Ug
Storage Azure

Uguu on Ubuntu 24.04 on Azure User Guide

| Product: Uguu on Ubuntu 24.04 LTS on Azure

Overview

This guide covers the deployment and configuration of Uguu on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Uguu is a simple, lightweight, open source temporary file hosting and sharing service (the maintained successor to Pomf). Upload a file by one click, drag and drop or paste, or through a documented HTTP API, and receive a short link you can share. Uploaded files expire automatically after a configurable retention window (8 hours by default) and are then deleted from disk and from the database, so nothing lingers.

The image runs Uguu on PHP 8.3 (php8.3-fpm) behind nginx, which terminates TLS on port 443. File metadata is held in a local SQLite database; the uploaded file blobs are stored on a dedicated data disk mounted at /data. The web assets are compiled once at build time and the appliance then runs on PHP only.

A temporary file host is only safe if uploading is controlled. Upstream Uguu is anonymous by design and lets anyone upload, which is abusable for hosting malware or pirated content. This cloudimg image is therefore secure by default: the uploader page and the upload endpoint are gated by an HTTP Basic upload key generated uniquely for this VM on first boot, so an unauthenticated upload is rejected with HTTP 401 before it ever reaches the application. Downloads (the shared links) stay public, which is what makes sharing work, so a recipient only needs the link while uploading needs your key. Sensible size and type limits and automatic expiry are enabled out of the box.

What is included:

  • Uguu 1.9.9 running on PHP 8.3 (php8.3-fpm) behind nginx terminating TLS on :443, with a local SQLite database for file metadata

  • Uploaded file blobs stored on a dedicated data disk mounted at /data, captured into the image so every VM is provisioned with it

  • A per VM upload key generated on first boot (HTTP Basic auth, user uguu) gating the uploader page and /upload.php, so the image is never an open public file drop; no default or blank credential is ever baked in

  • Public file downloads so shared links work without a login, plus an unauthenticated /healthz endpoint (HTTP 200) for load balancer probes

  • Port :80 returns a 301 redirect to HTTPS

  • A self signed TLS certificate regenerated per VM on first boot (SAN includes the VM public IP) — replace it with your own CA signed certificate for production

  • Automatic expiry (default 8 hours) run by a systemd timer, plus extension and MIME blacklisting and per client upload rate limiting

  • A built in self test at /opt/uguu/uguu-selftest.sh that proves the gated upload, the public download round trip and the rejection of unauthenticated uploads

  • Ubuntu 24.04 LTS base with latest security patches applied at build time

  • Azure Linux Agent for seamless cloud integration and SSH key injection

  • 24/7 cloudimg support with guaranteed 24 hour response SLA

Prerequisites

  • An Azure subscription with permission to deploy virtual machines

  • An SSH key pair for administrative access to the VM as the azureuser account

  • A Network Security Group allowing inbound TCP 443 (HTTPS) and 80 (redirect) from the networks that should reach the service, and 22 (SSH) from your management network only

  • A recommended size of Standard_B2s or larger

Step 1: Deploy from the Azure Portal

  1. Locate the Uguu on Ubuntu 24.04 LTS by cloudimg image in the Azure Marketplace and select Create.

  2. Choose your subscription, resource group and region.

  3. Select a VM size (Standard_B2s or larger) and provide your SSH public key for the azureuser account.

  4. On the Networking tab, allow inbound 443 and 80 from your users, and restrict 22 to your management network.

  5. Review and create. When the VM is running, browse to https://<your-public-ip>/.

Step 2: Deploy from the Azure CLI

You can deploy the same image from the Azure CLI. Replace the resource group, location and image URN as needed:

az vm create \
  --resource-group my-uguu-rg \
  --name uguu \
  --image <cloudimg-uguu-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
# then open the required ports
az vm open-port --resource-group my-uguu-rg --name uguu --port 443 --priority 1001
az vm open-port --resource-group my-uguu-rg --name uguu --port 80 --priority 1002

Step 3: Verify the services and the data disk

SSH in as azureuser and confirm nginx and php-fpm are active, that nginx is the only public listener, and that the dedicated data disk is mounted at /data where uploaded files are stored:

sudo systemctl is-active nginx php8.3-fpm

sudo ss -tln | grep -E ':80 |:443 '

df -h /data | tail -1

nginx listens on :80 and :443; php-fpm runs over a local unix socket (not a TCP port). The data disk (/dev/sdc) is mounted at /data.

