SecureAnyCloud
Deployment guide

Apache ActiveMQ

Overview

Apache ActiveMQ Classic is an open-source, multi-protocol Java message broker that implements the JMS API and speaks OpenWire, AMQP, STOMP and MQTT. It moves messages reliably between distributed applications, with durable queues and topics backed by a persistent store.

This SecureAnyCloud image installs ActiveMQ 6.2.6 on OpenJDK 17 at /opt/activemq and runs it as a dedicated activemq system user. An nginx reverse proxy on TCP 80 fronts the Jetty web console, and the KahaDB message store lives on a dedicated Azure data disk.

What you get:

  • Apache ActiveMQ Classic 6.2.6 broker on OpenJDK 17 at /opt/activemq
  • nginx reverse proxy on :80 in front of the Jetty web console (bound to loopback :8161)
  • OpenWire 61616, AMQP 5672, STOMP 61613 and MQTT 1883 transport connectors
  • A dedicated Azure data disk at /var/lib/activemq holding the KahaDB persistence store, separate from the OS disk and re-provisioned with every VM
  • A unique web console password (ACTIVEMQ_ADMIN_PASSWORD) generated on the first boot of every VM and stored in a root-only file
  • activemq.service and nginx.service as enabled, active systemd units
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting size for the JVM broker. Scale up for higher message throughput.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web console. Put TLS in front of the console before you expose it publicly (see Enabling HTTPS). Also allow the transport ports your clients use (61616 OpenWire, 5672 AMQP, 61613 STOMP, 1883 MQTT) from your application networks.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Apache ActiveMQ by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:apache-activemq-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name activemq \
  --image sac1647283583153:apache-activemq-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name activemq --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active activemq.service nginx.service

Both services report active. On first boot, the broker can take a minute or two to start fully while the JVM warms up.

Step 5 - Retrieve your web console password

Your VM generates its own web console password on first boot and writes it to a root-only file. Read the file with sudo:

sudo cat /root/activemq-credentials.txt

The ACTIVEMQ_ADMIN_PASSWORD value is the password. Sign in to the web console as admin with it.

Step 6 - Open the web console

Browse to http://<vm-public-ip>/ and sign in as admin with the password from Step 5.

The ActiveMQ web console lets you browse queues and topics, inspect message counts, send and purge messages, and view broker and connection details.

Step 7 - Verify the broker health

The broker exposes a Jolokia REST endpoint behind the console. Read the broker version to confirm the broker is healthy, replacing <password> with your console password:

PW=<password> curl -s -u admin:$PW -H 'Origin: http://<vm-public-ip>' -H 'Content-Type: application/json' \
  -X POST -d '{"type":"read","mbean":"org.apache.activemq:type=Broker,brokerName=localhost","attribute":"BrokerVersion"}' \
  'http://<vm-public-ip>/api/jolokia/'

The response is JSON with "status":200 and the broker version in value. The Jolokia endpoint accepts only POST and requires a same-origin request, so the Origin header must match the host you are calling.

Step 8 - Send and receive a test message

ActiveMQ ships a producer/consumer CLI. On the VM, send five messages to a queue, then drain them:

DIR=$(ls -d /opt/activemq/apache-activemq-*/);
sudo -u activemq "$DIR/bin/activemq" producer --destination queue://demo.queue --messageCount 5 --brokerUrl tcp://127.0.0.1:61616
DIR=$(ls -d /opt/activemq/apache-activemq-*/);
sudo -u activemq "$DIR/bin/activemq" consumer --destination queue://demo.queue --messageCount 5 --brokerUrl tcp://127.0.0.1:61616

The producer reports Produced: 5 messages and the consumer reports Received: 5. The queue and its messages persist in the KahaDB store on the dedicated data disk.

Step 9 - Connect from your applications

Point JMS / OpenWire clients at tcp://<vm-public-ip>:61616, AMQP 1.0 clients at amqp://<vm-public-ip>:5672, STOMP clients at <vm-public-ip>:61613, and MQTT clients at <vm-public-ip>:1883. Open the matching NSG ports to your application networks only.

Enabling HTTPS

For production, terminate TLS at nginx with a real domain pointed at the VM's public IP. Install certbot and request a certificate, replacing the domain with your own:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Backup and maintenance

The KahaDB persistence store and broker data live on the dedicated data disk at /var/lib/activemq. Snapshot that disk in Azure to back up your durable queues and topics. Keep the OS patched with sudo apt update && sudo apt upgrade. Restart the broker with sudo systemctl restart activemq; it restarts cleanly.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email and chat for help with broker configuration, protocol connectors, clustering, persistence, TLS and backups.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Apache ActiveMQ on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure