ThingsBoard on Ubuntu 24.04 on Azure User Guide

Overview

ThingsBoard is an open source IoT platform for connecting devices, collecting and processing their telemetry, and building interactive dashboards and automation on top of it. Devices connect over MQTT, HTTP and CoAP; their attributes and time series data are stored and exposed through a full REST API; and drag and drop dashboards turn that data into live widgets, charts and maps. A visual rule engine routes messages, raises alarms, transforms telemetry and triggers actions, while multi tenancy keeps tenants, customers and their assets cleanly separated.

The cloudimg image installs ThingsBoard Community Edition 4.3 from the official vendor package, running the platform in single node monolithic mode on the OpenJDK 21 runtime. A local PostgreSQL 16 database backs both the entities and the time series data (DATABASE_TS_TYPE=sql), so a complete platform, web UI, REST API, rule engine and device connectivity, comes up on one instance. The schema is preloaded together with a getting started set of demo devices, dashboards and rule chains, and the web UI plus REST API are served over HTTP on port 8080.

ThingsBoard seeds well known system administrator, tenant and customer logins. Because an IoT platform manages devices and their data, this image is secure by default: on the first boot of every deployed VM a one shot service rotates every seeded account password to a unique per VM value, rotates the local PostgreSQL password, and sets the platform base URL to the instance address, all before the login page is served. The per VM passwords for the three primary accounts are written to /root/thingsboard-credentials.txt with mode 0600, so no two VMs share credentials. Backed by 24/7 cloudimg support.

What is included:

• ThingsBoard Community Edition 4.3 installed from the official vendor package, running in single node monolithic mode
• The web UI and REST API served over HTTP on port 8080
• A local PostgreSQL 16 as the backing store for both entities and time series data (DATABASE_TS_TYPE=sql)
• OpenJDK 21 runtime, with the JVM heap tuned for the appliance and a 2 GB swap file
• A preloaded schema with demo devices, dashboards and rule chains for a getting started experience
• Secure by default: every seeded account password (system administrator, tenant, customer and the demo customer users) and the local database password are rotated per VM on first boot
• Per VM credentials for the three primary accounts written to a root only file
• thingsboard.service and postgresql.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2ms (2 vCPU / 8 GiB RAM) is the recommended starting point — ThingsBoard runs a Java virtual machine alongside a local PostgreSQL server and benefits from memory headroom for production workloads. NSG inbound: allow 22/tcp from your management network and 8080/tcp from the networks that your operators and devices will connect from. ThingsBoard serves plain HTTP on port 8080 — for anything beyond a private network, put it behind a TLS terminating reverse proxy (see below) and expose that instead.

Step 1 — Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for ThingsBoard by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22). Then Review + create → Create.

First boot initialisation takes approximately one to two minutes after the VM starts — ThingsBoard rotates every seeded account password, rotates the database password, sets the base URL, and starts the platform.

Step 2 — Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name thingsboard \
  --image <marketplace-image-urn> \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name thingsboard --port 8080 --priority 1010

Step 3 — Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 — Confirm the services are running

systemctl is-active postgresql thingsboard
java -version
ss -tlnp | grep ':8080'

Both services report active, ThingsBoard runs on OpenJDK 21, and the platform is listening on TCP 8080:

active
active
openjdk version "21.0.11" 2026-04-21
LISTEN 0      100                *:8080            *:*

On the very first boot allow a minute or two for ThingsBoard to finish starting before the endpoint responds — a Java application with demo data has a slow first start.

Step 5 — Retrieve your credentials

ThingsBoard's seeded logins are rotated to values unique to your VM on first boot. The three primary accounts are written to a root only file:

sudo cat /root/thingsboard-credentials.txt

TB_SYSADMIN_USERNAME=sysadmin@thingsboard.org
TB_SYSADMIN_PASSWORD=<generated-per-VM>
TB_TENANT_USERNAME=tenant@thingsboard.org
TB_TENANT_PASSWORD=<generated-per-VM>
TB_CUSTOMER_USERNAME=customer@thingsboard.org
TB_CUSTOMER_PASSWORD=<generated-per-VM>
THINGSBOARD_URL=http://<vm-address>:8080/

The system administrator (sysadmin@thingsboard.org) manages tenants and system wide settings. The tenant administrator (tenant@thingsboard.org) manages devices, dashboards, rule chains and customers. The customer (customer@thingsboard.org) sees the dashboards and devices assigned to it.

Step 6 — Secure by default

Because an IoT platform manages devices and their data, the image ships with no usable default credential. You can confirm the rotation from the shell: the publicly documented default password sysadmin is rejected, while the per VM password from the credentials file authenticates and returns a JSON Web Token.

SYS=$(sudo grep '^TB_SYSADMIN_PASSWORD=' /root/thingsboard-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'default password: HTTP %{http_code}\n' -X POST -H 'Content-Type: application/json' \
  -d '{"username":"sysadmin@thingsboard.org","password":"sysadmin"}' http://127.0.0.1:8080/api/auth/login
curl -s -o /dev/null -w 'per-VM password: HTTP %{http_code}\n' -X POST -H 'Content-Type: application/json' \
  -d "{\"username\":\"sysadmin@thingsboard.org\",\"password\":\"$SYS\"}" http://127.0.0.1:8080/api/auth/login

default password: HTTP 401
per-VM password: HTTP 200

The 401 for the built in default and 200 for the per VM password prove the first boot rotation. Every other seeded account — the tenant, the customer and the demo customer users — is rotated in the same way, and the local PostgreSQL password is rotated in lockstep.

