Altair GraphQL Client - Self-Hosted GraphQL IDE

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Altair GraphQL Client is a self-hosted GraphQL IDE for building, sending and inspecting GraphQL requests entirely from your own browser. It gives you a full-featured query editor with syntax highlighting, autocompletion and inline documentation driven by live schema introspection, so you can explore an API's types, queries, mutations and subscriptions as you write. Set custom headers and variables, run real-time subscriptions, view formatted responses, keep a searchable history, and organise reusable requests into collections. Every request goes directly from your browser to the endpoint you choose - no data passes through a third party, no telemetry is collected, and nothing is stored on the server. This AMI delivers the official pre-built Altair bundle served by nginx and gated by a unique per-instance credential, so a working private GraphQL IDE is operational within minutes of launch.

## How It Differs from SaaS and Desktop Alternatives

Unlike hosted GraphQL tools such as Apollo Studio or cloud-based API clients, this product keeps all traffic on your network with zero SaaS data egress. Unlike desktop tools, it provides a shared team URL accessible from any browser without per-seat licensing:

• Zero data egress: requests never leave your network boundary, making it suitable for internal and sensitive APIs
• No per-seat fees: one instance serves your entire team from a single URL
• Real-time subscription support: test GraphQL subscriptions natively
• No telemetry or stored data: purely client-side with no server-side database
• Works offline once loaded: the IDE runs without external dependencies after the initial load

## Why This Image vs a Manual Install

Altair's self-hosted build has no built-in authentication, so exposing it on a public IP would make it world-readable. Running it safely yourself means deploying the official static bundle, wiring the bootstrap call the self-hosting shell needs to render, serving it under nginx, and adding an authenticated front door. This image completes every step at build time. The pinned altair-static bundle is published under nginx on port 80, the render bootstrap is injected so the app loads on first request, and the whole application is gated behind HTTP Basic authentication using a credential generated fresh on each instance's first boot.

## Authentication

Altair itself has no accounts or login. This image adds a single per-instance HTTP Basic credential (user admin) generated on first boot and written to a root-only file, so the IDE is not publicly readable. A single unauthenticated path is exposed: GET /healthz returns 200 for load-balancer and health probing. Read your per-instance credential with: sudo cat /var/lib/cloudimg/altair-credentials.txt.

## Security Hardening

This image follows a defence in depth approach:

• No default or shared credentials: the per-instance HTTP Basic password is generated fresh on every instance's first boot with openssl and is never shipped in the image; the build-time credential is wiped before capture
• Gated front door: the whole application sits behind HTTP Basic authentication, so a scanner or passer-by cannot read the IDE; only GET /healthz is public
• Client-side by design: every request is sent straight from your browser to the endpoint you choose, so there is no server-side database, no stored user data and no telemetry to protect
• Add your own TLS: the front door is plain HTTP on port 80; for production, terminate TLS with your own certificate or an Application Load Balancer and restrict the security group to trusted source IP ranges as the guide describes

## Concrete Use Cases

• A private, self-hosted GraphQL IDE: give developers and API teams one self-hosted URL for building, running and inspecting GraphQL queries, mutations and subscriptions instead of a desktop tool or a third-party hosted client
• Schema exploration: use live introspection, autocompletion and inline documentation to explore an unfamiliar GraphQL API's types and operations as you write
• Private, controlled API testing: because every request goes straight from your own browser to your endpoint and nothing is stored on the machine, test internal and sensitive APIs on a network you control

## AWS Integration

Deploy on any EC2 instance type; the recommended size is m5.large. Put the instance behind an Application Load Balancer to terminate TLS with your own certificate, and restrict the security group to trusted source IP ranges. Because the application is entirely static and client-side there is no database to back up.

## About cloudimg

cloudimg publishes pre-hardened AMIs on AWS Marketplace with 24/7 support by email and live chat, covering deployment, adding your own TLS certificate, restricting network access, and reverse-proxy configuration.