Baby Buddy

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting size, because Baby Buddy is light on resources.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, 80/tcp for the web application, and 443/tcp if you add TLS.

Baby Buddy serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain and restrict access to trusted IP ranges (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Baby Buddy by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:baby-buddy-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name baby-buddy \
  --image sac1647283583153:baby-buddy-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 to your network so that you can reach the web application:

az vm open-port --resource-group <your-rg> --name baby-buddy --port 80

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active babybuddy.service nginx.service

Both services report active. Baby Buddy runs under gunicorn on the loopback address 127.0.0.1:8000, and nginx fronts it on port 80. The application is never bound to a public interface, so nginx is the only way in.

Step 5 - Retrieve your admin password

Baby Buddy uses its own Django login. The username is admin. Your VM generates a unique password on first boot and writes it to a root-only file:

sudo cat /root/babybuddy-credentials.txt

The file contains BABYBUDDY_USERNAME, BABYBUDDY_PASSWORD and the BABYBUDDY_URL to open in a browser. Its mode is 0600 root:root.

The default admin/admin account that Baby Buddy normally ships is removed at build time, so no shared or default credential exists in the image. Store the password somewhere safe and change it after your first sign-in (see Maintenance).

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes. Request it from the VM:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires authentication, so it is safe to use for an Azure Load Balancer health probe.

Step 7 - Confirm authentication is required

Baby Buddy manages its own login, so nobody can reach the dashboard without signing in. An unauthenticated request to the dashboard returns HTTP 302 and redirects to the sign-in page, while the health endpoint stays open:

echo "health : $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/healthz)"
echo "dashboard: $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/dashboard/)"

It prints health : 200 and dashboard : 302. The dashboard, timeline and every tracking view require the per-VM admin password, and only the health endpoint is open. gunicorn is bound to loopback, so nginx is the only way in.

Step 8 - Confirm the installed version and components

Baby Buddy runs on Django in a dedicated virtual environment. Confirm the framework version and check that the core components are in place:

/opt/babybuddy/venv/bin/python -c "import django; print('Django', django.get_version())"
sudo ls /opt/babybuddy/venv/bin/gunicorn /opt/babybuddy/app/data/db.sqlite3 /etc/systemd/system/babybuddy.service

It reports Django 5.2 and lists the gunicorn binary, the SQLite database on the OS disk and the systemd unit. The image ships Baby Buddy 2.9.2 with a demo child, so the dashboard is populated on first boot.

Step 9 - Sign in

Browse to http://<vm-public-ip>/. When Baby Buddy shows its sign-in page, enter admin and the password from Step 5.

You land on the dashboard for the demo child. It is a grid of at-a-glance cards: last feeding, last sleep, last diaper change, last pumping, recent activity counts and rolling statistics. The sample entries that ship with the image populate all of them.

Step 10 - Explore the timeline

Open a child from the Children menu, or open Timeline from the top navigation. You see the chronological record of everything tracked, including feedings, sleep, diaper changes, tummy time and notes, with timestamps and quick edit links.

Use this view to review and correct individual entries.

Step 11 - View the reporting charts

Open a child and choose Reports to reach the charting views.

Baby Buddy renders interactive charts for feeding amounts and types, sleep patterns, diaper change frequency, tummy time and growth (weight, height and head circumference). The Feeding Amounts report, for example, breaks daily intake down by type across the tracked period.

Step 12 - Add your own child and remove the demo data

The image ships a demo child so the dashboard is not empty. When you are ready, add your own child from the Children menu (Children -> Add Child). Then start tracking from the Activities and Measurements menus, or with the quick-add buttons on the dashboard.

To remove the demo child once you have your own, open it from the Children list and choose Delete. This removes the demo child and all of its sample entries.

Maintenance

• Password. The administrator password is generated on first boot and stored in /root/babybuddy-credentials.txt (mode 0600 root:root). Change it in the web interface under the admin user menu -> Settings, or reset it from the command line: cd /opt/babybuddy/app && sudo runuser -u babybuddy -- env DJANGO_SETTINGS_MODULE=babybuddy.settings.production SECRET_KEY=$(grep '^SECRET_KEY=' /opt/babybuddy/babybuddy.env | cut -d= -f2-) /opt/babybuddy/venv/bin/python manage.py changepassword admin.
• Add users. Invite additional caregivers from Users in the top navigation, or create one on the command line with Baby Buddy's createuser management command.
• Restrict access. Baby Buddy serves plain HTTP on port 80. For production, restrict access to trusted IP ranges in your NSG, and front it with TLS (for example, certbot with your own domain) terminating on :443. If you use a custom hostname, add your domain to CSRF_TRUSTED_ORIGINS and ALLOWED_HOSTS in /opt/babybuddy/babybuddy.env, then run sudo systemctl restart babybuddy.
• Loopback binding. gunicorn is bound to 127.0.0.1:8000 in /etc/systemd/system/babybuddy.service, so nginx is the only path in. Do not change the bind address to a public interface.
• Database. The SQLite database lives at /opt/babybuddy/app/data/db.sqlite3 (owned babybuddy:babybuddy). Back it up by copying the file while the service is stopped, or use Baby Buddy's built-in Import / Export under the Database menu.
• Upgrades. Baby Buddy is installed from a pinned release into its virtual environment. To upgrade, replace the source under /opt/babybuddy/app, reinstall requirements with /opt/babybuddy/venv/bin/pip, and run manage.py migrate and manage.py collectstatic. Then run sudo systemctl restart babybuddy.
• Security patches. unattended-upgrades remains enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Baby Buddy on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Prerequisites

• An AWS account subscribed to this product in AWS Marketplace
• An EC2 key pair in your target region for SSH access
• A security group that allows inbound TCP 22 (SSH) from your IP and TCP 80 (HTTP) from your users
• The recommended instance type, m5.large or larger

Connecting to your instance

Connect over SSH as the default login user for your operating system variant, using the key pair you launched with.

OS variant Login user Example

Ubuntu 24.04 ubuntu ssh -i your-key.pem ubuntu@<instance-public-ip>

Step 1 - Launch from the AWS Marketplace console

• Open the product page in AWS Marketplace and choose Continue to Subscribe, then Continue to Configuration.
• Select the software version and your AWS Region, then choose Continue to Launch.
• Choose an instance type (m5.large or larger), your VPC subnet, the security group described above, and your EC2 key pair.
• Launch the instance and wait until it reaches the running state and its status checks pass.

Step 2 - Launch from the AWS CLI (alternative)

Replace the AMI ID, key name, security group and subnet with your own values:

aws ec2 run-instances \
  --image-id ami-xxxxxxxxxxxxxxxxx \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --metadata-options "HttpTokens=required" \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=baby-buddy}]'

Step 3 - Retrieve the per-instance admin password

SSH into the instance and read the credentials file that first boot generated. It contains the URL, the admin username and the unique password for this instance:

sudo cat /root/babybuddy-credentials.txt

The BABYBUDDY_PASSWORD value is unique to this instance. Store it somewhere safe.

Step 4 - Sign in

Browse to the instance over HTTP and sign in with the admin username and the password from Step 3:

http://<instance-public-ip>/

You land on the dashboard, which the pre-loaded demo child already populates. You can see feedings, sleep, diaper changes and more at a glance.

The Timeline and each child's page show every tracked entry in chronological order, with tags, so patterns are easy to spot.

Step 5 - Change the admin password and add caregivers

For production, change the generated password after your first sign-in. Open the User menu (top right) and choose Settings. There you can update your profile, language, timezone and dashboard preferences, and use Change Password.

To add more caregiver accounts, open the Users area.

Step 6 - Add your own child and remove the demo data

The image ships with one demo child so the dashboard is not empty on first launch. When you are ready:

• Open the Children menu and choose Add Child to create your own child's profile.
• Record real entries from the Activities and Measurements menus, or start a Timer for a live feeding or sleep session.
• To remove the sample data, open the demo child from the Children list, choose Edit, then choose Delete Child. This removes the child and all of its sample entries.

Verifying the deployment

Check that both systemd services that make up the application are active:

systemctl is-active babybuddy.service nginx.service

The unauthenticated health endpoint that nginx serves returns HTTP 200 and is safe to use for load balancer and uptime probes:

curl -fsS -o /dev/null -w 'healthz: HTTP %{http_code}\n' http://127.0.0.1/healthz

A bundled helper proves the full login round trip end to end. It confirms that the dashboard requires authentication, that a wrong password is rejected, and that the per-instance admin password signs in successfully:

sudo bash /usr/local/sbin/babybuddy-verify-login.sh

It prints OK when the round-trip succeeds.

Data, configuration and services

• Application code. /opt/babybuddy/app (Django project), running in a dedicated Python virtual environment at /opt/babybuddy/venv.
• Database and media. /var/lib/babybuddy on the dedicated EBS data volume. The SQLite database is /var/lib/babybuddy/data/db.sqlite3, and uploads are under /var/lib/babybuddy/media.
• Environment file. /opt/babybuddy/babybuddy.env holds the per-instance Django secret key and host settings, written on first boot.
• Services. Manage babybuddy.service (gunicorn) and nginx.service with systemctl.

Because the data lives on its own EBS volume, you can grow it independently of the OS disk. Expand the volume in the EC2 console, then grow the filesystem on the instance.

Backups

Baby Buddy stores everything in a single SQLite database on the data volume. Take a consistent copy with the bundled SQLite tooling, or snapshot the EBS data volume from the EC2 console. A simple file copy of the database to a backup location also works, for example:

sudo cp /var/lib/babybuddy/data/db.sqlite3 /your-backup-location/babybuddy-$(date +%F).sqlite3

For scheduled, off-instance backups, create an Amazon EBS snapshot of the data volume (or a Data Lifecycle Manager policy) so your history is protected independently of the instance.

Step 7 - Enable HTTPS (recommended for production)

Baby Buddy is served over plain HTTP on port 80 by default. For production, put it behind TLS. The simplest options are:

• Terminate TLS at an AWS Application Load Balancer or CloudFront in front of the instance.
• Point a domain at the instance and obtain a free Let's Encrypt certificate with certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

The application already reads its trusted-origin settings from the environment and trusts the X-Forwarded-Proto header from nginx, so sign-in works correctly once TLS is terminated in front of it.

If you front the instance with a custom hostname, add your domain to CSRF_TRUSTED_ORIGINS in /opt/babybuddy/babybuddy.env, then restart the service.

Support

This product includes 24/7 technical support. Email sales@secureanycloud.com for help with deployment, first sign-in, adding children and caregivers, removing the demo data, TLS termination, backups, resizing the data volume, and software updates.

Deploy on AWS

Launch Baby Buddy on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com