systemctl reports nginx and php8.3-fpm both active, ss shows nginx listening on :80 and :443, and df shows the dedicated 32G data disk mounted at /data where uploads are stored

Step 4: Get your per VM upload key

Uploading is gated by a key that is unique to this VM and generated on first boot. Read it from the credentials file (the file also records the public URL and the appliance configuration; the key is shown here in full only on the VM itself):

sudo cat /root/uguu-credentials.txt

You can also confirm the appliance configuration — SQLite metadata, blobs stored under /data/uguu/files/, the 8 hour expiry, the 128 MB upload limit and rate limiting:

jq '{DB_MODE,FILES_ROOT,expireTime,expireTimeUnit,max_upload_size,RATE_LIMIT}' /var/www/uguu/dist/config.json

The uguu-credentials.txt file showing the public URL, upload endpoint and user with the upload key redacted, and the config.json showing SQLite mode, files stored under /data/uguu/files, an 8 hour expiry, a 128 MB max upload size and rate limiting enabled

Step 5: Open the uploader and sign in with your key

Browse to https://<your-public-ip>/. Because the certificate is self signed and generated per VM, your browser will warn about the certificate the first time — accept it (or install your own certificate, see Step 11). Your browser then prompts for a username and password: enter user uguu and the upload key from Step 4. You are presented with the Uguu uploader, which states the maximum upload size and the expiry window.

The Uguu uploader landing page showing the Drop or paste files button, with the notice that the maximum upload size is 128 MiB and files expire after 8 hours

Step 6: Upload a file and get a shareable link

Drag a file onto the Drop or paste file(s) area, paste from the clipboard, or click to choose a file. Uguu uploads it and shows the generated shareable link next to the file name, with a copy button. Send that link to whoever needs the file.

The Uguu uploader after uploading a file, showing the uploaded file name on the left and the generated shareable link with a copy button on the right

Step 7: Open a shared file

Opening a shared link downloads the file directly over TLS. Downloads are public by design (that is what lets you share the link), while uploading always requires your key. The file is served from the dedicated /data volume.

A shared demo image opened directly in the browser over TLS, served from the /data volume, confirming that public downloads work

Step 8: Upload from the API or a screenshot tool

Uguu also has a simple HTTP upload API, which is ideal for scripts and screenshot tools such as ShareX. POST an array of files to /upload.php; by default you get a JSON response, and you can request csv, text, html or gyazo with ?output=. Because uploads are gated, pass your key with HTTP Basic auth (user uguu). The API page on the appliance shows the endpoint for this VM:

The Uguu API documentation page showing the upload endpoint for this VM, the supported response formats, and a curl example that posts a file to the upload endpoint

From a shell you can upload with curl, passing your key (this example reads the key from the credentials file; replace 127.0.0.1 with your VM public IP when uploading from your workstation):

KEY=$(sudo grep '^uguu.upload.key=' /root/uguu-credentials.txt | cut -d= -f2-)
echo "hello from cloudimg" > /tmp/uguu-demo.txt
curl -k -s -u "uguu:$KEY" -F "files[]=@/tmp/uguu-demo.txt" "https://127.0.0.1/upload.php?output=json"

The response contains the shareable url for the uploaded file. For a screenshot tool such as ShareX, set the request URL to https://<your-public-ip>/upload.php, the file form name to files[], and add an HTTP Basic authorization header with user uguu and your key.

Step 9: Verify the upload gate and round trip

The image ships a self test that proves the whole security model end to end over TLS: an unauthenticated upload is rejected with 401, a gated upload with the key returns a share URL, the blob lands on the /data volume, and the file downloads back with identical content:

sudo /opt/uguu/uguu-selftest.sh

The uguu-selftest.sh output reporting that the ungated upload was rejected with 401, the gated upload returned a share URL, the blob landed on /data and the download round trip matched

Step 10: Confirm TLS and the upload gate

Confirm that plain HTTP redirects to HTTPS, that the unauthenticated /healthz probe answers, that the uploader page is gated (returns 401 without a key), and inspect the per VM self signed certificate:

curl -s -o /dev/null -w '%{http_code} -> %{redirect_url}\n' http://127.0.0.1/

curl -sk -o /dev/null -w 'healthz=%{http_code}\n' https://127.0.0.1/healthz

curl -sk -o /dev/null -w 'upload UI (no key)=%{http_code}\n' https://127.0.0.1/

sudo openssl x509 -in /etc/nginx/ssl/uguu.crt -noout -subject -ext subjectAltName

