freenginx

In the Azure Portal, open Marketplace, search for freenginx, select the SecureAnyCloud publisher entry, and choose Create.

On the Networking tab, attach a network security group. Allow inbound TCP 22 from your management IP range, and allow TCP 80 and TCP 443 from the client networks that should reach your site.

Choose Review + create, wait for validation, then choose Create. Deployment takes around two minutes.

RG="freenginx-prod" LOCATION="eastus" VM_NAME="freenginx-01" ADMIN_USER="azureuser" IMAGE_URN="sac1647283583153:freenginx-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:freenginx-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" \
  --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username "$ADMIN_USER" \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard

Open the web ports on the VM's network security group. Adjust the source ranges to your own networks:

az network nsg rule create --resource-group "$RG" --nsg-name "${VM_NAME}NSG" \
  --name allow-http --priority 1001 --destination-port-ranges 80 --access Allow --protocol Tcp
az network nsg rule create --resource-group "$RG" --nsg-name "${VM_NAME}NSG" \
  --name allow-https --priority 1002 --destination-port-ranges 443 --access Allow --protocol Tcp

Connect to the VM over SSH and confirm that freenginx is active, enabled at boot and listening on TCP 80 and 443. freenginx-firstboot.service generates the self-signed certificate and DH parameters once, at first boot.

systemctl status nginx --no-pager nginx -v ss -tln | grep -E ':80 |:443 '

Expected output:

● nginx.service - freenginx - high performance web server (sac) Loaded: loaded (/etc/systemd/system/nginx.service; enabled; preset: enabled) Active: active (running) nginx version: freenginx/1.30.1 LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 511 0.0.0.0:443 0.0.0.0:*

The image is compiled from the official freenginx source tarball. Inspect the exact modules and compiler flags used in the build, and confirm that the running configuration passes a syntax test:

nginx -V nginx -t

The build includes the SSL, HTTP/2, real-IP, stub-status, gzip-static and sub-filter modules, with stack-protector and RELRO hardening flags. nginx -t reports the configuration syntax is OK.

Check that the server version is hidden, the security headers are present, the per-VM self-signed certificate is in place and HTTP/2 is negotiated on TCP 443:

curl -sI http://localhost/ | grep -iE '^HTTP|^Server:|^X-|^Referrer' echo | openssl s_client -connect 127.0.0.1:443 2>/dev/null | openssl x509 -noout -subject -issuer -dates
curl -skI --http2 https://localhost/ | grep -iE '^HTTP|^strict-transport'

Server: freenginx appears with no version number (server_tokens off). The X-Content-Type-Options, X-Frame-Options and Referrer-Policy headers are set, and the certificate is this VM's own self-signed certificate. HTTP/2 200 confirms that HTTP/2 is active, with HSTS on HTTPS.

The default landing page is served from /var/www/html over both HTTP and HTTPS.

Copy your files into the document root, or edit the default site. The document root is /var/www/html:

ls -la /var/www/html/ cat /etc/nginx/conf.d/default.conf

To serve your own static site, replace the contents of /var/www/html, then test and reload:

sudo nginx -t sudo systemctl reload nginx

freenginx works as a reverse proxy and load balancer. The default site ships a commented location /app/ block. Uncomment it in /etc/nginx/conf.d/default.conf and point proxy_pass at your backend:

location /app/ { proxy_pass http://127.0.0.1:8080/; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; }

To load-balance across several backends, declare an upstream block and proxy to it:

upstream app_pool { server 10.0.0.4:8080; server 10.0.0.5:8080; } server { listen 80; location / { proxy_pass http://app_pool; } }

After you edit any configuration, validate it before you reload. A reload never drops live connections:

sudo nginx -t sudo systemctl reload nginx

The image ships with a per-VM self-signed certificate, so HTTPS works immediately. To serve a certificate that browsers trust, replace the two files referenced by the default :443 server block, then reload:

• /etc/nginx/ssl/sac.crt: your certificate (full chain).
• /etc/nginx/ssl/sac.key: your private key.

ssl_certificate /etc/nginx/ssl/sac.crt; ssl_certificate_key /etc/nginx/ssl/sac.key;

Copy your certificate and key over those paths, and keep the key readable only by root. Then test and reload:

sudo nginx -t sudo systemctl reload nginx

For automated Let's Encrypt certificates, install certbot with the nginx plugin (sudo apt-get install -y python3-certbot-nginx). Then run sudo certbot --nginx -d your-domain.example. Certbot rewrites the certificate paths for you and installs a renewal timer.