Azimutt

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point for exploring schemas of up to a few hundred tables. Increase the size for very large schemas or many concurrent users.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. Azimutt serves plain HTTP on port 80. For production, put it behind TLS with your own domain (see Step 10).

Step 1 - Deploy from the Azure Marketplace

• In the Azure portal, choose Create a resource and search the Marketplace for the SecureAnyCloud Azimutt offer.
• Select the plan, then select Create.
• On the Basics tab, pick your subscription, resource group and region, name the VM, and select Standard_B2s (or larger).
• Choose SSH public key authentication with admin username azureuser, and provide your public key.
• On the Networking tab, allow inbound 22/tcp from your management network and 80/tcp for the web interface.
• Review and create the VM. When it is running, note its public IP address.

Step 2 - Deploy from the Azure CLI

az vm image terms accept --urn sac1647283583153:azimutt:default:latest
az vm create \
  --resource-group my-azimutt-rg \
  --name azimutt \
  --image sac1647283583153:azimutt:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
# Open the port the web interface needs (SSH is opened by default):
az vm open-port --resource-group my-azimutt-rg --name azimutt --port 80 --priority 900

Step 3 - Connect to your VM

Connect over SSH as azureuser, replacing <vm-ip> with your VM's public IP address:

ssh azureuser@<vm-ip>

Step 4 - Confirm the services are running

Azimutt, its bundled PostgreSQL and nginx all start automatically on first boot. First boot also runs the database migrations, which can take up to a minute the first time. Confirm that the services are active:

sudo systemctl is-active docker azimutt-firstboot azimutt nginx

Expected output:

active active active active

The stack runs as two containers on a private Docker network. PostgreSQL is never published to a host port. Only Azimutt is published, and only to the loopback interface, with nginx in front on port 80. Check the listeners:

ss -tln | grep -E ':(80|4000|5432) '

Step 5 - Secure by default: a unique admin and a locked registration path

Self-hosted Azimutt has no seeded administrator, and by default anyone who reaches /register can create an account. On a public server that is a risk, and this image closes it.

On first boot, before the port is reachable, the image creates a unique administrator account, with its own personal organization, through Azimutt's own sign-up code path. The password is unique to each VM. Self-registration is then locked: every new account's email must end with a random suffix that is unique to your VM and readable only by someone with root access to your instance. An outside visitor therefore cannot register an account and claim your instance.

Run the round-trip check to see the whole security posture at a glance. A blank or wrong password is rejected, the per-VM admin credential is accepted and reaches the authenticated dashboard, an anonymous request is denied, and a registration attempt with a foreign email address is blocked:

sudo /usr/local/sbin/azimutt-roundtrip.sh

Read your unique credentials from the root-only credentials file:

sudo cat /root/azimutt-credentials.txt

The file holds your Azimutt URL, your admin email (ending in the per-VM lock suffix) and your admin password. Keep it safe.

Step 6 - Sign in to Azimutt

Open http://<vm-ip>/ in your browser. The Azimutt login screen appears, because anonymous access is not allowed. Sign in with the admin email and the password from the credentials file.

Step 7 - Your organization and your first project

After you sign in, you land on your personal organization, ready to create your first project. Azimutt can start a project from a live database connection, a SQL structure file, a Prisma schema, JSON, or an empty canvas.

Choose From SQL structure and upload a .sql file with your schema, or drag and drop it. Everything stays on your machine, and nothing is uploaded anywhere else. Azimutt's parser handles most SQL dialects and reports exactly how many tables it found.

Step 8 - Explore the entity relationship diagram

Click Create project!, then click Show all tables for an overview layout. Azimutt lays out the tables with their columns, types, primary keys (the key icon) and foreign keys (the linked-arrow icon), and draws the relationship lines between them.

Click a colored column icon to follow a relation. Drag tables to rearrange the layout. Use the search bar to jump straight to a table or column in a much larger schema.

You can add notes to any table or column and group tables into custom layouts. With a live database connection, you can also query and browse real data alongside the diagram. Save the project from the top bar to keep it in your organization.

Step 9 - Invite your team

Self-registration is locked to your VM's own suffix. To add a teammate, create their account with an email that ends in that same suffix, which is visible in /root/azimutt-credentials.txt. Create it the same way the admin account was created, or invite them from within the app once you are signed in.

To allow open registration on a private, trusted network, edit REQUIRE_EMAIL_ENDS_WITH in /etc/azimutt/azimutt.env and restart the stack with sudo systemctl restart azimutt.

Step 10 - Production: your own domain with TLS

Azimutt serves plain HTTP on port 80. For production, point a DNS record at the VM and put Azimutt behind TLS. Set PHX_HOST in /etc/azimutt/azimutt.env to your domain so that links use the right origin. A common approach is to add a certificate to nginx with Certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d schema.example.com

Then change PHX_HOST in /etc/azimutt/azimutt.env to schema.example.com and restart the stack with sudo systemctl restart azimutt. See the Azimutt documentation for the full production checklist.

Support

Every SecureAnyCloud image includes 24/7 support. If you have any questions about deploying or operating Azimutt on Azure, contact the SecureAnyCloud team through the Azure Marketplace listing or at secureanycloud.com.

Deploy on Azure

Launch Azimutt on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com