GoCD Continuous Delivery Server - Pipelines and Agent Ready

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

GoCD is the open-source continuous delivery server from Thoughtworks, trusted by development teams worldwide for modeling complex build and release workflows. It treats pipelines as first-class citizens and renders a value stream map that visualizes every change from commit through to production deployment. This AMI delivers a complete, self-contained CI/CD server: the GoCD server and a co-located build agent are installed and wired together, so your first pipeline can run the moment the instance boots - no manual pairing or external infrastructure required.

## Who This Is For

DevOps engineers and platform teams running on AWS EC2 who want a self-hosted continuous delivery server without the overhead of configuring one from scratch. Ideal for teams of 5-50 developers managing multi-stage deployment workflows, organizations in regulated industries needing on-premises audit trails, or any team seeking an alternative to hosted pipeline services while keeping full control in their own AWS account.

## Application Stack

The GoCD server runs as a JVM service bound to loopback on ports 8153 and 8154, fronted by an nginx reverse proxy on port 80 with correct forwarding headers. A co-located go-agent auto-registers with the server through a baked auto-register key and is automatically enabled - giving you a working build agent from first boot with zero manual configuration. systemd starts the server, the agent, and nginx on boot and restarts them on failure.

## Secure By Default

Upstream GoCD ships with no authentication, meaning anyone who can reach it can administer it. This image closes that gap:

• File-based authentication realm baked into the GoCD configuration
• An admin user marked as a GoCD administrator
• A strong per-instance admin password generated on first boot as a bcrypt entry, never shared across images
• Unauthenticated API requests rejected by default
• Credentials stored in /etc/cloudimg-credentials.txt (mode 0600 root:root)

This eliminates the security risk that competing CI/CD AMIs leave open by shipping with default or no credentials.

## Pipelines and the Value Stream Map

Model build, test, and release stages as pipelines, point them at Git or other materials, and let the built-in agent pick up and run the work. The value stream map traces every change end-to-end across connected pipelines, so you can see exactly what a commit triggered and where it is in the delivery process. Role-based security and pipeline group permissions govern who can view and administer each pipeline.

## Example Use Case

A 10-developer fintech team building Docker images and deploying to Amazon ECS across staging and production environments. Model a three-stage pipeline - build, integration test, deploy - with the value stream map providing the audit trail regulators require. The co-located agent handles the initial workload; scale out by adding go-agent instances on additional EC2 hosts as pipeline volume grows.

## Ready To Use

Open the web UI in your browser, read the generated credentials, sign in as admin, and model your first pipeline straight away. The built-in agent is registered and enabled, so a pipeline can run without adding any external agents. Scale out later by installing go-agent on additional hosts pointed at this server, or by adopting elastic agents on AWS.

## Get Started With Expert Guidance

Need help designing your pipeline topology or modeling a multi-stage deployment workflow? Contact cloudimg support to schedule a guided walkthrough of your specific use case. Our engineers can help you go from first boot to production-ready pipelines.

## Currently Available Versions

GoCD server 26.1, on a fully patched base with unattended security updates enabled.

## cloudimg Support

24/7 technical support by email and chat. Help with deployment, pipeline and value stream design, agent scale-out, authorization and role design, TLS termination, backup, and upgrade planning.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.