Bluesky PDS - AT Protocol Personal Data Server - AMI by cloudimg

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Run your own federated Bluesky node on AWS without the complexity of manual deployment. This delivers the official Bluesky Personal Data Server fully installed, configured, and serving behind an nginx reverse proxy - answering AT Protocol requests within minutes of launch.

Standing up a PDS from source means installing Docker, wiring a reverse proxy with WebSocket support for the repository firehose, provisioning persistent storage for account databases and the blobstore, generating a JWT signing secret, an admin password and a secp256k1 PLC rotation key, and building health checks. This is fiddly, security-sensitive work that must be repeated for every environment. This image removes all of it, giving you a hardened stack with unique per-instance secrets generated on first boot and zero shared or default credentials.

• Immediate federation readiness: the PDS container is version-frozen to a pinned image digest, fronted by nginx with WebSocket upgrade configured for the atproto firehose, and starts serving on boot
• Dedicated data disk: account databases, repository data, and the blobstore live on a separate EBS volume you can resize independently of the OS disk
• Automatic secret generation: first boot creates a unique JWT signing secret, admin password, and PLC rotation key - no manual key management required
• Full com.atproto XRPC surface: supports invite-gated account creation, connects to public directory and app-view services, and exposes the admin API for server management
• Health endpoint built in: ready for load balancer health checks and uptime monitoring out of the box

The PDS runs as a container bound to the loopback interface and fronted by nginx on port 80. The Docker engine and reverse proxy start on boot, and the container restarts on failure. The WebSocket upgrade needed by the atproto firehose is pre-configured, along with a generous upload limit for blobs. All persistent data lives on a dedicated disk, separate from the operating system.

The image ships domain-free: on first boot the server binds to the instance's own address so it is immediately verifiable. To federate with the wider Bluesky network, point a DNS hostname (and a wildcard record for user handles) at the instance, set that hostname in the server's environment file, and restart the service. TLS can be terminated with an AWS Application Load Balancer or your own certificate. The paired cloudimg user guide walks through every step.

• No shared secrets: a one-shot first-boot service generates all cryptographic material unique to your instance and records the admin password in a root-only file; no default or hardcoded passwords ship in the image, and you should change the admin password on first login
• Network isolation: the PDS container binds only to loopback and is never directly exposed
• Encryption in transit: terminate TLS on an AWS ALB or configure your own certificate
• Encryption at rest: enable EBS encryption on the dedicated data disk
• Security groups: restrict inbound access to served ports from your trusted IP ranges

• Independent operators and communities: host accounts and data on infrastructure you control rather than relying on a single provider
• Developers and integrators: get a real atproto server for building and testing clients, bots, feed generators, and protocol integrations
• Organisations and brands: run official accounts on your own domain with your own moderation and retention policies while remaining federated

Launch the AMI, verify the health endpoint responds, then follow the paired cloudimg user guide to configure your domain and begin federating. For deployment assistance, contact cloudimg support.