cloudimg lighttpd - Secure Web Server AMI

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

lighttpd, pronounced lighty, is a secure, fast and flexible web server designed and optimised for high performance environments. With a small memory footprint compared with other web servers, effective management of the processor load and an advanced feature set, lighttpd is an ideal choice for serving static websites and assets, acting as a front end for application servers, and running on resource constrained instances where efficiency matters. This cloudimg image delivers lighttpd fully installed and hardened as a managed systemd service, so a working, TLS enabled web server is answering requests within minutes of launch.

lighttpd serves HTTPS directly through its built in TLS engine, the mod_openssl module, so there is no separate reverse proxy to run or maintain. On the first boot of your instance a one shot service generates a unique self signed TLS certificate for that specific instance, so every deployment gets its own key material and no certificate or private key is ever baked into the image. Plain HTTP on port 80 is permanently redirected with a 301 status to HTTPS on port 443, so clients are always upgraded to an encrypted connection. When you are ready for a browser trusted certificate you can drop in your own certificate and key, or use the accompanying guide to obtain one from a certificate authority.

Secure and lean by default: directory listing is disabled so the contents of a directory that has no index file are never exposed, the server version token is suppressed so the software version is not advertised in response headers, and only modern TLS protocol versions are enabled. The document root lives at the standard location and ships with a simple cloudimg landing page you can replace with your own site. lighttpd is configured entirely through a plain text configuration file, so your web server configuration lives in version controllable text and there is no database and no administrative web console to manage.

Application stack: lighttpd runs as the dedicated unprivileged web server account under systemd, listening on port 80 for HTTP, which redirects, and port 443 for HTTPS. There is no login and no password anywhere in the product, because a web server has no administrative account, so this image ships with no known or shared bootstrap credential of any kind.

AWS integrations: place instances behind an Application Load Balancer for high availability and TLS termination with AWS Certificate Manager; stream the lighttpd access and error logs to Amazon CloudWatch Logs for centralised monitoring; and serve or back up static assets with Amazon S3. For network isolation, deploy within a VPC and restrict the security group to ports 80 and 443 for the web tier and SSH to your administrative IP range.

Key capabilities: a fast, event driven web server with a very small memory footprint; HTTPS served directly by lighttpd through mod_openssl with a per instance self signed certificate generated at first boot; an automatic and permanent HTTP to HTTPS redirect; a hardened default posture with directory listing disabled and the server version token suppressed; a simple, readable configuration file for virtual hosts, static file serving, URL rewriting, access control and FastCGI or proxy back ends; and efficient static file delivery that makes lighttpd an excellent origin server or front end for your applications.

Get started: browse to the instance over HTTPS to see the cloudimg landing page, replace the document root with your own site or point lighttpd at your application back end, add virtual hosts and TLS certificates as described in the guide, then open ports 80 and 443 to your users. cloudimg engineers can help you design virtual hosts, configure TLS, tune performance and wire lighttpd in front of your applications after purchase.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.