Applications AWS

Nightscout CGM Remote Monitor on AWS User Guide

| Product: Nightscout CGM Remote Monitor

Overview

Nightscout (the cgm-remote-monitor project) is a widely used open source, self hosted continuous glucose monitoring (CGM) remote monitor. It lets people with diabetes, their families and their care teams store and visualise glucose data in real time through a live web dashboard and a documented REST API, so readings from a sensor can be followed from any browser or shared with remote caregivers.

The cloudimg image installs Nightscout natively (no Docker), pinned to release 15.0.7:

  • The Node.js application is pre built (its client bundle produced by the project's own webpack build) and managed by nightscout.service on 127.0.0.1:1337.
  • MongoDB 7.0 Community runs bound to 127.0.0.1 with authorization enabled, its data directory on a dedicated EBS data volume mounted at /var/lib/nightscout.
  • nginx serves the dashboard on port 80 and reverse proxies it to the application, with an unauthenticated /healthz endpoint for load balancer probes.

Secure by default, no default login: there is no baked credential. On first boot a nightscout-firstboot.service oneshot generates a unique API secret (Nightscout's shared passphrase that gates all write and administrative access) and a unique MongoDB database credential, writes them to /root/nightscout-credentials.txt (readable only by root), starts the stack, then disables itself. Access is denied by default (AUTH_DEFAULT_ROLES=denied): the dashboard and API are not readable or writable until the API secret is presented. MongoDB is never exposed to the network.

What is included:

  • Nightscout cgm-remote-monitor 15.0.7 installed natively on Ubuntu 24.04 LTS
  • MongoDB 7.0 Community, loopback only, authorization enabled, on a dedicated data volume
  • The Node application under systemd and the dashboard served by nginx
  • A fully patched OS with unattended security upgrades enabled
  • 24/7 cloudimg support

Not a medical device. Nightscout is a project of the Nightscout Foundation and is provided for informational purposes only. It is not a medical device, is not intended to diagnose, treat, cure or prevent any disease, and does not replace professional medical advice or a prescribed monitoring device. Always confirm treatment decisions with a fingerstick and your care team.

Connecting to your instance

Connect over SSH as the default login user for your operating system variant:

OS variant SSH login user
Ubuntu 24.04 ubuntu 
ssh ubuntu@<public-ip>

Step 1: Launch the instance

  1. Subscribe to the Nightscout listing in AWS Marketplace and choose Launch.
  2. Pick an instance type with at least 2 vCPUs and 8 GB RAM. The recommended type is m5.large.
  3. Under the security group, allow inbound 80 (dashboard) and 22 (SSH) from the addresses you will manage the instance from. Add 443 if you enable HTTPS.
  4. Launch, then wait for the instance to reach a running state. First boot provisions the database, generates the per instance API secret and database credential, and brings the dashboard up.

You can also launch from the CLI:

aws ec2 run-instances \
  --image-id <nightscout-ami-id> \
  --instance-type m5.large \
  --key-name <your-key> \
  --security-group-ids <sg-with-22-and-80> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=nightscout}]'

Step 2: Verify the services are running

SSH in and confirm the four managed units are active:

systemctl is-active mongod nightscout nightscout-firstboot nginx

mongod active
nightscout active
nightscout-firstboot active
nginx active

Only the dashboard is exposed to the network. MongoDB and the Node application listen on loopback only:

sudo ss -tlnp | grep -E ':(80|1337|27017)\b'

LISTEN 127.0.0.1:1337 node
LISTEN 127.0.0.1:27017 mongod
LISTEN 0.0.0.0:80     nginx

The MongoDB data directory is on the dedicated data volume:

df -h /var/lib/nightscout

/dev/nvme1n1     20G  302M   19G   2% /var/lib/nightscout

Step 3: Secure by default, no credential ships

The upstream project runs unauthenticated unless you set an API secret; this image is locked down and generates its own on first boot. Retrieve the per instance secret (root only):

sudo cat /root/nightscout-credentials.txt

NIGHTSCOUT_URL=http://<your-public-ip>/
NIGHTSCOUT_API_SECRET=<unique-24-char-secret>
MONGO_APP_PASSWORD=<unique-mongodb-password>

No shared password, database user or pre seeded record exists in the image. MongoDB is bound to loopback with authorization enabled:

grep -E 'bindIp|authorization|dbPath' /etc/mongod.conf

  dbPath: /var/lib/nightscout/mongodb
  bindIp: 127.0.0.1
  authorization: enabled

Step 4: Open the dashboard and authenticate

Browse to http://<your-public-ip>/. Because access is denied by default, Nightscout presents a device authentication dialog. Enter the NIGHTSCOUT_API_SECRET from Step 3 to unlock the dashboard.

The Nightscout device authentication dialog asking for the API secret or token before any data can be read; the dashboard and REST API are denied by default until the per instance secret is presented

Once authenticated, the dashboard shows the current glucose value, a trend arrow and a live chart of readings over time, with a selectable time window (2, 3, 4, 6, 12 or 24 hours).

The Nightscout glucose dashboard showing the current value, trend arrow and a live chart of continuous glucose monitoring readings across a time axis, with an hours selector

Step 5: Review reports

The built in reporting suite turns the stored readings into clinical views: day to day, daily stats, distribution, percentile charts, weekly distribution, calibrations, treatments and more. Open it from Reports (/report/).

The Nightscout reporting page with tabs for day to day, week to week, daily stats, distribution, hourly stats, percentile chart, calibrations, treatments and profiles, plus a date range picker and a Show button

Step 6: Configure a treatment profile

The Profile Editor holds the clinical settings Nightscout uses for its calculations and plugins: target range, insulin activity duration (DIA), insulin to carb ratio, sensitivity, timezone and units. A default profile is created automatically; edit it to match the care team's settings.

The Nightscout profile editor showing general profile settings, database records, and stored profile fields such as timezone, duration of insulin activity and insulin to carb ratio

Step 7: Connect a CGM uploader

CGM uploaders and follower apps push readings to Nightscout's REST API. They authenticate by sending SHA1 of the API secret as the api-secret HTTP header (they never send the secret in plain text). Compute the hash your uploader needs:

printf '%s' 'YOUR_API_SECRET' | sha1sum

Common clients and where to enter the details:

  • xDrip+ (Android): Settings, Cloud Upload, Nightscout Sync (REST-API), then enter https://YOUR_API_SECRET@<your-host>/api/v1/.
  • AndroidAPS / Loop: configure the Nightscout URL and API secret in the app's Nightscout settings.
  • Spike (iOS) and other uploaders: enter the site URL and the API secret.

You can verify the API end to end from the shell. An unauthenticated write is rejected, an authenticated write is stored, and it reads back:

SECRET=$(sudo grep '^NIGHTSCOUT_API_SECRET=' /root/nightscout-credentials.txt | cut -d= -f2-)
H=$(printf '%s' "$SECRET" | sha1sum | cut -d' ' -f1)
TS=$(date +%s%3N)
# Authenticated write of a sample sensor glucose value
curl -s -H "api-secret: $H" -H 'Content-Type: application/json' \
  -X POST http://127.0.0.1/api/v1/entries.json \
  --data "[{\"type\":\"sgv\",\"sgv\":137,\"date\":$TS,\"direction\":\"Flat\",\"device\":\"guide\"}]"
# Read it back
curl -s -H "api-secret: $H" 'http://127.0.0.1/api/v1/entries.json?count=1'

Step 8: The runtime stack

The appliance manages four systemd units. Understanding them helps with day to day operation:

  • mongod.service — MongoDB 7.0 Community, bound to 127.0.0.1, authorization enabled, data directory on the dedicated volume at /var/lib/nightscout/mongodb.
  • nightscout-firstboot.service — a oneshot that runs once on the first customer boot: it creates the per instance MongoDB user, generates the API secret, writes /etc/nightscout/nightscout.env and the root only credentials file, then hands off to the app and disables itself via a sentinel.
  • nightscout.service — the Node application (node lib/server/server.js) running as the unprivileged nightscout system user on 127.0.0.1:1337, gated so it never starts before the per instance secret exists.
  • nginx.service — the reverse proxy on port 80 with the unauthenticated /healthz endpoint.

Installed versions on this image:

Nightscout 15.0.7   Node.js v22.23.1   npm 10.9.8
MongoDB v7.0.39     nginx 1.24.0

Step 9: Add a custom domain and HTTPS

Nightscout derives its base URL from the request host, so it works by public IP or your own domain with no rebuild. To serve it over HTTPS:

  1. Point a DNS A record at the instance's public IP.
  2. Open port 443 in the security group.
  3. Install a certificate with Certbot:
sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example

Certbot edits the nginx server block and reloads it. Renewals run automatically via the packaged systemd timer.

Managing the services

# Status and logs
systemctl status nightscout
journalctl -u nightscout -e

# Restart the app or the database
sudo systemctl restart nightscout
sudo systemctl restart mongod

# Reload nginx after editing the site config
sudo nginx -t && sudo systemctl reload nginx

Source code and licence

Nightscout / cgm-remote-monitor is free software licensed under the GNU Affero General Public License, version 3 (AGPL-3.0). This image ships the unmodified upstream 15.0.7 release. The corresponding source code is available from the upstream project at github.com/nightscout/cgm-remote-monitor. Because the AGPL covers network use, if you modify Nightscout and let others interact with your modified version over the network, you must offer them the modified source under the same licence.

Support

Every cloudimg image includes 24/7 support. If you have any questions about deploying or operating this image, contact the cloudimg team through the details on your AWS Marketplace listing. Nightscout is a trademark of its respective owner; use of it here is nominative and does not imply affiliation or endorsement.