Tracim on Ubuntu 24.04 on Azure User Guide

Overview

Tracim is an open-source team-collaboration platform. Teams work inside shared spaces that combine rich-text HTML documents, uploaded files with versioning, threaded discussions, comments, a kanban board and a calendar - so a project's content and conversations live together in one private place instead of being scattered across hosted tools. The cloudimg image runs the pinned official Tracim container behind nginx over HTTPS: the container is published on the loopback interface only, and nginx terminates TLS in front of it. Backed by 24/7 cloudimg support.

What is included:

• Tracim (build 2025-04.00_build_164) from the official pinned container image algoo/tracim:2025-04.00_build_164, baked into the image and published on loopback 127.0.0.1:8080
• nginx terminating TLS on :443 in front of Tracim, with :80 redirecting to HTTPS
• A per-VM administrator account and a per-VM session signing secret generated on first boot - no default or shared credential ships in the image, and the upstream default admin@admin.admin login is retired before the service ever serves a request
• A self-contained single-VM deployment backed by SQLite - no separate database server to run
• docker.service, tracim.service and nginx.service as systemd units, enabled and active
• 24/7 cloudimg support

Tracim is distributed under several open-source licences (AGPL-3.0 for the agenda application, LGPL-3.0 for the other frontend applications, MIT for the backend and Docker recipes, and CC-BY-SA-4.0 for the welcome-page background images).

Secure by default - a per-VM administrator credential

This image ships with no default or shared login: no database, no user accounts and no session secret ship in the image. On first boot a one-shot service resolves your public URL, regenerates a per-VM TLS certificate, initialises a fresh SQLite database (which generates a unique session secret for your VM), and then rotates the upstream default administrator - changing both its e-mail and password to a unique per-VM administrator credential that it writes to a root-only file. Tracim is deliberately held back until that rotation has happened, so there is never a window in which a fresh VM is reachable with the well-known default login. You retrieve the password over SSH and change it after your first login.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point (the running stack uses roughly 1.3 GiB); scale up for large teams or heavy file/document volumes. NSG inbound: allow 22/tcp from your management network, and 80/tcp + 443/tcp from wherever you browse Tracim (:80 only redirects to :443).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Tracim by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22), HTTP (80) and HTTPS (443). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name tracim \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name tracim --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name tracim --port 443 --priority 1020

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

The message of the day shows your VM's Tracim URL and administrator e-mail.

Step 4 - Confirm the services are running

Tracim runs as three systemd units - the Docker engine, the Tracim container and nginx:

systemctl is-active docker.service tracim.service nginx.service

active
active
active

The Tracim container is published only on the loopback interface; nginx is the only service bound to public ports (:80 and :443):

sudo ss -tln | grep -E ':(80|443|8080) '

LISTEN 0      4096       127.0.0.1:8080      0.0.0.0:*
LISTEN 0      511          0.0.0.0:443       0.0.0.0:*
LISTEN 0      511          0.0.0.0:80        0.0.0.0:*

The web UI is served over HTTPS, and plain HTTP redirects to it:

curl -sk -o /dev/null -w 'https:// -> %{http_code}\n' https://127.0.0.1/
curl -s  -o /dev/null -w 'http://  -> %{http_code}\n' http://127.0.0.1/

https:// -> 200
http://  -> 301

Step 5 - Read the per-VM administrator credential

On first boot the VM writes a root-only file with your Tracim URL, the administrator e-mail and the unique password generated for this VM:

sudo grep -E '^TRACIM_URL=|^TRACIM_ADMIN_EMAIL=' /root/tracim-credentials.txt

TRACIM_URL=https://<vm-public-ip>
TRACIM_ADMIN_EMAIL=admin@cloudimg.local

The TRACIM_ADMIN_PASSWORD line in that file holds your unique password. Only the per-VM credential authenticates - a wrong password, and the retired upstream default, are both rejected:

E=$(sudo grep '^TRACIM_ADMIN_EMAIL=' /root/tracim-credentials.txt | cut -d= -f2-)
P=$(sudo grep '^TRACIM_ADMIN_PASSWORD=' /root/tracim-credentials.txt | cut -d= -f2-)
curl -sk -o /dev/null -w 'per-VM password -> HTTP %{http_code}\n' -X POST https://127.0.0.1/api/auth/login \
  -H 'Content-Type: application/json' --data "{\"email\":\"$E\",\"password\":\"$P\"}"
curl -sk -o /dev/null -w 'wrong password  -> HTTP %{http_code}\n' -X POST https://127.0.0.1/api/auth/login \
  -H 'Content-Type: application/json' --data "{\"email\":\"$E\",\"password\":\"wrong-nope\"}"

per-VM password -> HTTP 200
wrong password  -> HTTP 403

Step 6 - First login

Open Tracim in your browser (accept the self-signed certificate warning, or install a trusted certificate first - see below):

https://<vm-public-ip>/

Enter the administrator e-mail (admin@cloudimg.local) and the TRACIM_ADMIN_PASSWORD from Step 5, then sign in. Change your password from your account settings immediately after your first sign-in.

Working in shared spaces

Tracim organises collaboration into spaces. Create a space, then add content inside it: HTML documents, uploaded files (with automatic versioning), threads for discussion, comments, and a kanban board. Everything in a space is shared with the space's members, so a team's documents and conversations stay together.

Inside a space you create rich content - HTML documents, files, threads and kanban cards - and everyone with access collaborates on it:

Documents and threads support comments and revisions, so discussion stays attached to the content it is about:

Step 7 - The official pinned container image

Tracim runs from the official upstream container image, pinned to an exact build and baked into the VM image (no runtime pull), published on the loopback interface only:

sudo docker ps --format 'table {{.Image}}\t{{.Status}}\t{{.Ports}}'

IMAGE                               STATUS         PORTS
algoo/tracim:2025-04.00_build_164   Up 6 minutes   127.0.0.1:8080->80/tcp

Adding more users

Tracim is multi-user. Add accounts from the VM with the built-in tracimcli user create command inside the running container (choose the profile users, trusted-users or administrators):

sudo docker exec tracim su www-data -s /bin/bash -c \
  "cd /tracim/backend && tracimcli user create \
     --email alice@example.com --password '<choose-a-strong-password>' \
     --profile users -c /etc/tracim/development.ini"

You can then invite that user into your spaces from the web UI. Administrators can also create and manage users directly from Administration in the interface.

Security updates

The image is captured fully patched (including Ubuntu phased updates) and unattended-upgrades stays enabled, so security patches keep flowing on your VM. There should be no held-back packages:

apt-mark showhold

The docker and nginx packages are managed by systemd units; the application itself is the pinned container image described above.

Your data

Tracim stores its SQLite database and uploaded files under /var/lib/tracim/data:

sudo du -sh /var/lib/tracim/data

Snapshot the VM's OS disk in Azure to back up your workspace, or copy /var/lib/tracim/data to external storage on a schedule.

Enabling a trusted TLS certificate

The image ships a per-VM self-signed certificate so HTTPS works out of the box; browsers will warn until you install a trusted certificate. For production, point a DNS A record at the VM's public IP, ensure 443/tcp is open in the NSG, then install certbot and let it manage the nginx certificate. Replace the placeholders with your own domain and email:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com -m you@example.com --agree-tos

certbot configures the HTTPS server block and sets up automatic renewal. After it completes, set basic_setup.website_base_url = https://your-domain.example.com in /var/lib/tracim/config/development.ini and run sudo systemctl restart tracim, and Tracim is available at your domain with a trusted certificate.

Upgrading Tracim

Tracim runs from a pinned container image. To upgrade, edit the image tag in /etc/systemd/system/tracim.service, then sudo docker pull algoo/tracim:<new-tag>, sudo systemctl daemon-reload and sudo systemctl restart tracim. The database schema migrates automatically on start. Always snapshot the OS disk first. cloudimg support can assist with planning and performing upgrades.

Support

This image is backed by 24/7 cloudimg support covering deployment, upgrades, integrations, TLS termination and user administration. Contact us by email and chat.

Tracim is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.