AliasVault Self-Hosted Password Manager & Aliases

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Why This AMI Instead of Self-Deploying?

AliasVault is an open source, self-hosted password manager combined with a private email-alias service. For every website you sign up to, it generates a unique identity and a unique email alias, receives mail for that alias through its own built-in mail server, and stores the login in a zero-knowledge vault whose master password never leaves your device.

Deploying AliasVault yourself means installing Docker, wiring up an eight-image container stack, fronting the web client, admin panel and API behind a TLS reverse proxy, generating JWT, data-protection, database and admin secrets, and maintaining the stack over time. This AMI eliminates that effort entirely - your self-hosted vault is running within minutes of launch, not hours. You get a pre-hardened, tested configuration backed by 24/7 expert support, something community forums cannot provide.

The current release available is AliasVault 0.30.1.

## Application Stack

The official upstream AliasVault stack, pinned to the release, runs under one systemd service via Docker Compose on a private container network: a bundled PostgreSQL database, the web vault client, an admin panel, a REST API, a mail-receiving server and a background task runner, all fronted by an nginx reverse proxy that terminates TLS on ports 80 and 443. The mail server listens on ports 25 and 587. PostgreSQL is never published to a host port, so the database is reachable only inside the container network.

## Secure By Default

AliasVault stores your most sensitive credentials, so a shipped secret would be a serious risk. This image closes that gap:

• A unique admin-panel password, JWT signing key, data-protection key and database password are generated for every instance on first boot, before the ports are reachable
• A fresh self-signed TLS certificate is generated per instance
• The vault is zero-knowledge by design: each master password derives its encryption key on the client, so no vault key is ever held in the image
• Build-time state is wiped before capture, so the database, vault, mail, secrets and TLS key are all re-created fresh on your instance
• No shared or default credential ships in the image

## Use Cases

• Teams needing full data ownership: organizations with data-residency requirements, such as GDPR-regulated EU companies or firms handling sensitive client data, who cannot send credentials to a third-party hosted vault gain complete control by running AliasVault in their own VPC.
• Privacy-focused professionals and small teams: developers, consultants and startups who onboard contractors or manage multiple client accounts can generate isolated per-site identities and email aliases, preventing credential reuse and cross-site tracking.
• Replacing hosted password managers: teams currently using hosted services who want the privacy of self-hosting without the operational burden of manual Docker, TLS and mail-server configuration get a turnkey alternative that launches in minutes.

## What You Avoid By Using This AMI

• Installing Docker and wiring up an eight-image container stack
• Fronting the web client, admin panel and API behind a TLS reverse proxy
• Generating and securely storing JWT, data-protection, database and admin secrets
• Provisioning a per-instance TLS certificate
• Ongoing maintenance and security patching without expert guidance

## Licensing

AliasVault is free and open source under the GNU Affero General Public License v3.0 (AGPL-3.0). The verbatim licence text and a pointer to the corresponding source at the pinned release ship inside the image. There is no per-seat fee for the software; the cloudimg charge covers packaging, security patching, image maintenance and 24/7 support.

## Get Started

Launch the AMI, browse to the instance over HTTPS on port 443, and register your vault account. The deployment guide is at https://www.cloudimg.co.uk/guides/aliasvault-aws/ . For help with DNS configuration, mail port setup, TLS certificate replacement or any other deployment question, contact cloudimg support at support@cloudimg.co.uk.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.