Mayfly-Go DevOps Bastion Platform on Ubuntu 24.04 on Azure User Guide

Overview

Mayfly-Go is an open source, web based platform that gives DevOps and operations teams a single audited entry point to their infrastructure. From one console it manages SSH and RDP hosts, relational and non relational databases (MySQL, PostgreSQL, SQLite and more), Redis, MongoDB, Elasticsearch and Kubernetes, with a built in web terminal, a file manager, per resource authorization, approval workflows and full audit logging of every session and command.

The cloudimg image installs Mayfly-Go v1.11.5 from the official release archive (sha256 verified) as a single hardened Go service, backed by a self contained SQLite datastore, so a production grade DevOps bastion is online within a minute or two of launch — no external database to provision.

What is included:

• Mayfly-Go v1.11.5 (Apache-2.0) installed from the official release archive, pinned and sha256 verified so the image never silently changes at build time
• A self contained SQLite metadata datastore — no external MySQL or PostgreSQL to run
• One systemd service — mayfly-go.service — serving the web console on port 18888 under a dedicated, unprivileged mayfly system user
• Secure by default: no default login ships in the image. A unique administrator password, a per VM JWT signing secret and a per VM AES encryption key (which protects the credentials you store for managed resources) are generated on the first boot of every VM and written to a root only file
• Full OS security patching applied at build time, with Ubuntu unattended security updates left enabled for the running image

Deploying on Azure

1. Launch the image from the Azure Marketplace. The recommended size is Standard_B2s (2 vCPU / 4 GB) or larger.
2. In the VM's Network Security Group, add an inbound rule allowing TCP port 18888 from your administrative IP range (this is the Mayfly-Go web console). Leave SSH (port 22) restricted to your own IP as well.
3. Allow the VM a minute to complete first boot — this is when your unique admin password and encryption keys are generated.

Retrieve your first-boot credentials

Every VM generates its own administrator password and encryption keys on first boot and writes them to a root only file. Connect over SSH and read them:

sudo cat /root/mayfly-go-credentials.txt

You will see your unique dashboard URL, the admin username (admin) and the per VM password. The file is 0600 root:root, and the jwt.key / aes.key in /opt/mayfly-go/config.yml are likewise unique to this VM:

Verify the service

Confirm the console service is active, first boot completed and the login page is being served on port 18888:

systemctl is-active mayfly-go.service
test -f /var/lib/cloudimg/mayfly-go-firstboot.done && echo "first boot: complete"
curl -s -o /dev/null -w 'login page: HTTP %{http_code}\n' http://127.0.0.1:18888/

Sign in

Browse to http://<your-vm-ip>:18888/ and sign in with username admin and the password from your credentials file.

After signing in you land on the console home, which shows your account, the last login IP and time, recent operations and quick access to every module. Each page carries Mayfly-Go's built in session watermark for audit.

Manage your resources

Open Resource → Machine to reach the resource console. From here you add the SSH and RDP hosts, databases, Redis, MongoDB and Kubernetes clusters you want to manage. The image ships with zero managed hosts — no target is ever wired up with a baked credential — so the console below shows an example SSH host added to illustrate the workflow.

Once a host is added you can open a browser based web terminal, transfer files, and run database queries — all mediated by Mayfly-Go's per resource authorization and recorded in its audit log. Credentials you enter for a managed resource are encrypted with this VM's own AES key before they are stored.

Audit every operation

Every action an operator takes — each sign in, host connection and command — is recorded in System → Operation Log with the operator, time, description, result and source IP, and every console page carries a per-session watermark. This audit trail is what makes Mayfly-Go a controlled, accountable entry point to your infrastructure rather than shared, unaudited access. Change your own password and manage your profile from Personal Center in the top-right user menu.

Security posture

The image is secure by default. The upstream demo credential (admin / admin123) is not present — the admin password is rotated to a unique per VM value on first boot, so the published default is rejected. There is a single built-in account, and the login brute-force lockout (5 failed attempts per 10 minutes) is retained:

sudo sqlite3 /opt/mayfly-go/data/mayfly-go.db "SELECT count(*) FROM t_sys_account;"

The login image-captcha is disabled by default so the appliance can be integrated and automated; you can re-enable it, and enable OTP two-factor authentication, under System → System Config in the console.

Security patching

The image is fully patched at build time and keeps Ubuntu unattended security updates enabled, so the running VM continues to receive security fixes:

systemctl is-active mayfly-go-firstboot.service
systemctl is-enabled unattended-upgrades.service
uname -r

Support

This image is built and maintained by cloudimg with 24/7 support. If you need help deploying or operating Mayfly-Go, contact us at support@cloudimg.co.uk.