Openfire - Secure Self-Hosted XMPP Collaboration Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Openfire is a mature, widely deployed open source XMPP (Jabber) real-time collaboration server. It delivers instant messaging, presence, multi-user group chat (MUC), rosters and publish-subscribe, all administered through a polished web admin console. This image gives you a private, self-hosted messaging server you run and control entirely in your own AWS account, delivered fully installed and secured so a working server is operational within minutes of launch.

## Why This Image vs a Manual Install

This image eliminates the manual package installation, first-run setup wizard, reverse-proxy and TLS configuration, and credential hardening a manual install requires. Openfire normally boots into an open, unauthenticated first-run setup wizard; this image pre-completes that wizard at build time so no privileged setup surface is ever exposed, and each instance generates its own administrator password on first boot. Launch the instance, read your unique credential, and sign in.

## Application Stack

Openfire is installed from the official upstream package and runs as an unprivileged system user under systemd. The web admin console is bound to the loopback interface only and fronted by an nginx reverse proxy on ports 80 and 443, with a self-signed TLS certificate regenerated uniquely on each instance's first boot. XMPP client-to-server traffic is served on ports 5222 and 5223 and server-to-server federation on port 5269. The server database lives on a dedicated data volume, independently resizable and separate from the OS disk.

## Security Hardening

This image follows a defence-in-depth approach:

• No open setup wizard: Openfire's unauthenticated first-run setup wizard is pre-completed at build time, so no privileged setup surface ships in the image
• No default or shared credentials: a cryptographically random administrator password is generated on each instance's first boot and written only to a root-only file
• Console isolation: the admin console binds exclusively to the loopback interface; only the nginx reverse proxy is exposed, and the raw administration ports are never opened
• TLS by default: the admin console is fronted over HTTPS with a per-instance self-signed certificate you can replace with your own trusted certificate
• Anonymous login disabled: anonymous XMPP access is turned off; every account authenticates
• Dedicated data volume: the server database lives on its own disk, surviving OS-disk changes and resizable independently

Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.

## Concrete Use Cases

• Private team messaging: An organization running its own internal instant-messaging and presence service for staff, keeping all conversation data inside its own AWS account rather than a third-party SaaS chat provider
• Federated community server: A community operator hosting group-chat rooms (MUC) and federating with other XMPP servers over server-to-server on port 5269 to build an interoperable messaging network
• Application messaging backend: Developers using a standards-based XMPP server as the real-time messaging, presence and publish-subscribe backbone for a chat, IoT or notification application

## AWS Integration

Deploy on any EC2 instance type. Use the unauthenticated health endpoint with an Application Load Balancer for availability monitoring. Back up your server database using EBS snapshots or AWS Backup. Resize the dedicated data volume independently of the OS disk as your user base grows. XMPP client traffic uses ports 5222 and 5223; server-to-server federation uses port 5269.

## Getting Started

Read your credential from the root-only file, open the admin console in your browser, and sign in as admin. Create users and groups, provision MUC group-chat rooms, install plugins and connect any standard XMPP client. To serve a real public domain instead of localhost and install a trusted certificate, follow the user guide.

## cloudimg Support

24/7 technical support by email and chat. Help with deployment, serving your own domain, installing a trusted TLS certificate, user and group provisioning, plugins, federation and backup planning for your messaging data.