Zulip Threaded Team Chat Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Production-Ready Zulip Team Chat In Minutes

Stop spending hours wiring together PostgreSQL, RabbitMQ, Redis, memcached, Django, Tornado and nginx by hand. This AMI delivers a complete Zulip threaded chat server that is answering over HTTPS, with an organization and owner account ready to sign in to, minutes after launch.

## Why This AMI Over Manual Deployment

A production Zulip server is a PostgreSQL database with a full text search extension, a RabbitMQ message broker, a Redis instance, a memcached cache, a Django application server, a Tornado real time push server, a pool of queue workers and an nginx front door terminating TLS. Standing that up by hand means running the upstream installer, separating the storage, generating a dozen secrets and terminating TLS before anyone can send a message. Every one of those steps is a place to leave a weak default in the system that will hold your organization's private conversations.

## About cloudimg

cloudimg publishes production-hardened images on AWS Marketplace. Every image regenerates its secrets on first boot, ships secure defaults, and is paired with a deploy guide and 24/7 support.

## What Is Running

Zulip is an open source team chat application built around threaded conversations. Messages live in channels and, within a channel, in named topics, so several discussions run in parallel without interleaving. That structure is what makes Zulip readable asynchronously: people catch up topic by topic instead of scrolling a firehose.

Features include:

• Formatted messages and code blocks
• Drag-and-drop file sharing
• Full text search across message history
• Message editing and moving, reactions, polls and reminders
• Read receipts, user groups and guest accounts
• A REST API and webhook integrations
• Native mobile, desktop and terminal clients

The image runs the official upstream Zulip server release, installed with the vendor's own production installer and verified against a pinned cryptographic digest. Every component runs natively under systemd and supervisor. Nothing in this image runs in a container.

## Unique Secrets On Every Instance

Zulip generates its secrets when it is installed. An image that simply captured that state would give every customer the same Django signing key, which means sessions minted on one deployment would be forgeable on all of them.

This image does not ship them. Every secret is stripped before capture, along with the TLS private key, the message broker's distribution cookie and the cache's authentication database, then regenerated on your instance's first boot before the web server starts. The build proves this rather than asserting it: it fingerprints every secret before and after, requires every one to have changed, confirms the database, broker and cache each accept the new credential and reject a wrong one, and compares two instances launched from this image to verify nothing is shared between them.

## Secure Defaults

• Invitation-only registration, and only administrators may invite
• Web-based creation of further organizations is disabled
• Only SSH, HTTP and HTTPS are published; the database, message broker, cache and Redis listen on loopback only
• Plain HTTP redirects to HTTPS

## Two Things Are Left For You, And The Guide Covers Both

The instance is reachable at its own address with a self-signed certificate, so pointing a DNS name at it and installing a certificate from a trusted authority is the first production step. And outbound email is not configured: EC2 restricts outbound port 25 and a new instance has no sending reputation, so invitations, password resets and email notifications will not work until you connect Amazon SES or an authenticated SMTP relay. Your owner account does not depend on email; its password is generated on the instance and written to a root-only file.

## Storage Built For Growth

The database and the application tier each get their own dedicated, resizable volume, so message history and uploaded files can be grown independently without rebuilding the server.

## Example Use Case: Engineering Teams Across Time Zones

A distributed engineering team replaces a general purpose chat tool where every incident, release and design discussion collides in one channel. In Zulip each project gets a channel, and each incident, review or release gets its own topic. An engineer starting their day reads only the topics that moved, replies in context, and marks the rest as read. Older topics stay searchable and linkable from an issue tracker.

## Get Started

Launch the AMI, retrieve the generated owner credentials over SSH, and sign in over HTTPS. The paired step-by-step deploy guide linked from this listing covers the sign-in walkthrough, DNS and certificate setup, outbound email, backups and upgrades. Questions before or after purchase: support@cloudimg.co.uk.