Deployment guide

Comentario

Overview

Comentario is a fast, flexible and free comment server for web pages. It is a privacy-focused, self-hosted alternative to hosted commenting services. A single Go service serves both the embeddable comments widget that you add to any site and a full Angular administration UI, backed by PostgreSQL.

This SecureAnyCloud image runs Comentario directly on TCP 80 as a dedicated non-root service user, with PostgreSQL bound to loopback as the datastore. It generates a unique owner and administrator login on the first boot of every VM.

What you get:

Comentario 3.17 as a single self-contained Go binary at /usr/bin/comentario, with its Angular frontend at /usr/lib/comentario/frontend
The Comentario service on :80, running as the dedicated non-root comentario system user (with CAP_NET_BIND_SERVICE to bind the privileged port)
PostgreSQL as the datastore, bound to 127.0.0.1 only
Per-VM owner/superuser and PostgreSQL passwords generated at first boot and stored in a root-only file, with an empty database and no working credentials in the shipped image
comentario.service and postgresql.service as enabled, active systemd units
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size, because Comentario is lightweight.

Configure the NSG to allow inbound 22/tcp from your management network. Also allow 80/tcp (and 443/tcp once you enable HTTPS) from the networks that will load your comment widget and reach the admin UI.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Comentario by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create and Create.

First-boot initialisation (database setup, secret rotation and owner creation) completes within about a minute of the VM starting.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:comentario-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name comentario \
  --image sac1647283583153:comentario-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name comentario --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active comentario.service postgresql.service curl -s -o /dev/null -w 'instance config: HTTP %{http_code}\n' http://127.0.0.1/api/config

Both services report active, and the public instance-config endpoint returns HTTP 200. This confirms that the Comentario service and PostgreSQL are serving.

The systemd units and the open instance-config endpoint are available on a freshly booted VM.

Step 5 - Retrieve your owner login

First boot generates a unique instance owner account and PostgreSQL password for your VM and writes them to a root-only file:

sudo cat /root/comentario-credentials.txt

The comentario.owner.email and comentario.owner.pass values are your sign-in for the administration UI. The owner is a Comentario superuser (instance administrator). The PostgreSQL password is rotated at the same time and is never shared between VMs.

The root-only credentials file holds the per-VM owner login.

Step 6 - First sign-in

Open a web browser and go to http://<vm-public-ip>/. Comentario shows its sign-in page. Enter the comentario.owner.email and comentario.owner.pass values from the credentials file, then select Sign in.

Comentario serves its sign-in page from first boot, with a per-VM owner login.

Step 7 - The administration dashboard

After you sign in, you land on the dashboard, which summarises users, views and comments over the last 30 days. The left-hand navigation gives you Domains, Users, Configuration and your account. As the instance owner, you are a superuser with full administrative control.

The administration dashboard shows per-instance statistics.

Step 8 - Add your first domain

Select Domains, then New domain, and enter the host of the website you want to add comments to (for example blog.example.com). Comentario registers the domain and gives you a small snippet of HTML to embed.

Paste the <script> and <comentario-comments> tags into your page template where you want the comment thread to appear, and point the script at your VM. Readers can then comment on that page, and you moderate the threads from Comments under the domain.

In the domains manager, a superuser sees and manages every domain on the instance.

Step 9 - Manage your account

Open your account (shown as Instance Owner in the sidebar) to change your display name, set a website URL, choose an interface language, upload an avatar and change your password. For production use, set a new owner password of your own straight away.

The owner profile page lets you change your name, language, avatar and password.

Step 10 - Prove the owner login through the API

Comentario is API-driven. Its own frontend signs in through POST /api/auth/login, which is XSRF-protected exactly as a browser expects: seed the XSRF-TOKEN cookie, echo it in the X-Xsrf-Token header, and send an Origin that matches the instance base URL.

From an SSH session on the VM, prove the round trip with the per-VM owner password:

CREDS=/root/comentario-credentials.txt
EMAIL=$(sudo grep '^comentario.owner.email=' "$CREDS" | cut -d= -f2-)
PASS=$(sudo grep '^comentario.owner.pass=' "$CREDS" | cut -d= -f2-)
HOST=$(sudo grep '^BASE_URL=' /etc/comentario/comentario.conf | sed -E 's#^BASE_URL=https?://##; s#/.*$##')
JAR=$(mktemp)
curl -s -o /dev/null -c "$JAR" http://127.0.0.1/api/config
TOK=$(awk '$6=="XSRF-TOKEN"{print $7}' "$JAR")
curl -s -o /dev/null -w 'owner login: HTTP %{http_code}\n' -b "$JAR" \
  -H "X-Xsrf-Token: $TOK" -H "Origin: http://$HOST" -H 'Content-Type: application/json' \
  -d "{\"email\":\"$EMAIL\",\"password\":\"$PASS\"}" http://127.0.0.1/api/auth/login rm -f "$JAR"

An owner login: HTTP 200 response confirms the API accepts the generated owner credentials.

Step 11 - Confirm the runtime and security posture

Check the Comentario package version, the dedicated non-root service user, the loopback-only PostgreSQL, the open :80 port, and the fully patched OS baseline:

dpkg-query -W -f='${Package} ${Version}\n' comentario id comentario ss -tlnp | grep -E ':80 |:5432 '

The image runs a pinned Comentario release as the non-root comentario service user, with PostgreSQL on loopback and the web port open, on a base patched at build time.

Enabling HTTPS

Serve Comentario over HTTPS in any production deployment, so that logins and comments cannot be intercepted. Terminate TLS with a reverse proxy such as nginx or Caddy in front of Comentario, or use a cloud load balancer.

The following commands install nginx and certbot. They assume a DNS record that points your fully qualified domain name at the VM's public IP, and port 443 open in the NSG:

sudo apt-get update && sudo apt-get install -y nginx certbot python3-certbot-nginx
# Proxy nginx :443 -> Comentario, then rebind Comentario to loopback:
sudo sed -i 's|^HOST=.*|HOST=127.0.0.1|; s|^PORT=.*|PORT=8080|; s|^BASE_URL=.*|BASE_URL=https://comments.your-domain.example/|' /etc/comentario/comentario.conf
sudo certbot --nginx -d comments.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example --redirect sudo systemctl restart comentario

Set BASE_URL to your HTTPS domain. Comentario validates the request Origin against it, and generated links and the embed widget use it.

Backup and maintenance

Comentario keeps all of its state, including domains, pages, users, comments and configuration, in PostgreSQL. Back it up regularly:

sudo -u postgres pg_dump comentario > <backup-dir>/comentario-db-$(date +%F).sql

Copy the dump to Azure Blob Storage or another object store.

Ubuntu's unattended-upgrades is enabled by default for kernel and package updates. You can also patch the OS manually with sudo apt update && sudo apt upgrade.

To upgrade Comentario, install a newer release package and restart the service. Database migrations run automatically on start. See https://docs.comentario.app.

Support

SecureAnyCloud provides 24/7 support for this image. Contact us by email or chat for help with deployment, embedding the widget, integrations, upgrades, TLS termination and database administration. Guaranteed response within 24 hours, with a one-hour average for critical issues. Contact sales@secureanycloud.com.

For general Comentario questions, consult the documentation at https://docs.comentario.app. Comentario is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Their use does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Comentario on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

What you get:

Comentario 3.17 as a single self-contained Go binary at /usr/bin/comentario, with its Angular frontend at /usr/lib/comentario/frontend
The Comentario service on :80, running as the dedicated non-root comentario system user (with CAP_NET_BIND_SERVICE to bind the privileged port)
PostgreSQL as the datastore, bound to 127.0.0.1 only, on a dedicated EBS data volume mounted at /var/lib/postgresql
Per-instance owner/superuser and PostgreSQL passwords generated at first boot and stored in a root-only file, with an empty database and no working credentials in the shipped image
comentario.service and postgresql.service as enabled, active systemd units
24/7 SecureAnyCloud support

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network, and inbound ports 80 (and 443 once you enable HTTPS) from the networks that will load your comment widget and reach the admin UI
The AWS CLI version 2 installed locally, if you plan to deploy from the command line
Outbound internet access from the instance for package updates and the embed widget

m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type. Comentario is lightweight, so a smaller type also works for low-traffic sites.

Connecting to your instance

Connect over SSH on port 22 as the default login user for your OS variant:

OS variant SSH login user

Ubuntu 24.04 ubuntu

The examples below use ubuntu. Substitute your variant's user from the table.

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Comentario. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet, then create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Keep the root volume at the default size or larger.

Select Launch instance. First-boot initialisation (database setup, secret rotation and owner creation) completes within about a minute of the instance state becoming Running and the status checks passing.

Launch the Instance from the AWS CLI

The following block launches an instance from the SecureAnyCloud Comentario Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --associate-public-ip-address \
  --metadata-options 'HttpTokens=required' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=comentario}]'

Connect to your instance

ssh -i /path/to/<key-name>.pem ubuntu@<instance-public-ip>

Confirm the services are running

systemctl is-active comentario.service postgresql.service curl -s -o /dev/null -w 'instance config: HTTP %{http_code}\n' http://127.0.0.1/api/config

Both services report active, and the public instance-config endpoint returns HTTP 200. This confirms that the Comentario service and PostgreSQL are serving:

active active instance config: HTTP 200

Retrieve your owner login

First boot generates a unique instance owner account and PostgreSQL password for your instance and writes them to a root-only file. Read the file with:

sudo cat /root/comentario-credentials.txt

To confirm that the file is present and root-only without printing the secrets, run:

test -f /root/comentario-credentials.txt && echo "credentials file present, mode 0$(stat -c '%a' /root/comentario-credentials.txt)" grep -c '^comentario.owner' /root/comentario-credentials.txt

credentials file present, mode 0600 2

First sign-in

Open a web browser and go to http://<instance-public-ip>/. Comentario redirects to its sign-in page. Enter the comentario.owner.email and comentario.owner.pass values from the credentials file, then select Sign in.

Comentario serves its sign-in page from first boot, with a per-instance owner login.

The administration dashboard

After you sign in, you land on the dashboard, which summarises domains, pages, comments and commenters, with a comment-activity chart over the last 30 days. The left-hand navigation gives you Domains, Users, Configuration and your account. As the instance owner, you are a superuser with full administrative control.

The administration dashboard shows per-instance statistics.

Add your first domain and embed the widget

Paste the <script> and <comentario-comments> tags into your page template where you want the comment thread to appear, and point the script at your instance. Readers can then comment on that page.

In the domains manager, a superuser sees and manages every domain on the instance.

Moderate comments

Open Comments under a domain to read and moderate every thread from one place. You can approve, reject or delete comments, work through the pending-moderation queue, and see comment scores from voting. Markdown, threaded replies and multiple sign-in options are supported out of the box.

The comments view offers approve, reject and delete actions, a pending-moderation queue and comment scores.

Per-domain settings

Each domain has its own settings: comment sorting, voting, RSS feeds, Markdown options (images, links, tables), moderation rules and authentication providers. Open a domain and select Edit to configure how comments behave on that website.

Per-domain settings control comment behaviour, moderation and authentication.

Instance configuration

Under Configuration, manage the instance-wide dynamic settings: registration and email-confirmation policy, default comment behaviour and integrations. These settings apply across every domain unless you override them per domain.

The instance-wide dynamic configuration applies across domains.

Prove the owner login through the API

From an SSH session on the instance, prove the round trip with the per-instance owner password:

CREDS=/root/comentario-credentials.txt
EMAIL=$(grep '^comentario.owner.email=' "$CREDS" | cut -d= -f2-)
PASS=$(grep '^comentario.owner.pass=' "$CREDS" | cut -d= -f2-)
HOST=$(grep '^BASE_URL=' /etc/comentario/comentario.conf | sed -E 's#^BASE_URL=https?://##; s#/.*$##')
JAR=$(mktemp)
curl -s -o /dev/null -c "$JAR" http://127.0.0.1/api/config
TOK=$(awk '$6=="XSRF-TOKEN"{print $7}' "$JAR")
curl -s -o /dev/null -w 'owner login: HTTP %{http_code}\n' -b "$JAR" \
  -H "X-Xsrf-Token: $TOK" -H "Origin: http://$HOST" -H 'Content-Type: application/json' \
  -d "{\"email\":\"$EMAIL\",\"password\":\"$PASS\"}" http://127.0.0.1/api/auth/login rm -f "$JAR"

An owner login: HTTP 200 response confirms the API accepts the generated owner credentials:

owner login: HTTP 200

Confirm the runtime and security posture

Check the Comentario package version, the dedicated non-root service user, the loopback-only PostgreSQL, and the open :80 port:

dpkg-query -W -f='${Package} ${Version}\n' comentario id comentario ss -tlnp | grep -E ':80 |:5432 '

comentario 3.17.0 uid=997(comentario) gid=987(comentario) groups=987(comentario) LISTEN 0 200 127.0.0.1:5432 0.0.0.0:* LISTEN 0 4096 *:80 *:*

Comentario listens on all interfaces on port 80, while PostgreSQL is bound to loopback only.

Enabling HTTPS

The following commands install nginx and certbot. They assume a DNS record that points your fully qualified domain name at the instance's public IP, and port 443 open in the security group:

sudo apt-get update && sudo apt-get install -y nginx certbot python3-certbot-nginx
# Proxy nginx :443 -> Comentario, then rebind Comentario to loopback:
sudo sed -i 's|^HOST=.*|HOST=127.0.0.1|; s|^PORT=.*|PORT=8080|; s|^BASE_URL=.*|BASE_URL=https://comments.your-domain.example/|' /etc/comentario/comentario.conf
sudo certbot --nginx -d comments.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example --redirect sudo systemctl restart comentario

Set BASE_URL to your HTTPS domain. Comentario validates the request Origin against it, and generated links and the embed widget use it.

Backup and maintenance

Comentario keeps all of its state, including domains, pages, users, comments and configuration, in PostgreSQL on the dedicated /var/lib/postgresql EBS volume. Back it up regularly:

sudo -u postgres pg_dump comentario > <backup-dir>/comentario-db-$(date +%F).sql

Copy the dump to Amazon S3 or another object store, and consider EBS snapshots of the data volume.

Ubuntu's unattended-upgrades is enabled by default. You can also patch the OS manually with sudo apt update && sudo apt upgrade.

To upgrade Comentario, install a newer release package and restart the service. Database migrations run automatically on start. See https://docs.comentario.app.

Support

Deploy on AWS

Launch Comentario on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS