ConvertX

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Increase the size for heavier media such as large video files.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. Also allow 443/tcp once you add TLS.

ConvertX serves plain HTTP on port 80. For production, put it behind TLS with your own domain (see Step 12).

Step 1 - Deploy from the Azure Marketplace

• In the Azure portal, choose Create a resource and search the Marketplace for the SecureAnyCloud ConvertX offer.
• Select the plan, then select Create.
• On the Basics tab, pick your subscription, resource group and region, name the VM, and select Standard_B2s (or larger).
• Choose SSH public key authentication with admin username azureuser and provide your public key.
• On the Networking tab, allow inbound 22/tcp from your management network and 80/tcp for the web interface.
• Select Review + create, then Create. When the VM is running, note its public IP address.

Step 2 - Deploy from the Azure CLI

To deploy from the command line, create the VM from the SecureAnyCloud ConvertX image and open 22/tcp and 80/tcp:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:convertx:default:latest
az vm create \
  --resource-group my-convertx-rg \
  --name convertx \
  --image sac1647283583153:convertx:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group my-convertx-rg --name convertx --port 80 --priority 900

When first boot has finished, browse to http://<vm-ip>/.

Step 3 - Connect to your VM

Connect over SSH as the administrator user you created at deployment:

ssh azureuser@<vm-ip>

Step 4 - Confirm the services are running

ConvertX runs as a single container under Docker Compose, managed by convertx.service. nginx fronts it on port 80. Check the services:

sudo systemctl is-active docker convertx nginx
sudo docker compose --env-file /etc/convertx/convertx.env -f /etc/convertx/compose.yaml ps

Expected output:

active active active NAME SERVICE STATUS convertx-convertx-1 convertx Up 6 minutes

Step 5 - Secure by default: a unique owner, no default account

With stock ConvertX, the first person to reach the page can register the owner account. This image closes that hole. On first boot, before the port was reachable, the image pre-seeded a unique owner account with a per-VM password, generated a per-VM session signing secret and disabled open sign-up.

You can verify this. The default guess and a blank password are rejected, while your per-VM owner password is accepted (HTTP 302, a redirect into the app):

EMAIL=$(sudo grep '^CONVERTX_ADMIN_EMAIL=' /root/convertx-credentials.txt | cut -d= -f2-)
PASS=$(sudo grep '^CONVERTX_ADMIN_PASSWORD=' /root/convertx-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'default admin@example.com -> HTTP %{http_code}\n' -X POST http://127.0.0.1/login --data-urlencode email=admin@example.com --data-urlencode password=password
curl -s -o /dev/null -w 'blank password -> HTTP %{http_code}\n' -X POST http://127.0.0.1/login --data-urlencode "email=$EMAIL" --data-urlencode 'password='
curl -s -o /dev/null -w 'per-VM owner password -> HTTP %{http_code}\n' -X POST http://127.0.0.1/login --data-urlencode "email=$EMAIL" --data-urlencode "password=$PASS"

Expected output:

default admin@example.com -> HTTP 403 blank password -> HTTP 403 per-VM owner password -> HTTP 302

Your per-VM owner email and password are written to a root-only file. Read the file with:

sudo cat /root/convertx-credentials.txt

Step 6 - Sign in to ConvertX

Open http://<vm-ip>/ in your browser. ConvertX redirects you to the login page, because anonymous use is disabled. Sign in with the owner email and password from the credentials file in Step 5.

Step 7 - Convert a file

After you sign in, you land on the convert screen. Drag a file into the drop area, or click Choose a file.

Type the format you want in the search box, for example jpg, pdf or mp4, and pick the converter offered. Click Convert to run the conversion.

Step 8 - Download the result

When the conversion finishes, ConvertX shows the results page with each converted file, its status and a download link. Download individual files, or download them all as a single archive.

Step 9 - Review your history

Open the History page to see your past conversion jobs and return to earlier results. By default, ConvertX cleans up old jobs automatically after 24 hours.

Step 10 - Check the stack health from the command line

ConvertX exposes an unauthenticated liveness endpoint, and you can verify a real conversion end to end from the shell. The built-in check logs in as your per-VM owner, uploads a small image, converts it to JPEG and downloads the result:

curl -s -o /dev/null -w 'GET /healthcheck -> HTTP %{http_code}\n' http://127.0.0.1/healthcheck
curl -s http://127.0.0.1/healthcheck; echo
sudo /usr/local/sbin/convertx-roundtrip.sh

Expected output:

GET /healthcheck -> HTTP 200 {"status":"ok"} OK round-trip: owner=admin@convertx.local (default+blank+wrong rejected; self-register blocked 403; anon 302; converted PNG->JPEG /download/1/2/cx_rt.jpg magic=ffd8ff)

Step 11 - Add more users

By default, this image is a single-owner appliance with open sign-up disabled. To let more people register accounts, enable registration and restart the service:

# Enable open registration, then browse to http://<vm-ip>/register to add users
sudo sed -i 's/ACCOUNT_REGISTRATION: "false"/ACCOUNT_REGISTRATION: "true"/' /etc/convertx/compose.yaml
sudo systemctl restart convertx

New users can then register at http://<vm-ip>/register. Once your users have accounts, set the value back to "false" and restart the service.

Step 12 - Production: your own domain with TLS

ConvertX is served over plain HTTP on port 80. For production, front it with your own domain and a TLS certificate.

Point a DNS record at the VM and open 443/tcp in the NSG. Then install a certificate with a tool such as Certbot, and configure nginx to serve HTTPS and redirect HTTP to HTTPS. Keep the app bound to the loopback interface so that it is reachable only through nginx.

Support

For questions or issues with the image, email sales@secureanycloud.com. For ConvertX itself, see the upstream project on GitHub.

Deploy on Azure

Launch ConvertX on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com