Perimattic Managed Temporal - Workflow Orchestration on AWS

This AMI runs the Temporal server, its Web UI and PostgreSQL 17 on Ubuntu 24.04 LTS, as a single-node Temporal cluster. The official images temporalio/server (1.32.2), temporalio/admin-tools (1.32.2) and temporalio/ui (2.58.0) are pinned, with PostgreSQL 17.11, and baked into the AMI, so first start does not depend on a registry. Temporal is an independent open-source project and Perimattic is not affiliated with Temporal Technologies; product names are trademarks of their respective owners.

Why Temporal?

Temporal runs durable workflows: your code (written with the Temporal SDKs for Go, Java, Python, TypeScript, .NET and others) keeps its state across crashes and deploys, with retries, timers, signals, schedules and a Web UI to inspect every execution.

What Perimattic adds

Temporal has no authentication of its own, neither on its gRPC API nor in its Web UI, so this image does not publish either one openly. The Web UI is served by Apache over HTTPS behind HTTP Basic authentication (user admin and a random 24-character password generated on your server, stored only as an Apache hash). The gRPC frontend (port 7233) listens on the loopback interface only and is never proxied: your workers and clients reach it through an SSH tunnel (ssh -N -L 7233:127.0.0.1:7233 ubuntu@your-server), so only people who can SSH to the server can use it. Setup checks that the gRPC port answers on loopback and not on the server's own network address, and the tests check that the UI refuses requests without the password.

Set up for you: setup creates Temporal's two databases and schemas (the server image does not), starts the server and UI, and creates the default namespace with 72 hours of retention. The server runs with 4 history shards and one task-queue partition per queue (conservative for one node); dynamic configuration is in /opt/app/dynamicconfig/docker.yaml. The Temporal CLI is available on the server: sudo docker compose exec temporal-admin-tools temporal operator cluster health. The server's version check and the UI's news fetch are off.

HTTPS: Apache is configured as a reverse proxy and a free Let's Encrypt certificate is requested for your domain with certbot. PostgreSQL is reachable only inside the Docker network.

Patched base: Ubuntu 24.04 LTS built through an automated EC2 Image Builder pipeline, with security updates applied at build time.

What you should know

This is a single-node install. The number of history shards is fixed when the cluster is created (4 here) and cannot be changed later, so it suits development, small and moderate workloads, not a large production cluster. Anyone who can reach port 7233 can start, signal and terminate workflows: if you open it to a network you must add mutual TLS or an authorizer yourself first. Anyone with the Web UI password can use the UI's start, signal, terminate and reset actions.

Temporal is light at idle: about 135 MB of memory for the server, 30 MB for the Web UI, 110 to 150 MB for PostgreSQL and 80 to 110 MB for the idle CLI container in our tests, and the full stack passed all tests on a t3.small (2 GB), which is the recommended starting size; busy clusters need more.

Licence

The Temporal server, its CLI tools and the Temporal Web UI are released under the MIT licence; this AMI runs the unmodified upstream images, whose source is at github.com/temporalio/temporal and github.com/temporalio/ui. PostgreSQL is released under the PostgreSQL License.

Getting Started Launch the AMI and open ports 22, 80 and 443 in the security group (not 7233) SSH in and answer the setup prompts (domain and admin email) Open https://your-domain  and sign in as admin with the password printed at the end of setup Open an SSH tunnel to port 7233 and point your workers at 127.0.0.1:7233, namespace default

A domain name with an A record pointing at the instance is required, because the site is served over HTTPS.

This AMI is built and supported by Perimattic.

Book a free setup consultation at https://cal.com/gaurav-pareek-perimattic/marketplace-setup-consultations  or email us at aws-support@perimattic.com .

Support Managed and supported by Perimattic, a cloud infrastructure company with 13+ years of experience serving global clients. We offer free setup assistance, custom integrations, infrastructure consulting, and 24/7 support.