Developer Tools Azure

Ortelius on Ubuntu 24.04 on Azure User Guide

| Product: Ortelius on Ubuntu 24.04 LTS on Azure

Overview

This guide covers the deployment and configuration of Ortelius on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Ortelius is an open source software supply chain intelligence platform and a Continuous Delivery Foundation project. It ingests Software Bills of Materials (SBOMs) at build time, matches every deployed component against the OSV.dev vulnerability database on a 15 minute refresh cycle, and tracks each CVE across its full lifecycle — from the moment it is introduced into a release, through detection in a running environment, to remediation.

The image installs Ortelius v12.0.515 (the backend API, Go/Fiber) and its companion frontend v12.0.1632 (Next.js) from the official upstream source, holding all data in ArangoDB 3.12. All three run on a single VM as native systemd services — there is no Docker/compose layer at runtime.

One appliance, three services. ortelius-backend.service serves the REST + GraphQL API on port 3000, ortelius-frontend.service serves the web dashboard on port 8080, and arangodb3.service holds every release, SBOM, CVE and dependency-graph record. ArangoDB is bound to 127.0.0.1:8529 and is never exposed to the network. Both 3000 and 8080 must be reachable from wherever you use the dashboard — the browser calls the API directly, it is not proxied through the frontend server.

Security by design — there is no administrator account in the image. Rather than shipping a default login and rotating it later, this image ships no usable credential, no database schema, and no signing keys at all. On the very first boot of every VM, a one-shot service rotates ArangoDB's root password from empty to a unique per-VM value and enables database authentication, generates a unique JWT signing key and token-encryption key, creates the schema and administrator account, and then proves the new administrator password signs in through the real login API and that admin, password, changeme, admin123, ortelius and a blank password are all rejected — before writing /root/ortelius-credentials.txt (mode 0600, root only).

Upstream ships a hardcoded JWT signing key — this image does not. The Ortelius backend source hardcodes a JWT signing key ("your-secret-key-change-this-in-production") and separately exposes a SetJWTSecret() function to override it that upstream's own main.go never calls. This image's backend is built from a small patch that wires that function up to a required JWT_SECRET environment variable — the backend now refuses to start at all without a per-VM signing key, so no cloudimg Ortelius instance can ever sign a session with the publicly-known default.

You start with real data, not an empty screen. First boot also adds the ortelius/ortelius repository as a system Favorite and proves it renders in the authenticated catalog before declaring itself done — so the moment you sign in, the Welcome page already shows real tracked-component data, and you can see exactly how favoriting a repository works before doing it yourself.

What is included:

  • Ortelius v12.0.515 (Go/Fiber API) + frontend v12.0.1632 (Next.js dashboard), holding data in ArangoDB 3.12
  • Continuous CVE matching against the OSV.dev vulnerability database (15 minute refresh)
  • A multi-organization dashboard: MTTR/SLA tracking, vulnerability trends, NIST framework alignment
  • A per-instance ArangoDB password, JWT signing key, token-encryption key and administrator password generated on first boot and documented in /root/ortelius-credentials.txt (0600)
  • GitHub App integration for connecting your own repositories, plus favorite-by-name for public repos
  • Ubuntu 24.04 LTS base, fully patched
  • 24/7 cloudimg support, 1 hour average response for critical issues

Prerequisites

  • Active Azure subscription, SSH public key, VNet and subnet in the target region
  • Subscription to the Ortelius listing on Azure Marketplace
  • Network Security Group rules allowing TCP 22 (administration), TCP 8080 (the web dashboard) and TCP 3000 (the API — the dashboard's browser-side calls hit this directly) from the networks that need them
  • Outbound internet access from the VM (the backend verifies favorited repositories against the GitHub/GitLab public API, and matches components against OSV.dev)

Step 1: Deploy from the Azure Portal

Search Ortelius in Marketplace, select the cloudimg publisher, and click Create. Choose Standard_B2ms or larger (ArangoDB plus a persistent Next.js server benefit from the extra headroom over Standard_B2s). Configure the Network Security Group to allow TCP 8080 (dashboard) and TCP 3000 (API — required, the browser talks to it directly) from your administrative networks, and TCP 22 for administration. ArangoDB stays on loopback and is never exposed.

Step 2: Deploy from the Azure CLI

RG="ortelius-prod"; LOCATION="eastus"; VM_NAME="ortelius-01"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/ortelius/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az network vnet create -g "$RG" --name ortelius-vnet --address-prefix 10.93.0.0/16 --subnet-name ortelius-subnet --subnet-prefix 10.93.1.0/24
az network nsg create -g "$RG" --name ortelius-nsg
az network nsg rule create -g "$RG" --nsg-name ortelius-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name ortelius-nsg --name allow-dashboard --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 8080 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name ortelius-nsg --name allow-api --priority 120 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 3000 --access Allow --protocol Tcp
az vm create -g "$RG" --name "$VM_NAME" --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2ms --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name ortelius-vnet --subnet ortelius-subnet --nsg ortelius-nsg --public-ip-sku Standard

Step 3: First boot and your credentials

On first boot the image rotates ArangoDB's root password and enables database authentication, generates this VM's JWT signing key, token-encryption key and administrator password, starts the API and dashboard, adds the ortelius/ortelius repository as a proof-of-life Favorite, and verifies the new administrator password works and that common defaults are rejected. This completes in seconds. SSH in as azureuser and read the details:

sudo cat /root/ortelius-credentials.txt

The file is mode 0600 and owned by root, so only a privileged user can read it. It contains the dashboard URL, the API URL, the administrator username and password, and the ArangoDB root password.

Step 4: Confirm the appliance is running

All three services should report active. ss confirms the API and dashboard are reachable while ArangoDB is bound to loopback only, and the Apache-2.0 licence text ships in the image.

systemctl is-active arangodb3.service ortelius-backend.service ortelius-frontend.service
ss -tln 2>/dev/null | grep -E ':(3000|8080|8529) '
head -3 /usr/share/doc/ortelius/LICENSE

All services report active, ss shows the API on port 3000 and the dashboard on port 8080 while ArangoDB is bound to 127.0.0.1 port 8529 only, and the Apache-2.0 licence text ships in the image

You can prove the same login from the command line. This performs a real login through the API with the per-VM password, confirms every common default credential is rejected through the same flow, then proves the core catalog function end to end (creating and listing a tracked repository):

sudo /usr/local/sbin/ortelius-roundtrip.sh

The credentials file contents (redacted)

ortelius-roundtrip.sh output: the per-VM password authenticates through the real login API, every default/known credential is rejected, and an authenticated create+list against the component catalog succeeds

ArangoDB authentication is enabled and rejects anonymous requests, the OS has zero remaining upgradable packages, and no swap is active

Step 5: Sign in to the web dashboard

Browse to http://<your-vm-public-ip>:8080/ and you will see the Ortelius sign-in form. Unauthenticated visitors can still browse public repository vulnerability data — the banner reads "You are viewing public open source repositories. Sign In or Sign Up to see your organization data."

The Ortelius sign-in form, reached while browsing public repository data unauthenticated

Sign in with the username admin and the password from the credentials file. You land on the Organizations view, showing the ortelius organization that first boot's own proof-of-life repository automatically created — with its release count, vulnerability status and dependency count.

The authenticated Organizations view, showing the 'ortelius' organization card with its vulnerability status

Step 6: Explore the Welcome page and your first tracked repository

Open Welcome (linked from the onboarding banner, or /welcome directly). Because first boot already added ortelius/ortelius as a proof-of-life Favorite, you land on real data immediately instead of an empty screen — this is the core of what Ortelius does: turning a tracked repository into a real, populated entry in the vulnerability catalog.

The Welcome page confirming the ortelius/ortelius repository is tracked as a Favorite, with real vulnerability data ready to explore

Step 7: Track your own repositories

Two ways to add repositories to the catalog:

  • Connect GitHub (recommended for your own repos): click Connect GitHub Account, authorize the Ortelius GitHub App, and choose which repositories — public or private — to grant it access to.
  • Favorite a public repo by name: search by owner/repo for something you actually run in production (the form suggests nginx, curl, redis) and click Search, then Favorite the result. Useful for public repos you don't have GitHub access to yourself.

Favoriting a public repository by name to add it to the vulnerability catalog

curl -s -b <(sudo bash -c 'echo "auth_token=<your session token>"') \
  -H 'Content-Type: application/json' \
  -d '{"provider":"github","owner":"<owner>","name":"<repo>"}' \
  http://<vm-ip>:3000/api/v1/tracked-repos

CVE matching depends on SBOM data reaching a release — connecting or favoriting a repository on its own creates a release record, but does not attach an SBOM immediately. If your deployment runs the companion relscanner-job CronJob (not part of this image, deployed separately if you want fully automated SBOM/Scorecard collection), it periodically scans every tracked repo on a 15 minute schedule and attaches SBOMs via OCI attestations, Cosign, GitHub Release assets, or Syft/cdxgen generation.

Step 8: Review the dashboard

Dashboard ("The Posture") surfaces Mean Time To Remediate, SLA compliance by severity (Critical 15 days, High 30 days, Medium 90 days, Low 180 days), 180-day vulnerability trend analysis, and NIST SP 800-53/800-137/800-190/800-218 alignment, once your organization has release and SBOM data. Synced Endpoints ("Where It's Running") shows where deployed software is actually running (Kubernetes, Docker, VM, serverless). Project Releases ("Where to Fix It") tracks vulnerabilities by release version.

Step 9: User management and RBAC

Sign in as admin and open User Management to review accounts, or System Settings for application configuration. Ortelius' role hierarchy is owner → admin → editor → viewer, scoped per organization; RBAC configuration can be applied as GitOps-style YAML via the API.

Step 10: Back up your data

The entire catalog — releases, SBOMs, CVEs, endpoints and the dependency graph — lives in ArangoDB's vulnmgt database. Take a logical backup with arangodump on a schedule appropriate for your change rate:

sudo arangodump --server.username root --server.password "<arangodb-root-password-from-credentials-file>" \
  --server.database vulnmgt --output-directory "/root/ortelius-backup-$(date +%Y%m%d)"

Store the dump off the VM (Azure Blob Storage, another host, or your existing backup pipeline). To restore, use arangorestore against an empty vulnmgt database.

Step 11: Add a TLS certificate for your own domain

The image ships HTTP only, on both the API (3000) and dashboard (8080) ports. If you point a domain at this VM, put a reverse proxy (nginx, Caddy, or an Azure Application Gateway) in front of both ports with your own TLS certificate, and set RUNTIME_REST_ENDPOINT / RUNTIME_GRAPHQL_ENDPOINT in /etc/ortelius/frontend.env plus CORS_ALLOWED_ORIGINS in /etc/ortelius/backend.env to your HTTPS domain before restarting both services — the browser calls the API origin directly, so both must agree on the externally-visible address.

Step 12: Change the administrator password

From the Ortelius UI, open Profile to change your password, or rotate it via the API:

curl -s -b <(echo "auth_token=<your session token>") -H 'Content-Type: application/json' \
  -d '{"old_password":"<current>","new_password":"<new-strong-password>"}' \
  http://<vm-ip>:3000/api/v1/auth/change-password

Troubleshooting

Cannot reach the dashboard right after first boot. First boot completes in seconds, but if you connect immediately on VM creation, wait a few seconds and retry — both ortelius-backend.service and ortelius-frontend.service only start once the bootstrap marker exists. Check progress with:

systemctl status ortelius-firstboot.service
journalctl -u ortelius-firstboot.service --no-pager

Sign-in fails with "Invalid credentials" even though the password looks right. Confirm you are reaching the dashboard on the same origin the API's CORS_ALLOWED_ORIGINS was configured for (the VM's own public IP by default) — browsing through a different hostname, IP, or a reverse SSH tunnel on a different local port changes the browser's Origin header, which the API's CORS policy then rejects, and the frontend surfaces that as an "Invalid credentials" message rather than a network error.

Forgot the administrator password. SSH in and read /root/ortelius-credentials.txt again, or rotate it via the API in Step 12.

Favoriting a repo returns "not found". The backend verifies the repository actually exists via a real GitHub/GitLab API call before tracking it — confirm the owner/repo spelling and that outbound internet access from the VM is not blocked.

Need to restore a captured secret. The ArangoDB root password is also visible in /root/ortelius-credentials.txt; Ortelius itself never displays it again after first boot.

Support

cloudimg provides 24/7 technical support for this Ortelius image by email (support@cloudimg.co.uk) and live chat, covering deployment and first-boot configuration, signing in and rotating the administrator password, GitHub integration and repository connection, organization and RBAC setup, ArangoDB backup and restore, Ortelius version upgrades, and troubleshooting. Critical issues receive a 1 hour average response time.

Ortelius is free software licensed under the Apache License, Version 2.0. It is a Continuous Delivery Foundation project. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.