Grimoire

• Open the Azure Marketplace and search for Grimoire on Ubuntu 24.04 LTS by SecureAnyCloud.
• Select Create, then choose your subscription, resource group and region.
• Pick a VM size of Standard_B2s or larger.
• Under Administrator account, select SSH public key and supply your public key.
• Under Inbound port rules, allow SSH (22) and HTTP (80).
• Select Review + create, then Create.

az group create --name grimoire-rg --location eastus

az vm image terms accept --urn sac1647283583153:grimoire:default:latest
az vm create \
  --resource-group grimoire-rg \
  --name grimoire-vm \
  --image sac1647283583153:grimoire:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group grimoire-rg --name grimoire-vm --port 80 --priority 1010

ssh azureuser@<vm-ip>

Three systemd units make up the deployment: grimoire (the Bun daemon), grimoire-firstboot (the one-shot unit that generates this VM's credential) and nginx (the public front door). Check that the daemon and nginx are running.

systemctl is-active grimoire nginx

Both report active. The first-boot unit runs once on the very first boot to create this VM's credential, then completes:

systemctl is-active grimoire-firstboot || echo "grimoire-firstboot: one-shot completed"

The Bun daemon is lightweight and fits comfortably on a Standard_B2s. Check its memory use:

ps -o rss= -C bun | awk '{s+=$1} END{printf "grimoire daemon RSS: %d MiB\n", s/1024}'

Grimoire is deliberately not reachable directly. Only nginx listens publicly. List the listening sockets:

ss -tln | grep -E ':(80|3210) '

The output shows 127.0.0.1:3210 for the Grimoire daemon and 0.0.0.0:80 for nginx. The daemon publishes no public port and is reachable only from nginx over the loopback interface.

Every VM generates its own web credential on first boot and writes it to a file that only root can read. Print the file:

sudo cat /root/grimoire-credentials.txt

The file records the web credential (WEB_USER and WEB_PASSWORD) and this VM's URL (GRIMOIRE_URL). Confirm that the file is locked down:

ls -l /root/grimoire-credentials.txt

stat -c '%a %U:%G %n' /root/grimoire-credentials.txt

This is the most important section of the guide, because Grimoire's design is unusual for a hosted app.

Grimoire is local-first and has no login of its own. Upstream, it is meant to run on your own machine, bound to the loopback interface, with its browser UI and API trusted for local use only. Its documentation is explicit that exposing the daemon directly on a public network is not a supported mode. On a public IP, anyone who could reach the port could read and change your whole library.

This image therefore puts a gate in front of the daemon, which is the reverse-proxy pattern upstream recommends for remote access:

• The Grimoire daemon binds to 127.0.0.1:3210 and is never directly reachable.
• nginx on port 80 is the only public listener. It requires HTTP Basic authentication with this VM's unique WEB_USER and WEB_PASSWORD.
• The optional AI enrichment is disabled, so no bookmark content is sent to a third party.

You can verify the gate yourself. Without a credential, and with a wrong one, the front door returns 401:

curl -s -o /dev/null -w 'no credential: HTTP %{http_code}\n' http://127.0.0.1/

curl -s -o /dev/null -w 'wrong credential: HTTP %{http_code}\n' -u '<WEB_USER>:definitely-wrong' http://127.0.0.1/

With the real credential it returns 200:

curl -s -o /dev/null -w 'per VM credential: HTTP %{http_code}\n' -u '<WEB_USER>:<WEB_PASSWORD>' http://127.0.0.1/

The image also ships a self-test that proves the whole platform works, not merely that a page loads. It confirms that an unauthenticated request is refused. It then signs in with the per-VM credential, creates a bookmark whose URL is unique to this run, and reads that exact bookmark back:

sudo /usr/local/sbin/grimoire-roundtrip.sh

Browse to your VM's URL, which is recorded in the credentials file:

<GRIMOIRE_URL>

When your browser asks for the web credential, enter WEB_USER and WEB_PASSWORD from Step 6. Grimoire's library then loads. Every bookmark you save is fetched, its readable content is extracted and indexed, and it is listed with its source domain.

Select Add and paste any URL, or use the search bar as a quick-add box. Grimoire saves the link immediately and queues a background job. The job fetches the page, extracts a readable copy of the content and any media, and indexes it for search.

You can also save from the API, using the same call the browser extension makes:

curl -s -o /dev/null -w 'save bookmark: HTTP %{http_code}\n' \
  -u '<WEB_USER>:<WEB_PASSWORD>' \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://kubernetes.io/docs/concepts/"}' \
  http://127.0.0.1/bookmarks

Type in the search bar to run a keyword and full-text search across titles, descriptions and the extracted page text. Matches are highlighted. Because the whole page content is indexed, you can find a bookmark by a phrase you remember from the article, even if it is not in the title.

Select any bookmark to open its detail view. It shows the extracted readable content and any media pulled from the page, with controls to tag, categorise, archive or add notes.

Grimoire can summarise, auto-tag and semantically search your library using an LLM and an embedding model. This is disabled by default in this image, so nothing leaves your VM.

To enable it, open Settings → AI and choose a provider. Use either a hosted provider such as OpenAI with your own API key, or a local model server such as Ollama running on a machine you control. Then save. Until you do, keyword and full-text search work as described above.

Your whole library lives in a single SQLite database under /var/lib/grimoire. To take a point-in-time backup, stop the daemon briefly and copy the data directory:

sudo systemctl stop grimoire && sudo tar czf /tmp/grimoire-backup.tgz -C /var/lib grimoire && sudo systemctl start grimoire && echo backup-done

Grimoire also has a built-in backup feature under Settings → Backup. It supports scheduled snapshots and optional upload to S3-compatible storage.