Hosting on AWS

Deploy a complete Netzilo Server on AWS from the AWS Marketplace. You don't build or configure anything by hand — a CloudFormation template does it all. You subscribe, fill in a short form, point your domain at the server, and log in.

Typical time to a working server: 10–15 minutes.

View the Netzilo listing on AWS Marketplace →

Netzilo Server on the AWS Marketplace

How it works

The CloudFormation template runs in your own AWS account and automatically:

  • launches the server (an EC2 instance) running the full Netzilo stack — management, signal, dashboard, identity provider, TURN relay, database, cache, and reverse proxy;
  • creates the network security group with exactly the right ports;
  • installs and starts everything, and obtains a free HTTPS certificate on first boot.

You never touch servers, networking, or firewall rules manually. You just provide a few details in a form.

What you need

Only two things:

  1. An AWS account.
  2. A domain name you can add a DNS record to (e.g. go.example.com).

That's it. Everything else is either created by the template or chosen from a drop-down while you launch.

What you'll do

  1. Subscribe to Netzilo Server on the AWS Marketplace.
  2. Reserve an IP and point your domain at it (so the HTTPS certificate is issued automatically).
  3. Launch the template and fill in the form (domain + admin details).
  4. Log in.

The rest of this page walks through each step.

Step 1 — Reserve an IP and set your DNS

So the certificate is issued the moment the server boots, give it a fixed IP and point your domain at it first:

  1. In the AWS console, go to EC2 → Elastic IPs → Allocate and note the allocation ID (looks like eipalloc-0abc…).
  2. Create a DNS A record for your domain pointing at that IP address: go.example.com → A → <your Elastic IP>.

You'll paste the allocation ID into the form in the next step; the template attaches it to the server for you.

Step 2 — Subscribe and launch

  1. In AWS Marketplace, search for Netzilo Server and click Subscribe.
  2. Choose Launch → Launch CloudFormation.
  3. Fill in the form. Most fields are drop-downs; here's what each means:
FieldWhat to enter
Domain (FQDN)The domain from Step 1, e.g. go.example.com
Admin emailYour login username, e.g. admin@example.com
Admin first / last nameThe first administrator
Admin password12+ chars with upper, lower, number, and a symbol
Instance typeLeave the default t3.large for most cases (see sizing below)
SSH admin access CIDRThe IP range allowed to SSH in, e.g. 203.0.113.5/32 — your office/VPN. Avoid 0.0.0.0/0.
VPCPick one from the drop-down — your account's default VPC is fine
Public subnetPick a public subnet in that same VPC
Elastic IP allocation IDThe eipalloc-… from Step 1
SSH key pairOptional — leave blank and use Session Manager instead
Database modeLeave as container (built-in database)
  1. Create the stack and wait for CREATE_COMPLETE, then a few more minutes while the server finishes first-boot setup and gets its certificate.

Step 3 — Log in

  1. Open https://<your-domain> (e.g. https://go.example.com).
  2. Sign in with the admin email and password you entered.
  3. You'll be asked to set a new password on first login.

Reference: sizing

The instance type is a drop-down in the form. Defaults suit most deployments:

Instance typevCPUMemoryGood for
t3.large (default)28 GBMost deployments (up to a few hundred machines)
t3.xlarge416 GBLarger networks / heavier relay traffic
m6i.large28 GBSteady, consistent performance
m6i.xlarge416 GBLarger, steady-state deployments

Storage (an encrypted disk) is provisioned automatically.

Reference: ports

You don't configure these — the template creates the security group for you. Listed only so you know what's open:

Port(s)ProtocolSourcePurpose
22TCPYour admin CIDRSSH (admin)
80TCPPublicCertificate validation + redirect to HTTPS
443TCPPublicDashboard, API, and login
3478TCP & UDPPublicSTUN/TURN
5349TCP & UDPPublicTURN over TLS

Managing the server

Connect via Session Manager (no key needed) or SSH. The stack lives under /opt/netzilo:

cd /opt/netzilo
sudo docker compose ps          # what's running
sudo docker compose logs -f     # follow logs
sudo docker compose pull        # fetch the latest version
sudo docker compose up -d       # apply updates / restart

Troubleshooting

SymptomLikely causeFix
Stack error: "security group and subnet belong to different networks"Subnet isn't in the selected VPCChoose a public subnet that belongs to the VPC you picked
Certificate warning in browserCert still issuing, or DNS not on the Elastic IPConfirm the A record → Elastic IP; wait a minute and refresh
Can't SSHAdmin CIDR too narrowWiden the SSH admin CIDR, or use Session Manager
Dashboard unreachableServer still finishing first bootWait for CREATE_COMPLETE plus a few minutes

Need help? Contact support@netzilo.com.