TimeBase Community Edition on Ubuntu 24.04 on Azure User Guide

Overview

TimeBase Community Edition is an event oriented time series database and real time messaging server designed for financial market data. Data is organised into user defined streams, and the same engine serves both as a historical time series store and as a live streaming bus: producers write time stamped messages into a stream and consumers read them back or subscribe to them as they arrive. A browser Web Admin shows live connections, cursors and loaders, and the version matched tickdb shell writes and queries data over the native protocol.

The cloudimg image ships the official FINOS TimeBase CE server (finos/timebase-ce-server, pinned by digest) as a managed service on Docker Engine, with authentication turned on and the Web Admin fronted by an nginx reverse proxy that terminates TLS with a certificate minted uniquely on the first boot of every VM. The native data port is bound to the loopback interface only, so the engine is never exposed to the network until you choose to open it. Backed by 24/7 cloudimg support.

What is included:

• The official FINOS TimeBase CE 6.2.34 server (finos/timebase-ce-server) run under systemd as timebase.service
• The version matched tickdb client (finos/timebase-ce-client) available on box as the timebase-shell command
• TimeBase file based User Access Control enabled, with a unique admin password generated on the first boot of every VM
• An nginx reverse proxy terminating TLS on :443 for the Web Admin, with a per VM self signed certificate, and a plain :80 that redirects to HTTPS and serves a health probe
• The native TimeBase protocol on :8011 bound to loopback only, so it is not reachable off the machine until you deliberately open it
• A hardened, fully patched Ubuntu 24.04 LTS base with automatic security updates

Key facts:

• Default SSH user: azureuser
• Web Admin: https://<vm-public-ip>/ (sign in as admin)
• Admin password file: /root/timebase-ce-credentials.txt
• Recommended VM size: Standard_B2ms (2 vCPU, 8 GB) or larger for heavier workloads

Step 1 - Launch the VM

Launch the image from the Azure Marketplace in the portal: choose the cloudimg TimeBase Community Edition on Ubuntu 24.04 LTS offer, pick a size (Standard_B2ms is a good starting point; size up for higher throughput), select or create a VNet, and allow inbound ports 22 (SSH) and 443 (HTTPS, the Web Admin) in the network security group. Restrict port 22 to trusted source ranges.

You can also deploy from the Azure CLI. Replace the resource group, image URN, size and admin user to suit your environment:

az vm create \
  --resource-group my-rg \
  --name timebase-ce \
  --image <marketplace-image-urn> \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open ports 22 and 443 on the VM's network security group, restricting 22 to your own address range. Port 8011 (the native TimeBase protocol) is deliberately left closed and bound to loopback; Step 9 explains how to expose it to your own application when you need it.

Step 2 - Verify the services

SSH in as azureuser and confirm Docker, the TimeBase server and nginx are all active. The server publishes its native protocol and its Web Admin to loopback, and nginx serves the Web Admin over TLS on port 443.

systemctl is-active docker timebase nginx

docker ps --format '{{.Names}}  {{.Image}}  {{.Status}}'

curl -s -o /dev/null -w 'nginx /healthz -> HTTP %{http_code}\n' http://127.0.0.1/healthz

Step 3 - Retrieve the per VM admin password

Every VM generates its own TimeBase admin password on first boot and writes it, along with the Web Admin URL, to a root only credentials file. Read it with sudo:

sudo cat /root/timebase-ce-credentials.txt

The Web Admin is reachable over TLS and requires the credential; the native data port is bound to loopback and refuses connections from off the machine. You can confirm both:

curl -sk -o /dev/null -w 'Web Admin unauthenticated -> HTTP %{http_code}\n' https://127.0.0.1/

IP=$(hostname -I | awk '{print $1}'); nc -z -w3 "$IP" 8011 && echo "8011 reachable off box" || echo "8011 refused off box (loopback only)"

You sign in to the Web Admin as user admin with the TIMEBASE_ADMIN_PASSWORD from this file. The same credential authenticates the tickdb shell and any client that connects over the native protocol.

