SecureAnyCloud
Deployment guide

Jenkins 2

Overview

Jenkins is a widely used open-source automation server for CI/CD pipelines, build automation and scheduled jobs. This SecureAnyCloud image runs Jenkins LTS 2.555.1 on Ubuntu 24.04 LTS with OpenJDK 21, fronted by nginx 1.24 on port 80.

The nginx proxy is pre-configured with X-Forwarded-* headers and websocket upgrade for the build console. A Groovy init script creates per-VM admin credentials on first boot, so you skip the upstream initial-admin-password setup wizard entirely.

What you get:

  • Jenkins LTS 2.555.1 from the official pkg.jenkins.io/debian-stable APT repo, signed with jenkins.io-2026.key (valid through 2028-12-21)
  • OpenJDK 21 JRE headless plus fontconfig, libharfbuzz0b, and fonts-dejavu-core (required by the Jenkins Jetty font subsystem on Ubuntu 24.04)
  • jenkins.service listening on 127.0.0.1:8080, with the upstream setup wizard disabled via -Djenkins.install.runSetupWizard=false
  • nginx 1.24 reverse proxy on :80 with X-Forwarded-* headers and websocket upgrade for /wsagents/, /cli, and /websocket
  • /var/lib/jenkins/init.groovy.d/sac-init.groovy provisions the admin user from /etc/jenkins/admin-password.txt on every Jenkins start
  • jenkins-2-firstboot.service rotates the admin password (openssl rand -hex 16) on first boot and writes /var/lib/sac/secrets/sac-credentials.txt (mode 0600 root:root)
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key, a VNet with a subnet, and a network security group (NSG) that allows TCP 22 (SSH) and TCP 80 (web UI).

Standard_B2s (4 GB RAM) is suitable for small teams running a handful of pipelines. For concurrent builds, distributed agents or heavy plugin usage, scale up to D4s_v5 or D8s_v5. For those workloads, consider switching from H2 to a managed PostgreSQL backend for the Jenkins state.

1

Deploy from the Azure Marketplace

Search the Azure Marketplace for "SecureAnyCloud Jenkins LTS Ubuntu 24.04" and select Create. Choose the Standard_B2s size and your VNet and subnet.

Make sure the NSG attached to the VM allows inbound TCP 22 and TCP 80 from your trusted CIDR.

2

Connect over SSH

ssh azureuser@<vm-ip>
3

Check the service status

Confirm that both services are active.

sudo systemctl status jenkins.service nginx.service --no-pager | head -20
4

Read the per-VM admin credentials

The first-boot service rotates the Jenkins admin password and writes the SecureAnyCloud credentials file. Read the file with sudo.

sudo cat /var/lib/sac/secrets/sac-credentials.txt

Note the values of JENKINS_URL, JENKINS_ADMIN_USER (always admin) and JENKINS_ADMIN_PASSWORD. Keep this terminal open while you sign in.

5

Open Jenkins in your browser

Browse to http://<vm-ip>/. nginx forwards the request to Jenkins on 127.0.0.1:8080, and the Jenkins sign-in page appears.

6

Sign in

Enter admin and the password from /var/lib/sac/secrets/sac-credentials.txt. The Jenkins dashboard loads.

The upstream setup wizard is already complete. sac-init.groovy provisions the security realm, the authorization strategy and the admin user.

7

Create your first job

Select New Item in the left sidebar and enter a name. Pick a project type, then select OK to open the job configuration page.

The base image ships with Freestyle project out of the box. For declarative-pipeline support, install the Pipeline plugin from Manage Jenkins > Plugins.

8

Configure Jenkins

Select Manage Jenkins in the left sidebar to reach System Configuration, Plugins, Tools, Nodes, Credentials and Security. You can install plugins from the Plugin Manager without restarting.

9

Test the REST API

Confirm that the REST API is reachable with the same credentials.

PASS=$(sudo grep '^JENKINS_ADMIN_PASSWORD=' /var/lib/sac/secrets/sac-credentials.txt | cut -d= -f2-)
curl -sf -u "admin:${PASS}" http://127.0.0.1/api/json | head -c 200

A 200 response confirms that admin authentication works through nginx to Jenkins. Use the same Basic authentication from your CI scripts and external triggers.

10

Harden the deployment

Before you expose Jenkins to the internet, work through these recommendations:

  • TLS termination. Add a Let's Encrypt certificate with certbot --nginx and uncomment the HTTPS server block. Set JENKINS_URL to the https:// form in Manage Jenkins > System so that absolute URLs in emails are correct.
  • Restrict the admin user. Rotate the admin password (System > Manage Users > admin > Configure) and create per-user accounts under Manage Jenkins > Security.
  • Authorization strategy. Switch from "Logged-in users can do anything" to Matrix-based or Role-based authorization for fine-grained, per-job permissions.
  • Plugin updates. Apply security patches from Manage Jenkins > Plugins > Updates, and subscribe to the Jenkins security advisory feed.
  • Back up JENKINS_HOME. /var/lib/jenkins holds all jobs, configurations and credentials. Back it up to Azure Blob storage with azcopy on a schedule.
  • Distributed builds. Add Linux or Windows agents under Manage Jenkins > Nodes to offload builds from the controller.

Architecture

Component Path Notes

Jenkins JAR /usr/share/java/jenkins.war Started by jenkins.service

JENKINS_HOME /var/lib/jenkins/ Job configs, build history, plugins, credentials

Jenkins systemd /etc/systemd/system/jenkins.service.d/sac-overrides.conf JENKINS_OPTS + JAVA_OPTS (setup wizard disabled, bind 127.0.0.1:8080)

Groovy init /var/lib/jenkins/init.groovy.d/sac-init.groovy Idempotent admin provisioning at every Jenkins start

Per-VM password /etc/jenkins/admin-password.txt Mode 0640 root:jenkins; rotated by firstboot

Per-VM URL /etc/jenkins/jenkins-url.txt Mode 0644 root:jenkins; consumed by JenkinsLocationConfiguration

nginx vhost /etc/nginx/sites-available/jenkins Reverse proxy with X-Forwarded-* + websocket upgrade

Customer creds /var/lib/sac/secrets/sac-credentials.txt Mode 0600 root:root; JENKINS_URL, admin user, admin password

Firstboot script /usr/local/sbin/jenkins-2-firstboot.sh Rotates password, writes URL, restarts Jenkins, writes credentials file

Firstboot sentinel /var/lib/sac/data/jenkins-2-firstboot.done Created when firstboot completes

Support

SecureAnyCloud provides 24/7 support for this image. Open a ticket at https://secureanycloud.com/support/ with your subscription ID, VM name and a brief description of the issue.

Common requests include scaling the controller, adding distributed agents, switching to a PostgreSQL or MySQL state backend, and integrating with Azure AD through the SAML or OpenID plugin.

Deploy on Azure

Launch Jenkins LTS Automation Server on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure