GeoServer 3.0

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.

Standard_D2s_v4 (2 vCPU / 8 GiB RAM) is a reasonable starting point for a JVM-based geospatial server. Size up for heavier rendering workloads and larger data.

In the NSG, allow inbound 22/tcp from your management network. Also allow 80/tcp for the Web Admin and the OGC services, and 443/tcp if you add TLS. GeoServer is served over plain HTTP by default, so for production, put your own domain and a trusted certificate in front of it (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, and search the Marketplace for GeoServer by SecureAnyCloud. Select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab. Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:geoserver-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name geoserver \
  --image sac1647283583153:geoserver-ubuntu-24-04:default:latest \
  --size Standard_D2s_v4 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

After the VM is created, open port 80 so that you can reach the Web Admin:

az vm open-port --resource-group <your-rg> --name geoserver --port 80 --priority 900

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

The first boot rotates the admin password and prints a summary to the message of the day. Your first SSH session therefore shows the Web Admin URL and the location of the credentials file.

Step 4 - Confirm the services are running

GeoServer runs as a systemd service behind nginx. Confirm that both are active, that GeoServer is bound to the loopback connector, and that GEOSERVER_DATA_DIR is on the dedicated data disk:

systemctl is-active geoserver.service nginx.service ss -tlnp | grep -E '127.0.0.1:8080|:80 ' findmnt /var/lib/geoserver

Step 5 - Retrieve your admin password and confirm the default is rotated

The per-VM admin password is written to a root-only file at /root/geoserver-credentials.txt (mode 0600). First boot rotates away the well-known default admin / geoserver credential, and both the Web Admin login form and the REST API reject it:

sudo cat /root/geoserver-credentials.txt GS=http://127.0.0.1:8080/geoserver curl -s -o /dev/null -w '%{http_code}\n' -u admin:geoserver $GS/rest/about/version.json
# 401, rejected

Step 6 - Explore the OGC service capabilities

GeoServer advertises each OGC service through a GetCapabilities document. Retrieve the WMS capabilities and confirm that every service answers:

PW=$(sudo grep '^GEOSERVER_ADMIN_PASSWORD=' /root/geoserver-credentials.txt | cut -d= -f2-) GS=http://127.0.0.1:8080/geoserver curl -s -u admin:$PW "$GS/ows?service=WMS&version=1.3.0&request=GetCapabilities" -o wms-capabilities.xml head -n 5 wms-capabilities.xml

Step 7 - Render a map with WMS GetMap

Prove that the geospatial engine renders by requesting a map image of the sample layer topp:states:

PW=$(sudo grep '^GEOSERVER_ADMIN_PASSWORD=' /root/geoserver-credentials.txt | cut -d= -f2-) GS=http://127.0.0.1:8080/geoserver curl -s -u admin:$PW -o states.png \
  "$GS/ows?service=WMS&version=1.3.0&request=GetMap&layers=topp:states&bbox=-124.73,24.96,-66.97,49.37&width=512&height=340&srs=EPSG:4326&format=image/png" file states.png

Step 8 - Sign in to the Web Admin

Browse to http://<vm-public-ip>/geoserver/web/, click the user icon, and sign in with admin and the password from Step 5.

The home page shows an Administration panel that summarizes the layers, layer groups, stores and workspaces the server is publishing.

Step 9 - Browse the layers with Layer Preview

Open Layer Preview to browse every layer the server publishes. Each layer offers an OpenLayers preview and downloads in common formats such as GML and GeoJSON.

Step 10 - Preview a layer on an interactive map

Click the OpenLayers link next to the topp:states layer to open it on an interactive slippy map. Pan and zoom to explore the data rendered live by the WMS service.

Step 11 - Manage layers, stores and workspaces

The Layers page under Data lists every published layer with its store, native projection and enabled state. It also gives you the actions to add, remove, enable and disable layers. This is where you publish your own data.

Step 12 - Publish your own data

To publish your own geospatial data, add a store and then publish a layer from it.

In the Web Admin, go to Data > Stores > Add new store. Choose a format (for example PostGIS, GeoPackage, Shapefile or GeoTIFF) and point it at your data. Then go to Data > Layers > Add a new layer, and publish.

Everything you add is written under GEOSERVER_DATA_DIR on the dedicated data disk, so it survives independently of the operating system disk.

Step 13 - Confirm data lives on the dedicated disk

The GEOSERVER_DATA_DIR sits on the dedicated Azure data disk, so your configuration, styles and published data are decoupled from the OS disk and can be resized independently. Confirm it:

findmnt /var/lib/geoserver ls /var/lib/geoserver

Maintenance

Add TLS. GeoServer is served over plain HTTP on port 80 by default. For production, point a DNS name at the VM and terminate TLS in nginx, for example with Certbot. The Web Admin and the OGC services are then served over HTTPS on port 443.

Back up the data directory. Everything that matters lives under /var/lib/geoserver: the security configuration, styles, workspaces, stores and layers. Snapshot the data disk, or back up that directory, to preserve your configuration and published data.

Keep the admin password safe. The per-VM password is in /root/geoserver-credentials.txt (root only). You can change it at any time from the Web Admin under Security > Users, Groups, Roles.

Updates. The image ships with unattended security upgrades enabled for the operating system. To upgrade GeoServer itself, follow the project's upgrade notes.

Support

Every SecureAnyCloud image is backed by 24/7 support. If you have any questions about deploying or operating GeoServer on Azure, contact the SecureAnyCloud team.

Deploy on Azure

Launch GeoServer 3.0 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com