Bichon

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Choose a larger size if you archive many accounts concurrently or index a large historic mailbox.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 15630/tcp for the web interface. In production, restrict 15630/tcp to trusted networks, because it exposes your entire mail archive.

Size the data disk for the mail you intend to keep. Bichon compresses bodies and attachments and stores identical content once, so the archive is usually smaller than the source mailboxes.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Bichon by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22).

Review the dedicated data disk on the Disks tab, then select Review + create and Create. After the VM is created, add an NSG rule for 15630/tcp scoped to the networks that should reach the archive.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:bichon-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name bichon \
  --image sac1647283583153:bichon-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the web interface port:

az vm open-port --resource-group <your-rg> --name bichon --port 15630 --priority 900

Step 3 - Confirm the service is running

SSH in as azureuser and confirm Bichon is active. The server listens on port 15630 and serves both the REST API and the web interface from that one port.

systemctl is-active bichon bichon-firstboot

sudo ss -tlnp | grep ':15630 ' | awk '{print $1, $4}'

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/bichon

curl -s http://127.0.0.1:15630/api/status | jq .

The status endpoint is public and unauthenticated, so it works as a health check for a load balancer or a monitoring probe. It reports the running version and how long the server has been up:

{ "uptime_ms": 618664, "timeago": "10 minutes ago", "timezone": "+00:00", "version": "2.0.2" }

Step 4 - Read your per-VM administrator password

Every VM generates its own administrator password on first boot and writes it to a root-only file. Nothing is shared between deployments, and SecureAnyCloud does not know the password. Read it with sudo:

sudo cat /root/bichon-credentials.txt

The file records the web interface URL, the administrator username and the password that first boot generated for this machine:

BICHON_URL=http://10.0.0.14:15630/ bichon.admin.username=admin bichon.admin.password=<unique to your VM>

You can prove from the command line that the password in that file signs in and that the published upstream default does not. First, try the per-VM password:

BICHON_PW=$(sudo grep '^bichon.admin.password=' /root/bichon-credentials.txt | cut -d= -f2-)
curl -s -X POST -H 'Content-Type: application/json' \
  -d "{\"username\":\"admin\",\"password\":\"$BICHON_PW\"}" \
  http://127.0.0.1:15630/api/login | jq '{success, signed_in: (.access_token != null)}'

{ "success": true, "signed_in": true }

Now try the upstream default, which this image replaces before the public listener starts:

curl -s -X POST -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"admin@bichon"}' \
  http://127.0.0.1:15630/api/login | jq '{success, error_message}'

{ "success": false, "error_message": "Incorrect password." }

Step 5 - Sign in to the web interface

Browse to http://<vm-public-ip>:15630/. Bichon opens on its sign-in page. No part of the archive is accessible anonymously.

Sign in as admin with the password from Step 4. Change it to your own password straight away under Settings, then Profile.

Step 6 - The archive dashboard

The dashboard is the landing page after you sign in. It reports how many mail accounts are connected, how many messages and attachments are archived, and how much disk the compressed blob store and the search index use.

Below that, it charts message volume over time and the share of mail that carries attachments. It also lists your top senders, largest messages, largest attachments and busiest accounts.

Step 7 - Connect a mailbox to archive

Open Email Accounts from the left navigation. Choose IMAP account to archive a live mailbox, then enter the address, the IMAP host and port, the encryption mode, and either a password or OAuth 2.0. Bichon can discover most provider settings from the email domain.

Set a download interval or a cron schedule. Optionally scope the download by date range or by folder so that you archive only what you need. Choose Local account instead if you want a container for imported mail with no IMAP server behind it.

After the first pass, Bichon downloads incrementally and fetches only new messages by UID. It detects UIDVALIDITY changes and rebuilds its cache automatically.

Step 8 - Import existing mail

You can load existing archives directly. In the web interface, open Import and upload .eml or .mbox files into an account and folder. For larger or scripted migrations, use the bundled command-line tool. It also handles Thunderbird profiles and Outlook PST files, and it can export back to MBOX.

/usr/local/bin/bichon-cli --version

On first run, the tool writes a config.toml that holds your server URL and an API token. Create the token under Settings, then API tokens. All parsing, indexing, deduplication and storage happen server-side.

Step 9 - Search the archive

Open Search and type a term. Bichon queries the full-text index across subjects, bodies, participants and attachment properties, and returns matches with the sender, recipient, folder, size, attachment count and date.

Narrow the results with the account, mailbox, contact and tag filters, or open Advanced for date ranges, size ranges, attachment presence and file type. Select a result to read the message, view the whole conversation thread, download the original EML, or restore it to an IMAP mailbox.

Step 10 - Verify the stack

Confirm the shipped version, check that the unit is enabled for reboots, check that the API answers, and verify the dedicated data disk mount:

/usr/local/bin/bichon-cli --version

systemctl is-enabled bichon

curl -s -o /dev/null -w 'GET /api/status -> HTTP %{http_code}\n' http://127.0.0.1:15630/api/status

df -h /var/lib/bichon | tail -1

Step 11 - Where your mail is stored

The entire archive lives on a dedicated Azure data disk mounted at /var/lib/bichon, separate from the operating system disk. This disk is captured into the image and re-provisioned on every VM. You can snapshot and resize it independently as the archive grows.

sudo ls /var/lib/bichon

Three storage layers sit under that mount. bichon-indices is the Tantivy full-text index, bichon-storage is the compressed blob store that holds message bodies and attachments, and memdb holds relational metadata. Identical bodies and attachments are stored once and referenced by content hash, so duplicated mail across accounts costs very little extra space.

df -h /var/lib/bichon | tail -1

To back up the archive, snapshot the data disk and keep a copy of /etc/bichon/encrypt.key with it. That key is unique to this VM and encrypts the stored IMAP passwords and OAuth tokens. Without it, a restored archive cannot reconnect to your mail accounts.

Step 12 - Explore the API

Every feature of the web interface is available over the REST API, which is documented interactively on the VM itself. Browse to http://<vm-public-ip>:15630/api-docs/swagger for Swagger UI, to /api-docs/redoc or /api-docs/scalar for alternative renderings, or to /api-docs/spec.json for the raw OpenAPI 3.0 document.

Endpoints under /api/v1/ take an Authorization: Bearer header. Create long-lived tokens for automation under Settings, then API tokens, so that scripts never need the administrator password.

Security notes

• Protect the shared port. The web interface and the API share port 15630. Restrict 15630/tcp in the NSG to trusted networks, and consider fronting it with your own TLS-terminating proxy or reaching it over a VPN. The archive contains the full text of your mail.
• No shipped credentials. The archive store is empty at capture, so the image contains no user database at all. First boot generates the administrator password and the data encryption key for that VM alone, completes the bootstrap on the loopback interface, and replaces the upstream default before the public listener starts.
• Protect the secrets. /root/bichon-credentials.txt is 0600 root:root, and /etc/bichon/encrypt.key is 0400 and owned by the service account. Change the administrator password to your own under Settings, then Profile. Give each person their own account and role rather than sharing the administrator.
• Unprivileged service. Bichon runs as the unprivileged bichon system account under systemd, with NoNewPrivileges, a private /tmp, a read-only system tree and write access limited to the archive disk.
• Limit access with roles. Managers, members and per-account viewers can be scoped to individual mailboxes, which matters when an archive spans several teams.
• Keep the VM patched. The image is patched at build time and ships with unattended security upgrades enabled.

Support

SecureAnyCloud images come with 24/7 support. For questions about this Bichon image or help with your deployment, contact us through the SecureAnyCloud website.

Deploy on Azure

Launch Bichon on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com