Perimattic Managed Live Streaming Server on AWS

This AMI runs an open-source live streaming server on Ubuntu 24.04 LTS: your encoder sends a stream to it over RTMP, and viewers watch on your own web page over HLS with a built-in live chat. The upstream vendor image, version 0.3.0, is pinned and baked into the AMI, so first start does not depend on a registry. Data is kept in an SQLite database and a data folder on the instance.

What Perimattic adds

Default credentials replaced: a fresh installation of this server has an administrator password and a stream key that are both a well-known default. During first-login setup this AMI starts the server with its RTMP port closed to the network, replaces both through the administrator API with random values generated on your server (a 24-character password and a 24-character stream key), proves that the defaults and wrong credentials are refused on the admin API and on the RTMP port, and only then opens the RTMP port. Nothing is published through Apache until setup has finished, and no credential is stored in the image.

HTTPS: Apache is configured as a reverse proxy (including the chat WebSocket) and a free Let's Encrypt certificate is requested for your domain with certbot. The web interface listens only on the loopback interface and the server runs as an unprivileged user. The public directory listing and federation are off, and the server sends no telemetry.

Patched base: Ubuntu 24.04 LTS built through an automated EC2 Image Builder pipeline, with security updates applied at build time.

Limits you should know

The RTMP ingest port, TCP 1935, must be open in your security group so that your encoder can reach the server; it accepts a stream only with your stream key. RTMP is not encrypted, so the key crosses the network in the clear: broadcast from a trusted network and change the key if it leaks. The stream page, the video and the chat are public by design: viewers can chat without an account. Transcoding uses a lot of CPU, and video leaves the instance for every viewer, so AWS data transfer charges apply and grow with your audience. In our tests the server used about 130 MB of memory idle and about 180 to 250 MB with one small test stream; we measured only 320x240 and 640x360 test streams, not a production broadcast, so a t3.medium (2 vCPU, 4 GB) is the recommended starting size and heavier or multi-quality streams need more CPU. Stream segments are stored on the instance's root volume.

Licence and attribution

The streaming server is released under the MIT licence; this AMI runs the unmodified upstream image. The image also contains FFmpeg, a GPL build from the Alpine Linux distribution, which is used as a separate program to transcode video. Built on the open-source Owncast (MIT). Not affiliated with, endorsed by, or sponsored by Owncast; Owncast is a trademark of its owner.

Getting Started Launch the AMI and open ports 22, 80, 443 and 1935 in the security group SSH in and answer the setup prompts (domain and admin email) Open https://your-domain/admin  and sign in as admin with the password printed at the end of setup In your encoder choose a custom RTMP service with the server address and stream key printed at the end of setup, then start streaming

A domain name with an A record pointing at the instance is required, because the site is served over HTTPS.

This AMI is built and supported by Perimattic.

Book a free setup consultation at https://cal.com/gaurav-pareek-perimattic/marketplace-setup-consultations  or email us at aws-support@perimattic.com .

Support Managed and supported by Perimattic, a cloud infrastructure company with 13+ years of experience serving global clients. We offer free setup assistance, custom integrations, infrastructure consulting, and 24/7 support.