Deployment guide

lighttpd

Overview

lighttpd (pronounced "lighty") is a secure, fast and flexible web server optimized for high-performance environments. Its small memory footprint and efficient event-driven design make it a strong choice for serving static websites and assets, fronting application back ends, and running on resource-constrained instances. This guide covers how to deploy and configure lighttpd on Ubuntu 24.04 on Azure with the SecureAnyCloud Azure Marketplace image.

The image installs lighttpd 1.4.x from the Ubuntu 24.04 package repository and runs it under systemd as the standard unprivileged www-data account. lighttpd serves HTTPS on port 443 directly through its mod_openssl TLS engine, so there is no separate reverse proxy to run or maintain. Plain HTTP on port 80 is permanently redirected to HTTPS with a 301 status.

There is no web interface and no database. A single readable configuration file is the whole configuration: /etc/lighttpd/lighttpd.conf plus the SecureAnyCloud drop-in at /etc/lighttpd/conf-enabled/50-sac.conf.

Secure and lean by default. On the first boot of every VM, a one-shot service generates a unique self-signed TLS certificate for that specific instance, so no certificate or private key is ever baked into the image. Directory listing is disabled, so a directory that has no index file returns 403 instead of exposing its contents. The server version token is suppressed, so response headers do not advertise the software version. lighttpd has no login, so no shared or default credential of any kind ships in the image.

What you get:

lighttpd 1.4.x from the Ubuntu 24.04 repository with the mod_openssl TLS module, run under systemd as www-data (lighttpd.service)
HTTPS on port 443 served directly by lighttpd through mod_openssl, and HTTP on port 80 permanently redirected (301) to HTTPS
A unique self-signed certificate generated for each instance on first boot into /etc/lighttpd/certs, so no key material is shared across deployments
A hardened default posture: directory listing disabled, the server version token suppressed, and only modern TLS protocol versions enabled
A simple document root at /var/www/html with a SecureAnyCloud landing page that you replace with your own site
The whole configuration in readable text that you can version-control, with no database and no administrative web console

Prerequisites

An active Azure subscription, an SSH public key, and a VNet and subnet in the target region
A subscription to the lighttpd listing on Azure Marketplace
Network Security Group rules that allow TCP 22 for administration, and TCP 80 and TCP 443 from the clients that will reach the web server

Recommended virtual machine size: Standard_B2s (2 vCPU, 4 GB RAM) is ample for serving static sites or fronting an application. lighttpd is extremely light, so larger sizes are only needed for very high request volumes.

Deploy from the Azure Portal

Search for lighttpd in the Marketplace, select the SecureAnyCloud publisher, and choose Create. Configure the Network Security Group to allow TCP 443 (HTTPS) and TCP 80 (HTTP, which redirects to HTTPS) from the clients that will reach the server. Also allow TCP 22 for administration.

Deploy from the Azure CLI

RG="web-prod"; LOCATION="eastus"; VM_NAME="lighttpd1" IMAGE_URN="sac1647283583153:lighttpd-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:lighttpd-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 443 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 80 --priority 1002
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1003

First boot

On first boot, the image resolves the IP of this VM, generates a unique self-signed TLS certificate into /etc/lighttpd/certs/sac.crt and sac.key, writes the informational note /root/lighttpd-info.txt (which records the served URL), and starts lighttpd. This completes within seconds. SSH in as azureuser and read the note:

sudo cat /root/lighttpd-info.txt

The note records the served HTTPS URL, the document root, the config paths and the certificate path. lighttpd has no password, so the note holds no secret.

Confirm the service is running

lighttpd.service is active, lighttpd -v reports the installed version, and ss confirms that lighttpd is listening on :443 for HTTPS and on :80 for the HTTP redirect.

systemctl is-active lighttpd.service lighttpd -v sudo ss -tlnp | grep -E ':80 |:443 '

Confirm HTTPS and the per-instance certificate

lighttpd answers HTTPS on port 443 directly. Request the site over HTTPS on the loopback address (the -k flag accepts the self-signed certificate), then inspect the certificate. The response Server header is just lighttpd with no version, and the certificate subject is sac-lighttpd, unique to this VM.

curl -ksI https://127.0.0.1/
sudo openssl x509 -in /etc/lighttpd/certs/sac.crt -noout -subject -issuer -dates

The HTTP status is 200, and the certificate was generated on the first boot of this instance, so no private key is shared with any other deployment.

Confirm the HTTP to HTTPS redirect and directory listing hardening

Plain HTTP on port 80 is permanently redirected to HTTPS with a 301 status, so clients are always upgraded to an encrypted connection. Directory listing is disabled, so a directory that has no index file returns 403 Forbidden instead of exposing its contents. Individual files inside the directory are still served by their path.

curl -sI http://127.0.0.1/
curl -ks -o /dev/null -w 'GET /downloads/ -> %{http_code}\n' https://127.0.0.1/downloads/
curl -ks -o /dev/null -w 'GET /downloads/README.txt -> %{http_code}\n' https://127.0.0.1/downloads/README.txt

The HTTP request returns 301 Moved Permanently with a Location header that points at https://. The /downloads/ directory has no index file and returns 403, and the file inside it returns 200.

Review the SecureAnyCloud configuration

Everything that SecureAnyCloud adds is in one readable drop-in file. The file loads mod_openssl, opens the HTTPS socket, defines the 301 redirect, disables directory listing and minimizes the server token. The base lighttpd configuration lives in /etc/lighttpd/lighttpd.conf.

sudo cat /etc/lighttpd/conf-enabled/50-sac.conf

Serve your own site

Replace the SecureAnyCloud landing page with your own site. Write your files into the document root /var/www/html, or point the document root at a different directory in the configuration. The following example is illustrative, so substitute your own content.

# copy your static site into the document root
#
sudo rsync -a ./my-site/ /var/www/html/
# or change server.document-root in /etc/lighttpd/lighttpd.conf to another path,
# then apply the change:
#
sudo systemctl reload lighttpd

lighttpd validates its configuration on reload. If there is a syntax error, lighttpd keeps serving the previous configuration. You can check the configuration at any time with sudo lighttpd -tt -f /etc/lighttpd/lighttpd.conf.

Install a browser-trusted certificate for your domain

The image ships with a self-signed certificate so that HTTPS works immediately. For a browser-trusted certificate, point the DNS A record of your domain at the public IP of this VM. Obtain a certificate for <your-domain> from a certificate authority, then point lighttpd at the new certificate and key.

# 1) obtain a certificate + key for <your-domain> (for example with acme.sh or certbot)
# 2) install them, then set in /etc/lighttpd/conf-enabled/50-sac.conf:
# ssl.pemfile = "/etc/lighttpd/certs/<your-domain>.crt"
# ssl.privkey = "/etc/lighttpd/certs/<your-domain>.key"
# 3) apply the change:
#
sudo systemctl reload lighttpd

Keep the private key readable only by root. lighttpd loads the certificate at startup, so a reload is enough to serve the new certificate.

Front an application back end

lighttpd can proxy or use FastCGI to reach an application that runs on the same VM. Load the relevant module and add a handler in the configuration. The following pattern forwards a path prefix to a local application port.

# enable the proxy module and route a prefix to a local app on <app-port>:
# server.modules += ( "mod_proxy" )
# $HTTP["url"] =~ "^/app/" {
# proxy.server = ( "" => ( ( "host" => "127.0.0.1", "port" => <app-port> ) ) )
# }
# then:
sudo systemctl reload lighttpd

For dynamic languages, lighttpd also ships FastCGI (mod_fastcgi) and CGI handlers. See the lighttpd documentation for the handler syntax.

Security recommendations

Restrict the NSG to your use case. Allow TCP 443 and TCP 80 only from the networks that need to reach the site, and restrict TCP 22 to your administration network.
Replace the self-signed certificate for public sites. The per-VM self-signed certificate secures the transport immediately, but browsers warn about it. For public-facing sites, install a CA-issued certificate for <your-domain> as in Step 9.
Keep directory listing disabled. The SecureAnyCloud default disables listing, so directories without an index file are never exposed. Leave it disabled unless you deliberately want a listing for a specific path.
Keep the OS patched. Unattended security upgrades remain enabled on the running VM, and lighttpd itself is patched with the OS through apt.

Support and Licensing

lighttpd is an open source project distributed under the BSD 3-Clause License. This SecureAnyCloud image installs the unmodified lighttpd package from the Ubuntu repository.

SecureAnyCloud provides the packaging, the systemd hardening, the secure-by-default TLS and redirect configuration, the per-instance certificate automation, the paired deploy guide, and 24/7 support with a guaranteed 24 hour response SLA.

SecureAnyCloud is not affiliated with or endorsed by the lighttpd project. lighttpd is a mark of its respective owner and is used here only to identify the software.

Deploy on Azure

Find lighttpd on Ubuntu 24.04 LTS on the Azure Marketplace, published by SecureAnyCloud. Deploy from the Portal or the Azure CLI as shown above.

Need Help?

Email sales@secureanycloud.com for deployment help, configuration questions or licensing inquiries.

Deploy on Azure

Launch lighttpd on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

The image installs lighttpd 1.4.x from the operating system package repository and runs it under systemd as the standard unprivileged www-data account. lighttpd serves HTTPS on port 443 directly through its mod_openssl TLS engine, so there is no separate reverse proxy to run or maintain. Plain HTTP on port 80 is permanently redirected to HTTPS with a 301 status.

Secure and lean by default. On the first boot of every instance, a one-shot service generates a unique self-signed TLS certificate for that specific instance, so no certificate or private key is ever baked into the image. Directory listing is disabled, so a directory that has no index file returns 403 instead of exposing its contents. The server version token is suppressed, so response headers do not advertise the software version. lighttpd has no login, so no shared or default credential of any kind ships in the image.

What you get:

lighttpd 1.4.x with the mod_openssl TLS module, run under systemd as www-data (lighttpd.service)
HTTPS on port 443 served directly by lighttpd through mod_openssl, and HTTP on port 80 permanently redirected (301) to HTTPS
A unique self-signed certificate generated for each instance on first boot into /etc/lighttpd/certs, so no key material is shared across deployments
A hardened default posture: directory listing disabled, the server version token suppressed, and only modern TLS protocol versions enabled
A simple document root at /var/www/html with a SecureAnyCloud landing page that you replace with your own site
The whole configuration in readable text that you can version-control, with no database and no administrative web console

Connecting to your instance

Connect over SSH on port 22 with the login user for the operating system variant that you launched. For Ubuntu 24.04, the SSH login user is ubuntu. lighttpd itself has no login or password.

ssh -i /path/to/your-key.pem ubuntu@<public-ip>

Prerequisites

An AWS account with EC2 access, and an SSH key pair in the target region
A subscription to the lighttpd listing on AWS Marketplace
A security group that allows inbound TCP 22 for administration, and TCP 80 and TCP 443 from the clients that will reach the web server

Recommended instance type: m5.large is a comfortable general-purpose default. lighttpd is extremely light, so smaller types such as t3.small serve static sites well, and larger types are only needed for very high request volumes.

Launch from AWS Marketplace

Find lighttpd on AWS Marketplace, published by SecureAnyCloud. Choose Continue to Subscribe, then Continue to Configuration and Continue to Launch.

Select your instance type, key pair and subnet. Select a security group that allows inbound TCP 443 (HTTPS) and TCP 80 (HTTP, which redirects to HTTPS) from the clients that will reach the server, and TCP 22 for administration.

Launch with the AWS CLI

AMI_ID="<lighttpd-ami-id>"
# from the Marketplace listing, for your region aws ec2 run-instances \
  --image-id "$AMI_ID" \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-xxxxxxxx \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=lighttpd1}]'

Open ports 80, 443 and 22 in the security group of the instance to the appropriate source ranges.

First boot

On first boot, the image resolves the IP of this instance through EC2 instance metadata, generates a unique self-signed TLS certificate into /etc/lighttpd/certs/sac.crt and sac.key, writes the informational note /root/lighttpd-info.txt (which records the served URL), and starts lighttpd. This completes within seconds. SSH in as ubuntu and read the note:

sudo cat /root/lighttpd-info.txt

The note records the served HTTPS URL, the document root, the config paths and the certificate path. lighttpd has no password, so the note holds no secret.

Confirm the service is running

lighttpd.service is active, lighttpd -v reports the installed version, and ss confirms that lighttpd is listening on :443 for HTTPS and on :80 for the HTTP redirect.

systemctl is-active lighttpd.service lighttpd -v sudo ss -tlnp | grep -E ':80 |:443 '

Confirm HTTPS and the per-instance certificate

curl -ksI https://127.0.0.1/
sudo openssl x509 -in /etc/lighttpd/certs/sac.crt -noout -subject -issuer -dates

The HTTP status is 200, and the certificate was generated on the first boot of this instance, so no private key is shared with any other deployment.

Confirm the HTTP to HTTPS redirect and directory listing hardening

curl -sI http://127.0.0.1/
curl -ks -o /dev/null -w 'GET /downloads/ -> %{http_code}\n' https://127.0.0.1/downloads/
curl -ks -o /dev/null -w 'GET /downloads/README.txt -> %{http_code}\n' https://127.0.0.1/downloads/README.txt

The HTTP request returns 301 Moved Permanently with a Location header that points at https://. The /downloads/ directory has no index file and returns 403, and the file inside it returns 200.

Review the SecureAnyCloud configuration

Everything that SecureAnyCloud adds is in one readable drop-in file. The file loads mod_openssl, opens the HTTPS socket, defines the 301 redirect and minimizes the server token. Directory listing is off because the listing generator module is deliberately not loaded. The base lighttpd configuration lives in /etc/lighttpd/lighttpd.conf.

sudo cat /etc/lighttpd/conf-enabled/50-sac.conf

Browse to the served site

Browse to https://<instance-public-ip>/ to see the SecureAnyCloud landing page served over TLS. Your browser warns about the self-signed certificate until you install your own (Step 10). Accept the warning to view the page.

Serve your own site

# copy your static site into the document root
#
sudo rsync -a ./my-site/ /var/www/html/
# or change server.document-root in /etc/lighttpd/lighttpd.conf to another path,
# then apply the change:
#
sudo systemctl reload lighttpd

Install a browser-trusted certificate for your domain

The image ships with a self-signed certificate so that HTTPS works immediately. For a browser-trusted certificate, point the DNS A record of your domain at the public IP of this instance. Obtain a certificate for your domain from a certificate authority, then point lighttpd at the new certificate and key.

# 1) obtain a certificate + key for your domain (for example with acme.sh or certbot)
# 2) install them, then set in /etc/lighttpd/conf-enabled/50-sac.conf:
# ssl.pemfile = "/etc/lighttpd/certs/your-domain.crt"
# ssl.privkey = "/etc/lighttpd/certs/your-domain.key"
# 3) apply the change:
#
sudo systemctl reload lighttpd

Keep the private key readable only by root. lighttpd loads the certificate at startup, so a reload is enough to serve the new certificate.

Front an application back end

lighttpd can proxy or use FastCGI to reach an application that runs on the same instance. Load the relevant module and add a handler in the configuration. The following pattern forwards a path prefix to a local application port.

# enable the proxy module and route a prefix to a local app on your app port:
# server.modules += ( "mod_proxy" )
# $HTTP["url"] =~ "^/app/" {
# proxy.server = ( "" => ( ( "host" => "127.0.0.1", "port" => 8080 ) ) )
# }
# then:
sudo systemctl reload lighttpd

For dynamic languages, lighttpd also ships FastCGI (mod_fastcgi) and CGI handlers. See the lighttpd documentation for the handler syntax.

Security recommendations

Restrict the security group to your use case. Allow TCP 443 and TCP 80 only from the networks that need to reach the site, and restrict TCP 22 to your administration network.
Terminate TLS at a load balancer where appropriate. Place instances behind an Application Load Balancer and use AWS Certificate Manager to provision and auto-renew public certificates, or install a CA-issued certificate directly on the instance as in Step 10.
Replace the self-signed certificate for public sites. The per-instance self-signed certificate secures the transport immediately, but browsers warn about it. For public-facing sites, install a CA-issued certificate.
Keep directory listing disabled. The SecureAnyCloud default does not load the directory listing generator, so directories without an index file are never exposed. Leave it that way unless you deliberately want a listing for a specific path.
Keep the OS patched. Unattended security upgrades remain enabled on the running instance, and lighttpd itself is patched with the OS.

Support and Licensing

lighttpd is an open source project distributed under the BSD 3-Clause License. This SecureAnyCloud image installs the unmodified lighttpd package from the operating system repository.

SecureAnyCloud provides the packaging, the systemd hardening, the secure-by-default TLS and redirect configuration, the per-instance certificate automation, the paired deploy guide, and 24/7 support.

SecureAnyCloud is not affiliated with or endorsed by the lighttpd project. lighttpd is a mark of its respective owner and is used here only to identify the software.

Need Help?

Email sales@secureanycloud.com for deployment help, configuration questions or licensing inquiries.

Deploy on AWS

Launch lighttpd with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS