SecureAnyCloud
Deployment guide

GreptimeDB

Overview

GreptimeDB is an open-source, cloud-native time-series database for metrics, logs and events. It speaks SQL and PromQL and accepts ingestion over the InfluxDB, OpenTSDB and Prometheus protocols, so it fits into existing observability and IoT pipelines without changes to your collectors.

The SecureAnyCloud image installs GreptimeDB 1.1.1 in standalone mode and runs it as a dedicated greptimedb system user. Every listener binds to loopback behind an nginx reverse proxy on TCP 80 with HTTP Basic auth. All data persists on a dedicated Azure data disk, and the first boot of every VM generates a unique web password. The web Dashboard gives you an immediate SQL and PromQL query console with table and chart views.

What you get:

  • GreptimeDB 1.1.1 (standalone) as the single greptime binary at /usr/local/bin/greptime
  • The web Dashboard, the SQL-over-HTTP API and the PromQL API, fronted by nginx on :80
  • nginx HTTP Basic auth, with a per-VM password in a root-only file, because GreptimeDB's HTTP API has no built-in authentication
  • A dedicated Azure data disk at /var/lib/greptimedb that holds all time-series data, separate from the OS disk and re-provisioned with every VM
  • SQL, PromQL and InfluxDB, OpenTSDB and Prometheus ingestion endpoints behind the same auth wall
  • greptimedb.service and nginx.service as systemd units, enabled and active
  • 24/7 SecureAnyCloud support

Prerequisites

  • An active Azure subscription, an SSH key pair, and a virtual network and subnet in the target region.
  • Standard_B2ms (2 vCPU, 8 GiB RAM) is a good starting point. Scale up for higher ingestion rates and cardinality.
  • A network security group that allows inbound 22/tcp from your management network and 80/tcp for the Dashboard and API. For public exposure, front the service with TLS (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for GreptimeDB by SecureAnyCloud, and select Create. On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

To deploy from the command line instead, run the following commands:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:greptimedb-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name greptimedb \
  --image sac1647283583153:greptimedb-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name greptimedb --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH with your key pair:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that both services are active:

systemctl is-active greptimedb.service nginx.service

Both services report active. GreptimeDB starts in seconds and is immediately ready to accept SQL, PromQL and line-protocol traffic.

Step 5 - Retrieve your web password

The first boot of your VM generates a unique admin password and writes it to a root-only file:

sudo cat /root/greptimedb-credentials.txt

This file contains GREPTIMEDB_ADMIN_USER (admin) and GREPTIMEDB_ADMIN_PASSWORD, plus the URLs for the Dashboard and API. Store the password in a safe place.

Step 6 - Check the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/health

The endpoint returns ok.

Step 7 - Open the web Dashboard

Browse to http://<vm-public-ip>/dashboard/ and sign in as admin with the password from Step 5. The Dashboard's Query view is a SQL and PromQL console. Type a statement, select Run Query, and inspect the result as a table or a chart. The image ships an empty database ready for your data. The following screenshots show a sample sensor_readings table that you can recreate in Step 9.

Switch the result panel to Chart to render the same query as a time-series line chart:

The left Tables browser expands each table to its columns. DESC TABLE <name> returns the full schema, including each column's semantic type (TAG, FIELD or TIMESTAMP):

The Status page reports the running build, version and host:

Step 8 - Query from the command line

The SQL-over-HTTP API is available behind the same Basic auth. Confirm that GreptimeDB is serving and report its version:

curl -s -u admin:<GREPTIMEDB_ADMIN_PASSWORD> -X POST http://localhost/v1/sql --data-urlencode 'sql=SELECT version()'; echo

The response is JSON, and output[0].records.rows carries the running version (1.1.1). Every successful query returns an "output" array. Errors return a "code" and an "error" instead.

Step 9 - Create a table and query it

GreptimeDB tables need a TIMESTAMP TIME INDEX column. Create a small table, insert a row, and read it back over the SQL API. The example uses host_region because region is a reserved keyword:

PW=<GREPTIMEDB_ADMIN_PASSWORD> curl -s -u admin:$PW -X POST http://localhost/v1/sql --data-urlencode "sql=CREATE TABLE IF NOT EXISTS sensor_readings (host STRING, host_region STRING, temperature DOUBLE, humidity DOUBLE, ts TIMESTAMP TIME INDEX, PRIMARY KEY(host, host_region))"; echo curl -s -u admin:$PW -X POST http://localhost/v1/sql --data-urlencode "sql=INSERT INTO sensor_readings (host, host_region, temperature, humidity, ts) VALUES ('host-a','eastus',23.5,47.0,now())"; echo curl -s -u admin:$PW -X POST http://localhost/v1/sql --data-urlencode "sql=SELECT host, host_region, temperature, humidity, ts FROM sensor_readings ORDER BY ts DESC LIMIT 5"; echo

Each call returns a JSON "output" array. The same table appears in the Dashboard's Tables browser and Query console.

Step 10 - Ingest with the InfluxDB line protocol

GreptimeDB accepts the InfluxDB v2 write API, so existing Telegraf and InfluxDB clients can ship data unchanged. Write a point and query it back. The table is created automatically on first write:

PW=<GREPTIMEDB_ADMIN_PASSWORD> curl -s -u admin:$PW -X POST 'http://localhost/v1/influxdb/api/v2/write?db=public' --data-binary 'weather,location=office temperature=21.3' curl -s -u admin:$PW -X POST http://localhost/v1/sql --data-urlencode 'sql=SELECT * FROM weather'; echo

The write returns HTTP 204, and the point is immediately queryable. GreptimeDB also exposes PromQL at /v1/promql, the Prometheus remote-write endpoint, the MySQL wire protocol on loopback 4002 and the Postgres wire protocol on loopback 4003. You can reach all of them from the VM itself or through an SSH tunnel.

Step 11 - Confirm data lives on the dedicated disk

All time-series data is stored on the dedicated Azure data disk, so it survives OS changes and can be resized independently:

findmnt /var/lib/greptimedb

A separate Azure data disk, captured into the image and re-provisioned on every VM, backs the mount.

Enabling HTTPS

The nginx reverse proxy terminates plain HTTP on port 80. For public exposure, put a certificate in front of it. The simplest path is to add a DNS name for the VM and use the companion SecureAnyCloud nginx-ssl-certbot image as a TLS reverse proxy. Alternatively, install certbot and extend the existing nginx site with a listen 443 ssl; server block and your certificate paths. Keep GreptimeDB itself bound to loopback so that the only public surface is the authenticated, TLS-terminated proxy.

Maintenance

  • Configuration: the standalone listeners and --data-home are set in /etc/default/greptimedb (the GT_ARGS line). Edit the file and run sudo systemctl restart greptimedb to apply changes.
  • Backups: snapshot the /var/lib/greptimedb data disk, or use GreptimeDB's export tooling to copy data to Azure Blob Storage.
  • Upgrades: replace /usr/local/bin/greptime with a newer release and restart the service.
  • Security patches: unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

GreptimeDB is a trademark of Greptime Inc. This image is produced by SecureAnyCloud and is not affiliated with or endorsed by the GreptimeDB project. GreptimeDB is distributed under the Apache License 2.0.

Deploy on Azure

Launch GreptimeDB on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure