OliveTin - Secure Shell Command Web Dashboard

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

OliveTin is a self-hosted web interface that turns a curated set of predefined shell commands into safe, one-click buttons. Instead of handing people SSH access to run ad hoc commands, an administrator defines a vetted set of actions in a single YAML file, and users click to run them and watch the live output stream back to the page. It is a natural fit for operations teams, home labs, and on-call engineers who want to let less technical users safely trigger routine jobs - restarting a service, checking disk space, pinging a host, or running a playbook - from a browser or a phone. This AMI delivers a fully installed, security-hardened OliveTin appliance so a working automation dashboard is operational within minutes of launch.

## Why This Image vs a Manual Install

Because every button is a real shell command running on the server, an OliveTin instance reachable without authentication is, in effect, remote command execution. This image is built around that fact and ships secure by default, eliminating the manual reverse-proxy, TLS, service-hardening, and credential setup a bare install requires. OliveTin is bound to the loopback interface and never exposed directly; an nginx reverse proxy terminates TLS and enforces HTTP Basic authentication whose password is generated uniquely on each instance's first boot. Launch the instance, read your unique credential, and start clicking.

## Application Stack

OliveTin 3000.17.1, the official release, is installed from the vendor package and runs as a dedicated unprivileged system user under a systemd unit, bound to the loopback interface only. An nginx reverse proxy on port 443 terminates TLS with a self-signed certificate regenerated per instance at first boot, redirects port 80 to HTTPS, serves an unauthenticated health endpoint for load balancers, and forwards the authenticated identity to OliveTin as spoof-proof headers. systemd starts the command runner and the web server on boot and restarts them on failure.

## Security Hardening

This image follows a defence-in-depth approach:

• Network isolation: the command runner binds exclusively to the loopback interface; only the authenticating nginx reverse proxy is exposed
• Authentication enforced: every request to the web UI and API is authenticated - nothing is served anonymously except a health endpoint for load-balancer probes
• No default or shared credentials: a cryptographically random administrator password is generated on each instance's first boot, hashed with bcrypt, and written only to a root-only file
• Least privilege: OliveTin runs as an unprivileged system user; the one privileged demo action is granted through a narrow, single-command sudoers rule rather than blanket root
• Safe defaults and TLS: only non-destructive, read-mostly sample actions ship, with no free-form command-injection surface, and a per-instance self-signed certificate is regenerated on first boot

Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.

## Concrete Use Cases

• Safe self-service for non-technical users: Expose a small set of vetted buttons - restart an application, clear a cache, trigger a backup - so support staff can run approved tasks from a browser without SSH access or the risk of a mistyped command
• Home lab and edge automation: Put one-click controls for media servers, network tools, and routine maintenance jobs on a phone-friendly dashboard, each action defined and constrained in advance
• Runbook and incident actions: Curate approved diagnostic and remediation actions so first responders can execute a documented runbook step consistently, with every run and its live output captured in the log view

## AWS Integration

Deploy on any EC2 instance type; the appliance is CPU-only and lightweight. Use the unauthenticated health endpoint with an Application Load Balancer for availability monitoring, place the instance in a VPC subnet with security-group control over what its actions can reach, and forward logs to CloudWatch for centralized auditing.

## Getting Started

1. Launch the AMI on your chosen EC2 instance type

2. Read your unique credential from the root-only file

3. Open the web interface over HTTPS and accept the per-instance self-signed certificate

4. Sign in and click a shipped sample action to watch its output stream live

5. Edit /etc/OliveTin/config.yaml to add your own carefully-constrained actions

For a guided walkthrough, architecture consultation, or help wiring OliveTin to your identity provider, contact cloudimg support at any time.

## cloudimg Support

24/7 technical support by email and chat.