Deployment guide

Dashy

Overview

Dashy is an open-source, self-hosted dashboard for your homelab, servers and applications. It brings all of your links, apps and bookmarks together on one customizable start page, organised into sections with icons, themes, search, keyboard shortcuts, live status checks and a built-in visual editor for changing the layout directly from the browser.

This SecureAnyCloud image runs Dashy on Ubuntu 24.04 on Azure. It builds the pinned stable Dashy 4.4.5 release from source with Node.js 22 LTS (recorded in /opt/dashy/VERSION) and runs it under systemd as the unprivileged dashy system user, bound to loopback only (127.0.0.1:4000). nginx is the sole network-facing surface. It terminates TLS on port 443, enforces HTTP basic authentication on every request and reverse proxies to Dashy. Port 80 redirects to HTTPS.

Secure by default. Dashy's own built-in login is a client-side gate that is turned off by default, which would leave an unprotected deployment open to anyone who can reach it. This image does not rely on it. Dashy is bound to loopback and fronted by nginx basic authentication, and a unique administrator credential is generated on each virtual machine's first boot.

Only a one-way bcrypt hash of the password is written to the server. The plain password is placed in a root-only file for the administrator to read. There are no shared or default credentials, and nothing usable is baked into the image. Because Dashy is loopback-only behind the basic auth gate, its built-in config-save endpoint is protected too.

What you get:

Dashy 4.4.5 built from source on Node.js 22 LTS and run under systemd as the unprivileged dashy system user.
Dashy bound to loopback only (127.0.0.1:4000), so it is never exposed to the network directly.
nginx terminating TLS on :443, enforcing HTTP basic authentication and reverse proxying to Dashy, with HSTS and sensible security headers.
Port :80 returns a 301 redirect to HTTPS for every path except an unauthenticated /healthz endpoint (HTTP 200) for load balancer probes.
A unique admin credential generated per VM on first boot. Only the one-way bcrypt hash is stored, and the plain password lands in a root-only file.
A self-signed TLS certificate regenerated per VM on first boot. Its Subject Alternative Names include the VM public IP, hostname and 127.0.0.1. For production, replace it with your own CA-signed certificate.
A starter SecureAnyCloud dashboard preloaded, so the interface is populated the moment you sign in.
A built-in self-test at /usr/local/bin/dashy-selftest that proves the authenticated dashboard and config load end to end over TLS.
Ubuntu 24.04 LTS base with the latest security patches applied at build time.
Azure Linux Agent for cloud integration and SSH key injection.
24/7 SecureAnyCloud support with a guaranteed 24 hour response SLA.

Prerequisites

Before you deploy, make sure you have:

An Azure subscription with permission to deploy virtual machines.
An SSH key pair for administrative access to the VM as the azureuser account.
A Network Security Group that allows inbound TCP 443 (HTTPS) and 80 (redirect) from the networks that should reach the service, and 22 (SSH) from your management network only.
A VM size of Standard_B2s or larger (recommended).

Deploy from the Azure Portal

Find the Dashy on Ubuntu 24.04 LTS image in the Azure Marketplace and select Create.
Choose your subscription, resource group and region.
Select a VM size (Standard_B2s or larger) and provide your SSH public key for the azureuser account.
On the Networking tab, allow inbound 443 and 80 from your users, and restrict 22 to your management network.
Review and create the VM.

When the VM is running, browse to https://<your-public-ip>/.

Deploy from the Azure CLI

Deploy the image from the command line and restrict SSH to your management network. Replace the resource group, VM name and CIDR values with your own:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:dashy-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-resource-group \
  --name dashy \
  --image sac1647283583153:dashy-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard
# Allow the web UI from your users and SSH from your management network only
az vm open-port --resource-group my-resource-group --name dashy --port 443 --priority 1001
az network nsg rule create --resource-group my-resource-group --nsg-name dashyNSG \
  --name allow-ssh --priority 1002 --destination-port-ranges 22 \
  --source-address-prefixes <your-mgmt-cidr> --access Allow --protocol Tcp

When the VM is running, browse to https://<public-ip>/.

Retrieve your per-instance admin credential

HTTP basic authentication protects access. Each VM generates its own admin username and password on first boot and writes them to a root-only file. Read the file over SSH:

ssh azureuser@<vm-ip> 'sudo cat /root/dashy-credentials.txt'

The file contains the DASHY_USER, DASHY_PASS and DASHY_URL for this specific VM. Keep it secret. The server stores only a one-way bcrypt hash of the password, never the plain text.

Sign in to your dashboard

Browse to https://<vm-ip>/. The certificate is self-signed per VM, so your browser shows a certificate warning the first time. Accept it to proceed. Alternatively, install the per-VM certificate or place a CA-signed certificate in front, as covered in Step 9.

Your browser then prompts for the basic authentication username and password from Step 3.

Dashy opens on your dashboard. The image ships a starter SecureAnyCloud layout, so the interface is populated immediately. Sections group your items into cards, each with an icon, and a search bar sits along the top.

Customize the layout, theme and item size

Click the settings icon in the top right corner to open the Options panel. From here you can switch the theme, change the layout and item size, toggle edit mode, and open the config editor. Changes preview live, so you can try a look before you keep it.

Edit your dashboard configuration

A single configuration file describes your whole dashboard. From the Options panel, click Config to open the built-in interactive editor. It shows the live configuration with syntax highlighting and validation, and you can edit sections and items directly.

Save to Disk writes the change back to the server so it persists. Save Locally keeps it only in your browser.

You can also edit the configuration file directly on the VM at /opt/dashy/user-data/conf.yml and restart the service. Both approaches are equivalent, because Save to Disk writes to that same file:

# Edit the dashboard configuration, then apply the change.
# Browse back to https://<vm-ip>/ afterwards.
sudo nano /opt/dashy/user-data/conf.yml
sudo systemctl restart dashy

Find items fast with instant search

Start typing in the search bar to filter your items live. This is the quickest way to jump to a service on a large dashboard. Pressing Enter can hand the query off to a configured web search.

Keyboard shortcuts let you open items without touching the mouse.

Verify the deployment

SSH to the VM as azureuser. Confirm that the services are running and that Dashy is bound to loopback only:

systemctl is-active dashy nginx
sudo ss -tlnp | grep 4000

All services report active, and Dashy listens on 127.0.0.1:4000 only. nginx is the only component exposed on :80 and :443.

Run the built-in self-test. It reads this VM's credential and proves the full path over TLS. The health probe answers, an unauthenticated request is refused, the config-save endpoint is protected, and an authenticated request loads the dashboard and a known configuration item:

sudo /usr/local/bin/dashy-selftest

TLS, redirect and the authentication gate

nginx terminates TLS on port 443 and redirects plain HTTP on port 80 to HTTPS. Confirm the redirect and the unauthenticated health probe. Then confirm that the dashboard and its config-save endpoint both require the per-VM credential:

curl -s -o /dev/null -w 'port 80 -> HTTP %{http_code}\n' http://127.0.0.1/
curl -sk -o /dev/null -w 'healthz -> HTTP %{http_code}\n' https://127.0.0.1/healthz
curl -sk -o /dev/null -w 'no creds -> HTTP %{http_code}\n' https://127.0.0.1/

Port 80 returns 301, and the health endpoint returns 200. An unauthenticated request to the dashboard, and to the config-save endpoint, is refused with 401. A request carrying this VM's credential succeeds with 200.

The self-signed certificate is regenerated per VM on first boot, with the VM IP and hostname in its Subject Alternative Names.

Replace the certificate for production

The per-VM certificate is self-signed, so browsers warn on first use. For a public deployment, put a real certificate in front. The simplest approach is to point a DNS name at the VM and obtain a free certificate with Certbot:

# Point https://<your-domain> at this VM first, then:
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

Alternatively, terminate TLS at an Azure Application Gateway or a load balancer in front of the VM and forward to port 443.

Baked version and per-instance credential

The baked Dashy and Node.js versions are recorded on the VM, alongside this instance's credential summary. Read the version file and the credential file:

cat /opt/dashy/VERSION
sudo cat /root/dashy-credentials.txt

The credential file holds the full password. See Step 3.

Security notes

No default login. nginx HTTP basic authentication protects access, and a unique admin credential is generated on each VM's first boot. Only a one-way bcrypt hash is stored. The plain password lives in the root-only /root/dashy-credentials.txt.
Loopback-only application. Dashy binds to 127.0.0.1:4000 and is reachable only through the nginx TLS reverse proxy on :443. Keep it that way, and let nginx (or a load balancer) be the sole network-facing surface.
Protected configuration. Every path is behind the basic auth gate, so Dashy's config-save endpoint cannot be reached without the per-VM credential. Sign in over HTTPS only.
Restrict access. Allow 443 only from the networks that need it, keep 22 restricted to your management network, and replace the self-signed certificate with a CA-signed one for production.
Rotate the credential by regenerating the nginx htpasswd entry (sudo htpasswd -B /etc/nginx/dashy.htpasswd admin) and reloading nginx. Alternatively, place your own identity-aware proxy in front.

Support

This image is backed by 24/7 SecureAnyCloud support with a guaranteed 24 hour response SLA. Contact sales@secureanycloud.com for assistance.

Dashy is open-source software distributed under the MIT License and is free. The SecureAnyCloud charge covers packaging, hardening, security patching, image maintenance and support.

Deploy on Azure

Launch Dashy on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Dashy is a popular open-source, self-hosted dashboard for your homelab, servers and applications. It brings all of your links, apps and bookmarks together on one customizable start page, organised into sections with icons, themes, search, keyboard shortcuts, live status checks and a built-in visual editor for changing the layout from the browser.

This SecureAnyCloud AMI builds Dashy from source at a pinned stable release and ships it secure by default. Dashy binds to the loopback interface only. An nginx reverse proxy in front terminates TLS and enforces HTTP basic authentication on every request, and a unique admin credential is generated on each instance's first boot.

What you get:

Dashy 4.4.5 built from source into /opt/dashy, run as the unprivileged dashy system user by dashy.service on the Node.js runtime, bound to 127.0.0.1:4000.
An nginx reverse proxy on :443 that terminates TLS (a self-signed certificate regenerated per instance on first boot) and enforces HTTP basic authentication, with :80 redirecting to HTTPS.
A per-instance admin credential minted on first boot. Only its bcrypt hash is written to /etc/nginx/dashy.htpasswd, and the plaintext is placed in a root-only note at /root/dashy-credentials.txt.
An unauthenticated /healthz endpoint for load-balancer health checks, plus a protected config-save endpoint.
A round-trip self-test at /usr/local/bin/dashy-selftest that proves the appliance end to end.
24/7 SecureAnyCloud support.

Prerequisites

Before you launch, make sure you have:

An AWS account, an EC2 key pair in the target Region, and a VPC with a public subnet.
The recommended instance type, m5.large (2 vCPU / 8 GiB RAM).
A security group with inbound rules that allow 22/tcp from your management network for SSH, and 443/tcp (plus 80/tcp for the HTTPS redirect) for the dashboard.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace, choose Continue to Launch, and launch through the EC2 console or the AWS CLI. Select the m5.large instance type, your key pair, and a security group that opens ports 22, 80 and 443:

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <security-group-id> \
  --subnet-id <subnet-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=dashy}]'

Step 2 - Connect to your instance

Connect over SSH as the default login user for the OS variant you launched. On Ubuntu 24.04 LTS, the login user is ubuntu. Connect with ssh ubuntu@<instance-public-ip>.

Step 3 - Confirm the services are running

Dashy runs behind nginx. A one-shot first-boot service creates the per-instance credential and TLS certificate. Confirm that the two long-running services are healthy:

systemctl is-active dashy.service nginx.service

Both report active.

Step 4 - Verify the stack and endpoints

Confirm the baked Dashy version and that the dashboard is bound to the loopback interface only. Confirm that the unauthenticated health probe answers and that the dashboard itself refuses anonymous access:

cat /opt/dashy/VERSION ss -tln | grep 4000 curl -sk -o /dev/null -w 'healthz: HTTP %{http_code}\n' https://127.0.0.1/healthz curl -sk -o /dev/null -w 'unauthenticated dashboard: HTTP %{http_code}\n' https://127.0.0.1/

Dashy is bound to 127.0.0.1:4000 only, /healthz returns 200, and the dashboard returns 401 because nginx enforces basic authentication on every path.

Step 5 - Read your per-instance admin credential

The image ships no shared or default login. On first boot, a unique admin credential is generated for this instance. Only its bcrypt hash is stored on the server, and the plaintext is written to a root-only file. Read the file, and confirm its permissions and the resolved URL:

sudo stat -c '%a %U:%G' /root/dashy-credentials.txt
sudo grep -E '^DASHY_(USER|URL)=' /root/dashy-credentials.txt

The file is 600 root:root, DASHY_USER is your admin username, and DASHY_URL is the HTTPS address to open in your browser. Run sudo cat /root/dashy-credentials.txt to also see the password.

Step 6 - Prove the appliance end to end

Run the bundled self-test. It exercises the whole appliance over TLS. It checks the unauthenticated health probe, confirms that anonymous access and the config-save endpoint are refused, confirms that the authenticated dashboard renders, and confirms that a known configuration item loads.

sudo /usr/local/bin/dashy-selftest

It prints OK dashy self-test passed: ....

Step 7 - Open the dashboard

Browse to https://<instance-public-ip>/ (the value of DASHY_URL). The certificate is self-signed per instance, so your browser shows a one-time warning. Accept it, then sign in with the admin username and password from the credentials file.

The dashboard loads with the SecureAnyCloud starter configuration. It has a Getting Started section that links to this guide and the Dashy docs, and an Example Services section that you can replace with your own.

Step 8 - Theme, layout and options

Click the Options icon (top right) to change the theme, switch between the grid, list and column layouts, adjust the item size, or jump between the default, minimal and workspace views. Every change applies instantly from the browser, with nothing to edit on disk.

Step 9 - Customize with the built-in visual editor

From Options, choose Config, then the Edit Config tab, to edit the dashboard's YAML directly in the browser with live validation. Add your own sections and items, each with a title, description, icon and URL. Dashy validates the document as you type. Save it back to the instance to make the change permanent.

You can also edit the configuration file on the instance directly at /opt/dashy/user-data/conf.yml. Apply the change with sudo systemctl restart dashy.

Maintenance

Configuration: the dashboard configuration lives at /opt/dashy/user-data/conf.yml. Edit it there or through the built-in editor, then restart Dashy with sudo systemctl restart dashy.
Credential: the per-instance admin credential is in /root/dashy-credentials.txt. To rotate it, generate a new password and write it into the basic-auth file with sudo /usr/local/sbin/dashy-write-htpasswd admin <new-password>.
TLS: the image serves HTTPS with a self-signed certificate generated per instance. For production, place your own domain and a CA-signed certificate in front of the instance, or replace the certificate in /etc/nginx/tls.
Status checks and widgets: enable Dashy's live status checks and widgets by adding them to your configuration. See the Dashy documentation at https://dashy.to/docs.
Restart: run sudo systemctl restart dashy.service nginx.service to restart the whole stack.
Security patches: unattended-upgrades stays enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

This image packages the open-source Dashy software (MIT License) for deployment on AWS. SecureAnyCloud is not affiliated with, endorsed by, or sponsored by the Dashy project.

Deploy on AWS

Launch Dashy with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS