NethServer 8 on AlmaLinux 9 on Azure User Guide

Overview

This image ships NethServer 8 (NS8) on AlmaLinux 9, installed and ready to initialise on the first boot of every deployed virtual machine. NethServer 8 is a free, open source server management platform: it runs a lightweight cluster/management layer on the host and installs applications as Podman containers, all administered through a single browser-based console. The platform itself is licensed under the GPL-3.0.

The management layer is installed at build time using the upstream NethServer ns8-core installer (the ns8-stable release track). The core services — the api-server, the node and cluster agents, Redis, and the Traefik reverse proxy — are enabled and start automatically on every boot. The web console is served over HTTPS on port 443 at the path /cluster-admin/.

Authentication is independent per virtual machine. On the very first boot a one-time initialisation service resolves this VM's public IP, creates a standalone single-node cluster (generating a unique WireGuard identity for the node), rotates the cluster-admin password to a value unique to this VM, opens the web console at the firewall, and writes the credentials to a root-only file. Two virtual machines launched from the same gallery image never share a password, and the shipped image never exposes the vendor default password to the internet.

AlmaLinux 9 is a free, community-led, binary-compatible rebuild of Red Hat Enterprise Linux 9. This image is intended for administrators and managed-service providers who want a production-grade NethServer 8 platform on the Red Hat family, ready in minutes, without manually installing the core, bootstrapping a cluster, or setting an admin password by hand. Section 9 covers replacing the first-boot self-signed certificate with a trusted one, and Section 12 covers the security steps you should take before exposing the console to the public internet.

The brand is lowercase cloudimg throughout this guide. All cloudimg URLs use the form https://www.cloudimg.co.uk.

Prerequisites

Before you deploy this image you need:

• A Microsoft Azure subscription with permissions to create resource groups, virtual networks, and virtual machines
• An SSH public key for initial login to the azureuser admin account on the virtual machine
• A virtual network and subnet in the eastus region with an associated network security group
• Inbound NSG rules allowing TCP 22 from your management IP, TCP 443 from the IPs that need the web console, and (for multi-node clusters) UDP 55820 for the cluster VPN
• The Azure CLI (az version 2.50 or later) if you intend to use the CLI deployment path in Section 2

Step 1: Deploy the Virtual Machine from the Azure Portal

Navigate to Marketplace in the Azure Portal, search for NethServer 8, and select the cloudimg publisher entry. Click Create.

On the Basics tab choose your subscription, target resource group, and region. Set the virtual machine name. Choose SSH public key as the authentication type, set the username to azureuser, and paste your SSH public key. Standard_B2s (2 vCPU / 4 GiB) is the supported minimum for the NethServer 8 core and comfortably runs the console and a small number of applications. If you plan to install heavier applications (mail, groupware, file sharing), choose Standard_B2ms (2 vCPU / 8 GiB) or larger.

On the Disks tab select Standard SSD for the OS disk. Application containers and their data live under /home and /var/lib/nethserver; the image provisions a 64 GB OS disk, which clears NethServer's 40 GB minimum. Attach and grow storage if you plan to run data-heavy applications.

On the Networking tab select your existing virtual network and subnet. Attach a network security group that opens TCP 22 from your management IP range and TCP 443 from the client IPs that need the console. Do not expose the console to the entire public internet until you have replaced the self-signed certificate (Section 9) and reviewed Section 12.

Review and create. When provisioning finishes, note the public IP address on the VM's Overview page.

Step 2: Deploy the Virtual Machine from the Azure CLI

The following commands create a resource group, open the required ports, and launch the image. Replace the offer/plan URN with the one shown on the cloudimg listing page if it differs.

az group create --name nethserver-rg --location eastus

az network nsg create --resource-group nethserver-rg --name nethserver-nsg
az network nsg rule create --resource-group nethserver-rg --nsg-name nethserver-nsg \
  --name allow-ssh --priority 1001 --protocol Tcp --destination-port-ranges 22 \
  --source-address-prefixes "<your-management-ip>/32" --access Allow
az network nsg rule create --resource-group nethserver-rg --nsg-name nethserver-nsg \
  --name allow-https --priority 1002 --protocol Tcp --destination-port-ranges 443 \
  --source-address-prefixes "<your-management-ip>/32" --access Allow

az vm create \
  --resource-group nethserver-rg \
  --name nethserver-vm \
  --image cloudimg:nethserver:nethserver:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --nsg nethserver-nsg \
  --public-ip-sku Standard

If prompted, accept the marketplace image terms once per subscription with az vm image terms accept --urn cloudimg:nethserver:nethserver:latest.

Step 3: First Boot and Credentials

On the first boot, nethserver-firstboot.service creates the single-node cluster, rotates the cluster-admin password to a value unique to this VM, and writes it to /root/nethserver-credentials.txt (mode 0600, root only). SSH in as azureuser and read the file:

ssh azureuser@<public-ip>
sudo cat /root/nethserver-credentials.txt

The file looks like this (the password is unique to your VM):

# NethServer 8 — generated on first boot. These credentials are unique to this
# VM. Store them somewhere safe, then log in and change the password if you wish.

# Web console (cluster-admin)
console.url=https://<your-vm-public-ip>/cluster-admin/
admin.username=admin
admin.password=<unique-to-your-vm>

Confirm the core platform is up and the first-boot service completed:

sudo systemctl is-active nethserver-firstboot.service
for u in redis api-server agent@cluster agent@node; do echo "$u.service = $(systemctl is-active $u.service)"; done

Step 4: Sign In to the Web Console

Open https://<your-vm-public-ip>/cluster-admin/ in your browser. The console uses a self-signed certificate on first boot, so your browser will warn on the first visit — this is expected and is resolved in Section 9. NethServer's sign-in is a two-step form: enter the username admin, click Continue, then enter the per-VM password from /root/nethserver-credentials.txt.

You can verify from the command line that the web console is healthy, that the per-VM password authenticates, and that the vendor default password is rejected:

curl -sk -o /dev/null -w "cluster-admin console: HTTP %{http_code}\n" https://127.0.0.1/cluster-admin/
curl -sk -X POST http://127.0.0.1:9311/api/login -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"<admin.password>"}' | grep -q '"token"' \
  && echo "per-VM admin login: PASS" || echo "per-VM admin login: FAIL"

Step 5: The Cluster Status Dashboard

After signing in you land on the Cluster status dashboard. It shows available updates, installed applications, the number of nodes (1 on a fresh install), scheduled backups, email-notification status, and system logs. The left navigation gives you Nodes, Domains and users, Software center, Applications, Backup and restore, System logs, Audit trail, Settings, and About.

Step 6: Install Applications from the Software Center

The Software center is the application catalog. Search for an application — for example CrowdSec, DNSMasq, Ejabberd, Nextcloud, or a mail server — and click Install. NethServer downloads the application's container images and provisions it as an isolated, rootless-Podman module with its own user, so applications are cleanly separated from each other and from the host.

Step 7: Manage Users, Domains, and Settings

Under Domains and users you create a local or LDAP/Active Directory account provider and add the users and groups your applications will authenticate against. Under Settings you manage the node name, TLS certificates, email notifications, software repositories, and other system-wide options.

Step 8: Verify the Node from the Command Line

The first-boot service is a one-shot that disables itself after it succeeds, and the node's WireGuard identity is generated per VM. You can confirm the state directly:

systemctl is-enabled nethserver-firstboot.service
ip -brief addr show wg0
firewall-cmd --list-services

Step 9: Replace the Self-Signed TLS Certificate

The first-boot console uses a self-signed certificate. For production, point a DNS name at your VM's public IP and request a trusted certificate from the console: go to Settings → TLS certificates, add a certificate for your fully-qualified domain name, and NethServer obtains and renews a Let's Encrypt certificate automatically through Traefik. Access the console at https://<your-fqdn>/cluster-admin/ afterwards.

Step 10: Firewall and Ports

NethServer manages the host firewall with firewalld. The first-boot service opens http and https so the console is reachable, and opens UDP 55820 for the cluster VPN. Review the open services with:

firewall-cmd --list-services
firewall-cmd --list-ports

On the Azure side, mirror only what you need in your network security group: TCP 443 for the console, plus whatever ports the applications you install require (for example TCP 25/143/993 for a mail module). Keep TCP 22 restricted to your management IP.

Step 11: Backup and Restore

NethServer 8 backs up applications, not the whole VM. Under Backup and restore you configure one or more backup destinations (S3-compatible object storage, Backblaze B2, or any WebDAV target), select which application instances to include, and set a schedule. Because each application is a self-contained module, you can restore an individual application onto this node or onto a different NethServer 8 cluster. For infrastructure-level protection, also enable Azure Backup or periodic managed-disk snapshots on the VM.

Step 12: Security Hardening

Before exposing the console to the internet:

• Replace the self-signed certificate with a trusted one (Section 9) and access the console only over your FQDN.
• Restrict TCP 443 in the network security group to the IP ranges that administer the server.
• Sign in and change the admin password, or add a dedicated named admin account and enable two-factor authentication under the user's settings.
• Keep TCP 22 restricted to your management IP and prefer key-only SSH (the image ships with password authentication disabled).
• Apply operating-system updates regularly (Section 13) and application updates from the Software center as they appear on the dashboard.

Step 13: Upgrade and Patch the Operating System

The underlying AlmaLinux 9 host is patched with dnf:

sudo dnf -y upgrade --refresh
sudo systemctl reboot

NethServer application and core updates are surfaced on the Cluster status dashboard under Available updates and applied from the console.

Additional Resources

• NethServer 8 documentation: https://docs.nethserver.org/
• NethServer community: https://community.nethserver.org/
• cloudimg guides: https://www.cloudimg.co.uk/guides/
• cloudimg support: support@cloudimg.co.uk