AzuraCast

• In the Azure portal, choose Create a resource, search the Marketplace for AzuraCast by SecureAnyCloud, select the Default plan and choose Create.
• On the Basics tab, pick your subscription, resource group and region, name the VM, and choose Standard_B2s (or larger). Choose SSH public key authentication with the admin username azureuser and your public key.
• On the Disks tab, increase the OS disk size if you will upload a large music library.
• On the Networking tab, allow inbound SSH (22), HTTP (80) and HTTPS (443). Afterwards, restrict SSH to your own IP address in the network security group. Leave ports 80 and 443 open to your listeners, because a public radio station is usually open to the internet.
• Choose Review + create, then Create. When the VM is running, note its public IP address.

Run these commands on your own workstation. They create a resource group, the VM, and network security group rules for HTTP and HTTPS. The az vm create command opens SSH by default, so restrict it to your own address range:

az group create --name my-resource-group --location eastus
az vm image terms accept --urn sac1647283583153:azuracast:default:latest
az vm create \
  --resource-group my-resource-group \
  --name azuracast \
  --image sac1647283583153:azuracast:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard \
  --os-disk-size-gb 64
az vm open-port --resource-group my-resource-group --name azuracast --port 443 --priority 900
az vm open-port --resource-group my-resource-group --name azuracast --port 80 --priority 910

The --os-disk-size-gb 64 option grows the OS disk for a music library. Leave it out to keep 30 GiB.

A Standard public IP keeps its address while the VM is stopped. If you deallocate a VM with a dynamic address, AzuraCast follows the new address at the next boot.

Connect as azureuser with your key. Replace <vm-ip> with the VM's public IP address:

ssh azureuser@<vm-ip>

First boot finishes a few minutes after the VM starts, because the first start reads AzuraCast's 2.3 GB container image from the disk. First boot performs these tasks:

• Sets the address that AzuraCast is served as, using the VM's public IP from Azure metadata.
• Generates the secrets.
• Seeds the super administrator over loopback.
• Creates and starts the SecureAnyCloud Radio station.
• Writes /root/azuracast-credentials.txt (mode 0600, root).

Only then does azuracast.service open ports 80 and 443. The following commands show the entries in the credentials file and the database environment file. The secrets themselves are not shown:

sudo grep -E '^AZURACAST_(URL|ADMIN_EMAIL)=' /root/azuracast-credentials.txt
sudo grep -oE '^[A-Z_]+=' /root/azuracast-credentials.txt
sudo stat -c '%a %U:%G %n' /root/azuracast-credentials.txt /etc/azuracast/azuracast.env
sudo grep -oE '^MYSQL_[A-Z_]*PASSWORD=' /etc/azuracast/azuracast.env

AZURACAST_URL=https://203.0.113.10/ AZURACAST_ADMIN_EMAIL=admin@azuracast.local AZURACAST_URL= AZURACAST_ADMIN_EMAIL= AZURACAST_ADMIN_PASSWORD= 600 root:root /root/azuracast-credentials.txt 600 root:root /etc/azuracast/azuracast.env MYSQL_PASSWORD= <set-at-first-boot>=

Value What it is for

AZURACAST_URL The address of this VM's AzuraCast

AZURACAST_ADMIN_EMAIL Sign-in e-mail of the super administrator (admin@azuracast.local; change it after signing in)

AZURACAST_ADMIN_PASSWORD Super administrator password, generated on this VM

MYSQL_PASSWORD, MYSQL_ROOT_PASSWORD MariaDB passwords for AzuraCast and for the database root account, generated on this VM (in /etc/azuracast/azuracast.env)

To read the values, run sudo cat /root/azuracast-credentials.txt in your own session, and store them in your password manager.

Docker, the metadata firewall rule and AzuraCast should all be active, and the container should run the pinned 0.24.0 image. Only sshd and Docker's port forwarder for 80 and 443 listen beyond loopback.

2022/tcp (SFTP) and 9000/tcp appear in docker ps because the image declares them, but neither is published on the host:

systemctl is-active docker.service sac-docker-imds-deny.service azuracast.service
sudo docker ps --format '{{.Names}} {{.Image}}'
sudo docker ps --format '{{.Ports}}' | tr ',' '\n' | sed 's/^ //'
sudo ss -Htlnp | awk '{print $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort -u sudo docker exec azuracast azuracast_cli --version sudo docker exec azuracast php -r 'echo "PHP ", PHP_VERSION, "\n";'

active active active azuracast ghcr.io/azuracast/azuracast:0.24.0 0.0.0.0:80->80/tcp [::]:80->80/tcp 2022/tcp 0.0.0.0:443->443/tcp [::]:443->443/tcp 9000/tcp 0.0.0.0:22 users:(("sshd"),("systemd")) 0.0.0.0:443 users:(("docker-proxy")) 0.0.0.0:80 users:(("docker-proxy")) 127.0.0.53%lo:53 users:(("systemd-resolve")) 127.0.0.54:53 users:(("systemd-resolve")) [::]:22 users:(("sshd"),("systemd")) [::]:443 users:(("docker-proxy")) [::]:80 users:(("docker-proxy")) AzuraCast Command Line Tools (Production) 0.24.0 PHP 8.5.12

The sign-in page answers, the setup page is already complete, and the administration API refuses a signed-out request. Plain HTTP redirects to HTTPS, an unknown Host header gets no answer, a client-sent X-Forwarded-Host is refused, and TLS 1.1 is not offered.

The last command is the image's own round-trip check. It signs in with this VM's administrator password, proves that blank and wrong passwords are refused, and reads the station list with the session:

H=$(sed -n 's#^https://##p' /etc/azuracast/base-url) C=(--connect-to ::127.0.0.1:) curl -sk "${C[@]}" -o /dev/null -w 'sign-in page -> %{http_code}\n' "https://$H/login" curl -sk "${C[@]}" -o /dev/null -w 'setup page -> %{http_code} %{redirect_url}\n' "https://$H/setup/register" curl -sk "${C[@]}" -o /dev/null -w 'admin API, signed out -> %{http_code}\n' "https://$H/api/admin/stations" curl -s "${C[@]}" -o /dev/null -w 'http -> %{http_code} %{redirect_url}\n' "http://$H/login" curl -sk -o /dev/null -w 'unknown Host -> %{http_code}\n' -H 'Host: evil.example' https://127.0.0.1/login || true curl -sk "${C[@]}" -o /dev/null -w 'client-sent X-Forwarded-Host -> %{http_code}\n' -H 'X-Forwarded-Host: evil.example' "https://$H/login" curl -sk "${C[@]}" -o /dev/null -w 'TLS 1.1 -> %{http_code}\n' --tlsv1.1 --tls-max 1.1 "https://$H/login" || true
sudo /usr/local/sbin/azuracast-roundtrip.sh

sign-in page -> 200 setup page -> 302 https://203.0.113.10/setup/complete admin API, signed out -> 403 http -> 301 https://203.0.113.10/login unknown Host -> 000 client-sent X-Forwarded-Host -> 400 TLS 1.1 -> 000 OK round-trip https://203.0.113.10/: login page 200; /setup/register closed; anonymous, wrong and blank password get no admin API; per-VM super administrator logs in (Secure HttpOnly session) and reads the station list; unknown Host dropped; HTTP 301 to HTTPS

The --connect-to ::127.0.0.1: option sends each request to this VM while keeping the real host name in the request, exactly as a browser would send it. A status of 000 means that the server closed the connection without an answer.

Browse to AZURACAST_URL (https://<vm-public-ip>/). The certificate is self-signed, so your browser warns you once. Accept it for this address, or set up a Let's Encrypt certificate (Step 10). Sign in with AZURACAST_ADMIN_EMAIL and AZURACAST_ADMIN_PASSWORD:

The dashboard lists your stations with their listener counts and what is playing. Open My Account (top right) first, and change the e-mail address to your own. You can also change the password.

Then add accounts for your team under Administration > Users. There is no public sign-up:

Open SecureAnyCloud Radio from the dashboard. Its Icecast broadcasting service and Liquidsoap AutoDJ are already running. Until you add music, the Now Playing panel reads Station Offline and the stream carries AzuraCast's fallback audio.

