Developer Tools Azure

Accent on Ubuntu 24.04 on Azure User Guide

| Product: Accent on Ubuntu 24.04 LTS on Azure

Overview

This guide covers the deployment and configuration of Accent on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Accent is an open source, developer oriented translation and localisation management platform. It takes the translation files that already live in your codebase, JSON, YAML, gettext PO, Android XML, Apple .strings, XLIFF, CSV, Java properties and more, and turns them into a shared workspace where developers, translators and reviewers all work against the same source of truth. Files are pushed in and pulled back out over a sync and export API, so Accent slots into an existing build pipeline instead of replacing it, and every key keeps a full history of who changed what and when.

Around that core it adds a side by side editor with comments and a review state for each key, conflict detection when a source string changes underneath an existing translation, versioned releases of a revision, linting for problems such as missing interpolation placeholders, and per project collaborator roles. A GraphQL API and a command line client cover automation, so a project can be synchronised from continuous integration on every merge.

The cloudimg image ships the free and open source, BSD 3 Clause licensed Accent release, run the officially supported way as the upstream container pinned by image digest, paired with PostgreSQL 16. Both images are captured into the VM, so your instance starts in seconds with nothing to download. Accent itself has no password authentication, so this image does not leave it open: the application binds to the loopback interface, PostgreSQL publishes no host port at all, and nginx on port 80 is the single public listener, gated by a unique web credential generated on the first boot of every VM. The Phoenix session signing key, the cookie signing salt, the machine translation vault key and the database password are all generated per instance on that same first boot, replacing the published upstream defaults. Backed by 24/7 cloudimg support.

Accent is a trademark of its respective owner. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by Mirego or the Accent project. It ships the free and open source BSD 3 Clause licensed software, unmodified.

The docker, accent-firstboot, accent, accent-postboot and nginx services all active, and the two compose containers, the Accent release and PostgreSQL 16, running and healthy

What is included:

  • Accent 1.30.4 — the official upstream release container, pinned by image digest, with the compiled web application bundle built in
  • PostgreSQL 16 — the application database, on a private container network with no host port published
  • nginx — the single public listener on port 80, gated by a per instance web credential
  • First boot secret generation — session signing key, cookie signing salt, machine translation vault key, database password and web credential, all unique to each VM
  • A bundled self test — imports a translation file and reads the exact strings back out again, proving the platform really works end to end

Prerequisites

  • An Azure subscription with permission to create virtual machines
  • An SSH key pair for administrative access
  • A network security group allowing inbound TCP 22 (SSH) and TCP 80 (web UI) from your own address ranges
  • Standard_B2s (2 vCPU, 4 GB RAM) or larger

Step 1: Deploy from the Azure Portal

  1. Open the Azure Marketplace and search for Accent on Ubuntu 24.04 LTS by cloudimg.
  2. Select Create, then choose your subscription, resource group and region.
  3. Pick a VM size of Standard_B2s or larger.
  4. Under Administrator account, select SSH public key and supply your public key.
  5. Under Inbound port rules, allow SSH (22) and HTTP (80).
  6. Select Review + create, then Create.

Step 2: Deploy from the Azure CLI

az group create --name accent-rg --location eastus

az vm create \
  --resource-group accent-rg \
  --name accent-vm \
  --image cloudimg:accent-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

az vm open-port --resource-group accent-rg --name accent-vm --port 80 --priority 1010

Step 3: Connect to your VM

ssh azureuser@<vm-ip>

Step 4: Confirm the services are running

Five units make up the deployment: docker, accent-firstboot (which generates this VM's secrets), accent (the compose stack), accent-postboot (which bootstraps the administrator account) and nginx.

systemctl is-active docker accent-firstboot accent accent-postboot nginx

All five report active. The two containers should both be up:

sudo docker ps --format '{{.Names}}\t{{.Image}}\t{{.Status}}'

Step 5: Confirm the network exposure

Accent is deliberately not reachable directly. Only nginx listens publicly:

ss -tln | grep -E ':(80|4000|5432) '

You will see 127.0.0.1:4000 for Accent and 0.0.0.0:80 for nginx. PostgreSQL appears nowhere, because it publishes no host port at all and is reachable only from the Accent container on a private network.

