Comentario on Ubuntu 24.04 on Azure User Guide

Overview

Comentario is a fast, flexible and powerful free comment server for web pages - a privacy-focused, self-hosted alternative to hosted commenting services. A single Go service serves both the embeddable comments widget you drop into any site and a full Angular administration UI, backed by PostgreSQL. The cloudimg image runs Comentario directly on TCP 80 as a dedicated non-root service user, with PostgreSQL as the datastore bound to loopback, and generates a unique owner/administrator login on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• Comentario 3.17 as a single self-contained Go binary at /usr/bin/comentario, with its Angular frontend at /usr/lib/comentario/frontend
• The Comentario service on :80, running as the dedicated non-root comentario system user (with CAP_NET_BIND_SERVICE to bind the privileged port)
• PostgreSQL as the datastore, bound to 127.0.0.1 only
• Per-VM owner/superuser and PostgreSQL passwords generated at first boot, in a root-only file - the image ships with an empty database and no working credentials
• comentario.service and postgresql.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point - Comentario is lightweight. NSG inbound: allow 22/tcp from your management network and 80/tcp (plus 443/tcp once you enable HTTPS) from the networks that will load your comment widget and reach the admin UI.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Comentario by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create -> Create. First boot initialisation - database setup, secret rotation and owner creation - completes within about a minute of the VM starting.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name comentario \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name comentario --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active comentario.service postgresql.service
curl -s -o /dev/null -w 'instance config: HTTP %{http_code}\n' http://127.0.0.1/api/config

Both services report active and the public instance-config endpoint returns HTTP 200 - that confirms the Comentario service and PostgreSQL are serving.

The systemd units and the open instance-config endpoint on a freshly booted VM.

Step 5 - Retrieve your owner login

The instance owner account and the PostgreSQL password are generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/comentario-credentials.txt

The comentario.owner.email and comentario.owner.pass values are your sign-in for the administration UI - the owner is a Comentario superuser (instance administrator). The PostgreSQL password is rotated at the same time and never shared between VMs.

The root-only credentials file with the per-VM owner login (secrets redacted here).

Step 6 - First sign-in

Open a web browser and navigate to http://<vm-public-ip>/. Comentario presents its sign-in page. Enter the comentario.owner.email and comentario.owner.pass from the credentials file, then select Sign in.

The Comentario sign-in, served on first boot with a per-VM owner login.

Step 7 - The administration dashboard

After signing in you land on the dashboard, which summarises users, views and comments over the last 30 days. The left-hand navigation gives you Domains, Users, Configuration and your account. As the instance owner you are a superuser with full administrative control.

The Comentario administration dashboard with per-instance statistics.

Step 8 - Add your first domain

Select Domains, then New domain, and enter the host of the website you want to add comments to (for example blog.example.com). Comentario registers the domain and gives you the small snippet of HTML to embed. Paste the <script> and <comentario-comments> tags into your page template where you want the comment thread to appear, pointing the script at your VM. Readers can then comment on that page, and you moderate the threads from Comments under the domain.

The domains manager - as a superuser you see and manage every domain on the instance.

Step 9 - Manage your account

Open your account (shown as Instance Owner in the sidebar) to change your display name, set a website URL, choose an interface language, upload an avatar, and change your password. For production use, sign in and set a new owner password of your own straight away.

The owner profile page - change your name, language, avatar and password.

Step 10 - Prove the owner login through the API

Comentario is API-driven: its own frontend signs in through POST /api/auth/login, which is XSRF-protected exactly as a browser expects (seed the XSRF-TOKEN cookie, echo it in the X-Xsrf-Token header, and send an Origin matching the instance base URL). From an SSH session on the VM you can prove the round trip with the per-VM owner password:

CREDS=/root/comentario-credentials.txt
EMAIL=$(sudo grep '^comentario.owner.email=' "$CREDS" | cut -d= -f2-)
PASS=$(sudo grep '^comentario.owner.pass=' "$CREDS" | cut -d= -f2-)
HOST=$(sudo grep '^BASE_URL=' /etc/comentario/comentario.conf | sed -E 's#^BASE_URL=https?://##; s#/.*$##')
JAR=$(mktemp)
curl -s -o /dev/null -c "$JAR" http://127.0.0.1/api/config
TOK=$(awk '$6=="XSRF-TOKEN"{print $7}' "$JAR")
curl -s -o /dev/null -w 'owner login: HTTP %{http_code}\n' -b "$JAR" \
  -H "X-Xsrf-Token: $TOK" -H "Origin: http://$HOST" -H 'Content-Type: application/json' \
  -d "{\"email\":\"$EMAIL\",\"password\":\"$PASS\"}" http://127.0.0.1/api/auth/login
rm -f "$JAR"

An owner login: HTTP 200 response confirms the API accepts the generated owner credentials.

Step 11 - Confirm the runtime and security posture

The Comentario package version, the dedicated non-root service user, the loopback-only PostgreSQL and open :80, and the fully-patched OS baseline:

dpkg-query -W -f='${Package} ${Version}\n' comentario
id comentario
ss -tlnp | grep -E ':80 |:5432 '

The pinned Comentario release, the non-root comentario service user, loopback PostgreSQL and the open web port, on a fully patched base.

Enabling HTTPS

For any production deployment serve Comentario over HTTPS so logins and comments cannot be intercepted. Terminate TLS with a reverse proxy such as nginx or Caddy in front of Comentario, or use a cloud load balancer. The following installs nginx and certbot and assumes a DNS record pointing your fully qualified domain name at the VM's public IP, and port 443 open in the NSG:

sudo apt-get update && sudo apt-get install -y nginx certbot python3-certbot-nginx
# Proxy nginx :443 -> Comentario, then rebind Comentario to loopback:
sudo sed -i 's|^HOST=.*|HOST=127.0.0.1|; s|^PORT=.*|PORT=8080|; s|^BASE_URL=.*|BASE_URL=https://comments.your-domain.example/|' /etc/comentario/comentario.conf
sudo certbot --nginx -d comments.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example --redirect
sudo systemctl restart comentario

Setting BASE_URL to your HTTPS domain is important: Comentario validates the request Origin against it, and generated links and the embed widget use it.

Backup and maintenance

Comentario keeps all of its state - domains, pages, users, comments and configuration - in PostgreSQL. Back it up regularly:

sudo -u postgres pg_dump comentario > <backup-dir>/comentario-db-$(date +%F).sql

Ship the dump to Azure Blob Storage or another object store. For kernel and package updates, Ubuntu's unattended-upgrades is enabled by default; keep the OS patched with sudo apt update && sudo apt upgrade. To upgrade Comentario, install a newer release package and restart the service - database migrations run automatically on start. See https://docs.comentario.app.

Support

This image is backed by 24/7 cloudimg support. Contact us by email and chat for help with deployment, embedding the widget, integrations, upgrades, TLS termination and database administration. Guaranteed response within 24 hours, one hour average for critical issues. Contact support@cloudimg.co.uk.

For general Comentario questions consult the documentation at https://docs.comentario.app. Comentario is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.