ClearFlask on Ubuntu 24.04 on Azure User Guide

Overview

ClearFlask is an open source product feedback and public roadmap platform: your users post ideas and feature requests, vote on what matters to them, and follow a public roadmap that shows what you are considering, planning and shipping. It is a self hosted alternative to tools like Canny and UserVoice. The cloudimg image runs the official ClearFlask 2.4.0 self host Docker Compose stack on a hardened, fully patched Ubuntu 24.04 LTS base, tuned to fit a single Standard_B2s VM (2 vCPU / 4 GiB RAM) with no swap.

The whole stack runs on the one VM with nothing external to provision: the Node front end (ClearFlask Connect), the Java backend, MariaDB as the search engine, and a bundled LocalStack that provides the DynamoDB, S3 and SES services the application expects entirely on box - so no customer AWS account is required. A host nginx reverse proxy publishes the application on port 80, while every internal service port is bound to loopback or the Docker network only.

The image is secure by default. On the first boot of every VM a one shot service rotates every secret (the Connect token, the database password, and the application's own signing keys), points the application at the VM's own address, seeds a fresh admin@localhost super administrator with a per VM random password, proves that password authenticates, and then disables open self signup so a passer by cannot create an account. Nothing sensitive is baked into the image. Backed by 24/7 cloudimg support.

What is included:

• ClearFlask 2.4.0, the official self host stack, pinned so the image never silently upgrades
• ClearFlask Connect (Node front end) and the Java backend, JVM heap capped to fit 4 GiB
• MariaDB 10.5 as the search engine in READWRITE_MYSQL mode (Elasticsearch is deliberately not used, to fit the memory budget)
• A bundled LocalStack providing DynamoDB, S3 and SES on box - no customer AWS account needed
• A host nginx reverse proxy on port 80; internal ports (8080, 3306, 4566) bound to loopback / the Docker network only
• A per VM admin@localhost super administrator, seeded with a random password on first boot
• Open self signup disabled on first boot; every secret rotated per VM
• clearflask.service and clearflask-firstboot.service as enabled systemd units
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is the recommended size and is what the stack is tuned for. NSG inbound: allow 22/tcp from your management network and 80/tcp for the ClearFlask web interface. You do not need to open any other port - the database, the LocalStack services and the Java backend are all internal.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for ClearFlask by cloudimg, and select Create. On Basics pick your subscription, resource group, region and the Standard_B2s size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name clearflask \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open the ClearFlask web port:

az vm open-port --resource-group <your-rg> --name clearflask --port 80 --priority 900

Give the first boot a couple of minutes to bring the stack up, rotate the secrets and seed the administrator before you sign in.

Step 3 - Confirm the stack is running

SSH in as azureuser and confirm the ClearFlask units, Docker and nginx are all active. clearflask-firstboot.service is the one shot unit that rotates the secrets and seeds the administrator on first boot; clearflask.service keeps the Compose stack up.

systemctl is-active clearflask-firstboot clearflask docker nginx

Only SSH and the ClearFlask web interface face the network. Confirm nginx is serving on port 80:

sudo ss -ltnH 'sport = :80' | awk '{print $4}'

Step 4 - Retrieve your per VM administrator credentials

Every VM seeds its own admin@localhost super administrator with a random password on first boot, and writes it to a root only file. There are no shared or default credentials in the image. Read it with sudo:

sudo cat /root/clearflask-credentials.txt

The file records the dashboard URL, the administrator email (admin@localhost) and the per VM password. You can prove end to end that the seeded administrator authenticates and that a wrong password is rejected, straight from the command line:

sudo bash -c 'PW=$(grep "^clearflask.admin.password=" /root/clearflask-credentials.txt | cut -d= -f2-); \
  GOOD=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" \
    -d "{\"email\":\"admin@localhost\",\"password\":\"$PW\"}" http://127.0.0.1:8080/api/v1/admin/account/login); \
  BAD=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" \
    -d "{\"email\":\"admin@localhost\",\"password\":\"wrong-000\"}" http://127.0.0.1:8080/api/v1/admin/account/login); \
  echo "correct password -> HTTP $GOOD ; wrong password -> HTTP $BAD"'