Step 4 - Sign in to the Web Admin

Browse to https://<vm-public-ip>/. The certificate is a per VM self signed certificate, so your browser will warn on first visit; accept it to continue (or front the VM with your own domain and certificate, see Step 9). Enter username admin and the password from Step 3 when prompted. The QuantServer monitoring home shows the running server version and its administration tools.

Step 5 - Live connections

Open the TimeBase monitor and select Connections to see every client currently connected to the server, with its client id, application, connection time and remote address. The example below shows several tickdb shell sessions connected at once.

Step 6 - Cursors and loaders

Cursors lists the open read cursors, so you can see exactly which streams are being queried in real time. Loaders lists the open writers, so you can see which streams are being ingested into. The examples below show read cursors and a loader both working against the bars stream created in Step 7.

Step 7 - Write and query time series data

The image includes a timebase-shell command that runs the version matched tickdb shell inside a container, connected to the server over loopback. This example uses the built in sample producer to create a bars stream and load time series bar messages, then reads them straight back with a select. Retrieve the password first, then run the shell:

PW=$(sudo grep '^TIMEBASE_ADMIN_PASSWORD=' /root/timebase-ce-credentials.txt | cut -d= -f2-)
sudo timebase-shell <<EOF
set db dxtick://admin:$PW@localhost:8011
open
generate bars
set max 6
set stream bars
select
exit
EOF

You will see the generated SimpleBarMessage rows for several symbols, each with an open, high, low, close and volume, printed straight back from the stream you just wrote.

To define your own stream and write your own messages, use the tickdb shell (mkstream, send) or one of the TimeBase client libraries (Java, .NET, Python and C++) over the native protocol. Create a dedicated, least privilege user for each application rather than sharing the admin credential.

Step 8 - No known or default credentials

TimeBase Community Edition ships with authentication disabled by default. The cloudimg image turns authentication on and sets a unique per VM admin password on first boot; the server will not start until that per VM secret is in place. You can prove there is no known or default login with the built in round trip check, which confirms the per VM admin authenticates and reads data while common default logins are rejected:

sudo bash /usr/local/sbin/timebase-ce-cred-roundtrip.sh

Step 9 - Exposing the native protocol to your application

By default the native TimeBase protocol on port 8011 is published to loopback only, so client libraries running on other machines cannot reach it. When you are ready to connect your own application over the network, edit the service so the server port is published on the private network interface, then open port 8011 in the network security group scoped to your application's subnet only:

sudo sed -i 's/-p 127.0.0.1:8011:8011/-p 8011:8011/' /etc/systemd/system/timebase.service
sudo systemctl daemon-reload && sudo systemctl restart timebase

Authentication stays enabled, so even once the port is open, clients must present the per VM admin credential or a dedicated user you create. Keep the security group rule as tight as possible and prefer a private VNet over public exposure.

Where your data lives

TimeBase stores all of its streams and message data at /var/lib/timebase/home on the OS disk, bind mounted into the server container as /timebase-home. The data persists across container restarts and VM reboots. Inspect it with:

sudo du -sh /var/lib/timebase/home

For backups, stop the service and take a file level backup of that directory, or use the TimeBase tooling to export stream data.

Security notes

• Authentication is enabled and the admin password is unique to every VM. Keep /root/timebase-ce-credentials.txt protected and create dedicated per application users rather than sharing the admin credential.
• The Web Admin is served over TLS with a per VM self signed certificate. For anything beyond a trusted network, front it with your own domain and a certificate from Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer.
• Only ports 22 (SSH) and 443 (Web Admin over TLS) are exposed by default. The native protocol on 8011 is bound to loopback until you deliberately open it (Step 9). Restrict every open port to trusted source ranges in the network security group.
• The base OS is fully patched at build time and keeps unattended security updates enabled for ongoing protection.

Support

This image is built and maintained by cloudimg with 24/7 support. TimeBase Community Edition is free and open source software licensed under the Apache License 2.0 and governed by the Fintech Open Source Foundation (FINOS). This image is provided by cloudimg and is not affiliated with or endorsed by FINOS, EPAM Systems or the TimeBase project.