Step 7 — Sign in to the web UI

Open http://<vm-public-ip>:8080/ in a browser. Sign in with the system administrator login from your credentials file to manage the platform, or the tenant administrator login to work with devices, dashboards and rule chains.

After signing in as the tenant administrator you land on the Home page, which summarises your devices and alarms, offers a getting started checklist, and links to solution templates and the device library.

Step 8 — Manage devices

Open Entities → Devices to see the devices provisioned on the platform. The image ships with a set of demo devices — thermostats, a Raspberry Pi and a DHT11 sensor, plus test devices assigned to demo customers — so you can explore dashboards and rules immediately. Use Add device to provision your own, then connect it over MQTT, HTTP or CoAP with its access token.

Step 9 — The visual rule engine

ThingsBoard processes every incoming message through a rule chain — a visual flow of nodes that filter, transform, enrich, store and act on telemetry. Open Rule chains to see the Root Rule Chain that all device messages enter, plus the demo Thermostat chain. Open a chain to edit its nodes on the drag and drop canvas, wire in alarm rules, or branch messages to external systems.

Step 10 — The REST API

Everything the UI does is driven through the ThingsBoard REST API. Authenticate with a POST to /api/auth/login to obtain a JWT, then pass it as an X-Authorization: Bearer header. This reads the demo device inventory for the tenant:

TEN=$(sudo grep '^TB_TENANT_PASSWORD=' /root/thingsboard-credentials.txt | cut -d= -f2-)
T=$(curl -s -X POST -H 'Content-Type: application/json' \
  -d "{\"username\":\"tenant@thingsboard.org\",\"password\":\"$TEN\"}" \
  http://127.0.0.1:8080/api/auth/login | jq -r .token)
curl -s -H "X-Authorization: Bearer $T" \
  'http://127.0.0.1:8080/api/tenant/devices?pageSize=100&page=0' | jq '.totalElements'

The login returns a token and a refreshToken; the authenticated call reports the number of devices in the tenant:

9

The full REST API — devices, assets, dashboards, telemetry, rule chains, alarms and administration — is served under http://<vm-address>:8080/api/, and the interactive Swagger documentation is available at http://<vm-address>:8080/swagger-ui/.

Putting ThingsBoard behind TLS

The image serves the UI and REST API over plain HTTP on port 8080, which is appropriate for a private network. For anything exposed more widely, terminate TLS in front of ThingsBoard with your own reverse proxy (nginx, Caddy, Azure Application Gateway) forwarding to http://127.0.0.1:8080/, and expose 443 instead of 8080. Configure the same public address as the platform base URL under Settings → General so that generated links and notifications use it. MQTT (1883) and CoAP (5683) device transports can likewise be fronted or firewalled to suit your deployment.

Server components

Filesystem layout

Key directories:

Managing the service

sudo systemctl status thingsboard
sudo systemctl restart thingsboard
sudo journalctl -u thingsboard -f

ThingsBoard configuration lives in /etc/thingsboard/conf/thingsboard.conf (environment overrides, including the JVM heap and the SQL datasource) and /etc/thingsboard/conf/thingsboard.yml. Restart the service after any change.

Backup and maintenance

ThingsBoard keeps all of its data — devices, dashboards, rule chains, telemetry and time series — in its PostgreSQL backing database. Back it up regularly:

sudo -u postgres pg_dump thingsboard > /tmp/thingsboard-db-$(date +%F).sql

Ship the dump to Azure Blob Storage or another object store, or snapshot the OS disk in Azure for a coordinated point in time backup. Keep the OS patched with sudo apt update && sudo apt upgrade. To upgrade ThingsBoard itself, follow the vendor upgrade notes for your target version, always taking a database backup first.

Troubleshooting

• The UI does not load yet. On first boot ThingsBoard takes a minute or two to start. Check progress with sudo journalctl -u thingsboard -f; confirm the port with ss -tlnp | grep ':8080'.
• A login is rejected. The seeded passwords are rotated per VM — use the values from sudo cat /root/thingsboard-credentials.txt, not the documented defaults. If you have changed a password in the UI, use the new one.
• The service will not start. Confirm PostgreSQL is up (systemctl is-active postgresql) and inspect sudo journalctl -u thingsboard --no-pager | tail -50. On a memory constrained VM, ensure the swap file is active with swapon --show.

Security recommendations

• Restrict the NSG so that 8080/tcp is reachable only from the networks that need it, and 22/tcp only from your management network.
• Put ThingsBoard behind a TLS terminating reverse proxy before exposing it to the internet, and set the platform base URL to the public HTTPS address.
• Sign in and review the seeded accounts under Customers and Users; delete or repurpose the demo entities you do not need. Their passwords are already rotated to random values on this image.
• Keep the OS and ThingsBoard patched, and back up the PostgreSQL database regularly.

Support

This image is backed by 24/7 cloudimg support. Contact us by email and chat for help with deployment, device connectivity (MQTT, HTTP, CoAP), dashboard and rule chain design, reverse proxy and TLS termination, and PostgreSQL administration. Contact support@cloudimg.co.uk.

For general ThingsBoard questions consult the documentation at https://thingsboard.io/docs/ and https://github.com/thingsboard/thingsboard. ThingsBoard is an open source project; ThingsBoard is a trademark of ThingsBoard, Inc. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.