Ant Media Server

Step 1 - Launch the VM

Launch the VM from the Azure Marketplace listing or from the Azure CLI. Standard_B2s is the recommended size for evaluation and light streaming. Choose a larger size for production encoding workloads.

az group create --name ant-media-rg --location eastus
az vm image terms accept --urn sac1647283583153:ant-media-server-ubuntu-24-04:default:latest
az vm create \
  --resource-group ant-media-rg \
  --name ant-media-vm \
  --image sac1647283583153:ant-media-server-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
# Open the management panel (nginx :80) and SSH. The extra streaming ports are opened in Step 6.
az vm open-port --resource-group ant-media-rg --name ant-media-vm --port 80 --priority 900

Note the public IP that az vm create prints. This guide uses it as <vm-ip>.

Step 2 - Confirm the services are running

SSH in as azureuser and confirm that the units are active. ant-media-server-firstboot is a oneshot unit, so active means it ran to completion and created this VM's admin account.

systemctl is-active antmedia nginx ant-media-server-firstboot

Expected output:

active active active

Confirm that Ant Media is listening on 5080 and that nginx is the public listener on 80:

sudo ss -tlnp | grep -E ':80 |:5080 '

Step 3 - Retrieve this VM's admin password

First boot generated this VM's admin password and wrote it to a root-owned file with mode 0600. Check the file, then read it:

sudo ls -l /root/ant-media-server-credentials.txt

sudo cat /root/ant-media-server-credentials.txt

The file contains the panel URL, AMS_ADMIN_USER (the email admin@sac.local) and AMS_ADMIN_PASSWORD.

Store the password in your password manager. The value is unique to this VM, and nothing else on the VM shows it to you again in plain text.

Step 4 - Verify the server is answering

Ant Media's REST API answers through nginx on port 80. The first-login status endpoint is unauthenticated and confirms that the panel is up. Once the admin exists, it returns "success":false, which means the panel now requires a login:

curl -s http://127.0.0.1/rest/v2/first-login-status

nginx also serves a static health endpoint for load balancer probes:

curl -s http://127.0.0.1/healthz

Finally, confirm that this VM's admin authenticates. Read the password from the credentials file and post it to the authenticate endpoint. A valid login returns "success":true with "message":"system/ADMIN":

PW=$(sudo awk -F= '/^AMS_ADMIN_PASSWORD=/{print $2}' /root/ant-media-server-credentials.txt)
curl -s -X POST http://127.0.0.1/rest/v2/users/authenticate \
  -H 'Content-Type: application/json' \
  -d "{\"email\":\"admin@sac.local\",\"password\":\"${PW}\"}"

Step 5 - Sign in to the management panel

Browse to http://<vm-ip>/ and sign in with the email admin@sac.local and the password from Step 3.

The dashboard opens on Overview. It shows live gauges for system CPU, memory and JVM heap, the count of active live streams, and a table of the installed applications. LiveApp and WebRTCApp are for streaming, and live is a bare template. Each application is an independent streaming context with its own streams, settings and REST namespace.

The account is protected against brute force. After three failed sign-ins, the panel locks the account for five minutes.

Step 6 - Create and publish a live stream

Open LiveApp from the left menu. The Live Streams tab lists every broadcast, live or defined, with its stream id, status and viewer count.

Click New Live Stream and give it a name. Ant Media assigns it a stream id. Publish to that stream id in one of two ways:

• RTMP from an encoder such as OBS or ffmpeg. Set the server URL to rtmp://<vm-ip>/LiveApp and the stream key to the stream id. This needs port 1935/tcp open (Step 6a).
• WebRTC straight from the browser, using the publish page the panel links to. WebRTC media travels over UDP in the 50000 to 60000 range (Step 6a).

Play the stream back over WebRTC or HLS:

• WebRTC player: http://<vm-ip>/LiveApp/play.html?id=<stream-id>
• HLS: http://<vm-ip>/LiveApp/streams/<stream-id>.m3u8

Step 6a - Open the streaming ports

The launch in Step 1 opened only port 80 for the panel. Live streaming also needs the ingest and media ports open on the VM's network security group. Open RTMP and the WebRTC media range:

az network nsg rule create --resource-group ant-media-rg --nsg-name ant-media-vmNSG \
  --name rtmp --priority 1001 --access Allow --protocol Tcp --direction Inbound \
  --destination-port-ranges 1935
az network nsg rule create --resource-group ant-media-rg --nsg-name ant-media-vmNSG \
  --name webrtc-media --priority 1002 --access Allow --protocol Udp --direction Inbound \
  --destination-port-ranges 50000-60000

To reach the panel directly on Ant Media's own ports instead of through nginx, also open 5080 (HTTP) and 5443 (HTTPS). The recommended approach keeps the attack surface small: reach the panel through nginx on port 80, or on port 443 once you add TLS in Step 8.

Step 7 - Tune the application

Each application has its own Settings tab. For LiveApp, you can turn on Record Live Streams as MP4, enable HLS Streaming and set its segment parameters, and upload recordings to S3. You can also set token control to require a one-time token before a stream can be published or played.

Some options on this page, such as adaptive bitrate transcoding and alternative WebRTC codecs, are Enterprise Edition features and are shown for reference. Everything the Community Edition supports is editable here and takes effect immediately.

Server-wide settings, including the JVM and the list of applications, live under Settings in the left menu. A systemd drop-in at /etc/systemd/system/antmedia.service.d/sac-heap.conf presets the JVM heap to -Xmx1536m for the Standard_B2s size. Raise it on a larger VM.

Step 8 - Serve the panel over HTTPS

For production, put a certificate in front of nginx so that the panel and WebRTC signalling are encrypted. Point a DNS record at the VM, open port 443, then run:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d streaming.example.com

certbot installs the certificate into the nginx site and reloads nginx. Browsers also require a secure context for the browser-based WebRTC publisher on any host other than localhost. HTTPS is therefore what lets you publish from the panel on your own domain.

Troubleshooting

I cannot sign in to the panel. Use the email admin@sac.local, not a bare username, and the exact password from /root/ant-media-server-credentials.txt. After three failed attempts the account is locked for five minutes. Wait, then try once, carefully.

If you have lost the password, delete /usr/local/antmedia/server.db* and restart antmedia. The next start of ant-media-server-firstboot.service mints a new password. You can also run /usr/local/sbin/ant-media-server-firstboot.sh manually after removing the sentinel.

A published RTMP stream never appears. Either port 1935/tcp is not open, or the encoder's server URL is not rtmp://<vm-ip>/LiveApp. Confirm that the rule from Step 6a exists and that the stream key matches the stream id.

A WebRTC stream connects but shows no video. The UDP media range 50000 to 60000 is not open on the network security group. WebRTC signalling rides the panel over port 80, but the media itself is UDP and needs Step 6a.

The service will not start. Run sudo systemctl status antmedia and sudo journalctl -u antmedia -n 40. The error log is at /var/log/antmedia/antmedia-error.log. On a 4 GiB VM the heap is capped at 1.5 GiB. If you lowered the VM size below Standard_B2s, raise the heap back.

Nothing answers on port 80. Confirm nginx is active with systemctl is-active nginx and that antmedia is listening on 5080 with sudo ss -tlnp | grep :5080. nginx proxies to 127.0.0.1:5080, so both must be up.

What is installed

Component Detail

Ant Media Server Community Edition 3.0.3, Apache 2.0, at /usr/local/antmedia

Runtime OpenJDK 17 (headless), antmedia.service, user antmedia

Datastore Embedded MapDB (/usr/local/antmedia/server.db); no external database

Web server nginx on port 80, WebSocket aware, reverse proxying to 127.0.0.1:5080

Panel / API Ant Media management panel and REST API on port 5080

JVM heap -Xms512m -Xmx1536m via a systemd drop-in, tuned for Standard_B2s

Credentials /root/ant-media-server-credentials.txt, mode 0600 root:root

First boot ant-media-server-firstboot.service, creates the per-VM admin

Ports 80 (panel via nginx); 1935 (RTMP), 50000 to 60000/udp (WebRTC), 5080/5443 (direct) as needed

Support

This image is packaged and maintained by SecureAnyCloud. Ant Media Server Community Edition is free software under the Apache License 2.0, developed by Ant Media and its contributors. SecureAnyCloud is not affiliated with the Ant Media project.

For questions about this image, contact SecureAnyCloud support through the Azure Marketplace listing. For questions about Ant Media Server itself, see the Ant Media documentation.

Deploy on Azure

Launch Ant Media Server Community Edition on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com