SecureAnyCloud
Deployment guide

DefectDojo

Overview

DefectDojo is the OWASP application vulnerability management platform. This DevSecOps tool consolidates the findings from your SAST, DAST, SCA, container and infrastructure scanners into a single system of record. It de-duplicates and tracks findings across products, engagements and tests, and it drives remediation through a configurable workflow. It supports JIRA and notification integrations and exposes a complete REST API, so it can sit at the centre of an automated security pipeline.

The SecureAnyCloud image installs DefectDojo 3.0.100 as the official django-DefectDojo Docker Compose stack and runs it as a systemd service. A working vulnerability-management platform is online within minutes of launch.

What you get:

  • DefectDojo 3.0.100 (BSD-3-Clause) deployed from the official django-DefectDojo Docker Compose stack, pinned to the 3.0.100 published images, so the image never silently upgrades at build time
  • Docker Engine (Docker CE) and the Docker Compose plugin, installed from the official Docker package repository
  • The DefectDojo Compose stack: the nginx reverse proxy on port 80, the uwsgi Django application server, the celeryworker and celerybeat async task services, the one-shot initializer (runs the database migrations and creates the admin account), postgres (PostgreSQL 18, the primary database) and valkey (Valkey 9, the Celery broker and cache)
  • All stateful data (the PostgreSQL database, the Valkey data and the DefectDojo media and uploads) on a dedicated 40 GiB data disk mounted at /var/lib/defectdojo. Docker's data-root is relocated there, and the disk is independently resizable and re-provisioned on every VM
  • A per-VM admin account with a generated password, created at first boot
  • Two systemd units: defectdojo.service (a oneshot wrapper around docker compose up -d) and defectdojo-firstboot.service
  • 24/7 SecureAnyCloud support

Prerequisites

  • An active Azure subscription, an SSH key, and a VNet with a subnet
  • A VM size of Standard_B4ms (4 vCPU / 16 GB RAM), which is the recommended size and is comfortable for the DefectDojo stack
  • Network security group inbound rules that allow 22/tcp from your management CIDR for SSH and 80/tcp from the CIDR that needs the DefectDojo web UI and API. Add 443/tcp if you enable HTTPS
1

Connect over SSH

Replace <vm-ip> with the public IP address of your VM. The default login user is azureuser.

ssh azureuser@<vm-ip>
2

Confirm the services are active

sudo systemctl is-active docker.service defectdojo.service docker --version docker compose version

The output shows active twice, followed by the Docker Engine version and the Docker Compose v2 plugin version.

3

Confirm the DefectDojo containers are running

cd /opt/defectdojo && sudo docker compose -f docker-compose.yml -f docker-compose.override.sac.yml --env-file .env ps

The core services (nginx, uwsgi, celeryworker, celerybeat, postgres and valkey) show the Up / running state. The one-shot initializer shows Exited (0) after it completes the migrations and creates the admin account.

4

Confirm the data disk is mounted

All stateful DefectDojo data lives on a dedicated data disk mounted at /var/lib/defectdojo. Check the mount:

findmnt /var/lib/defectdojo df -h /var/lib/defectdojo

findmnt shows the device backing /var/lib/defectdojo and df confirms the 40 GiB volume.

5

Check the DefectDojo login page

The bundled nginx reverse proxy serves the DefectDojo login page without authentication on port 80. It returns HTTP 200.

curl -s -o /dev/null -w "%{http_code}\n" http://localhost/login

A 200 confirms the web UI is up.

6

Read the per-VM admin credentials

A unique admin password is generated for your instance on its first boot and written to a root-only file.

sudo cat /root/defectdojo-credentials.txt

The file lists defectdojo.url (where to sign in), defectdojo.admin.user (admin) and defectdojo.admin.pass. Store the password securely.

7

Sign in to the DefectDojo web UI

Browse to http://<vm-ip>/ and sign in with the username admin and the defectdojo.admin.pass from Step 6. The bundled nginx reverse proxy serves both the UI and the API on port 80.

After you sign in, the DefectDojo dashboard opens. It summarises your products, engagements and current findings posture.

8

Organise your work into products and engagements

DefectDojo models your work as products (the application or system under test), engagements (a period of testing against a product) and tests (the individual scans whose results you import). Create a product, create an engagement within it, and then import a scan report to populate findings.

9

Triage findings

The Findings view consolidates every imported vulnerability across your products and engagements, de-duplicated and ranked by severity. From here you can triage findings, accept risk, mark findings as mitigated or false-positive, and drive remediation.

10

Use the REST API

DefectDojo exposes a complete REST API under /api/v2/. Obtain an API token with your admin credentials, and then call any endpoint with the Authorization: Token <token> header.

curl -s -X POST http://<vm-ip>/api/v2/api-token-auth/ \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"<password from Step 6>"}'

The response contains a token field. Use the token to import scan results, query findings and integrate DefectDojo into your CI/CD pipeline.

11

Manage the stack

The defectdojo.service systemd unit manages the whole stack. It wraps docker compose under /opt/defectdojo.

sudo systemctl restart defectdojo.service
sudo systemctl status defectdojo.service --no-pager

To inspect logs for a specific service:

cd /opt/defectdojo && sudo docker compose -f docker-compose.yml -f docker-compose.override.sac.yml --env-file .env logs --tail 50 uwsgi

Enabling HTTPS on your own domain

The image serves plain HTTP on port 80 out of the box. To serve DefectDojo over HTTPS on your own domain, terminate TLS in front of the VM. For example, use an Azure Application Gateway or a reverse proxy with a Let's Encrypt certificate, pointing at the VM on port 80.

Set DD_ALLOWED_HOSTS to your domain in /opt/defectdojo/.env before you restart defectdojo.service. Add 443/tcp to your NSG inbound rules.

First-boot security model

On the first boot of each VM, defectdojo-firstboot.service runs once and:

  • Rotates every per-VM secret in the stack: the Django secret key (DD_SECRET_KEY), the AES-256 credential encryption key (DD_CREDENTIAL_AES_256_KEY) and the PostgreSQL password
  • Generates a fresh, strong admin password and initialises the stack on an empty database, so the initializer creates the admin account with that password
  • Verifies the admin API-token round-trip and writes the credentials to /root/defectdojo-credentials.txt (root-only, mode 0600)

No shared or default secret and no pre-existing login ship in the image.

Support

24/7 technical support is included. Contact SecureAnyCloud at sales@secureanycloud.com for help with deployment, scanner imports and parsers, products and engagements, the findings and de-duplication model, the REST API, JIRA and notification integrations, TLS and backups.

DefectDojo and OWASP are trademarks of the OWASP Foundation. PostgreSQL is a trademark of the PostgreSQL Community Association of Canada. Valkey is a trademark of the Linux Foundation. Docker is a trademark of Docker, Inc. All other product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch DefectDojo 3.0.100 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure