Apache Tika Server on Ubuntu 24.04 on Azure User Guide

Overview

Apache Tika Server is the standalone HTTP interface to the Apache Tika toolkit. Send it a document, PDF, Office file, email, image or one of more than a thousand supported formats, and it returns the plain text content and a structured set of metadata such as author, title, dates and the detected media type. It is stateless, holding no data between requests, which makes it a natural building block for search indexing, document processing and retrieval augmented generation (RAG) pipelines that need to turn arbitrary files into clean, machine readable text. Under the hood it uses the mature Apache PDFBox and Apache POI parsers, so it copes with the messy variety of real world documents.

The cloudimg image installs the official tika-server-standard 3.3.1 JAR at /opt/tika, running as the tika service under OpenJDK 17 bound to loopback 127.0.0.1:9998, behind nginx on port 80.

Secure by default, no default login: Tika Server ships with no authentication, and its file fetching and unpack features are a known SSRF/RCE risk if the port is exposed. This image never exposes it. The Tika server binds loopback only and the dangerous features stay disabled (the server is not started with -enableUnsecureFeatures). nginx is the only public listener, fronting the whole REST surface with HTTP Basic Auth. A tika-firstboot.service oneshot generates a unique per VM password on each VM's first boot, writes a bcrypt .htpasswd and a root only info note, proves the auth gate with a real extraction round trip, then disables itself. No two VMs share a password and none is baked into the image.

Note on the interface: Tika Server is an API first service with no bundled web interface. You drive it through its REST API, the official Tika client libraries, or your own application. This guide uses curl against the API.

What is included:

• Apache Tika Server 3.3.1 (tika-server-standard) on OpenJDK 17
• tika.service bound to 127.0.0.1:9998, run as a dedicated non root tika user under a hardened systemd unit
• nginx reverse proxy on port 80 with per VM HTTP Basic Auth, ready for TLS
• An unauthenticated /healthz endpoint for load balancer and probe checks
• tika-firstboot.service for the first boot per VM password and gate proof
• A unique per VM password generated on first boot, in a root only 0600 file
• Sample fixtures under /opt/tika/samples so you can test extraction immediately
• Ubuntu 24.04 LTS base, fully patched
• 24/7 cloudimg support, 24h response SLA

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet with a subnet. Tika is CPU and memory bound while parsing; extraction of large or complex documents benefits from more RAM. Recommended VM size: Standard_B2s (2 vCPU, 4 GB RAM) for evaluation and light workloads, or a Standard_D2s_v5 or larger for production throughput and large documents.

Step 1: Deploy from the Azure Portal

Search the Marketplace for Apache Tika Server on Ubuntu 24.04, choose your VM size, and attach an NSG that allows TCP 22 (SSH) from your management network and TCP 80 / 443 (the API) from the networks and applications that need to submit documents. Front port 80 with TLS in production (see the HTTPS section below).

Step 2: Deploy from the Azure CLI

RG="tika-prod"; LOCATION="eastus"; VM_NAME="tika-01"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/apache-tika-server-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az network vnet create -g "$RG" --name tika-vnet --address-prefix 10.90.0.0/16 --subnet-name tika-subnet --subnet-prefix 10.90.1.0/24
az network nsg create -g "$RG" --name tika-nsg
az network nsg rule create -g "$RG" --nsg-name tika-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name tika-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
az vm create -g "$RG" --name "$VM_NAME" --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name tika-vnet --subnet tika-subnet --nsg tika-nsg --public-ip-sku Standard

Step 3: Connect via SSH

ssh azureuser@<vm-ip>

Step 4: Verify the services are running

The Tika server listens on loopback 127.0.0.1:9998 and nginx fronts the API on port 80. The /healthz endpoint is public; every other endpoint requires your per VM password.

sudo systemctl is-active tika nginx
sudo ss -tln | grep -E ':80 |:9998'
curl -s http://127.0.0.1/healthz

You should see both services active, the two listening sockets, and ok from the health endpoint.

