Deployment guide

GoCD

Overview

GoCD is an open source continuous integration and continuous delivery (CI/CD) server from Thoughtworks. It models complex build and release workflows as pipelines. Its value stream map visualizes every change from commit through to deployment.

This SecureAnyCloud image runs GoCD 26.1 on Ubuntu 24.04 LTS with a co-located build agent, so it is a complete, self-contained CI/CD server the moment it boots.

GoCD ships with no authentication out of the box, so anyone who can reach it has full admin access. This image closes that gap. The file-based authentication realm is baked into the GoCD configuration, an admin user is marked as a GoCD administrator, and the per-VM admin password is generated and rotated on first boot. The server binds to loopback and is fronted by nginx on port 80.

What you get:

GoCD server 26.1 from the official download.gocd.org APT repository (Apache License 2.0, Thoughtworks)
A co-located go-agent that auto-registers and is auto-enabled, so pipelines run out of the box
GoCD bound to 127.0.0.1:8153 / :8154 and fronted by nginx on :80 with X-Forwarded-* headers
Secure-by-default authentication: the file-based auth realm (cd.go.authentication.passwordfile) plus an admin GoCD administrator baked into /etc/go/cruise-config.xml
gocd-firstboot.service generating a strong per-VM admin password (bcrypt entry in /etc/go/password.properties) and writing /var/lib/sac/secrets/sac-credentials.txt (mode 0600 root:root) on first boot
OpenJDK runtime (installed by the GoCD package), apache2-utils for the bcrypt password entry, and nginx 1.24
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key, a VNet with a subnet, and an NSG that allows TCP 22 (SSH) and TCP 80 (web UI).

Standard_B2s (4 GB RAM) suits small teams running a handful of pipelines. GoCD is a JVM application. For busy servers with many concurrent jobs, distributed agents or large materials, scale up to D4s_v5 or D8s_v5.

Deploy from the Azure Marketplace

Search the Azure Marketplace for "SecureAnyCloud GoCD Ubuntu 24.04" and click Create. Pick the Standard_B2s size and choose your VNet and subnet.

Make sure the NSG attached to the VM allows inbound TCP 22 and TCP 80 from your trusted CIDR.

SSH in

SSH to the VM as azureuser:

ssh azureuser@<vm-ip>

Check the service status

Confirm that the GoCD server, the built-in agent and nginx are all active. GoCD is a JVM service and can take 60 to 90 seconds to finish warming up after a boot.

sudo systemctl is-active go-server go-agent nginx

Confirm secure-by-default authentication

Unlike a stock GoCD install, this image requires a login. Run the check below. An unauthenticated API call is rejected, while the per-VM admin credentials authenticate.

PASS=$(sudo grep '^GOCD_ADMIN_PASSWORD=' /var/lib/sac/secrets/sac-credentials.txt | cut -d= -f2-)
echo "unauthenticated: $(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: application/vnd.go.cd.v7+json' http://127.0.0.1/go/api/agents)"
echo "per-VM admin: $(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: application/vnd.go.cd.v7+json' -u "admin:${PASS}" http://127.0.0.1/go/api/agents)"

The unauthenticated request returns 401. The authenticated request returns 200.

Read the per-VM admin credentials

The first-boot service rotates the GoCD admin password and writes the SecureAnyCloud credentials file. Read the file:

sudo cat /var/lib/sac/secrets/sac-credentials.txt

Note GOCD_URL, GOCD_ADMIN_USER (always admin) and GOCD_ADMIN_PASSWORD. Keep this terminal open while you sign in.

Sign in to GoCD

Browse to http://<vm-ip>/go/. nginx forwards the request to GoCD on 127.0.0.1:8153. The GoCD sign-in page appears, which proves the server is not open.

Enter admin and the password from /var/lib/sac/secrets/sac-credentials.txt.

Create your first pipeline

A fresh GoCD server has no pipelines, so it opens the Add a New Pipeline wizard. Point the wizard at a Git repository (the Material), name the pipeline, and define its stages and jobs. The built-in agent picks up and runs the work.

Confirm the built-in agent

Open Agents from the top navigation. The co-located gocd-builtin-agent is registered and Enabled, so pipelines can run immediately without adding external agents.

You can confirm the same over the REST API:

PASS=$(sudo grep '^GOCD_ADMIN_PASSWORD=' /var/lib/sac/secrets/sac-credentials.txt | cut -d= -f2-)
curl -s -H 'Accept: application/vnd.go.cd.v7+json' -u "admin:${PASS}" http://127.0.0.1/go/api/agents \
  | python3 -c "import sys,json; a=json.load(sys.stdin)['_embedded']['agents']; print('agents:', len(a)); [print(' -', x['hostname'], x['agent_config_state']) for x in a]"

Administer pipelines

Use the Admin menu to manage pipelines, pipeline groups, configuration, plugins and security. Administration is restricted to the admin user provisioned in the GoCD security configuration.

Test the API round trip

Confirm that the REST API is reachable with the same credentials from your CI scripts or external triggers.

PASS=$(sudo grep '^GOCD_ADMIN_PASSWORD=' /var/lib/sac/secrets/sac-credentials.txt | cut -d= -f2-)
curl -sf -H 'Accept: application/vnd.go.cd.v7+json' -u "admin:${PASS}" http://127.0.0.1/go/api/agents | head -c 200

A 200 response with a JSON agents payload confirms that admin authentication through nginx to GoCD is wired correctly. GoCD's versioned API needs an exact Accept header. For the agents resource, it is application/vnd.go.cd.v7+json.

Production hardening checklist

If you expose GoCD to the internet, work through this checklist:

TLS termination. Add a Let's Encrypt certificate with certbot --nginx and redirect port 80 to 443. Set the GoCD Site URL under Admin > Server Configuration to the https:// form, so absolute links are correct.
Rotate and add users. The per-VM admin password lives in /etc/go/password.properties as a bcrypt entry. Add more users with sudo htpasswd -B /etc/go/password.properties <user> and grant roles under Admin > Security.
Authorization. Define pipeline-group and role-based permissions under Admin > Pipelines and Admin > Security > Roles, so contributors see only what they need.
Add agents. Scale out by installing go-agent on additional hosts pointed at https://<this-server>:8154/go, or use elastic agents. The built-in agent is convenient but shares resources with the server.
Back up /etc/go and /var/lib/go-server. These hold the configuration, pipeline history and artifacts. Back them up to Azure Blob storage on a schedule.
Keep it patched. Unattended-upgrades is enabled. Run sudo apt-get update && sudo apt-get upgrade to pull GoCD point releases from the official repo.

Architecture

Key components and paths on the VM:

GoCD server: go-server.service, a JVM server bound to 127.0.0.1:8153 (HTTP) and :8154 (HTTPS)
Built-in agent: go-agent.service, which auto-registers and is auto-enabled via a baked auto-register key
GoCD config: /etc/go/cruise-config.xml, with the security realm and admin administrator baked in (mode 0600 go:go)
Password file: /etc/go/password.properties, holding the bcrypt admin entry that first boot rotates per VM (mode 0640 go:go)
Server data: /var/lib/go-server/, holding the database, pipeline history and artifacts
Agent auto-register: /var/lib/go-agent/config/autoregister.properties, holding the auto-register key that matches the server
nginx vhost: /etc/nginx/sites-available/gocd, a reverse proxy on :80 with X-Forwarded-* headers
Customer credentials: /var/lib/sac/secrets/sac-credentials.txt (mode 0600 root:root), holding GOCD_URL, the admin user and the admin password
First-boot script: /usr/local/sbin/gocd-firstboot.sh, which rotates the admin password and writes the credentials file
First-boot sentinel: /var/lib/sac/data/gocd-firstboot.done, created when first boot completes

Support

SecureAnyCloud provides 24/7 support for this image. Open a ticket at https://secureanycloud.com/support/ with your subscription ID, VM name and a brief description of the issue. Common requests include adding distributed or elastic agents, wiring up SSO, configuring pipeline-group authorization and scaling the server for larger workloads.

Deploy on Azure

Launch GoCD Continuous Delivery Server on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

GoCD is the open source continuous integration and continuous delivery server from Thoughtworks. It models complex build and release workflows as pipelines and renders a value stream map that visualises every change from commit through to deployment. The SecureAnyCloud image runs GoCD 26.1 with a co-located build agent, so it is a complete, self contained CI/CD server the moment it boots.

GoCD ships with no authentication out of the box: anyone who can reach it can administer it. This image closes that gap. The file based authentication realm is baked into the GoCD configuration, an admin user is marked as a GoCD administrator, and the per instance admin password is generated and rotated on first boot. The server binds to loopback and is fronted by nginx on port 80.

What is included:

GoCD server 26.1 from the official download.gocd.org APT repository (Apache License 2.0, Thoughtworks)

A co-located go-agent that auto registers and is auto enabled, so pipelines run out of the box

GoCD bound to 127.0.0.1:8153 / :8154, fronted by nginx on :80 with X-Forwarded-* headers

Secure by default authentication: the file based auth realm (cd.go.authentication.passwordfile) plus an admin GoCD administrator baked into /etc/go/cruise-config.xml

gocd-firstboot.service generating a strong per instance admin password (bcrypt entry in /etc/go/password.properties) and writing /var/lib/sac/secrets/sac-credentials.txt (mode 0600 root:root) on first boot

OpenJDK runtime, apache2-utils for the bcrypt password entry, and nginx

24/7 SecureAnyCloud support

Prerequisites

An AWS account, an EC2 key pair, and a VPC subnet. The instance security group should allow inbound TCP 22 (SSH) and TCP 80 (web UI) from your trusted CIDR. m5.large (8 GB RAM) suits small teams running a handful of pipelines. GoCD is a JVM application; for busy servers with many concurrent jobs, distributed agents, or large materials, scale up to a larger instance type.

Connecting to your instance

SSH in as the default login user for the operating system variant you launched. This listing currently ships one variant:

OS variant SSH login user

Ubuntu 24.04 LTS ubuntu

ssh ubuntu@<public-ip>

Launch from AWS Marketplace

Subscribe to the SecureAnyCloud GoCD listing in AWS Marketplace and launch an instance. Pick the m5.large size, choose your VPC and subnet, and attach a security group that allows inbound TCP 22 and TCP 80 from your trusted CIDR.

SSH In

ssh ubuntu@<public-ip>

Service Status

Confirm the GoCD server, the built in agent, and nginx are all active. GoCD is a JVM service and can take 60 to 90 seconds to finish warming up after a boot.

sudo systemctl is-active go-server go-agent nginx

active active active

Confirm Secure By Default Authentication

Unlike a stock GoCD install, this image requires a login. An unauthenticated API call is rejected, while the per instance admin credentials authenticate.

PASS=$(sudo grep '^GOCD_ADMIN_PASSWORD=' /var/lib/sac/secrets/sac-credentials.txt | cut -d= -f2-)
echo "unauthenticated: $(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: application/vnd.go.cd.v7+json' http://127.0.0.1/go/api/agents)"
echo "per-VM admin: $(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: application/vnd.go.cd.v7+json' -u "admin:${PASS}" http://127.0.0.1/go/api/agents)"

The unauthenticated request returns 401. The authenticated request returns 200.

unauthenticated: 401 per-VM admin: 200

Read Per-VM Admin Credentials

The first boot service rotates the GoCD admin password and writes the SecureAnyCloud credentials file. Read it now.

sudo cat /var/lib/sac/secrets/sac-credentials.txt

Note GOCD_URL, GOCD_ADMIN_USER (always admin) and GOCD_ADMIN_PASSWORD. Keep this terminal open while you sign in.

Sign In to GoCD

Browse to http://<public-ip>/go/ (nginx forwards to GoCD on 127.0.0.1:8153). The GoCD sign in page appears, which is proof the server is not open. Enter admin and the password from /var/lib/sac/secrets/sac-credentials.txt.

Create Your First Pipeline

A fresh GoCD server has no pipelines, so it opens the Add a New Pipeline wizard. Point it at a Git repository (the Material), name the pipeline, and define stages and jobs. The built in agent will pick up and run the work.

Confirm the Built-In Agent

Open Agents from the top navigation. The co-located gocd-builtin-agent is registered and Enabled, so pipelines can run immediately without adding external agents.

You can confirm the same over the REST API:

PASS=$(sudo grep '^GOCD_ADMIN_PASSWORD=' /var/lib/sac/secrets/sac-credentials.txt | cut -d= -f2-)
curl -s -H 'Accept: application/vnd.go.cd.v7+json' -u "admin:${PASS}" http://127.0.0.1/go/api/agents \
  | python3 -c "import sys,json; a=json.load(sys.stdin)['_embedded']['agents']; print('agents:', len(a)); [print(' -', x['hostname'], x['agent_config_state']) for x in a]"

agents: 1 - gocd-builtin-agent Enabled

Administer pipelines

Use the Admin menu to manage pipelines, pipeline groups, configuration, plugins and security. Administration is restricted to the admin user provisioned in the GoCD security configuration.

Test the API round trip

Confirm that the REST API is reachable with the same credentials from your CI scripts or external triggers.

PASS=$(sudo grep '^GOCD_ADMIN_PASSWORD=' /var/lib/sac/secrets/sac-credentials.txt | cut -d= -f2-)
curl -sf -H 'Accept: application/vnd.go.cd.v7+json' -u "admin:${PASS}" http://127.0.0.1/go/api/agents | head -c 200

Production Hardening Checklist

Before exposing GoCD to the internet, work through these:

TLS termination. Add a Let's Encrypt certificate with certbot --nginx and redirect port 80 to 443. Set the GoCD Site URL under Admin, Server Configuration to the https:// form so absolute links are correct.

Rotate and add users. The per instance admin password lives in /etc/go/password.properties as a bcrypt entry; add more users with sudo htpasswd -B /etc/go/password.properties <user> and grant roles under Admin, Security.

Authorization. Define pipeline group and role based permissions under Admin, Pipelines and Admin, Security, Roles so contributors only see what they need.

Add agents. Scale out by installing go-agent on additional hosts pointed at https://<this-server>:8154/go, or use elastic agents. The built in agent is convenient but shares resources with the server.

Back up /etc/go and /var/lib/go-server. These hold the configuration, pipeline history, and artifacts; back them up on a schedule.

Keep it patched. Unattended upgrades is enabled; run sudo apt-get update && sudo apt-get upgrade to pull GoCD point releases from the official repo.

Architecture

Component Path Notes

GoCD server go-server.service JVM server bound to 127.0.0.1:8153 (HTTP) / :8154 (HTTPS)

Built in agent go-agent.service Auto registers and is auto enabled via a baked auto register key

GoCD config /etc/go/cruise-config.xml Security realm plus admin administrator baked in (mode 0600 go:go)

Password file /etc/go/password.properties bcrypt admin entry; rotated per instance by firstboot (mode 0640 go:go)

Server data /var/lib/go-server/ Database, pipeline history, artifacts

Agent auto register /var/lib/go-agent/config/autoregister.properties Auto register key matching the server

nginx vhost /etc/nginx/sites-available/gocd Reverse proxy on :80 with X-Forwarded-* headers

Customer creds /var/lib/sac/secrets/sac-credentials.txt Mode 0600 root:root; GOCD_URL, admin user, admin password

Firstboot script /usr/local/sbin/gocd-firstboot.sh Rotates the admin password, writes the credentials file

Firstboot sentinel /var/lib/sac/data/gocd-firstboot.done Created when firstboot completes

Support

SecureAnyCloud provides 24/7 support for this image. Open a ticket at https://secureanycloud.com/support/ with your instance ID and a brief description of the issue. Common asks: adding distributed or elastic agents, wiring up SSO, configuring pipeline group authorization, and scaling the server for larger workloads.

Deploy on AWS

Launch GoCD Continuous Delivery Server with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS