SecureAnyCloud
Deployment guide

Blazer

Overview

Blazer is an open-source, self-hosted business-intelligence tool. You explore your data with SQL, turn queries into charts and dashboards, and set up data checks that alert you when something looks wrong.

The SecureAnyCloud image runs Blazer 3.4.0 from the official ankane/blazer Docker image as a systemd service behind an nginx reverse proxy on port 80. Blazer has no built-in authentication, so nginx protects it with HTTP Basic auth. The username and password are generated uniquely on the first boot of every VM, along with a fresh Rails secret and a fresh database password.

What you get:

  • Blazer 3.4.0 (MIT) run from the official ankane/blazer Docker image, managed by blazer.service
  • Blazer published on port 80 via nginx, gated by HTTP Basic auth so the tool is not open to the internet
  • A bundled local PostgreSQL 16 database that holds both Blazer's own metadata and a seeded sample dataset (users, orders, events)
  • Four example queries (Orders per Month, Revenue by Status, Top Cities by Users, Weekly Signups), a Sales Overview dashboard and a data check, seeded so the interface shows real content the moment it boots
  • A unique Basic auth admin password, a unique Rails SECRET_KEY_BASE and a unique PostgreSQL password generated on first boot, written to a root-only credentials file
  • postgresql@16-main.service, blazer.service and nginx.service as systemd units, enabled and active
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point.

On the network security group (NSG), allow inbound 22/tcp from your management network and 80/tcp for Blazer. For public exposure, front Blazer with TLS (see Enabling HTTPS).

The bundled PostgreSQL listens only on loopback and is never exposed.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Blazer by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then choose Review + create -> Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:blazer-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name blazer \
  --image sac1647283583153:blazer-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name blazer --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active postgresql@16-main.service blazer.service nginx.service

All three report active. On first boot, the image generates a unique Basic auth admin password, a unique Rails secret and a unique database password.

Step 5 - Retrieve your admin credentials

Blazer has no built-in login, so the SecureAnyCloud image puts it behind nginx HTTP Basic auth. The admin username and password are generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/blazer-credentials.txt

The file contains BLAZER_URL, BLAZER_ADMIN_USER (admin) and BLAZER_ADMIN_PASSWORD. Store them somewhere safe. You use this credential to sign in to Blazer in your browser.

Step 6 - Check the health endpoint

nginx serves a static, unauthenticated health endpoint for load balancer probes. It returns 200:

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/healthz

Step 7 - Confirm your credentials gate the tool

nginx fronts Blazer with HTTP Basic auth. A valid login returns 200, and a missing or wrong password returns 401:

curl -s -o /dev/null -w '%{http_code}\n' -u 'admin:<BLAZER_ADMIN_PASSWORD>' http://localhost/queries
curl -s -o /dev/null -w '%{http_code}\n' http://localhost/queries

The first command prints 200. The second prints 401.

Step 8 - Open Blazer in your browser

Browse to http://<vm-public-ip>/ and sign in with admin and the password from Step 5. The home page lists the seeded example queries and the Sales Overview dashboard.

Open the Orders per Month query to see its SQL and the result. Blazer automatically renders a time-series result as a chart above the results table.

Open Revenue by Status to see a two-column result rendered as a column chart. Every query keeps its SQL editable at the top, so you can tweak the statement and re-run it.

Open the Sales Overview dashboard to see several queries laid out together on one page. It is a starting point for building your own dashboards.

Step 9 - Inspect the seeded queries and sample data

Blazer stores its saved queries, dashboards and checks in the bundled PostgreSQL database, alongside the sample dataset those queries run against. List the seeded queries, then run one of them directly:

sudo -u postgres psql -d blazer -c 'SELECT id, name, data_source FROM blazer_queries ORDER BY id;'
sudo -u postgres psql -d blazer -c 'SELECT status, round(SUM(amount)) AS revenue FROM orders GROUP BY 1 ORDER BY 2 DESC;'

The first command lists the four example queries. The second runs the same aggregation as the Revenue by Status query, against the seeded orders table.

Step 10 - Create your own query

In the browser, click New Query, give it a name, write a SELECT statement and click Run. Blazer shows the results as a table. When the shape suits it (a time column with numbers, or a label column with a single numeric column), it also shows a chart.

Save the query, then add it to a dashboard from the dashboard's Edit view. You can also create a check on any query, so Blazer alerts you when the result changes unexpectedly.

Point Blazer at your own database

The image ships a bundled PostgreSQL database seeded with sample data, so Blazer works out of the box. Blazer's default data source, main, points at that same database through the DATABASE_URL in the environment file on the VM. To query a different database, add another data source.

Blazer reads its data sources from DATABASE_URL and, for additional sources, from a blazer.yml config. The simplest approach is to point the default source at your own database. Edit the environment file /var/lib/blazer/blazer.env and set a new DATABASE_URL:

DATABASE_URL=postgres://readonly_user:your-db-password@your-db-host:5432/your_database

Use a read-only database user for reporting. After you change the environment file, restart Blazer so the container picks up the new connection:

sudo systemctl restart blazer

Blazer supports PostgreSQL, MySQL and many other data sources. See the Blazer documentation for adding multiple named data sources through blazer.yml, and for statement timeouts, caching and smart variables.

Security notes

  • No default login ships in the image. The Basic auth admin password, the Rails SECRET_KEY_BASE and the PostgreSQL password are all generated uniquely on the first boot of every VM. The admin login lives in /root/blazer-credentials.txt (mode 0600, root only).
  • Blazer is reachable only through nginx on port 80. The Blazer container is bound inside the host, and the bundled PostgreSQL listens only on loopback (127.0.0.1:5432). Neither is exposed to the network. Keep your NSG limited to 22/tcp and 80/tcp (or 443/tcp once you enable TLS).
  • Blazer runs the SQL you write against your data sources. Point it at read-only database users and restrict who can reach the tool.

Enabling HTTPS

In production, front Blazer with TLS. Point a DNS record at the VM and open 443/tcp on the NSG. Then install a certificate with Certbot and the nginx plugin:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot obtains a certificate, updates the nginx site to serve HTTPS, and sets up automatic renewal.

Maintenance

Check the Blazer container and tail its logs:

sudo docker ps --filter name=blazer
sudo journalctl -u blazer.service -n 50 --no-pager

Restart or stop the service with sudo systemctl restart blazer or sudo systemctl stop blazer.

The bundled database is a standard PostgreSQL 16 cluster. Back it up with sudo -u postgres pg_dump blazer. Unattended upgrades apply OS security updates automatically.

Support

SecureAnyCloud maintains this image and provides 24/7 support. For help, contact support through the SecureAnyCloud listing on the Azure Marketplace.

Deploy on Azure

Launch Blazer on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure