Plik on AWS User Guide

Overview

This image runs Plik, an open source, self-hosted temporary file upload and sharing service. Users upload one or more files through a clean web interface or the HTTP API, choose how long the files should live, and receive short shareable links that expire automatically. Optional one-shot links that self-destruct after a single download, password-protected uploads, streaming uploads that are never written to disk, and markdown comments make Plik a flexible replacement for emailing large attachments or standing up ad hoc file drops.

Plik is installed from the official prebuilt release, pinned to version 1.4.2 (github.com/root-gg/plik, MIT licensed) - the plikd server binary and the compiled web frontend, with no source build and no runtime interpreter. The server (plikd) binds to loopback only (127.0.0.1:8080) and is fronted by nginx, which terminates TLS on port 443 and is the sole network-facing surface. HTTPS is load-bearing here: API tokens and shared files must never cross the wire in plaintext. Both plik.service and nginx.service are managed by systemd and start automatically on boot.

The image is secure by default. Plik normally allows open anonymous uploads; this image sets FeatureAuthentication="forced" so that every upload requires a valid account or API token and anonymous uploads are rejected. Open self-registration is impossible - Plik 1.4.2 has no local-registration route and never auto-creates accounts, and no OAuth provider is configured, so local users can only be created by an administrator. On the first boot of every deployed instance, a one-shot service creates a fresh administrator account with a random password and an API token, regenerates a per-instance self-signed TLS certificate, and writes the credentials to /root/plik-info.txt (mode 0600, root only). Two instances launched from the same AMI never share an administrator password, API token or certificate, and no credentials, users or files are baked into the image.

The SQLite metadata database (plik.db) and the uploaded file store (files/) live under /var/lib/plik, on a dedicated EBS data volume separate from the operating system disk, so the data tier can be resized independently.

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users will reach Plik on
• The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Step 1: Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for Plik. Select the cloudimg listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at the default size or larger; the data volume is attached automatically.

Select Launch instance. First-boot initialisation takes well under a minute after the instance state becomes Running and the status checks pass.

Step 2: Launch the Instance from the AWS CLI

The following block launches an instance from the cloudimg Plik Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80, and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options 'HttpTokens=required,HttpEndpoint=enabled' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=plik}]'

Connecting to Your Instance

Connect over SSH using the default login user for the operating system variant you launched. Replace <instance-public-ip> with the public IP address or DNS name shown in the EC2 console, and <key.pem> with the path to your private key.

Step 3: Retrieve Your Per-Instance Credentials

The administrator account and API token are generated uniquely on the first boot of your instance and written to a root-only file. Read them over SSH:

sudo cat /root/plik-info.txt

The file contains the web URL, the admin login (admin) and password, and the API token. Keep it secret - anyone with the API token can upload to your instance. Confirm the installed version and that both services are running:

sudo cat /opt/plik/VERSION
systemctl is-active plik nginx

You should see plik 1.4.2 and both services reported as active.

Step 4: Verify the Security Model from the Command Line

Confirm that the Plik server is bound to loopback only and that nginx is the sole network-facing listener on ports 80 and 443:

sudo ss -tlnp | grep -E ':(80|443|8080)\b'

plikd listens on 127.0.0.1:8080 (loopback only), while nginx listens on 0.0.0.0:80 and 0.0.0.0:443. Now confirm that anonymous uploads are rejected - authentication is forced, so an unauthenticated upload request returns an error:

curl -ks -o /dev/null -w '%{http_code}\n' -X POST https://127.0.0.1/upload -H 'Content-Type: application/json' -d '{}'

This returns 400, and the response body reads anonymous uploads are disabled. Every upload must present the per-instance account or API token.

Step 5: Sign in to the Web Interface

Browse to https://<instance-public-ip>/ over HTTPS. The TLS certificate is self-signed and generated uniquely for your instance, so your browser will warn about it until you install a certificate from a real certificate authority (see Bring Your Own Domain and Certificate below). Because authentication is forced, you are taken straight to the sign-in page.

Sign in with the login admin and the password from /root/plik-info.txt. After signing in you land on the upload page, where you can drag in files, choose upload options - one-shot self-destruct, streaming, removable, end-to-end encryption, password and comment - and set an expiration up to the configured maximum.

Select Upload to create the share. Plik generates a short share link to send to recipients and a separate admin URL for managing the upload, shows when the share expires, and offers actions to download a zip archive, show a QR code, add more files or delete the upload.

Step 6: Script Uploads with the API Token

The API token lets you upload from scripts and pipelines without the browser. The block below creates an upload, adds a file to it, and downloads the file back to prove the round-trip. It reads the token from your credentials file; replace <your-plik-token> with the PLIK_API_TOKEN value from /root/plik-info.txt.

TOKEN='<your-plik-token>'
echo 'hello from cloudimg' > /tmp/plik-demo.txt
UPID=$(curl -ksf -X POST -H "X-PlikToken: $TOKEN" -H 'Content-Type: application/json' https://127.0.0.1/upload -d '{}' | jq -r .id)
FJSON=$(curl -ksf -X POST -H "X-PlikToken: $TOKEN" -F "file=@/tmp/plik-demo.txt" https://127.0.0.1/file/$UPID)
FID=$(echo "$FJSON" | jq -r .id); FNAME=$(echo "$FJSON" | jq -r .fileName)
curl -ksf -H "X-PlikToken: $TOKEN" "https://127.0.0.1/file/$UPID/$FID/$FNAME"

The final command prints hello from cloudimg, downloaded back through the share link - a full authenticated upload and download round-trip over TLS. The plik command line client is also bundled under /opt/plik/clients for scripted uploads with a friendlier interface.

Step 7: Manage Your Account and Review Statistics

From the admin menu in the web interface you can review your account configuration - maximum file size, maximum user size, default and maximum time to live - and your usage statistics, and manage your API tokens under the Tokens tab.

The Dedicated Data Volume

The SQLite metadata database and all uploaded files live under /var/lib/plik, on a dedicated EBS volume separate from the operating system disk. You can confirm the layout:

df -h /var/lib/plik

Because the data tier is on its own volume, you can resize it independently of the root disk, and snapshot it for backups. To back up Plik, snapshot this EBS volume or copy /var/lib/plik/plik.db and /var/lib/plik/files/ while the service is stopped.

Bring Your Own Domain and Certificate

The image ships with a per-instance self-signed certificate so the service is encrypted from the first request. For production, put Plik behind a real domain and a certificate from a trusted authority. Point a DNS record at your instance, then replace the certificate and key referenced by nginx at /etc/nginx/tls/plik.crt and /etc/nginx/tls/plik.key with your own (for example from Let's Encrypt), and reload nginx:

sudo nginx -t && sudo systemctl reload nginx

Share links use the host in each request, so once you reach Plik on your own domain, the links it generates use that domain automatically - there is no base URL to configure.

Service Management

Both services are managed by systemd:

systemctl status plik nginx

To rotate the API token, run the Plik CLI against the metadata backend:

sudo /opt/plik/plikd --config /etc/plik/plikd.cfg token create --login admin

Restart the stack after any configuration change:

sudo systemctl restart plik nginx

Support

Every subscription includes 24/7 technical support from cloudimg engineers via email and live chat, covering deployment, first-boot credential retrieval, upgrades to new Plik releases, reverse proxy and TLS termination, bringing your own domain and CA certificate, authentication and upload policy tuning, and data volume backups. Email support@cloudimg.co.uk. Critical issues receive a one-hour average response time.