go-httpbin on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of go-httpbin on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. go-httpbin is a fast, dependency free HTTP request and response testing service, a Go implementation of the well known httpbin. It exposes a rich set of endpoints for exercising and debugging anything that speaks HTTP: echo endpoints such as /get and /post that reflect the method, headers, query arguments and body of a request back as JSON, status code endpoints such as /status/{code} that return any HTTP status you ask for, and utility endpoints for headers, client IP, redirects, delays, streaming, compressed responses, cookies, UUIDs and random bytes.

The image installs go-httpbin 2.24.0 from the official upstream release (a single self contained, statically linked Go binary). go-httpbin has no rich web console: it serves the HTTP testing API plus a small HTML index page, and is driven by curl or any HTTP client. In this image the go-httpbin server is bound to the loopback interface only (127.0.0.1:8080) and nginx is the sole network facing surface. nginx terminates TLS on port 443 and fronts the entire service with HTTP basic authentication, so it can never be abused as an open reflector or SSRF relay through its redirect and fetch endpoints.

Secure by default, no shared credentials. go-httpbin ships with no authentication of its own. This image never exposes it directly, and nothing secret is baked into the image. On the first boot of every instance, the image generates a unique HTTP basic authentication password for the user httpbin and a unique self signed TLS certificate, and writes the credentials to a root only file. Unauthenticated requests are rejected, and the service is reachable only over TLS with the per instance credentials.

What is included:

• go-httpbin 2.24.0 from the official upstream release binary, run under systemd (go-httpbin.service) as an unprivileged httpbin user with the service bound to 127.0.0.1:8080

• nginx (nginx.service) terminating TLS on port 443 as the only network facing service, fronting the whole service with HTTP basic auth, plus an unauthenticated /healthz for load balancer probes and an :80 server that redirects to HTTPS

• A per instance HTTP basic authentication password and TLS certificate, generated fresh on first boot, with the per instance values written to /root/go-httpbin-credentials.txt

• A fully patched Ubuntu 24.04 LTS base with unattended security upgrades enabled

Prerequisites

• Active Azure subscription, SSH public key, VNet + subnet in target region

• Subscription to the go-httpbin listing on Azure Marketplace

• Network Security Group rules allowing TCP 22 (admin) and TCP 443 (HTTPS, for the testing service) from the clients, test runners and CI agents that use the service

Recommended virtual machine size: Standard_B2s (2 vCPU, 4 GB RAM) is ample. go-httpbin is a single lightweight binary; increase the size only if you drive very high request concurrency.

Step 1: Deploy from the Azure Portal

Search go-httpbin in Marketplace, select the cloudimg publisher, and click Create. Configure the Network Security Group to allow TCP 443 from the clients and CI agents that will use the service, and TCP 22 for administration. Keep 443 restricted to the networks you serve; a test endpoint rarely needs to be reachable from the whole internet.

Step 2: Deploy from the Azure CLI

RG="go-httpbin-prod"; LOCATION="eastus"; VM_NAME="go-httpbin1"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/go-httpbin-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 443 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

Step 3: First boot and per instance credentials

On first boot the image resolves this VM's IP, generates a per instance HTTP basic authentication password and a per instance TLS certificate, and writes everything to /root/go-httpbin-credentials.txt. This completes within seconds. SSH in as azureuser and read the credentials file:

sudo cat /root/go-httpbin-credentials.txt

The file is 0600 root:root and records the basic auth user (httpbin) and password, the HTTPS service URL, and ready to paste curl examples. These values are unique to this instance.

Step 4: Confirm the services are running

go-httpbin.service and nginx.service are both active, and ss confirms that nginx owns port 443 while the go-httpbin server is bound to loopback only on port 8080.

systemctl is-active go-httpbin.service nginx.service
/opt/go-httpbin/go-httpbin -help 2>&1 | head -1
sudo ss -tlnp | grep -E ':443 |:8080 '

Step 5: Secure by default, never an open reflector

The service is reachable only through nginx on port 443, and only with the per instance HTTP basic authentication. An unauthenticated request returns 401; a request with the per instance credentials returns 200. Only the /healthz load balancer probe is served without credentials. The block below reads the password from the instance credentials file, so it works unchanged on any instance.

PW=$(sudo grep '^GO_HTTPBIN_PASSWORD=' /root/go-httpbin-credentials.txt | cut -d= -f2-)
curl -sk -o /dev/null -w 'healthz  (no auth)   -> HTTP %{http_code}\n' https://127.0.0.1/healthz
curl -sk -o /dev/null -w '/get     (no auth)   -> HTTP %{http_code}\n' https://127.0.0.1/get
curl -sk -u "httpbin:$PW" -o /dev/null -w '/get     (with auth) -> HTTP %{http_code}\n' https://127.0.0.1/get

The -k flag tells curl to accept the self signed per instance certificate. The unauthenticated /get returns 401, while the authenticated request returns 200.

Step 6: Inspect requests with the echo endpoints

The /get, /post, /put, /delete and /anything endpoints echo your request back as JSON: the method, query arguments, headers, origin and full URL. This is how you verify exactly what your HTTP client, proxy or gateway is sending. The block below deletes the echoed Authorization header from the output so the per instance password is not printed.

PW=$(sudo grep '^GO_HTTPBIN_PASSWORD=' /root/go-httpbin-credentials.txt | cut -d= -f2-)
curl -sk -u "httpbin:$PW" 'https://127.0.0.1/get?example=1&team=cloudimg' | jq 'del(.headers.Authorization)'

The response shows the query arguments (example, team) and the request headers exactly as go-httpbin received them, which is what makes it so useful for debugging clients and middleboxes.

Step 7: Return any status code and test other behaviours

/status/{code} returns whatever HTTP status you ask for, which is ideal for testing how a client handles errors, retries and redirects. /json returns a sample body, /uuid returns a random UUID, /ip returns the caller origin, /headers echoes the request headers, and /delay/{n} waits n seconds before responding.

PW=$(sudo grep '^GO_HTTPBIN_PASSWORD=' /root/go-httpbin-credentials.txt | cut -d= -f2-)
curl -sk -u "httpbin:$PW" -o /dev/null -w '/status/418 -> HTTP %{http_code}\n' https://127.0.0.1/status/418
curl -sk -u "httpbin:$PW" https://127.0.0.1/json | head -10
curl -sk -u "httpbin:$PW" https://127.0.0.1/uuid
curl -sk -u "httpbin:$PW" https://127.0.0.1/ip

/status/418 returns HTTP 418, /json returns the sample slideshow document, and /uuid and /ip return a fresh UUID and the caller origin.

Step 8: Use the service from your clients and CI

On any workstation or CI agent, point your HTTP client at this instance. Replace <vm-ip> with this instance's address (or a DNS name you point at it), and use the per instance credentials from /root/go-httpbin-credentials.txt.

# trust this instance's certificate (copy /etc/nginx/tls/go-httpbin.crt from the VM), then:
curl --cacert /path/to/go-httpbin.crt -u '<user>:<password>' https://<vm-ip>/get
curl --cacert /path/to/go-httpbin.crt -u '<user>:<password>' -o /dev/null -w '%{http_code}\n' https://<vm-ip>/status/503

In a test suite or CI pipeline, set the base URL and the basic auth credentials as environment variables and point your integration tests at the instance. Every request then exercises a predictable, controllable endpoint you own instead of a shared public service.

Step 9: Use a real domain and certificate for production

The per instance certificate is self signed, so clients must trust it explicitly. For production, put a DNS name and a CA signed certificate in front of the service by replacing the per instance certificate in /etc/nginx/tls, so clients trust the transport with no extra configuration.

# replace the self signed certificate with your CA signed certificate + key for <your-domain>, then reload nginx
sudo cp your-cert.crt /etc/nginx/tls/go-httpbin.crt
sudo cp your-cert.key /etc/nginx/tls/go-httpbin.key
sudo systemctl reload nginx

Step 10: Security recommendations

• Restrict the NSG. Allow TCP 443 only from the clients, test runners and CI agents that use the service, and TCP 22 only from your administration network. A test endpoint rarely needs to be public.

• Protect the basic auth password. It lives in /root/go-httpbin-credentials.txt (0600 root:root). The service is reachable only through nginx and only with this password; rotate it by updating /etc/nginx/go-httpbin.htpasswd with htpasswd and reloading nginx.

• Use a real certificate for production. The per instance certificate is self signed. Put a CA signed certificate and a DNS name in front for production so clients trust the transport without extra configuration.

• Mind the fetch endpoints. go-httpbin's redirect and fetch endpoints are powerful; keeping the service behind basic auth and restricted to your own networks is what prevents them being abused as a reflector.

• Keep the OS patched. Unattended security upgrades remain enabled on the running VM.

Step 11: Support and Licensing

go-httpbin is open source software distributed under the MIT License. This cloudimg image bundles the unmodified official go-httpbin release binary. cloudimg provides the packaging, the systemd hardening, the nginx TLS front, the loopback only service with per instance basic auth, the per instance credential automation, the paired deploy guide, and 24/7 support with a guaranteed 24 hour response SLA.

cloudimg is not affiliated with or endorsed by the go-httpbin project. go-httpbin is a mark of its respective owner and is used here only to identify the software.

Deploy on Azure

Find go-httpbin on Ubuntu 24.04 LTS on the Azure Marketplace, published by cloudimg. Deploy from the Portal or the Azure CLI as shown above.

Need Help?

Email support@cloudimg.co.uk for deployment help, configuration questions, or licensing enquiries.