GoAlert

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for GoAlert by SecureAnyCloud and select Create.

On the Basics tab, pick your subscription, resource group, region and size, and set the administrator account (SSH public key or password). Under Inbound port rules, allow SSH (22), HTTPS (443) and HTTP (80).

Select Review + create, then Create.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:goalert-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name goalert \
  --image sac1647283583153:goalert-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name goalert --port 443 --priority 1010
az vm open-port --resource-group <your-rg> --name goalert --port 80 --priority 1020

First boot takes about a minute. It creates the database, the admin account, the encryption key and the certificate.

ssh azureuser@<vm-public-ip>

Confirm that PostgreSQL, GoAlert and nginx are active, and that the first-boot and per-boot host units have completed:

systemctl is-active postgresql@16-main goalert nginx goalert-firstboot goalert-configure
sudo test -f /var/lib/sac/data/goalert-firstboot.done && echo FIRSTBOOT_DONE

active active active active active FIRSTBOOT_DONE

Only SSH and nginx listen on public addresses. GoAlert listens on loopback, and PostgreSQL has no TCP listener at all. Confirm the listeners:

sudo ss -lntp | awk 'NR>1 {print $4, $6}' | grep -v '127.0.0.5' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort

0.0.0.0:22 users:(("sshd"),("systemd")) 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) 127.0.0.1:8081 users:(("goalert")) [::]:22 users:(("sshd"),("systemd")) [::]:443 users:(("nginx"),("nginx"),("nginx")) [::]:80 users:(("nginx"),("nginx"),("nginx"))

sudo cat /root/goalert-credentials.txt

The file is readable by root only. It holds the sign-in URL, the user name and this VM's password:

# GoAlert - generated on first boot by goalert-firstboot.service
# These credentials are unique to this VM. Store them somewhere safe. GOALERT_URL=https://<vm-public-ip>/ GOALERT_ADMIN_USER=admin GOALERT_ADMIN_PASSWORD=<GOALERT_ADMIN_PASSWORD>
#
# Open GOALERT_URL in a browser (self-signed certificate minted on this VM's first boot; port 80 redirects # to https) and sign in with the username and password above. GoAlert only accepts sign-ins made from that URL. # Serve it under your own DNS name:
sudo goalert-set-hostname <your-dns-name>
# Alert delivery (SMS, voice, email, Slack, webhooks) is configured under Admin -> Config after signing in.
# Full deployment guide: https://secureanycloud.com/stacks/goalert/

The URL uses the VM's public IP, which first boot reads from the Azure Instance Metadata Service. GoAlert accepts a sign-in only from the URL it is configured with (it checks the browser's Referer), so always open this URL rather than another name or address. The certificate also names the VM's private IP.

If you deallocate and start the VM and its public IP changes, the next boot re-reads the IP and updates the URL, the certificate and /root/goalert-credentials.txt for you. To use your own DNS name instead, see Step 9.

Open the GOALERT_URL in your browser. The certificate is self-signed, so your browser asks you to confirm it the first time (or install your own certificate, Step 9). Sign in as admin with the password from Step 4:

The Alerts page lists open alerts for the services you are on call for or have marked as favourites. Open an alert to acknowledge, escalate or close it, and to see which escalation step is paging whom:

A service ties an escalation policy to the integration keys your monitoring uses to raise alerts:

Schedules combine rotations, rules and temporary overrides into a calendar of who is on call:

A typical first setup follows this order:

• Users: invite your team, or switch on GitHub or OIDC sign-in under Admin.
• Rotations and Schedules: define who is on call and when.
• Escalation Policies: define which schedule or person is paged first, and after how many minutes the next step follows.
• Services: add one with an integration key for each monitoring system.

Each user adds their own contact methods and notification rules under their profile. The Wizard in the menu creates a service, an escalation policy and a schedule in one go.

Port 80 redirects to HTTPS, the health check answers only on the VM itself, GoAlert's internal health endpoints are not exposed, and other host names are dropped. Verify this behaviour:

H=$(sudo grep '^GOALERT_URL=' /root/goalert-credentials.txt | sed -E 's#^GOALERT_URL=https://([^/]+)/.*#\1#')
P=$(hostname -I | awk '{print $1}')
curl -s -o /dev/null -w 'http:// -> %{http_code} %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/alerts" echo "/healthz (local) -> $(curl -sk --resolve "$H:443:127.0.0.1" "https://$H/healthz")"
curl -sk -o /dev/null -w '/healthz (other) -> HTTP %{http_code}\n' --interface "$P" --resolve "$H:443:$P" "https://$H/healthz"
curl -sk -o /dev/null -w '/health -> HTTP %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/health"
curl -sk -o /dev/null -w 'other Host -> %{http_code} (connection closed)\n' -H 'Host: example.com' https://127.0.0.1/ || true

http:// -> 301 https://<vm-public-ip>/alerts /healthz (local) -> ok /healthz (other) -> HTTP 403 /health -> HTTP 404 other Host -> 000 (connection closed)

The script below signs in as admin and creates a Web shop service whose escalation policy pages you. It gives the service a generic API integration key and raises an alert through that key, exactly as a monitoring system would.

The password goes to curl on standard input, and the integration key travels in an Authorization: Bearer header. Neither appears in the process list, your shell history or the web server's access log:

sudo bash <<'EOF_GOALERT' set -euo pipefail F=/root/goalert-credentials.txt
P=$(grep '^GOALERT_ADMIN_PASSWORD=' "$F" | cut -d= -f2-)
H=$(grep '^GOALERT_URL=' "$F" | sed -E 's#^GOALERT_URL=https://([^/]+)/.*#\1#') B="https://$H"; R=(--resolve "$H:443:127.0.0.1");
J=$(mktemp); trap 'rm -f "$J"' EXIT
# Sign in as admin: the form body goes to curl on stdin, so the password never appears in the process list printf 'username=admin&password=%s' "$P" | curl -sk "${R[@]}" -o /dev/null -c "$J" -H "Referer: $B/" --data-binary @- "$B/api/v2/identity/providers/basic" gql() { curl -sk "${R[@]}" -b "$J" -H "Referer: $B/" -H "Origin: $B" -H 'Content-Type: application/json' --data-binary @- "$B/api/graphql"; }
ME=$(printf '%s' '{"query":"{user{id name role}}"}' | gql | jq -r '.data.user.id') [ -n "$ME" ] && [ "$ME" != null ] || { echo "sign-in failed"; exit 1; }
# A service whose escalation policy pages you, with a generic API integration key (reused if it already exists)
S=$(printf '%s' '{"query":"{services(input:{search:\"Web shop\"}){nodes{id name integrationKeys{id type}}}}"}' | gql)
SVC=$(jq -c '[.data.services.nodes[] | select(.name == "Web shop")][0] // empty' <<<"$S") if [ -z "$SVC" ]; then
Q=$(jq -nc --arg me "$ME" '{query:"mutation($in:CreateServiceInput!){createService(input:$in){id name integrationKeys{id type}}}",variables:{in:{name:"Web shop",newEscalationPolicy:{name:"Web shop on-call",steps:[{delayMinutes:5,targets:[{id:$me,type:"user"}]}]},newIntegrationKeys:[{type:"generic",name:"monitoring"}]}}}')
SVC=$(printf '%s' "$Q" | gql | jq -c '.data.createService // empty') fi
SID=$(jq -r '.id // empty' <<<"$SVC")
KEY=$(jq -r '[.integrationKeys[] | select(.type == "generic")][0].id // empty' <<<"$SVC") [ -n "$SID" ] && [ -n "$KEY" ] || { echo "service creation failed: $SVC"; exit 1; } echo "service: $(jq -r '.name' <<<"$SVC") (integration key type generic)"
# Raise an alert the way a monitoring system would: the key travels in an Authorization header
C=$(printf 'Authorization: Bearer %s\n' "$KEY" | curl -sk "${R[@]}" -o /dev/null -w '%{http_code}' -H @- -X POST "$B/api/v2/generic/incoming" \
  --data-urlencode 'summary=Checkout latency above 2s' --data-urlencode 'details=p95 2.4 s for 5 minutes on web-1')
echo "generic API: HTTP $C" [ "$C" = 204 ] || [ "$C" = 200 ] || { echo "alert was not accepted"; exit 1; } for i in $(seq 1 10); do
A=$(jq -nc --arg s "$SID" '{query:"query($s:ID!){alerts(input:{filterByServiceID:[$s]}){nodes{alertID status summary}}}",variables:{s:$s}}' | gql) [ "$(jq '.data.alerts.nodes | length' <<<"$A")" -ge 1 ] && break; sleep 1 done
L=$(jq -r '.data.alerts.nodes[] | "alert #\(.alertID) \(.status): \(.summary)"' <<<"$A") case "$L" in *"StatusUnacknowledged: Checkout latency above 2s"*) echo "$L" ;; *) echo "the alert is not open: $A"; exit 1 ;; esac EOF_GOALERT

service: Web shop (integration key type generic) generic API: HTTP 204 alert #1 StatusUnacknowledged: Checkout latency above 2s

The alert now shows on the Alerts page and pages whoever the escalation policy targets.

From a monitoring system, send the same request to https://<your-goalert-host>/api/v2/generic/incoming with the integration key in an Authorization: Bearer <key> header. Copy a service's key from Services > (service) > Integration Keys. GoAlert also accepts the key as a token query parameter, but a header keeps it out of web server logs.

Add action=close with the same dedup value to close an alert automatically when the problem clears.

Notification providers are switched off until you configure them under Admin > Config with your own accounts:

• Twilio for SMS and voice calls
• SMTP for email
• Slack for Slack messages
• Webhook for outgoing webhooks

Their tokens are stored in the database, encrypted with this VM's data encryption key.

Twilio and Slack call back into GoAlert (delivery status, SMS replies, button presses). Those features need the VM to be reachable from them at its configured URL, with a certificate they trust. Put GoAlert under your own DNS name with a trusted certificate (Step 9) and allow their traffic on port 443. Outgoing webhooks and the generic API work without that.

The environment file holds the database URL (a local socket, no password) and this VM's data encryption key. It is readable by root only, and systemd reads it before starting GoAlert as its own user. This command prints the variable names only:

sudo stat -c '%a %U:%G %n' /etc/goalert/goalert.env /root/goalert-credentials.txt /etc/ssl/goalert/goalert.key
sudo grep -oE '^[A-Z_]+=' /etc/goalert/goalert.env
sudo grep -E '^GOALERT_(DB_URL|LISTEN)=' /etc/goalert/goalert.env

600 root:root /etc/goalert/goalert.env 600 root:root /root/goalert-credentials.txt 600 root:root /etc/ssl/goalert/goalert.key GOALERT_DB_URL= GOALERT_DATA_ENCRYPTION_KEY= GOALERT_LISTEN= GOALERT_DB_URL=postgres://goalert@/goalert?host=/var/run/postgresql GOALERT_LISTEN=127.0.0.1:8081

PostgreSQL has no network listener and no role has a password. Local connections are allowed only for the matching operating system user:

sudo -u postgres psql -XtAc "SHOW listen_addresses" | sed 's/^$/(empty: no TCP listener)/'
sudo -u postgres psql -XtAc "SELECT count(*) || ' roles with a password' FROM pg_authid WHERE rolpassword IS NOT NULL"
sudo -u postgres psql -XtAc "SELECT type, database, user_name, auth_method FROM pg_hba_file_rules WHERE type = 'local'"

(empty: no TCP listener) 0 roles with a password local|{all}|{all}|peer local|{replication}|{all}|peer

GoAlert runs unprivileged in a sandbox with no capabilities. GoAlert, nginx and PostgreSQL cannot reach the Azure Instance Metadata Service (169.254.169.254) or the Azure wire server (168.63.129.16). This matters because GoAlert sends webhooks to addresses its users enter:

systemctl show goalert -p User -p ProtectSystem -p NoNewPrivileges -p CapabilityBoundingSet
systemctl show goalert nginx postgresql@16-main -p Id -p IPAddressDeny

CapabilityBoundingSet= User=goalert ProtectSystem=strict NoNewPrivileges=yes IPAddressDeny=168.63.129.16/32 169.254.169.254/32 Id=goalert.service IPAddressDeny=168.63.129.16/32 169.254.169.254/32 Id=nginx.service IPAddressDeny=168.63.129.16/32 169.254.169.254/32 Id=postgresql@16-main.service

nginx passes GoAlert the configured host name and the real client address from the connection, never values a client sends. It also refuses any state-changing request or WebSocket upgrade whose Origin is another web site (HTTP 403):

grep -E 'proxy_set_header (Host|X-Forwarded-For|X-Real-IP)' /etc/nginx/sites-available/sac-goalert

proxy_set_header Host $goalert_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr;

The certificate was generated on this VM and names its own addresses. fwupd's firmware refresh is masked:

H=$(sudo grep '^GOALERT_URL=' /root/goalert-credentials.txt | sed -E 's#^GOALERT_URL=https://([^/]+)/.*#\1#')
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName for u in fwupd-refresh.timer fwupd-refresh.service; do
echo "$u: $(systemctl is-enabled "$u" 2>/dev/null)"; done

subject=CN = <vm-public-ip>, O = sac X509v3 Subject Alternative Name: IP Address:<vm-public-ip>, IP Address:<vm-private-ip>, IP Address:127.0.0.1, DNS:localhost fwupd-refresh.timer: masked fwupd-refresh.service: masked

The session cookie GoAlert sets after sign-in is Secure, HttpOnly and SameSite=Strict. The sign-in form is refused when it is posted from any page other than the configured URL.

Azure configures SSH from the authentication type you chose when you created the VM (key or password). The image adds no SSH override.

Point a DNS record at the VM's public IP, then set the name GoAlert is served as. This command mints a new self-signed certificate for the name and points GoAlert's public URL and every link it sends at that name. It also updates nginx and /root/goalert-credentials.txt, and keeps the name across reboots and deallocation:

sudo goalert-set-hostname <your-domain>

To use a certificate from your own certificate authority (needed for Twilio and Slack callbacks), copy it over the generated pair and reload nginx. Running goalert-set-hostname again replaces it with a self-signed certificate:

sudo install -m 0644 <your-domain>.crt /etc/ssl/goalert/goalert.crt
sudo install -m 0600 <your-domain>.key /etc/ssl/goalert/goalert.key
sudo nginx -t && sudo systemctl reload nginx

Everything GoAlert knows lives in the goalert PostgreSQL database. Its stored secrets are encrypted with the key in /etc/goalert/goalert.env, so back up that file together with the database and keep both somewhere safe:

sudo -u postgres pg_dump -Fc goalert | sudo tee <backup-dir>/goalert-$(date +%F).dump >/dev/null
sudo install -m 0600 /etc/goalert/goalert.env <backup-dir>/goalert-$(date +%F).env

To change the admin password, sign in, open Users > admin, choose Edit Access and enter the current and the new password. Afterwards, update or delete GOALERT_ADMIN_PASSWORD in /root/goalert-credentials.txt so that it does not hold an old password.

GoAlert writes its logs to the journal:

sudo journalctl -u goalert --no-pager -n 3 -o cat

time="2026-10-21T17:50:06Z" level=info msg="producer: Producer job counts" module=river num_completed_jobs=8 num_jobs_running=0 queue=status-manager

GoAlert reads its startup flags from GOALERT_ environment variables. A flag such as --listen becomes GOALERT_LISTEN, and goalert --help lists the flags. Add them to /etc/goalert/goalert.env and run sudo systemctl restart goalert. Everything else is configured in the web interface under Admin.

These are the components and where they live on the VM:

• GoAlert binary: /usr/local/bin/goalert
• Environment (database URL, encryption key): /etc/goalert/goalert.env (root only)
• Public URL: /etc/goalert/public-url.env (written by goalert-set-hostname)
• Service unit: /etc/systemd/system/goalert.service
• Database: PostgreSQL 16 cluster 16/main, /var/lib/postgresql/16/main, socket /var/run/postgresql
• nginx site: /etc/nginx/sites-available/sac-goalert
• Certificate and key: /etc/ssl/goalert/
• First-boot and per-boot host scripts: /usr/local/sbin/goalert-firstboot.sh, /usr/local/sbin/goalert-configure.sh
• Host name helper: /usr/local/sbin/goalert-set-hostname
• Credentials: /root/goalert-credentials.txt (mode 0600)
• Build record, licence and govulncheck reports: /usr/share/doc/goalert/

/usr/local/bin/goalert version sed -n '1,4p;/^binary sha256/p;/^govulncheck/,+2p' /usr/share/doc/goalert/BUILD-INFO.txt

Version: v0.35.0 GitCommit: db9829187a1c1f96a7c57112b74dba54442d7c6b (clean) BuildDate: 2026-09-15T21:24:20Z GoVersion: go1.27.3 (gc) Platform: linux/amd64 Migration: cm-private (#281) GoAlert v0.35.0 - sac source build (d-320) Licence: Apache-2.0 (LICENSE.md in this directory). The resulting go.mod and go.sum are in this directory. source https://github.com/target/goalert/archive/refs/tags/v0.35.0.tar.gz binary sha256 389f2c5db4de3a3c457ee2b9570601f2758ccfa18e92a8686a83caeb5ea68206 (reproducible) govulncheck v1.9.0: -mode=binary "No vulnerabilities found"; source mode 0 symbol and 0 package findings; module-level only GO-2026-5932 (golang.org/x/crypto/openpgp, no fixed version, not linked: go list -deps ./cmd/goalert has no x/crypto/openpgp package) (DB updated: 2026-10-21 00:27:29 +0000 UTC)

About this build. Upstream GoAlert release binaries are compiled with older Go releases. Their standard library has known vulnerabilities reachable in GoAlert (TLS, X.509, HTTP and HTML template handling), all fixed in later Go releases. This image compiles the 0.35.0 source (tag commit db982918) with Go 1.27.3 and updated golang.org/x/net and golang.org/x/crypto modules. govulncheck finds no vulnerability in the shipped binary.

The only entry govulncheck lists is GO-2026-5932 (golang.org/x/crypto/openpgp, deprecated, no fixed version). It belongs to a required module that GoAlert never imports, so it is not in the binary at all.

The web interface is built from upstream's locked dependencies. The browser-side npm packages carry advisories, which are listed with their severities in /usr/share/doc/goalert/ui-npm-advisories.txt. They are denial-of-service and prototype-pollution issues reported for markdown-it, linkify-it, lodash, diff and mdast-util-to-hast, none critical. That code runs only in a signed-in user's browser. No JavaScript runtime runs on the server.

GoAlert 0.35.0 adds multi-acknowledge escalation steps, private contact methods, an alerts view per escalation policy and new admin hardening options. Every new behaviour is off until you enable it. One option is worth considering: Admin > Config > Webhook > Block Private Addresses stops outgoing webhooks to private, loopback and link-local addresses. This image already blocks the Azure metadata service for GoAlert.

Recommendations:

• Allow ports 22, 80 and 443 in the network security group from your own networks and monitoring systems only.
• Keep the admin password secret and give every person their own user. If you have an identity provider, switch on GitHub or OIDC sign-in under Admin > Config > Auth.
• Use your own DNS name and a certificate that your users and providers trust (Step 9).
• Keep the operating system patched. Unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else.
• Back up the database and the environment file together (Step 10), or snapshot the OS disk.