Step 5: Read your per VM password

The password was generated on this VM's first boot and stored in a root only file. Read it and keep it secret: it authenticates every API request. Confirm that unauthenticated requests are rejected.

sudo ls -l /root/tika-server-credentials.txt
echo "unauthenticated /version -> HTTP $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/version)"

The info note holds TIKA_USERNAME (admin) and TIKA_PASSWORD, is owned root:root with mode 0600, and an unauthenticated call to /version returns 401 because the nginx Basic Auth gate enforces authentication.

Step 6: Extract text from a document

This is what Tika does: turn a document into plain text. Load the per VM password into a shell variable, then submit a file to the /tika endpoint with a PUT. The image ships sample PDF and DOCX fixtures under /opt/tika/samples so you can test immediately; swap in your own files the same way.

export TIKA_PW=$(sudo grep '^TIKA_PASSWORD=' /root/tika-server-credentials.txt | cut -d= -f2-)
# Extract text from the sample PDF
curl -s -u "admin:$TIKA_PW" -T /opt/tika/samples/cloudimg-sample.pdf \
  -H 'Accept: text/plain' http://127.0.0.1/tika
# Extract text from the sample DOCX (any Office format works the same way)
curl -s -u "admin:$TIKA_PW" -T /opt/tika/samples/cloudimg-sample.docx \
  -H 'Accept: text/plain' http://127.0.0.1/tika

Each call returns the extracted plain text of the document. To extract from your own file, replace the path after -T with your document — Tika detects the type automatically.

Step 7: Extract metadata

The /meta endpoint returns just the document metadata as JSON (detected content type, page or word counts, author, dates and more), and /rmeta returns a recursive JSON array combining metadata and text for every embedded part of a container document.

export TIKA_PW=$(sudo grep '^TIKA_PASSWORD=' /root/tika-server-credentials.txt | cut -d= -f2-)
# Metadata only, as JSON
curl -s -u "admin:$TIKA_PW" -T /opt/tika/samples/cloudimg-sample.docx \
  -H 'Accept: application/json' http://127.0.0.1/meta
echo
# Detect the media type of a file without parsing it
curl -s -u "admin:$TIKA_PW" -T /opt/tika/samples/cloudimg-sample.pdf \
  http://127.0.0.1/detect/stream

/meta reports fields such as Content-Type; /detect/stream returns the detected MIME type (application/pdf) using Tika's content detection without a full parse.

Step 8: Supported formats and endpoints

Tika parses over a thousand formats through a single API. Useful endpoints, all behind the Basic Auth gate:

• PUT /tika — extract plain text (or XHTML with Accept: text/html)
• PUT /meta — extract metadata as JSON, CSV or XMP
• PUT /rmeta — recursive metadata and text for container formats (zip, mbox, PDF portfolios)
• PUT /detect/stream — detect the media type without parsing
• GET /version, GET /parsers, GET /detectors, GET /mime-types — introspect the server

List the parsers and detected MIME types the server supports:

export TIKA_PW=$(sudo grep '^TIKA_PASSWORD=' /root/tika-server-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$TIKA_PW" http://127.0.0.1/version
curl -s -u "admin:$TIKA_PW" http://127.0.0.1/detectors | head -20

Step 9: Enable HTTPS

nginx fronts the API on port 80 and is ready for TLS. Point a DNS record at the VM, then obtain a certificate with certbot and let it configure nginx for port 443.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

After issuance, restrict the NSG so only 443 (and 22 from your management network) is reachable, and submit documents over https://your-domain.example.com/tika.

Persistence, first boot and updates

Tika Server is stateless — it keeps no data between requests, so there is no data volume to manage. The Tika JAR and sample fixtures live on the OS disk and are captured into the image, so a VM launched from this image is ready immediately. The first boot service generates the per VM Basic Auth password, proves the auth gate, then disables itself so subsequent reboots are unaffected. The OS ships fully patched with unattended security upgrades enabled. To change the password later, edit /etc/nginx/.tika.htpasswd with sudo htpasswd -B /etc/nginx/.tika.htpasswd admin and reload nginx.

Support

Every cloudimg deployment includes 24/7 support with a 24 hour response SLA. Contact support@cloudimg.co.uk for help with deployment, configuration or scaling.

This is a repackaged open source software product with additional charges for cloudimg support services. Apache Tika is a trademark of the Apache Software Foundation. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.