Deployment guide

AliasVault

Overview

AliasVault is an open source, end-to-end encrypted password manager combined with a private email alias service that you host yourself. For every website you sign up to, it can generate a unique identity and a unique email alias, receive email for that alias through its own built-in mail server, and store the login in a zero-knowledge vault. Your master password never leaves your device, so the server holds only encrypted data.

This SecureAnyCloud image runs AliasVault the officially supported way: the upstream Docker Compose stack, pinned to release 0.30.1 and orchestrated by systemd. Seven containers run on a private network behind an nginx reverse proxy that terminates TLS: a Blazor web client, a REST API, an admin panel, a built-in SMTP mail server, a background task runner and a bundled PostgreSQL database.

Because AliasVault stores your most sensitive credentials, security is enforced from first boot, before the ports are reachable. A unique admin password, JWT signing key, data protection key and database password are generated for each VM, and a fresh self-signed TLS certificate is created.

What you get:

AliasVault v0.30.1, the full open source stack, pinned to the upstream release and captured into the VM
A bundled PostgreSQL database and a built-in SMTP mail server, reachable only inside a private Docker network (PostgreSQL is never published to a host port)
A web vault client, an admin panel and a REST API behind an nginx reverse proxy that terminates TLS on port 443
docker.service, aliasvault-firstboot.service and aliasvault.service as systemd units, enabled and active on boot
A unique admin password, JWT signing key, data protection key and database password generated per VM on first boot, never baked into the image
A clean, empty instance on first boot: no default account, no shipped vault and no prior data
24/7 SecureAnyCloud support

AliasVault is a trademark of its respective owner. This image is produced by SecureAnyCloud and is not affiliated with, endorsed by, or sponsored by AliasVault. It ships the unmodified upstream open source release under the GNU Affero General Public License v3.0 (AGPL-3.0). The verbatim licence and a pointer to the corresponding source ship inside the image under /usr/share/doc/sac/third-party-licences.

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) comfortably runs the full stack and is a sensible starting size. Increase the size for more users and heavier mail traffic.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 443/tcp for the web interface. Also allow 25/tcp and 587/tcp if you want to receive alias email from the internet.

The web interface is served over HTTPS with a per-VM self-signed certificate. For production, put it behind your own domain and a trusted certificate (see the final section).

Step 1 - Deploy from the Azure Marketplace

In the Azure portal, choose Create a resource and search the Marketplace for the SecureAnyCloud AliasVault offer.
Select the plan, then select Create.
On the Basics tab, pick your subscription, resource group and region, name the VM, and select Standard_B2s (or larger).
Choose SSH public key authentication with the admin username azureuser, and provide your public key.
On the Networking tab, allow inbound 22/tcp from your management network, 443/tcp for the web interface, and 25/tcp plus 587/tcp for mail.
Review and create the VM. When it is running, note its public IP address.

Step 2 - Deploy from the Azure CLI

az vm image terms accept --urn sac1647283583153:aliasvault-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-aliasvault-rg \
  --name aliasvault \
  --image sac1647283583153:aliasvault-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the ports that the web interface and mail server need. SSH is opened by default:

az vm open-port --resource-group my-aliasvault-rg --name aliasvault --port 443 --priority 900
az vm open-port --resource-group my-aliasvault-rg --name aliasvault --port 25 --priority 910
az vm open-port --resource-group my-aliasvault-rg --name aliasvault --port 587 --priority 920

Step 3 - Connect to your VM

Connect over SSH as azureuser:

ssh azureuser@<vm-ip>

Step 4 - Confirm the services are running

The systemd units start on boot. Check the orchestrating services:

systemctl is-active docker aliasvault-firstboot aliasvault

active active active

List the containers that make up the stack:

cd /opt/aliasvault && sudo docker compose ps --format 'table {{.Service}}\t{{.Status}}\t{{.Ports}}'

SERVICE STATUS PORTS admin Up 44 seconds 3002/tcp api Up 44 seconds 3001/tcp client Up 50 seconds 80/tcp, 3000/tcp postgres Up 50 seconds (healthy) 5432/tcp reverse-proxy Up 44 seconds 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp smtp Up 44 seconds 0.0.0.0:25->25/tcp, 0.0.0.0:587->587/tcp task-runner Up 44 seconds

Only the reverse proxy (80/443) and the SMTP mail server (25/587) publish host ports. PostgreSQL, the API, the admin panel and the client are reachable only inside the private Docker network.

