SORMAS on Ubuntu 24.04 on Azure User Guide

Overview

SORMAS (Surveillance Outbreak Response Management and Analysis System) is an open-source digital platform, developed by the SORMAS Foundation and the Helmholtz Centre for Infection Research, that helps public health authorities run disease surveillance and coordinate outbreak response. Health workers record and investigate cases across dozens of diseases, trace and follow up contacts, manage events and samples, and monitor the situation through dashboards, maps and statistics. The cloudimg image installs SORMAS 1.104.0 from the official SORMAS server setup onto a Payara application server and a PostgreSQL 15 database, runs both as systemd services behind an nginx reverse proxy, uses the built-in SORMAS authentication realm, and generates a unique administrator password on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• SORMAS 1.104.0 (the SORMAS web UI and REST API), served over HTTP on port 80 by nginx
• Payara 5.2022.5 hosting the SORMAS application, running as an enabled sormas systemd unit as the unprivileged payara user, bound to localhost
• PostgreSQL 15 (within the SORMAS-supported 14-15 range) bound to localhost, carrying the sormas_db database
• OpenJDK 11, the Java version SORMAS requires
• The built-in SORMAS authentication realm, with a single admin account rotated to a unique password on first boot
• ufw default-deny inbound with only ports 22 and 80 open
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B4ms (4 vCPU / 16 GiB RAM) is the recommended size: SORMAS runs a Payara application server (with a 4 GiB JVM heap) alongside PostgreSQL, and 16 GiB keeps the stack healthy. NSG inbound: allow 22/tcp from your management network and 80/tcp for the SORMAS web interface.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for SORMAS by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name sormas \
  --image <marketplace-image-urn> \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name sormas --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm SORMAS is running

On first boot the appliance generates a unique administrator password, rotates the SORMAS admin account to it, starts the Payara application server, and writes the credentials to a root-only file. The sormas service does not start until first boot has finished rotating the password, so the vendor default is never served.

systemctl is-active postgresql sormas nginx

All three should report active. You can also confirm the listeners: the SORMAS web UI is proxied by nginx on port 80, while Payara (6080/6048) and PostgreSQL (5432) stay bound to localhost.

Check the component versions — OpenJDK 11, PostgreSQL 15, Payara 5 and SORMAS 1.104.0:

Step 5 - Retrieve the per-VM administrator password

The unique password generated on first boot is stored in a root-only file:

sudo cat /root/sormas-credentials.txt

You will see the login URL, the user name admin, and the generated SORMAS_ADMIN_PASSWORD. Store this password in your password manager; it is unique to this VM.

The SORMAS default login (admin / sadmin) is rotated away before the server ever serves a request. You can verify this against the REST API — the default is refused, the unique password is accepted:

Step 6 - Sign in to SORMAS

Browse to http://<vm-public-ip>/ — you are redirected to the SORMAS login page. Sign in as admin with the password from Step 5.

After signing in, the Surveillance Dashboard opens, summarising cases by disease and epidemiological week. From the left-hand menu you reach Tasks, Persons, Cases, Contacts, Events, Samples, Immunizations, Reports, Statistics, Users and Configuration.

Step 7 - Manage cases and configure the system

The Cases directory is where cases are registered, filtered, imported, exported and line-listed. It is empty on a fresh appliance — you build your own case data, or import it.

As administrator, begin by opening Configuration to define your countries, regions, districts, facilities and user roles, then create users under Users. The About page confirms the running version and links to the SORMAS components.

Architecture

SORMAS is a Jakarta EE application. The cloudimg image runs it on Payara 5.2022.5 in a Payara domain named sormas, with its HTTP listener bound to 127.0.0.1:6080 and its admin listener to 127.0.0.1:6048; customers reach the web UI (/sormas-ui) and REST API (/sormas-rest) through the nginx reverse proxy on port 80. PostgreSQL 15 holds the sormas_db database and is bound to localhost. Authentication uses the built-in SORMAS realm (a real username/password login backed by the database) rather than an external identity provider, keeping the appliance to a single node. The firewall (ufw) denies all inbound traffic except ports 22 and 80, so Payara and the database are never reachable off-box. Only the admin account is seeded (createDefaultEntities=false), so none of the SORMAS demo users or demo passwords ship in the image.

Step 8 - Use the REST API

SORMAS exposes a REST API through the same nginx proxy, authenticated with HTTP Basic auth, so you can automate and integrate. For example, obtain the running version and read the seeded disease configurations, substituting the administrator password from Step 5:

curl -s -u admin:<SORMAS_ADMIN_PASSWORD> http://127.0.0.1/sormas-rest/info/version
curl -s -u admin:<SORMAS_ADMIN_PASSWORD> http://127.0.0.1/sormas-rest/diseaseconfigurations/all/0

The first returns "1.104.0"; the second returns the disease configuration list as JSON. The SORMAS documentation describes the full API surface.

Maintenance

• Start/stop SORMAS: sudo systemctl restart sormas (this stops and starts the Payara domain)
• Logs: the Payara/SORMAS server log is at /opt/domains/sormas/logs/server.log
• Database: PostgreSQL 15 runs locally; back up the sormas_db database with sudo -u postgres pg_dump -Fc sormas_db on a schedule
• Security updates: unattended-upgrades is enabled, so OS security patches are applied automatically
• TLS: for production, front the appliance with your own TLS termination (for example an Azure Application Gateway or a customer-managed nginx certificate) so browser traffic to port 80 is encrypted in transit. SORMAS handles sensitive health data, so terminating TLS is strongly recommended before going live

Support

SORMAS is developed by the SORMAS Foundation and the Helmholtz Centre for Infection Research and is licensed under the GNU General Public License v3. This cloudimg image is backed by 24/7 support. For help with the image, contact cloudimg support; for questions about using SORMAS itself, see the SORMAS documentation.