Perimattic Managed Zulip - Team Chat on AWS

This AMI runs Zulip, the open-source team chat with threaded conversations (topics), on Ubuntu 24.04 LTS. It uses the official Zulip server Docker image (ghcr.io/zulip/zulip-server 12.3-0) with the services Zulip's own Docker Compose file lists: PostgreSQL 14 (zulip/zulip-postgresql, pinned by digest), memcached 1.6.45, RabbitMQ 4.2.9 and Valkey 9.1.3. All images are pinned and baked into the AMI, so first start does not depend on a registry. Zulip is an independent project and Perimattic is not affiliated with it.

Why Zulip?

Zulip organizes every conversation into channels and topics, so a team can catch up asynchronously without losing threads. It has search, integrations, bots, an API, desktop and web clients, and self-hosting with all features of the server included.

What Perimattic adds

Secure by default: on a fresh Zulip server, whoever reaches it first can create the organization. Here, during first-login setup, the first organization and its owner are created on your server with Zulip's own create_realm management command and a random 24-character password, before the site is published. The organization is invite-only, no organization creation link is generated, and setup checks that a stranger can neither create an organization nor join without an invitation, that a wrong password and anonymous requests are refused. All service passwords and the Django secret key are generated per instance and passed to the containers as Docker secrets. No default credential exists.

Pinned, tested versions: every image is fixed to an exact tag or digest, not 'latest', so a rebuild never changes the application behind your back.

HTTPS: Apache is configured as a reverse proxy in front of Zulip's plain-HTTP mode and a free Let's Encrypt certificate is requested for your domain with certbot. Only the Docker gateway address is trusted to set forwarded headers. Zulip listens only on the loopback interface; the database, memcached, RabbitMQ and Valkey are reachable only inside the Docker network.

Patched base: Ubuntu 24.04 LTS built through an automated EC2 Image Builder pipeline, with security updates applied at build time.

Email, memory and limits

Zulip needs a host name (a domain with an A record pointing at the instance). Without an SMTP server, invitations by email, password-reset emails and missed-message notification emails do not work: the owner can still invite people with a reusable invitation link and can set a password on the server. Add your SMTP settings to the compose file to enable email. Mobile push notifications need Zulip's push service and are not configured. Zulip is memory hungry: with no users or messages, Zulip used about 1.7 to 2.3 GB and its four services about 0.25 GB more (measured on t3.medium and t3.large with queue workers in one process); Zulip's own minimum is 2 GB. See the recommended instance type below. Uploads, daily database dumps and configuration are in /opt/app/zulip-data and the database in /opt/app/postgres on the root volume: choose the EBS volume size for your use and take snapshots for backup.

Licence

Zulip is released under the Apache License 2.0; this AMI runs the unmodified official image. PostgreSQL is released under the PostgreSQL License, memcached and Valkey under BSD licences and RabbitMQ under the Mozilla Public License 2.0.

Getting Started Launch the AMI and open ports 22, 80 and 443 in the security group SSH in and answer the setup prompts (domain and owner email) Open https://your-domain  and sign in with the owner email and the password printed at the end of setup Invite your team with an invitation link

This AMI is built and supported by Perimattic.

Book a free setup consultation at https://cal.com/gaurav-pareek-perimattic/marketplace-setup-consultations  or email us at aws-support@perimattic.com .

Support Managed and supported by Perimattic, a cloud infrastructure company with 13+ years of experience serving global clients. We offer free setup assistance, custom integrations, infrastructure consulting, and 24/7 support.