ChartDB on Ubuntu 24.04 on Azure User Guide

Overview

ChartDB is an open-source, web-based database schema visualization and diagram editor. You import an existing database schema by running a single query the app gives you and pasting the result, then edit the entity-relationship (ER) diagram in your browser and export it as SQL, DBML or an image. ChartDB is a pure client-side single-page app: all of your diagram data lives in your own browser, with no external database or service.

The cloudimg image serves the built ChartDB app with nginx on port 80, hardened and ready on first boot. Because ChartDB has no built-in authentication, this image is secure by default: nginx gates the whole app behind per-VM HTTP Basic-Auth, and a unique password is generated on the first boot of every instance and written to a root-only file, so no two instances share a credential. A public, unauthenticated health endpoint is exposed at /health. Built from ChartDB 1.20.1 (AGPL-3.0), backed by 24/7 cloudimg support.

What is included:

• ChartDB 1.20.1 static app, built from the official source and served from /var/www/chartdb
• nginx on :80 as the single public listener, gating the app behind per-VM HTTP Basic-Auth
• A public, unauthenticated health endpoint at /health
• A first-boot service that generates a unique admin password into a root-only 0600 file
• The unmodified upstream source archive at /usr/share/chartdb (AGPL-3.0 section 13)
• nginx.service + chartdb-firstboot.service as systemd units, enabled on every boot
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point; ChartDB serves static files, so it is light on resources. NSG inbound: allow 22/tcp from your management network and 80/tcp for the editor. ChartDB serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for ChartDB by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create and Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name chartdb \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name chartdb --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the service is running

ChartDB is served by nginx, and a one-shot first-boot service prepares the per-VM login. Confirm both, and that nginx is the only public listener:

systemctl is-active nginx.service chartdb-firstboot.service
ss -tln | grep ':80 '
test -f /var/lib/cloudimg/chartdb-firstboot.done && echo "first boot complete"

nginx.service reports active and chartdb-firstboot.service reports active, nginx is listening on :80, and the sentinel confirms first boot finished.

Step 5 - Verify the authentication gate

ChartDB has no login of its own, so nginx gates the whole app behind HTTP Basic-Auth. The public /health endpoint returns 200 without credentials, the app returns 401 without credentials, and 200 with the per-VM login:

curl -s -o /dev/null -w 'health: %{http_code}\n' http://127.0.0.1/health
curl -s -o /dev/null -w 'unauth: %{http_code}\n' http://127.0.0.1/
sudo bash -c 'U=$(grep ^CHARTDB_USERNAME= /var/lib/cloudimg/chartdb-credentials.txt | cut -d= -f2-); P=$(grep ^CHARTDB_PASSWORD= /var/lib/cloudimg/chartdb-credentials.txt | cut -d= -f2-); curl -s -o /dev/null -w "auth: %{http_code}\n" -u "$U:$P" http://127.0.0.1/'

You see health: 200, unauth: 401 and auth: 200 - proof the app is reachable only with the per-VM credential.

Step 6 - Read your per-VM login

The unique per-VM credential (username admin) is written to a root-only file on first boot:

sudo cat /var/lib/cloudimg/chartdb-credentials.txt

Example output (your password is unique to this VM):

# ChartDB 1.20.1 on Ubuntu 24.04 (cloudimg Azure Marketplace image)
# Per-VM HTTP Basic-Auth credentials - UNIQUE to this VM, minted at first boot.

CHARTDB_URL=http://<vm-public-ip>/
CHARTDB_USERNAME=admin
CHARTDB_PASSWORD=3f9c1a7be2d045c8a1e6b0f4d7c2e9a1

Step 7 - Open ChartDB

Browse to http://<vm-public-ip>/ in any modern browser. Your browser prompts for the HTTP Basic-Auth login: enter admin and the password from Step 6. ChartDB opens and asks which database you are diagramming - pick your engine (PostgreSQL, MySQL, MariaDB, SQL Server, SQLite or Oracle).

Step 8 - Import a schema

After choosing a database, ChartDB shows the Import your Database dialog. You can paste the output of the Smart Query it generates for your live database, or switch to the SQL Script tab and paste a CREATE TABLE script directly. ChartDB parses the tables, columns, keys and foreign keys, and reports how many tables it found.

Step 9 - Explore the ER diagram

Click Import and ChartDB draws the entity-relationship diagram: each table is a node listing its columns and types, primary keys are marked, and foreign keys are drawn as relationship connectors with cardinality. Drag tables to rearrange them, zoom and fit the view, and add or edit tables and columns directly on the canvas.

Step 10 - Edit as DBML and export

Open the DBML panel to see your diagram as DBML (Database Markup Language) - edit the DBML and the diagram updates, or edit the diagram and the DBML updates. Use the Export SQL action (under Actions) to generate DDL for your target database, or export the diagram as an image. Because all data lives in your browser, use Backup to export and import your diagrams.

Maintenance

• Data: ChartDB is client-side; your diagrams are stored in your browser. There is no server-side database to back up. Use the in-app Backup to export and import your diagrams as files.
• Change the login: the per-VM password lives in the nginx htpasswd file. To set your own, run sudo htpasswd -B /etc/nginx/.chartdb-htpasswd admin and follow the prompts, then sudo systemctl reload nginx.
• Source code: the unmodified upstream source for this AGPL-3.0 release ships on disk at /usr/share/chartdb/chartdb-v1.20.1-source.tar.gz.
• TLS: ChartDB serves plain HTTP on port 80; front it with TLS (for example certbot) and your own domain before production use.
• Restart: sudo systemctl restart nginx.service if you need to bounce the web server.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.

ChartDB is open-source software released under the GNU Affero General Public License v3.0 (AGPL-3.0). cloudimg is not affiliated with, endorsed by, or sponsored by the ChartDB project. This image packages the open-source ChartDB software for convenient deployment on Microsoft Azure. All trademarks are the property of their respective holders.