The /healthz probe returns 200, the uploader page returns 401 without a key (the gate is enforced), and the certificate subject and Subject Alternative Name carry this VM's IP.

curl shows plain HTTP returning a 301 redirect to https, the healthz probe returning 200, the uploader page returning 401 without a key, and openssl printing the per VM self signed certificate subject and IP Subject Alternative Name

Step 11: How the appliance is wired

  • Uguu — a PHP application deployed under /var/www/uguu/dist, served by php8.3-fpm behind nginx. The web root is dist/public.

  • SQLite — a local metadata database at /var/lib/uguu/db/uguu.sq3. It records the filename, size, hash and upload time of each file. No external database is required.

  • Data disk — a dedicated Azure data disk mounted at /data; uploaded blobs are stored under /data/uguu/files/ (the FILES_ROOT in the configuration).

  • nginx — nginx.service, terminating TLS on :443, redirecting :80 to HTTPS, gating the uploader page and /upload.php with the per VM key, and serving public downloads and the unauthenticated /healthz probe.

  • First boot — uguu-firstboot.service runs once on first boot: it generates the per VM upload key and the self signed TLS certificate, writes this VM's public address into the configuration and the documentation pages, ensures the data disk directories and database exist, and writes /root/uguu-credentials.txt.

  • Expiry — uguu-expire.timer runs checkExpire.php every 15 minutes, deleting files past their retention window from both disk and the database.

Step 12: Auto expiry and upload limits

Files expire automatically. The retention window is expireTime and expireTimeUnit in /var/www/uguu/dist/config.json (8 hours by default). To change it, edit those values, for example to keep files for 3 days, and the change takes effect on the next timer run. You can confirm the expiry timer is scheduled:

systemctl list-timers uguu-expire.timer --no-pager

Other limits also live in config.json: max_upload_size (MB), the FILTER_EXTENSIONS and FILTER_MIME blacklists (which reject executables, scripts and other risky types), and RATE_LIMIT settings. The image ships with a 128 MB limit, blacklisting enabled and rate limiting on.

Step 13: Manage the upload key

Your upload key gates the uploader page and the API. To rotate it, set a new password for the uguu user in the nginx htpasswd file and record it wherever you keep the appliance secrets (replace <new-password> with a strong secret; omit -b to be prompted instead of passing it on the command line):

sudo htpasswd -bB /etc/nginx/uguu.htpasswd uguu <new-password>

nginx picks up the change immediately, so the next upload requires the new key. Downloads are unaffected. Keep the key private: anyone with it can upload to your instance.

Step 14: Use your own domain and a trusted certificate (production)

The image ships a self signed certificate so it is secure out of the box, but browsers will warn on it. For production, point a DNS name at the VM and install a CA signed certificate. With your own domain you can obtain a free certificate from Let's Encrypt:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

Certbot installs the certificate into nginx and sets up automatic renewal.

Step 15: Security recommendations

  • Restrict SSH. Allow inbound 22 only from your management network; keep 443 (and 80 for the redirect) open to your users.

  • Keep the upload key private and rotate it. It is the only thing standing between your instance and an open public file drop. Rotate it if it may have leaked (Step 13).

  • Install a trusted certificate. Replace the self signed certificate with a CA signed one (Step 14) so users are not trained to click through warnings.

  • Keep expiry short. The shortest retention window that suits your workflow limits how long a shared file is reachable. Files delete themselves automatically.

  • Keep the image updated. Unattended security upgrades remain enabled so the OS keeps receiving patches.

Step 16: Support and Licensing

Uguu is free software distributed under the GNU General Public License v3.0. This image bundles the upstream Uguu release; the licence file is retained on the image. cloudimg packaging, the per VM upload gate, hardening and support are provided by cloudimg.

Deploy on Azure

Find this image on the Azure Marketplace and deploy it in minutes. See www.cloudimg.co.uk for the full catalogue.

Need Help?

cloudimg provides 24/7 support with a guaranteed 24 hour response SLA. Contact us through www.cloudimg.co.uk for deployment assistance, configuration help or any questions about this image.