SecureAnyCloud
Deployment guide

Lowdefy

Overview

Lowdefy is an open source, config-first low-code web stack for building internal tools, admin panels, CRUD interfaces, dashboards and business applications. You describe an application in a single declarative lowdefy.yaml file (its pages, a rich library of UI blocks, data connections and requests, and the logic that ties them together), and Lowdefy compiles that configuration into a production web application built on Next.js. The whole application is reviewable, version-controllable text rather than hand-written frontend code, so teams ship internal software quickly and consistently.

The SecureAnyCloud image builds the official Lowdefy starter app with the Lowdefy CLI into a production server under /opt/lowdefy/.lowdefy/server. It runs the server as the dedicated lowdefy system user, bound to loopback 127.0.0.1:3000, and fronts it with nginx on port 80, ready for your TLS certificate.

What you get:

  • Secure by default. Lowdefy has no built-in login, so this image protects the application with nginx HTTP Basic authentication, and there is no known bootstrap credential. On the first boot of every instance, lowdefy-firstboot.service generates a unique Basic auth password for the user admin and a per-VM application signing secret. It writes both the URL and the password to /root/lowdefy-credentials.txt (readable only by root).
  • An application that binds to loopback only, so no world-open window is ever exposed, and a static /healthz endpoint (no auth, no app content) for liveness probes.
  • The official Lowdefy starter app, built with the Lowdefy CLI 5.5 into /opt/lowdefy/.lowdefy/server.
  • The app config at /opt/lowdefy/lowdefy.yaml, ready for you to edit and rebuild.
  • lowdefy.service running as lowdefy, bound to 127.0.0.1:3000.
  • An nginx reverse proxy on port 80 with HTTP Basic auth, ready for TLS.
  • lowdefy-firstboot.service for the per-VM Basic auth password and signing secret.
  • Node.js 22 LTS runtime.
  • Ubuntu 24.04 LTS base, patched at build time.
  • 24/7 SecureAnyCloud support, 24h response SLA.

Prerequisites

  • An active Azure subscription, an SSH key pair, and a VNet with a subnet.
  • The recommended VM size, Standard_B2s. Lowdefy is lightweight, and 4 GB RAM is comfortable.
1

Deploy from the Azure Portal

Search the Marketplace for Lowdefy on Ubuntu 24.04 and choose your VM size. Attach an NSG that allows TCP 22 (SSH) from your management network and TCP 80 / 443 (the web app) from the networks that need it. In production, front port 80 with TLS (see Step 12).

2

Deploy from the Azure CLI

RG="lowdefy-prod"; LOCATION="eastus"; VM_NAME="lowdefy-01" IMAGE_URN="sac1647283583153:lowdefy-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name ld-vnet --address-prefix 10.90.0.0/16 --subnet-name ld-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name ld-nsg az network nsg rule create -g "$RG" --nsg-name ld-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name ld-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:lowdefy-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name ld-vnet --subnet ld-subnet --nsg ld-nsg --public-ip-sku Standard
3

Connect via SSH

ssh azureuser@<vm-ip>
4

Verify the services are running

The Lowdefy server listens on loopback 127.0.0.1:3000, and nginx fronts the web app on port 80.

sudo systemctl is-active lowdefy nginx ss -tln | grep -E ':80 |127.0.0.1:3000' curl -s -o /dev/null -w 'GET /healthz -> HTTP %{http_code}\n' http://127.0.0.1/healthz

Both services report active, the Lowdefy server is bound to 127.0.0.1:3000, nginx is bound to :80, and the liveness endpoint returns HTTP 200 through nginx.

5

Read your per-VM credentials

There is no default login. On first boot, the instance generated a unique Basic auth password and application signing secret and wrote them to a root-only file. Lowdefy has no built-in login, so nginx HTTP Basic auth protects the application.

sudo stat -c '%n perms=%a owner=%U:%G' /root/lowdefy-credentials.txt
sudo grep -E '^LOWDEFY_URL|^LOWDEFY_USERNAME' /root/lowdefy-credentials.txt curl -s -o /dev/null -w 'unauthenticated GET / -> HTTP %{http_code}\n' http://127.0.0.1/

The credentials file is 600 root:root and records the resolved URL and the username admin. An unauthenticated request to / is refused with HTTP 401. Read your password with sudo grep '^LOWDEFY_PASSWORD' /root/lowdefy-credentials.txt.

6

Confirm the credential authenticates

Use the per-VM password to confirm that the Basic auth gate accepts your credential end to end.

PW=$(sudo grep '^LOWDEFY_PASSWORD=' /root/lowdefy-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'authenticated GET / -> HTTP %{http_code}\n' -u "admin:$PW" http://127.0.0.1/

The authenticated request is accepted and returns an HTTP redirect to the app home page (307). This proves that the credential works while unauthenticated access is refused.

7

Open the web UI

Open http://<vm-ip>/ in your browser. Your browser prompts for the Basic auth credential. Enter the username admin and the password from /root/lowdefy-credentials.txt. The Lowdefy starter app then loads its welcome page.

Use the header menu to move between the pages. The Getting started page explains how to build your own app.

The Capabilities page summarises what you can build with Lowdefy from configuration alone.

8

Build your own low code app

The app is defined entirely by /opt/lowdefy/lowdefy.yaml. Confirm that the file is present and editable, and that the current build is in place:

sudo test -f /opt/lowdefy/lowdefy.yaml && echo "config present at /opt/lowdefy/lowdefy.yaml"
sudo test -d /opt/lowdefy/.lowdefy/server/.next && echo "current compiled build present"

To build your own app, edit /opt/lowdefy/lowdefy.yaml to add pages, blocks, connections and requests. Then recompile and restart the service:

  • Rebuild: sudo -u lowdefy bash -c 'cd /opt/lowdefy && lowdefy build'
  • Restart: sudo systemctl restart lowdefy

lowdefy build recompiles the configuration into the Next.js server under /opt/lowdefy/.lowdefy/server, and restarting lowdefy.service serves your updated app. See the Lowdefy documentation at docs.lowdefy.com for the block, operator and connection reference.

9

The runtime stack

node -v nginx -v test -f /opt/lowdefy/lowdefy.yaml && echo "config present" test -d /opt/lowdefy/.lowdefy/server/.next && echo "next build present"

Node.js 22 LTS runs the server, and nginx 1.24 fronts it. Both the app configuration and the compiled Next.js server are present on disk.

10

First boot and patch baseline

test -f /var/lib/sac/data/lowdefy-firstboot.done && echo "firstboot: completed"
sudo stat -c '%n perms=%a owner=%U:%G' /etc/nginx/.lowdefy_htpasswd apt-mark showhold

The first-boot marker confirms that the per-VM password and signing secret were provisioned. The nginx Basic auth password file is present and root-owned, and there are no held packages, so the OS security baseline is intact.

11

Change the Basic auth password

Rotate the per-VM password at any time with htpasswd. Run sudo htpasswd /etc/nginx/.lowdefy_htpasswd admin and enter a new password when prompted. To add another user, run sudo htpasswd /etc/nginx/.lowdefy_htpasswd <username>. No nginx reload is needed, because nginx reads the password file on each request. Confirm that the password file is in place and root-owned:

sudo stat -c '%n perms=%a owner=%U:%G' /etc/nginx/.lowdefy_htpasswd
12

Enable HTTPS

nginx already fronts Lowdefy on port 80 and is ready for TLS. Point a DNS record at your VM, then obtain a certificate with certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> --agree-tos -m <your-email> --redirect

certbot installs the certificate, rewrites the nginx server block for TLS and sets up automatic renewal. Your app is then served over HTTPS with Basic auth in front.

Managing the service

sudo systemctl status lowdefy --no-pager | head -n 6
sudo journalctl -u lowdefy -n 15 --no-pager

Restart the server with sudo systemctl restart lowdefy and follow its logs live with sudo journalctl -u lowdefy -f. The Lowdefy server logs to the journal, and nginx logs are under /var/log/nginx/. To back up the instance, snapshot the OS disk or copy /opt/lowdefy while the service is stopped.

Support

SecureAnyCloud provides 24/7 support for this image by email and live chat. Support covers deployment, nginx TLS termination, Basic auth and optional Lowdefy authentication providers, upgrades, and building your Lowdefy configuration. Email sales@secureanycloud.com.

This is a repackaged open source software product with additional charges for SecureAnyCloud support services. Lowdefy is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Lowdefy on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure