Applications Azure

Scoold on Ubuntu 24.04 on Azure User Guide

| Product: Scoold on Ubuntu 24.04 LTS on Azure

Overview

Scoold is an open source questions and answers knowledge base for teams and communities. It gives your organisation a private Stack Exchange style place to ask questions, post answers, vote on the best ones, accept solutions and build a searchable library of shared knowledge that grows with your team. Members earn reputation as they contribute, tags keep topics organised, and a full moderation and permission system keeps the content healthy.

Scoold is a Spring Boot application that always needs a companion backend called Para for storage, search and identity. The cloudimg image ships both, wired together and ready on the first boot of every VM: Scoold 1.69.3 and Para 1.54.7 (both Apache 2.0) run as systemd services on a hardened, fully patched Ubuntu 24.04 LTS base. Para runs in its fully embedded mode with an H2 database for storage, a Lucene index for search and an in memory cache, so there is no external database to run and nothing else to install. An nginx reverse proxy serves the site on port 80. Scoold and Para both listen only on the loopback interface, so neither is exposed to the network. A unique administrator login and fresh backend secrets are generated on the first boot of every VM, and no default credential ships in the image. Backed by 24/7 cloudimg support.

What is included:

  • Scoold 1.69.3 served on port 80 through nginx, managed by systemd
  • Para 1.54.7 as the bundled backend, running fully embedded with H2 storage, Lucene search and an in memory cache, no external database
  • A per VM administrator login generated on first boot and recorded in a root only file
  • No shipped default login: the admin and all backend secrets are unique per VM, and no known or blank credential authenticates
  • Scoold and Para bound to 127.0.0.1 only, never exposed to the network; only nginx listens publicly on port 80
  • Java heaps tuned to fit a 4 GiB VM (Para 512 MiB, Scoold 640 MiB)
  • para.service, scoold.service, nginx.service and scoold-firstboot.service as systemd units
  • An unauthenticated /healthz endpoint for Azure Load Balancer health probes
  • 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is the recommended size and is what the image is tuned for; size up for larger or busier teams. NSG inbound: allow 22/tcp from your management network and 80/tcp for the site. Scoold serves plain HTTP on port 80; for production, put your own domain and TLS in front of it. The bundled Para backend is never exposed: it listens on 127.0.0.1:8080 only, and Scoold listens on 127.0.0.1:8000 only, so neither port is reachable from the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Scoold by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create and Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name scoold \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the site:

az vm open-port --resource-group <your-rg> --name scoold --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that Para, Scoold and nginx are all active. The scoold-firstboot unit is a one shot that runs once on the first boot to generate the per VM secrets and administrator, then stays satisfied. Note that Para and Scoold listen only on the loopback interface, while nginx serves the site on port 80.

systemctl is-active para scoold nginx scoold-firstboot

active
active
active
active

ss -tlnp | grep -E ':80 |:8000 |:8080 '

The listing confirms nginx on 0.0.0.0:80 (public) with Para on 127.0.0.1:8080 and Scoold on 127.0.0.1:8000 bound to the loopback interface only.

The para, scoold, nginx and scoold-firstboot services all active, and the listening ports showing nginx public on port 80 while Scoold and Para stay bound to the 127.0.0.1 loopback interface

Step 4 - Retrieve the administrator login

A unique administrator email and password are generated on the first boot of every VM and written to a root only file. Read it with sudo:

sudo cat /root/scoold-credentials.txt

SCOOLD_URL=http://<your-vm-ip>/
SCOOLD_ADMIN_EMAIL=admin@scoold.local
SCOOLD_ADMIN_PASSWORD=<generated-on-first-boot>

The password shown below is masked. On your VM the file holds the real per VM value. This account is a full administrator, and Scoold ships no other login.

The per VM Scoold credentials file, showing the site URL, the administrator email admin@scoold.local and the generated password (masked here), with guidance on signing in and using your own domain

Step 5 - Sign in and explore the questions feed

Open http://<your-vm-ip>/ in a browser. Click Sign in, choose the email and password option, and enter the administrator email and password from Step 4. The home page is the questions feed: a searchable, sortable list of every question, with filters for newest, most voted, recently updated, answered and unanswered, and a tags sidebar. New questions are asked from the Ask Question button in the top navigation.

The Scoold questions feed showing a question with its title and body preview, the vote, answer and view counts, the Newest, Votes, Updated, Answered and Unanswered filters, and the top navigation with Questions, Users, Tags and Ask Question

Step 6 - Ask and answer questions

Choose Ask Question to open the compose form. Give the question a clear title, write the details in the Markdown editor (with a toolbar for formatting, code, lists, links, images and tables), pick a space, and add tags so the question is easy to find. Publish it, and teammates can post answers, comment, and vote. The asker marks the best response as the accepted answer.

The Scoold Ask Question form showing the space selector, the title field and the Markdown editor with its formatting toolbar for bold, italic, headings, code, quotes, lists, links, images, tables and emoji

Each question has its own page showing the full question, its votes and views, the answers, and the actions available to you such as edit, comment, close and share. This is where your team captures the detail behind an answer so it is never lost.

A Scoold question detail page showing the question title and body, the vote controls, the author and posted time, the action bar with edit, comment, close and deprecate, and the write your answer button

Step 7 - Administer Scoold

Open the Administration area from the menu under your avatar. From here an administrator manages spaces (isolated areas of questions for different teams), webhooks, backup and restore, themes, API keys and the full site configuration, and can review the environment and system information.

The Scoold Administration page showing the Spaces, Webhooks, Backup and Restore, Themes, API Keys and Configuration tabs, the create new space panel, and the environment and system information sections

Step 8 - Confirm the no default credential security model

The image ships with no known login. The administrator and every backend secret (the Para root secret, the app secret used to sign sessions, and the child app credentials Scoold creates for itself) are generated uniquely on the first boot of each VM, and the credentials file is 0600 root:root. A round trip check proves the per VM administrator authenticates while a blank password and common weak guesses are rejected:

sudo bash /usr/local/sbin/scoold-cred-roundtrip.sh

OK per-VM admin authenticates via /signin; blank + weak guesses rejected

A sign in attempt with the wrong password is refused and redirected back to the sign in page with an error, never granted a session:

The credential round trip confirming the per VM administrator authenticates while blank and weak guesses are rejected, and a wrong password sign in being refused with an error redirect

Step 9 - Architecture and where your data lives

nginx on port 80 reverse proxies to Scoold on 127.0.0.1:8000, which talks to Para on 127.0.0.1:8080. Para stores everything in an embedded H2 database on disk and indexes it with Lucene, so there is no external database to manage. The /healthz endpoint returns 200 for load balancer probes.

curl -sI http://127.0.0.1/healthz | head -1
du -sh /opt/para/data; ls /opt/para/data

HTTP/1.1 200 OK
88K /opt/para/data
para.mv.db

Your questions, answers, users and tags all live in /opt/para/data/para.mv.db on the VM disk. Back up that file (or use the backup feature in the Administration area) to protect your knowledge base.

The Para backend version, the healthz endpoint returning HTTP 200, and the embedded H2 database file para.mv.db in the on disk data directory

Using your own domain and TLS

Scoold serves plain HTTP on port 80. For production, put your own domain and a TLS terminating proxy or load balancer in front of the VM, then set scoold.host_url in /opt/scoold/application.conf to your public URL and restart Scoold so links and sessions use the correct address:

sudo systemctl restart scoold

Support

This image is published and supported by cloudimg with 24/7 support. Scoold is developed by Erudika and released under the Apache 2.0 licence, as is its Para backend. For product documentation see the Scoold project. For issues with the cloudimg image, contact cloudimg support.