copyparty

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting size, because copyparty is very light on resources.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. Add 443/tcp if you set up TLS. copyparty serves plain HTTP on port 80, so terminate TLS in front of it with your own domain before exposing it beyond a trusted network (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for copyparty by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:copyparty-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name copyparty \
  --image sac1647283583153:copyparty-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name copyparty --port 80 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH with the admin user you created:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that copyparty and nginx are active:

systemctl is-active copyparty.service nginx.service

Both services report active. copyparty listens on the loopback connector 127.0.0.1:3923, and nginx fronts it on port 80. Your shared files live on the dedicated Azure data disk mounted at /var/lib/copyparty.

Step 5 - Retrieve your admin password

copyparty protects browsing and uploading with its own account system, not nginx Basic Auth. The username is admin. Your VM generates a unique password on first boot and writes it to a root-only file. Read it as follows:

sudo cat /root/copyparty-credentials.txt

The file contains COPYPARTY_USERNAME, COPYPARTY_PASSWORD and the COPYPARTY_URL to open in a browser.

On disk, the password is stored only as a salted sha2 hash in /etc/copyparty/accounts.conf, and each VM gets its own random salt. No plaintext password ships in the image. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes. Request it from the VM:

curl -s http://localhost/healthz

It returns ok. The endpoint never requires authentication, so it is safe to use as an Azure Load Balancer health probe.

Step 7 - Confirm authentication

Unlike a plain read-only file share, this image grants no anonymous access at all. Both browsing and uploading require the admin login.

Run the following commands to prove it. They read the per-VM password from the credentials file, then show that an unauthenticated upload is rejected, a wrong password is rejected, and the correct password is accepted:

PW=$(sudo grep '^COPYPARTY_PASSWORD=' /root/copyparty-credentials.txt | cut -d= -f2-)
echo "unauthenticated upload: $(curl -s -o /dev/null -w '%{http_code}' -T /etc/hostname http://127.0.0.1/probe.txt)"
echo "wrong password: $(curl -s -o /dev/null -w '%{http_code}' -u admin:wrong-pw -T /etc/hostname http://127.0.0.1/probe.txt)"
echo "correct password: $(curl -s -o /dev/null -w '%{http_code}' -u admin:$PW -T /etc/hostname http://127.0.0.1/probe.txt)" curl -s -o /dev/null -X DELETE -u admin:$PW http://127.0.0.1/probe.txt

The output shows 401 for the unauthenticated upload, 403 for the wrong password, and 201 for the correct password, which means the file was uploaded. The last line removes the probe file.

Step 8 - Sign in to the web interface

Browse to http://<vm-public-ip>/. copyparty shows a "howdy stranger" prompt because you are not logged in yet.

Enter the password from Step 5 into the password field and click login.

Step 9 - Browse and upload files

After you log in, you land on the file browser. The toolbar along the top gives you upload, search, media player, mkdir, new-file and control-panel actions, and the tree on the left navigates folders.

Drag and drop files anywhere onto the page, or click the upload icon, to add them to the current folder. copyparty's resumable up2k protocol lets large uploads survive a dropped connection.

Step 10 - Preview Markdown and media inline

Click any .md file to render it inline. Headings, lists, blockquotes and bold or italic text render as they would on GitHub.

Images, audio and video files get an inline preview and player in the same way. You can share a folder of notes or media without anyone downloading it first.

Step 11 - The control panel

Click the gear icon in the toolbar to open the control panel. There you can toggle the grid or thumbnail view, choose a folder-download format (zip, tar, ...), change the theme and language, and tune upload behavior.

These are per-browser client preferences and do not require another login.

Step 12 - Confirm data lives on the dedicated disk

Your shared files are kept under /var/lib/copyparty/share on the dedicated Azure data disk. They survive OS changes, and you can resize the disk independently. Confirm the mount:

findmnt /var/lib/copyparty

A separate Azure data disk backs the mount. It is captured into the image and re-provisioned on every VM.

Maintenance

• Password: the admin password is set on first boot and stored as a salted sha2 hash in /etc/copyparty/accounts.conf. To change it, generate a new hash with python3 /opt/copyparty/copyparty-sfx.py --ah-alg sha2 --ah-salt <same-salt-from-accounts.conf> --ah-gen '<new-password>'. Replace the admin: line with the new hash, then run sudo systemctl restart copyparty.
• Adding more accounts: add another user: <hash> line under [accounts] in /etc/copyparty/accounts.conf. Add a matching permission entry under [/] in /etc/copyparty/copyparty.conf, then restart the service. See the copyparty accounts documentation for the full permission syntax.
• Upgrades: copyparty is a single self-contained file at /opt/copyparty/copyparty-sfx.py. To upgrade, download a newer pinned release, verify its checksum, replace the file and run sudo systemctl restart copyparty. Your shared files under /var/lib/copyparty/share are preserved.
• Storage: all shared files live under /var/lib/copyparty/share on the data disk. Back up that volume to protect your files.
• TLS: copyparty serves plain HTTP on port 80 behind nginx. Front it with TLS (for example, certbot with your own domain) before exposing it beyond a trusted network.
• Security patches: unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. For questions or help with your deployment, contact sales@secureanycloud.com.

Deploy on Azure

Launch copyparty on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com