Overte Domain Server on Ubuntu 24.04 on Azure User Guide

Overview

Overte is a free, open source platform for building and hosting shared virtual worlds and social VR spaces, continuing the engine that was originally created as High Fidelity. This cloudimg image runs the self-hosted Overte domain server — the program that hosts a virtual world others connect to — together with the assignment-clients that make that world live:

• audio-mixer — mixes what each visitor hears
• avatar-mixer — lets visitors see and move around each other
• entity-server — describes the objects and layout of the world
• asset-server — stores the models and content clients download
• entity-script-server — runs the interactive logic in the world
• messages-mixer — carries messages between clients

Point an Overte client (or a compatible High Fidelity client) at the running domain and people can meet, talk and explore inside a world you own and run yourself.

The image installs the stock upstream Overte 2026.04.1 server packages, unmodified, verified against a pinned SHA256 checksum. Every cloudimg customisation is external configuration only. On first boot the VM generates a unique administrator credential, secures the settings console with it, and starts the world server automatically. Backed by 24/7 cloudimg support.

What is included:

• Overte 2026.04.1 domain server and its six assignment-clients, running under systemd, as the unprivileged overte user
• A settings console on 40100/tcp protected by HTTP Basic Auth with a unique administrator password generated on first boot — upstream ships this console with no authentication at all; this image does not
• The client connection port on 40102/udp
• A per-VM credentials file readable only by root
• 24/7 cloudimg support

The Overte engine is licensed under Apache-2.0; corresponding source is linked at the end of this guide.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size for a small world. NSG inbound rules:

• 22/tcp from your management network (SSH administration)
• 40100/tcp from your management network (the settings console — keep this restricted to trusted IPs)
• 40102/udp from your visitors (the Overte client connection port)

Only 40102/udp needs to be open to the public for visitors to connect; keep the administration ports (22/tcp, 40100/tcp) restricted to your own network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Overte by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size (Standard_B2s recommended); under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22). After deployment, add inbound rules for 40102/udp (visitors) and 40100/tcp (restricted to your management network).

Step 2 - Deploy from the Azure CLI

Alternatively, deploy the same image from the Azure CLI. Replace the resource group, location and SSH key path to suit your environment.

az group create --name overte-rg --location eastus

az vm create \
  --resource-group overte-rg \
  --name overte-domain \
  --image <cloudimg-overte-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard

# Visitors connect over UDP 40102; keep the admin ports to your own network.
az vm open-port --resource-group overte-rg --name overte-domain --port 40102 --priority 1001

Step 3 - Confirm the world server is running

SSH in as azureuser and confirm the domain server and its assignment-clients are active. The overte-server@default.target controls the overte-domain-server@default.service and overte-assignment-client@default.service.

systemctl is-active overte-server@default.target \
  overte-domain-server@default.service \
  overte-assignment-client@default.service

Expected output — all three report active:

active
active
active

Confirm the settings console is listening on TCP 40100 and the client connection port on UDP 40102:

sudo ss -ltnp | grep :40100
sudo ss -lunp | grep :40102

Step 4 - Read your per-VM administrator credentials

Upstream ships the domain settings console with no authentication, so anyone who can reach it could take over the world. This image is different: on first boot it generates a unique administrator username and password, stores only a SHA256 hash of the password in the domain settings, and writes the credentials to a root-only file.

sudo cat /root/overte-credentials.txt

Expected output (your password will differ — it is unique to this VM):

OVERTE_ADMIN_USERNAME=admin
OVERTE_ADMIN_PASSWORD=<OVERTE_ADMIN_PASSWORD>
OVERTE_DOMAIN_URL=<OVERTE_DOMAIN_URL>
OVERTE_SETTINGS_URL=<OVERTE_SETTINGS_URL>
OVERTE_CONNECT_ADDRESS=<vm-ip>:40102

The domain settings console rejects unauthenticated and wrong-password requests, and accepts only the per-VM administrator credentials:

PASS='<OVERTE_ADMIN_PASSWORD>'
curl -s -o /dev/null -w "no credentials      -> HTTP %{http_code}\n" http://127.0.0.1:40100/settings/
curl -s -o /dev/null -w "wrong password      -> HTTP %{http_code}\n" -u admin:wrong http://127.0.0.1:40100/settings/
curl -s -o /dev/null -w "per-VM credentials  -> HTTP %{http_code}\n" -u "admin:$PASS" http://127.0.0.1:40100/settings/

Expected output:

no credentials      -> HTTP 401
wrong password      -> HTTP 401
per-VM credentials  -> HTTP 200

Step 5 - Open the settings console

Browse to the settings console at http://<vm-ip>:40100/ from your management network. Your browser will prompt for the username and password from the credentials file. Once signed in, the Nodes page shows the running world server with all six assignment-clients connected — the audio and avatar mixers, the entity and asset servers, the entity-script server and the messages mixer.

The Settings page is where you configure networking, directory services, security and the world's behaviour. This is also where you can change the administrator username and password later.

The Content page manages the objects installed in your world and the automatic content archives (backups) the domain keeps.

The Assignment page lets you run assignment-client scripts inside your world for custom server-side behaviour.

Step 6 - Confirm the world is live and connect a client

From the settings console (or the command line) you can confirm every assignment-client has registered with the domain. Query the node list with your administrator credentials:

PASS='<OVERTE_ADMIN_PASSWORD>'
NODES=$(curl -s -u "admin:$PASS" http://127.0.0.1:40100/nodes.json)
echo "$NODES" | jq -r '.nodes[].type' 2>/dev/null | sort || true

Expected output — all six assignment-clients connected:

asset-server
audio-mixer
avatar-mixer
entity-script-server
entity-server
messages-mixer

To visit your world, install the Overte client on your desktop, then in the client's address bar enter your domain's connection address:

<vm-ip>:40102

The client connects to the domain over 40102/udp and you will arrive in your world, where other people who connect to the same address can meet you.

Step 7 - Day-two administration

Restart the whole world server (this brings the domain-server and assignment-clients down and up together):

sudo systemctl restart overte-server@default.target

Follow the domain-server log:

sudo journalctl -u overte-domain-server@default.service -f

The domain's configuration and content live under /var/lib/overte/default, owned by the overte user. To change the administrator credentials, edit the Security section of the settings console.

Secure by default

• No default administrator ships in the image. Upstream serves the settings console with no authentication; this image generates a unique administrator username and password on first boot and stores only a SHA256 hash of the password in the domain settings.
• The console never opens unprotected. The domain-server and assignment-clients are held from starting on first boot until the credential has been generated and seeded, so there is no window in which the console is reachable without a password.
• The credential is unique per VM, written to /root/overte-credentials.txt (mode 0600, root only), so no two deployments share a secret.
• Only the client connection port needs to face the public. Keep 22/tcp and 40100/tcp restricted to your management network.

Source and licence

Overte is free and open source software licensed under the Apache License 2.0. The domain server is installed from the official upstream packages published at public.overte.org; the corresponding source is available from the Overte project on GitHub (release 2026.04.1). The Apache-2.0 licence text is included on the image at /opt/overte/LICENSE.