Deployment guide

Excalidraw

Overview

Excalidraw is an open-source virtual whiteboard for sketching hand-drawn-style diagrams. It is local-first: your drawings live privately in your own browser, and there is no account, login or password to manage.

The SecureAnyCloud image, built from Excalidraw 0.18.1, self-hosts both halves of Excalidraw. You get a fully private deployment with no dependency on the public excalidraw.com. nginx serves the static web app on port 80. The official real-time collaboration room server runs alongside it on loopback, so the Share to Live collaboration feature connects to your own VM, not a public server.

What you get:

Excalidraw 0.18.1 static web app, built from the official source and served from /var/www/excalidraw
nginx on :80 serving the single-page app, with a Socket.IO reverse proxy to the local collaboration server
The official Excalidraw collaboration room server (excalidraw-room) on loopback 127.0.0.1:3002, never publicly exposed
excalidraw-room.service and nginx.service as systemd units, enabled and active on every boot
A first-boot service that writes an MOTD banner and a non-secret info note (Excalidraw has no credentials to rotate)
24/7 SecureAnyCloud support

Prerequisites

Before you deploy, make sure you have:

An active Azure subscription
An SSH key pair
A VNet and subnet in the target region
NSG inbound rules that allow 22/tcp from your management network and 80/tcp for the whiteboard

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting point. Excalidraw serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Excalidraw by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:excalidraw-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name excalidraw \
  --image sac1647283583153:excalidraw-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name excalidraw --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

nginx serves the whiteboard, and the real-time collaboration server runs as excalidraw-room.service. Confirm both are active:

systemctl is-active excalidraw-room.service nginx.service

Both report active.

Step 5 - Verify the endpoints

Confirm that nginx serves the Excalidraw app on port 80. Also confirm that the Socket.IO collaboration endpoint is reachable through nginx, which proxies to the loopback room server:

echo "SPA index: $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/)"
echo "nginx /health: $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/health)"
echo "Socket.IO (nginx):$(curl -s -o /dev/null -w '%{http_code}' 'http://127.0.0.1/socket.io/?EIO=4&transport=polling')"

All three return 200. The Socket.IO request returns an Engine.IO handshake payload (it contains a sid session id). This proves the live-collaboration server is wired up behind nginx.

Step 6 - Confirm the collaboration server is private

The collaboration room server is bound to loopback 127.0.0.1:3002 and is never exposed directly. Only nginx on port 80 is public. A non-secret info note records the app URL:

ss -tlnp | grep 3002 cat /var/lib/sac/data/excalidraw-info.txt

Step 7 - Open the whiteboard

Browse to http://<vm-public-ip>/ in any modern browser. The Excalidraw canvas loads with the drawing toolbar across the top.

Because Excalidraw is local-first, there is no sign-in. Your drawings are saved privately in your browser.

Step 8 - Draw

Pick a tool from the toolbar (rectangle, ellipse, diamond, arrow, line, freedraw, text and more) and draw on the canvas.

Select a shape to show the style panel on the left. Use it to change stroke color, fill style, font family and size, opacity and layer order for the selected element.

Step 9 - Live collaboration

Click Share in the top-right and choose Live collaboration. Excalidraw starts a collaborative session and gives you a room link to share.

This VM's own room server serves the collaboration link, so your whiteboard data never leaves your host. Anyone you send the link to joins the same canvas in real time.

Maintenance

Data: Excalidraw is local-first, so drawings are stored in each visitor's browser. There is no server-side database to back up. Use the in-app Save to file and Open commands to export and import .excalidraw scenes.
Collaboration: the room server (excalidraw-room.service) holds an in-progress shared scene only while a session is active. Nothing is persisted to disk.
TLS: Excalidraw serves plain HTTP on port 80. For production, front it with TLS (for example certbot) and your own domain.
Restart: sudo systemctl restart excalidraw-room.service nginx.service to restart the services.
Security patches: unattended-upgrades remains enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Excalidraw is a trademark of Excalidraw, Inc. SecureAnyCloud is not affiliated with, endorsed by, or sponsored by Excalidraw, Inc. This image packages the open-source Excalidraw software (MIT License) for deployment on Microsoft Azure.

Deploy on Azure

Launch Excalidraw on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Excalidraw is an open-source virtual whiteboard for sketching hand-drawn-like diagrams. It provides an infinite canvas with a distinctive hand-drawn look, a rich set of shapes, arrows, text and freehand drawing tools, a reusable shape library and real-time collaboration.

This SecureAnyCloud image builds the Excalidraw single-page frontend from source at the v0.18.1 release and serves it as a static bundle through nginx.

What you get:

Real-time collaboration through the bundled excalidraw-room collaboration server. It is a stateless socket.io broadcast server that runs as a dedicated unprivileged excalidraw system account, bound to the loopback interface only. A systemd service starts it on boot and restarts it on failure.
An application directory at /var/lib/excalidraw, which is a dedicated, independently resizable EBS data volume
An nginx reverse proxy on port 80 with HTTP Basic authentication, because Excalidraw ships with no built-in authentication. nginx serves the static whiteboard and proxies the collaboration WebSocket (the /socket.io/ path) to the room server on loopback.
An admin password generated on the first boot of every deployed instance, so two instances launched from the same Amazon Machine Image never share a password. It is written to /root/excalidraw-credentials.txt with mode 0600, so only the root user can read it.

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and port 80 for the whiteboard
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Excalidraw. Select the SecureAnyCloud listing and choose Select. Then choose Continue on the subscription summary.

Pick an instance type of t3.medium or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Create or select a security group that opens port 22 from your management network and port 80 for the whiteboard. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization takes a few seconds after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

The following block launches an instance from the SecureAnyCloud Excalidraw Marketplace AMI into an existing subnet and security group. Replace the values in angle brackets as follows:

<ami-id> with the AMI ID shown on the Marketplace listing
<key-name> with your EC2 key pair name
<subnet-id> with your subnet ID
<security-group-id> with a security group that opens ports 22 and 80 as described above

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.medium \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=excalidraw}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can find it in the EC2 console or with aws ec2 describe-instances.

Connect to Your Instance

Connect over SSH using your key pair and the login user for your operating system variant.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i <key-name>.pem ubuntu@<public-ip>

Retrieve the Admin Password

The Excalidraw admin password is unique to your instance and was generated on first boot. Read it as root:

sudo cat /root/excalidraw-credentials.txt

The file lists the whiteboard URL, the admin user (admin) and the generated password. Store this password somewhere safe.

Sign In to the Whiteboard

The Excalidraw whiteboard is served on port 80 by nginx behind HTTP Basic authentication. In a browser, go to:

http://<instance-public-ip>/

The browser prompts for credentials. Sign in as admin with the password from the credentials file. The Excalidraw canvas loads, ready to draw.

Use the tool palette at the top to draw rectangles, diamonds, ellipses, arrows, lines, freehand strokes and text. Select, move, group, align, lock and restyle elements with the left and right side panels. Pan with space-drag or the scroll wheel, and zoom with the on-canvas controls.

Open the library panel to keep reusable items and drag them onto the canvas. To build flowcharts and wireframes, connect shapes with bound arrows that stay attached as you move things around.

Your drawings are kept locally in your browser. Use the main menu to save the scene to a .excalidraw file or to export the canvas to PNG or SVG at any time.

Confirm Excalidraw Is Running

Over SSH, confirm that the collaboration server and the nginx proxy are active and that the ports are listening:

sudo systemctl is-active excalidraw-room nginx
sudo ss -tlnp | grep -E ':(80|3002) '

You should see both services reported as active, the collaboration server listening on 127.0.0.1:3002 (loopback only), and nginx listening on port 80.

Real Time Collaboration

Excalidraw supports live multiplayer drawing through the bundled collaboration server. In the editor, open the main menu, choose Live collaboration, and start a session. Excalidraw generates a shareable room link. Send it to your teammates.

Everyone who opens the link (and signs in with the same admin credentials) joins the same room. The collaboration server relays drawing updates and live cursors between everyone in the room in real time.

The room server is stateless and self-hosted on this instance, so your boards are broadcast only through your own appliance. nginx proxies the collaboration WebSocket on the same port 80 (the /socket.io/ path) behind the same HTTP Basic credentials.

To confirm that the collaboration server is reachable through the proxy, run the following over SSH from the instance itself: curl -s -u admin:PASSWORD 'http://127.0.0.1/socket.io/?EIO=4&transport=polling' | head -c 80; echo. Replace PASSWORD with the generated admin password from /root/excalidraw-credentials.txt.

A short socket.io handshake payload containing a session id (sid) confirms the proxy reaches the room server.

The Data Volume

The Excalidraw application lives on a dedicated EBS volume mounted at /var/lib/excalidraw. The volume holds the built static frontend bundle and the collaboration server. This keeps the application off the operating system disk and lets you resize or snapshot it independently.

Confirm the mount with:

df -h /var/lib/excalidraw

To grow the volume, expand the EBS volume in the AWS console, then grow the filesystem on the instance with sudo resize2fs on the underlying device.

Enable HTTPS

nginx serves the whiteboard over plain HTTP on port 80. For production use, place it behind TLS.

Obtain a certificate for your domain. For example, use a managed certificate on an Application Load Balancer in front of the instance, or install Certbot on the instance. Then configure nginx to listen on 443 with your certificate. Serve the same static bundle and proxy the /socket.io/ WebSocket to 127.0.0.1:3002, exactly as the bundled site does for port 80. Keep the HTTP Basic authentication in place.

Restrict the security group so ports 80 and 443 are reachable only from the networks that use the whiteboard.

Backup and Maintenance

Your drawings live in your browser, not on the server, so there is no server-side board database to back up. Export important boards to .excalidraw, PNG or SVG from the editor. Snapshot the /var/lib/excalidraw EBS volume if you want to preserve the built application and any custom configuration.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade. Reboot when a new kernel is installed. The collaboration server and nginx start automatically on boot.

Support

SecureAnyCloud publishes and supports this image. Support covers deployment, the collaboration server, the authenticating proxy, TLS termination, custom shape libraries, and reverse proxy and DNS configuration. Contact SecureAnyCloud through the support channel listed on the AWS Marketplace listing.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Excalidraw on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS