Hosting on AWS
Deploy a complete Netzilo Server on AWS from the AWS Marketplace. You don't build or configure anything by hand — a CloudFormation template does it all. You subscribe, fill in a short form, point your domain at the server, and log in.
Typical time to a working server: 10–15 minutes.
View the Netzilo listing on AWS Marketplace →
How it works
The CloudFormation template runs in your own AWS account and automatically:
- launches the server (an EC2 instance) running the full Netzilo stack — management, signal, dashboard, identity provider, TURN relay, database, cache, and reverse proxy;
- creates the network security group with exactly the right ports;
- installs and starts everything, and obtains a free HTTPS certificate on first boot.
You never touch servers, networking, or firewall rules manually. You just provide a few details in a form.
What you need
Only two things:
- An AWS account.
- A domain name you can add a DNS record to (e.g.
go.example.com).
That's it. Everything else is either created by the template or chosen from a drop-down while you launch.
What you'll do
- Subscribe to Netzilo Server on the AWS Marketplace.
- Reserve an IP and point your domain at it (so the HTTPS certificate is issued automatically).
- Launch the template and fill in the form (domain + admin details).
- Log in.
The rest of this page walks through each step.
Step 1 — Reserve an IP and set your DNS
So the certificate is issued the moment the server boots, give it a fixed IP and point your domain at it first:
- In the AWS console, go to EC2 → Elastic IPs → Allocate and note the
allocation ID (looks like
eipalloc-0abc…). - Create a DNS
Arecord for your domain pointing at that IP address:go.example.com → A → <your Elastic IP>.
You'll paste the allocation ID into the form in the next step; the template attaches it to the server for you.
Step 2 — Subscribe and launch
- In AWS Marketplace, search for Netzilo Server and click Subscribe.
- Choose Launch → Launch CloudFormation.
- Fill in the form. Most fields are drop-downs; here's what each means:
| Field | What to enter |
|---|---|
| Domain (FQDN) | The domain from Step 1, e.g. go.example.com |
| Admin email | Your login username, e.g. admin@example.com |
| Admin first / last name | The first administrator |
| Admin password | 12+ chars with upper, lower, number, and a symbol |
| Instance type | Leave the default t3.large for most cases (see sizing below) |
| SSH admin access CIDR | The IP range allowed to SSH in, e.g. 203.0.113.5/32 — your office/VPN. Avoid 0.0.0.0/0. |
| VPC | Pick one from the drop-down — your account's default VPC is fine |
| Public subnet | Pick a public subnet in that same VPC |
| Elastic IP allocation ID | The eipalloc-… from Step 1 |
| SSH key pair | Optional — leave blank and use Session Manager instead |
| Database mode | Leave as container (built-in database) |
- Create the stack and wait for CREATE_COMPLETE, then a few more minutes while the server finishes first-boot setup and gets its certificate.
Pick a public subnet that belongs to the VPC you selected — that's the one thing to get right. If your account has a default VPC, its subnets work out of the box.
Step 3 — Log in
- Open
https://<your-domain>(e.g.https://go.example.com). - Sign in with the admin email and password you entered.
- You'll be asked to set a new password on first login.
If you see a certificate warning right after launch, the HTTPS certificate is still being issued — wait a minute and refresh.
Reference: sizing
The instance type is a drop-down in the form. Defaults suit most deployments:
| Instance type | vCPU | Memory | Good for |
|---|---|---|---|
t3.large (default) | 2 | 8 GB | Most deployments (up to a few hundred machines) |
t3.xlarge | 4 | 16 GB | Larger networks / heavier relay traffic |
m6i.large | 2 | 8 GB | Steady, consistent performance |
m6i.xlarge | 4 | 16 GB | Larger, steady-state deployments |
Storage (an encrypted disk) is provisioned automatically.
Reference: ports
You don't configure these — the template creates the security group for you. Listed only so you know what's open:
| Port(s) | Protocol | Source | Purpose |
|---|---|---|---|
22 | TCP | Your admin CIDR | SSH (admin) |
80 | TCP | Public | Certificate validation + redirect to HTTPS |
443 | TCP | Public | Dashboard, API, and login |
3478 | TCP & UDP | Public | STUN/TURN |
5349 | TCP & UDP | Public | TURN over TLS |
Managing the server
Connect via Session Manager (no key needed) or SSH. The stack lives under
/opt/netzilo:
cd /opt/netzilo
sudo docker compose ps # what's running
sudo docker compose logs -f # follow logs
sudo docker compose pull # fetch the latest version
sudo docker compose up -d # apply updates / restart
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| Stack error: "security group and subnet belong to different networks" | Subnet isn't in the selected VPC | Choose a public subnet that belongs to the VPC you picked |
| Certificate warning in browser | Cert still issuing, or DNS not on the Elastic IP | Confirm the A record → Elastic IP; wait a minute and refresh |
| Can't SSH | Admin CIDR too narrow | Widen the SSH admin CIDR, or use Session Manager |
| Dashboard unreachable | Server still finishing first boot | Wait for CREATE_COMPLETE plus a few minutes |
Need help? Contact support@netzilo.com.

