Deployment guide

Flamenco

Overview

Flamenco is an open source render farm manager from Blender Studio. It coordinates rendering jobs and distributes them across worker machines running Blender. This SecureAnyCloud image ships the Flamenco Manager, a single self-contained Go binary with an embedded web dashboard that submits, tracks and manages render jobs and workers across your farm.

The Manager runs as a systemd service bound to the loopback address 127.0.0.1:8080. An nginx reverse proxy in front of it terminates TLS on port 443, and port 80 redirects to HTTPS. The image ships already configured, so it boots straight into the dashboard rather than an interactive setup assistant. It generates a fresh self-signed TLS certificate on the first boot of every VM. Workers are separate machines with Blender installed that you connect to the Manager afterwards.

What you get:

Flamenco Manager 3.9.3 managed by systemd, serving its dashboard and REST API on 127.0.0.1:8080.
An nginx reverse proxy terminating TLS on port 443, with port 80 redirecting to HTTPS.
A self-signed TLS certificate regenerated uniquely on the first boot of every VM.
A ready-to-run configuration (flamenco-manager.yaml), so the appliance boots into the dashboard and not the setup assistant.
SQLite storage and a shared-storage directory under /var/lib/flamenco, owned by a dedicated flamenco system user.
flamenco-manager.service and nginx.service as systemd units, enabled and active.
The Flamenco REST API and Blender add-on, served directly from the Manager.
24/7 SecureAnyCloud support.

Flamenco Manager has no built-in login by design, because it targets a trusted network. Security comes from the network shape: the Manager binds the loopback interface only, and the sole public surface is nginx on port 443. Restrict access to the dashboard at the network level and, for production, install your own TLS certificate (see Maintenance).

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.
A VM size of Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point for the Manager. Rendering itself runs on your separate worker machines.
NSG inbound rules that allow 22/tcp from your management network for SSH and 443/tcp for the dashboard and API. Port 80 is optional and only redirects to HTTPS. Workers connect to the Manager over port 443 as well.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Flamenco by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443). Then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM and open port 443:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:flamenco-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name flamenco \
  --image sac1647283583153:flamenco-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name flamenco --port 443 --priority 1010

Step 3 - Connect to your VM

Connect over SSH as azureuser:

ssh azureuser@<public-ip>

Step 4 - Confirm the services are running

Check that both services are active:

systemctl is-active flamenco-manager.service nginx.service

Both report active. The Flamenco Manager serves its dashboard and REST API on the loopback address 127.0.0.1:8080, and nginx fronts it over TLS on port 443. Confirm the loopback listener and that first boot has completed:

ss -tln | grep '127.0.0.1:8080' ls -l /var/lib/sac/data/flamenco-firstboot.done

Step 5 - Review the version, configuration and connection URL

Check the Manager version, its baked configuration and the per-VM connection URL. First boot writes the connection details to a root-only file:

/opt/flamenco/flamenco-manager -version 2>&1 | sed 's/\x1b\[[0-9;]*m//g' | head -1 grep -E '^(listen|database|shared_storage_path):' /var/lib/flamenco/flamenco-manager.yaml
sudo cat /root/flamenco-credentials.txt

The version line reports version=3.9.3. The configuration binds the Manager to 127.0.0.1:8080 with its SQLite database and shared storage under /var/lib/flamenco. The credentials file contains FLAMENCO_URL, the HTTPS address to open in your browser. Flamenco has no login, so there is no password to store.

Step 6 - Confirm the Manager API and the TLS dashboard

The Manager exposes a REST API. The configuration endpoint reports "isFirstRun": false, which confirms that the appliance booted into the dashboard and not the setup assistant:

curl -s http://127.0.0.1:8080/api/v3/configuration
curl -s http://127.0.0.1:8080/api/v3/version

nginx fronts the dashboard over TLS. A request to / redirects to the single-page app at /app/, which loads with HTTP 200. Confirm it:

curl -ks -o /dev/null -w 'GET /app/ -> HTTP %{http_code}\n' https://127.0.0.1/app/

Step 7 - Open the dashboard in your browser

Browse to the FLAMENCO_URL from Step 5, for example https://<public-ip>/. Because the certificate is self-signed, your browser shows a one-time warning. Accept it to continue, or install your own certificate (see Maintenance).

The Flamenco Manager dashboard opens on the Jobs page, where you submit, pause, requeue and track render jobs. The header shows the farm status and the Manager version.

The Settings page is an in-browser editor for the Manager configuration, including the shared storage location, timeouts and variables. It writes directly to flamenco-manager.yaml.

Step 8 - Connect render workers

Rendering runs on worker machines, which are separate hosts with Blender installed. Download the matching Flamenco worker from flamenco.blender.org onto each worker machine, then point it at this Manager over HTTPS:

flamenco-worker -manager https://<public-ip>/

Each worker registers itself and appears on the Workers page of the dashboard, where you can monitor status, pause a worker or inspect its details. Until at least one worker connects, the farm status reads inoperative. This is expected on a fresh Manager.

Confirm the worker fleet, which is initially empty, from the API:

curl -s http://127.0.0.1:8080/api/v3/worker-mgt/workers

Step 9 - Explore the REST API

The Manager ships an interactive OpenAPI (Swagger) explorer for the full render-farm API, covering jobs, workers, tags and configuration. It is useful for automating job submission and farm management. Open it at https://<public-ip>/api/v3/swagger-ui/.

Maintenance

Restrict access. Flamenco Manager has no login, so scope the NSG rule for port 443 to the networks that run your workers and operators, not the whole internet.

Install a real TLS certificate. The image ships a self-signed certificate, regenerated per VM, at /etc/nginx/tls/flamenco.crt and /etc/nginx/tls/flamenco.key. For production, replace both files with a certificate for your own domain, for example from Let's Encrypt, then reload nginx:

sudo systemctl reload nginx

Shared storage. Render job files are exchanged through the shared storage directory at /var/lib/flamenco/shared. For a larger farm, mount dedicated or network storage there and update the shared storage location on the Settings page.

Updates. The image keeps unattended security updates enabled for the OS. To update Flamenco itself, download a newer release from flamenco.blender.org, replace the binary under /opt/flamenco, and restart flamenco-manager.service.

Support

Every SecureAnyCloud image is backed by 24/7 support. If you have any questions about Flamenco on Ubuntu 24.04, contact us at sales@secureanycloud.com.

Deploy on Azure

Launch Flamenco on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure