var/www/erugo/storage/app, and the database is at /var/www/erugo/database/database.sqlite. Back up the volume with an EBS snapshot, or take an application-level database backup:

sudo -u www-data php /var/www/erugo/artisan back-up-database

Replacing the self-signed certificate

The image ships a certificate generated uniquely on your instance's first boot, so no private key is shared between instances. Browsers still warn on it because it is self-signed. For production, install a certificate for your own domain:

sudo cp <your-domain>.crt /etc/nginx/ssl/erugo.crt
sudo cp <your-domain>.key /etc/nginx/ssl/erugo.key
sudo chmod 0600 /etc/nginx/ssl/erugo.key
sudo nginx -t && sudo systemctl reload nginx

Point a DNS record at your instance's public IP first, then update Erugo's own URL so that the share links it generates use your domain rather than the IP address:

sudo sed -i 's|^APP_URL=.*|APP_URL=https://files.<your-domain>|' /var/www/erugo/.env
sudo -u www-data php /var/www/erugo/artisan config:clear

Maintenance

Erugo's scheduled jobs run automatically, but each can also be run on demand:

sudo -u www-data php /var/www/erugo/artisan clean-expired-shares
sudo -u www-data php /var/www/erugo/artisan prune-logs
sudo -u www-data php /var/www/erugo/artisan maintain-db

The maximum share size, default and maximum expiry, upload modes, branding and SMTP are all configured from System settings in the web interface rather than from configuration files.

The OS receives unattended security updates. Apply the latest packages and reboot if the kernel changed:

sudo apt-get update && sudo apt-get upgrade -y

Support

cloudimg provides 24/7 support for this image. Contact support@cloudimg.co.uk with your AWS account ID and instance ID.