Jotty

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting size for personal or small-team use. Choose a larger size for many active users or very large note collections.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp. Jotty serves plain HTTP on port 80, so for production terminate TLS in front of it with your own domain (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Jotty by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:jotty-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name jotty \
  --image sac1647283583153:jotty-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name jotty --port 80 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH as azureuser:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active docker.service jotty.service nginx.service

All three units report active. Docker runs the Jotty container on the loopback port 127.0.0.1:3000, and nginx fronts it on port 80. Jotty's notes, checklists and state live on the dedicated Azure data disk mounted at /var/lib/jotty.

Step 5 - Retrieve your administrator credential

The administrator account is seeded uniquely on the first boot of your VM. The generated password is written to a root-only file. That file holds the plaintext password, while Jotty's store keeps only a SHA-256 hash.

sudo cat /root/jotty-credentials.txt

The file shows the sign-in URL, the username (admin) and the per-VM password. Keep this password safe, because it controls the administrator account for your Jotty instance.

Step 6 - Verify the app is serving

Jotty exposes an unauthenticated health endpoint, and the image ships a self-test that checks the per-VM admin gate end to end. Run both:

curl -s http://127.0.0.1:3000/api/health; echo
sudo /usr/local/sbin/jotty-selftest

The health endpoint returns {"status":"healthy",...}. The self-test confirms that the app is serving and that the per-VM password matches the seeded admin. It also confirms that common and blank default passwords are rejected and that first-admin self-registration is guarded.

Step 7 - Review the security posture

The image is locked down by default. The app port is loopback-only, so nginx is the sole public surface. First-visitor /auth/setup self-registration is closed, and nginx refuses unknown Host headers and config paths. Run these checks to see it:

curl -s -o /dev/null -w 'setup -> HTTP %{http_code} %{redirect_url}\n' http://127.0.0.1:3000/auth/setup ss -lnt | grep -E ':3000|:80 '
curl -s -o /dev/null -w 'evil-host -> %{http_code}\n' -H 'Host: evil.example.com' http://127.0.0.1/auth/login
curl -s -o /dev/null -w '/users.json -> %{http_code}\n' -H 'Host: 127.0.0.1' http://127.0.0.1/users.json

Expect four results. /auth/setup returns a 307 redirect to /auth/login, which shows self-registration is guarded. Port 3000 listens on 127.0.0.1 only. An unknown Host header gets a bare 404, and the config path returns 404.

Step 8 - Sign in to Jotty

In your browser, go to http://<vm-public-ip>/. Jotty opens the Welcome back sign-in screen rather than a setup form, because the admin account is already seeded. Sign in as admin with the password from Step 5.

Step 9 - Create your first note

After you sign in, click New Note, give it a title and click Create. Jotty opens the Markdown editor, where you write the note body. The note appears in the notes list immediately and opens with its content rendered.

Jotty also provides task checklists and kanban boards alongside notes, so you can track to-dos in the same private workspace.

To add more users, open Settings as the administrator. There is no open self-service registration, so only an administrator can create new accounts.

Maintenance

Secure with HTTPS. For production, put your own domain in front of the VM and terminate TLS. Point a DNS record at the VM's public IP, then install a certificate (for example with Certbot). Add a TLS server block to nginx that proxies to http://127.0.0.1:3000, mirroring the shipped port-80 vhost.

The nginx server_name allowlist already includes your VM's addresses. Add your domain name to the server_name line so nginx serves it.

Back up your notes. Everything Jotty stores is under /var/lib/jotty/data as plain Markdown and JSON. Snapshot the data disk from the Azure portal, or copy the directory:

sudo tar czf /var/tmp/jotty-data-backup.tgz -C /var/lib/jotty data

Grow the data disk. The notes store grows on the dedicated Azure data disk. Expand the disk in the Azure portal, then grow the filesystem online with sudo growpart and sudo resize2fs on the data-disk partition.

Update Jotty. New releases ship as new image tags. Pull the new tag, point the jotty.service unit at it, and restart:

sudo docker pull ghcr.io/fccview/jotty:<new-version>
sudo sed -i 's#ghcr.io/fccview/jotty:1.26.0#ghcr.io/fccview/jotty:<new-version>#' /etc/systemd/system/jotty.service
sudo systemctl daemon-reload && sudo systemctl restart jotty

Review the upstream release notes before you upgrade, because some releases run a data migration. Back up first.

Support

SecureAnyCloud maintains this image and provides 24/7 support. If you need help deploying or operating Jotty on Azure, contact SecureAnyCloud support through the Azure Marketplace listing.

Jotty is an open source project (AGPL-3.0). This image packages unmodified upstream Jotty with SecureAnyCloud configuration and automation. It is not affiliated with or endorsed by the Jotty project.

Deploy on Azure

Launch Jotty on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com