SecureAnyCloud
Deployment guide

Accent

Overview

Accent is an open-source, developer-oriented translation and localisation management platform. It turns the translation files already in your codebase (JSON, YAML, gettext PO, Android XML, Apple .strings, XLIFF, CSV, Java properties and more) into a shared workspace where developers, translators and reviewers work from the same source of truth. Files move in and out over a sync and export API, so Accent fits into your existing build pipeline, and every key keeps a full history of who changed what and when.

This SecureAnyCloud image runs the free, open-source, BSD 3 Clause licensed Accent release on Ubuntu 24.04 on Azure, in the officially supported way: the upstream container pinned by image digest, paired with PostgreSQL 16. Both images are captured into the VM, so your instance starts in seconds with nothing to download.

Accent has no password authentication of its own, so the image does not leave it open. Accent binds to the loopback interface, PostgreSQL publishes no host port, and nginx on port 80 is the single public listener, gated by a unique web credential generated on the first boot of every VM. The Phoenix session signing key, the cookie signing salt, the machine translation vault key and the database password are also generated per instance on first boot, replacing the published upstream defaults.

Accent is a trademark of its respective owner. This image is produced by SecureAnyCloud and is not affiliated with, endorsed by, or sponsored by Mirego or the Accent project. It ships the free, open-source BSD 3 Clause licensed software, unmodified.

What you get:

  • Accent 1.30.4: the official upstream release container, pinned by image digest, with the compiled web application bundle built in
  • PostgreSQL 16: the application database, on a private container network with no host port published
  • nginx: the single public listener on port 80, gated by a per-instance web credential
  • First-boot secret generation: session signing key, cookie signing salt, machine translation vault key, database password and web credential, all unique to each VM
  • A bundled self-test: imports a translation file and reads the exact strings back out, proving the platform works end to end
  • A side-by-side editor with comments and a review state for each key, conflict detection when a source string changes under an existing translation, versioned releases, linting for problems such as missing interpolation variables, and per-project collaborator roles
  • A GraphQL API and a command-line client, so a project can be synchronised from continuous integration on every merge
  • 24/7 SecureAnyCloud support

Prerequisites

  • An Azure subscription with permission to create virtual machines
  • An SSH key pair for administrative access
  • A network security group (NSG) that allows inbound TCP 22 (SSH) and TCP 80 (web UI) from your own address ranges
  • A VM size of Standard_B2s (2 vCPU, 4 GB RAM) or larger
1

Deploy from the Azure Portal

  • Open the Azure Marketplace and search for Accent on Ubuntu 24.04 LTS by SecureAnyCloud.
  • Select Create, then choose your subscription, resource group and region.
  • Pick a VM size of Standard_B2s or larger.
  • Under Administrator account, select SSH public key and paste your public key.
  • Under Inbound port rules, allow SSH (22) and HTTP (80).
  • Select Review + create, then Create.
2

Deploy from the Azure CLI

az group create --name accent-rg --location eastus
az vm image terms accept --urn sac1647283583153:accent-ubuntu-24-04:default:latest
az vm create \
  --resource-group accent-rg \
  --name accent-vm \
  --image sac1647283583153:accent-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group accent-rg --name accent-vm --port 80 --priority 1010
3

Connect to your VM

ssh azureuser@<vm-ip>
4

Confirm the services are running

Check the five units that make up the deployment: docker, accent-firstboot (generates this VM's secrets), accent (the compose stack), accent-postboot (bootstraps the administrator account) and nginx.

systemctl is-active docker accent-firstboot accent accent-postboot nginx

All five report active. The two containers should both be up:

sudo docker ps --format '{{.Names}}\t{{.Image}}\t{{.Status}}'
5

Confirm the network exposure

Accent is deliberately not reachable directly. Only nginx listens on a public address. Run:

ss -tln | grep -E ':(80|4000|5432) '

You will see 127.0.0.1:4000 for Accent and 0.0.0.0:80 for nginx. PostgreSQL does not appear. It publishes no host port and is reachable only from the Accent container on a private network.

6

Read the per-instance credentials

Every VM generates its own secrets on first boot and writes them to a file that only root can read. Print it with:

sudo cat /root/accent-credentials.txt

The file records the web credential (WEB_USER and WEB_PASSWORD), the administrator email address for signing in to Accent, and this VM's URL. Confirm that the file is locked down:

ls -l /root/accent-credentials.txt
stat -c '%a %U:%G %n' /root/accent-credentials.txt
7

Understand the security model

Read this step first: Accent's authentication model is unusual.

Accent has no password login of its own. Out of the box, its only ready-to-use sign-in method is a passwordless email prompt. You type any email address and you are signed in, with no secret. Every real identity provider that Accent supports (GitHub, GitLab, Google, Slack, Discord, Microsoft and generic OIDC) requires an OAuth application that only you can register, so those credentials cannot be included in a shared Marketplace image.

On a public IP address, that default would let anyone who can reach the port sign in. This image therefore puts a gate in front of Accent:

  • Accent binds to 127.0.0.1:4000 and is not directly reachable.
  • PostgreSQL publishes no host port.
  • nginx on port 80 is the only public listener. It requires HTTP Basic authentication with this VM's unique WEB_USER and WEB_PASSWORD.

As a result, you sign in twice: once at the browser credential prompt, then once with the Accent email login. Verify the gate yourself:

curl -s -o /dev/null -w 'no credential: HTTP %{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'wrong credential: HTTP %{http_code}\n' -u '<WEB_USER>:definitely-wrong' http://127.0.0.1/

Both requests return 401. With the real credential, the request returns 200:

curl -s -o /dev/null -w 'per VM credential: HTTP %{http_code}\n' -u '<WEB_USER>:<WEB_PASSWORD>' http://127.0.0.1/

The image also ships a self-test that proves the whole platform works, not just that a page loads. It signs in, creates a project and imports a translation file that it writes itself. It then reads the strings back and checks the exact values and count, and confirms that an unauthenticated import writes nothing. Run it with:

sudo /usr/local/sbin/accent-roundtrip.sh
8

Open Accent and sign in

Browse to your VM:

<ACCENT_URL>

Your browser first asks for the web credential. Enter WEB_USER and WEB_PASSWORD from Step 6. Accent's own sign-in page then appears.

Enter the ADMIN_EMAIL value from your credentials file and select Enter an email and login. Accent opens the projects list.

9

Create your first project

Select New project, enter a name and choose the main language of your source strings. This language becomes the project's master revision, and Accent tracks every other language you add against it.

10

Sync a translation file

Import files through Accent's sync endpoint. The command-line client and your continuous integration pipeline make the same call. The language parameter is required alongside document_format and file. Create a sample file:

printf '{"app.title":"Northwind Field Service","nav.jobs":"Jobs"}' > /tmp/en.json

Push it, replacing the project ID with your own from the browser address bar:

curl -s -o /dev/null -w 'sync: HTTP %{http_code}\n' \
  -u '<WEB_USER>:<WEB_PASSWORD>' \
  -b /tmp/accent-session -c /tmp/accent-session \
  -X POST '<ACCENT_URL>sync' \
  -F 'project_id=<your-project-id>' \
  -F 'document_path=en' \
  -F 'document_format=simple_json' \
  -F 'language=en' \
  -F 'file=@/tmp/en.json;type=application/json'

After the sync completes, open All strings in the project sidebar to see every key with its text and review state.

11

Edit and review a string

Select a key to open its editor. You can change the text, mark it as reviewed, discuss it with a collaborator in the conversation tab, and inspect every past edition.

12

Export a file back out

Export is the mirror of sync. Your build pipeline calls it to pull finished translations back into the codebase. The language parameter is required here too:

curl -s -u '<WEB_USER>:<WEB_PASSWORD>' -b /tmp/accent-session \
  '<ACCENT_URL>export?project_id=<your-project-id>&document_path=en&document_format=simple_json&language=en&inline_render=true'
13

Wire up real single sign-on

The web credential gate exists because Accent ships no password login. To replace the passwordless email login with a real identity provider, register an OAuth application with your provider, then add its credentials to this VM.

Accent reads credentials from the environment. Add the keys to the per-instance environment file and the matching entries to the compose file:

sudo nano /etc/accent/accent.env

For GitHub, add GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET. For a generic OIDC issuer, add OIDC_CLIENT_ID, OIDC_CLIENT_SECRET and OIDC_DISCOVERY_URI. Google, GitLab, Slack, Discord and Microsoft follow the same pattern. Then reference those variables in the accent service's environment: block:

sudo nano /etc/accent/compose.yaml

Restart the stack to apply the changes:

sudo systemctl restart accent

Set the callback URL at your provider to <ACCENT_URL>auth/<provider>/callback. Once your provider works, remove DUMMY_LOGIN_ENABLED from the compose file to disable the passwordless email login. If your provider is then the only way in, you can also drop the auth_basic lines from /etc/nginx/sites-available/accent.

No third-party credentials ship in this image, and no single sign-on is configured out of the box.

14

Manage the service

Check the service status and read the application logs:

sudo systemctl status accent --no-pager
sudo docker logs accent --tail 50

Restart or stop the whole stack with sudo systemctl restart accent or sudo systemctl stop accent.

15

Use your own domain and HTTPS

Accent is served over plain HTTP on port 80 so that it works as soon as the VM boots. For production, point a DNS name at the VM and terminate TLS in front of it.

After you add a certificate, set CANONICAL_URL in /etc/accent/accent.env to your https:// address and restart. Links in emails and authentication redirects then use your domain. Because the scheme is HTTPS, Accent also enables secure cookies automatically.

16

Security recommendations

  • Restrict inbound port 80 to the networks that need it.
  • Put TLS in front of the VM before you use it with real content, so that neither the web credential nor session cookies travel in clear text.
  • Replace the passwordless email login with a real identity provider as soon as practical (Step 13).
  • Set RESTRICTED_PROJECT_CREATOR_EMAIL_DOMAIN to limit who can create projects.
  • Keep /root/accent-credentials.txt at mode 0600 and never copy it to a shared system.
  • Back up the accent_pgdata Docker volume, which holds every project, translation and revision.
17

Support and Licensing

Accent is open-source software distributed under the BSD 3 Clause Licence (Copyright Mirego). The image also carries these components, all redistributed unmodified:

  • The LanguageTool grammar engine, licensed under LGPL 2.1, which Accent bundles for its linting checks
  • Hunspell and its dictionaries
  • Erlang/OTP and Elixir, under Apache 2.0
  • PostgreSQL 16, under the PostgreSQL Licence
  • Docker Engine, under Apache 2.0
  • nginx, under the BSD 2 Clause Licence

The shipped set contains no AGPL, SSPL or source-available component.

SecureAnyCloud provides 24/7 support for this image. Upstream project documentation is at github.com/mirego/accent.

Deploy on Azure

Find Accent on Ubuntu 24.04 LTS by SecureAnyCloud on the Azure Marketplace.

Deploy on Azure

Launch Accent on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure