Infrahub 1.10.5 on Ubuntu 24.04

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Why This AMI Instead of Self-Deploying?

Infrahub is an open source infrastructure source of truth and infrastructure data management platform - a FastAPI backend with a GraphQL API, a web frontend, version-controlled schemas and branch-based change proposals, backed by a Neo4j graph database. Deploying it yourself means installing Docker, wiring up a seven-container compose stack (application, graph database, cache, message queue, task manager and its database, and workers), generating and rotating a large set of secrets, hardening the anonymous-access and telemetry defaults, and maintaining the stack over time. This AMI eliminates that effort entirely - your self-hosted source of truth is running within minutes of launch, not hours. You get a pre-hardened, tested configuration backed by 24/7 expert support with a one-hour average response for critical issues, something community forums cannot provide.

The current release available is Infrahub 1.10.5.

## Application Stack

Seven official upstream containers, pinned by digest, run under one systemd service via Docker Compose on a private network: the Infrahub server, two task workers and the task manager (all the Infrahub image), a Neo4j Community graph database that is Infrahub's source of truth, a Redis cache, a RabbitMQ message queue, and a PostgreSQL database for the task manager. Only the web application is published, on port 80; the graph database, cache, message queue and PostgreSQL bind to the private container network only and are never reachable from off the instance. The stateful data lives on a dedicated, independently-resizable data volume.

## Secure By Default

Upstream ships a large set of published default credentials - an admin password, an admin API token, an agent token, a security secret key, and graph, broker and database passwords - all hardcoded in a public repository. This image neutralises every one of them:

• All seven secrets are regenerated uniquely for every instance on its first boot, before the application serves traffic
• The graph and task databases initialise empty under the rotated credentials
• Anonymous read access to the object graph is disabled (upstream leaves it on)
• Product telemetry and analytics are turned off
• The per-instance admin password and API token are written to a root-only file, inaccessible to unprivileged users
• Build-time state - the entire graph, every schema and node - is wiped before capture

## Ready To Use

Browse to the instance on port 80, sign in with the generated admin credentials, and start modelling your infrastructure: define a schema, create objects through the web UI or the GraphQL API, and use branches and change proposals to review changes before they land. Retrieve the generated credentials with sudo cat /root/infrahub-credentials.txt.

## Recommended Sizing

Infrahub is a seven-container stack including a JVM graph database. Upstream documents a minimum of 6 vCPU and 12 GB RAM and recommends 8 vCPU and 16 GB. For production use launch this AMI on an m5.2xlarge (8 vCPU, 32 GB) or larger instance.

## What You Avoid By Using This AMI

• Installing Docker and wiring up a seven-container compose stack
• Generating, rotating and securely storing seven separate secrets
• Hardening the anonymous-access and telemetry defaults
• Relocating the stateful data onto a dedicated, resizable volume
• Ongoing maintenance and security patching without expert guidance

## cloudimg Support

24/7 technical support by email and chat with a one-hour average response for critical issues. Our engineers help with deployment, TLS termination, schema design, backups, scaling and upgrades.

## Use Cases

• A private, in-your-own-VPC infrastructure source of truth with full data ownership
• Version-controlled network and infrastructure data with branch-based change review
• A GraphQL-driven data backend for infrastructure automation and CI pipelines

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.