Applications Azure

Ergo on Ubuntu 24.04 on Azure User Guide

Last updated: 2026-07-18 | Product: Ergo IRC Server on Ubuntu 24.04 LTS on Azure

Overview

This guide covers the deployment and configuration of Ergo on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Ergo is a modern IRC server (IRCd) written from scratch in Go. Where a traditional IRC daemon needs a separate services package for user accounts and channels, Ergo bundles NickServ account registration, ChanServ channel registration, native TLS, persistent message history and modern IRCv3 capabilities into a single self contained binary, so a full featured chat network runs from one process with no external database or runtime to manage.

The image installs the official Ergo binary (pinned at build) and runs it under systemd, so an IRC server is listening within minutes of launch.

Security by design — no baked operator password. There is no default operator password inside the image. A unique operator password is generated on this machine's first boot, hashed with bcrypt into the configuration, and written to a root only file. No two machines share it and none ships inside the image.

Security by design — per VM TLS certificate. A unique self signed TLS certificate for the encrypted 6697 listener is generated on first boot, so the private key is never baked into the image. You can replace it with a certificate issued by a recognised authority at any time (see Step 9).

Security by design — fresh datastore per machine. The account and channel database is created fresh on each machine's first boot, so no registrations, accounts or state are ever carried over inside the image.

What is included:

Ergo (official pinned binary), run under systemd as the unprivileged ergo user (ergo.service)
The standard IRC ports: 6667 (plaintext) and 6697 (TLS), listening on all interfaces so the server is reachable inside your VNet
Built in NickServ account registration and ChanServ channel registration, so accounts and channels work with no separate services package
A per VM operator password (bcrypt) and a per VM self signed TLS certificate, both generated on first boot and never baked into the image
Persistent message history, always on clients, IRCv3 capabilities including SASL, and WebSocket support for browser clients
Sensible defaults: per IP connection limits and account registration throttling left on to blunt abuse
Unattended security upgrades left enabled so the server keeps receiving patches

Prerequisites

Active Azure subscription, SSH public key, VNet + subnet in the target region
Subscription to the Ergo listing on Azure Marketplace
Network Security Group rules allowing TCP 22 (admin), TCP 6667 (plaintext IRC) and TCP 6697 (TLS IRC) from the clients that will connect

Recommended virtual machine size: Standard_B2s (2 vCPU, 4 GB RAM) for a small network. Busy networks should use Standard_D2s_v5 or larger.

Step 1: Deploy from the Azure Portal

Search Ergo in Marketplace, select the cloudimg publisher, and click Create. Configure the Network Security Group to allow TCP 6697 (TLS IRC) and TCP 6667 (plaintext IRC) from your client networks, and TCP 22 for administration. Prefer 6697 for real users; treat 6667 as loopback or VNet internal only where you can.

Step 2: Deploy from the Azure CLI

RG="chat-prod"; LOCATION="eastus"; VM_NAME="ircd1"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/ergo-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
# Open the IRC and admin ports on the VM's NSG:
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 6697 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 6667 --priority 1002
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1003

Step 3: First boot

On first boot the image resolves the VM public IP, generates a per VM operator password and a per VM self signed TLS certificate, initialises the account and channel datastore, renders the configuration, and starts Ergo. This completes within a minute. SSH in as azureuser and read the per VM details, including the operator password:

sudo cat /root/ergo-credentials.txt

Step 4: Confirm the server is running

ergo.service is active and listening on 6667 (plaintext) and 6697 (TLS).

systemctl is-active ergo.service
ss -tln | grep -E ':6667|:6697'

ergo.service reports active and ss shows the server listening on port 6667 plaintext and port 6697 TLS on all interfaces, confirming the modern IRC daemon is up and serving on the standard IRC ports

Step 5: Prove a full IRC round trip

The image ships a self test that connects two IRC clients to the server, has both join a channel, sends a message from one and confirms the other receives it, logs in as an operator with the per VM password, and completes a TLS handshake on 6697. Run it to prove the server is healthy end to end:

sudo python3 /usr/local/lib/cloudimg/ergo-roundtrip.py

the cloudimg round trip self test prints ROUNDTRIP OK confirming two clients registered, a private message was delivered from one client to the other in a channel, the operator login returned RPL YOUREOPER 381, and the TLS listener on 6697 completed a handshake

Step 6: Confirm the TLS listener

The encrypted listener on 6697 presents the per VM self signed certificate. Inspect the handshake and certificate with openssl:

echo | openssl s_client -connect 127.0.0.1:6697 -servername localhost 2>/dev/null | openssl x509 -noout -subject -issuer -dates

openssl s_client completes a TLS handshake against the ergo listener on port 6697 and prints the certificate subject, issuer and validity dates for the per VM self signed certificate generated on first boot

Step 7: Connect an IRC client and become an operator

Point any IRC client at the server. Use port 6697 with TLS (accept the self signed certificate, or install a CA issued one per Step 9), or port 6667 for plaintext on trusted networks. Read <IRC_HOST> and the operator password from /root/ergo-credentials.txt.

In your client, register your nick, then become an operator with the per VM password (the operator name is admin):

/msg NickServ REGISTER <your-account-password>
/OPER admin <OPER_PASSWORD>

A successful OPER returns RPL_YOUREOPER and grants you the server administrator class defined in the configuration.

Step 8: Register a channel with ChanServ

Ergo's built in ChanServ lets an account own and manage a channel with no separate services package. After registering and identifying to your account, join a channel and register it:

/join #welcome
/msg ChanServ REGISTER #welcome

Message history is retained, so clients that support the CHATHISTORY capability can play back recent messages when they reconnect.

Step 9: Replace the self signed TLS certificate (recommended)

The image ships a per VM self signed certificate so TLS works out of the box. For production, install a certificate issued by a recognised authority. Place your full chain and private key on the VM, point the 6697 listener at them in /etc/ergo/ircd.yaml, and reload:

server:
    listeners:
        ":6697":
            tls:
                cert: /etc/ergo/tls.crt
                key: /etc/ergo/tls.key

Replace /etc/ergo/tls.crt and /etc/ergo/tls.key with your issued certificate and key (keep the key readable by the ergo group), then restart the service with sudo systemctl restart ergo.

Step 10: Security recommendations

Restrict the NSG. Allow 6697 (and 6667 where you must) only from the client networks that need to connect, and TCP 22 for administration only.
Prefer TLS. Use port 6697 for real users and install a CA issued certificate (Step 9). Treat plaintext 6667 as internal or loopback only where you can.
Require SASL for stricter deployments. For a private network, require SASL authentication and disable open account registration in /etc/ergo/ircd.yaml so only invited accounts can connect.
Keep the operator password secret. It lives only in /root/ergo-credentials.txt (root only) and is unique to this VM. Rotate it by generating a new hash with ergo genpasswd and updating the opers block.
Keep the OS and Ergo patched. Unattended security upgrades remain enabled on the running VM.
Back up the datastore. Account and channel registrations live in /var/lib/ergo/ircd.db; include it in your backups.

Step 11: Support and Licensing

Ergo is developed by the ergochat project and distributed under the MIT license. This cloudimg image bundles the unmodified official Ergo binary. cloudimg provides the packaging, the secure by default first boot (per VM operator password, per VM TLS certificate, fresh datastore), the systemd integration, and 24/7 support with a guaranteed 24 hour response SLA.

cloudimg is not affiliated with or endorsed by the Ergo project. Ergo is a mark of its respective owner and is used here only to identify the software.

the per VM credentials file shows the operator name admin with the operator password masked and the server endpoints, alongside the rendered configuration confirming a real bcrypt operator hash and the per VM TLS certificate paths, proving no operator password or TLS key is baked into the image

Deploy on Azure

Find Ergo on Ubuntu 24.04 LTS on the Azure Marketplace, published by cloudimg. Deploy from the Portal or the Azure CLI as shown above.

Need Help?

Email support@cloudimg.co.uk for deployment help, configuration questions, or licensing enquiries.