GeoWebCache 2.0

Prerequisites

• An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.
• Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point for a single JVM tile cache. Size up for heavier seeding workloads and larger caches.
• NSG inbound: allow 22/tcp from your management network and 80/tcp (and 443/tcp if you add TLS) for the web UI and the tile services.
• GeoWebCache is served over plain HTTP by default. To serve it over HTTPS, put your own domain and a trusted certificate in front of it (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for GeoWebCache by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Create the VM with the Azure CLI:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:geowebcache-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name geowebcache \
  --image sac1647283583153:geowebcache-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 (and 22 for SSH) on the VM's network security group. Then browse to http://<vm-public-ip>/.

Step 3 - Connect over SSH

Connect over SSH:

ssh azureuser@<vm-public-ip>

First boot generates the administrator password and prints a summary to the message of the day. Your first SSH session therefore shows the web UI URL and where the credentials file lives.

Step 4 - Confirm the services are running

GeoWebCache runs as a web application in Tomcat behind nginx. Confirm both services are active and that Tomcat is bound to the loopback connector only:

systemctl is-active tomcat.service nginx.service ss -tlnp | grep -E '127.0.0.1:8080|:80 ' java -version

Step 5 - Retrieve your admin password and confirm the secure-by-default posture

First boot writes the per-VM administrator password to a root-only file at /root/geowebcache-credentials.txt (mode 0600). The tile service is public, while the REST and seed endpoints reject both anonymous access and the well-known default geowebcache / secured credential. Check both:

sudo cat /root/geowebcache-credentials.txt GWC=http://127.0.0.1/geowebcache curl -s -o /dev/null -w 'anon %{http_code}\n' $GWC/rest/layers.xml curl -s -o /dev/null -w 'default %{http_code}\n' -u geowebcache:secured $GWC/rest/layers.xml curl -s -o /dev/null -w 'tiles %{http_code}\n' "$GWC/service/wmts?REQUEST=GetCapabilities&SERVICE=WMTS&VERSION=1.0.0"

The anonymous and default REST calls return 401, while the public WMTS service returns 200. To receive 200 from the REST API, authenticate as the geowebcache user with the password from your credentials file.

Step 6 - Confirm the pre-seeded tile cache

The demo osm layer is pre-seeded into the on-disk blob store, so a real tile request is served straight from cache. Request a WMTS tile and confirm it comes back as a real PNG image:

GWC=http://127.0.0.1/geowebcache curl -s -D - -o tile.png \
  "$GWC/service/wmts?REQUEST=GetTile&SERVICE=WMTS&VERSION=1.0.0&LAYER=osm&STYLE=&TILEMATRIXSET=EPSG:4326&TILEMATRIX=EPSG:4326:0&TILEROW=0&TILECOL=0&FORMAT=image/png" \
  | grep -iE 'HTTP/|content-type|content-length|geowebcache-cache-result' file tile.png

The geowebcache-cache-result: HIT header confirms the tile was served from the cache rather than re-rendered by the backend.

Step 7 - Explore the WMTS capabilities

GeoWebCache advertises its layers and tile matrix sets through a WMTS GetCapabilities document. Retrieve it and confirm the osm layer and the EPSG:4326 tile matrix set are present:

GWC=http://127.0.0.1/geowebcache curl -s "$GWC/service/wmts?REQUEST=GetCapabilities&SERVICE=WMTS&VERSION=1.0.0" -o wmts-capabilities.xml grep -oE '<ows:Identifier>[^<]*</ows:Identifier>|<TileMatrixSet>[^<]*</TileMatrixSet>' wmts-capabilities.xml | head

Step 8 - Open the GeoWebCache web UI

Browse to http://<vm-public-ip>/geowebcache/home. The home page shows the GeoWebCache version, the automatically generated demos link, direct links to the WMTS, TMS and WMS GetCapabilities documents, and live runtime statistics for the cache.

Step 9 - Browse the demo layer list

Follow A list of all the layers and automatic demos to the demo page. Each configured layer is listed with its enabled state and grid sets, and offers OpenLayers and KML previews plus a Seed link. The pre-seeded osm layer is published on the EPSG:4326 grid set:

Step 10 - Preview tiles on an interactive map

Click the OpenLayers preview link next to the osm layer to open it on an interactive slippy map. GeoWebCache serves every tile of the map over WMTS. Pan and zoom to explore the OpenStreetMap data:

Step 11 - Zoom the tile preview

Use the zoom controls to move to higher zoom levels. Tiles already in the cache are served instantly. Tiles not yet cached are fetched from the backend WMS, cached, and then served from cache on every subsequent request:

Step 12 - Add your own WMS backend

To cache your own maps, add a WMS-backed layer through the authenticated REST API. Authenticate as the geowebcache user with the password from Step 5, then PUT a layer definition. For example:

GWC=http://<vm-public-ip>/geowebcache curl -u geowebcache:<your-password> -XPUT -H 'Content-Type: application/xml' \
  -d '<wmsLayer><name>mylayer</name><mimeFormats><string>image/png</string></mimeFormats> <gridSubsets><gridSubset><gridSetName>EPSG:900913</gridSetName></gridSubset></gridSubsets> <wmsUrl><string>https://your-wms-server/wms</string></wmsUrl> <wmsLayers>your:layer</wmsLayers></wmsLayer>' \
  "$GWC/rest/layers/mylayer.xml"

Then seed it with a POST to "$GWC/rest/seed/mylayer.xml" or from the Seed this layer form on the demo page. See the GeoWebCache documentation for the full configuration reference.

Maintenance

Add TLS. GeoWebCache is served over plain HTTP on port 80 by default. To serve it over HTTPS, point a DNS name at the VM and terminate TLS in nginx, for example with Certbot. The web UI and the tile services are then available over HTTPS on port 443.

Back up the cache and configuration. The layer configuration (geowebcache.xml) and the tile blob store both live under /var/lib/geowebcache. Snapshot the disk or back up that directory to preserve your configuration and cached tiles.

Keep the admin password safe. The per-VM password is in /root/geowebcache-credentials.txt (root-only). It belongs to the geowebcache administrator, which is used for REST, seeding, truncation and reconfiguration.

Updates. The image ships with unattended security upgrades enabled for the operating system. To upgrade GeoWebCache itself, follow the project's upgrade notes.

Support

Every SecureAnyCloud image is backed by 24/7 support. If you have questions about deploying or operating GeoWebCache on Azure, contact the SecureAnyCloud team.

Deploy on Azure

Launch GeoWebCache 2.0 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com