big-AGI

Prerequisites

• An active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.
• Standard_B2s (2 vCPU, 4 GiB RAM) is a reasonable starting size for the UI itself. big-AGI does not run any model locally. All inference happens on the remote or local API endpoint you configure.
• NSG inbound rules that allow 22/tcp from your management network and 80/tcp.
• Your own API key for the LLM provider you plan to use (OpenAI, Anthropic, Gemini or OpenRouter), or a reachable local inference server (llama.cpp, Ollama or LM Studio).

big-AGI serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain and consider adding 443/tcp (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for big-AGI by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:big-agi-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name big-agi \
  --image sac1647283583153:big-agi-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name big-agi --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active docker.service nginx.service
sudo docker ps --filter name=big-agi --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'

Both systemd units report active, and Docker shows the big-agi container Up. Docker manages the container, which is bound to the loopback connector 127.0.0.1:3000. nginx fronts it on port 80 behind HTTP Basic Auth.

Step 5 - Retrieve your login credentials

big-AGI's access gate is HTTP Basic Auth, with the user admin. The password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/big-agi-credentials.txt

This file contains BIG_AGI_URL, BIG_AGI_USERNAME and BIG_AGI_PASSWORD. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires authentication, so you can use it for an Azure Load Balancer health probe.

Step 7 - Confirm the login password is enforced

A password is set on first boot, so an unauthenticated request to big-AGI is rejected with HTTP 401. Nobody reaches your chat sessions without the password:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/

It prints 401. A wrong password is also rejected with 401. Only the per-VM password from Step 5 returns 200. You can confirm this in the browser in the next step.

Step 8 - Sign in to big-AGI

Browse to http://<vm-public-ip>/. Your browser prompts for HTTP Basic Auth credentials. Enter admin and the password from Step 5.

Once signed in, you land on the chat home. It shows an AI Persona picker (Default, Developer, Scientist, Catalyst, Executive, Custom, or your own persona built with the Persona Creator) and an empty message composer.

Step 9 - Connect your own LLM API key

big-AGI has no server-side accounts or stored keys of any kind. The toolbar shows a Models warning until you add a key. Click it, or the model and settings icon in the sidebar, to open Setup AI Models.

Paste an OpenAI, Anthropic, Gemini or OpenRouter API key. Alternatively, switch to the Local tab to point at a self-hosted OpenAI-compatible endpoint (llama.cpp server, Ollama or LM Studio).

Whatever you enter here is saved only in your browser's local storage. It is never written to this VM, never logged, and never visible to SecureAnyCloud.

Step 10 - Start a conversation

Pick a persona, type your message in the composer, and press Enter (or the Chat button) to send it to the model you configured in Step 9.

Step 11 - Explore the Apps & Tools menu

Select the Apps & Tools icon in the left rail. It opens Create Personas, Compare Text, News, the AI Inspector and Clipboard History. These are big-AGI's built-in productivity tools, alongside the core chat experience.

Step 12 - Confirm the auth credential lives on the dedicated disk

The per-VM .htpasswd for the nginx Basic Auth gate is stored under /var/lib/big-agi on the dedicated Azure data disk. The disk survives OS changes and can be resized independently.

big-AGI's own conversation history, personas and model settings live in your browser's local storage, not on the server:

findmnt /var/lib/big-agi

The mount is backed by a separate Azure data disk that is captured into the image and re-provisioned on every VM.

Maintenance

• Password: the Basic Auth password is set on first boot. To change it, run sudo sh -c 'printf "admin:%s\n" "$(openssl passwd -apr1 NEW_PASSWORD)" > /var/lib/big-agi/.htpasswd' && sudo systemctl reload nginx.
• LLM API keys: you enter all provider keys and local-endpoint URLs in Settings > Models, and they are saved to your browser only. There is nothing server-side to back up, rotate or leak. Clearing your browser's site data for this VM's URL removes them, and you can simply re-enter them.
• Pairs well with: a SecureAnyCloud llama.cpp Server instance as a private backend that needs no external API key. Point big-AGI's Local tab at your llama.cpp Server's address for a fully self-hosted chat stack.
• Upgrades: big-AGI runs as the big-agi container from the pinned ghcr.io/enricoros/big-agi:v2.0.5 image. To upgrade, pull a newer tag and re-run docker run with the same -p 127.0.0.1:3000:3000 binding.
• TLS: big-AGI serves plain HTTP on port 80. Front it with TLS (for example, certbot with your own domain) before running it in production, especially before entering real API keys in the browser.
• Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.
• License: big-AGI Open is MIT licensed. This image ships the free Open edition. Some optional big-AGI Pro features described in the upstream project are not included.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch big-AGI on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com