FHEM

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is comfortable for FHEM, which is light on resources.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the dashboard. For public exposure, front the dashboard with TLS (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for FHEM by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:fhem-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name fhem \
  --image sac1647283583153:fhem-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name fhem --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check the three services:

systemctl is-active fhem nginx fhem-firstboot

All three report active. The listeners show the security posture at a glance. nginx is public on :80, while FHEMWEB (:8083) and the FHEM telnet CLI (:7072) are bound to loopback only:

ss -tln | grep -E ':80 |:8083 |:7072 '

Step 5 - Retrieve your dashboard password

The first boot of your VM generates a unique admin password and writes it to a root-only file. Read it with sudo:

sudo cat /root/fhem-credentials.txt

The file contains FHEM_ADMIN_USER (admin) and FHEM_ADMIN_PASSWORD, plus the dashboard URL. Store the password somewhere safe.

Step 6 - Check the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/health

The endpoint returns ok.

Step 7 - Open the FHEMWEB dashboard

Browse to http://<vm-public-ip>/. When the browser prompts for HTTP Basic credentials, sign in as admin with the password from Step 5.

FHEMWEB opens on the pre-loaded Living Room, which shows the demo climate sensor, thermostat and light. A Home Overview panel lists every demo device with live readings.

The room menu on the left groups devices, and the Everything view lists them all. Together they give a whole-home overview across Living Room, Bedroom, Kitchen, Outdoor and Automation.

Step 8 - Inspect and control a device

Click any device name to open its detail page. There you can see its readings and internals, change its value with the set control, and edit its attributes. For example, the Living Room thermostat has a desired-temperature slider.

Step 9 - Review the demo automations

The Automation room collects the example rules that ship with the image:

• Two scheduled at timers for the morning and night lighting scenes
• A notify that turns the lights off when presence goes to absent
• A structure that groups the lights so you can switch them together

Step 10 - Confirm the security posture

The dashboard is closed by default. An unauthenticated request is rejected with 401, and a request succeeds only with the per-VM password. FHEMWEB itself is never exposed to the network, and nginx is the only public door.

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/fhem/

This prints 401. With the per-VM credentials, it returns 200:

curl -s -o /dev/null -w '%{http_code}\n' -u admin:<FHEM_ADMIN_PASSWORD> http://localhost/fhem/

Step 11 - Explore the demo devices and add your own

The demo devices are FHEM dummy devices, so they need no hardware. List them from the loopback telnet CLI. Once you attach a controller, use the same interface or the dashboard to define real devices:

perl /opt/fhem/fhem.pl 7072 'list'

To connect real hardware, add the FHEM module for your controller, for example a Z-Wave or ZigBee stick or an MQTT broker. Add it from the dashboard under Everything -> define, or edit /opt/fhem/fhem.cfg. The FHEM command reference documents every module.

Security posture

• FHEMWEB has no authentication of its own by default. This image never exposes it. define WEB FHEMWEB 8083 is used without the global keyword, so FHEMWEB binds 127.0.0.1 only. The FHEM telnet CLI is likewise loopback-only on 127.0.0.1:7072.
• nginx is the only public surface. It listens on :80 and enforces HTTP Basic auth against /etc/nginx/.htpasswd (user admin). It also reverse-proxies FHEMWEB's long-poll live updates.
• The password is unique per VM. fhem-firstboot.service creates it on first boot in /etc/nginx/.htpasswd and the root-only /root/fhem-credentials.txt. No two deployments share a credential, and the image contains no usable password.
• Terminate TLS in front of nginx for any public exposure (see below), so credentials are never sent in clear text.

Enabling HTTPS

The nginx reverse proxy serves plain HTTP on port 80. For public exposure, put a certificate in front of it. Add a DNS name for the VM, then use the companion SecureAnyCloud nginx-ssl-certbot image as a TLS reverse proxy. Alternatively, install certbot and extend the existing nginx site with a listen 443 ssl; server block.

Keep FHEMWEB bound to loopback, so the only public surface is the authenticated, TLS-terminated proxy.

Maintenance

• Configuration. Edit devices and rules from the dashboard, which saves them to /opt/fhem/fhem.cfg. Or edit the file directly and reload.
• Backups. Back up /opt/fhem (configuration, logs and state) to preserve your devices, rules and history.
• Upgrades. FHEM can update itself: enter update in the dashboard command field, then shutdown restart. The OS is patched separately.
• Security patches. Unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch FHEM 6.4 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com