LibreTime

Sign in to the Azure Portal, choose Create a resource, and search the Marketplace for LibreTime by SecureAnyCloud. Select Create.

• On Basics, pick your subscription, resource group, region and size (Standard_B2ms or larger).
• Under Administrator account, choose SSH public key and paste your key.
• Under Inbound port rules, allow SSH (22) and HTTP (80), and add 8000 for the stream.
• Choose Review + create, then Create.

Create the resource group and the VM from the image with the Azure CLI.

RG="libretime-prod"; LOCATION="eastus"; VM_NAME="libretime-01" IMAGE_URN="sac1647283583153:libretime-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name lt-vnet --address-prefix 10.100.0.0/16 --subnet-name lt-subnet --subnet-prefix 10.100.1.0/24 az network nsg create -g "$RG" --name lt-nsg az network nsg rule create -g "$RG" --nsg-name lt-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name lt-nsg --name allow-web --priority 110 \
  --destination-port-ranges 80 8000 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:libretime-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2ms --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name lt-vnet --subnet lt-subnet --nsg lt-nsg --public-ip-sku Standard

Connect over SSH as azureuser with the key you supplied.

ssh azureuser@<vm-ip>

LibreTime runs as ten containers under one libretime.service. The service starts after libretime-firstboot.service has prepared the per-VM secrets and database. Confirm that the systemd units are active.

sudo systemctl is-active docker libretime-firstboot libretime

All three report active. Then list the containers. Each runs on the private libretime network, with nginx on :80 as the single public front door.

sudo docker compose --env-file /etc/libretime/libretime.env -f /etc/libretime/compose.yaml ps

First boot generated every service password, the Django secret key and the internal API key for this VM. It also rotated the default admin / admin login to a random per-instance password before the web interface started. All of these are written to a root-only file. Print it with the following command.

sudo cat /root/libretime-credentials.txt

The file has mode 0600 root:root. It holds:

• ADMIN_USERNAME and ADMIN_PASSWORD, the account you sign in to the web interface with.
• WEB_URL and ICECAST_STREAM_URL.
• The per-VM PostgreSQL, RabbitMQ, Icecast and API secrets.

None of these values ship in the image. Every value is unique to this VM, so no two instances share a credential and there is no default login to change.

The web interface presents a login page, but the vendor default admin / admin account does not exist. It was rotated to the random per-instance password in Step 5 before nginx served a request.

Confirm that the login page and API are live, that the per-instance admin password authenticates through the real login form, and that the default credential is rejected. The image bundles this round trip as a single script. Run it.

sudo /usr/local/sbin/libretime-roundtrip.sh

The script reports OK when all of these hold:

• The web interface, the API and the Icecast server are live.
• The per-instance admin logs in, with an HTTP 302 redirect to the studio.
• The default admin / admin login is rejected.
• The database confirms that the default credential hash is gone.

Browse to http://<vm-ip>/ to reach LibreTime. Sign in with the ADMIN_USERNAME (admin) and the ADMIN_PASSWORD from Step 5.

After you sign in, you land on the Now Playing studio. The left panel is your audio library of tracks, playlists and smart blocks. The right panel is the schedule timeline. The top bar shows what is on air and lets you drive live sources.

Choose Upload (top left) to add audio. Then organise it into playlists and smart blocks.

Every feature is backed by a REST API, authenticated with the per-VM API key. Read the key from the credentials file, then list your library and query the Icecast server. All calls go through the front door on the VM itself.

API_KEY=$(sudo grep '^API_KEY=' /root/libretime-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'API version : HTTP %{http_code}\n' http://127.0.0.1/api/v2/version
curl -s -o /dev/null -w 'library (key) : HTTP %{http_code}\n' -H "Authorization: Api-Key $API_KEY" http://127.0.0.1/api/v2/files
curl -s -o /dev/null -w 'library (nokey): HTTP %{http_code}\n' http://127.0.0.1/api/v2/files
curl -s -o /dev/null -w 'Icecast :8000 : HTTP %{http_code}\n' http://127.0.0.1:8000/

The version endpoint is public. The library requires the API key, and an unauthenticated request is rejected. The Icecast streaming server answers on 8000.

A fresh VM starts with an empty library. Upload your own audio with Upload in the studio.

Open Calendar and choose New Show to schedule programming. Give the show a name, genre and description. Set when it starts and how long it runs, and optionally make it repeat.

Once a show exists, drag tracks, playlists or smart blocks onto it in the studio. LibreTime plays the show out automatically at the scheduled time.

LibreTime broadcasts through the built-in Icecast server. Open Settings > Streams to review and adjust the output: the stream label, the Icecast host, port, mount, format and bitrate.

The image ships with one Icecast output enabled, streaming OGG at 256 kbps. It reports Connected to the streaming server once playout starts. Listeners tune in at http://<vm-ip>:8000/main.

The image contains these components:

• Platform: LibreTime 4.5.0 (AGPL-3.0), official upstream containers.
• Web and API: LibreTime legacy (PHP) and API (Django), fronted by nginx on :80.
• Database: PostgreSQL 15, created fresh on first boot.
• Message queue: RabbitMQ 3.13.
• Playout: Liquidsoap playout engine, with live input harbours on :8001 / :8002.
• Streaming: Icecast 2.4.4 on :8000 (OGG 256 kbps output).
• Orchestration: Docker Compose under libretime.service.
• Service secrets: generated per instance on first boot into /etc/libretime/libretime.env and config.yml.
• Admin account: the vendor default is rotated to a random per-instance password in /root/libretime-credentials.txt.
• Operating system: Ubuntu 24.04 LTS, patched at build time.
• License: AGPL-3.0 (LibreTime).

Check the units at any time.

sudo systemctl is-active docker libretime

The stack configuration lives in /etc/libretime/config.yml and /etc/libretime/compose.yaml. The per-VM secrets are in /etc/libretime/libretime.env (root only).

To restart the whole stack after a configuration change, run sudo systemctl restart libretime. Because libretime.service runs docker compose up, you manage individual containers with docker compose against /etc/libretime/compose.yaml.

The image serves the web interface over plain HTTP on port 80. In production, terminate TLS in front of the VM so the admin password travels encrypted.

• Front the VM with Azure Application Gateway, a load balancer with a managed certificate, or a CDN, and forward to nginx on port 80.
• Point a DNS name you control at the VM's public IP. LibreTime resolves its public URL at first boot from the reachable public address. For a custom domain, use a stable public IP or set the address before first boot.
• Icecast serves the public radio stream on port 8000. Front it separately or expose it directly to your listeners.

• Restrict the NSG. Allow TCP 80 and 8000 only from the networks that need them, and 22 only from your management network. Open 8001 and 8002 only if you connect a live source.
• Terminate TLS in front of the app (Step 14) so the admin password is encrypted in transit.
• Rotate the seeded admin password. Sign in and change it under the username menu. Create individual accounts for your team under Settings > Users.
• Keep the services private. PostgreSQL, RabbitMQ and the application services run on a private container network. Only nginx on :80, Icecast on :8000 and the harbours on :8001 / :8002 are published, so keep it that way.
• Keep the OS patched. Unattended security upgrades remain enabled on the running VM.

LibreTime is distributed under the GNU Affero General Public License v3 (AGPL-3.0). This image bundles the unmodified official open-source release.

SecureAnyCloud provides the packaging, the single nginx front door, the per-instance secret generation and default admin rotation, this deployment guide, and 24/7 support with a guaranteed 24-hour response SLA. LibreTime is an independent open-source project, and this image is not affiliated with or endorsed by it.

Deploy on Azure

Launch LibreTime on Ubuntu 24.04 LTS by SecureAnyCloud from the Azure Marketplace and follow this guide to a working radio automation station in minutes.

Deploy on Azure

Launch LibreTime on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com