Waltz on Ubuntu 24.04 on Azure User Guide

Overview

Waltz is the FINOS open-source Enterprise Architecture tool. It gives an organisation one authoritative, queryable model of its estate: the applications it runs, the organisational units that own them, the data flows between systems, and the measurables and assessments that describe capability, cost and risk. Architects, application owners and change teams use it to explore that landscape, attest to it and report on it — instead of rediscovering it from scattered spreadsheets and diagrams.

The cloudimg image installs the official Waltz 1.84.0 release, verified against the upstream release SHA256 checksum at build time. Waltz runs as a self-contained Java application (an embedded Jetty server) under a dedicated non-root waltz service user on the OpenJDK 17 runtime, backed by a local PostgreSQL 16 database. To make the tool immediately useful, the image ships with the upstream sample landscape pre-loaded — organisational units, applications, data flows, measurables and assessments — so a launched VM opens on a populated model rather than an empty install.

Waltz is designed to run behind an authenticating gateway (its built-in login is intended for development only). The cloudimg image therefore keeps the application on the loopback path and puts nginx in front as the only public listener, requiring HTTP Basic authentication. The authenticated user is passed straight through to Waltz as a full administrator, so a single credential unlocks the whole product. No credential is baked into the image: on first boot every VM mints its own database password and its own administrator password, verifies the administrator works and confirms the guessable admin/admin default is rejected, then writes the details to /root/waltz-credentials.txt (mode 0600). Backed by 24/7 cloudimg support.

What is included:

• Waltz 1.84.0 (the official FINOS release, exploded under /opt/waltz/app) on the OpenJDK 17 runtime, run as the non-root waltz user
• nginx on :80 as the only public listener, requiring HTTP Basic authentication and passing the authenticated user to Waltz, plus an unauthenticated /health endpoint
• PostgreSQL 16 as the backing database, holding the pre-loaded sample landscape
• An nftables ruleset keeping the application port 8443 off the public interface, so nginx on :80 is the only way in
• Header-based authentication configured so the Basic-auth user is a full Waltz administrator (all roles), with zero password login accounts shipped in the image
• JVM heap sized automatically at first boot from the VM's actual memory
• A per-VM administrator password and database password, minted at first boot, in a root-only file
• waltz.service, postgresql.service, nginx.service and nftables.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

• An Azure subscription with permission to create resources
• The Azure CLI installed and signed in (az login), if you deploy from the command line
• An SSH key pair for VM access

Step 1 — Deploy from the Azure Marketplace

Find Waltz on Ubuntu 24.04 in the Azure Marketplace and select Create. Choose your subscription, resource group and region. The recommended size is Standard_B2ms (2 vCPU / 8 GiB) — Waltz and its local PostgreSQL share the VM. Open inbound port 80 (HTTP) in the networking step, then review and create.

Step 2 — Deploy from the Azure CLI

az vm create \
  --resource-group my-resource-group \
  --name my-waltz \
  --image cloudimg:waltz-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

az vm open-port --resource-group my-resource-group --name my-waltz --port 80

First boot mints the per-VM credentials and starts the services; allow a minute or two after the VM is running before signing in.

Step 3 — Connect to your VM

ssh azureuser@<vm-ip>

Step 4 — Confirm the services are running

Waltz, PostgreSQL and nginx run as systemd units. The application port 8443 is kept off the public interface by nftables — nginx on :80 is the only public listener.

systemctl is-active waltz.service postgresql.service nginx.service
curl -s -o /dev/null -w 'health: HTTP %{http_code}\n' http://localhost/health

You should see active three times and health: HTTP 200.

Step 5 — Retrieve your administrator login

The administrator username and password are unique to your VM and were written to a root-only file on first boot.

sudo cat /root/waltz-credentials.txt

The file lists WALTZ_ADMIN_USER (the sign-in name for the nginx front door), WALTZ_ADMIN_PASSWORD (unique to this VM) and the database password. Keep them somewhere safe.

You can prove the credential end-to-end from the shell. An unauthenticated request and the guessable default are both rejected; the per-VM password authenticates and returns a full-administrator identity:

curl -s -o /dev/null -w 'no credentials:   HTTP %{http_code}\n' http://localhost/api/user/whoami
curl -s -o /dev/null -w 'admin/admin:      HTTP %{http_code}\n' -u admin:admin http://localhost/api/user/whoami
curl -s -u '<WALTZ_ADMIN_USER>:<WALTZ_ADMIN_PASSWORD>' http://localhost/api/user/whoami

The first two return HTTP 401; the last returns your administrator's user record with its granted roles.

Step 6 — First sign-in

Browse to http://<vm-ip>/. Your browser will prompt for the HTTP Basic credentials — enter the WALTZ_ADMIN_USER and WALTZ_ADMIN_PASSWORD from the previous step. Waltz opens on its home page: a summary of the pre-loaded demo landscape, recent change activity, and quick links into the model.

Step 7 — Explore an application

Use the Search box in the title bar, or the Org Units menu, to open any application in the sample landscape. An application view shows its lifecycle phase, owning org unit, criticality and complexity ratings, assessments, and — down the left-hand sidebar — its data flows, costs, change initiatives, people, technology and more.

Step 8 — Trace a data flow

Waltz's core strength is modelling the flows between systems. Open any logical data flow to see its source and target applications, the data types that move across it, its provenance and its assessments — the building block of a landscape-wide data-lineage picture.

Step 9 — Browse the capability viewpoints

The Function menu opens the taxonomy viewpoints — the business-function hierarchy the landscape is mapped against, with coverage indicators and the people involved. Viewpoints are how Waltz turns a flat list of applications into a structured, navigable model of what the organisation does.

Step 10 — Confirm the pre-loaded landscape

You can see the size of the pre-loaded model, and the authentication mode, directly from the database:

sudo -u postgres psql waltz -tAc "SELECT 'applications: '||count(*) FROM application UNION ALL SELECT 'org units: '||count(*) FROM organisational_unit UNION ALL SELECT 'data flows: '||count(*) FROM logical_flow;"

The sample landscape ships with over a hundred applications, dozens of organisational units and hundreds of data flows.

The pre-loaded landscape is the upstream FINOS demo dataset, provided so the tool is useful the moment you sign in. When you are ready to model your own estate, you can clear it and import your own data through Waltz's bulk-upload screens and REST API.

Enabling HTTPS

The image serves HTTP on port 80 behind nginx. For production use, place your VM behind a TLS-terminating load balancer or reverse proxy, or add a certificate to nginx directly. With a DNS name pointed at the VM you can obtain a free certificate with certbot:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot updates the nginx site in place and sets up automatic renewal.

Backup and maintenance

Waltz's state lives entirely in its PostgreSQL database. Back it up with a standard dump:

sudo -u postgres pg_dump waltz | gzip > waltz-backup-$(date +%F).sql.gz

The OS is configured for unattended security updates. To update Waltz itself, follow the upstream release notes: replace the exploded application under /opt/waltz/app with the new release, apply the release's Liquibase changelog set to the database, and restart waltz.service.

Support

Every cloudimg image comes with 24/7 support and a deploy guide tested against the exact build. If you need help, contact the cloudimg team at www.cloudimg.co.uk.