Razzia on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of Razzia on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Razzia is an open source, self-hosted live multiplayer quiz game — the kind of buzzer quiz where a host puts questions on the big screen and everyone in the room plays along from their phone. The host builds a quiz of multiple-choice questions, starts a game that generates a short room code, and players join from any phone, answer as fast as they can, and climb a live leaderboard between rounds.

All of the real-time gameplay — players joining, questions advancing, answers registering and the leaderboard updating — is delivered over WebSockets (socket.io), so it feels instant. Because the platform is self-hosted, your quizzes and game results stay on infrastructure you control, and a ready-to-run example quiz is included so you can start a game the moment the VM boots.

The cloudimg image ships the free and open source, MIT licensed Razzia release, run the officially supported way as the upstream container pinned by image digest. The image is captured into the VM, so your instance starts in seconds with nothing to download. Razzia is fronted by nginx with self-signed TLS on port 443 (port 80 redirects), configured to proxy the socket.io WebSocket upgrades the live game depends on, while the game app itself binds only to the loopback interface. The host/manager password is generated on the first boot of every VM and the upstream default password is never used. Backed by 24/7 cloudimg support.

Razzia is a trademark of its respective owner. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by the Razzia project or Ralex. It ships the free and open source MIT licensed software, unmodified.

What is included:

• Razzia 3.1.0 — the official upstream release container ghcr.io/ralex91/razzia:3.1.0, pinned by image digest, with the compiled front end and the socket.io real-time server built in
• nginx — the single public listener, terminating self-signed TLS on port 443 (port 80 redirects), configured for the socket.io WebSocket upgrades the live game relies on
• First-boot secret generation — a unique host/manager password generated per VM, replacing the upstream published default
• A ready-to-run example quiz — a starter quiz is present on first boot so you can start a game immediately
• A bundled self test — authenticates as the per-VM host manager over the real socket, proves the upstream default and a wrong password are refused, and confirms the WebSocket upgrades

Prerequisites

• An Azure subscription with permission to create virtual machines
• An SSH key pair for administrative access
• A network security group allowing inbound TCP 22 (SSH) and TCP 443 (HTTPS web UI), and TCP 80 (which redirects to 443), from your own address ranges
• Standard_B2s (2 vCPU, 4 GB RAM) or larger. Razzia is very light and runs comfortably on Standard_B2s; for very large audiences choose a larger size.

Step 1: Deploy from the Azure Portal

1. Open the Azure Marketplace and search for Razzia on Ubuntu 24.04 LTS by cloudimg.
2. Select Create, then choose your subscription, resource group and region.
3. Pick a VM size of Standard_B2s or larger.
4. Under Administrator account, select SSH public key and supply your public key.
5. Under Inbound port rules, allow SSH (22), HTTPS (443) and HTTP (80).
6. Select Review + create, then Create.

Step 2: Deploy from the Azure CLI

az group create --name razzia-rg --location eastus

az vm create \
  --resource-group razzia-rg \
  --name razzia-vm \
  --image cloudimg:razzia:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

az vm open-port --resource-group razzia-rg --name razzia-vm --port 443 --priority 1010
az vm open-port --resource-group razzia-rg --name razzia-vm --port 80 --priority 1011

Step 3: Connect to your VM

ssh azureuser@<vm-ip>

Step 4: Confirm the services are running

Five units make up the deployment: docker, razzia-firstboot (which generates this VM's host password), razzia (the game container), razzia-postboot (which proves the security model and writes the credentials) and nginx.

systemctl is-active docker razzia-firstboot razzia razzia-postboot nginx

All five report active. The game container should be up:

sudo docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'

NAMES     STATUS          PORTS
razzia    Up 12 minutes   127.0.0.1:3000->3000/tcp

Step 5: Confirm the network exposure

Razzia is deliberately not reachable directly. Only nginx listens publicly, and it terminates TLS:

ss -tlnH | grep -E ':(80|443|3000) ' | sort

You will see 127.0.0.1:3000 for the game app and 0.0.0.0:443 / 0.0.0.0:80 for nginx. The 3000 entry is bound to 127.0.0.1 only, so the app itself is not reachable off the machine — every visitor goes through nginx.

LISTEN 0  4096  127.0.0.1:3000 0.0.0.0:*
LISTEN 0  511         0.0.0.0:80 0.0.0.0:*
LISTEN 0  511        0.0.0.0:443 0.0.0.0:*

Step 6: Read the per instance credentials

Every VM generates its own host/manager password on first boot. It is written to a file only root can read:

sudo cat /root/razzia-credentials.txt

The file records the MANAGER_PASSWORD for the host to sign in to the manager area, and this VM's URL. Confirm the file is locked down:

sudo stat -c '%a %U:%G  %n' /root/razzia-credentials.txt

600 root:root  /root/razzia-credentials.txt

Step 7: Understand the security model

Razzia protects its host/manager area with a password, and this image is careful about how that password is seeded.

