Elixir Phoenix

Search the Azure Marketplace for Elixir with Phoenix, select the SecureAnyCloud publisher, and click Create.

Add Network Security Group rules that allow TCP 22 (admin), TCP 80 (HTTP) and TCP 443 (reserved for TLS) from your client networks.

RG="phoenix-prod"; LOCATION="eastus"; VM_NAME="phoenix-01" IMAGE_URN="sac1647283583153:elixir-phoenix-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name phoenix-vnet --address-prefix 10.100.0.0/16 --subnet-name phoenix-subnet --subnet-prefix 10.100.1.0/24 az network nsg create -g "$RG" --name phoenix-nsg az network nsg rule create -g "$RG" --nsg-name phoenix-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name phoenix-nsg --name allow-http --priority 110 \
  --destination-port-ranges 80 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name phoenix-nsg --name allow-https --priority 120 \
  --destination-port-ranges 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:elixir-phoenix-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name phoenix-vnet --subnet phoenix-subnet --nsg phoenix-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

Run the checks below. They confirm that the demo release and nginx are running, Phoenix is bound to loopback only, the health endpoint answers, and the data disk is mounted.

for s in phoenix-demo.service nginx.service elixir-phoenix-firstboot.service; do printf ' %-34s %s\n' "$s" "$(systemctl is-active $s)" done ss -tlnH | awk '{print $4}' | grep -E ':4000$|:80$' | sort -u curl -s -o /dev/null -w 'GET /healthz -> HTTP %{http_code}\n' http://127.0.0.1/healthz findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/phoenix-demo

Request the /healthz endpoint. nginx serves it directly, with no round trip to the BEAM, so it suits Azure Load Balancer health probes.

curl -i http://127.0.0.1/healthz

Browse to http://<vm-public-ip>/. The demo Phoenix application serves the standard Phoenix welcome page, rendered by the running release on the BEAM VM.

Browse to http://<vm-public-ip>/api/status, or request it with curl. The route returns live JSON: a server timestamp, the Elixir, Erlang/OTP and Phoenix version numbers, and a request counter held in a supervised process.

Reload the page. The counter increments and the timestamp advances, which shows that the BEAM VM executes code on every request instead of serving a static file.

curl -s http://127.0.0.1/api/status echo
curl -s http://127.0.0.1/api/status

Browse to http://<vm-public-ip>/dashboard. Phoenix LiveDashboard is the real-time observability console for the BEAM VM, and it updates live over a LiveView WebSocket. The Home page shows the Erlang/OTP, Elixir and Phoenix versions, atom and process counts, memory breakdown and run-queue depth.

The Processes page lists the live Erlang processes inside the BEAM VM with their memory, reduction count, message-queue length and current function, refreshing in real time.

LiveDashboard is exposed without authentication as a demo and showcase surface. Restrict it in production, either by putting it behind authentication or by removing the route (see Step 13).

The Elixir toolchain is on the system PATH. The demo app is a self-contained production Mix release that bundles its own Erlang runtime. Confirm both:

elixir --version ls -1 /var/lib/phoenix-demo/rel/demo/ test -x /var/lib/phoenix-demo/rel/demo/bin/demo && echo "release binary present"

First boot writes a non-secret notes file that documents the demo URLs and how to deploy your own release. Read it:

cat /var/lib/sac/data/elixir-phoenix-endpoints.notes

The image is a full Elixir and Phoenix build environment. To ship your own application, generate it, build a production release, and point the systemd unit at it. A Mix release bundles its own runtime, so nothing else is needed at runtime.

# On a build host (or this VM), generate and build a release, then browse http://<vm-ip>/ : mix phx.new myapp cd myapp MIX_ENV=prod mix assets.deploy MIX_ENV=prod mix release
# Deploy it onto the data disk and repoint the service:
sudo systemctl stop phoenix-demo.service
sudo cp -a _build/prod/rel/myapp /var/lib/phoenix-demo/rel/myapp
sudo chown -R phoenix:phoenix /var/lib/phoenix-demo/rel/myapp
sudo sed -i 's#/rel/demo#/rel/myapp#g; s#/bin/demo#/bin/myapp#g' /etc/systemd/system/phoenix-demo.service
sudo systemctl daemon-reload
sudo systemctl start phoenix-demo.service

The per-VM SECRET_KEY_BASE, PHX_HOST and PORT live in /var/lib/phoenix-demo/demo.env. The systemd unit reads this file as an EnvironmentFile.

sudo systemctl status phoenix-demo.service --no-pager sudo systemctl restart phoenix-demo.service
sudo journalctl -u phoenix-demo.service -n 50 --no-pager

Run sudo journalctl -u phoenix-demo.service -f to follow the logs live. Run sudo -u phoenix /var/lib/phoenix-demo/rel/demo/bin/demo remote to attach a remote IEx shell to the running node.

• Restrict or remove LiveDashboard. The /dashboard route is unauthenticated in this demo image. For production, put it behind authentication, for example a Plug that checks a basic-auth header or an admin session. Alternatively, remove the live_dashboard route from your router.
• Add TLS. Terminate HTTPS at nginx (port 443) with your certificate, or front the VM with Azure Application Gateway. Port 443 is reserved in the NSG for this.
• Lock down the NSG. Restrict TCP 22 to your management CIDR. Expose TCP 80 and 443 only to the clients or load balancer that need them.
• Keep the OS patched. Unattended security upgrades are enabled by default.
• Rotate the Phoenix secret if you clone the VM. Delete /var/lib/phoenix-demo/demo.env and restart elixir-phoenix-firstboot.service to regenerate SECRET_KEY_BASE.