Sold by: Lynxroute
Deployed on AWS
Free Trial
This is a repackaged open source software product wherein additional charges apply for hardening, security configuration, and setup support.
Umami is a privacy-friendly, self-hosted web analytics platform - a Next.js application backed by PostgreSQL that tracks pageviews, sessions, events, referrers, devices, and custom events without setting cookies or storing personal data. This Lynxroute build is hardened and ready out of the box: the seeded admin password is rotated to a random 24-character string at first boot, the app is bound to 127.0.0.1 and reachable only through Nginx with TLS, PostgreSQL lives entirely inside the Docker compose bridge, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base.
MIT license - fully auditable, no vendor lock-in.
Overview
This is a repackaged open source software product wherein additional charges apply for hardening, security configuration, and setup support.
WHAT IS UMAMI
Umami is an open-source, privacy-friendly, self-hosted web analytics platform - a lightweight alternative to Google Analytics and Plausible. It is a Next.js + Node 22 application backed by PostgreSQL 15. It tracks pageviews, sessions, events, referrers, devices, and custom events without setting cookies and without storing personal data, which removes the need for cookie consent banners on most jurisdictions (GDPR, CCPA, PECR). Owners manage multiple sites in one dashboard, share read-only public pages, define custom event tracking, build their own dashboards via Boards, and capture optional session replay. Integrates with any website by pasting a small JavaScript snippet into the - no SDK, no build step, no third-party tracking pixel. Persists pageviews, sessions, events, and dashboards in PostgreSQL 15. MIT license, no vendor lock-in. Self-hosting puts your visitor data entirely under your control, eliminates per-pageview SaaS pricing, and keeps every event on infrastructure you own.
WHAT THIS AMI ADDS
Security hardening:
- Seeded admin:umami credential rotated to a random 24-character password at first boot - written to /root/umami-credentials.txt, the rotation verified to no longer authenticate before the AMI accepts traffic
- Umami app bound to 127.0.0.1:3000 only - reachable through the Nginx reverse proxy with TLS, never directly exposed on the host network
- PostgreSQL 15 inside the Docker compose bridge - no host port mapping, never reachable on 0.0.0.0:5432
- Per-instance PostgreSQL password and APP_SECRET generated at first boot - never baked into the AMI
- Nginx reverse proxy with TLS, HTTP-to-HTTPS redirect, hardened cipher suite, security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy)
- UFW firewall pre-configured - only TCP 22, 80, 443 exposed
- fail2ban, AppArmor
- CVE scan - every image is scanned for vulnerabilities before release
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, SSH hardening, kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Highlights
- Umami security baked in: the upstream-seeded admin:umami credential is rotated to a random 24-character password at first boot via the official Umami password API, the app is bound to 127.0.0.1 and reachable only through Nginx with TLS, PostgreSQL lives entirely inside the Docker compose bridge.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.small Recommended | $0.03 |
m6i.large | $0.05 |
t2.large | $0.05 |
t3.large | $0.05 |
t3.medium | $0.05 |
Dimensions summary
You pay by the hour based on the EC2 instance size you run. The five options — t3.small, t3.medium, t2.large, t3.large, and m6i.large — differ in compute and memory capacity. Larger instances carry a higher hourly rate. All run the same hardened Umami analytics image, so your choice depends on the workload you expect. Pick a smaller instance for light traffic and a larger one for heavier use. Billing runs on usage, so you pay only for the hours your instance runs, plus standard AWS infrastructure charges.
Top-of-mind questions for buyers
One billing unit is one running EC2 instance measured per hour. Each option maps to a specific instance size with its own compute and memory allocation. The t3.small and t3.medium suit lighter traffic, while t2.large, t3.large, and m6i.large give more capacity for heavier workloads.
The hourly software rate meters running time only. A fully stopped instance stops accruing that charge. Stopped instances may still incur standard AWS storage fees for attached volumes, but those are separate AWS infrastructure charges, not the software rate.
All five options run the same hardened Umami image, so switching instance sizes changes only the underlying EC2 type. Your hourly software rate follows the instance you run. A larger instance carries a higher hourly rate; you pay the new rate for the hours it runs.
lynxroute.com
Helpful?
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Umami 3.3.1
- Umami 3.3.1 - privacy-friendly, open-source web analytics (patch update from 3.3.0). MIT unchanged
- Hardens two-factor authentication when TWO_FACTOR_ENCRYPTION_KEY is missing or invalid, with safer API enforcement and clearer configuration feedback
- Fixes event property filtering so fields and values respect the selected event name, preserves events without a matching session record, and stabilises relational event pagination
- Preserves the root path when REMOVE_TRAILING_SLASH is enabled, and resets tracker visit state when a session drifts
- Adds the 24_lowercase_username migration, which normalises usernames carried over from pre-3.2 installations
- Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com
- Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base
Additional details
Usage instructions
- Launch instance (t3.small recommended)
- Open Security Group - allow TCP 443 from your IP
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read credentials: sudo cat /root/umami-credentials.txt
- Open https://<PUBLIC_IP>/ in your browser - accept the self-signed certificate warning
- Log in as username "admin" with the password from the credentials file
- Add a website: Settings -> Websites -> Add - then copy the tracking <script> snippet
- Paste the <script> snippet into the <head> of the website you want to track
The admin username is "admin"; the password is a random 24-character string generated at first boot. Credentials are saved to /root/umami-credentials.txt at first boot (mode 0600). Replace the self-signed TLS certificate with a CA-signed certificate for production use: sudo certbot --nginx -d YOUR_DOMAIN
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com
For Umami documentation: https://umami.is/docs For Umami upstream issues:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Self-hosted, privacy-friendly web analytics. No cookies, fully GDPR compliant. A lightweight alternative to Google Analytics with Plausible CE v3.2.0, ClickHouse, PostgreSQL, and Caddy for automatic HTTPS.
Private Business Intelligence and Privacy Analytics Server by Optick gives organizations a ready to launch analytics server with Apache Superset for dashboards and data exploration, Umami for privacy focused website and product analytics, AWS ready data connectors, first boot automation, and AI ready Superset MCP support. This product helps teams launch a private analytics workspace quickly without manually assembling the database, cache, reverse proxy, credentials, and application services. This product has charges associated with it for the provision and deployment of the application and AMI support.
Self-hosted Matomo web analytics on Ubuntu 24.04 with Docker Compose, MariaDB, Nginx, first-boot credential generation, hourly archiving, helper commands, backup support, and optional HTTPS setup. Built for fast deployment on AWS by Code Creator. This product has charges associated with it for the provision and deployment of the application and AMI support.
Private Business Intelligence and Privacy Analytics Server by Optick gives organizations a ready to launch analytics server with Apache Superset for dashboards and data exploration, Umami for privacy focused website and product analytics, AWS ready data connectors, first boot automation, and AI ready Superset MCP support. This product helps teams launch a private analytics workspace quickly without manually assembling the database, cache, reverse proxy, credentials, and application services. This product has charges associated with it for the provision and deployment of the application and AMI support.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.