ClearFlask

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is the recommended size, and it is what the stack is tuned for.

In the network security group (NSG), allow inbound 22/tcp from your management network and 80/tcp for the ClearFlask web interface. You do not need to open any other port, because the database, the LocalStack services and the Java backend are all internal.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, select Create a resource, and search the Marketplace for ClearFlask by SecureAnyCloud. Select Create.

On the Basics tab, pick your subscription, resource group, region and the Standard_B2s size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, and then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:clearflask-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name clearflask \
  --image sac1647283583153:clearflask-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open the ClearFlask web port:

az vm open-port --resource-group <your-rg> --name clearflask --port 80 --priority 900

Wait a couple of minutes before you sign in. The first boot brings the stack up, rotates the secrets and seeds the administrator.

Step 3 - Confirm the stack is running

SSH in as azureuser and confirm that the ClearFlask units, Docker and nginx are all active.

clearflask-firstboot.service is the one-shot unit that rotates the secrets and seeds the administrator on first boot. clearflask.service keeps the Compose stack up.

systemctl is-active clearflask-firstboot clearflask docker nginx

Only SSH and the ClearFlask web interface face the network. Confirm that nginx is serving on port 80:

sudo ss -ltnH 'sport = :80' | awk '{print $4}'

Step 4 - Retrieve your per-VM administrator credentials

Every VM seeds its own admin@localhost super administrator with a random password on first boot and writes the password to a root-only file. There are no shared or default credentials in the image. Read the file with sudo:

sudo cat /root/clearflask-credentials.txt

The file records the dashboard URL, the administrator email (admin@localhost) and the per-VM password.

You can prove end to end, from the command line, that the seeded administrator authenticates and that a wrong password is rejected:

sudo bash -c 'PW=$(grep "^clearflask.admin.password=" /root/clearflask-credentials.txt | cut -d= -f2-); \
  GOOD=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" \
  -d "{\"email\":\"admin@localhost\",\"password\":\"$PW\"}" http://127.0.0.1:8080/api/v1/admin/account/login); \
  BAD=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" \
  -d "{\"email\":\"admin@localhost\",\"password\":\"wrong-000\"}" http://127.0.0.1:8080/api/v1/admin/account/login); \
  echo "correct password -> HTTP $GOOD ; wrong password -> HTTP $BAD"'

Step 5 - Confirm internal services stay internal

The database, the LocalStack services and the Java backend are all bound to loopback or the Docker network. They are never exposed on the VM's public interface.

Confirm that the three internal ports listen only on 127.0.0.1:

sudo ss -ltnH | grep -E ':8080|:3306|:4566' | awk '{print $4}' | sort -u

cd /var/lib/clearflask && sudo docker compose ps --format 'table {{.Service}}\t{{.Status}}'

Step 6 - Sign in to the dashboard

Browse to http://<vm-public-ip>/dashboard. ClearFlask opens on its sign-in page.

Select Log in with Email, enter admin@localhost and the per-VM password from Step 4, and sign in. Open signup was disabled on first boot, so this administrator is the only account that can sign in until you invite others.

Step 7 - Create your first feedback project

The first time you sign in, ClearFlask walks you through creating a project.

Choose a scenario. Select Customer feedback for a customer-first feedback experience, or Open community for a public discussion forum. Then pick a feedback layout and give your product a name.

Select Create. ClearFlask provisions the project with a feedback board and a roadmap, ready to use.

Step 8 - Collect and triage feedback

Capturing what your users actually want, in their own words, is the core of ClearFlask. The dashboard home shows how much feedback is open and how each post is moving through your workflow.

In the example below, five feedback posts sit across the new, considering and accepted stages, with a separate task pipeline underneath.

As an administrator, you can open any post, see its vote count and status, respond to users, and move the post through the workflow.

Step 9 - Publish a public roadmap

Open the Roadmap view to see and manage the public roadmap. Posts move across columns, typically Considering, Planned and In progress. Your users can follow at a glance what you are thinking about, what you have committed to, and what you are actively building.

Drag a post between columns to update its status. The change appears on the public roadmap immediately.

Step 10 - Where your data lives

The entire ClearFlask project lives under /var/lib/clearflask on the OS disk. This includes the Compose stack, the generated configuration, the MariaDB search index and the LocalStack DynamoDB, S3 and SES data. The directory is captured into the image, so every VM is re-provisioned with it. Confirm the layout:

sudo ls /var/lib/clearflask

df -h / | tail -1

Step 11 - Point ClearFlask at your own domain (optional)

By default, the image points ClearFlask at the VM's own address, which suits evaluation and internal use. To serve it on your own domain in production, put a TLS-terminating reverse proxy or an Azure load balancer in front of the VM.

Then update the parentDomain in /var/lib/clearflask/connect/connect.config.json and the domain in /var/lib/clearflask/server/config-selfhost.cfg to your hostname. Restart the stack with sudo systemctl restart clearflask.

ClearFlask can also send email through its SES integration if you configure real AWS SES credentials in the server configuration.

Security notes

• The host nginx reverse proxy publishes ClearFlask on port 80. For production, terminate TLS in front of the VM (an Azure load balancer, Application Gateway or your own reverse proxy) so that traffic is encrypted. Restrict 22/tcp in the NSG to your management network.
• The image ships no shared or default credentials. Each VM seeds its own admin@localhost super administrator with a random password on first boot and disables open self-signup, so a passer-by cannot create an account. Change the seeded password after your first sign-in.
• Every secret (the Connect token, the database password, the token signer, cursor and SSO keys) is rotated per VM on first boot, so nothing cryptographic is shared across deployments.
• The database, the LocalStack services and the Java backend are bound to loopback or the Docker network only. They are never reachable from outside the VM.
• Keep the VM patched. The image is patched at build time and ships with unattended security upgrades enabled.

Support

SecureAnyCloud images come with 24/7 support. If you have questions about this ClearFlask image or need help with your deployment, contact us through the SecureAnyCloud website.

Deploy on Azure

Launch ClearFlask on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com