SecureAnyCloud
Deployment guide

Apache Tika Server

Overview

Apache Tika Server is the standalone HTTP interface to the Apache Tika toolkit. Send it a PDF, Office file, email, image or any of more than a thousand supported formats. It returns the plain text content and structured metadata, such as author, title, dates and the detected media type.

Tika Server is stateless and holds no data between requests. That makes it a natural building block for search indexing, document processing and retrieval-augmented generation (RAG) pipelines that turn arbitrary files into clean, machine-readable text. It uses the mature Apache PDFBox and Apache POI parsers, so it copes with the variety of real-world documents.

Secure by default, no default login: Tika Server ships with no authentication, and its file-fetching and unpack features are a known SSRF/RCE risk if the port is exposed. This image never exposes it. The Tika server binds to loopback only, and the dangerous features stay disabled (the server is not started with -enableUnsecureFeatures). nginx is the only public listener and fronts the whole REST surface with HTTP Basic Auth.

On each VM's first boot, a tika-firstboot.service oneshot generates a unique password, writes a bcrypt .htpasswd and a root-only info note, and proves the auth gate with a real extraction round trip. It then disables itself. No two VMs share a password, and none is baked into the image.

Note on the interface: Tika Server is an API-first service with no bundled web interface. You drive it through its REST API, the official Tika client libraries or your own application. This guide uses curl against the API.

What you get:

  • Apache Tika Server 3.3.1 (tika-server-standard) on OpenJDK 17, with the official JAR installed at /opt/tika
  • tika.service bound to 127.0.0.1:9998, run as a dedicated non-root tika user under a hardened systemd unit
  • nginx reverse proxy on port 80 with per-VM HTTP Basic Auth, ready for TLS
  • An unauthenticated /healthz endpoint for load balancer and probe checks
  • tika-firstboot.service for the per-VM first-boot password and gate proof
  • A unique per-VM password generated on first boot, in a root-only 0600 file
  • Sample fixtures under /opt/tika/samples so you can test extraction immediately
  • Ubuntu 24.04 LTS base, patched at build time
  • 24/7 SecureAnyCloud support with a 24-hour response SLA

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet. Tika is CPU- and memory-bound while parsing, so extracting large or complex documents benefits from more RAM.

The recommended VM size is Standard_B2s (2 vCPU, 4 GB RAM) for evaluation and light workloads. Use Standard_D2s_v5 or larger for production throughput and large documents.

1

Deploy from the Azure Portal

Search the Marketplace for Apache Tika Server on Ubuntu 24.04 and choose your VM size. Attach an NSG that allows TCP 22 (SSH) from your management network. Also allow TCP 80 and 443 (the API) from the networks and applications that submit documents.

In production, front port 80 with TLS (see the HTTPS step below).

2

Deploy from the Azure CLI

RG="tika-prod"; LOCATION="eastus"; VM_NAME="tika-01" IMAGE_URN="sac1647283583153:apache-tika-server-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name tika-vnet --address-prefix 10.90.0.0/16 --subnet-name tika-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name tika-nsg az network nsg rule create -g "$RG" --nsg-name tika-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name tika-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:apache-tika-server-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name tika-vnet --subnet tika-subnet --nsg tika-nsg --public-ip-sku Standard
3

Connect over SSH

ssh azureuser@<vm-ip>
4

Verify the services are running

The Tika server listens on loopback 127.0.0.1:9998 and nginx fronts the API on port 80. The /healthz endpoint is public. Every other endpoint requires your per-VM password.

sudo systemctl is-active tika nginx
sudo ss -tln | grep -E ':80 |:9998' curl -s http://127.0.0.1/healthz

You should see both services active, the two listening sockets, and ok from the health endpoint.

5

Read your per-VM password

The password was generated on this VM's first boot and stored in a root-only file. Read it and keep it secret, because it authenticates every API request. Then confirm that unauthenticated requests are rejected.

sudo ls -l /root/tika-server-credentials.txt echo "unauthenticated /version -> HTTP $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/version)"

The info note holds TIKA_USERNAME (admin) and TIKA_PASSWORD. It is owned by root:root with mode 0600. An unauthenticated call to /version returns 401, because the nginx Basic Auth gate enforces authentication.

6

Extract text from a document

This is what Tika does: it turns a document into plain text. Load the per-VM password into a shell variable, then submit a file to the /tika endpoint with a PUT.

The image ships sample PDF and DOCX fixtures under /opt/tika/samples so you can test immediately. Swap in your own files the same way.

export
TIKA_PW=$(sudo grep '^TIKA_PASSWORD=' /root/tika-server-credentials.txt | cut -d= -f2-)
# Extract text from the sample PDF curl -s -u "admin:$TIKA_PW" -T /opt/tika/samples/sac-sample.pdf \
  -H 'Accept: text/plain' http://127.0.0.1/tika
# Extract text from the sample DOCX (any Office format works the same way)
curl -s -u "admin:$TIKA_PW" -T /opt/tika/samples/sac-sample.docx \
  -H 'Accept: text/plain' http://127.0.0.1/tika

Each call returns the extracted plain text of the document. To extract from your own file, replace the path after -T with your document. Tika detects the type automatically.

7

Extract metadata

The /meta endpoint returns only the document metadata as JSON, such as detected content type, page or word counts, author and dates. The /rmeta endpoint returns a recursive JSON array that combines metadata and text for every embedded part of a container document.

export
TIKA_PW=$(sudo grep '^TIKA_PASSWORD=' /root/tika-server-credentials.txt | cut -d= -f2-)
# Metadata only, as JSON curl -s -u "admin:$TIKA_PW" -T /opt/tika/samples/sac-sample.docx \
  -H 'Accept: application/json' http://127.0.0.1/meta echo
# Detect the media type of a file without parsing it curl -s -u "admin:$TIKA_PW" -T /opt/tika/samples/sac-sample.pdf \
  http://127.0.0.1/detect/stream

/meta reports fields such as Content-Type. /detect/stream returns the detected MIME type (application/pdf) using Tika's content detection, without a full parse.

8

Supported formats and endpoints

Tika parses over a thousand formats through a single API. The useful endpoints are listed below. All of them sit behind the Basic Auth gate.

  • PUT /tika: extract plain text (or XHTML with Accept: text/html)
  • PUT /meta: extract metadata as JSON, CSV or XMP
  • PUT /rmeta: recursive metadata and text for container formats (zip, mbox, PDF portfolios)
  • PUT /detect/stream: detect the media type without parsing
  • GET /version, GET /parsers, GET /detectors, GET /mime-types: introspect the server

List the parsers and detected MIME types the server supports:

export
TIKA_PW=$(sudo grep '^TIKA_PASSWORD=' /root/tika-server-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$TIKA_PW" http://127.0.0.1/version
curl -s -u "admin:$TIKA_PW" http://127.0.0.1/detectors | head -20
9

Enable HTTPS

nginx fronts the API on port 80 and is ready for TLS. Point a DNS record at the VM. Then obtain a certificate with certbot and let it configure nginx for port 443.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

After issuance, restrict the NSG so that only port 443 (and port 22 from your management network) is reachable. Then submit documents over https://your-domain.example.com/tika.

Persistence, first boot and updates

Tika Server is stateless. It keeps no data between requests, so there is no data volume to manage. The Tika JAR and sample fixtures live on the OS disk and are captured into the image, so a VM launched from this image is ready immediately.

The first-boot service generates the per-VM Basic Auth password and proves the auth gate. It then disables itself, so later reboots are unaffected. The OS is patched at build time and ships with unattended security upgrades enabled.

To change the password later, edit /etc/nginx/.tika.htpasswd with sudo htpasswd -B /etc/nginx/.tika.htpasswd admin and reload nginx.

Support

Every SecureAnyCloud deployment includes 24/7 support with a 24-hour response SLA. Contact sales@secureanycloud.com for help with deployment, configuration or scaling.

This is a repackaged open source software product with additional charges for SecureAnyCloud support services. Apache Tika is a trademark of the Apache Software Foundation. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Apache Tika Server on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure