Excalidraw on AWS User Guide

Overview

This image runs Excalidraw, the open source virtual whiteboard for sketching hand-drawn-like diagrams. It provides an infinite canvas with a distinctive hand-drawn aesthetic, a rich set of shapes, arrows, text and freehand drawing tools, a reusable shape library and real time collaboration.

The Excalidraw single page frontend is built from source at the v0.18.1 release and served as a static bundle by nginx. Real time collaboration is provided by the bundled excalidraw-room collaboration server, a stateless socket.io broadcast server that runs as a dedicated unprivileged excalidraw system account under a systemd service that starts it on boot and restarts it on failure, bound to the loopback interface only. The application lives at /var/lib/excalidraw, which is a dedicated, independently resizable EBS data volume.

Excalidraw ships with no built in authentication, so the whole site is published behind an nginx reverse proxy on port 80 with HTTP Basic authentication. nginx serves the static whiteboard and proxies the collaboration WebSocket (the /socket.io/ path) to the room server on loopback. The admin password is generated on the first boot of every deployed instance, so two instances launched from the same Amazon Machine Image never share a password. It is written to /root/excalidraw-credentials.txt with mode 0600 so that only the root user can read it.

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and port 80 for the whiteboard
• The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Step 1: Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for Excalidraw. Select the cloudimg listing and choose Select, then Continue on the subscription summary.

Pick an instance type of t3.medium or larger. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group that opens port 22 from your management network and port 80 for the whiteboard. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass.

Step 2: Launch the Instance from the AWS CLI

The following block launches an instance from the cloudimg Excalidraw Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.medium \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=excalidraw}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name from the EC2 console or with aws ec2 describe-instances.

Step 3: Connect to Your Instance

Connect over SSH using your key pair and the login user for your operating system variant.

ssh -i <key-name>.pem ubuntu@<public-ip>

Step 4: Retrieve the Admin Password

The Excalidraw admin password is unique to your instance and was generated on first boot. Read it as root:

sudo cat /root/excalidraw-credentials.txt

The file lists the whiteboard URL, the admin user (admin) and the generated password. Keep this password somewhere safe.

Step 5: Sign In to the Whiteboard

The Excalidraw whiteboard is served on port 80 by nginx behind HTTP Basic authentication. In a browser, go to:

http://<instance-public-ip>/

You are prompted for credentials. Sign in as admin with the password from the credentials file. The Excalidraw canvas loads ready to draw.

Use the tool palette at the top to draw rectangles, diamonds, ellipses, arrows, lines, freehand strokes and text. Select, move, group, align, lock and restyle elements with the left and right side panels. Pan with space-drag or the scroll wheel and zoom with the on-canvas controls.

Open the library panel to keep reusable items and drag them onto the canvas. Build flowcharts and wireframes by connecting shapes with bound arrows that stay attached as you move things around.

Your drawings are kept locally in your browser. Use the main menu to save the scene to a .excalidraw file or to export the canvas to PNG or SVG at any time.

Step 6: Confirm Excalidraw Is Running

Over SSH, confirm the collaboration server and the nginx proxy are active and that the ports are listening:

sudo systemctl is-active excalidraw-room nginx
sudo ss -tlnp | grep -E ':(80|3002) '

You should see both services reported as active, the collaboration server listening on 127.0.0.1:3002 (loopback only), and nginx listening on port 80.

Step 7: Real Time Collaboration

Excalidraw supports live multiplayer drawing through the bundled collaboration server. In the editor, open the main menu and choose Live collaboration, then start a session. Excalidraw generates a shareable room link; send it to your teammates.

Everyone who opens the link (and signs in with the same admin credentials) joins the same room. The collaboration server relays drawing updates and live cursors between everyone in the room in real time. The room server is stateless and self hosted on this instance, so your boards are broadcast only through your own appliance. nginx proxies the collaboration WebSocket on the same port 80 (the /socket.io/ path) behind the same HTTP Basic credentials.

You can confirm the collaboration server is reachable through the proxy from the instance itself. Run curl -s -u admin:PASSWORD 'http://127.0.0.1/socket.io/?EIO=4&transport=polling' | head -c 80; echo over SSH, replacing PASSWORD with the generated admin password from /root/excalidraw-credentials.txt.

A short socket.io handshake payload containing a session id (sid) confirms the proxy reaches the room server.

Step 8: The Data Volume

The Excalidraw application lives on a dedicated EBS volume mounted at /var/lib/excalidraw. It holds the built static frontend bundle and the collaboration server. This keeps the application off the operating system disk and lets you resize or snapshot it independently. Confirm the mount with:

df -h /var/lib/excalidraw

To grow the volume, expand the EBS volume in the AWS console, then grow the filesystem on the instance with sudo resize2fs on the underlying device.

Step 9: Enable HTTPS

The whiteboard is served over plain HTTP on port 80 by nginx. For production use, place it behind TLS. Obtain a certificate for your domain (for example with a managed certificate on an Application Load Balancer in front of the instance, or with Certbot installed on the instance), then configure nginx to listen on 443 with your certificate, serving the same static bundle and proxying the /socket.io/ WebSocket to 127.0.0.1:3002 exactly as the bundled site does for port 80, keeping the HTTP Basic authentication in place. Restrict the security group so ports 80 and 443 are reachable only from the networks that use the whiteboard.

Step 10: Backup and Maintenance

The Excalidraw application is content free at rest: your drawings live in your browser, not on the server, so there is no server side board database to back up. Export important boards to .excalidraw, PNG or SVG from the editor. Snapshot the /var/lib/excalidraw EBS volume if you want to preserve the built application and any custom configuration. Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade and reboot when a new kernel is installed; the collaboration server and nginx start automatically on boot.

Support

This image is published and supported by cloudimg. Support covers deployment, the collaboration server, the authenticating proxy, TLS termination, custom shape libraries and reverse proxy and DNS configuration. Contact cloudimg through the support channel listed on the AWS Marketplace listing.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.