Apache Seata

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. Scale up for higher transaction throughput.

In the NSG, allow inbound 22/tcp from your management network and 80/tcp for the web console (front it with TLS for public exposure, see Enabling HTTPS). Also allow 8091/tcp for the Transaction Coordinator from the application subnets whose microservices will register with it.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Apache Seata by SecureAnyCloud, and select Create. On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:apache-seata-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name seata \
  --image sac1647283583153:apache-seata-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name seata --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name seata --port 8091 --priority 1020

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active seata-namingserver.service seata-server.service nginx.service

All three report active. On first boot the JVM can take 30 to 60 seconds to start fully while it warms up.

ss -tln | grep -E ':80 |:8081 |:8091 '

You should see nginx on :80, the console bound to loopback on 127.0.0.1:8081, and the Transaction Coordinator on :8091:

Step 5 - Retrieve your web console password

A unique console password is generated on the first boot of every VM and written to a root-only file. There is no shared or default login.

sudo cat /root/seata-credentials.txt

The file records the console URL, the console user (seata) and the per-VM password:

Step 6 - Sign in to the web console

Browse to http://<vm-public-ip>/ and sign in as seata with the password from Step 5.

After you sign in, you land on the TransactionInfo view. It lists the global transactions coordinated by the server, and it stays empty until your applications start running transactions:

Step 7 - Verify the Transaction Coordinator is up

The web console health endpoint is unauthenticated and answers through nginx:

curl -s http://127.0.0.1/naming/v1/health

{"code":"200","message":"success","success":true}

To prove that the coordinator itself is up, and not merely that the port is open, sign in and open ClusterManager. Then click View on the default cluster. The console shows the Transaction Coordinator registered as a healthy member on port 8091:

The same fact is available from the console API. Log in for a token, then query the registered cluster:

PW=$(sudo grep '^SEATA_CONSOLE_PASSWORD=' /root/seata-credentials.txt | cut -d= -f2-)
TOKEN=$(curl -s -H 'Content-Type: application/json' -X POST \
  -d "{\"username\":\"seata\",\"password\":\"$PW\"}" \
  http://127.0.0.1/api/v1/auth/login | jq -r .data)
curl -s -H "Authorization: $TOKEN" \
  'http://127.0.0.1/naming/v1/clusters?namespace=public' \
  | jq '.[0].unitData[0].namingInstanceList[0] | {transaction, healthy, role, version}'

{ "transaction": { "host": "10.0.0.10", "port": 8091 }, "healthy": true, "role": "MEMBER", "version": "2.6.0" }

Step 8 - Connect your microservice clients to the coordinator

Your Seata clients (the Transaction Manager and Resource Managers embedded in your microservices) connect directly to the Transaction Coordinator on TCP 8091. With the standalone file registry, point each client at the coordinator's address. For a Spring Boot application, set:

seata: tx-service-group: default_tx_group service: vgroup-mapping: default_tx_group: default grouplist: default: <vm-private-ip>:8091 registry: type: file config: type: file

Open your NSG to allow 8091/tcp from the subnets where those microservices run. When your applications begin coordinating transactions, they appear in the TransactionInfo view. Any held global locks appear under GlobalLockInfo:

Enabling HTTPS

nginx serves the console over plain HTTP on :80. For public exposure, put a certificate in front of it. Point your own DNS name at the VM, then run:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d seata.example.com

certbot obtains a certificate, rewrites the nginx site to listen on 443 with a redirect from :80, and installs a renewal timer.

Backup and maintenance

The Transaction Coordinator stores its session/lock state under /opt/seata/current/seata-server/sessionStore (standalone file mode). Service logs are under /var/log/seata. To restart the stack after a configuration change:

sudo systemctl restart seata-namingserver.service seata-server.service

The base image keeps receiving unattended security updates. Scale the VM up for higher transaction throughput. The JVM heaps are tuned for the 4 GiB Standard_B2s.

Support

Every SecureAnyCloud image is backed by 24/7 support. For questions about this deployment, contact us through secureanycloud.com.

Deploy on Azure

Launch Apache Seata Server on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances

• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products

• An EC2 key pair in the target Region for SSH access to the instance

• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network, port 80 for the console front, and port 8091 from the networks your microservice clients run in

• The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Connecting to your instance

Connect over SSH using your EC2 key pair. The login user depends on the operating system variant you launched:

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i /path/to/your-key.pem ubuntu@<public-ip>

Security hardening

• Restrict inbound access. Open port 80 (console front) and port 8091 (coordinator RPC) only to trusted networks in your security group. The console (8081) is bound to loopback and is never directly reachable off the instance.

• Terminate TLS. Put a TLS-terminating load balancer, or configure TLS on nginx, in front of port 80 so console traffic is encrypted. Restrict the coordinator RPC port to private application subnets.

• Rotate credentials. The console password and token signing key are unique per instance. To rotate the console password later, update console.user.password for the NamingServer and restart seata-namingserver.service.

• Encrypt at rest. Enable AWS EBS encryption on the root volume to protect configuration and transaction state at rest.

• Scale out. For production throughput and durability beyond evaluation, move the coordinator to a database-backed store and run multiple coordinators; contact SecureAnyCloud support for sizing guidance.

Support

SecureAnyCloud provides 24/7 technical support for this Apache Seata image via email and live chat. We assist with deployment, wiring your microservice clients to the coordinator, console and credential administration, TLS termination, and JVM tuning. Contact sales@secureanycloud.com or reach us via live chat. For sizing recommendations, production architecture planning, or any issues including requesting refunds, contact sales@secureanycloud.com.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Apache Seata Transaction Coordinator on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com