Ghostfolio

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Choose a larger size for bigger portfolios and heavier market data gathering.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. Also allow 443/tcp once you add TLS. Ghostfolio serves plain HTTP on port 80, so for production, put it behind TLS with your own domain (see Step 11).

Step 1 - Deploy from the Azure Marketplace

• In the Azure portal, choose Create a resource and search the Marketplace for the SecureAnyCloud Ghostfolio offer.
• Select the plan, then select Create.
• On the Basics tab, pick your subscription, resource group and region, name the VM, and select Standard_B2s or larger.
• Choose SSH public key authentication, enter the admin username azureuser and provide your public key.
• On the Networking tab, allow inbound 22/tcp from your management network and 80/tcp for the web interface.
• Select Review + create, then Create. When the VM is running, note its public IP address.

Step 2 - Deploy from the Azure CLI

az vm image terms accept --urn sac1647283583153:ghostfolio:default:latest
az vm create \
  --resource-group my-ghostfolio-rg \
  --name ghostfolio \
  --image sac1647283583153:ghostfolio:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the port the web interface needs. SSH is opened by default.

az vm open-port --resource-group my-ghostfolio-rg --name ghostfolio --port 80 --priority 900

Step 3 - Connect to your VM

Connect over SSH. Replace <vm-ip> with your VM's public IP address:

ssh azureuser@<vm-ip>

Step 4 - Confirm the services are running

Ghostfolio, its bundled PostgreSQL and Redis, and nginx start automatically on first boot. Confirm that they are active:

sudo systemctl is-active docker ghostfolio nginx

Expected output:

active active active

The stack runs as three containers on a private Docker network. PostgreSQL and Redis are never published to a host port. Only Ghostfolio is published, and only to the loopback interface, with nginx in front on port 80.

Step 5 - Review the secure defaults and read your credentials

In self-hosted Ghostfolio, the first account created becomes the administrator. On a public server, whoever registers first would own your instance. The SecureAnyCloud image closes this gap in two ways.

First, on first boot and before the port is reachable, the image creates a unique owner administrator and stores its Security Token for you, so the administrator role is already claimed. Second, public sign-up is blocked at the reverse proxy, so nobody can self-register. The session signing key is unique per VM, so sessions cannot be forged.

As a result, public sign-up is refused, a blank or wrong token is rejected, and only the per-VM admin Security Token is accepted.

Read your unique credentials. They are written to a root-only file:

sudo cat /root/ghostfolio-credentials.txt

The file holds the application URL and the per-VM admin Security Token. Keep it safe.

Step 6 - Sign in to Ghostfolio

Open http://<vm-ip>/ in your browser. The Ghostfolio landing page appears. Self-hosted Ghostfolio signs in with a Security Token rather than an email address and password.

Select Sign in and paste the GHOSTFOLIO_ADMIN_SECURITY_TOKEN value from the credentials file. Optionally tick Stay signed in, then confirm. The portfolio overview opens and shows your total value and performance over time.

Step 7 - Explore your portfolio

The overview is your home base. It shows total portfolio value, performance over your chosen time range, and quick links to holdings, summary, the watchlist and markets. Open Holdings to see every position with its value, allocation, change and performance.

The Portfolio section breaks your wealth down further. Allocations shows how your net worth is split by platform, currency and asset class, with a per-holding breakdown underneath.

Step 8 - Add your activities

Ghostfolio builds your portfolio from activities: buys, sells, dividends, fees and cash transactions. While signed in, add them from Portfolio, Activities, or import a CSV.

As you add positions, Ghostfolio gathers market data in the background. Your holdings, performance and allocation update automatically.

Step 9 - Check the stack health from the command line

Query the unauthenticated liveness endpoint. It reports whether the application, database and cache are ready, which makes it useful for monitoring:

curl -s http://127.0.0.1/api/v1/health

A healthy stack returns:

{"status":"OK"}

Step 10 - Adding more people (optional)

This appliance ships with public sign-up disabled, so only you can use the application. To add more people, re-enable sign-up. Remove the location = /api/v1/user block in /etc/nginx/sites-available/ghostfolio, then reload nginx:

sudo nginx -t && sudo systemctl reload nginx

Each new account is a normal, non-administrator user with its own isolated portfolio. Only the first account, pre-seeded for you on first boot, is the administrator. When everyone has an account, restore the block and reload nginx to disable sign-up again.

Step 11 - Add your own domain with TLS

Ghostfolio serves plain HTTP on port 80. For production, point a DNS record at the VM and put Ghostfolio behind TLS, so links and sessions use an https origin. A common approach is to add a certificate to nginx with Certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d finance.example.com

Then restart the stack with sudo systemctl restart ghostfolio and restrict the NSG to the sources that need access. See the Ghostfolio documentation for the full production checklist.

Support

Every SecureAnyCloud image includes 24/7 support. For questions about deploying or operating Ghostfolio on Azure, contact the SecureAnyCloud team through the Azure Marketplace listing or at secureanycloud.com.

Deploy on Azure

Launch Ghostfolio on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com