BunkerWeb

Replace <vm-ip> with the public IP address of your VM. The default login user is azureuser.

ssh azureuser@<vm-ip>

sudo systemctl is-active docker bunkerweb test -f /var/lib/sac/data/bunkerweb-firstboot.done && echo "first boot: complete"
sudo docker ps --format '{{.Names}} {{.Status}}'

You should see active printed twice, first boot: complete, and the bunkerweb-aio container reporting Up ... (healthy).

bunkerweb.service starts only once first boot has written your per-VM secrets, so a fresh VM is never left running with a default login.

A unique administrator password, Flask session secret, 2FA encryption key and a hard-to-guess dashboard path are generated for your instance on its first boot. They are written to a root-only file (0600 root:root). The full login URL, including the secret path, is in the file.

sudo ls -l /root/bunkerweb-credentials.txt
sudo cat /root/bunkerweb-credentials.txt

The file holds your BUNKERWEB_URL (replace <VM-PUBLIC-IP> with this VM's public IP address from the Azure portal), bunkerweb.username, bunkerweb.password and the secret bunkerweb.ui_path.

Note the BUNKERWEB_URL value. That is exactly where you sign in.

This check confirms that the per-VM administrator credentials authenticate against the BunkerWeb web UI over the same CSRF-protected login flow a browser uses. It reads the generated username, password and secret path from the credentials file and signs in.

CREDS=/root/bunkerweb-credentials.txt
USER=$(sudo grep '^bunkerweb.username=' "$CREDS" | cut -d= -f2-)
PASS=$(sudo grep '^bunkerweb.password=' "$CREDS" | cut -d= -f2-)
UIPATH=$(sudo grep '^bunkerweb.ui_path=' "$CREDS" | cut -d= -f2-) sudo /usr/local/sbin/bunkerweb-login-check.sh "$USER" "$PASS" "$UIPATH"

An OK: line confirms that the per-VM administrator credentials authenticate and the dashboard is live.

The WAF listens on ports 80 and 443. HTTP is redirected to HTTPS, and the dashboard is served over HTTPS at your secret path. The raw web UI (port 7000) is bound to localhost only, and the container image is pinned by digest. Run the checks:

UIPATH=$(sudo grep '^bunkerweb.ui_path=' /root/bunkerweb-credentials.txt | cut -d= -f2-)
curl -ks -o /dev/null -w 'HTTP -> HTTPS redirect: %{http_code}\n' http://127.0.0.1/ curl -ks -o /dev/null -w 'dashboard through the WAF: %{http_code}\n' "https://127.0.0.1${UIPATH}"
sudo ss -tlnH 'sport = :7000' | awk '{print "raw UI 7000 bound to:", $4}'
sudo docker inspect --format 'image pinned: {{.Config.Image}}' bunkerweb-aio

A 301 redirect to HTTPS and a 303/200 from the dashboard path confirm that the WAF is serving. The raw UI shows 127.0.0.1:7000, which means localhost only.

systemctl is-enabled bunkerweb-firstboot.service 2>/dev/null || echo "disabled (already ran on first boot)" uname -r apt-mark showhold

The bunkerweb-firstboot.service reports disabled. It runs once on first boot to generate your unique credentials, then disables itself.

apt-mark showhold prints nothing, so no security updates are held back.

Browse to the BUNKERWEB_URL from Step 3: it has the form https://<VM-PUBLIC-IP>/<secret-path>/. Accept the self-signed certificate warning, and sign in with your generated username and password.

The dashboard answers on whatever address you use, so the same secret path also works over the VNet private IP address or an SSH tunnel.

After signing in, you land on the Home dashboard, your single pane of glass. It shows the running BunkerWeb instance and version, counts of your instances, services and plugins, and live traffic metrics: total requests, blocked requests, blocked unique IPs, and a request status distribution chart.

The left sidebar gives you Instances, Global Settings, Services, Configs, Templates, Plugins, Cache, Reports, Bans, Jobs and Logs.

Open Global Settings to configure BunkerWeb's protections. Each security feature is a plugin: General, ACME (automatic Let's Encrypt certificates), Antibot, Anti DDoS, Auth basic, rate limiting, the ModSecurity WAF with the OWASP Core Rule Set, bad behaviour, reverse proxy and more.

Settings applied here become the defaults for every protected service. Individual services can override them.

Open Services and choose Create new service to protect a backend. Give the service a server name (a domain that resolves to this VM), and point it at your upstream application with the reverse proxy settings.

Choose its security mode. Block actively blocks malicious traffic, and Detect only logs it. BunkerWeb then proxies and protects that site on ports 80 and 443, and requests a Let's Encrypt certificate automatically when the domain resolves publicly.

Manage the WAF with systemd and Docker:

sudo systemctl status bunkerweb --no-pager | head -5 sudo docker logs --tail 20 bunkerweb-aio

BunkerWeb's configuration, database and Redis state live in the bw-data Docker volume on the OS disk. Keep the OS patched. Unattended security upgrades are enabled by default.

To move to a newer BunkerWeb release, review the upstream release notes first. Then update the pinned image reference in /etc/systemd/system/bunkerweb.service and restart the service.