TeemIp 3.2 IPAM DHCP DNS on Ubuntu 24.04 on Azure User Guide

Overview

TeemIp is a web based IP Address Management (IPAM) application with integrated DHCP and DNS management, delegated administration and a complete IP audit trail. Built on the iTop CMDB framework, it models IP blocks, subnets, ranges and individual addresses across IPv4 and IPv6, manages DHCP scopes and DNS zones, and records a full change history so teams can plan, allocate and reclaim address space with confidence. The cloudimg image ships TeemIp 3.2 served by nginx and PHP 8.3 FPM on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server, so the appliance is complete and useful on its own. The setup wizard is completed headlessly and locked, so the application is ready the moment the instance boots. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306). A unique administrator password is generated on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• TeemIp 3.2.3 served by nginx and PHP 8.3 FPM, managed by systemd
• A bundled MariaDB server holding the TeemIp database, already installed and ready
• The iTop setup wizard completed headlessly and locked, so no setup wizard is ever exposed on the web
• A per VM administrator password generated on first boot and recorded in a root only file
• No shipped default login: the administrator password ships rotated to a discarded random and the real per VM password is set on first boot
• MariaDB bound to 127.0.0.1 only, never exposed to the network
• Graphviz installed for the impact and lifecycle graph rendering iTop uses
• nginx.service, php8.3-fpm.service and mariadb.service as enabled systemd units
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• The complete AGPL-3.0 source on disk under /var/www/teemip
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_D2s_v3 (2 vCPU / 8 GiB RAM) is a sensible starting point for typical production use; a smaller size such as Standard_B2s works for a small deployment. NSG inbound: allow 22/tcp from your management network, 80/tcp for the application and 443/tcp if you terminate TLS on the VM. The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for TeemIp by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22), HTTP (80) and HTTPS (443). Then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name teemip \
  --image <marketplace-image-urn> \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name teemip --port 80,443

Step 3 - Confirm the services are running

SSH in as azureuser and confirm nginx, PHP FPM, MariaDB and the first boot service are all active. Note that MariaDB listens only on 127.0.0.1:3306 while nginx serves TeemIp on port 80.

systemctl is-active nginx php8.3-fpm mariadb teemip-firstboot

Expected output:

active
active
active
active

Confirm the bundled database is bound to loopback only (port 3306 never leaves the VM):

sudo ss -tlnp | grep -E ':80 |:3306'

MariaDB appears on 127.0.0.1:3306 while nginx listens on 0.0.0.0:80:

Step 4 - Retrieve the per VM administrator password

Every VM generates a unique administrator password on first boot and records it, along with the database credentials, in a root only file. Read it over SSH:

sudo cat /root/teemip-credentials.txt

The file records the browse URL, the admin user and its per VM password. There is no shipped default: the administrator password is rotated to a discarded random in the image and the real per VM password is set on first boot, and a credential round trip proves at build time that the per VM password authenticates while blank and common weak guesses are all rejected.

Step 5 - Sign in

Browse to http://<vm-ip>/ and sign in on the TeemIp welcome page as the admin user with the password from the credentials file.

After signing in you land on the TeemIp welcome dashboard, which groups your Configuration Items, Networking objects and IP Management at a glance.

Step 6 - Manage your IP address space

TeemIp organises address space as IP blocks that contain subnets, ranges and individual addresses. From the left menu open IP Management, then create an IPv4 Block (for example 10.0.0.0 to 10.255.255.255) and add IPv4 Subnets inside it. The IPv4 Subnets view lists every subnet with its mask, status, owning organization and allocation date, and supports rich filtering.

Opening a block shows its full detail: the address range, delegation information, and tabs for the child blocks and subnets it contains, so you can drill down through the hierarchy of your address plan.

Step 7 - Verify the application endpoint

The image exposes an unauthenticated /healthz endpoint for load balancer probes, serves the TeemIp login page on /pages/UI.php, and denies web access to the setup directory:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/healthz

Expected output:

HTTP 200

Step 8 - What is installed

TeemIp 3.2 is licensed under the GNU Affero General Public License v3, and the complete source ships on disk under /var/www/teemip. Confirm the runtime versions:

php -v | head -1 && mariadb --version && dot -V

Security model

• No default login. The administrator password ships rotated to a discarded random value. On the first boot of every VM, the teemip-firstboot.service unit generates a fresh administrator password and a fresh database password, records them in /root/teemip-credentials.txt (mode 0600, root only), and rewrites the application base URL to the VM's resolved address.
• Loopback only database. The bundled MariaDB listens on 127.0.0.1:3306 only and is never exposed to the network. Keep port 3306 closed in your NSG.
• Setup locked. The iTop configuration file is read only and nginx denies web access to the setup, conf, data and log directories, so the setup wizard can never be reached from a browser.
• Fully patched base. The Ubuntu 24.04 LTS base is fully patched at build time and keeps unattended security upgrades enabled for the running VM.

Where your data lives

The TeemIp database is held in the bundled MariaDB on the OS disk. For on box database maintenance, connect as root over the local socket (no password needed):

sudo mariadb teemip -e 'SHOW TABLES;' | head

Enable HTTPS (optional)

For production, front the appliance with your own domain and a TLS certificate. Point a DNS record at the VM's public IP, then install a certificate with Certbot:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Support

Every cloudimg image includes 24/7 support. If you have any questions about deploying or operating TeemIp on Azure, contact the cloudimg team.