RSpace 2.26 on Ubuntu 24.04 LTS

Why the cloudimg image

RSpace seeds its own administrator and secondary admin accounts with passwords that are published in the project's public documentation, allows anyone to self register out of the box, and leaves its monitoring console outside the application login. Running the upstream package as shipped therefore puts a server on the network with credentials anybody can look up. cloudimg closes every one of those gaps before the machine is ever reachable. A unique administrator password, database password, monitoring password and TLS certificate are generated on the first boot of every machine, the published default logins are rotated away before the image is captured, and the web interface is held behind a holding page until that provisioning finishes, so there is no window in which a known credential is live and no two deployments share a secret or a private key. Self registration is switched off, the monitoring console is restricted to the machine itself, and the database and application server are bound to the loopback interface so only SSH, HTTP and HTTPS answer from outside. Traffic is served over TLS by default rather than in clear text. Because RSpace validates the origin of every save against the address it is configured with, a name change that would otherwise leave the interface loading but silently failing to save is handled by a single supplied command. The base is fully patched with unattended security updates left enabled, and every deployment is paired with a step by step deploy guide verified against this exact build and backed by 24/7 cloudimg support.