JBoss EAP 8.1 on Red Hat 8

Accept the Marketplace terms, then create the VM with the Azure CLI.

az vm image terms accept --urn sac1647283583153:jboss-eap-8-1-rhel-8:standard:latest
az vm create -g <resource-group> -n jboss-eap-vm -l eastus \
  --image sac1647283583153:jboss-eap-8-1-rhel-8:standard:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub

Standard_B2s (4 GB RAM) is enough for the default standalone-full profile under light load. For production traffic, choose Standard_E4s_v5 (4 vCPU, 32 GB RAM) and tune the JVM heap as described in Step 9.

Connect to the VM as azureuser.

ssh azureuser@<public-ip>

Confirm the operating system:

cat /etc/redhat-release

Check that jboss-eap.service is active and enabled. It starts automatically at boot.

sudo systemctl is-active jboss-eap.service

sudo systemctl is-enabled jboss-eap.service

Inspect the unit:

sudo systemctl show jboss-eap.service -p Description -p ActiveState -p SubState -p MainPID -p User

On first boot, jboss-eap-firstboot.service rotates the management admin password. It writes the new credentials to /home/azureuser/CREDENTIALS.txt. Read the file with sudo:

sudo cat /home/azureuser/CREDENTIALS.txt

Copy the password to a secure location. The file is owned by root:root with mode 0600. Remove it once the password is stored elsewhere.

List the listening sockets.

sudo ss -tlnp | grep -E ':8080|:9990'

You should see 0.0.0.0:8080 (HTTP for deployed applications) and 0.0.0.0:9990 (the management console and management API). Both are owned by the java process running EAP.

Open the EAP welcome page on port 8080 in a browser to confirm the server is reachable from outside the VM. This page is the default landing page for any HTTP request that does not match a deployed application context.

Open the public IP on port 9990 in a browser. On the standalone-full profile, the management console is served over HTTP by default.

echo "http://<vm-public-ip>:9990/console/"

Sign in with the username admin and the per-VM password from Step 4. EAP uses HTTP digest authentication, so most browsers show a native login dialog the first time you open the URL. The console then opens on the Homepage view.

The Deployments tab lists the applications deployed to the server. A fresh image starts empty. Drag and drop a WAR file into the deployment column, or use the CLI as described in Step 8.

The Runtime tab monitors the live server: log files, JVM metrics, datasource pools and web subsystem statistics. The image registers the VM hostname as the only server entry, with a green health indicator.

The Configuration tab shows the full subsystem tree, including datasources, messaging-activemq, transactions, undertow and infinispan. It is the graphical equivalent of the JBoss CLI and covers most administrative changes.

For production, restrict the management interface to a private VNet subnet (Step 7) and switch the management console to HTTPS (Step 11).

The OS firewalld already permits ports 8080 and 9990, but the Azure network security group (NSG) attached to the VM blocks them by default. Open them only to the subnets that need access, and never to 0.0.0.0/0 in production.

az network nsg rule create -g <resource-group> --nsg-name <nsg-name> \
  -n allow-eap-http \
  --priority 200 --direction Inbound --access Allow \
  --protocol Tcp --source-address-prefixes 10.0.0.0/16 \
  --destination-port-ranges 8080

az network nsg rule create -g <resource-group> --nsg-name <nsg-name> \
  -n allow-eap-mgmt \
  --priority 210 --direction Inbound --access Allow \
  --protocol Tcp --source-address-prefixes 10.0.0.0/16 \
  --destination-port-ranges 9990

Replace 10.0.0.0/16 with your application subnet's CIDR for HTTP. Limit the management rule to your operations subnet.

Copy a WAR file to the VM and deploy it with the JBoss CLI. The CLI uses the same ManagementRealm credentials as the console. Substitute the path to your own WAR file.

sudo -u jboss /opt/jboss-eap-8.1/bin/jboss-cli.sh \
  --connect \
  --user=admin --password="$(grep '^Admin password:' /home/azureuser/CREDENTIALS.txt | awk '{print $3}')" \
  --command="deploy /home/azureuser/myapp.war"

List the active deployments (a read-only command):

sudo -u jboss /opt/jboss-eap-8.1/bin/jboss-cli.sh \
  --connect \
  --user=admin --password="$(grep '^Admin password:' /home/azureuser/CREDENTIALS.txt | awk '{print $3}')" \
  --command="deployment-info"

Undeploy:

sudo -u jboss /opt/jboss-eap-8.1/bin/jboss-cli.sh \
  --connect \
  --user=admin --password="$(grep '^Admin password:' /home/azureuser/CREDENTIALS.txt | awk '{print $3}')" \
  --command="undeploy myapp.war"

The image uses EAP's default heap of Xms1303m and Xmx1303m (about 1.3 GB), which fits a Standard_B2s (4 GB RAM total). On a larger size, raise both values to roughly 50 to 70 percent of system RAM.

Edit the systemd drop-in. Replace <your-min-heap> and <your-max-heap> with values that suit your VM size, for example 8g and 8g on a Standard_E4s_v5 with 32 GB.

sudo mkdir -p /etc/systemd/system/jboss-eap.service.d
sudo tee /etc/systemd/system/jboss-eap.service.d/heap.conf >/dev/null <<'CONF' [Service] Environment=JAVA_OPTS=-Xms<your-min-heap> -Xmx<your-max-heap> -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true CONF
sudo systemctl daemon-reload
sudo systemctl restart jboss-eap.service

Verify that the JVM picked up the new values:

sudo journalctl -u jboss-eap.service --no-pager -n 20 | grep -E 'Xms|Xmx'

EAP 8.1 ships ExampleDS, an embedded H2 database, by default. To add a production datasource such as PostgreSQL, copy the JDBC driver into the modules tree and register the datasource with the CLI. Substitute your own database connection details.

sudo -u jboss /opt/jboss-eap-8.1/bin/jboss-cli.sh \
  --connect \
  --user=admin --password="$(grep '^Admin password:' /home/azureuser/CREDENTIALS.txt | awk '{print $3}')" \
  --command="data-source add --name=AppDS --jndi-name=java:jboss/datasources/AppDS --driver-name=postgresql --connection-url=jdbc:postgresql://<your-db-host>:5432/<your-db-name> --user-name=<your-db-user> --password=<your-db-password> --use-ccm=true --enabled=true"

Test the connection:

sudo -u jboss /opt/jboss-eap-8.1/bin/jboss-cli.sh \
  --connect \
  --user=admin --password="$(grep '^Admin password:' /home/azureuser/CREDENTIALS.txt | awk '{print $3}')" \
  --command="/subsystem=datasources/data-source=AppDS:test-connection-in-pool"

For production, serve the management console over HTTPS. Add a key store with the CLI. Replace changeit with a real keystore password, for example one stored in Azure Key Vault.

sudo -u jboss /opt/jboss-eap-8.1/bin/jboss-cli.sh \
  --connect \
  --user=admin --password="$(grep '^Admin password:' /home/azureuser/CREDENTIALS.txt | awk '{print $3}')" \
  --command="/subsystem=elytron/key-store=mgmtKS:add(path=mgmt.keystore,relative-to=jboss.server.config.dir,credential-reference={clear-text=changeit},type=PKCS12)"

Then create a key-manager and a server-ssl-context, attach the HTTPS listener to port 9993, and switch the management console to it. The exact CLI sequence is in the Red Hat JBoss EAP 8.1 documentation, under "Configuring SSL for the Management Console".