AliasVault on Ubuntu 24.04 on Azure User Guide

Overview

AliasVault is an open source, end to end encrypted password manager combined with a private email alias service that you host yourself. For every website you sign up to, AliasVault can generate a unique identity and a unique email alias, receive email for that alias through its own built in mail server, and store the login in a zero knowledge vault. Your master password never leaves your device, so the server only ever holds encrypted data.

The cloudimg image runs AliasVault the officially supported way: the upstream Docker Compose stack, pinned to release 0.30.1, orchestrated by systemd. Seven containers run on a private network behind an nginx reverse proxy that terminates TLS: a Blazor web client, a REST API, an admin panel, a built in SMTP mail server, a background task runner and a bundled PostgreSQL database. Because AliasVault stores your most sensitive credentials, security is enforced from first boot, before the ports are reachable: a unique admin password, JWT signing key, data protection key and database password are generated for each VM, and a fresh self signed TLS certificate is created. Backed by 24/7 cloudimg support.

AliasVault is a trademark of its respective owner. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by AliasVault. It ships the unmodified upstream open source release under the GNU Affero General Public License v3.0 (AGPL-3.0); the verbatim licence and a pointer to the corresponding source ship inside the image under /usr/share/doc/cloudimg/third-party-licences.

What is included:

• AliasVault v0.30.1, the full open source stack, pinned to the upstream release and captured into the VM
• A bundled PostgreSQL database and a built in SMTP mail server, reachable only inside a private Docker network (PostgreSQL is never published to a host port)
• A web vault client, an admin panel and a REST API behind an nginx reverse proxy that terminates TLS on port 443
• docker.service, aliasvault-firstboot.service and aliasvault.service as systemd units, enabled and active on boot
• A unique admin password, JWT signing key, data protection key and database password generated per VM on first boot, never baked into the image
• A clean, empty instance on first boot: no default account, no shipped vault and no prior data
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) comfortably runs the full stack and is a sensible starting point; increase the size for more users and heavier mail traffic. NSG inbound rules: allow 22/tcp from your management network, 443/tcp for the web interface, and 25/tcp plus 587/tcp if you want to receive alias email from the internet. The web interface is served over HTTPS with a per VM self signed certificate; for production, front it with your own domain and a trusted certificate (see the final section).

Step 1 - Deploy from the Azure Marketplace

1. In the Azure portal, choose Create a resource and search the Marketplace for the cloudimg AliasVault offer.
2. Select the plan, then Create.
3. On the Basics tab pick your subscription, resource group and region, name the VM, and select Standard_B2s (or larger).
4. Choose SSH public key authentication with admin username azureuser and provide your public key.
5. On the Networking tab, allow inbound 22/tcp from your management network, 443/tcp for the web interface, and 25/tcp plus 587/tcp for mail.
6. Review and create. When the VM is running, note its public IP address.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group my-aliasvault-rg \
  --name aliasvault \
  --image cloudimg:aliasvault-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the ports the web interface and mail server need (SSH is opened by default):

az vm open-port --resource-group my-aliasvault-rg --name aliasvault --port 443 --priority 900
az vm open-port --resource-group my-aliasvault-rg --name aliasvault --port 25 --priority 910
az vm open-port --resource-group my-aliasvault-rg --name aliasvault --port 587 --priority 920

Step 3 - Connect to your VM

ssh azureuser@<vm-ip>

Step 4 - Confirm the services are running

The systemd units come up on boot. Check the orchestrating services:

systemctl is-active docker aliasvault-firstboot aliasvault

active
active
active

List the containers that make up the stack:

cd /opt/aliasvault && sudo docker compose ps --format 'table {{.Service}}\t{{.Status}}\t{{.Ports}}'

SERVICE         STATUS                    PORTS
admin           Up 44 seconds             3002/tcp
api             Up 44 seconds             3001/tcp
client          Up 50 seconds             80/tcp, 3000/tcp
postgres        Up 50 seconds (healthy)   5432/tcp
reverse-proxy   Up 44 seconds             0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp
smtp            Up 44 seconds             0.0.0.0:25->25/tcp, 0.0.0.0:587->587/tcp
task-runner     Up 44 seconds

Only the reverse proxy (80/443) and the SMTP mail server (25/587) publish host ports. PostgreSQL, the API, the admin panel and the client are reachable only inside the private Docker network.

