Vane on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and operation of Vane on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Vane is an open source, MIT licensed AI answering engine, known as Perplexica until the project was renamed. You ask a question in plain language; Vane searches the web, reads the results and writes an answer with numbered citations that link back to its sources, so you can check every claim.

The image runs the whole stack on one VM:

• Vane is the web application and API you use: questions and follow ups, three search modes (Speed, Balanced, Quality), web, discussion and academic sources, file uploads, a Discover news feed and a Library of past conversations
• SearXNG is a private metasearch engine that Vane queries for results. It runs on the VM itself, so your searches do not go through a third party search API and no search API key is needed
• Chrome Headless Shell lets Vane read the full text of web pages in Quality mode, and when you ask it to summarise a specific URL
• A small local embedding model ranks search results and searches your uploaded files without any key

The answers themselves are written by the model provider you connect: OpenAI, Anthropic, Google Gemini, Groq, any OpenAI compatible service, or a model server you run yourself such as Ollama, LM Studio or Lemonade. No chat model is bundled. Vane asks a local model for a 32,000 token context on every request and runs several model calls per answer, so a model running on the CPU of a general purpose VM is too slow and too memory hungry to be useful; a hosted provider, or your own GPU server, gives fast answers on a small VM.

No password, key or certificate is baked into the image. Vane has no sign in of its own, so this image puts the whole application behind a login: first boot creates an admin user with a password generated uniquely for each VM, a TLS certificate for the VM and a fresh SearXNG secret key. Nothing answers until first boot has done this, and first boot proves that an anonymous caller and a wrong password are refused before it marks the VM ready. Backed by 24/7 cloudimg support.

Vane (formerly Perplexica) is developed by ItzCrazyKns and its contributors under the MIT licence, and SearXNG by the SearXNG project under the AGPL-3.0. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by the Vane or SearXNG projects or by any model provider. The names are used here solely to identify the software this image contains.

What is included:

• Vane 1.12.2, built from the upstream v1.12.2 release on Node.js 24 LTS, running as a dedicated vane service account on 127.0.0.1:3000
• SearXNG at a pinned commit with its Python dependencies installed from a hash locked list, running as a dedicated searxng account on 127.0.0.1:8888, with the JSON API Vane needs switched on
• Chrome Headless Shell for reading web pages, and the all-MiniLM-L6-v2 embedding model already on disk
• nginx terminating HTTPS on 443 with a per-VM certificate and a per-VM login, redirecting 80 to HTTPS
• Vane and SearXNG blocked from reaching the Azure metadata service and the Azure wire server, so a crafted link cannot read the VM's identity or tokens
• Unattended security upgrades left on for the operating system

Prerequisites

• An Azure subscription with permission to create VMs
• A Standard_B2ms VM (2 vCPU, 8 GiB) or larger is recommended. Standard_B4ms gives more headroom for Quality mode, which opens several web pages at once
• An account with a model provider (an API key for OpenAI, Anthropic, Google Gemini, Groq or another OpenAI compatible service), or your own Ollama, LM Studio or Lemonade server that the VM can reach
• Inbound TCP 443 (and 80 for the redirect) open only to the networks you connect from, plus 22 for SSH administration
• An SSH key pair for administrative access

Step 1: Deploy from the Azure Portal

1. In the Azure Portal, search the Marketplace for Vane on Ubuntu 24.04 LTS and select Create.
2. Choose your subscription, resource group and region.
3. Set the VM size to Standard_B2ms or larger.
4. Under Administrator account, select SSH public key and supply your own key.
5. Under Inbound port rules, allow HTTPS (443), HTTP (80) and SSH (22), then restrict all three to your own address ranges on the networking blade.
6. Review and create.

Step 2: Deploy from the Azure CLI

az vm image terms accept --urn cloudimg1647283583153:vane-ubuntu-24-04:default:latest

az vm create \
  --resource-group my-resource-group \
  --name my-vane \
  --image cloudimg1647283583153:vane-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard

# Open HTTPS (and the HTTP redirect) to YOUR network only.
MY_CIDR="203.0.113.0/24"   # replace with your own range
az network nsg rule create \
  --resource-group my-resource-group \
  --nsg-name my-vaneNSG \
  --name allow-https-from-office --priority 1010 \
  --source-address-prefixes "${MY_CIDR}" \
  --destination-port-ranges 80 443 --protocol Tcp --access Allow

Step 3: Connect to your VM

ssh azureuser@<vm-ip>

Step 4: Confirm the services are running

First boot takes under a minute. It generates this VM's login, certificate and SearXNG secret, starts the services and proves the login gate before it finishes.

# Every unit reports "active". vane-firstboot is a oneshot that stays active (exited).
systemctl is-active vane-firstboot searxng vane nginx

# Only SSH (22) and nginx (80, 443) listen publicly. Vane (3000) and SearXNG (8888)
# listen on loopback, and port 53 is the operating system's local DNS resolver.
sudo ss -lntH | awk '{print $4}' | sort -u

Expected output:

active
active
active
active
0.0.0.0:22
0.0.0.0:443
0.0.0.0:80
127.0.0.1:3000
127.0.0.1:8888
127.0.0.53%lo:53
127.0.0.54:53
[::]:22
[::]:443
[::]:80

Step 5: Read this VM's login

Everything in this file was generated on this VM at first boot.

sudo cat /root/vane-credentials.txt

# Vane - per-VM login generated on first boot (...).
# Keep this file private. Change the password with: sudo htpasswd -B /etc/nginx/vane.htpasswd admin
VANE_URL=https://<vm-ip>/
VANE_USERNAME=admin
VANE_PASSWORD=<VANE_PASSWORD>

Step 6: Sign in and connect your model provider

1. Open VANE_URL from the credentials file in your browser. The certificate is self-signed and generated for this VM, so your browser will warn you the first time. Accept it for this address, or follow Step 12 to use your own domain and a trusted certificate.
2. Your browser asks for a username and password. Enter admin and VANE_PASSWORD.
3. On the first visit Vane opens its setup screen. Select Add Connection, choose the connection type and fill it in:
4. OpenAI, Anthropic, Gemini or Groq: a name for the connection and your API key. For any other OpenAI compatible service, choose OpenAI and change the Base URL
5. Ollama, LM Studio or Lemonade: the base URL of your model server, for example http://10.0.1.5:11434 for an Ollama server on your virtual network

1. Select Next. Choose the chat model that will write answers, and keep Transformers - all-MiniLM-L6-v2 as the embedding model unless your provider offers one you prefer. The Transformers models run on the VM and need no key.

1. Select Finish. You land on Vane's search page. You can add, edit or remove connections later from Settings (the gear at the bottom of the sidebar), under Models.

Costs. Your provider bills you for the tokens Vane uses. Every answer makes several model calls, and Balanced and Quality modes make more than Speed. Vane can also run an extra image and video search after each answer; if you want fewer calls, turn off Auto video & image search under Settings > Preferences. Most providers let you set a monthly spending limit on the key you use here.

Step 7: Understand the access model

• Login. Vane itself has no accounts and no sign in. Upstream treats it as a single user app on a trusted network, and an exposed instance lets anyone read its settings, including your provider API keys, and spend on them. In this image nginx requires a login for every page and API route. The password is stored as a bcrypt hash in /etc/nginx/vane.htpasswd; the plain text exists only in the root-only credentials file. Everyone who signs in sees the same Vane, with the same connections and history, so share the login only with people you would share the API key with.
• Network. nginx is the only public listener: it serves Vane on port 443 with a certificate generated for this VM, and port 80 only redirects to HTTPS. Vane and SearXNG listen on 127.0.0.1 only.
• Brute force. nginx limits each client address to 20 requests a second.
• Outbound requests. Vane fetches web pages and talks to your model provider, and SearXNG queries search engines. Both services are blocked from the Azure Instance Metadata Service (169.254.169.254) and the Azure wire server (168.63.129.16), so a link that points at them cannot read this VM's identity or managed identity tokens. Private address ranges stay reachable on purpose, so Vane can use a model server elsewhere on your network.

You can check the login from the VM itself:

PW=$(sudo sed -n 's/^VANE_PASSWORD=//p' /root/vane-credentials.txt)
code() { curl -sk -o /dev/null -w '%{http_code}' "$@"; }
echo "anonymous       : $(code https://127.0.0.1/)"
echo "wrong password  : $(code -u admin:wrong-password-123 https://127.0.0.1/)"
echo "this VM's login : $(printf 'user = "admin:%s"\n' "$PW" | code -K - https://127.0.0.1/)"
echo "plain HTTP      : $(code http://127.0.0.1/)"

Expected output:

anonymous       : 401
wrong password  : 401
this VM's login : 200
plain HTTP      : 301

Step 8: Ask questions

Type a question on the search page and press Enter. Vane shows the sources it found first, then writes the answer with numbered citations; select a source card to open the page it came from. Ask follow ups in the box at the bottom of the answer.

• Modes. Speed answers from search snippets in one or two research steps. Balanced does more searching. Quality goes further and opens the most relevant pages in Chrome Headless Shell to read them in full, which takes longer and uses more tokens.
• Sources. Choose web, discussions or academic sources from the box under the question, or name a site in your question to focus on it.
• Files. Attach PDFs, documents or text files with the paperclip and ask questions about them. Uploaded files are searched with the local embedding model.
• Read a page. Ask Vane to summarise a specific URL and it reads that page.
• Library. Every conversation is saved on the VM and listed in the Library, where you can reopen or delete it.

Step 9: Use the API

Vane's search API is the same one the web page uses, behind the same login. List the connections to find the provider and model identifiers it needs:

PW=$(sudo sed -n 's/^VANE_PASSWORD=//p' /root/vane-credentials.txt)
printf 'user = "admin:%s"\n' "$PW" | curl -sk -K - https://127.0.0.1/api/providers \
  | jq -r '.providers[] | "\(.name)  chat models: \(.chatModels|length)  embedding models: \(.embeddingModels|length)"'

On a new VM only the built in Transformers connection is listed; the connection you added in Step 6 appears after it:

Transformers  chat models: 0  embedding models: 3

Then ask a question from any machine that can reach the VM, using the provider id and model key values from /api/providers:

curl -sk -u 'admin:<VANE_PASSWORD>' https://<vm-ip>/api/search \
  -H 'Content-Type: application/json' -d '{
    "query": "What is the capital city of Australia?",
    "sources": ["web"],
    "optimizationMode": "speed",
    "stream": false,
    "history": [],
    "chatModel":      {"providerId": "<your-connection-id>", "key": "<chat-model-key>"},
    "embeddingModel": {"providerId": "<transformers-connection-id>", "key": "Xenova/all-MiniLM-L6-v2"}
  }'

The reply is a JSON object with the answer in message and the cited pages in sources. Set "stream": true to receive the answer as it is written, one JSON object per line.

Step 10: Use a model server on your own network

Vane can use a model server you run yourself, for example Ollama on a GPU VM in the same virtual network. On that server:

• Ollama must listen on an address the Vane VM can reach, for example by setting OLLAMA_HOST=0.0.0.0:11434 in its service, and its network security group must allow port 11434 from the Vane VM only. Ollama has no authentication of its own
• Pull the models you want there, for example ollama pull qwen3:8b. Choose a model with tool calling support, because Vane's research step uses tools

Then add an Ollama connection in Vane (Settings > Models > Add Connection) with the base URL http://<server-private-ip>:11434. Vane asks Ollama for a 32,000 token context on every request, so size the model server's memory for that context, not only for the model weights.

Step 11: The search backend

SearXNG runs on the VM and only Vane talks to it. Its settings live in /etc/searxng/settings.yml, which changes only what differs from SearXNG's defaults. You can query it directly from the VM:

curl -s 'http://127.0.0.1:8888/search?q=azure+virtual+machines&format=json' | jq '.results | length'

20

To enable or disable search engines, edit /etc/searxng/settings.yml (see the SearXNG documentation for the engines: list) and restart the service:

sudo nano /etc/searxng/settings.yml
sudo systemctl restart searxng

Step 12: Use your own domain and certificate

1. Point a DNS record, for example vane.example.com, at the VM's public IP address and allow port 80 from the internet while the certificate is issued.
2. Install certbot and request a certificate with the webroot nginx already serves for ACME challenges:

sudo apt-get install -y certbot
sudo certbot certonly --webroot -w /var/www/html -d vane.example.com

1. Point nginx at the new certificate and reload it:

sudo sed -i 's#/etc/vane/tls/server.crt#/etc/letsencrypt/live/vane.example.com/fullchain.pem#; s#/etc/vane/tls/server.key#/etc/letsencrypt/live/vane.example.com/privkey.pem#' /etc/nginx/sites-available/vane
sudo nginx -t && sudo systemctl reload nginx

Step 13: Change the password and add users

The login is a standard nginx password file. To set a new password for admin, or to add a separate login for a colleague, run htpasswd and type the password when prompted:

sudo htpasswd -B /etc/nginx/vane.htpasswd admin
sudo htpasswd -B /etc/nginx/vane.htpasswd alice

nginx reads the file on every request, so no restart is needed. Remove a login with sudo htpasswd -D /etc/nginx/vane.htpasswd alice. Update /root/vane-credentials.txt if you change the admin password, or delete that file once you have stored the password somewhere safe.

Step 14: Day-2 operations

The exact versions in the image are recorded on the VM:

cat /usr/share/vane-appliance/VERSIONS

vane=1.12.2
vane_commit=9e8d883768c43520464345fefe58654f5cee451b
searxng_commit=b00212a8366131936856b726ed4dd9bd281e4d7e
chrome_headless_shell=155.0.8059.79
embedding_model=Xenova/all-MiniLM-L6-v2@751bff37182d3f1213fa05d7196b954e230abad9
node=v24.22.0

• Logs. sudo journalctl -u vane -f shows Vane's log, sudo journalctl -u searxng -f SearXNG's, and /var/log/nginx/ the web server's.
• Restart. sudo systemctl restart vane (or searxng, nginx).
• Back up. Vane keeps its settings, connections (including your API keys), conversation history and uploaded files in /var/lib/vane/data. Back up that directory, for example with sudo tar -C /var/lib/vane -czf vane-data-backup.tgz data, and keep the archive private because it contains your keys. Azure Backup or disk snapshots of the VM also work.
• Updates. Unattended upgrades install Ubuntu security updates automatically. cloudimg publishes new image versions with updated Vane releases.

Troubleshooting

• The browser keeps asking for a password. Use the username admin and VANE_PASSWORD from /root/vane-credentials.txt exactly; the password is case sensitive.
• "No chat models found". No chat connection is set up yet, or the provider rejected the key. Open Settings > Models, check the connection and its API key or base URL, and make sure at least one chat model is listed.
• An Ollama or LM Studio connection lists no models. The VM cannot reach the server. From the VM, curl http://<server-private-ip>:11434/api/tags should list the models; if it does not, check the server's listen address and its network security group.
• Answers are slow or Quality mode times out. Quality mode reads several pages and makes more model calls. Try Speed or Balanced mode, a faster model, or a larger VM.
• No search results. Check SearXNG with curl -s 'http://127.0.0.1:8888/search?q=test&format=json' | jq '.results | length' and its log with sudo journalctl -u searxng -n 50. Some search engines rate limit cloud addresses; enabling more engines in /etc/searxng/settings.yml helps.

Support

cloudimg provides 24/7 support for this image. Contact support@cloudimg.co.uk with your VM size, region and a description of the issue.