Autobase

In the Azure Portal, open the Marketplace, search for Autobase, select the SecureAnyCloud publisher entry, and click Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range and TCP 443 from the trusted networks that will reach the console. The console deploys clusters over SSH, so the VM must also reach your target database servers on TCP 22 (outbound).

Click Review + create, wait for validation, then click Create. Deployment takes around two minutes. The console then needs another minute or two on first boot to mint its secrets and bring the stack up.

Accept the Marketplace terms once per subscription, then create the VM and open ports 22 and 443:

RG="autobase-prod" LOCATION="eastus" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:autobase:default:latest
az vm create \
  --resource-group "$RG" \
  --name autobase-console \
  --image sac1647283583153:autobase:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
# Open SSH (administration) and HTTPS (the console):
az vm open-port --resource-group "$RG" --name autobase-console --port 22 --priority 1001
az vm open-port --resource-group "$RG" --name autobase-console --port 443 --priority 1002

Connect to the VM as azureuser:

ssh azureuser@<vm-ip>

The console runs as a Docker Compose stack managed by autobase.service. Confirm that the containers are up and that first boot completed:

sudo docker ps --format '{{.Names}}\t{{.Status}}'

sudo test -f /var/lib/sac/data/autobase-firstboot.done && echo "first boot: complete"

All four containers (autobase-console-ui, autobase-console-api, autobase-console-db and dbdesk-studio) should report Up. The API and datastore should also report healthy.

On first boot, the console mints a per-VM access token, console datastore password and secret-storage encryption key. You log in to the console with the access token. It is written, along with the console URL, to a root-only credentials file:

sudo cat /root/autobase-credentials.txt

The file is mode 0600 root:root and contains autobase.url, autobase.auth.token and autobase.console.db.password. Keep the access token secret, because anyone who holds it has full control of the console.

Browse to https://<vm-ip>/. The console is served over TLS, and port 80 redirects to HTTPS.

The image ships a per-VM self-signed certificate, so your browser warns on the first visit. Step 11 shows how to install your own certificate for production.

Paste the access token from Step 5 into the Token field and click Login.

Your browser holds the token and sends it as a bearer token on every API call, so it never crosses plain HTTP. To confirm that the API rejects unauthenticated calls and reports the running version, run:

curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/api/v1/environments

curl -sk -H "Authorization: Bearer <AUTOBASE_AUTH_TOKEN>" https://127.0.0.1/api/v1/version

The first call returns 401, which shows that authentication is enforced. The second call returns the console version.

After you log in, the console opens on the Clusters view. A freshly launched image has no clusters, so you add your own. Once a cluster is deployed, this view reports its status, for example healthy.

Click Create cluster. Autobase can deploy onto a cloud provider (AWS, GCP, Azure, DigitalOcean, Hetzner) by creating the servers for you. It can also deploy onto existing servers that you already run, including a single node, reached over SSH.

For the existing-servers path, register a secret that holds an SSH private key for a sudo-capable user on the targets. Choose the topology (a highly available cluster with Patroni, etcd and HAProxy, or a lightweight single node), pick the PostgreSQL major version, and start the deployment. The console drives its Ansible engine to install and configure PostgreSQL, Patroni, etcd, PgBouncer and the rest.

When the deployment finishes, the cluster overview shows the running leader, its connection details and the cluster metadata.

Connect to the deployed database with any PostgreSQL client:

psql -h <vm-ip> -p 6432 -U postgres -tAc "SELECT version();"

Every deployment and lifecycle action runs as an operation. Follow each operation in the console, where the full Ansible log is available.

The console UI is the only service reachable on the public NIC, and it is served over TLS. The console API, its datastore and the dbdesk SQL studio are bound to an internal Docker network. Port 80 redirects to HTTPS, the first-boot service is enabled, and the OS is patched at build time with nothing held back from security updates. Verify the units and the redirect:

sudo systemctl is-enabled autobase-firstboot.service autobase.service

curl -s -o /dev/null -w ':80 -> HTTP %{http_code}\n' http://127.0.0.1/

The image ships a per-VM self-signed certificate so the console is available over TLS immediately. For production, replace it with a certificate for your own hostname.

Point DNS at the VM, then install a certificate. You can use a companion reverse proxy, or replace the certificate and key that the console's nginx front end uses. List the current files:

sudo ls -l /srv/autobase/tls/

Replace autobase.crt and autobase.key with your own certificate and private key, and keep the key mode at 0600. Then reload nginx:

sudo nginx -t && sudo systemctl reload nginx

Check the console service:

sudo systemctl status autobase.service --no-pager

Stop or start the whole console stack through its systemd unit with sudo systemctl stop autobase.service and sudo systemctl start autobase.service.

The compose project, per-VM secrets and TLS material live on the dedicated data disk at /srv/autobase. They persist across reboots and are independent of the OS disk.

The console does not answer on 443. Check that first boot completed (sudo systemctl status autobase-firstboot.service) and that the stack is up (sudo docker ps). The console does not start until the per-VM secrets exist. A start-time guard refuses to run with an absent, example or too-short token.

Browser certificate warning. This is expected on the first visit with the shipped self-signed certificate. Install your own certificate (Step 11).

A deployment fails. Open the operation in the console and read its Ansible log. The most common cause is that the console cannot reach a target server over SSH. Check the target's security group, and check that the registered key's user has passwordless sudo.

Autobase is distributed under the MIT License. The Community Edition console UI, API, datastore image and the Ansible automation engine shipped in this image are all open source. The proprietary Enterprise Edition is a separate set of images and is not included.

TimescaleDB notice (Timescale License, TSL). The console's internal monitoring datastore bundles TimescaleDB, which is distributed under the Timescale License (TSL). The TSL is a source-available license, not an open source license. TimescaleDB is used solely as the console's internal metrics store. You never manage or expose it yourself, and the clusters you deploy run vanilla PostgreSQL.

The full TSL text is available at https://github.com/timescale/timescaledb/blob/main/tsl/LICENSE-TIMESCALE. Your use of the bundled TimescaleDB is subject to that license.

The PostgreSQL clusters that Autobase deploys install components onto your own target servers at deploy time: PostgreSQL under the PostgreSQL License, Patroni under MIT, etcd under Apache-2.0, HAProxy under GPL-2.0, PgBouncer under ISC, and pgBackRest and WAL-G under MIT. None of these are baked into this image.

Deploy on Azure

SecureAnyCloud publishes Autobase for PostgreSQL as a hardened, ready-to-run image on the Azure Marketplace, patched and secured with per-VM secret generation and an empty-by-default posture.

Need Help?

SecureAnyCloud provides 24/7 support with a guaranteed 24 hour response SLA for all marketplace images. Contact support through the SecureAnyCloud website.

Deploy on Azure

Launch Autobase for PostgreSQL on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com