Step 5 - Secure by default: per VM secrets generated on first boot

Because AliasVault stores your most sensitive credentials, this image never ships a default password. On the very first boot, before the ports are reachable, a unique admin password, JWT signing key, data protection key and PostgreSQL password are generated for this VM, and a fresh self signed TLS certificate is created. The admin password is written to a root only file:

sudo cat /root/aliasvault-credentials.txt

# AliasVault (v0.30.1) - cloudimg Azure Marketplace image
ALIASVAULT_URL=https://<vm-ip>/
ALIASVAULT_ADMIN_URL=https://<vm-ip>/admin
ALIASVAULT_ADMIN_USERNAME=admin
ALIASVAULT_ADMIN_PASSWORD=<ALIASVAULT_ADMIN_PASSWORD>

The four secrets live under /opt/aliasvault/secrets as root only files and are mounted read only into the containers. The vault itself is zero knowledge: each user's master password derives their encryption key on the client, so no vault key is ever stored on the server or shipped in the image.

Step 6 - Open the web vault and register your account

Browse to https://<vm-ip>/. The certificate is a per VM self signed certificate, so your browser will warn once; accept it (or add your own certificate later, see the final section). On the sign in screen choose Create account and register your vault with a username and a strong master password.

Your master password is the key to your zero knowledge vault. It is never sent to the server and cannot be recovered by anyone, including you, if lost, so store it safely.

Step 7 - Create identities and email aliases

Inside the vault, use Create to generate a new credential. AliasVault can auto generate a full identity (name, username and a strong password) and a unique email alias for the site you are signing up to, then store it all encrypted. When a website emails that alias, the mail is received by the built in mail server and shown against the credential (once you have configured a private email domain, see Step 9).

Step 8 - Sign in to the admin panel

AliasVault has a separate admin panel for managing the server (users, statistics, server settings). It is served at https://<vm-ip>/admin and signs in with the username admin and the per VM password from Step 5.

sudo grep -E '^ALIASVAULT_ADMIN_(USERNAME|URL)=' /root/aliasvault-credentials.txt

ALIASVAULT_ADMIN_URL=https://<vm-ip>/admin
ALIASVAULT_ADMIN_USERNAME=admin

Step 9 - Receive alias email (private email domains)

To receive email at your aliases from the internet, point DNS at this VM and set your private email domains. Add an MX record for your mail domain pointing at the VM, an A record for the mail hostname, and (recommended) an SPF/PTR record, then list the domains in /opt/aliasvault/.env (replace <your-domain> with your mail domain):

sudo sed -i 's/^PRIVATE_EMAIL_DOMAINS=.*/PRIVATE_EMAIL_DOMAINS=<your-domain>/' /opt/aliasvault/.env
cd /opt/aliasvault && sudo docker compose up -d

The SMTP server listens on ports 25 and 587; make sure both are open in your NSG. See the AliasVault documentation for the full DNS and deliverability setup.

Step 10 - Check the stack health from the command line

The reverse proxy redirects plain HTTP to HTTPS, the web client is served over HTTPS, and the API exposes an unauthenticated health endpoint that returns OK once the database is reachable and migrations are applied:

echo "http  -> $(curl -sk -o /dev/null -w '%{http_code}' http://127.0.0.1/)"
echo "https -> $(curl -sk -o /dev/null -w '%{http_code}' https://127.0.0.1/)"
echo "api   -> $(curl -sk https://127.0.0.1/api/)"

http  -> 301
https -> 200
api   -> OK

Step 11 - Lock down open registration after onboarding

Public registration is enabled by default so you can create your own vault account. Once your account (and your family's) exists, disable open sign up so nobody else can register on your instance. The AliasVault management CLI is vendored into the workspace (run it against <your-domain> deployment):

sudo /opt/aliasvault/install.sh configure-registration

Or set PUBLIC_REGISTRATION_ENABLED=false in /opt/aliasvault/.env and run cd /opt/aliasvault && sudo docker compose up -d.

Step 12 - Production: your own domain with TLS

For production, front AliasVault with your own domain and a trusted certificate rather than the per VM self signed certificate. AliasVault ships a Let's Encrypt integration through the vendored CLI. Point an A record for <your-domain> at the VM first, then:

# after <your-domain> resolves to this VM:
sudo /opt/aliasvault/install.sh configure-hostname
sudo /opt/aliasvault/install.sh configure-ssl

Keep 443/tcp (and 80/tcp for the ACME challenge) open in the NSG. Restrict 22/tcp to your management network, and only open the mail ports (25, 587) if you are receiving alias email. Keep the OS current with unattended security updates (enabled by default on this image).

Support

This image is built and supported by cloudimg. For help, contact support@cloudimg.co.uk. AliasVault is open source software under the AGPL-3.0 licence; the verbatim licence and a pointer to the corresponding source ship in the image under /usr/share/doc/cloudimg/third-party-licences. cloudimg is not affiliated with, endorsed by, or sponsored by AliasVault.