Rill Data on Ubuntu 24.04 on Azure User Guide

Overview

Rill Data is an open-source operational business-intelligence tool that builds fast, interactive dashboards directly from your data using an embedded DuckDB engine. You define a project as a few YAML and SQL files — a source, a metrics view (the semantic layer) and an Explore dashboard — and Rill compiles them into a live, sub-second dashboard you slice and dice in the browser. The cloudimg image installs Rill 0.87.4 as the single rill binary at /usr/local/bin/rill, runs it as a dedicated rill system user against a ready-made sample analytics project so the UI shows real dashboards on first login, binds the listener to loopback behind an nginx reverse proxy on TCP 80 with HTTP Basic auth, persists the project and DuckDB data on a dedicated Azure data disk, and generates a unique web password on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• Rill Data 0.87.4 at /usr/local/bin/rill
• A ready-made sample Rill project (a CSV source, an Orders metrics view and an Orders Explore dashboard) at /var/lib/rill/sample
• The Rill web UI fronted by nginx on :80
• nginx HTTP Basic auth (Rill's local UI has no built-in authentication) with a per-VM password in a root-only file
• A dedicated Azure data disk at /var/lib/rill holding the project and the embedded DuckDB data — separate from the OS disk and re-provisioned with every VM
• A loopback firewall guard so the Rill runtime port 9009 is only reachable from localhost
• rill.service + nginx.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting point; scale up for larger datasets and more concurrent users. NSG inbound: allow 22/tcp from your management network and 80/tcp for the web UI (front with TLS for public exposure — see Enabling HTTPS).

Step 1 — Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Rill Data by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create -> Create.

Step 2 — Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name rill \
  --image <marketplace-image-urn> \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name rill --port 80 --priority 1010

Step 3 — Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 — Confirm the services are running

systemctl is-active rill.service nginx.service

Both services report active. Rill compiles the sample project at startup and serves it within a few seconds.

Step 5 — Retrieve your web password

The admin password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/rill-credentials.txt

This file contains RILL_ADMIN_USER (admin) and RILL_ADMIN_PASSWORD, plus the URL for the web UI. Store the password somewhere safe.

Step 6 — Check the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/health

It returns ok.

Step 7 — Open the Rill web UI

Browse to http://<vm-public-ip>/ and sign in as admin with the password from Step 5. Rill opens on the project home, listing the sample dashboards and resources compiled from /var/lib/rill/sample.

Open the Orders Explore dashboard to see the embedded-DuckDB engine in action — time-series of revenue, headline metric cards and dimension breakdowns, all interactive and sub-second:

The project's metrics view is the semantic layer — it declares the dimensions and measures the dashboard exposes. Open it from the file browser to see how Rill maps SQL expressions to dashboard metrics:

Back in the Explore dashboard, click a dimension (Region or Category) to slice every chart and metric by that value — Rill recomputes the whole dashboard against DuckDB instantly:

Step 8 — Inspect the sample project

The project is a small set of plain-text files on the data disk that you can read and copy as a template for your own:

ls -R /var/lib/rill/sample

You will see rill.yaml, a data/orders.csv source file, sources/orders.yaml (the CSV ingest), metrics/orders_metrics.yaml (the semantic layer) and dashboards/orders_explore.yaml (the Explore dashboard).

Step 9 — Look at the metrics view

The metrics view declares the time dimension, the dimensions you can slice by, and the measures Rill aggregates:

cat /var/lib/rill/sample/metrics/orders_metrics.yaml

Each measure is a SQL expression (for example SUM(revenue) for total revenue). Add a measure or dimension to this file and Rill hot-reloads the dashboard.

Step 10 — Build your own project

Rill is project-driven: drop a CSV, Parquet or JSON file into a project's data/ directory, point a source at it, declare a metrics view over it and add an Explore dashboard. The sample project is a working template you can copy:

sudo cp -r /var/lib/rill/sample /var/lib/rill/myproject
sudo chown -R rill:rill /var/lib/rill/myproject

Then edit /etc/default/rill to point RILL_ARGS at /var/lib/rill/myproject and sudo systemctl restart rill. Rill recompiles the new project and serves it behind the same auth wall.

Step 11 — Confirm data lives on the dedicated disk

The project and the embedded DuckDB data are stored on the dedicated Azure data disk so they survive OS changes and can be resized independently:

findmnt /var/lib/rill

The mount is backed by a separate Azure data disk captured into the image and re-provisioned on every VM.

Enabling HTTPS

The nginx reverse proxy terminates plain HTTP on port 80. For public exposure, put a certificate in front of it. The simplest path is to add a DNS name for the VM and use the companion cloudimg nginx-ssl-certbot image as a TLS reverse proxy, or install certbot and extend the existing nginx site with a listen 443 ssl; server block and your certificate paths. Keep Rill itself bound to loopback so the only public surface is the authenticated, TLS-terminated proxy.

Maintenance

• Configuration: the project path and listener flags are set in /etc/default/rill (the RILL_ARGS line). Edit it and sudo systemctl restart rill to apply changes.
• Backups: snapshot the /var/lib/rill data disk, or copy your project directory (it is plain text plus data files) to Azure Blob Storage.
• Upgrades: replace /usr/local/bin/rill with a newer release and restart the service.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.

Rill is a trademark of Rill Data, Inc. This image is produced by cloudimg and is not affiliated with or endorsed by the Rill Data project. Rill Data is distributed under the Apache License 2.0.