Rename the station under Edit Station Settings, then add your music:

• Media > Music Files: Upload MP3, OGG, FLAC or other audio files (or folders). Then select them and add them to a playlist from the Playlists menu. Files uploaded while you view a playlist's tracks are added to that playlist directly.
• Playlists: The station starts with a default playlist. Create more playlists and schedules here. Grouped playlists (new in 0.24.0) let one "clockwheel" run several smaller playlists in a set order.
• Overview: The station page shows the HTTPS stream address, the public player link and the state of the broadcasting and AutoDJ services, with their Restart and Stop buttons.

Listeners can use the public player page, or the stream address directly in any media player. Both are served over HTTPS on port 443:

H=$(sed -n 's#^https://##p' /etc/azuracast/base-url) C=(--connect-to ::127.0.0.1:) curl -sk "${C[@]}" "https://$H/api/nowplaying" | jq -r '.[] | "\(.station.name) | \(.station.shortcode) | \(.station.listen_url) | public page: \(.station.public_player_url)"'
sudo docker exec azuracast supervisorctl status | awk '/^station_/{print $1, $2}' curl -sk "${C[@]}" -m 5 -o /dev/null -w 'stream -> %{http_code} %{content_type}\n' "https://$H/listen/sac_radio/radio.mp3" || true curl -sk "${C[@]}" -o /dev/null -w 'Icecast admin, no password -> %{http_code}\n' "https://$H/listen/sac_radio/admin/"

sac Radio | sac_radio | https://203.0.113.10/listen/sac_radio/radio.mp3 | public page: https://203.0.113.10/public/sac_radio station_1:station_1_backend RUNNING station_1:station_1_frontend RUNNING stream -> 200 audio/mpeg Icecast admin, no password -> 401

The stream request stops itself after five seconds (-m 5), because a stream never ends on its own. This is the public player page:

Web DJ. On the station overview, choose Enable in the Streamers/DJs panel. Alternatively, turn on Allow Streamers / DJs under Edit Station Settings > Streamers/DJs. Then create DJ accounts under Streamers/DJs. DJs can broadcast from their browser with the station's Web DJ page, which works over HTTPS on 443 with no extra port.

DJ software and more stations. DJ software (butt, Mixxx, Rocket Broadcaster) connects to the station's DJ port (8005 for the first station). Stations that you add get their own Icecast port (8000, 8010, 8020 and so on). These ports are not published by default.

To publish a range of ports for your stations, add the range to the ports in /etc/azuracast/compose.public.yaml on the VM, and then restart AzuraCast:

services: web: ports: - "80:80" - "443:443" - "8000-8099:8000-8099"

sudo systemctl restart azuracast

Then open the same range on the VM's network security group, limited to the networks that your DJs and listeners use. Run this command on your workstation, and replace the source range with your own:

az network nsg rule create --resource-group my-resource-group --nsg-name azuracastNSG \
  --name azuracast-stations --priority 920 --direction Inbound --access Allow --protocol Tcp \
  --destination-port-ranges 8000-8099 --source-address-prefixes 198.51.100.0/24

azuracastNSG is the network security group that az vm create made for a VM named azuracast. In the portal, it is under the VM's Networking page.

SFTP uploads (port 2022) work the same way. Add "2022:2022" to the ports and open port 2022 to your own network only.

The DOCKER-USER chains drop traffic from the container to the Azure Instance Metadata Service and the WireServer, while ordinary internet access works. The VM itself and the Azure agent still reach the metadata service. Docker, containerd and AzuraCast's unit carry IPAddressDeny, and the Azure agent carries none.

PHP inside the container is the fixed 8.5.12 build with no Debian PHP package installed, and SSH runs with the SecureAnyCloud pins:

sudo iptables -S DOCKER-USER
sudo ip6tables -S DOCKER-USER
sudo docker exec azuracast curl -s -m 10 https://checkip.amazonaws.com/ >/dev/null && echo "container -> internet: reachable"
sudo docker exec azuracast curl -s -m 5 -H 'Metadata: true' 'http://169.254.169.254/metadata/instance?api-version=2021-02-01' >/dev/null || echo "container -> Azure metadata: blocked (curl exit $?)"
sudo docker exec azuracast curl -s -m 5 'http://168.63.129.16/?comp=versions' >/dev/null || echo "container -> WireServer: blocked (curl exit $?)" curl -s -m 5 -o /dev/null -w 'VM -> Azure metadata: %{http_code}\n' -H 'Metadata: true' 'http://169.254.169.254/metadata/instance?api-version=2021-02-01' for u in docker containerd azuracast walinuxagent; do echo "$u: $(systemctl show -p IPAddressDeny --value $u.service | tr ' ' '\n' | sort | tr '\n' ' ')"; done
sudo docker exec azuracast sh -c 'php -v | head -1; dpkg-query -W -f="\${db:Status-Abbrev} \${Package}\n" "php*" | grep -c "^ii" || true'
sudo sshd -T | grep -E '^(permitrootlogin|permitemptypasswords|x11forwarding) '

-N DOCKER-USER -A DOCKER-USER -d 168.63.129.16/32 -j DROP -A DOCKER-USER -d 169.254.169.254/32 -j DROP -N DOCKER-USER -A DOCKER-USER -d ::ffff:168.63.129.16/128 -j DROP -A DOCKER-USER -d ::ffff:169.254.169.254/128 -j DROP -A DOCKER-USER -d fd00:ec2::254/128 -j DROP container -> internet: reachable container -> Azure metadata: blocked (curl exit 28) container -> WireServer: blocked (curl exit 28) VM -> Azure metadata: 200 docker: 168.63.129.16/32 169.254.169.254/32 ::ffff:168.63.129.16/128 ::ffff:169.254.169.254/128 fd00:ec2::254/128 containerd: 168.63.129.16/32 169.254.169.254/32 ::ffff:168.63.129.16/128 ::ffff:169.254.169.254/128 fd00:ec2::254/128 azuracast: 168.63.129.16/32 169.254.169.254/32 ::ffff:168.63.129.16/128 ::ffff:169.254.169.254/128 fd00:ec2::254/128 walinuxagent: PHP 8.5.12 (cli) (built: Oct 21 2026 15:49:51) (NTS) 0 permitrootlogin no x11forwarding no permitemptypasswords no

Exit code 28 is curl's timeout, which means the request is dropped rather than answered.

The SecureAnyCloud settings are visible under Administration > System Settings:

• On Settings, the Site Base URL is your VM's address and Prefer Browser URL is off.
• On Security & Privacy, Always Use HTTPS is on, IP Address Source is the local connection, and Filter Local User-provided URLs is on.
• On Services, Show Update Announcements is off.

Point a DNS record (for example radio.example.com) at the VM's public IP address. Alternatively, give the public IP an Azure DNS name label (<label>.<region>.cloudapp.azure.com) under the public IP's Configuration page.

Then tell the image to serve that name. The command rewrites the nginx host guard, sets AzuraCast's Site Base URL and keeps the name across reboots:

sudo azuracast-set-hostname radio.example.com

For a trusted certificate, open Administration > System Settings > Services. Enter the name under LetsEncrypt > Domain Name(s), optionally add an e-mail address, and save.

AzuraCast requests the certificate over port 80 and renews it itself. The image leaves /.well-known/acme-challenge/ on plain HTTP for exactly this purpose. Port 80 must be reachable from the internet while AzuraCast requests or renews the certificate.

Without your own name, the VM keeps following its public IP when it changes after a deallocate and start. azuracast-hostname.service updates it at boot from Azure metadata.

The image is built for AzuraCast to face the network directly. An Azure Application Gateway, Front Door or another proxy adds X-Forwarded-Proto, X-Forwarded-Port and X-Forwarded-For headers, which the host guard refuses.

If you put AzuraCast behind your own proxy, make these changes:

• Allow only the proxy's address in the network security group.
• Remove the three X-Forwarded lines from /etc/azuracast/nginx.d/10-sac-host.conf. sudo azuracast-set-hostname writes them back, so repeat this after any name change.
• Reload nginx with sudo docker exec azuracast supervisorctl signal HUP nginx.
• Set IP Address Source to Reverse Proxy (X-Forwarded-For) in Security & Privacy.

Make these changes only when every request really arrives through your proxy.

• Super administrator: Sign in and use My Account > Change Password, so the new password never appears on a command line or in your shell history. The file /root/azuracast-credentials.txt is not updated. Once you have stored the new password, remove the old one from the file (sudo nano /root/azuracast-credentials.txt).
• Station passwords (Icecast admin, source, relay and DJ): Open Edit Station Settings > Broadcasting for the station.
• The MariaDB passwords in /etc/azuracast/azuracast.env are used only inside the container and do not need changing.