Step 5 - Read the per-VM secrets generated on first boot

Because AliasVault stores your most sensitive credentials, this image never ships a default password. On the very first boot, before the ports are reachable, the VM generates a unique admin password, JWT signing key, data protection key and PostgreSQL password. It also creates a fresh self-signed TLS certificate.

The admin password is written to a root-only file. Read it with:

sudo cat /root/aliasvault-credentials.txt

# AliasVault (v0.30.1) - sac Azure Marketplace image ALIASVAULT_URL=https://<vm-ip>/ ALIASVAULT_ADMIN_URL=https://<vm-ip>/admin ALIASVAULT_ADMIN_USERNAME=admin ALIASVAULT_ADMIN_PASSWORD=<ALIASVAULT_ADMIN_PASSWORD>

The four secrets live under /opt/aliasvault/secrets as root-only files and are mounted read-only into the containers.

The vault itself is zero-knowledge. Each user's master password derives their encryption key on the client, so no vault key is ever stored on the server or shipped in the image.

Step 6 - Open the web vault and register your account

Browse to https://<vm-ip>/. The certificate is a per-VM self-signed certificate, so your browser warns you once. Accept it, or add your own certificate later (see the final section).

On the sign-in screen, choose Create account and register your vault with a username and a strong master password.

Your master password is the key to your zero-knowledge vault. It is never sent to the server, and nobody can recover it for you if it is lost, so store it safely.

Step 7 - Create identities and email aliases

Inside the vault, use Create to generate a new credential. AliasVault can auto-generate a full identity (name, username and a strong password) and a unique email alias for the site you are signing up to, then store it all encrypted.

When a website emails that alias, the built-in mail server receives the message and shows it against the credential. This works once you have configured a private email domain (see Step 9).

Step 8 - Sign in to the admin panel

AliasVault has a separate admin panel for managing the server: users, statistics and server settings. It is served at https://<vm-ip>/admin. Sign in with the username admin and the per-VM password from Step 5.

sudo grep -E '^ALIASVAULT_ADMIN_(USERNAME|URL)=' /root/aliasvault-credentials.txt

ALIASVAULT_ADMIN_URL=https://<vm-ip>/admin ALIASVAULT_ADMIN_USERNAME=admin

Step 9 - Receive alias email (private email domains)

To receive email at your aliases from the internet, point DNS at this VM and set your private email domains.

Add an MX record for your mail domain that points at the VM, an A record for the mail hostname, and, as recommended, an SPF/PTR record. Then list the domains in /opt/aliasvault/.env, replacing <your-domain> with your mail domain:

sudo sed -i 's/^PRIVATE_EMAIL_DOMAINS=.*/PRIVATE_EMAIL_DOMAINS=<your-domain>/' /opt/aliasvault/.env cd /opt/aliasvault && sudo docker compose up -d

The SMTP server listens on ports 25 and 587. Make sure both are open in your NSG. See the AliasVault documentation for the full DNS and deliverability setup.

Step 10 - Check the stack health from the command line

The reverse proxy redirects plain HTTP to HTTPS and serves the web client over HTTPS. The API exposes an unauthenticated health endpoint that returns OK once the database is reachable and migrations are applied. Run these checks:

echo "http -> $(curl -sk -o /dev/null -w '%{http_code}' http://127.0.0.1/)"
echo "https -> $(curl -sk -o /dev/null -w '%{http_code}' https://127.0.0.1/)"
echo "api -> $(curl -sk https://127.0.0.1/api/)"

http -> 301 https -> 200 api -> OK

Step 11 - Lock down open registration after onboarding

Public registration is enabled by default so you can create your own vault account. Once your account (and your family's) exists, disable open sign-up so nobody else can register on your instance.

Use the AliasVault management CLI that is vendored into the workspace. Run it for your <your-domain> deployment:

sudo /opt/aliasvault/install.sh configure-registration

Alternatively, set PUBLIC_REGISTRATION_ENABLED=false in /opt/aliasvault/.env and run cd /opt/aliasvault && sudo docker compose up -d.

Step 12 - Production: your own domain with TLS

For production, put AliasVault behind your own domain and a trusted certificate instead of the per-VM self-signed certificate. AliasVault ships a Let's Encrypt integration through the vendored CLI.

First, point an A record for <your-domain> at the VM. Then run:

# after <your-domain> resolves to this VM:
sudo /opt/aliasvault/install.sh configure-hostname
sudo /opt/aliasvault/install.sh configure-ssl

Keep 443/tcp open in the NSG, and keep 80/tcp open for the ACME challenge. Restrict 22/tcp to your management network. Open the mail ports (25, 587) only if you are receiving alias email.

Unattended security updates are enabled by default on this image, which keeps the OS current.

Support

SecureAnyCloud builds and supports this image. For help, contact sales@secureanycloud.com.

AliasVault is open source software under the AGPL-3.0 licence. The verbatim licence and a pointer to the corresponding source ship in the image under /usr/share/doc/sac/third-party-licences. SecureAnyCloud is not affiliated with, endorsed by, or sponsored by AliasVault.

Deploy on Azure

Launch AliasVault on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

AliasVault is an open source, self-hosted password manager combined with a private email alias service. For every website you sign up to, it can generate a unique identity and a unique email alias, receive email for that alias through its own built-in mail server, and store the login in a zero-knowledge vault. Your master password derives your encryption key in your browser and never leaves your device, so the server holds only encrypted data.

This SecureAnyCloud AMI ships the free and open source, AGPL-3.0 licensed AliasVault, run the officially supported way as the upstream containers pinned to the release. The bundled PostgreSQL database, the web vault client, the admin panel, the REST API, the mail server and a background task runner all run under one systemd service on a private container network. An nginx reverse proxy in front terminates TLS on ports 80 and 443. Every image is captured into the AMI, so your instance starts in seconds.

Because a password manager holds your most sensitive data, nothing here ships with a known secret. On first boot, before the ports are reachable, each instance generates a unique admin password, JWT signing key, data protection key and database password, plus a fresh self-signed TLS certificate.

What you get:

AliasVault v0.30.1, the full open source stack, pinned to the upstream release
A bundled PostgreSQL database, reachable only inside the private container network (never published to a host port)
A web vault client, an admin panel and a REST API behind an nginx reverse proxy that terminates TLS
A built-in mail server listening on ports 25 and 587 for receiving alias email
A unique admin password, JWT key, data protection key and database password generated per instance on first boot
A fresh self-signed TLS certificate generated per instance
24/7 SecureAnyCloud support

AliasVault is a trademark of its respective owner. This image is produced by SecureAnyCloud and is not affiliated with, endorsed by, or sponsored by AliasVault. It ships the free and open source AGPL-3.0 licensed self-hosted software, unmodified. The verbatim licence text and a pointer to the corresponding source ship inside the image under /usr/share/doc/sac/third-party-licences.

Connecting to your instance

This listing offers one or more operating-system variants. Connect over SSH as the default login user for your variant, using your EC2 key pair:

OS variant Login user Example

Ubuntu 24.04 LTS ubuntu ssh -i your-key.pem ubuntu@<instance-public-ip>

Subscribe and launch from AWS Marketplace

On the product page in AWS Marketplace, choose Continue to Subscribe, accept the terms, then choose Continue to Configuration.
Choose the region and the m5.large instance type (recommended), then choose Continue to Launch.
Under Network settings, attach a security group that allows inbound TCP 22 (SSH) from your IP, TCP 443 (the web vault) and TCP 80 (which redirects to 443). To receive alias email, also allow TCP 25 and TCP 587 to the mail server.
Select your EC2 key pair and launch.

Launch from the AWS CLI (alternative)

You can also launch the subscribed AMI directly. Replace the AMI ID, key name, security group and subnet with your own:

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids <sg-id> \
  --subnet-id <subnet-id> \
  --metadata-options "HttpTokens=required" \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=aliasvault}]'

Then connect over SSH as ubuntu, as shown in the table above.

Confirm the services are running

SSH in as ubuntu and confirm that Docker and the AliasVault stack are active:

systemctl is-active docker.service aliasvault.service

All three of the core units report active. List the running containers:

sudo docker ps --format '{{.Names}} {{.Status}}'

Seven containers should be running: postgres, client, api, admin, smtp, reverse-proxy and task-runner.

PostgreSQL is deliberately not published to a host port. Only the reverse proxy (80/443) and the mail server (25/587) listen externally:

sudo ss -tln | grep -E ':(80|443|25|587) '

Retrieve your per-instance credentials

On the first boot of every instance, a unique admin-panel password and the four cryptographic secrets are generated and written to a root-only file. Read it with:

sudo cat /root/aliasvault-credentials.txt

The file (mode 0600 root:root) holds ALIASVAULT_URL and ALIASVAULT_ADMIN_URL. It also holds ALIASVAULT_ADMIN_USERNAME (admin) and ALIASVAULT_ADMIN_PASSWORD (the password for the admin panel).

