rConfig on Ubuntu 24.04 on Azure User Guide

Overview

rConfig v8 Core is a free, open source Network Configuration Management (NCM) tool that connects to your routers, switches and firewalls, backs up their running and startup configurations on a schedule, and keeps a full version history so you can see exactly what changed and when with side by side and inline diffs. It supports multiple vendors out of the box — Cisco, Juniper, HP, Dell, Fortinet and more — with unlimited devices, categories, tags and reusable command templates, an upgraded multi-term configuration search, and a token-authenticated REST API (v1 and v2) for scripting and integration. The cloudimg image delivers rConfig v8 Core 8.2.12 fully installed and configured on Ubuntu 24.04, so a complete configuration-management service is running within minutes of launch.

rConfig v8 Core is licensed under the GNU General Public License v3.0 (GPL-3.0). This image installs only the free, open Core edition — never the paid rConfig Professional tier — and requires no licence key or subscription of any kind. All product and company names are trademarks or registered trademarks of their respective holders. This image repackages the upstream open source release with cloudimg's provisioning and support.

What is included:

• rConfig v8 Core 8.2.12 (GPL-3.0), served from /var/www/html/rconfig
• PHP 8.4 (php8.4-fpm) from the ondrej/php PPA + nginx, with the web UI on port 80
• A dedicated MariaDB database, Redis for cache/session/queue, and Supervisor running the Horizon queue worker (scheduled device backups run through it)
• A per-VM administrator password, a fresh application encryption key and a fresh database password, all generated on first boot and written to a root-only file, so no default or shared login ships in the image
• nginx.service, php8.4-fpm.service, mariadb.service, redis-server.service and supervisor.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. NSG inbound: allow 22/tcp from your management network and 80/tcp (HTTP) from your users. Add 443/tcp if you enable HTTPS.

Step 1 — Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for rConfig by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create and Create.

Step 2 — Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name rconfig \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open HTTP to reach the web UI:

az vm open-port --resource-group <your-rg> --name rconfig --port 80 --priority 900

Step 3 — Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 — Confirm the application stack is running

Five services back rConfig, and the Horizon queue worker (which runs scheduled device backups) reports RUNNING under Supervisor:

systemctl is-active nginx php8.4-fpm mariadb redis-server supervisor
sudo supervisorctl status rconfig-horizon
curl -s -o /dev/null -w 'GET /api/auth/providers -> %{http_code}\n' http://127.0.0.1/api/auth/providers

Expected: five lines of active, RUNNING for rconfig-horizon, then GET /api/auth/providers -> 200.

Step 5 — Retrieve your administrator password

On the first boot of every VM, a one-shot service (rconfig-firstboot.service) generates credentials that are unique to that VM: a fresh MariaDB password, a fresh Laravel application encryption key, and a fresh administrator password. The web service (nginx) does not even start until this has completed, so there is never a window where a default or shared credential is reachable.

sudo cat /root/rconfig-credentials.txt

The file (mode 0600, root only) contains the sign-in URL, the administrator email (rconfig.admin.user, which is admin@domain.com) and the administrator password (rconfig.admin.pass).

You can prove the credential + core-function round trip from the VM's own shell — it confirms the upstream default admin@domain.com / admin is rejected, a wrong password is rejected, your real per-VM credential signs in, the authenticated dashboard is reachable, and a real write against the REST API (creating a vendor) reaches the database:

sudo /usr/local/sbin/rconfig-roundtrip.sh

Expected: six numbered checks, each ending (rejected, good), (accepted, good), HTTP 200 or (created), followed by a final OK.

Step 6 — Sign in and explore the dashboard

Browse to http://<vm-public-ip>/ and sign in with the administrator email and password from the credentials file.

The dashboard shows your device count, down devices, stored configuration files and system health, all computed live from the database.

Step 7 — Add your first device and schedule a backup

Open Inventory → Devices and select New Device to register a router, switch or firewall (hostname/IP, vendor, device model, credential set and command template). rConfig connects out to the device on its own schedule to pull the running/startup configuration, version it, and flag any change with a side-by-side diff.

Vendors, categories, tags and command templates are all managed the same way. The screenshot below shows the Vendors list — including cloudimg-smoke-*, the row this build's automated round-trip check creates via the REST API to prove authenticated writes reach the database end-to-end (deleted before the image ships).

Step 8 — Confirm the version and OS patch baseline

cat /var/www/html/rconfig/VERSION
php -v | head -1

Expected: 8.2.12, then PHP 8.4.

First-boot service and security model

A one-shot rconfig-firstboot.service runs after the network is up and before nginx is allowed to start (the systemd unit is Before=nginx.service, so nginx literally cannot start until firstboot completes). It rotates the MariaDB rconfig_user password, regenerates the Laravel APP_KEY, pins the application URL to the VM's own address (resolved from the Azure instance metadata service), rotates the administrator password to a fresh per-VM value via a direct database update, writes the credentials file at mode 0600 (root only), starts the Horizon queue worker, and drops a sentinel so it runs exactly once. The image ships with the upstream default admin password already rotated to an unrecorded, discarded value at build time — the per-VM administrator credential is created only on first boot.

systemctl is-active rconfig-firstboot.service
sudo stat -c '%a %U:%G %n' /root/rconfig-credentials.txt

Expected: active, then 600 root:root /root/rconfig-credentials.txt.

Enabling HTTPS with your own domain

The image serves the web UI over plain HTTP on port 80. For a browser-trusted certificate, point a DNS record at the VM, open port 443 in the NSG, and install a certificate from your CA (for example Let's Encrypt):

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot updates the nginx site to serve your domain certificate. Then set APP_URL=https://your-domain.example.com in /var/www/html/rconfig/.env and run sudo -u www-data php /var/www/html/rconfig/artisan config:cache so generated links use your domain.

Backup and maintenance

The rConfig application, its MariaDB database and Redis all live on the OS disk. Back up the MariaDB database and the application tree together:

sudo mariadb-dump rconfig | gzip > /var/backups/rconfig-db-$(date +%F).sql.gz
sudo tar -C /var/www/html -czf /var/backups/rconfig-app-$(date +%F).tar.gz rconfig

Or snapshot the whole OS disk from the Azure portal for a full point-in-time copy. Keep the OS current with sudo apt-get update && sudo apt-get upgrade; the image ships with unattended security updates enabled. Review the rConfig documentation before moving between major versions, and always back up before an upgrade.

Support

This image is backed by 24/7 cloudimg support for deployment and initial configuration, retrieving first-boot administrator credentials, adding devices and credential sets, scheduling backups, REST API integration, HTTPS and custom domain setup, application upgrades and patch management, performance tuning and troubleshooting. Email support@cloudimg.co.uk or use the live chat in the support portal; critical issues receive a one-hour average response.