PlantUML Server - Secure Diagram-as-Code

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

PlantUML Server is a browser-based rendering server for PlantUML, the popular open source diagram-as-code language. Type or paste plain-text diagram source into the editor and watch it render live as a UML diagram - sequence, class, activity, state, component, use-case, deployment and more - which you can download as SVG, PNG or ASCII art. It also exposes a stateless HTTP rendering API: an encoded diagram in the URL returns the rendered image, so wikis, documentation sites and editors can embed always-current diagrams generated straight from text in source control. This image delivers a fully installed, security-hardened PlantUML Server appliance so a working diagram-rendering endpoint is operational within minutes of launch, self-hosted in your own AWS account.

## Why This Image vs a Manual Install

This image eliminates the Java runtime and servlet-container setup, Graphviz installation, reverse-proxy configuration, TLS termination and credential hardening that a bare install requires. PlantUML Server has no authentication of its own, so exposing it directly would put an unauthenticated diagram renderer on the network. This image never leaves it exposed: the server is bound to the loopback interface only, and an nginx reverse proxy fronts it over HTTPS with HTTP Basic authentication whose password is generated uniquely on each instance's first boot. The renderer additionally runs with an internet-grade security profile that blocks local-file includes and requests to internal network addresses. Launch the instance, read your unique credential, and start rendering diagrams.

## Application Stack

PlantUML Server runs from the maintainer's official pinned distribution, which bundles the diagram engine and Graphviz, bound to the loopback interface. An nginx reverse proxy on port 443 forwards to it over a per-instance self-signed TLS certificate, enforcing HTTP Basic authentication; port 80 serves an unauthenticated health endpoint and redirects everything else to HTTPS. The server is stateless - it stores no diagrams and keeps no per-user data - and the appliance's container store and logs live on a dedicated, independently-resizable data volume mounted at /var/lib/plantuml.

## Security Hardening

This image follows a defence-in-depth approach:

• Network isolation: the renderer binds exclusively to the loopback interface; only the nginx reverse proxy is exposed
• Authentication enforced: every request is authenticated except an unauthenticated health endpoint for load-balancer probes
• No default or shared credentials: a cryptographically random web password is generated on each instance's first boot and written only to a root-only file
• SSRF and include hardening: the renderer runs with an internet-grade security profile that blocks local-file includes and fetches of internal or loopback network addresses
• Encrypted transport: the reverse proxy terminates HTTPS with a certificate generated uniquely per instance
• Automatic restart: systemd monitors the renderer and nginx and restarts them on failure

## Concrete Use Cases

• Diagrams as code in your documentation: Point a wiki, static-site generator or documentation pipeline at the encoded-URL rendering API so every diagram is generated from text in source control and is always current, with no binary image files to maintain
• Live diagram authoring: Open the browser editor to sketch and iterate on sequence, class, activity and state diagrams in plain text, previewing the render instantly and exporting SVG or PNG when done
• Self-hosted rendering for privacy: Run diagram rendering entirely inside your own AWS account instead of a public PlantUML service, so proprietary architecture and design diagrams never leave your network

## AWS Integration

Deploy on any EC2 instance type; larger instances render bigger diagrams faster. Keep the appliance's container store and logs on the dedicated EBS data volume and snapshot it independently with AWS Backup. Use the unauthenticated health endpoint with an Application Load Balancer for availability monitoring.

## Pricing and Evaluation

This listing includes a software charge in addition to standard AWS infrastructure costs. See the Pricing tab for the current rate. To evaluate at low cost, launch on a small instance type and scale up when ready.

## Getting Started

1. Launch the AMI from this listing with a key pair and a Security Group allowing inbound ports 22, 80 and 443.

2. SSH into the instance and retrieve your unique web password from /root/plantuml-server-credentials.txt.

3. Open https:// in your browser, accept the self-signed certificate, and log in with username "admin" and your retrieved password.

4. Paste PlantUML source into the editor to render a diagram, or call the encoded-URL API from your wiki.