OliveTin Safe Web Automation on AWS User Guide

Overview

This image runs OliveTin 3000.17.1, an open source, self-hosted web interface that turns a curated set of predefined shell commands into safe, one-click buttons. Instead of handing people SSH access to run ad hoc commands, an administrator defines a vetted set of actions in a single YAML file, and users click to run them and watch the live output stream back to the page. It is a natural fit for home labs and operations teams who want to let less technical users safely trigger routine jobs from a browser or a phone.

Because every button runs a real shell command on the server, an OliveTin that is reachable without authentication is, in effect, remote command execution. The cloudimg image is built around that fact and is secure by default. OliveTin runs bound only to the loopback interface and is fronted by nginx on port 443, terminating TLS and enforcing HTTP Basic authentication. The administrator password is a unique value generated on first boot for each instance and written to a root-only file. No credential is baked into the image, and no two deployments share one.

What is included:

• OliveTin 3000.17.1 installed from the official vendor package, running as a dedicated non-root olivetin service bound to 127.0.0.1:1337
• nginx on port 443 terminating TLS with a per-instance self-signed certificate, enforcing HTTP Basic authentication, redirecting port 80 to HTTPS, and serving an unauthenticated /healthz endpoint for load-balancer probes
• Spoof-proof identity forwarding: nginx authenticates the request and passes the identity to OliveTin as headers, so a request that reaches the loopback port without the proxy header is treated as an unauthenticated guest and denied
• A one-shot olivetin-firstboot.service that regenerates the TLS certificate, generates a per-instance administrator password on first boot, and writes it to /root/olivetin-credentials.txt (mode 0600)
• A small set of safe, non-destructive sample actions so the dashboard is usable immediately
• A dedicated EBS data volume mounted at /var/lib/olivetin for the runtime's state and logs
• A fully patched Ubuntu 24.04 LTS base with unattended security upgrades enabled
• 24/7 cloudimg support

OliveTin is published by the OliveTin project under the GNU Affero General Public License version 3. This image is packaged by cloudimg and is not affiliated with or endorsed by the OliveTin project.

Prerequisites

An AWS account, an EC2 key pair in the target region, and a VPC with a public subnet. m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type; OliveTin itself is light, so smaller types work for low-traffic use. Security group inbound: allow 22/tcp from your management network for SSH and 443/tcp for the web UI (80/tcp is optional and only redirects to HTTPS). OliveTin serves HTTPS with a per-instance self-signed certificate; for production or shared access, terminate TLS in front of it with your own domain using a reverse proxy or an Application Load Balancer.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace, then launch an instance from the AMI with your key pair, a public subnet, and the security group described above. Leave the default root volume; the image also attaches a small dedicated data volume for OliveTin's state.

Step 2 - Connect to your instance

Connect over SSH as the default login user for the OS variant you launched, using your key pair.

The instance login banner (MOTD) prints the web URL, the health-check URL, and where to find your credentials.

Step 3 - Read your unique administrator credential

The administrator password is generated on this instance's first boot and stored in a root-only file. Read it with:

sudo cat /root/olivetin-credentials.txt

You will see the per-instance values, for example:

olivetin.url=https://<instance-public-ip>
olivetin.admin_user=admin
olivetin.admin_password=<unique-per-instance-password>

This password is unique to this instance and is not baked into the image. Keep it safe. You can rotate it at any time with sudo htpasswd -B /etc/nginx/olivetin.htpasswd admin.

Step 4 - Confirm the secure-by-default posture from the command line

Before opening a browser, you can confirm from the shell that OliveTin is not reachable unauthenticated and is bound only to the loopback interface:

# Unauthenticated request to the web UI is refused (expect 401)
curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/

# The unauthenticated health endpoint is available for load balancers (expect 200)
curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/healthz

# OliveTin listens on the loopback interface only, never 0.0.0.0
sudo ss -tlnp | grep 1337

The first command returns 401, the second 200, and the listener shows 127.0.0.1:1337 - the reverse proxy is the only network-facing surface.

Step 5 - Sign in to the web UI

Open https://<instance-public-ip>/ in your browser. Because the certificate is a per-instance self-signed certificate, your browser will warn about it the first time - accept it to proceed (or install your own certificate for production). Sign in with the admin username and the password from Step 3.

You will land on the Actions dashboard, where each shipped sample action is a button:

The shipped safe actions are Check disk usage, Show memory usage, Show system uptime, Ping a host (constrained to a fixed allow-list of hosts), and Restart demo service (a controlled privileged example granted through a single-command sudoers rule).

Step 6 - Run an action and read its live output

Click an action - for example Check disk usage. OliveTin runs its predefined shell command and streams the output back to the page in real time, showing the run duration and a completed or failed status:

Every button runs exactly the command defined for it in the configuration - there is no free-form command entry in the shipped actions, so there is no command-injection surface.

Step 7 - Review the execution log

The Logs view lists every action that has been executed, with its timestamp, the user who ran it, and its status - a searchable audit trail of who ran what and when:

Step 8 - Add your own actions

OliveTin's actions are defined in a single YAML file at /etc/OliveTin/config.yaml. To add your own action, edit that file with your preferred editor (for example sudo nano /etc/OliveTin/config.yaml), add an entry under actions:, then restart OliveTin with sudo systemctl restart olivetin.

A minimal action looks like this:

actions:
  - title: Show running containers
    id: docker_ps
    shell: docker ps
    icon: box
    onclick: execution-dialog
    timeout: 15

Security guidance. Every action is a real shell command run as the unprivileged olivetin user. Treat the OliveTin login as the only thing standing between an action button and shell execution on the server. When you add actions:

• Prefer fixed choices for any argument rather than free-form input, so a user cannot inject arbitrary commands
• Keep the reverse proxy authentication in place and use a strong password (or wire OliveTin's header authentication to your own identity provider)
• Grant privileged actions through a narrow sudoers rule scoped to exactly the command you intend, as the shipped Restart demo service action does - never blanket root
• Ship only the actions you actually need

Managing the services

# Service status
systemctl status olivetin nginx

# Restart after editing the config
sudo systemctl restart olivetin

# Follow the logs
journalctl -u olivetin -f

Troubleshooting

• Browser certificate warning: expected - the image ships a per-instance self-signed certificate. Accept it, or replace /etc/nginx/tls/olivetin.crt and /etc/nginx/tls/olivetin.key with your own and reload nginx.
• 401 when signing in: confirm the password from /root/olivetin-credentials.txt; it is unique per instance. Rotate it with sudo htpasswd -B /etc/nginx/olivetin.htpasswd admin.
• An action shows a non-zero exit: the command it runs failed - check the live output in the execution dialog and the journalctl -u olivetin logs.
• Health check: curl -sk https://<instance-public-ip>/healthz returns ok without authentication, for load balancers.

Support

cloudimg provides 24/7 technical support for this image by email and live chat at support@cloudimg.co.uk - deployment, terminating TLS with your own domain and certificate, authoring and safely constraining your own actions, wiring OliveTin's header authentication to your own identity provider, and integrating actions with your operational tooling.