Step 5 - Confirm internal services stay internal

The database, the LocalStack services and the Java backend are all bound to loopback or the Docker network - they are never exposed on the VM's public interface. You can confirm the three internal ports only listen on 127.0.0.1:

sudo ss -ltnH | grep -E ':8080|:3306|:4566' | awk '{print $4}' | sort -u

cd /var/lib/clearflask && sudo docker compose ps --format 'table {{.Service}}\t{{.Status}}'

Step 6 - Sign in to the dashboard

Browse to http://<vm-public-ip>/dashboard. ClearFlask opens on its sign in page. Select Log in with Email, enter admin@localhost and the per VM password from Step 4, and sign in. Because open signup was disabled on first boot, this administrator is the only account that can get in until you invite others.

Step 7 - Create your first feedback project

The first time you sign in, ClearFlask walks you through creating a project. Choose a scenario - Customer feedback for a customer first feedback experience, or Open community for a public discussion forum - then pick a feedback layout, and give your product a name. Select Create and ClearFlask provisions the project with a feedback board and a roadmap ready to use.

Step 8 - Collect and triage feedback

Capturing what your users actually want, in their own words, is the core of ClearFlask. The dashboard home gives you the whole picture at a glance: how much feedback is open, and how each post is moving through your workflow. In the example below five feedback posts sit across the new, considering and accepted stages, with a separate task pipeline underneath. As an administrator you can open any post, see its vote count and status, respond to users, and move it through the workflow as you work through it.

Step 9 - Publish a public roadmap

Open the Roadmap view to see and manage the public roadmap. Posts move across columns - typically Considering, Planned and In progress - so your users can follow at a glance what you are thinking about, what you have committed to, and what you are actively building. Drag a post between columns to update its status, and it updates on the public roadmap immediately.

Step 10 - Where your data lives

The entire ClearFlask project - the Compose stack, the generated configuration, the MariaDB search index and the LocalStack DynamoDB, S3 and SES data - lives under /var/lib/clearflask on the OS disk, and is captured into the image so every VM is re provisioned with it. Confirm the layout:

sudo ls /var/lib/clearflask

df -h / | tail -1

Step 11 - Point ClearFlask at your own domain (optional)

By default the image points ClearFlask at the VM's own address, which is ideal for evaluation and internal use. To serve it on your own domain in production, put a TLS terminating reverse proxy or an Azure load balancer in front of the VM, and update the parentDomain in /var/lib/clearflask/connect/connect.config.json and the domain in /var/lib/clearflask/server/config-selfhost.cfg to your hostname, then restart the stack with sudo systemctl restart clearflask. ClearFlask can also send email through its SES integration if you configure real AWS SES credentials in the server configuration.

Security notes

• ClearFlask is published on port 80 by the host nginx reverse proxy. For production, terminate TLS in front of the VM (an Azure load balancer, Application Gateway, or your own reverse proxy) so traffic is encrypted, and restrict 22/tcp in the NSG to your management network.
• The image ships no shared or default credentials. Each VM seeds its own admin@localhost super administrator with a random password on first boot and disables open self signup, so a passer by cannot create an account. Change the seeded password after your first sign in.
• Every secret (the Connect token, the database password, the token signer, cursor and SSO keys) is rotated per VM on first boot, so nothing cryptographic is shared across deployments.
• The database, the LocalStack services and the Java backend are bound to loopback / the Docker network only and are never reachable from outside the VM.
• Keep the VM patched. The image ships fully patched with unattended security upgrades enabled.

Support

cloudimg images come with 24/7 support. If you have any questions about this ClearFlask image or need help with your deployment, contact us through the cloudimg website.