Media & Entertainment AWS

Flamenco 3.9.3 on AWS User Guide

Last updated: 2026-11-07 | Product: Flamenco 3.9.3 on Ubuntu 24.04 on AWS

Overview

This guide covers launching and verifying Flamenco 3.9.3 on Ubuntu 24.04 from cloudimg on Amazon EC2. It is one version of the cloudimg Hardened SRS Streaming Media Server & Media Servers AMIs listing on AWS Marketplace; you pick it as the software version when you subscribe and launch. The other media and streaming products in the listing are described on the listing's guide hub.

Flamenco is the free, open source render farm manager from Blender Studio (GPL-3.0-or-later). Artists submit render jobs from Blender through the Flamenco add-on; the Manager splits each job into tasks and hands them to Workers, the machines with Blender installed that do the rendering, and tracks progress, logs and the last rendered frame in its web interface. This image is the Manager. Workers are your own render machines (EC2 instances or studio hardware) that you point at it.

What is on the image:

Flamenco Manager 3.9.3, built on the image from the upstream v3.9.3 source with Go 1.26.10, with its web interface and the Blender add-on embedded
The Manager on 127.0.0.1:8080 only, behind nginx serving HTTPS on port 443 with a certificate created on your instance; port 80 redirects to HTTPS
A per-instance login (flamenco and a password generated on first boot) in front of the web interface and its API; Flamenco itself has no login
A separate per-instance worker URL for Workers and the Blender add-on, which cannot send that login
A ready configuration (SQLite database, job storage at /srv/flamenco/jobs with Shaman enabled) so the Manager opens on its dashboard, not the first-run setup assistant
flamenco-set-hostname (serve Flamenco under your own DNS name), flamenco-credentials --rotate (new password and worker URL) and flamenco-selftest (an end-to-end check)

Default user: ubuntu · Architecture: x86_64 · Root volume: 12 GiB gp3

Security posture

A login in front of Flamenco. Upstream Flamenco has no user accounts: anyone who can reach it can submit, change and delete jobs. Here nginx asks for HTTP basic authentication (user flamenco, a 32-character password generated on your instance) on the web interface and every API path, over HTTPS only. nginx keeps only a SHA-512 crypt hash of the password.
A secret URL for Workers. Flamenco Workers and the Blender add-on cannot send that login (a Worker sends its own per-worker secret in the Authorization header), so they use a separate address, https://<host>/farm/<token>/, with a 48-character token generated on your instance. A wrong or missing token gets 404, and the Worker API at the normal address gets 401. Anyone who holds the worker URL can submit jobs and register workers, so share it only with your render machines and artists, and rotate it with sudo flamenco-credentials --rotate.
Restrict port 443 to your own networks. The login and the worker URL protect Flamenco, but a render farm should not face the whole internet. Allow 443 (and 80) only from your own IP address or office CIDR and the subnets your Workers run in.
Dangerous endpoints refused. The first-run setup assistant and the server-side path and Blender checks (which probe the Manager's filesystem and run a program on it) are refused on every path. Through the worker URL the configuration file endpoint is refused too; the signed-in web interface keeps it for its Settings page.
Per-instance secrets. The login, the worker token and the TLS key are generated on first boot. The image ships with no TLS key, no database and no credentials, so no two instances share a secret.
Fails closed. nginx starts only after first boot has written this instance's TLS key and finished; if creating the key fails, first boot fails and nothing is served. The Manager starts only after first boot.
Only nginx faces the network. Exactly ports 22, 80 and 443 listen beyond loopback. The Manager runs as the unprivileged flamenco user under a systemd sandbox and may use only loopback addresses (IPAddressAllow=localhost), so even a configuration edit to a public listen address cannot be reached from outside. SSDP/UPnP autodiscovery is off: Workers are given the Manager URL.
HTTPS from first boot. nginx serves TLS 1.2 and 1.3 with a self-signed certificate created on your instance and sends Strict-Transport-Security. Requests for any other host name get their connection closed, and the instance's IP addresses redirect to the configured name.
The app cannot read instance metadata. The Manager, the first-boot unit and nginx are blocked from the instance metadata service by systemd IPAddressDeny; only the small unit that looks up the host name at first boot may use it.
Hardened SSH and system. SSH allows keys only, no root login and no X11 forwarding. The AMI requires IMDSv2. SSH host keys and the machine ID are generated fresh on every instance.

Prerequisites

An AWS account and permission to launch EC2 instances
An EC2 key pair in the Region you launch in
One or more render machines with Blender installed, and storage that the Manager and every Worker can reach at the same path (for example an Amazon EFS file system)

Recommended instance type: m5.large. The Manager itself is light; the rendering happens on the Workers.

Connecting to your instance

Version	Operating system	SSH user
Flamenco 3.9.3 on Ubuntu 24.04	Ubuntu 24.04 LTS	`ubuntu`

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick Flamenco 3.9.3 on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.large, your key pair, and a security group that allows TCP 22 (SSH), TCP 443 (the web interface, the API and the worker URL) and TCP 80 (redirects to HTTPS) from your own networks and your Workers' subnets only.

With the AWS CLI (replace the values in angle brackets):

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=flamenco-manager}]'

Step 2: Connect to your instance

ssh -i <your-key.pem> ubuntu@<public-ip>

The login message shows where the credentials are and how to rotate them.

Step 3: Check the services

First boot looks up the instance's name, creates the certificate, the login and the worker URL, then starts the Manager and nginx:

systemctl is-active flamenco-host flamenco-firstboot flamenco-manager nginx
sudo test -f /var/lib/cloudimg/flamenco-firstboot.done && echo FIRSTBOOT_DONE

All four units are active and the first boot marker is present:

active
active
active
active
FIRSTBOOT_DONE

Only SSH and nginx listen on public addresses; the Manager listens on loopback:

sudo ss -lntp | awk 'NR>1 {print $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort -u

0.0.0.0:22 users:(("sshd"),("systemd"))
0.0.0.0:443 users:(("nginx"),("nginx"),("nginx"))
0.0.0.0:80 users:(("nginx"),("nginx"),("nginx"))
127.0.0.1:8080 users:(("flamenco-manage"))
127.0.0.53%lo:53 users:(("systemd-resolve"))
127.0.0.54:53 users:(("systemd-resolve"))
[::]:22 users:(("sshd"),("systemd"))
[::]:443 users:(("nginx"),("nginx"),("nginx"))
[::]:80 users:(("nginx"),("nginx"),("nginx"))

Step 4: Find your URL, login and worker URL

First boot writes /root/flamenco-credentials.txt (mode 0600, root). These are the entries in that file (the secrets are not shown here):

sudo grep -E '^(FLAMENCO_URL|WEB_USERNAME)=' /root/flamenco-credentials.txt
sudo grep -oE '^[A-Z_]+=' /root/flamenco-credentials.txt
sudo stat -c '%a %U:%G %n' /root/flamenco-credentials.txt

FLAMENCO_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/
WEB_USERNAME=flamenco
FLAMENCO_URL=
WEB_USERNAME=
WEB_PASSWORD=
WORKER_MANAGER_URL=
600 root:root /root/flamenco-credentials.txt

Entry	What it is for
`FLAMENCO_URL`	The web interface, in your browser
`WEB_USERNAME` / `WEB_PASSWORD`	The login for the web interface and its API (`flamenco` and a 32-character password made on your instance)
`WORKER_MANAGER_URL`	`https://<host>/farm/<48-character token>/`: the Manager URL for Flamenco Workers and the Blender add-on

To read the password and the worker URL, run sudo cat /root/flamenco-credentials.txt in your own session and keep them in your password manager. The URL uses the instance's public DNS name from EC2 instance metadata (in us-east-1 it looks like the example above; in other Regions it is ec2-<public-ip-dashed>.<region>.compute.amazonaws.com). To serve Flamenco under your own DNS name, see Step 10.

Step 5: Check the Manager over HTTPS

Ask the Manager for its version through nginx with your login. The password is passed to curl on standard input, so it never appears in the process list or your shell history:

sudo bash -c '
  F=/root/flamenco-credentials.txt
  P=$(grep "^WEB_PASSWORD=" $F | cut -d= -f2-)
  H=$(grep "^FLAMENCO_URL=" $F | sed -E "s#^FLAMENCO_URL=https://([^/]+)/.*#\1#")
  V=$(printf "user = \"flamenco:%s\"\n" "$P" | curl -K - -sk --resolve "$H:443:127.0.0.1" "https://$H/api/v3/version")
  echo "$V"
  case "$V" in *\"version\":\"3.9.3\"*) echo LOGIN_OK ;; *) echo "unexpected answer"; exit 1 ;; esac
'

{"git":"6f0311ea","name":"Flamenco","shortversion":"3.9.3","version":"3.9.3"}
LOGIN_OK

Without the login, or with a wrong password, nginx refuses the request before it reaches Flamenco:

H=$(sudo grep '^FLAMENCO_URL=' /root/flamenco-credentials.txt | sed -E 's#^FLAMENCO_URL=https://([^/]+)/.*#\1#')
A=$(curl -sk -o /dev/null -w '%{http_code}' --resolve "$H:443:127.0.0.1" "https://$H/api/v3/version")
W=$(printf 'user = "flamenco:not-the-password"\n' | curl -K - -sk -o /dev/null -w '%{http_code}' --resolve "$H:443:127.0.0.1" "https://$H/api/v3/version")
echo "no login: HTTP $A"; echo "wrong password: HTTP $W"
[ "$A" = 401 ] && [ "$W" = 401 ] && echo REFUSED_OK

no login: HTTP 401
wrong password: HTTP 401
REFUSED_OK

The Manager opens on its dashboard, not the first-run setup assistant, with job storage under /srv/flamenco/jobs and Shaman on:

sudo bash -c '
  F=/root/flamenco-credentials.txt
  P=$(grep "^WEB_PASSWORD=" $F | cut -d= -f2-)
  H=$(grep "^FLAMENCO_URL=" $F | sed -E "s#^FLAMENCO_URL=https://([^/]+)/.*#\1#")
  printf "user = \"flamenco:%s\"\n" "$P" | curl -K - -sk --resolve "$H:443:127.0.0.1" "https://$H/api/v3/configuration"; echo
'

{"isFirstRun":false,"shamanEnabled":true,"storageLocation":"/srv/flamenco/jobs"}

Step 6: Open the web interface

Open the FLAMENCO_URL in your browser. The certificate is self signed, so your browser asks you to confirm it the first time (or install your own certificate, Step 10). Sign in as flamenco with the password from Step 4. The Jobs page lists every job with its tasks, their status and the worker that ran each one (this is the short test job the build ran):

The Flamenco Jobs page with a completed job, its settings and its two completed tasks

Workers lists the render machines that have registered, with their status and version. It is empty until you connect your first Worker (Step 8):

The Flamenco Workers page, empty before any Worker has registered

The gear icon opens the Manager's Settings, which edits /var/lib/flamenco/flamenco-manager.yaml. Keep the listening address at 127.0.0.1:8080 (nginx on 443 is the public face) and Auto Discoverable off:

The Flamenco Manager settings page, showing the database path and the loopback listening address 127.0.0.1:8080

The add-on link at the top right downloads the Blender add-on for this Manager.

Step 7: Shared storage

Flamenco needs one file system that the Manager and every Worker see at the same path: the Manager writes each job's files there and the Workers read the blend files and write the frames. On this image that path is /srv/flamenco, which ships empty. Mount your share there on the Manager and at the same path on every Worker, for example an Amazon EFS file system (with the amazon-efs-utils package installed):

sudo mount -t efs -o tls <file-system-id>:/ /srv/flamenco
echo '<file-system-id>:/ /srv/flamenco efs _netdev,tls 0 0' | sudo tee -a /etc/fstab
sudo chown flamenco:flamenco /srv/flamenco

Then restart the Manager so it recreates its jobs and file-store folders on the share: sudo systemctl restart flamenco-manager. If a Worker mounts the share at another path (Windows or macOS artists, for example), map it with a two-way variable in Settings > Variables; see the Flamenco documentation on shared storage.

Step 8: Connect render Workers

Workers are your own render machines with Blender installed (EC2 instances in the same VPC, or studio hardware over a VPN). Each one runs the Flamenco Worker 3.9.3 from flamenco.blender.org (use the same version as the Manager). Workers cannot send the web login, so they use the worker URL from Step 4. On each Worker, put this in flamenco-worker.yaml next to the flamenco-worker program, with your own WORKER_MANAGER_URL:

manager_url: https://<host>/farm/<token>/
task_types: [blender, ffmpeg, file-management, misc]

The Worker checks the Manager's certificate. With the self-signed certificate it must trust this instance's certificate: copy /etc/ssl/flamenco/flamenco.crt from the Manager to the Worker and either add it to the Worker's trusted certificates or, on Linux, start the Worker with SSL_CERT_FILE pointing at it:

SSL_CERT_FILE=/path/to/flamenco.crt ./flamenco-worker

A certificate from a public certificate authority for your own DNS name (Step 10) avoids this step on every machine. The Worker registers on its first start, appears on the Workers page and starts taking tasks. The web interface shows each Worker's address as 127.0.0.1, the nginx proxy that Workers connect through; the real address of every request is in /var/log/nginx/access.log, where the worker URL's token is masked as /farm/<token>/.

