FreedomBox on Debian 12

Prerequisites

• An active Azure subscription.
• An SSH key pair.
• A VNet and subnet in the target region.
• NSG inbound rules that allow 22/tcp from your management network for SSH, and 443/tcp (and optionally 80/tcp) so you can reach the Plinth web console.

Recommended size: Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point.

Plinth serves over HTTPS with a self-signed certificate by default. To avoid the browser warning, configure a domain and a Let's Encrypt certificate from within FreedomBox (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal. Choose Create a resource, search the Marketplace for FreedomBox by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443). Then choose Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:freedombox:default:latest
az vm create \
  --resource-group <your-rg> \
  --name freedombox \
  --image sac1647283583153:freedombox:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name freedombox --port 443 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

FreedomBox runs the Plinth console as a systemd service, fronted by Apache on HTTPS port 443. Confirm that both services are active and that the HTTP port redirects to HTTPS:

systemctl is-active plinth.service apache2.service

curl -sk -o /dev/null -w "plinth https: %{http_code}\n" https://127.0.0.1/plinth/

Step 5 - Retrieve the per VM setup secret

FreedomBox has no default login. A one-time setup secret is generated on the first boot of every VM and written to a root-only credentials file. Retrieve it over SSH:

sudo cat /root/freedombox-credentials.txt

The file contains the console URL and the setup_secret value you enter in the setup wizard. You can also read the same secret directly from FreedomBox at any time:

sudo cat /var/lib/plinth/firstboot-wizard-secret

Step 6 - Complete the secure setup wizard

Open https://<vm-public-ip>/plinth/ in your browser. Plinth uses a self-signed certificate by default, so your browser warns you the first time. Accept the warning to continue.

The first screen is the FreedomBox first-run wizard, which asks for the setup secret from Step 5. Paste the setup_secret value and select Start Setup.

FreedomBox then asks you to create the first administrator account. Choose your own username and a strong password. This account is the administrator and is added to the FreedomBox admin group.

Step 7 - Explore the app catalogue

After the wizard completes, you land in the Plinth console. The Apps page is the heart of FreedomBox. It is a catalogue of self-hosted applications, such as file sharing, a personal VPN, chat and messaging, a wiki and media streaming. You can enable and configure each one from the console.

The System section holds server-wide settings: networking, users and groups, security, backups, certificates and diagnostics.

Step 8 - Verify there is no default login

The setup secret gates the wizard, so no one can create the administrator account without it. You can confirm this directly. The wizard rejects a wrong secret, and it accepts the real per-VM secret and advances to account creation.

Maintenance

• HTTPS with your own domain. In the Plinth console, open System -> Configure to set your domain name. Then use System -> Let's Encrypt to obtain and auto-renew a trusted certificate, so browsers no longer warn about the self-signed default.
• Enable apps as you need them. Every application in the Apps catalogue is disabled until you enable it. Enable only what you use, to keep the attack surface small.
• Users and groups. Manage additional accounts under System -> Users and Groups. Add users to the admin group only when they need administrative access.
• Backups. Use System -> Backups to schedule and export backups of your FreedomBox configuration and app data.
• Security updates. The Debian 12 base ships with unattended security upgrades enabled, so security patches are applied automatically. FreedomBox can also manage distribution updates from System -> Software Update.

Support

SecureAnyCloud maintains this image and provides 24/7 support. For questions about deploying or operating FreedomBox on Azure, contact sales@secureanycloud.com.

Deploy on Azure

Launch FreedomBox on Debian 12 on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com