ChirpStack Ubuntu 24.04

Prerequisites

• An active Azure subscription
• An SSH key pair
• A VNet plus subnet in the target region
• VM size: Standard_B2s (2 vCPU / 4 GiB RAM) is the recommended size for evaluation and small networks. For large fleets, choose a size with more memory.
• NSG inbound: allow 22/tcp from your management network and 443/tcp for the web console.
• Port 80/tcp is optional, because it only issues a redirect to HTTPS.
• To connect real LoRa gateways using the Semtech UDP packet forwarder, also allow 1700/udp from your gateways.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for ChirpStack by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443).

Choose Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:chirpstack-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name chirpstack \
  --image sac1647283583153:chirpstack-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
# Open the HTTPS port so you can reach the web console
az vm open-port --resource-group <your-rg> --name chirpstack --port 443 --priority 900

Step 3 - Retrieve the per-VM admin password

Nothing secret is baked into the image. ChirpStack normally ships with a default admin / admin console login. On this image, that default is rotated away on the very first boot.

A one-shot service (chirpstack-firstboot.service) generates a fresh database password, a fresh API/JWT signing secret, a fresh TLS certificate and a unique administrator password, all unique to your instance. It writes them to /root/chirpstack-credentials.txt, readable only by root. SSH in as azureuser and read them:

$
sudo cat /root/chirpstack-credentials.txt
# ChirpStack - generated on first boot by chirpstack-firstboot.service.
# These credentials are unique to THIS VM. Store them somewhere safe. chirpstack.url=https://20.55.10.42/ chirpstack.admin.user=admin chirpstack.admin.pass=Xq7pR2mK9wU4nZ8vB3hL6yD1
# Canonical keys consumed by the sac smoke verifier + guide substitution: CHIRPSTACK_ADMIN_PASSWORD=<set-at-first-boot> CHIRPSTACK_URL=https://20.55.10.42/

The rotation service is ordered before the ChirpStack server and the nginx console, so the console only becomes reachable after the default password has been replaced.

The username stays admin. The password above is an example, and your instance has its own unique value.

Step 4 - Confirm the services are running

Check that PostgreSQL, Redis, Mosquitto, the ChirpStack server, the gateway bridge and nginx are all active:

sudo systemctl is-active postgresql redis-server mosquitto chirpstack chirpstack-gateway-bridge nginx

All six report active. The ChirpStack API and the MQTT broker bind to loopback only (127.0.0.1:8080 and 127.0.0.1:1883). nginx publishes the console on 443 (and a redirect on 80), and the gateway bridge listens for gateways on UDP 1700:

sudo ss -tlnp | grep -E ':(80|443|8080|1883) '

Step 5 - Confirm the web console over HTTPS

The console is served over HTTPS on port 443 with a per-VM self-signed certificate. A request to the HTTPS endpoint returns 200, and the plain HTTP port 80 returns a 301 redirect to HTTPS. The API and MQTT ports are not reachable from the network.

Run:

curl -k -s -o /dev/null -w 'HTTPS %{http_code}\n' https://127.0.0.1/

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/

Because the certificate is self-signed, your browser shows a certificate warning on first visit. Accept the warning to proceed, or install /etc/nginx/tls/chirpstack.crt as a trusted certificate.

For production, replace it with a certificate for your own domain (see Step 10).

Step 6 - Sign in to the web console

Browse to https://<vm-ip>/ and sign in as admin with the password from /root/chirpstack-credentials.txt. ChirpStack opens on the login page.

After you sign in, the dashboard summarises your active devices, active gateways and device data rate usage, with the Network Server and Tenant navigation down the left.

The screenshots in this guide show ChirpStack populated with a small set of example objects. A freshly deployed instance starts empty, ready for you to model your own network.

Step 7 - Create applications, device profiles and devices

Use Applications to group the devices that share an integration, for example a fleet of environmental sensors or asset trackers. Each application lists its devices with their DevEUI, name and device profile.

Open an application to see its Devices tab. A device is identified by its 64-bit DevEUI and is bound to a device profile, which pins the LoRaWAN region (EU868, US915 and so on), MAC version and class.

Create device profiles under the tenant's Device Profiles. Then add devices to an application and provision their keys for OTAA activation.

Step 8 - Use the gRPC API

ChirpStack v4 exposes a gRPC and gRPC web API on the same port as the console (there is no separate JSON REST server in the core binary). The image includes grpcurl so you can drive the API from the shell.

Log in with your per-VM admin password to obtain a JWT, then pass it as an authorization: Bearer header. This example logs in, lists tenants and lists the applications in the default tenant:

$
PW=$(sudo grep '^CHIRPSTACK_ADMIN_PASSWORD=' /root/chirpstack-credentials.txt | cut -d= -f2-) $
JWT=$(grpcurl -plaintext -d "{\"email\":\"admin\",\"password\":\"$PW\"}" \
  127.0.0.1:8080 api.InternalService/Login | jq -r .jwt) $ grpcurl -plaintext -H "authorization: Bearer $JWT" -d '{"limit":10}' \
  127.0.0.1:8080 api.TenantService/List | jq -r '.result[].name' ChirpStack $
TID=$(grpcurl -plaintext -H "authorization: Bearer $JWT" -d '{"limit":10}' \
  127.0.0.1:8080 api.TenantService/List | jq -r '.result[0].id') $ grpcurl -plaintext -H "authorization: Bearer $JWT" \
  -d "{\"tenantId\":\"$TID\",\"limit\":10}" \
  127.0.0.1:8080 api.ApplicationService/List | jq -r '.result[].name' Asset Trackers Environmental Sensors

The default admin / admin login is rejected on your instance, and so is an unauthenticated API call. Only the per-VM password issues a working token.

Use grpcurl -plaintext 127.0.0.1:8080 list to browse the available services (Tenant, Application, DeviceProfile, Device, Gateway and more), and grpcurl ... describe <service> for their methods. You can also create long-lived API keys from API Keys in the console.

Step 9 - Connect a LoRa gateway

Real LoRa gateways connect through the bundled ChirpStack Gateway Bridge. The bridge listens for the Semtech UDP packet forwarder on UDP 1700 and translates it to the local MQTT broker. BasicStation is also supported.

Open 1700/udp in the NSG from your gateways first. Then point your gateway's packet forwarder at this VM's public IP on UDP 1700, and add the gateway under the tenant's Gateways using its Gateway EUI.

The Mosquitto broker itself stays bound to loopback, so it is never exposed to the network.

Step 10 - Enable HTTPS with your own domain

The image ships with a per-VM self-signed certificate so the console works over TLS immediately. For production, point a DNS record at the VM's public IP. Then replace the certificate at /etc/nginx/tls/chirpstack.crt and /etc/nginx/tls/chirpstack.key with a certificate for your domain, for example one obtained with certbot. Alternatively, terminate TLS at Azure Application Gateway in front of the VM.

Reload nginx after you replace the certificate:

$
sudo systemctl reload nginx

Administration and support

The ChirpStack configuration lives in /etc/chirpstack/ (chirpstack.toml plus the per-region region_*.toml files). Enable or disable LoRaWAN regions with the network.enabled_regions list, then restart with sudo systemctl restart chirpstack.

The gateway bridge configuration is in /etc/chirpstack-gateway-bridge/. The admin password and every per-VM secret live in /root/chirpstack-credentials.txt.

This image is a repackaged open-source software product, with additional charges for SecureAnyCloud support services. Our engineers provide 24/7 support for deployment, upgrades, TLS termination with your own domain, gateway onboarding, MQTT exposure and integration, LoRaWAN region configuration and scaling.

ChirpStack is a trademark of its respective owner. This page uses the name only to identify the software this image packages.

Deploy on Azure

Launch ChirpStack on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com