SeedDMS Document Management on AWS User Guide

Overview

This image runs SeedDMS, the mature open source document management system used by businesses, engineering and quality teams and any organisation that needs a self hosted, access controlled document repository. From one web interface you organise files into a browsable folder tree, keep full version history for every document, control who can see and edit each folder or document with per object access control lists, run documents through review and approval workflows, tag them with categories and attributes, and find them again with full text search. SeedDMS also exposes a WebDAV endpoint and a REST API.

SeedDMS is a PHP application deployed under /var/www/seeddms and served by the nginx web server through PHP 8.3 FPM on port 80. Its metadata lives in a MariaDB database whose data directory, /var/lib/mysql, is bind mounted onto a dedicated, independently resizable EBS data volume mounted at /data. The document content store, /var/lib/seeddms, holding your uploaded files, cache, full text index and backups, is kept on that same data volume, so every document and its metadata stays off the operating system disk and survives instance replacement.

The install wizard is completed during the build and locked away from the web, so you land directly on a working sign in page. The administrator account is created on the first boot of every deployed instance, and its password is generated freshly on each instance, so two instances launched from the same Amazon Machine Image never share a password. The well known SeedDMS default administrator login is never shipped. The credentials are written to /root/seeddms-credentials.txt with mode 0600 so that only the root user can read them, and the shipped document store is empty.

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and port 80 for the web interface
• The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Step 1: Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for SeedDMS. Select the cloudimg listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group that opens port 22 from your management network and port 80 for the web interface. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass, while the per instance administrator and database passwords are generated.

Step 2: Launch the Instance from the AWS CLI

The following command launches an instance from the cloudimg SeedDMS Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=seeddms}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name from the EC2 console or with aws ec2 describe-instances.

Step 3: Connect to Your Instance

Connect over SSH using your key pair and the login user for your operating system variant.

ssh -i <key-name>.pem ubuntu@<public-ip>

Step 4: Retrieve the Administrator Password

The administrator password is unique to your instance and was generated on first boot. Read it as root:

sudo cat /root/seeddms-credentials.txt

The file lists the web interface URL, the administrator login name (admin) and the generated password, along with the MariaDB database name and its application password. Keep this file somewhere safe.

Step 5: Sign In to SeedDMS

The web interface is served on port 80 by nginx. In a browser, go to the instance address:

http://<instance-public-ip>/

You are taken to the SeedDMS sign in page. Sign in with login name admin and the password from the credentials file.

SeedDMS derives its base URL from the address you reach it on, so it answers correctly whether you browse by public IP, private IP or a custom domain name, and there is no baked in build time address to change. After signing in you land on the document browser, the root DMS folder, which is the starting point for organising and managing your documents.

Step 6: Confirm SeedDMS Is Running

Over SSH, confirm the web server, PHP FPM and the database are active, that the health endpoint returns 200, and that the sign in page is served:

sudo systemctl is-active nginx php8.3-fpm mariadb
curl -s -o /dev/null -w 'healthz: %{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'login page: %{http_code}\n' http://127.0.0.1/out/out.Login.php

You should see all three services reported as active, the health endpoint return 200, and the login page return 200. The MariaDB database listens on the loopback interface only and is never exposed directly.

The per instance administrator credential is proven end to end by a round trip that signs in through the real web login form and rejects a wrong password, without ever printing the password:

sudo bash /usr/local/sbin/seeddms-cred-roundtrip.sh

A successful run prints SEEDDMS_CRED_ROUNDTRIP_OK.

Step 7: Organise Documents into Folders

SeedDMS stores everything in a folder tree beneath the root DMS folder. From a folder view, use Add subfolder to create folders such as Finance, Engineering or HR Policies, each with its own description. Use Access rights on any folder or document to set per object access control lists, so you control precisely who may view, edit or manage each item. The folder tree on the left lets you navigate the whole repository at a glance.

Step 8: Add Documents and Track Versions

Open a folder and select Add document to upload a file. Give the document a name and comment, add keywords, and optionally assign reviewers and approvers to drive a review and approval workflow; a document with no reviewer or approver is released immediately.

Every time you upload a new file to an existing document with Update document, SeedDMS keeps the previous content as an earlier version, so the document detail shows the full version history, the release status of each version, and an activity timeline. You can download or view any version, compare revisions, and see exactly who changed what and when.

Step 9: Administer SeedDMS

Open Admin tools from the top menu to administer the system. From here you manage users, groups and roles, define categories, attributes and global keywords, review the contents overview and charts, run folder and document checks, schedule tasks, and adjust settings. Guest login is disabled by default, so only accounts you create can sign in.

Step 10: The Data Volume

The MariaDB database and the SeedDMS document content store live on a dedicated EBS volume mounted at /data, with the database bind mounted onto /var/lib/mysql and the content store bind mounted onto /var/lib/seeddms. This keeps your documents and metadata off the operating system disk and lets you resize or snapshot them independently. Confirm the mounts with:

df -h /data
findmnt /var/lib/mysql
findmnt /var/lib/seeddms

To grow the data store, expand the EBS volume in the AWS console, then grow the filesystem on the instance with sudo resize2fs on the underlying device. The SeedDMS application code under /var/www/seeddms lives on the root volume.

Step 11: Enable HTTPS

The web interface is served over plain HTTP on port 80 by nginx. For production use, place it behind TLS so that the administrator password and your documents are encrypted in transit. Point a domain name at the instance, then obtain a certificate for that domain, for example with a managed certificate on an Application Load Balancer in front of the instance, or with Certbot installed on the instance, and configure nginx to listen on 443 with your certificate exactly as the bundled site does for port 80.

Because SeedDMS derives its base URL from the request host, no configuration change is needed when you move to HTTPS: once a certificate is in front of the instance and you browse to the https:// address, SeedDMS generates its links over HTTPS automatically. Restrict the security group so that ports 80 and 443 are reachable only from the networks that need to reach the web interface.

Step 12: Backup and Maintenance

Back up the application by snapshotting the /data EBS volume, which captures both the database and the document content store together. You can also take a logical backup of the database over the loopback socket:

sudo mysqldump seeddms > seeddms-backup.sql

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade and reboot when a new kernel is installed; nginx, PHP FPM and MariaDB start automatically on boot.

Support

This image is published and supported by cloudimg. Support covers deployment, access control and workflow setup, categories and attributes, full text search, version upgrades, performance tuning, the database and document volume, TLS and backups. Contact cloudimg through the support channel listed on the AWS Marketplace listing.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.