Icecast + Liquidsoap Internet Radio Station on Azure User Guide

Overview

This image is a complete internet radio station on Ubuntu 24.04 LTS, pairing two open source projects into one ready to broadcast appliance:

• Liquidsoap 2.4.5, from savonet, is a scriptable audio engine that builds a station. It plays playlists, mixes live and scheduled sources, crossfades tracks, inserts jingles and streams the result out to a server.
• Icecast 2.4.4, from the Xiph.Org Foundation, is the streaming server. It takes that single live feed on a named mountpoint and relays it to many simultaneous listeners over ordinary HTTP, speaking Ogg Vorbis, Opus and MP3 and publishing M3U and XSPF playlists any media player understands.

The appliance boots already streaming. On first boot, Liquidsoap connects a licence clean generated demo source to Icecast on the /stream.ogg mountpoint, so the whole chain is proven working the moment the VM starts and the status page shows a live mountpoint out of the box. You then point Liquidsoap at your own music to go live. Because Icecast relays over plain HTTP, listeners need no special software: a browser, VLC, or any internet radio app can play a mountpoint directly.

Secure by default. The stock Icecast configuration ships the well known default password hackme for its source, relay and admin accounts. This image ships no working password at all. On the first boot of every VM, icecast-liquidsoap-firstboot.service generates three independent random passwords, writes them into the configuration, and wires Liquidsoap to authenticate with the same per VM source password. Both Icecast and the Liquidsoap source are configured to refuse to start if that rotation has not run, so a VM can never come up serving a default or placeholder credential.

No copyrighted audio ships in this image. The out of the box demo source is a generated reference tone, not a recording of anyone's work, so you can demonstrate the appliance freely. Step 11 shows exactly how to swap in your own playlist.

What is included:

• Liquidsoap 2.4.5 installed from savonet's official release, streaming a licence clean demo source to Icecast out of the box
• Icecast 2.4.4 installed from the stock Ubuntu 24.04 archive package so it inherits Ubuntu's security maintenance
• Icecast listening on port 8000, its native port, for both listeners and source clients
• nginx on port 80 reverse proxying the status and admin interface so the server is reachable without a port suffix, plus an unauthenticated /healthz endpoint for Azure Load Balancer health probes
• Per VM admin, source and relay passwords generated on first boot and recorded at /root/icecast-liquidsoap-credentials.txt (mode 0600)
• icecast2.service, nginx.service, cloudimg-radio.service (Liquidsoap) and a one shot icecast-liquidsoap-firstboot.service as systemd units, enabled and active
• A fully patched Ubuntu 24.04 LTS base with unattended security upgrades enabled
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) comfortably serves a typical station; Icecast is light on CPU because it relays the source stream rather than re encoding it, so listener count is mostly a bandwidth question, while Liquidsoap's own CPU use depends on how much mixing and encoding your station script does. NSG inbound: allow 22/tcp from your management network, 80/tcp for the status and admin interface, and 8000/tcp for listeners and source clients.

Icecast serves plain HTTP. For a public station, or any time an admin or source password crosses the internet, terminate TLS in front of it with your own domain using a reverse proxy or Azure Application Gateway.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Icecast + Liquidsoap Internet Radio Station by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create then Create. After deployment, open port 8000 as well (Step 2 shows the CLI equivalent).

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name radio \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name radio --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name radio --port 8000 --priority 1011

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Four units make up the appliance: icecast-liquidsoap-firstboot.service runs once on first boot to generate this VM's passwords, icecast2.service is the streaming server, cloudimg-radio.service is the Liquidsoap source feeding it, and nginx.service fronts it on port 80. Confirm all four are active, and that Icecast is listening on port 8000 with nginx on port 80:

systemctl is-active icecast2 nginx cloudimg-radio icecast-liquidsoap-firstboot
sudo ss -tlnp | grep -E ':80 |:8000 '

Expected output:

active
active
active
active
LISTEN 0      5            0.0.0.0:8000      0.0.0.0:*    users:(("icecast2",pid=...))
LISTEN 0      511          0.0.0.0:80        0.0.0.0:*    users:(("nginx",pid=...))
LISTEN 0      511             [::]:80           [::]:*    users:(("nginx",pid=...))

Step 5 - Retrieve your per VM passwords

On first boot, icecast-liquidsoap-firstboot.service generated three independent random passwords for this VM and recorded them in a root only file:

• ICECAST_ADMIN_PASSWORD signs you in to the admin interface as user admin
• ICECAST_SOURCE_PASSWORD is what a source client uses (with user source) to start broadcasting; the built in Liquidsoap source already uses this value
• ICECAST_RELAY_PASSWORD is used by another Icecast server pulling a relay from this one

Read them with:

sudo cat /root/icecast-liquidsoap-credentials.txt

The three passwords are distinct on purpose: handing a presenter the source password does not give them admin access. When you need to share the file, for example in a support bundle or a screenshot, print it with the secrets masked:

sudo sed -E 's/^(ICECAST_[A-Z_]*PASSWORD=).*/\1********/' /root/icecast-liquidsoap-credentials.txt

Step 6 - Confirm the appliance is already streaming

nginx serves an unauthenticated /healthz endpoint for load balancer probes, and Icecast publishes machine readable server statistics at /status-json.xsl. Because Liquidsoap connected the demo source on first boot, the status JSON already lists a live /stream.ogg mountpoint. The admin interface requires the password from Step 5, so an unauthenticated request is rejected with 401 while an authenticated one returns 200:

curl -sI http://127.0.0.1/healthz | head -1
curl -s http://127.0.0.1/status-json.xsl | jq -r '.icestats.server_id, .icestats.source.listenurl'

PW=$(sudo grep '^ICECAST_ADMIN_PASSWORD=' /root/icecast-liquidsoap-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w "no auth  -> HTTP %{http_code}\n" http://127.0.0.1/admin/stats
curl -s -o /dev/null -w "with pw  -> HTTP %{http_code}\n" -u "admin:$PW" http://127.0.0.1/admin/stats

Expected output:

HTTP/1.1 200 OK
Icecast 2.4.4
http://<vm-public-ip>:8000/stream.ogg
no auth  -> HTTP 401
with pw  -> HTTP 200

You can pull the live audio itself to prove the stream end to end. A listener needs no credentials; this reads a few seconds of audio and reports how many bytes arrived:

curl -s -m 3 -o /tmp/stream-sample.ogg http://127.0.0.1:8000/stream.ogg || true
echo "pulled $(wc -c < /tmp/stream-sample.ogg) bytes of live Ogg audio"; rm -f /tmp/stream-sample.ogg

Step 7 - Confirm no default password shipped

Upstream Icecast ships the default password hackme. This image removes it everywhere, including from the commented examples in the configuration file, and generates per VM secrets instead. Prove it for yourself: the default appears nowhere in the configuration, it does not authenticate, and icecast2.service declares a hard Requires dependency on the first boot rotation so it cannot start without real per VM credentials:

sudo grep -c hackme /etc/icecast2/icecast.xml || echo "0 (the upstream default password is not present)"
curl -s -o /dev/null -w "admin:hackme -> HTTP %{http_code}\n" -u admin:hackme http://127.0.0.1/admin/stats
systemctl show icecast2 -p Requires --value

Expected output:

0 (the upstream default password is not present)
admin:hackme -> HTTP 401
icecast-liquidsoap-firstboot.service system.slice sysinit.target -.mount

Step 8 - Open the status page

Browse to http://<vm-public-ip>/. The public status page lists every active mountpoint with its stream name, description, content type, listener count and current track, together with M3U and XSPF playlist links and an inline player. Because the appliance boots streaming, you will see the live /stream.ogg mountpoint with its current track set by Liquidsoap.

Step 9 - Explore the admin interface

Browse to http://<vm-public-ip>/admin/ and sign in as admin with the password from Step 5. Admin Home shows global server statistics: the resolved host, total connections, current listeners, source count and server version.

Mountpoint List shows every active mountpoint with its live controls: List Clients to see who is connected, Move Listeners to migrate an audience to another mountpoint without interrupting them, Update Metadata to change the track title shown to listeners, and Kill Source to disconnect the broadcaster.

Step 10 - Inspect connected listeners

From the Mountpoint List choose List Clients on the /stream.ogg mountpoint to see each connected listener: their IP address, how long they have been connected and the player they are using. Each row has a Kick action to disconnect a single listener.

Step 11 - Replace the demo source with your own playlist

The station is driven by a Liquidsoap script at /opt/cloudimg-radio/cloudimg-radio.liq, run by cloudimg-radio.service. Out of the box it streams a generated reference tone so the appliance is demonstrably live without shipping anyone's music. To broadcast your own library, upload your audio to a directory the cloudimg-radio user can read, then edit the script to play a playlist instead of the tone. Replace the radio = ... source line with a playlist source, keeping the output.icecast(...) block as is:

# /opt/cloudimg-radio/cloudimg-radio.liq
source_password = environment.get("ICECAST_SOURCE_PASSWORD")

# Play everything under /srv/music on shuffle, and never fall silent.
radio = mksafe(playlist(mode="randomize", "/srv/music"))

output.icecast(
  %vorbis(quality=0.4),
  host="localhost", port=8000,
  password=source_password,
  mount="/stream.ogg",
  name="My Station", description="My internet radio", genre="Various",
  public=false,
  radio)

The Icecast source password is injected from /etc/cloudimg-radio/cloudimg-radio.env, which first boot populated with this VM's ICECAST_SOURCE_PASSWORD, so you never hard code a secret in the script. Apply your changes with:

sudo systemctl restart cloudimg-radio

Liquidsoap reconnects to Icecast within a couple of seconds and your playlist replaces the demo tone on /stream.ogg. Liquidsoap can do much more than play a folder: crossfades, scheduled shows with switch, live input that takes over from the playlist, request queues, jingles and per track normalisation. See the Liquidsoap documentation for the full language.

Step 12 - Broadcast from an external source client instead

You can also disable the built in Liquidsoap source and broadcast from a source client on your machine. Stop cloudimg-radio (sudo systemctl stop cloudimg-radio) and point any Icecast compatible client at the server using the source password from Step 5:

Server / host : <vm-public-ip>   (or your DNS name from Step 13)
Port          : 8000
Mountpoint    : /stream.ogg
Username      : source
Password      : the ICECAST_SOURCE_PASSWORD value from Step 5
Format        : Ogg Vorbis, Opus or MP3

Popular choices are butt (Broadcast Using This Tool) and Mixxx for live shows, and OBS Studio for streaming a desktop or console audio feed. Once connected, the mountpoint appears immediately on the status page and listeners can tune in at http://<vm-public-ip>:8000/stream.ogg.

Step 13 - Set your public hostname

Icecast uses the <hostname> setting to build the stream URLs it advertises: the listen URLs on the status page, and the contents of the M3U and XSPF playlists listeners download. On first boot the appliance resolves this automatically, but Azure's instance metadata service does not report a public IP for every VM configuration, so it may have fallen back to the VM's private address. Check what it resolved to:

grep -E '<hostname>' /etc/icecast2/icecast.xml

If that is a private address (for example 10.x.x.x) then playlists handed to external listeners will not work. It is good practice in any case to publish a stable DNS name rather than an IP, because an Azure public IP can change. Set it to the name or address your listeners will use, then restart Icecast:

sudo sed -i -E 's#<hostname>[^<]*</hostname>#<hostname>radio.your-domain.example</hostname>#' /etc/icecast2/icecast.xml
sudo systemctl restart icecast2

Maintenance

• Station script: the Liquidsoap station lives in /opt/cloudimg-radio/cloudimg-radio.liq; restart with sudo systemctl restart cloudimg-radio after editing. Check what it is doing with journalctl -u cloudimg-radio -f.
• Icecast configuration: everything lives in /etc/icecast2/icecast.xml. Restart with sudo systemctl restart icecast2 after editing. Common changes are raising <clients> in <limits> for a larger audience, and adding <mount> sections to set per mountpoint limits or fallback streams.
• Logs: Icecast access and error logs are in /var/log/icecast2/; Liquidsoap logs to the journal (journalctl -u cloudimg-radio).
• Rotating passwords: edit the <source-password>, <relay-password> and <admin-password> values in /etc/icecast2/icecast.xml and restart Icecast; if you change the source password, update /etc/cloudimg-radio/cloudimg-radio.env to match and restart cloudimg-radio. The first boot generator only runs once, so it will not overwrite your changes.
• Security updates: unattended security upgrades are enabled, so the OS keeps itself patched. Reboot when a new kernel is installed.
• TLS and access control: for a public station, front Icecast with your own domain and a TLS terminating reverse proxy or Azure Application Gateway, and restrict the admin interface in the NSG to the networks that need it.

Support

cloudimg provides 24/7/365 expert technical support for this image. Contact support@cloudimg.co.uk. Icecast is developed by the Xiph.Org Foundation and Liquidsoap by savonet; both are licensed under the GNU General Public License version 2. The corresponding source is available from the Ubuntu archive with apt-get source icecast2 for Icecast, and from github.com/savonet/liquidsoap for Liquidsoap. This image is provided by cloudimg and is not affiliated with or endorsed by the Xiph.Org Foundation or savonet; additional charges apply for build, maintenance and 24/7 support.