deepstream.io - Realtime Data Sync and Pub/Sub Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

deepstream.io is an open source realtime server that keeps state synchronized across many clients simultaneously. Over a single websocket connection it provides four primitives: records (JSON documents that synchronize automatically so every subscriber sees a change the moment it is written), events (publish/subscribe channels), remote procedure calls (requests routed to whichever client registered to answer them), and presence (who is currently connected). Clients subscribe to what they care about and the server handles fan-out - no polling, diffing, or manual state reconciliation required. A HTTP and JSON interface sits alongside the websocket endpoint for systems that cannot hold an open connection.

This AMI delivers deepstream.io fully installed and hardened on AWS so you have a working, authenticated realtime endpoint within minutes of launch - no Node.js setup, no reverse-proxy configuration, and no credential wiring required.

## What Is Included

• The pinned upstream deepstream.io server (@deepstream/server 10.1.4) on Node.js 22 LTS, run as a dedicated deepstream system user
• A systemd unit that binds deepstream to loopback only, so the realtime engine is never directly internet-exposed
• An nginx front end on port 80 that reverse-proxies the websocket endpoint, the HTTP/JSON API and the health check, with long read/send timeouts for long-lived realtime connections
• File-based authentication enabled by default, with a per-instance administrator credential generated on first boot
• A bundled self-test tool that opens two independent connections and proves a message really travels between them

## Why This AMI Over a Manual Install

deepstream ships upstream with authentication set to none, meaning any client that can reach the port may read and write every record, event and RPC. cloudimg replaces this before the server is ever reachable. The image is pinned to file-based authentication with hashed, salted passwords; the user database ships empty so no guessable default exists; and on first boot a unique administrator password is generated, hashed, and written to a root-only file. The server is bound to loopback with nginx as the single public listener, and the service is held back from starting until the first-boot credential is in place. Compared to a manual install, you eliminate configuration drift, avoid the published sample account vulnerability, and reach a production-ready state in minutes rather than hours.

## Security Practices

• File authentication, not open access: The shipped config pins auth to file mode. Upstream's open-access default and its published sample account are removed.
• Loopback-bound engine: deepstream binds to 127.0.0.1 only. All external access flows through nginx.
• Per-instance credentials on first boot: A one-shot service generates a random 24-character admin password, hashes it with deepstream's own file-auth settings, and writes the plaintext to /root/deepstream-credentials.txt with mode 0600.
• Fail-closed bootstrap: The service will not start until first boot has provisioned the credential, so a booted instance never runs with an empty user map.
• Default security group opens SSH only: Port 80 is served by nginx but is not reachable until you open it in your security group. Restrict it to your own application CIDR, and terminate TLS in front for encryption in transit.

## Use Cases

• Realtime state sync for collaborative tools: Keep records in step across collaborative editors, shared dashboards, and multiplayer game state - synchronize changes across many concurrent sessions without building a bespoke socket layer.
• Pub/sub and RPC backends: Fan out events to browsers, mobile apps, and backend workers, and route remote procedure calls to the client registered to answer them - useful for microservice orchestration and task distribution.
• Live tracking and presence: Drive telemetry feeds, power chat and notification backends, and display presence indicators for connected users in real time.

## Getting Started

1. Launch the AMI and SSH in as the login user for your operating system variant.

2. Read your unique admin password from /root/deepstream-credentials.txt.

3. Verify the instance really delivers messages with: sudo deepstream-selftest all.

4. Point any @deepstream/client application at ws:///deepstream and log in with the admin credential.

For a guided setup, a TLS termination walkthrough, or a persistence review, contact cloudimg support at support@cloudimg.co.uk.

## About deepstream.io

deepstream.io is an open source project distributed under the MIT License.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.