TDengine on Ubuntu 24.04 on Azure User Guide

Overview

TDengine is a high-performance open-source time-series database purpose-built for IoT, industrial and observability workloads. It speaks SQL with time-series extensions, stores data in a super-table / child-table model that keeps each device's stream contiguous, ingests over a native protocol and a REST/HTTP API, and ships taosExplorer - a web console for browsing databases and running SQL. The cloudimg image installs the OSS/Community edition of TDengine 3.4.1.6 from the official TDengine apt repository, runs taosd, taosAdapter and taosExplorer as systemd services, fronts the web console with nginx on port 80, restricts the external surface with a host firewall, and rotates the built-in root password to a unique per-VM secret on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• TDengine 3.4.1.6 (OSS/Community edition) installed from the official TDengine apt repository and version-pinned
• taosd (the database engine), taosAdapter (REST/HTTP API) and taos-explorer (web console) as systemd units, enabled and active
• The taosExplorer web console fronted by nginx on :80, authenticated natively against TDengine (sign in as root)
• A unique root password generated on the first boot of every VM and written to a root-only file - the upstream default root/taosdata never survives into a running customer VM
• A host firewall (ufw) that allows only SSH (22) and the web console (80); the native port (6030) and the REST API (6041) are reachable only from the VM itself
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) runs the full stack comfortably; scale up for higher ingestion rates and larger datasets. NSG inbound: allow 22/tcp from your management network and 80/tcp for the web console (front with TLS for public exposure - see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for TDengine by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name tdengine \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name tdengine --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active taosd.service taosadapter.service taos-explorer.service nginx.service

All four services report active. The taos --version command reports the running build, and the host firewall keeps everything except SSH and the web console off the network:

Step 5 - Retrieve your root password

The root password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/tdengine-credentials.txt

This file contains TDENGINE_ROOT_USER (root) and TDENGINE_ROOT_PASSWORD, plus the web console URL. Store the password somewhere safe - the upstream default root/taosdata is rotated away on first boot and no longer works.

Step 6 - Check the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/health

It returns ok. Every other path proxies through to the taosExplorer web console.

Step 7 - Open the taosExplorer web console

Browse to http://<vm-public-ip>/ and sign in as root with the password from Step 5.

On your first sign-in taosExplorer shows an optional "register for support" page. Registration is not required to use the database - click the TDengine icon (top-right) or browse to the home page to reach the console. The Explorer view lists your databases on the left and gives you a SQL editor on the right:

Step 8 - Run SQL in the web console

Type a query in the editor and click Run. The results appear in the grid below, and the Chart tab visualises them as a time series. Here we query the pre-loaded demo super-table:

The Databases tree on the left lets you browse every database, super-table and child table, with their columns, types and tags:

Step 9 - Query with the taos CLI

The taos command-line client is installed on the VM. Create a time-series round-trip - list databases, inspect a super-table schema, and read rows back:

taos -u root -p'<TDENGINE_ROOT_PASSWORD>' -s "SHOW DATABASES;"
taos -u root -p'<TDENGINE_ROOT_PASSWORD>' -s "DESCRIBE demo.sensors;"
taos -u root -p'<TDENGINE_ROOT_PASSWORD>' -s "SELECT ts, device_id, temperature, humidity FROM demo.sensors ORDER BY ts DESC LIMIT 5;"

The demo database ships with a sensors super-table and a few child tables so you have data to query immediately:

Create your own super-table and start ingesting:

taos -u root -p'<TDENGINE_ROOT_PASSWORD>' -s "CREATE DATABASE IF NOT EXISTS iot;"
taos -u root -p'<TDENGINE_ROOT_PASSWORD>' -s "CREATE STABLE iot.meters (ts TIMESTAMP, current FLOAT, voltage INT) TAGS (groupid INT, location BINARY(32));"
taos -u root -p'<TDENGINE_ROOT_PASSWORD>' -s "INSERT INTO iot.d1 USING iot.meters TAGS (1, 'floor-1') VALUES (NOW, 11.5, 220);"

Step 10 - Query with the taosAdapter REST API

taosAdapter exposes a REST/HTTP API on port 6041, reachable from the VM itself. First confirm the security model - the upstream default credential is rejected, and the per-VM password authenticates and returns a session token:

curl -s http://localhost:6041/rest/login/root/<TDENGINE_ROOT_PASSWORD>

Then run SQL with HTTP Basic auth (the response is JSON with a code of 0 on success):

curl -s -u root:'<TDENGINE_ROOT_PASSWORD>' -d 'SELECT COUNT(*), AVG(temperature) FROM demo.sensors' http://localhost:6041/rest/sql

Security model and connecting remotely

The host firewall (ufw) allows only 22/tcp (SSH) and 80/tcp (the web console) from the network. TDengine's native port 6030 and the taosAdapter REST API 6041 are reachable only from the VM itself. To reach the REST API from your workstation, use an SSH tunnel:

ssh -L 6041:127.0.0.1:6041 azureuser@<vm-public-ip>

Then point a REST client at http://localhost:6041 on your workstation. The data directory lives at /var/lib/taos; the built-in root user is a superuser, and you can create additional least-privilege users with CREATE USER for applications.

Enabling HTTPS

The nginx reverse proxy terminates plain HTTP on port 80. For public exposure, put a certificate in front of it: add a DNS name for the VM and use the companion cloudimg nginx-ssl-certbot image as a TLS reverse proxy, or install certbot and extend the existing nginx site (/etc/nginx/sites-available/cloudimg-tdengine) with a listen 443 ssl; server block and your certificate paths. Keep taosExplorer bound to loopback so the only public surface is the TLS-terminated proxy.

Maintenance

• Configuration: the engine config is /etc/taos/taos.cfg (the appliance pins fqdn localhost and disables the taoskeeper telemetry subsystem); the REST API config is /etc/taos/taosadapter.toml and the web console config is /etc/taos/explorer.toml. Edit and sudo systemctl restart taosd (or the relevant unit) to apply.
• Users: create least-privilege application users with CREATE USER <name> PASS '<password>'; and grant scoped read/write access rather than sharing root.
• Backups: snapshot the OS disk, or use TDengine's taosdump utility to export databases.
• Upgrades: the shipped version is held with apt-mark hold tdengine-tsdb. To move to a newer release, sudo apt-mark unhold tdengine-tsdb then install the target version from the TDengine apt repository and restart the services.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.