• No shipped default. Upstream ships a literal default host password ("PASSWORD"), and while it is left as the default the manager login is blocked entirely. This image never ships that default: it generates a fresh, random host/manager password on first boot and writes it into the game configuration before the game container is allowed to start, so the game never comes up on the published default.
• Player join is open, quiz authoring is not. Your players join a running game with a room code and need no account, which is the whole point of the game. Only the host/manager area — where quizzes are built and games are controlled — is gated, by the per-VM manager password.
• Only nginx is public. The game app binds to 127.0.0.1:3000 and nginx is the single public listener, terminating self-signed TLS on port 443 (port 80 redirects) and configured for the socket.io WebSocket upgrades the live game needs.

The image ships a self test that proves the whole model, not merely that a page loads. It drives a real socket.io manager authentication: the per-VM manager password authenticates, the upstream default "PASSWORD" and a wrong password are both refused, and the WebSocket transport upgrades through nginx (a 101 response):

sudo /usr/local/sbin/razzia-roundtrip.sh

You can also confirm directly that the shipped configuration does not carry the upstream default password:

sudo grep -q '"managerPassword": *"PASSWORD"' /var/lib/razzia/config/game.json && echo DEFAULT || echo 'NON_DEFAULT (a unique per-VM host password is set)'

Step 8: Sign in as the host

Because nginx uses a self-signed certificate out of the box, your browser will show a certificate warning the first time — that is expected; proceed to the site (and see Step 14 to install your own certificate for production).

Browse to your VM's address (the RAZZIA_URL from your credentials file) and add /manager — for example https://<vm-ip>/manager. Enter the MANAGER_PASSWORD value from /root/razzia-credentials.txt and select Submit.

Step 9: The host dashboard

After signing in you land on the Configurations dashboard with Play, Quizz and Results tabs. The Play tab lists your quizzes — including the shipped Example Quizz — and a Start game button. The Quizz tab is where you build and edit your own quizzes; the Results tab shows reports from finished games.

Step 10: Start a game

On the Play tab, select a quiz (the Example Quizz is ready to go), then select Start game. Razzia opens the host game view and generates a short Game PIN — the room code — shown large on screen along with a QR code and the join URL. This is the screen you put on the big display in the room.

Step 11: Players join and play from their phones

Your players open your VM's address on their phones (or scan the QR code), enter the Game PIN, choose a username, and land in the lobby. When everyone is in, the host selects Start Game and the first question begins. Each player sees the question and its colour-coded answer options on their phone and taps their answer before the timer runs out; faster correct answers score more, and a leaderboard is shown between questions.

Step 12: Build your own quizzes

Switch to the Quizz tab in the host dashboard to create your own quiz. Add questions, provide the answer options and mark the correct one(s), and set a time limit and points per question. Your quizzes are saved on the VM and appear on the Play tab, ready to run. When a game finishes, its report is available under the Results tab.

Step 13: Managing the service

sudo systemctl status razzia --no-pager

sudo docker logs razzia --tail 50

Restart or stop the game with sudo systemctl restart razzia and sudo systemctl stop razzia.

Step 14: Use your own certificate and domain (production)

The image ships a self-signed TLS certificate so the site works over HTTPS the moment the VM boots, which is why browsers show a warning. For production, point a DNS name at the VM and install your own certificate — for example replace /etc/ssl/razzia/razzia.crt and /etc/ssl/razzia/razzia.key with your certificate and private key (or obtain one automatically with a tool such as Certbot), then reload nginx:

sudo systemctl reload nginx

Step 15: Change the host/manager password

To change the host/manager password, edit the managerPassword value in /var/lib/razzia/config/game.json and restart the game:

sudo systemctl restart razzia

Step 16: Security recommendations

• Restrict inbound ports 443 and 80 to the networks that genuinely need them
• Replace the self-signed certificate with your own before using the game with real audiences, so neither the manager login nor gameplay travels behind an untrusted certificate
• Keep /root/razzia-credentials.txt at mode 0600 and never copy it onto a shared system
• Change the host/manager password from the shipped per-VM value if you share console access, and keep it private
• Back up /var/lib/razzia/config, which holds your quizzes and game results

Step 17: Support and Licensing

Razzia is open source software distributed under the MIT License. This image also carries Node.js and the bundled socket.io real-time stack under the MIT License, nginx under the BSD 2-Clause Licence, and Docker Engine under Apache 2.0. All are redistributed unmodified.

Commercial support for the cloudimg image is available 24/7. Upstream project documentation lives at github.com/Ralex91/Razzia.

Deploy on Azure

Find Razzia on Ubuntu 24.04 LTS by cloudimg on the Azure Marketplace.