Docmost

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point. Increase the size for larger teams and larger documents.

Configure the NSG to allow inbound 22/tcp from your management network and 80/tcp (and 443/tcp once you add TLS) for the web interface. Docmost serves plain HTTP on port 80. For production, put it behind TLS with your own domain (see the final section).

Step 1 - Deploy from the Azure Marketplace

• In the Azure portal, choose Create a resource and search the Marketplace for the SecureAnyCloud Docmost offer.
• Select the plan, then Create.
• On the Basics tab, pick your subscription, resource group and region, name the VM, and select Standard_B2s (or larger).
• Choose SSH public key authentication with the admin username azureuser, and provide your public key.
• On the Networking tab, allow inbound 22/tcp from your management network and 80/tcp for the web interface.
• Select Review + create, and then Create. When the VM is running, note its public IP address.

Step 2 - Deploy from the Azure CLI

az vm image terms accept --urn sac1647283583153:docmost:default:latest
az vm create \
  --resource-group my-docmost-rg \
  --name docmost \
  --image sac1647283583153:docmost:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the ports that the web interface needs. SSH is opened by default:

az vm open-port --resource-group my-docmost-rg --name docmost --port 80 --priority 900

Step 3 - Connect to your VM

Replace <vm-ip> with your VM's public IP address:

ssh azureuser@<vm-ip>

Step 4 - Confirm the services are running

Docmost, its bundled PostgreSQL and Redis, and nginx all come up automatically on first boot. Confirm they are active:

sudo systemctl is-active docker docmost nginx

The expected output is:

active active active

The stack runs as three containers on a private Docker network. PostgreSQL and Redis are never published to a host port. Only Docmost is published, and only to the loopback interface, with nginx in front on port 80.

Step 5 - Secure by default: the workspace owner is pre-seeded

A fresh Docmost instance has no workspace, and the first account created becomes the workspace owner. On a public server, that is a risk, because whoever reaches the setup page first would own your instance.

The SecureAnyCloud image closes this gap. On first boot, before the port is reachable, the image creates a unique workspace owner administrator with a per-VM password, so the workspace is already claimed. After that, setup is permanently blocked and self-hosted Docmost has no open sign-up. New members join by invitation only.

As a result, a login with a blank or wrong password is rejected, only the per-VM admin password is accepted, and a second attempt to run setup is refused because the workspace already exists.

Read your unique credentials, which are written to a root-only file:

sudo cat /root/docmost-credentials.txt

The file holds the workspace URL, the admin email (admin@docmost.local) and the per-VM admin password. Keep it safe.

Step 6 - Sign in to Docmost

Open http://<vm-ip>/ in your browser. The Docmost login screen appears, and there is no anonymous access. Sign in with the admin email and the password from the credentials file.

Step 7 - Explore the workspace

After you sign in, you land on the workspace home. From here, you can see the spaces you belong to and the pages you recently updated, and you can jump straight to full-text search. The left sidebar holds your spaces, favorites, templates, invitations and settings.

Step 8 - Create spaces and pages

A space is a container for related pages, with its own members and permissions. Use one space per team, project or knowledge area. Inside a space, pages nest to any depth and reorder by drag and drop.

The editor is a rich, real-time collaborative editor. Type / for a menu of headings, lists, tables, code blocks, callouts, images and diagrams. Everyone editing a page sees each other's changes live.

Step 9 - Check the stack health from the command line

Docmost exposes an unauthenticated liveness endpoint that reports whether the database and cache are reachable. It is useful for monitoring:

curl -s http://127.0.0.1/api/health

A healthy stack returns the following output:

{"status":"ok","info":{"database":{"status":"up"},"redis":{"status":"up"}},"error":{},"details":{"database":{"status":"up"},"redis":{"status":"up"}}}

Step 10 - Invite your team

Self-hosted Docmost is invitation only, so add colleagues from Settings, Members while you are signed in as the workspace owner. Invited members set their own password when they accept. You assign each member a workspace role and add them to the spaces they need.

Step 11 - Production: your own domain with TLS

Docmost serves plain HTTP on port 80. For production, point a DNS record at the VM, put Docmost behind TLS, and set the application URL to your https domain so that links and the collaborative editor use the right origin. A common approach is to add a certificate to nginx with Certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d docs.example.com

Then edit APP_URL in /etc/docmost/docmost.env to https://docs.example.com and restart the stack with sudo systemctl restart docmost. See the Docmost documentation for the full production checklist.

Support

Every SecureAnyCloud image includes 24/7 support. For questions about deploying or operating Docmost on Azure, contact the SecureAnyCloud team through the Azure Marketplace listing or at secureanycloud.com.

Deploy on Azure

Launch Docmost on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com