AirTrail

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for AirTrail by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

RG="airtrail-prod"; LOCATION="eastus"; VM_NAME="airtrail-01" IMAGE_URN="sac1647283583153:airtrail-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name airtrail-vnet --address-prefix 10.100.0.0/16 --subnet-name airtrail-subnet --subnet-prefix 10.100.1.0/24 az network nsg create -g "$RG" --name airtrail-nsg az network nsg rule create -g "$RG" --nsg-name airtrail-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name airtrail-nsg --name allow-http --priority 110 \
  --destination-port-ranges 80 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:airtrail-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name airtrail-vnet --subnet airtrail-subnet --nsg airtrail-nsg --public-ip-sku Standard

Replace <sub-id> and <version> with your subscription ID and the image version shown on the listing. Replace <your-mgmt-cidr> with the network you administer from.

On the first boot of each VM, AirTrail generates its own per-instance secrets and claims its own owner account before the web port is opened. Nothing is baked into the image.

Wait a minute after first boot, then SSH in and read the credentials file (mode 0600 root:root):

sudo cat /root/airtrail-credentials.txt

The file contains everything unique to this instance:

• AIRTRAIL_USERNAME and AIRTRAIL_PASSWORD: the owner login you use in the web UI. The owner has full access, including user management.
• AIRTRAIL_URL: the web address of this instance, resolved from its public IP on first boot.
• POSTGRES_PASSWORD: the database role password. PostgreSQL is not published to any host port, so this password is used only inside the private container network.

Confirm that the services and containers are healthy:

sudo systemctl is-active docker airtrail-firstboot airtrail airtrail-postboot nginx

active active active active active

sudo docker compose -f /opt/airtrail/docker-compose.yml ps --format 'table {{.Service}}\t{{.Status}}\t{{.Ports}}'

SERVICE STATUS PORTS airtrail Up 8 minutes (healthy) 127.0.0.1:3000->3000/tcp db Up 8 minutes (healthy) 5432/tcp

The application container publishes to loopback only, and PostgreSQL has no host port at all. Host nginx on port 80 is the single public entry point.

Upstream AirTrail lets the first person who opens a new instance create the owner account. On a VM with a public IP that is a real risk, so SecureAnyCloud removes it in two independent ways.

First, airtrail-postboot.service claims the owner account itself, over the loopback port, with a password generated for this VM. AirTrail's own setup endpoint then refuses all further attempts with Owner already exists. The application code enforces this, not a configuration flag.

Second, host nginx, the only public listener, does not start until the owner exists. It is gated on a bootstrap-ready marker that the post-boot service creates only after the owner account is in place. Port 80 is therefore closed for the whole bootstrap window.

The database password is also generated on first boot, before the stack can start. The upstream sample value (DB_PASSWORD=<set-at-first-boot>) never exists on your VM. A start-up guard refuses to launch the application at all if the password is empty, too short or a known default.

ss -tln | grep -E ':(80|3000|5432) ' | awk '{print $1, $4}'

LISTEN 127.0.0.1:3000 LISTEN 0.0.0.0:80 LISTEN [::]:80

Cross-site form submissions are rejected, and anonymous visitors cannot read map data that belongs to a signed-in user:

curl -s -o /dev/null -w 'form POST without an Origin header -> %{http_code}\n' -X POST http://127.0.0.1/api/users/setup --data-urlencode username=probe --data-urlencode password=probeprobe1 --data-urlencode displayName=probe
curl -s -o /dev/null -w 'authenticated-only map API (anonymous) -> %{http_code}\n' http://127.0.0.1/api/map-styles/openaip/tiles/1/1/1

form POST without an Origin header -> 403 authenticated-only map API (anonymous) -> 401

A fresh instance has exactly one account, the owner:

sudo docker exec airtrail-db psql -w -U airtrail -d airtrail -tAc "SELECT username, role FROM \"user\"" </dev/null

admin|owner

Run the prover script that ships with the image. It exercises the whole security model through the public front door. It confirms that:

• The app answers
• Anonymous visitors are sent to the login page
• Cross-site form posts are refused
• The owner seat is taken
• A wrong password is rejected
• The per-instance password logs in and reads back real authenticated data

sudo /usr/local/sbin/airtrail-roundtrip.sh

Open http://<vm-ip>/ in your browser and sign in with the AIRTRAIL_USERNAME and AIRTRAIL_PASSWORD from the credentials file.

The map is the home view once you sign in. Every flight you log is drawn as a great-circle arc between its two airports, so your travel history builds into a picture of where you have been. The controls on the right zoom, re-centre, switch the base map and filter which flights are shown. The dock along the bottom opens the flight list, statistics and settings.

Choose Statistics in the dock for the totals AirTrail derives from your logged flights. They include the number of flights, distance flown as a fraction of the way around the globe, total time in the air, and how many airports and countries you have visited. You also get breakdowns by seat class, cabin, trip reason, continent and airline.

List flights shows every flight in date order with its airline, flight number, route, duration and seat. To record a new flight, choose Add flight in the dock. You can enter it by hand or look it up by flight number and date.