Rybbit Analytics on Ubuntu 24.04 on Azure User Guide

Overview

This image runs Rybbit 2.7.0, an open source, privacy friendly web and product analytics platform, on Ubuntu 24.04 LTS. Rybbit is a self hostable alternative to Google Analytics and Plausible: a single lightweight script on your pages tracks page visits, unique visitors, referrers, countries, devices and real time users, and you can send your own custom events with structured properties. Because it is cookie free it tracks visitors without cookie banners.

Rybbit self hosts as a Docker Compose stack, managed by systemd. The stack is a Next.js dashboard (the client), a Fastify API (the backend, which handles event ingestion, statistics and authentication), backed by ClickHouse for events and PostgreSQL for accounts, organizations and sites, with Redis for sessions and queues. A host nginx serves the dashboard over HTTPS on port 443 and keeps a health endpoint and the event ingestion path on port 80. The datastores stay on the internal Compose network and are never exposed.

What is included:

• Rybbit 2.7.0 self host stack pinned by exact image digest, run under Docker Compose via a rybbit.service systemd unit
• The dashboard served over HTTPS on :443 with a per-VM self signed certificate generated on first boot
• A single administrator account whose password is generated on first boot and recorded in a root only file, with public sign up disabled afterwards
• Every secret (PostgreSQL, ClickHouse and Redis passwords and the BETTER_AUTH_SECRET) generated fresh per-VM on first boot, so no upstream example secret survives into the image
• The database bound to the instance only (the upstream compose publishes PostgreSQL to the network; this image does not), and product telemetry turned off
• An unauthenticated /healthz endpoint on port 80 for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

• An Azure subscription and the Azure CLI (or use the Azure Portal)
• An SSH key pair
• Inbound TCP 443 (dashboard), TCP 80 (HTTPS redirect and event ingestion) and TCP 22 (SSH) open to the addresses you will use

Step 1 - Deploy from the Azure Marketplace

Find Rybbit Analytics on Ubuntu 24.04 LTS by cloudimg in the Azure Marketplace, click Create, choose a Standard_B2s (or larger) size, provide your SSH public key, and allow inbound ports 443, 80 and 22. Create the VM and note its public IP address.

Step 2 - Deploy from the Azure CLI

Alternatively, launch from the CLI. Accept the image terms once per subscription, open the ports, and create the VM:

az vm image terms accept --urn cloudimg:rybbit-ubuntu-24-04:rybbit-ubuntu-24-04:latest

az network nsg rule create --resource-group myResourceGroup --nsg-name myNsg \
  --name allow-rybbit --priority 1010 \
  --destination-port-ranges 443 80 22 --access Allow --protocol Tcp --direction Inbound

az vm create \
  --resource-group myResourceGroup \
  --name rybbit-vm \
  --image cloudimg:rybbit-ubuntu-24-04:rybbit-ubuntu-24-04:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<public-ip>

The first boot initialises the stack: it generates every secret and the admin password, creates the administrator account, and generates a self signed TLS certificate for this VM. This takes two to three minutes on first boot.

Step 4 - Confirm the services are running

Check the systemd units and the Docker Compose stack:

sudo systemctl is-active docker nginx rybbit rybbit-firstboot
sudo docker compose -f /opt/rybbit/docker-compose.yml ps --format 'table {{.Service}}\t{{.Status}}'

Every service should report active and each container Up.

Step 5 - Retrieve your admin password

The administrator password is generated on first boot and written to a root only file:

sudo cat /root/rybbit-credentials.txt

Note the RYBBIT_ADMIN_EMAIL and RYBBIT_ADMIN_PASSWORD and the console URL.

Step 6 - Confirm the health endpoint and versions

curl -sI http://127.0.0.1/healthz | head -1
curl -s -o /dev/null -w 'backend  HTTP %{http_code}\n' http://127.0.0.1:3001/api/health
curl -sk -o /dev/null -w 'dashboard  HTTP %{http_code}\n' https://127.0.0.1/
sudo docker exec rybbit-clickhouse clickhouse-server --version | head -1
sudo docker exec rybbit-postgres postgres --version

The health probe returns 200, the backend and dashboard both answer, and the datastore versions print.

Step 7 - Review the security posture

The image is secure by default: public sign up is disabled after the admin is seeded, telemetry is off, the datastores are not exposed to the network, and the dashboard has a per-VM TLS certificate.

grep -E '^DISABLE_SIGNUP|^DISABLE_TELEMETRY' /opt/rybbit/.env
sudo ss -tlnp | grep -E ':(5432|8123|6379) ' || echo 'ClickHouse, PostgreSQL and Redis are NOT exposed to the host'
sudo openssl x509 -noout -subject -ext subjectAltName -in /etc/nginx/ssl/rybbit.crt | head -3

Step 8 - Sign in to the dashboard

Browse to https://<public-ip>/ and sign in with the admin email and password from Step 5.

Because the dashboard uses a self signed certificate, your browser shows a one-time "not secure" warning the first time. Click Advanced then Proceed to continue. (For production, see Step 13.)

Step 9 - Your dashboard

After signing in you land on your organization's site list. Public sign up is disabled, so only your administrator account exists.

Step 10 - Add your first site

Click Add Site, enter your website's domain and a name, and save. Rybbit assigns the site a numeric site ID and shows a tracking snippet. Add the snippet to the <head> of every page you want to track:

<script
  src="https://<public-ip>/api/script.js"
  data-site-id="YOUR_SITE_ID"
  async
></script>

Server side and API tracking send events to POST /api/track with a site_id; a real browser's headers (Accept-Language, Accept, sec-fetch-*) are what distinguish genuine visits from bots, which Rybbit records in a separate bots view.

Step 11 - View your analytics

Open your site from the dashboard to see live analytics: unique users, sessions, pageviews, bounce rate and session duration across the top, a time series chart, and breakdowns of referrers, pages, countries and devices. Data appears within seconds of an event arriving.

Step 12 - Organization settings and API keys

Under Settings -> Organization you can rename the organization, manage members, and create API keys for the Stats API (to read your analytics programmatically) and for server side event tracking.

Step 13 - Production: assign a domain and a trusted certificate

The self signed certificate lets you sign in immediately, but browsers will not load the tracking script from a self signed origin on your production sites. For production:

1. Point a DNS name (for example analytics.example.com) at this VM's public IP.
2. Install a trusted certificate (for example with Let's Encrypt) and set BASE_URL=https://analytics.example.com in /opt/rybbit/.env, then run sudo docker compose -f /opt/rybbit/docker-compose.yml up -d to apply it.

Your tracking snippet then references your domain and loads cleanly on any HTTPS site.

Maintenance

• Manage the stack: sudo systemctl restart rybbit restarts the whole stack; sudo docker compose -f /opt/rybbit/docker-compose.yml logs -f backend tails the API logs.
• Data: analytics events live in ClickHouse and accounts, organizations and sites live in PostgreSQL, both on Docker named volumes on the OS disk.
• Security updates: unattended security upgrades for the base OS are enabled.

Support

This image is maintained by cloudimg with 24/7 support. If you need help, contact us at cloudimg.co.uk.