Step 1 — Launch an EC2 instance

1. Go to EC2 Console (opens in a new tab) → Instances → Launch instances
2. Fill in the form:

3. Expand Advanced details → scroll to User data
4. Choose how to deploy:

Option A — Bootstrap snippet (EC2 console, recommended)

AWS user-data has a 16 KB paste limit. The full script exceeds this, so paste this small bootstrap instead — it fetches the full script from GitHub at first boot:

#!/bin/bash
export PROJECT_ID="rtsurvey"
export ADMIN_PASSWORD="admin"
export EMBED_KEYCLOAK="true"
export TZ="Asia/Ho_Chi_Minh"
curl -fsSL https://raw.githubusercontent.com/therealtimex/rtsurvey/main/scripts/aws-ec2.sh | bash

Customise by changing the export lines before launching.

Option B — Full script via AWS CLI

The 16 KB limit does not apply when uploading via the CLI. Download aws-ec2.sh, edit the CONFIGURATION block at the top, then launch:

aws ec2 run-instances \
  --image-id ami-0c02fb55956c7d316 \
  --instance-type t3.medium \
  --key-name YOUR_KEY_PAIR \
  --security-group-ids sg-xxxxxxxx \
  --user-data file://aws-ec2.sh \
  --count 1

5. Click Launch instance (Option A) or run the CLI command (Option B)

Recommended instance types

Step 2 — Configure security group rules

Create a new security group with these inbound rules:

Outbound: Allow all (required for Docker image pulls and Let's Encrypt).

Step 3 — Wait for setup to complete

The script runs automatically on first boot. It installs Docker, pulls the rtSurvey image, initialises the database, and starts all services. This takes 5–10 minutes.

No console access needed. Open your browser and go to http://<instance-public-ip>. You will see a loading page while the app finishes starting up. It refreshes automatically every 5 seconds and loads the app once ready.

The instance public IP is shown in the EC2 → Instances list. If you assigned an Elastic IP, use that instead.

To watch the log directly:

ssh ubuntu@<instance-public-ip>
sudo tail -f /var/log/rtsurvey-setup.log

Step 4 — Set up SSL

Once the app is running, follow the Set Up SSL guide → to configure HTTPS. The free rtsurvey.com subdomain is the fastest option — no DNS setup needed.

Step 5 — Change the default password

All passwords default to admin. Change them immediately after your first login:

• App admin password — account settings inside the app
• Keycloak admin — accessible at https://your-domain.com/auth/admin (login: admin / admin)

Security group rules

Inbound

Outbound

Ports NOT needed externally

Troubleshooting

Check the setup log

sudo tail -200 /var/log/rtsurvey-setup.log

Check the SSL log

sudo tail -200 /var/log/rtsurvey-ssl.log

View container status

docker compose -f /opt/rtsurvey/docker-compose.production.yml ps