Check the worker URL from the Manager itself (it answers the API only, without the web login):

sudo bash -c '
  F=/root/flamenco-credentials.txt
  U=$(grep "^WORKER_MANAGER_URL=" $F | cut -d= -f2-)
  H=$(grep "^FLAMENCO_URL=" $F | sed -E "s#^FLAMENCO_URL=https://([^/]+)/.*#\1#")
  printf "url = \"%sapi/v3/version\"\n" "$U" | curl -K - -sk --resolve "$H:443:127.0.0.1"; echo
'

{"git":"6f0311ea","name":"Flamenco","shortversion":"3.9.3","version":"3.9.3"}

Step 9: Submit jobs from Blender

Download the add-on from the add-on link in the web interface (or https://<host>/flamenco-addon.zip with the login) and install it in Blender under Edit > Preferences > Add-ons > Install. In the add-on's preferences set Manager URL to your WORKER_MANAGER_URL and select Test Connection. The add-on, like the Workers, needs to trust the Manager's certificate (Step 8). Save your blend file inside the shared storage, then use the Flamenco panel in the Output properties to submit a render job. Its progress appears on the Jobs page and the newest frame on Last Rendered.

Step 10: Your own DNS name and certificate

Point a DNS record (for example render.example.com) at the instance's public or Elastic IP address, then tell the image to serve that name. It creates a new self-signed certificate for the name, pins nginx and the cross-site guard to it, updates both URLs in the credentials file and keeps the name across reboots:

sudo flamenco-set-hostname <your-domain>

Every Worker and the Blender add-on then need the new WORKER_MANAGER_URL. For a certificate your machines already trust, replace /etc/ssl/flamenco/flamenco.crt and /etc/ssl/flamenco/flamenco.key with one issued for that name by a public certificate authority and run sudo systemctl reload nginx.

Step 11: Security checks

The first-run setup assistant (which would let anyone reconfigure the Manager) is refused even with the login, a wrong worker token is not found, and the Worker API is refused outside the worker URL:

sudo bash -c '
  F=/root/flamenco-credentials.txt
  P=$(grep "^WEB_PASSWORD=" $F | cut -d= -f2-)
  H=$(grep "^FLAMENCO_URL=" $F | sed -E "s#^FLAMENCO_URL=https://([^/]+)/.*#\1#")
  S=$(printf "user = \"flamenco:%s\"\n" "$P" | curl -K - -sk -o /dev/null -w "%{http_code}" --resolve "$H:443:127.0.0.1" \
        -X POST -H "Content-Type: application/json" --data "{}" "https://$H/api/v3/configuration/setup-assistant")
  T=$(curl -sk -o /dev/null -w "%{http_code}" --resolve "$H:443:127.0.0.1" "https://$H/farm/$(printf "0%.0s" $(seq 48))/api/v3/version")
  R=$(curl -sk -o /dev/null -w "%{http_code}" --resolve "$H:443:127.0.0.1" \
        -X POST -H "Content-Type: application/json" --data "{}" "https://$H/api/v3/worker/register-worker")
  echo "setup assistant, signed in: HTTP $S"
  echo "wrong worker token: HTTP $T"
  echo "worker registration outside the worker URL: HTTP $R"
  [ "$S" = 403 ] && [ "$T" = 404 ] && [ "$R" = 401 ] && echo SECURITY_OK
'

setup assistant, signed in: HTTP 403
wrong worker token: HTTP 404
worker registration outside the worker URL: HTTP 401
SECURITY_OK

The certificate was created on this instance at first boot, so its fingerprint is different on every instance:

H=$(sudo grep '^FLAMENCO_URL=' /root/flamenco-credentials.txt | sed -E 's#^FLAMENCO_URL=https://([^/]+)/.*#\1#')
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -issuer -enddate -fingerprint -sha256

issuer=CN = ec2-<public-ip-dashed>.compute-1.amazonaws.com, O = cloudimg
notAfter=Feb  9 18:30:39 2029 GMT
sha256 Fingerprint=<unique to your instance>

The Manager, nginx and the first-boot unit cannot reach the instance metadata service, and the Manager may use loopback addresses only:

for u in flamenco-manager nginx flamenco-firstboot; do echo "$u: $(systemctl show -p IPAddressDeny --value $u)"; done
systemctl show -p IPAddressAllow --value flamenco-manager

flamenco-manager: ::/0 0.0.0.0/0
nginx: fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32
flamenco-firstboot: fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32
::1/128 127.0.0.0/8

Step 12: Self-test

flamenco-selftest checks the whole path over HTTPS through nginx: an anonymous client and a wrong password are refused, the web interface and the API answer the login, the setup assistant is refused, a wrong worker token is refused, and a probe Worker registers through the worker URL, signs on with its own secret, signs off and is removed again:

sudo flamenco-selftest

round-trip OK: Flamenco 3.9.3 at https://<host>/ (anonymous 401, wrong password 401, login 200); setup assistant 403; wrong worker token 404; probe worker registered through the worker URL, signed on (wrong secret 403), signed off 204 and removed (204)

Step 13: Configuration, rotation and upgrades

Configuration: the Manager reads /var/lib/flamenco/flamenco-manager.yaml (the Settings page edits it). After editing it by hand, run sudo systemctl restart flamenco-manager. Keep listen: 127.0.0.1:8080 and autodiscoverable: false.
Rotate the login and the worker URL: sudo flamenco-credentials --rotate makes a new password and a new worker token, updates the credentials file and reloads nginx. The old password and the old worker URL stop working at once; give every Worker and the Blender add-on the new WORKER_MANAGER_URL (Workers keep their registration).
Database: the jobs and Workers are in /var/lib/flamenco/data/flamenco-manager.sqlite. Back it up with the Manager stopped, or snapshot the volume.
Upgrades: OS packages update with sudo apt update && sudo apt upgrade. A new Flamenco release is a new software version of this listing; Workers and the Manager should run the same Flamenco version.

The installed build is recorded on the instance:

head -3 /opt/flamenco/VERSION

flamenco_version=3.9.3
flamenco_commit=6f0311eae5cf183132811da3d8941532c67b4f90
flamenco_source=https://projects.blender.org/studio/flamenco.git (tag v3.9.3)

Server components

Component	Version	Where
Flamenco Manager	3.9.3 (web interface and Blender add-on embedded)	`/opt/flamenco/flamenco-manager`, service `flamenco-manager` on `127.0.0.1:8080`
nginx	1.24.0 (Ubuntu)	HTTPS on 443, port 80 redirects; login file `/etc/nginx/flamenco.htpasswd`
Database	SQLite	`/var/lib/flamenco/data/flamenco-manager.sqlite`
Shared storage	your NFS/EFS share	`/srv/flamenco` (jobs in `/srv/flamenco/jobs`, Shaman store in `/srv/flamenco/file-store`)
TLS certificate	self signed, made on first boot	`/etc/ssl/flamenco/flamenco.crt`, key `/etc/ssl/flamenco/flamenco.key` (0600 root)
Credentials	made on first boot	`/root/flamenco-credentials.txt` (0600 root)
Helpers	cloudimg	`flamenco-set-hostname`, `flamenco-credentials`, `flamenco-selftest` in `/usr/local/sbin`
Operating system	Ubuntu 24.04 LTS	user `ubuntu`

Troubleshooting

The browser keeps asking for the login: use flamenco and the WEB_PASSWORD from /root/flamenco-credentials.txt. After flamenco-credentials --rotate the old password stops working.
A Worker or the add-on reports a certificate error: it does not trust the self-signed certificate; see Step 8, or install a certificate from a public certificate authority (Step 10).
A Worker gets 404: its manager_url is not the current WORKER_MANAGER_URL (for example after a rotation or flamenco-set-hostname).
Jobs fail with missing files: the shared storage is not mounted at /srv/flamenco on the Manager and the Worker (Step 7).
Nothing is served after launch: first boot failed and the image stays closed. Check sudo journalctl -u flamenco-host -u flamenco-firstboot and /var/log/cloudimg-firstboot.log.

Support and licensing

Flamenco is free software from Blender Studio under the GNU General Public License version 3 or later. The licence is in /opt/flamenco/LICENSE, and /opt/flamenco/SOURCE.txt explains how the Manager was built from the upstream v3.9.3 source and which files cloudimg changed (go.mod, go.sum and the web app's yarn.lock, raised to newer dependency releases with published security fixes). Flamenco and Blender are trademarks of the Blender Foundation; cloudimg is not affiliated with or endorsed by the Blender Foundation.

cloudimg supports this image (the configuration on top of Flamenco: nginx, the login, the worker URL, the first-boot units and the helpers) by email at support@cloudimg.co.uk. For Flamenco itself, see the Flamenco manual.