Operating Systems Azure

FreedomBox on Debian 12 on Azure User Guide

| Product: FreedomBox on Debian 12 on Azure

Overview

FreedomBox is a private personal server, built as a Debian Pure Blend, that you administer entirely through a friendly web console called Plinth. Instead of renting services from a cloud provider, you run your own: file sharing and backups, a personal VPN, a website and blog, contact and calendar sync, chat, and a growing catalogue of other self hosted applications, all enabled and managed from one dashboard without editing configuration files by hand. The cloudimg image installs FreedomBox 23.6.2 on Debian 12, with the Plinth web interface served over HTTPS on port 443 (and port 80 redirecting to it) behind Apache. Every listed application is Free Software.

FreedomBox has no default login. The first time you open the console, a secure first run setup wizard asks for a one time setup secret that is generated uniquely on the first boot of every VM, and only then do you create your own administrator account. This design prevents anyone else on the network from claiming the admin account before you do. The cloudimg image writes that per VM secret to a root only credentials file so you can retrieve it over SSH. Backed by 24/7 cloudimg support.

What is included:

  • FreedomBox 23.6.2 on Debian 12, managed by systemd
  • The Plinth web administration console on HTTPS port 443, fronted by Apache, with port 80 redirecting to HTTPS
  • A large catalogue of self hosted apps ready to enable from the console (file sharing, VPN, chat, wiki, media, and more)
  • No default login: a unique setup secret generated on first boot and recorded in a root only file, so you create the first administrator yourself
  • plinth.service and apache2.service as systemd units, enabled and active
  • A fully patched Debian 12 base with unattended security upgrades enabled
  • 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point. NSG inbound rules: allow 22/tcp from your management network for SSH, and 443/tcp (and optionally 80/tcp) so you can reach the Plinth web console. Plinth serves over HTTPS with a self signed certificate by default; for production, configure a domain and a Let's Encrypt certificate from within FreedomBox (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for FreedomBox by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTPS (443). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name freedombox \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name freedombox --port 443 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

FreedomBox runs the Plinth console as a systemd service, fronted by Apache on HTTPS port 443. Confirm both are active and that the HTTP port redirects to HTTPS:

systemctl is-active plinth.service apache2.service

curl -sk -o /dev/null -w "plinth https: %{http_code}\n" https://127.0.0.1/plinth/

The plinth and apache2 systemd services active and the Apache listeners on ports 80 and 443, with the HTTP port redirecting to the Plinth console over HTTPS

Step 5 - Retrieve the per VM setup secret

FreedomBox has no default login. A one time setup secret is generated on the first boot of every VM and written to a root only credentials file. Retrieve it over SSH:

sudo cat /root/freedombox-credentials.txt

The file contains the console URL and the setup_secret value you will enter in the setup wizard. The same secret can also be read directly from FreedomBox at any time:

sudo cat /var/lib/plinth/firstboot-wizard-secret

The FreedomBox version and the per VM credentials file showing the console URL and the setup secret, masked in this screenshot

Step 6 - Complete the secure setup wizard

Open https://<vm-public-ip>/plinth/ in your browser. Because Plinth uses a self signed certificate by default, your browser will warn you the first time; accept the warning to continue. The first screen is the FreedomBox first run wizard, which asks for the setup secret from Step 5.

The FreedomBox first run welcome page asking for the Firstboot Wizard Secret, with help text explaining it can be read with sudo cat /var/lib/plinth/firstboot-wizard-secret

Paste the setup_secret value and select Start Setup. FreedomBox then asks you to create the first administrator account. Choose your own username and a strong password - this account is the administrator and is added to the FreedomBox admin group.

The FreedomBox create administrator account form where you choose the first admin username and password

Step 7 - Explore the app catalogue

After the wizard completes, you land in the Plinth console. The Apps page is the heart of FreedomBox: a catalogue of self hosted applications - file sharing, a personal VPN, chat and messaging, a wiki, media streaming, and more - each of which you can enable and configure from the console.

The FreedomBox app catalogue in the Plinth console, showing self hosted applications such as file sharing, video conferencing, encrypted messaging, wikis and media tools ready to enable

The System section holds server wide settings - networking, users and groups, security, backups, certificates and diagnostics.

The FreedomBox System section showing server wide configuration such as users, networking, security and backups

Step 8 - Verify there is no default login

The setup secret is what gates the wizard, so no one can create the administrator account without it. You can confirm the mechanism directly: a wrong secret is rejected by the wizard, while the real per VM secret is accepted and advances to account creation.

Posting a wrong secret to the first run wizard is rejected while the real per VM setup secret is accepted with a redirect, proving the wizard has no default login

Maintenance

  • HTTPS with your own domain. In the Plinth console, open System -> Configure to set your domain name, then use System -> Let's Encrypt to obtain and auto renew a trusted certificate so browsers no longer warn on the self signed default.
  • Enable apps as you need them. Every application in the Apps catalogue is disabled until you enable it. Enable only what you use to keep the attack surface small.
  • Users and groups. Manage additional accounts under System -> Users and Groups; add users to the admin group only when they need administrative access.
  • Backups. Use System -> Backups to schedule and export backups of your FreedomBox configuration and app data.
  • Security updates. The Debian 12 base ships with unattended security upgrades enabled, so security patches are applied automatically. FreedomBox can also manage distribution updates from System -> Software Update.

Support

This image is maintained by cloudimg with 24/7 support. If you have any questions about deploying or operating FreedomBox on Azure, contact support@cloudimg.co.uk.