webtrees Genealogy and Family Tree Server on AWS User Guide

Overview

webtrees is a mature open source online collaborative genealogy application. It gives you and your family interactive family trees, pedigree and descendancy charts, individual and family records, reports, media galleries, and per-user accounts, all through a clean web interface, so relatives can explore and contribute to a shared family history from any browser. This cloudimg image delivers webtrees fully installed and security hardened: nginx with PHP 8.3 fronts the application, MySQL 8.0 holds the data, the setup wizard is driven to completion at build time so no open installer ships, and a small demo family tree is imported so the pedigree charts are populated the moment you sign in. A unique MySQL password, application database password, and webtrees administrator password are generated on the first boot of every instance and written to a root-only file, so no shared or default credential ships in the image. The database (/var/lib/mysql) and the application and its data (/var/www) each live on their own dedicated data volume. Backed by 24/7 cloudimg support.

What is included:

• webtrees 2.2.6 served by nginx on port 80 with PHP 8.3 (php8.3-fpm)
• MySQL 8.0 holding the genealogy database, bound to the loopback interface only
• The schema built, the first administrator created, and a demo family tree imported for you, so no open setup wizard is reachable
• Unique MySQL, application database, and administrator passwords generated on first boot and recorded in a root-only file
• A dedicated data volume for the database at /var/lib/mysql and one for the application and its data at /var/www
• Public self registration disabled by default
• nginx.service, php8.3-fpm.service, and mysql.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An AWS account, an EC2 key pair in the target region, and a VPC with a public subnet. m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type. Security group inbound: allow 22/tcp from your management network for SSH and 80/tcp for the web interface.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace, choose Continue to Launch, and launch through the EC2 console or the AWS CLI. Select the m5.large instance type, your key pair, and a security group that opens ports 22 and 80.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <security-group-id> \
  --subnet-id <subnet-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=webtrees}]'

Step 2 - Connect to your instance

Connect over SSH as the default login user for the OS variant you launched. This listing may ship more than one OS variant; use the matching login user below.

Step 3 - Confirm the services are running

webtrees is served by nginx and PHP, backed by MySQL, with a one-shot first-boot service that mints the per-instance credentials and drives the setup. Confirm the three long-running services are healthy:

systemctl is-active nginx.service php8.3-fpm.service mysql.service

Each reports active.

Step 4 - Verify the stack and endpoints

Confirm the deployed webtrees version, that MySQL is bound to the loopback interface only, that the site answers, and that the privileged setup wizard is no longer reachable:

grep -oE "VERSION = '[0-9.]+'" /var/www/webtrees/app/Webtrees.php
ss -tln | grep 127.0.0.1:3306
curl -s -o /dev/null -w 'tree page: HTTP %{http_code}\n' http://127.0.0.1/tree/demo
curl -s http://127.0.0.1/ -o /dev/null -w 'home: HTTP %{http_code}\n'

webtrees reports version 2.2.6, MySQL listens on 127.0.0.1:3306 only, the demo tree page returns 200, and the home page returns 302 (it redirects to the default tree - the setup wizard is closed).

Step 5 - Read your per-instance credentials

The image ships no shared or default login. On first boot a unique administrator password (and the MySQL and application database passwords) are generated for this instance and written to a root-only file. Confirm the file permissions and read the public fields:

sudo stat -c '%a %U:%G' /stage/scripts/webtrees-credentials.log
sudo grep -E '^WEBTREES_(ADMIN_USER|URL)=' /stage/scripts/webtrees-credentials.log

The file is 600 root:root, WEBTREES_ADMIN_USER is your administrator username (admin), and WEBTREES_URL is the address to open in your browser. Run sudo cat /stage/scripts/webtrees-credentials.log to also see the passwords.

Step 6 - Prove the login round-trip from the command line

Confirm the per-instance administrator password authenticates against webtrees exactly as your browser will, that a guessable default admin/admin login is rejected, and that the imported genealogy records are present in the live database:

sudo bash /usr/local/sbin/webtrees-cred-roundtrip.sh

The helper reports OK: the per-instance password authenticates, the default admin/admin is rejected, and the demo tree's individuals and families are persisted in the database.

Step 7 - Sign in and explore your family tree

Browse to http://<instance-public-ip>/ (the value of WEBTREES_URL) and sign in with the administrator username and password from the credentials file. The tree home page shows a Statistics block summarising the imported demo tree - the number of individuals and families, the earliest birth, and recent changes.

Step 8 - Browse the pedigree charts

Open the Charts menu and choose Pedigree (or any of the ancestor, descendant, fan, hourglass or family-book charts) to view a family visually. The demo tree is pre-populated, so the pedigree chart renders immediately with birth and death details for each ancestor.

Step 9 - View an individual's record

Click any person to open their individual page: names, sex, birth and death facts, sources, notes and media, plus a family navigator linking to parents, spouses and children. This is the heart of webtrees - a full record for every person in your tree.

Step 10 - Import your own GEDCOM

The demo tree is only a starting point. To load your own family history, sign in as the administrator, open the control panel at http://<instance-public-ip>/admin-control-panel, choose Family trees, create a new tree, and import your GEDCOM file. You can keep, rename, or delete the demo Demo Family Tree at any time.

Maintenance

• Data volumes: the MySQL database lives on the dedicated data volume at /var/lib/mysql and the webtrees application and its writable data (config, caches, uploaded media, tree store) on /var/www. Resize either volume independently of the OS disk as your data grows, and back them up with EBS snapshots or AWS Backup.
• Credentials: the per-instance administrator, application database, and MySQL passwords are in /stage/scripts/webtrees-credentials.log (600 root:root). Change the administrator password from the control panel at any time.
• Ports: the web interface is served on port 80 by nginx. MySQL is bound to the loopback interface only and is never exposed to the network. To serve HTTPS, terminate TLS with your own domain and certificate in front of nginx.
• Registration: public self registration is disabled by default. Invite users or create accounts from the control panel.
• Restart: sudo systemctl restart nginx.service php8.3-fpm.service mysql.service if you need to bounce the stack.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.

This image packages the open source webtrees software (GNU General Public License v3.0) for convenient deployment on AWS. cloudimg is not affiliated with, endorsed by, or sponsored by the webtrees project.