None of these values ship in the image. Every value is unique to this instance, so no two instances share a credential and there is no default login. The vault master password you choose in the next step is never written here, because it never leaves your browser.

Create your vault

Open the web vault in your browser at https://<instance-public-ip>/. The certificate is a per-instance self-signed certificate, so your browser warns you once. Accept it to continue.

Choose Create new vault, accept the terms, pick a username and set a strong master password.

Your master password encrypts your vault and cannot be recovered. AliasVault derives your encryption key from it in your browser (Argon2id), so if you forget it, your data is permanently inaccessible. Store it in a safe place.

Once your vault is initialised, you land on the vault view, where your logins and aliases are listed:

Generate an identity and email alias

Choose + New to add an item. AliasVault can store a Login, generate a full Alias (a random identity with its own private email address), or hold a Card or Note.

For a new sign-up, generate an alias so the site never sees your real identity or email address:

Receive email at your aliases

The Emails view lists every message received by your private alias addresses.

To receive real mail, point DNS for your own domain at this instance. Add the domain to PRIVATE_EMAIL_DOMAINS in /opt/aliasvault/.env, and make sure inbound TCP 25 is open to the mail server:

The admin panel

The built-in admin panel is served at https://<instance-public-ip>/admin. Sign in with the username admin and the per-instance ALIASVAULT_ADMIN_PASSWORD from your credentials file.

The panel shows server activity, registered users, mail and logs, and lets you manage server settings:

Lock down open registration

Public registration is enabled by default so you can create your own vault account on first use. Once your account exists, disable open sign-up so no one else can register on your server:

sudo /opt/aliasvault/install.sh configure-registration

Alternatively, set PUBLIC_REGISTRATION_ENABLED=false in /opt/aliasvault/.env and restart the stack:

cd /opt/aliasvault && sudo docker compose up -d

Use a trusted TLS certificate

The image ships a per-instance self-signed certificate, so HTTPS works out of the box. For production, put the instance behind a domain name and a trusted certificate.

Point DNS at the instance. Then either terminate TLS at an AWS load balancer in front of the instance, or configure a certificate for AliasVault directly with the vendored management CLI:

sudo /opt/aliasvault/install.sh configure-ssl

Security model

No known credential ships. On first boot, before the ports are reachable, AliasVault generates a unique admin password, JWT signing key, data protection key and database password for this instance, plus a fresh self-signed TLS certificate.
Zero-knowledge vault. Your master password derives your encryption key in your browser (Argon2id + SRP). The server stores only encrypted data and never sees your master password or your vault key.
PostgreSQL is never exposed. The database listens only inside the private container network. Only the reverse proxy (80/443) and the mail server (25/587) are reachable from outside.
Clean first boot. Build-time state is wiped before the image is captured, so the database, vault, mail, secrets and TLS key are all created fresh on your instance.

You can confirm the front door end to end at any time. The reverse proxy redirects HTTP to HTTPS and serves the web client over HTTPS. The API reports healthy, which proves that the database is reachable and migrations have been applied:

curl -sk -o /dev/null -w 'web: HTTP %{http_code}\n' https://127.0.0.1/

Managing the service

Check status: systemctl status aliasvault.service
Configuration and per-instance secrets live under /opt/aliasvault (.env, secrets/, docker-compose.yml)
The bundled AliasVault management CLI is at /opt/aliasvault/install.sh (configure-registration, configure-ssl, configure-hostname, reset-admin-password, update)
The AGPL-3.0 licence text and source pointer ship at /usr/share/doc/sac/third-party-licences

Support

SecureAnyCloud provides 24/7 technical support for this product by email and live chat, with a one-hour average response for critical issues. We help with deployment, DNS and mail configuration, TLS termination, backups, user management and scaling.

Email: sales@secureanycloud.com
Live chat: available 24/7

AliasVault is free and open source under the GNU Affero General Public License v3.0. There is no per-seat fee for the software. The SecureAnyCloud charge covers packaging, security patching, image maintenance and 24/7 support.

Deploy on AWS

Launch AliasVault Password Manager and Email Aliases with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS