Cronmaster

Find the Cronmaster on Ubuntu 24.04 LTS image in the Azure Marketplace and select Create.

Choose your subscription, resource group and region. Select a VM size (Standard_B2s or larger) and provide your SSH public key for the azureuser account.

On the Networking tab, allow inbound 443 and 80 from your users, and restrict 22 to your management network.

Select Review + create, then Create. When the VM is running, browse to https://<your-public-ip>/.

Deploy the image from the command line, restricting SSH to your management network. Replace the angle-bracket values with your own before you run the commands:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:cronmaster-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-resource-group \
  --name cronmaster \
  --image sac1647283583153:cronmaster-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard
# Allow the web UI from your users and SSH from your management network only
az vm open-port --resource-group my-resource-group --name cronmaster --port 443 --priority 1001
az network nsg rule create --resource-group my-resource-group --nsg-name cronmasterNSG \
  --name allow-ssh --priority 1002 --destination-port-ranges 22 \
  --source-address-prefixes <your-mgmt-cidr> --access Allow --protocol Tcp

When the VM is running, browse to https://<public-ip>/.

Authentication is on by default. Each VM generates its own admin password on first boot and writes it to a root-only file. Read the file over SSH:

ssh azureuser@<vm-ip> 'sudo cat /root/cronmaster-credentials.txt'

The file contains the CRONMASTER_PASS and CRONMASTER_URL for this specific VM. Cronmaster uses a single admin password and no username.

Keep the password secret. It lives only in this root-only file and in the service environment file, and is never baked into the image.

Browse to https://<vm-ip>/. The certificate is self-signed per VM, so your browser shows a certificate warning the first time. Accept it to proceed, or install the per-VM certificate, or place a CA-signed certificate in front as covered in Step 11.

Cronmaster presents a password prompt. Enter the CRONMASTER_PASS value from Step 3.

After you sign in, Cronmaster opens the dashboard. The left panel shows live system information: status, uptime, memory, CPU and load.

The main panel lists every scheduled task with its raw cron expression, its command, a plain-English translation of the schedule, and the user it runs as. A New Task button sits above the list.

Click New Task to open the create form. Choose the user the job runs as and enter the schedule. Pick a task type: either a Custom Command (a single command line) or a Saved Script from the library.

Enter the command to run and an optional description. Saving the task writes it straight to the real crontab, and the system cron daemon runs it on schedule.

You do not have to remember cron field order. Open Quick Patterns in the task form to pick from common intervals, each labelled in plain English, or search for one. Cronmaster fills in the matching cron expression for you.

The dashboard also translates every job's schedule back into a sentence, such as "At 02:00 AM, every day", so a schedule is never a mystery.

You can run any job on demand and watch its output stream live in the interface. Cronmaster also keeps a searchable history of previous runs with their exit status, so you can see at a glance which jobs succeeded or failed and read the captured output of any run.

Log retention is configurable through the service environment. To confirm what reaches the real system crontab, check it directly from the shell:

sudo crontab -l -u root 2>/dev/null | head -20 || echo "(no jobs scheduled yet — add one in the web UI)"

SSH to the VM as azureuser and confirm that the services are running and Cronmaster is bound to loopback only:

systemctl is-active cronmaster nginx cron
sudo ss -tlnp | grep -E ':3000|:443 |:80 ' | sed 's/users:.*//'

All three services report active, and Cronmaster listens on 127.0.0.1:3000 only. nginx is the only component exposed on :80 and :443.

Run the built-in self test. It reads this VM's password and checks the full round trip over TLS. An unauthenticated request is refused, a password login succeeds and the UI renders, and a job seeded into the system crontab is surfaced by the application, which proves the host crontab integration:

sudo /usr/local/bin/cronmaster-selftest

nginx terminates TLS on port 443 and redirects plain HTTP on port 80 to HTTPS. Confirm the redirect, confirm that an unauthenticated request is refused, and confirm that a request carrying a valid session succeeds:

curl -s -o /dev/null -w 'port 80 -> HTTP %{http_code}\n' http://127.0.0.1/
curl -sk -o /dev/null -w 'unauthenticated -> HTTP %{http_code}\n' https://127.0.0.1/api/cronjobs
P=$(sudo grep '^AUTH_PASSWORD=' /etc/cronmaster/cronmaster.env | cut -d= -f2-)
J=$(mktemp)
curl -sk -c "$J" -o /dev/null -H 'Content-Type: application/json' --data "{\"password\":\"$P\"}" https://127.0.0.1/api/auth/login
curl -sk -o /dev/null -w 'authenticated -> HTTP %{http_code}\n' -b "$J" https://127.0.0.1/api/cronjobs rm -f "$J"

Port 80 returns 301, an unauthenticated request returns 401, and an authenticated request returns 200.

The self-signed certificate is regenerated per VM on first boot, with the VM IP and hostname in its Subject Alternative Names. Inspect it with:

The baked version and this VM's credential summary are recorded on the VM. The password line is redacted below. Read the full value from the root-only file in Step 3:

cat /opt/cronmaster/VERSION
sudo sed 's/^CRONMASTER_PASS=.*/CRONMASTER_PASS=<redacted per-VM secret>/' /root/cronmaster-credentials.txt | grep -E '^CRONMASTER_'

The per-VM certificate is self-signed, so browsers warn on first use. For a public deployment, put a real certificate in front. The simplest approach is to point a DNS name at the VM and obtain a free certificate with Certbot:

# Point https://<your-domain> at this VM first, then:
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

Alternatively, terminate TLS at an Azure Application Gateway or a load balancer in front of the VM and forward to port 443.

Service and environment. The service definition is at /etc/systemd/system/cronmaster.service. Its environment, including the per-VM AUTH_PASSWORD and other settings, is in /etc/cronmaster/cronmaster.env.

Rotate the password. Edit AUTH_PASSWORD in /etc/cronmaster/cronmaster.env, then run sudo systemctl restart cronmaster. Use a strong value of at least 16 characters, because the service refuses to start with a shorter one.

Choose which user's crontab is managed. The HOST_CRONTAB_USER setting controls this, and the default is the system root crontab. Adjust it in the unit if you want Cronmaster to manage a different user's cron jobs.

Optional single sign-on. Cronmaster also supports OIDC single sign-on with providers such as Keycloak, Authentik and Auth0. If you prefer SSO to the built-in password, see the upstream documentation to configure SSO_MODE and the OIDC_* settings.