Hoop

Prerequisites

• An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region
• A virtual machine size of Standard_B2s (2 vCPU / 4 GiB RAM) as a sensible starting point. Size up for heavier use.
• NSG inbound rules that allow 22/tcp from your management network, 8009/tcp for the web console, and 8010/tcp for agent connections

Hoop serves plain HTTP on port 8009. For production, front it with your own domain and TLS and set the API URL accordingly (see Step 11).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, and search the Marketplace for Hoop by SecureAnyCloud. Select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), 8009 and 8010. Then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:hoop-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name hoop \
  --image sac1647283583153:hoop-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name hoop --port 8009 --priority 1010
az vm open-port --resource-group <your-rg> --name hoop --port 8010 --priority 1020

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

The gateway runs as the hoopgateway systemd service (a host-networked hoophq/hoop container) and talks to PostgreSQL on 127.0.0.1:5432.

Confirm that all three services are active and that the gateway is listening on its web (8009) and agent gRPC (8010) ports:

systemctl is-active postgresql docker hoopgateway
sudo ss -tlnp | grep -E ':8009|:8010' | awk '{print $4}' | sort -u

Expected output:

active active active *:8009 *:8010

Step 5 - Retrieve your per-VM credentials

On the first boot of every VM, hoop-firstboot.service generates a unique PostgreSQL password and a unique administrative API key. It creates the gateway database and writes the access URLs and the API key into a root-only file. Read the file with:

sudo cat /root/hoop-credentials.txt

The image contains no default or shared credential. The web console uses local password authentication with no administrator baked in, and the API key is unique to this VM.

The first user you register in the console (next steps) becomes your organization administrator. Store the API key somewhere safe.

Step 6 - Confirm the gateway health and admin API

The gateway exposes an unauthenticated health endpoint and an authenticated admin REST API. Confirm that the health endpoint returns 200. Then use the per-VM API key from the credentials file to call an admin endpoint. The gateway rejects a wrong key with 401:

curl -s -o /dev/null -w 'healthz: %{http_code}\n' http://127.0.0.1:8009/api/healthz
API_KEY=$(sudo grep '^HOOP_API_KEY=' /root/hoop-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'wrong key: %{http_code}\n' -H 'Api-Key: bad|bad' http://127.0.0.1:8009/api/users
curl -s -o /dev/null -w 'per-VM key: %{http_code}\n' -H "Api-Key: ${API_KEY}" http://127.0.0.1:8009/api/users

Expected output:

healthz: 200 wrong key: 401 per-VM key: 200

Step 7 - Sign in and create your administrator

Browse to http://<vm-public-ip>:8009/. The image ships with no administrator, so the first account you create becomes the administrator of your organization. Choose Create one, register with an email and a strong password, then sign in.

Hoop points the browser console at the API URL it detects for this VM. On this image, hoop-configure.service sets the API URL to the VM's public IP on every boot, so signing in over the Azure public IP works out of the box.

If you reach Hoop through a different hostname (a DNS name, a load balancer or your own TLS proxy), set API_URL and GRPC_URL in /etc/hoop/hoop.env and run sudo systemctl restart hoopgateway.

Step 8 - Enroll an access agent

Hoop reaches the systems it protects through lightweight agents that dial the gateway's gRPC endpoint on port 8010.

Open Agents from the left navigation and choose Setup new Agent. Follow the instructions to run an agent, as a container or a binary, with the agent key that Hoop generates. Once the agent connects, it shows as Online.

Step 9 - Register a connection

Open Resources and choose Setup new Resource to register a connection. A connection can be a database (PostgreSQL, MySQL, SQL Server, MongoDB), an SSH or RDP server, a Kubernetes cluster or a shell command, and it is bound to one of your agents.

Users then request access to the connection through Hoop rather than connecting directly. Hoop records every session and can optionally send it for review before it runs.

Step 10 - Review the audit dashboard

Open Dashboard to see an overview of sessions executed, reviews sent and data redacted. Open Sessions to browse the full immutable log of every command and query run through the gateway.

This audit trail lets you answer who accessed what, when, and what they did.

Step 11 - Production hardening

The image ships the fully functional gateway, console and API. For production, make these changes:

• TLS and DNS: Front Hoop with your own domain and a TLS-terminating reverse proxy or Azure Application Gateway. Then set API_URL and GRPC_URL in /etc/hoop/hoop.env to the https:///grpc(s):// addresses and run sudo systemctl restart hoopgateway.
• Single sign-on: Switch AUTH_METHOD in /etc/hoop/hoop.env from local to oidc or saml. Configure your identity provider to enforce SSO for console access.
• Reviews and guardrails: Require approvals on sensitive connections, and add guardrail rules and live data masking from the console.

Maintenance

• Back up your data: All gateway state lives in the local hoopdb PostgreSQL database. That state includes organizations, users, connections, agents and session audit logs. Snapshot the OS disk, or use pg_dump hoopdb for logical backups.
• API URL: The API URL is set to the detected public IP on each boot. For a stable hostname or HTTPS, set API_URL/GRPC_URL in /etc/hoop/hoop.env and run sudo systemctl restart hoopgateway.
• Security updates: Unattended security upgrades are enabled, so the OS keeps itself patched. Reboot when a new kernel is installed.
• Upgrades: The gateway image is pinned for reproducibility. When you choose to upgrade, pull a newer hoophq/hoop tag and update the tag in /etc/systemd/system/hoopgateway.service.

Support

SecureAnyCloud provides 24/7/365 expert technical support for this image. Contact sales@secureanycloud.com.

Hoop is licensed under the MIT License. SecureAnyCloud provides this image, and additional charges apply for build, maintenance and 24/7 support.

Deploy on Azure

Launch Hoop on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com