Lowdefy Low-Code Web Stack on AWS User Guide

Overview

This guide covers the deployment and configuration of Lowdefy on AWS using cloudimg AWS Marketplace AMIs. Lowdefy is an open source, config-first low-code web stack: you describe pages, a rich library of UI blocks, data connections and requests, and the logic that ties them together in a single declarative lowdefy.yaml configuration file, and Lowdefy compiles that configuration into a production web application. It is a fast way to build internal tools, admin panels, CRUD interfaces, dashboards and business applications without hand-writing a frontend, from configuration that is easy to review, version-control and generate.

The cloudimg image ships the free and open source, Apache-2.0-licensed Lowdefy stack. At build time the Lowdefy CLI compiles the official starter application into a production Next.js server, which is captured into the AMI so your instance starts serving in seconds. Because Lowdefy has no built-in login of its own, the appliance protects the app with an nginx reverse proxy that adds HTTP Basic authentication, and nothing ships with a known secret: a per-instance administrator password and a per-instance application signing secret are generated for each instance on its first boot and written to a root-only credentials file. Backed by 24/7 cloudimg support.

Lowdefy is a trademark of its respective owner. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by the Lowdefy project. It ships the free and open source Apache-2.0-licensed software.

What is included:

• Lowdefy 5.5.0 (the Apache-2.0-licensed config-first low-code stack), with the official starter app pre-built into a Next.js production server
• Node.js 22 LTS and the built Lowdefy/Next.js server under /opt/lowdefy/.lowdefy/server, bound to the loopback interface only
• nginx as a reverse proxy on port 80, adding HTTP Basic authentication in front of the app, with a static /healthz liveness path that needs no auth
• lowdefy.service, nginx.service and a one-shot lowdefy-firstboot.service as systemd units, enabled on boot
• A per-instance administrator password and a per-instance application signing secret generated on first boot, never baked into the image
• No default login and no shipped secret: the app binds to loopback only and every proxied path requires Basic auth
• Ubuntu 24.04 LTS base with latest security patches applied at build time
• 24/7 cloudimg support

Prerequisites

• An active AWS account and an EC2 key pair in your target region
• A subscription to the Lowdefy listing on AWS Marketplace
• A VPC and subnet, and a security group allowing inbound 22/tcp (SSH, from your admin network) and 80/tcp (the web app, from the networks that use it)

Recommended instance type: m5.large (2 vCPU, 8 GB RAM) is a sensible starting point. Lowdefy compiles to a Next.js server that is lightweight to serve, so a general-purpose instance is ample; scale up for heavier applications or higher concurrency.

Connecting to your instance

Connect over SSH as the default login user for your operating system variant. The private key is the EC2 key pair you selected at launch.

ssh -i /path/to/your-key.pem ubuntu@<public-ip>

Retrieving your per-instance credentials

Lowdefy has no built-in login, so the app is protected by nginx HTTP Basic authentication. On the first boot of each instance, a unique administrator password is generated and written, together with the resolved URL, to a root-only file. Retrieve it over SSH:

sudo cat /root/lowdefy-credentials.txt

LOWDEFY_URL=http://<instance-public-ip>/
LOWDEFY_USERNAME=admin
LOWDEFY_PASSWORD=<admin-password>
NOTE=Open LOWDEFY_URL in a browser and sign in with LOWDEFY_USERNAME and LOWDEFY_PASSWORD.

The password is unique to this instance and is never baked into the image. Keep this file protected; it is readable by root only.

Signing in

Browse to http://<instance-public-ip>/ and your browser will prompt for HTTP Basic authentication. Enter the username admin and the password from the credentials file. The official Lowdefy starter application then renders in your browser.

The starter ships three pages you can navigate from the header menu: a welcome page, a getting-started page and a capabilities page. They demonstrate Lowdefy blocks (cards, results, buttons, paragraphs) rendered from configuration.

The security model

• The Lowdefy/Next.js server binds to 127.0.0.1:3000 only; it is never exposed directly.
• nginx on port 80 is the only public entry point. Every application path requires HTTP Basic authentication against /etc/nginx/.lowdefy_htpasswd.
• A static /healthz path returns 200 without authentication for load-balancer and monitoring liveness probes; it exposes no application content.
• A per-instance LOWDEFY_SECRET (the application signing secret) is generated on first boot into /etc/lowdefy/lowdefy.env (root-only) and is never baked into the image.

You can confirm the running state over SSH:

systemctl is-active lowdefy nginx
sudo ss -tlnp | grep -E ':80 |:3000 '

active
active
LISTEN 0  511  127.0.0.1:3000  0.0.0.0:*  users:(("next-server (v1",pid=6796,...))
LISTEN 0  511    0.0.0.0:80     0.0.0.0:*  users:(("nginx",pid=6807,...))

Changing the Basic-auth password

To set your own administrator password, or add another user, use htpasswd:

sudo htpasswd /etc/nginx/.lowdefy_htpasswd admin

The change takes effect immediately; nginx reads the file on each request.

Building your own application

The whole application is defined in /opt/lowdefy/lowdefy.yaml. To build your own low-code app you edit that file, rebuild with the Lowdefy CLI, then restart the service:

sudo -i
cd /opt/lowdefy
# edit lowdefy.yaml to define your pages, blocks, connections and requests
lowdefy build
systemctl restart lowdefy

lowdefy build compiles the configuration into the production Next.js server under /opt/lowdefy/.lowdefy/server; restarting lowdefy.service serves the new build. Lowdefy provides a rich block library, an operator and event system for logic, connections and requests to databases and APIs, theming, and optional authentication providers. See the Lowdefy documentation for the full block and connection reference.

Enabling HTTPS

For production use, terminate TLS in front of the instance. Two common options:

• AWS Application Load Balancer with an ACM certificate, forwarding to the instance on port 80. This is the simplest managed option and integrates with AWS WAF.
• A certificate directly on nginx using Certbot. Point a DNS record at the instance, then install a certificate and let Certbot edit the nginx server block:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Restrict the security group so that only your load balancer (or trusted networks) can reach the instance on port 80.

Managing the services

# Status
systemctl status lowdefy nginx

# Restart the app after editing and rebuilding
sudo systemctl restart lowdefy

# View application logs
journalctl -u lowdefy -f

The build details: Node.js v22.23.1, nginx 1.24.0, and the Lowdefy CLI 5.5.0 producing a Next.js production server. The application, its configuration and the built server all live on the OS disk and are captured into the AMI.

Support

cloudimg provides 24/7 technical support for this product by email and live chat, with a one-hour average response for critical issues. Our engineers help with deployment, TLS termination, application configuration, connecting data sources and scaling.

• Email: support@cloudimg.co.uk
• Live chat: available 24/7

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.