Nexterm on Ubuntu 24.04 on Azure User Guide

Overview

Nexterm is an open source, self hosted server management platform. It gives your team a single browser based console for connecting to servers over SSH, VNC, RDP and Telnet, transferring files with an SFTP manager, and organising everything with organizations, folders and an encrypted credential vault. It also covers server monitoring, reusable command snippets, Docker and Proxmox administration, two factor authentication, passkeys and OIDC and LDAP single sign on.

The cloudimg image runs Nexterm from the vendor's official all in one container (nexterm/aio, pinned by digest), published only on loopback 127.0.0.1:6989, and fronts it with nginx on port 80. nginx is configured for the WebSocket traffic the live terminal, remote desktop and SFTP channels rely on and is ready for your TLS certificate. The embedded SQLite datastore lives in a Docker volume captured into the image.

Secure by default: the image ships with no administrator and no stored data. The at rest encryption key that protects your saved server passwords, SSH keys and passphrases is generated uniquely on the first boot of every instance and written 0600 root:root to /etc/nexterm/nexterm.env, never baked into the image. Your first visit lands on the first run setup where you create your own admin. A nexterm-firstboot.service oneshot generates the key, resolves the instance URL and starts the stack on first boot, then disables itself.

What is included:

• Nexterm 1.2.2-BETA (MIT) from the official nexterm/aio image, pinned by digest
• Embedded SQLite datastore in the Docker volume nexterm at /app/data (no separate database to run)
• nexterm.service running the container, published on 127.0.0.1:6989
• Per VM encryption key generated at first boot, stored 0600 root:root in /etc/nexterm/nexterm.env
• nginx reverse proxy on port 80, WebSocket aware, ready for TLS
• nexterm-firstboot.service for first boot key generation + stack start
• Docker Engine runtime
• Ubuntu 24.04 LTS base, fully patched
• 24/7 cloudimg support, 24h response SLA

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet with a subnet. Recommended VM size: Standard_B2s (Nexterm is lightweight; 4 GB RAM is comfortable).

Step 1: Deploy from the Azure Portal

Search the Marketplace for Nexterm on Ubuntu 24.04, choose your VM size, and attach an NSG that allows TCP 22 (SSH) from your management network and TCP 80 / 443 (the console) from the networks that need it. Front port 80 with TLS in production (see the HTTPS section below).

Step 2: Deploy from the Azure CLI

RG="nexterm-prod"; LOCATION="eastus"; VM_NAME="nexterm-01"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/nexterm-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az network vnet create -g "$RG" --name nexterm-vnet --address-prefix 10.90.0.0/16 --subnet-name nexterm-subnet --subnet-prefix 10.90.1.0/24
az network nsg create -g "$RG" --name nexterm-nsg
az network nsg rule create -g "$RG" --nsg-name nexterm-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name nexterm-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
az vm create -g "$RG" --name "$VM_NAME" --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name nexterm-vnet --subnet nexterm-subnet --nsg nexterm-nsg --public-ip-sku Standard

Step 3: Connect via SSH

ssh azureuser@<vm-ip>

Step 4: Verify the services are running

Nexterm runs in a container published on loopback 127.0.0.1:6989; nginx fronts the console on port 80 and proxies its WebSocket traffic.

systemctl is-active docker nexterm nginx nexterm-firstboot
sudo ss -tlnp | grep -E ':80 |127.0.0.1:6989'
sudo docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'

All services report active, nginx is bound to :80, the container is published on 127.0.0.1:6989, and the nexterm container is Up.

Step 5: Secure by default, per VM encryption key

Nothing sensitive ships in the image. The first run setup is still pending (is-fts is true, so no administrator ships), and the at rest encryption key was generated uniquely for this VM at first boot and is root only.

curl -s http://127.0.0.1/api/service/is-fts
sudo stat -c '%n perms=%a owner=%U:%G' /etc/nexterm/nexterm.env
sudo sed -E 's/(ENCRYPTION_KEY=)[0-9a-f]+/\1************/' /etc/nexterm/nexterm.env

is-fts returns true, the key file is 600 root:root, and it holds a unique per VM ENCRYPTION_KEY (masked above). Keep this key safe: it is required to decrypt your credential vault.

Step 6: Complete the first run setup

Open http://<vm-ip>/ in your browser. Because no administrator ships, Nexterm shows its first run Registration screen. Enter a First Name, Last Name, Username and a strong Password, then click Register. This is where you secure the instance, so pick a real password.

Step 7: The server console

After registering you are signed in and land on the server console. Add servers from the sidebar, grouped into folders, to build up the infrastructure you manage from the browser.

Step 8: Add and edit a server

Right click in the sidebar to add a server, or right click an existing entry and choose Edit Server. Give it a name, choose the protocol (SSH, VNC, RDP, Telnet or SFTP), enter the host and port, and attach an identity from the encrypted credential vault under the Identities tab. Click Save, then double click the server to open a live session in your browser.

Step 9: Settings, identities and two factor authentication

The Settings area holds your account, the Identities credential vault, Organizations for team sharing, Users, Roles & Permissions, and Authentication where you can enable OIDC or LDAP single sign on. Enable two factor authentication on your account for an extra layer of security.

Step 10: The stack

sudo docker inspect --format '{{.Image}}' nexterm
curl -s http://127.0.0.1/api/service/version
nginx -v
curl -s -o /dev/null -w 'GET / -> HTTP %{http_code}\n' http://127.0.0.1/

The pinned nexterm/aio image runs the server, nginx 1.24 fronts it, the Nexterm version is 1.2.2-BETA, and the console returns HTTP 200 through nginx.

Step 11: Data and persistence

All Nexterm data lives in the embedded SQLite database inside the Docker volume nexterm, captured into the image and carried onto every instance.

sudo docker volume ls | grep nexterm
sudo docker exec nexterm ls -lh /app/data/nexterm.db
systemctl is-enabled nexterm-firstboot.service
apt-mark showhold

The volume is present, the database file is on disk inside it, the first boot service is enabled for the next fresh instance, and there are no held packages, so the OS security baseline is intact.

Step 12: Enable HTTPS

nginx already fronts Nexterm on port 80 and is ready for TLS. Point a DNS record at your VM, then obtain a certificate with certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> --agree-tos -m <your-email> --redirect

certbot installs the certificate, rewrites the nginx server block for TLS, and sets up automatic renewal. Your console is then served over HTTPS.

Managing the service

sudo systemctl status nexterm --no-pager | head -n 6
sudo docker logs --tail 8 nexterm

Restart the stack with sudo systemctl restart nexterm and follow the live container logs with sudo docker logs -f nexterm; nginx logs are under /var/log/nginx/. Back up the instance by snapshotting the OS disk, and keep a copy of /etc/nexterm/nexterm.env (your per VM encryption key) somewhere safe, since it is required to decrypt the credential vault.

Support

cloudimg provides 24/7 support for this image via email and live chat: deployment, nginx TLS termination, upgrades, identity providers and performance tuning. Email support@cloudimg.co.uk.

This is a repackaged open source software product with additional charges for cloudimg support services. Nexterm is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.