Accent listening on 127.0.0.1:4000 only, nginx listening publicly on port 80, and PostgreSQL publishing no host port at all

Step 6: Read the per instance credentials

Every VM generates its own secrets on first boot. They are written to a file only root can read:

sudo cat /root/accent-credentials.txt

The file records the web credential (WEB_USER and WEB_PASSWORD), the administrator email address for signing in to Accent, and this VM's URL. Confirm the file is locked down:

ls -l /root/accent-credentials.txt

stat -c '%a %U:%G  %n' /root/accent-credentials.txt

The accent-credentials.txt file at mode 0600 root root, and the per VM environment file and nginx credential file in /etc/accent, with the secrets themselves never displayed

Step 7: Understand the security model

This is the most important section of this guide, because Accent's authentication story is unusual.

Accent has no password login of its own. Out of the box, its only ready to use sign in method is a password less email prompt: you type any email address and you are signed in, with no secret at all. Every real identity provider that Accent supports — GitHub, GitLab, Google, Slack, Discord, Microsoft and generic OIDC — requires an OAuth application that only you can register, and those credentials can never be baked into a shared marketplace image.

Left alone on a public IP address, that would mean anyone who could reach the port could sign in. So this image puts a gate in front of it:

  • Accent binds to 127.0.0.1:4000 and is not directly reachable
  • PostgreSQL publishes no host port at all
  • nginx on port 80 is the only public listener, and it requires HTTP Basic authentication using this VM's unique WEB_USER and WEB_PASSWORD

The practical effect is that you sign in twice: once at the browser credential prompt, then once more with the Accent email login. You can verify the gate yourself:

curl -s -o /dev/null -w 'no credential: HTTP %{http_code}\n' http://127.0.0.1/

curl -s -o /dev/null -w 'wrong credential: HTTP %{http_code}\n' -u '<WEB_USER>:definitely-wrong' http://127.0.0.1/

Both return 401. With the real credential it returns 200:

curl -s -o /dev/null -w 'per VM credential: HTTP %{http_code}\n' -u '<WEB_USER>:<WEB_PASSWORD>' http://127.0.0.1/

The image also ships a self test that proves the whole platform works, not merely that a page loads. It signs in, creates a project, imports a translation file it writes itself, then reads the strings back and checks that the exact values and the exact count came back, and that an unauthenticated import writes nothing:

sudo /usr/local/sbin/accent-roundtrip.sh

The bundled self test reporting OK: no credential and no session are refused with 401, the per instance credential is accepted, three translations import and all three are read back with the exact content and count, and an unauthenticated import wrote nothing

Step 8: Open Accent and sign in

Browse to your VM:

<ACCENT_URL>

Your browser first asks for the web credential. Enter WEB_USER and WEB_PASSWORD from Step 6. Accent's own sign in page then appears.

The Accent sign in page, showing the product introduction alongside a Login panel that asks only for an email address

Enter the ADMIN_EMAIL value from your credentials file and select Enter an email and login. You land on the projects list.

The Accent projects list, signed in as the per instance administrator, with a search box and a New project button

Step 9: Create your first project

Select New project, give it a name and choose the main language your source strings are written in. This becomes the project's master revision, and every other language you add is tracked against it.

Step 10: Sync a translation file

Accent imports files through its sync endpoint. This is the same call the command line client and your continuous integration pipeline make. Note that language is required alongside document_format and file:

printf '{"app.title":"Northwind Field Service","nav.jobs":"Jobs"}' > /tmp/en.json

Then push it, substituting your own project id from the browser address bar:

curl -s -o /dev/null -w 'sync: HTTP %{http_code}\n' \
  -u '<WEB_USER>:<WEB_PASSWORD>' \
  -b /tmp/accent-session -c /tmp/accent-session \
  -X POST '<ACCENT_URL>sync' \
  -F 'project_id=<your-project-id>' \
  -F 'document_path=en' \
  -F 'document_format=simple_json' \
  -F 'language=en' \
  -F 'file=@/tmp/en.json;type=application/json'

Once a file has synced, All strings in the project sidebar lists every key with its text and review state.

The Accent strings list for a project, showing real imported keys such as app.title and jobs.status.open alongside their English text and an In Review badge for each

Step 11: Edit and review a string

Select any key to open its editor. You can change the text, mark it as reviewed, discuss it with a collaborator in the conversation tab, and inspect every past edition.

The Accent single string editor for the app.tagline key, showing the editable English text, Update text and Update and mark as reviewed actions, and the Conversation, Activities and Editions tabs

Step 12: Export a file back out

Exporting is the mirror of syncing, and is what your build pipeline calls to pull finished translations back into the codebase. language is required here too:

curl -s -u '<WEB_USER>:<WEB_PASSWORD>' -b /tmp/accent-session \
  '<ACCENT_URL>export?project_id=<your-project-id>&document_path=en&document_format=simple_json&language=en&inline_render=true'

Step 13: Wire up real single sign on

The web credential gate exists because Accent ships no password login. To replace the password less email login with a real identity provider, register an OAuth application with your provider, then add its credentials to this VM.

Accent reads them from the environment, so add the keys to the per instance environment file and the matching entries to the compose file:

sudo nano /etc/accent/accent.env

For GitHub you would add GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET; for a generic OIDC issuer, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET and OIDC_DISCOVERY_URI. Google, GitLab, Slack, Discord and Microsoft follow the same pattern. Then reference those variables in the accent service's environment: block:

sudo nano /etc/accent/compose.yaml

Restart the stack to pick them up:

sudo systemctl restart accent

Set the callback URL at your provider to <ACCENT_URL>auth/<provider>/callback. Once your provider works, you can remove DUMMY_LOGIN_ENABLED from the compose file so the password less email login disappears, and if you are confident your provider is the only way in you can then drop the auth_basic lines from /etc/nginx/sites-available/accent.

No third party credentials of any kind ship in this image, and no single sign on is configured out of the box.

Step 14: Managing the service

sudo systemctl status accent --no-pager

sudo docker logs accent --tail 50

Restart or stop the whole stack with sudo systemctl restart accent and sudo systemctl stop accent.

Step 15: Use your own domain and HTTPS (production)

Accent is served over plain HTTP on port 80 so it works the moment the VM boots. For production, point a DNS name at the VM and terminate TLS in front of it. After adding a certificate, set CANONICAL_URL in /etc/accent/accent.env to your https:// address and restart, so the links Accent generates in emails and authentication redirects use your domain. Because the scheme is then HTTPS, Accent also enables secure cookies automatically.

Step 16: Security recommendations

  • Restrict inbound port 80 to the networks that genuinely need it
  • Put TLS in front of the VM before using it with real content, so neither the web credential nor session cookies travel in clear text
  • Replace the password less email login with a real identity provider as soon as practical (Step 13)
  • Set RESTRICTED_PROJECT_CREATOR_EMAIL_DOMAIN if you want to limit who can create projects
  • Keep /root/accent-credentials.txt at mode 0600 and never copy it onto a shared system
  • Back up the accent_pgdata Docker volume, which holds every project, translation and revision

Step 17: Support and Licensing

Accent is open source software distributed under the BSD 3 Clause Licence (Copyright Mirego). This image also carries the LGPL 2.1 licensed LanguageTool grammar engine that Accent bundles for its linting checks, Hunspell and its dictionaries, Erlang/OTP and Elixir under Apache 2.0, PostgreSQL 16 under the PostgreSQL Licence, Docker Engine under Apache 2.0 and nginx under the BSD 2 Clause Licence. There is no AGPL, SSPL or source available component in the shipped set. All are redistributed unmodified.

Commercial support for the cloudimg image is available 24/7. Upstream project documentation lives at github.com/mirego/accent.

Deploy on Azure

Find Accent on Ubuntu 24.04 LTS by cloudimg on the Azure Marketplace.