MapStore

Prerequisites

• An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region
• Standard_B2s (2 vCPU / 4 GiB RAM) as a comfortable starting point. MapStore is a single JVM alongside a local PostgreSQL, and upstream's own reference production heap is 512 MiB. Size up if you expect many concurrent users or plan to enable the printing module heavily
• NSG inbound rules that allow 22/tcp from your management network and 80/tcp (and 443/tcp if you add TLS)

MapStore is served over plain HTTP by default. For production, put your own domain and a trusted certificate in front of it (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for MapStore by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab. Then choose Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:mapstore:default:latest
az vm create \
  --resource-group <your-rg> \
  --name mapstore \
  --image sac1647283583153:mapstore:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

After the VM is created, open port 80 so you can reach the web interface.

az vm open-port --resource-group <your-rg> --name mapstore --port 80 --priority 900

Step 3 - Connect to your VM

Connect over SSH as azureuser.

ssh azureuser@<vm-public-ip>

The first boot rotates the admin password and prints a summary to the message of the day. Your first SSH session therefore shows the MapStore URL and where the credentials file lives.

Step 4 - Confirm the services are running

MapStore runs as a systemd service behind nginx, with PostgreSQL as its backend. Confirm all three are active.

systemctl is-active postgresql@16-main.service mapstore.service nginx.service

Confirm Tomcat is bound to the loopback connector only. MapStore is then reachable exclusively through the nginx front end.

ss -tln | grep -E '127.0.0.1:8080|:80 '

Step 5 - Confirm MapStore is answering

Check the deployed version, which is published at /mapstore/version.txt. Also check the unauthenticated health endpoint that nginx serves for load balancer probes.

curl -s http://localhost/mapstore/version.txt
curl -s -o /dev/null -w 'GET /mapstore/ -> HTTP %{http_code}\n' http://localhost/mapstore/
curl -s -o /dev/null -w 'GET /healthz -> HTTP %{http_code}\n' http://localhost/healthz

Step 6 - Retrieve your admin password

Read the per-VM admin password. It is written to a root-only file at /root/mapstore-credentials.txt (mode 0600).

sudo cat /root/mapstore-credentials.txt

Confirm the published default logins are rejected. MapStore seeds both admin / admin and user / user in its source. This image rotates the first and deletes the second. Each is rejected with HTTP 401, while your per-VM password authenticates with HTTP 200.

MS=http://localhost/mapstore for p in admin:admin user:user; do code=$(curl -s -o /dev/null -w '%{http_code}' -XPOST -u $p $MS/rest/geostore/session/login) printf '%-16s -> HTTP %s\n' "$p" "$code" [ "$code" = "401" ] || { echo "UNEXPECTED: $p was not rejected"; exit 1; } done code=$(curl -s -o /dev/null -w '%{http_code}' -XPOST -u 'admin:<MAPSTORE_ADMIN_PASSWORD>' $MS/rest/geostore/session/login) printf '%-16s -> HTTP %s\n' 'admin:<per-VM>' "$code" [ "$code" = "200" ] || { echo "FAILED: the per VM admin password did not authenticate"; exit 1; }

Step 7 - Query the map catalogue over the REST API

MapStore stores maps, dashboards and GeoStories as resources in its GeoStore backend. List the maps your server is holding, and confirm the preloaded sample map is present.

MS=http://localhost/mapstore curl -s -u 'admin:<MAPSTORE_ADMIN_PASSWORD>' -H 'Accept: application/json' \
  "$MS/rest/geostore/extjs/search/category/MAP/*?start=0&limit=5" | python3 -m json.tool

The response reports "success": true and a totalCount of at least 1, with the preloaded Welcome to MapStore map listed.

Step 8 - Confirm your data lives on the dedicated disk

Both the PostgreSQL cluster and MapStore's data directory sit on the dedicated Azure data disk. Your maps and accounts are therefore decoupled from the OS disk, and you can resize or snapshot the disk independently. Check the mount and the cluster.

df -h /var/lib/mapstore | tail -2 pg_lsclusters

Step 9 - Open MapStore in your browser

Browse to http://<vm-public-ip>/mapstore/. The homepage is MapStore's resource catalogue, which lists the maps, dashboards and GeoStories available to you.

Step 10 - Sign in

Select the user icon at the top right and choose Login. Sign in as admin with the password from Step 6: the one generated for this VM.

Once you are signed in, the catalogue shows the resources you own. It also gives you the Add Resource action for creating new maps, dashboards and GeoStories.

Step 11 - Open the sample map

Open the Welcome to MapStore card. The map renders immediately with an OpenStreetMap background and a set of sample points. The scale bar, coordinate readout and zoom controls are all live.

Step 12 - Explore the layer tree

Open the layers panel from the icon at the top left. The sample map ships with an offline vector layer of sample points that renders without contacting any external service. You can therefore confirm the map engine works even on a locked-down network.

Step 13 - Connect your own OGC services

MapStore's value is consuming your own spatial data. Open the Catalog panel from the map toolbar to add a service. Choose the service type (WMS, WFS, WMTS or CSW), give it a name and paste its URL, for example your own GeoServer at https://your-geoserver.example.com/geoserver/wms.

Search the catalogue and add any layer it advertises straight onto the map. Then save the map so it is available to your users.

If you also need to publish your own geospatial data over OGC services, SecureAnyCloud's GeoServer image pairs with this one. MapStore is the portal your users see, and GeoServer is the server that publishes the layers.

Maintenance

Add TLS. MapStore is served over plain HTTP on port 80 by default. For production, point a DNS name at the VM and terminate TLS in nginx, for example with Certbot. The interface is then served over HTTPS on port 443.

Back up the database and data directory. Everything that matters lives on the dedicated data disk at /var/lib/mapstore. The PostgreSQL cluster under pgdata/ holds every map, dashboard, GeoStory and user account, and datadir/ holds the configuration overrides. To preserve both, snapshot the data disk or take a logical backup with sudo -u postgres pg_dump geostore.

Move the database off the VM. The image runs PostgreSQL locally, which suits a self-contained deployment. To point MapStore at an external server such as Azure Database for PostgreSQL, edit the connection settings in /var/lib/mapstore/datadir/geostore-datasource-ovr.properties and restart mapstore.service. Migrate your existing content first with pg_dump and pg_restore, so your maps and accounts come with you. PostGIS is not required, because MapStore stores map documents, not geometry.

Keep the admin password safe. The per-VM password is in /root/mapstore-credentials.txt (root only). Change it at any time from Manage accounts in the user menu.

Outbound connections. The shipped sample map draws its background from OpenStreetMap's public tile service, and MapStore's interface loads a web font from Google Fonts. Both are outbound only. If your VM has no internet egress, the offline vector layer still renders. You can set any background you prefer in the map configuration.

Updates. The image ships with unattended security upgrades enabled for the operating system. To upgrade MapStore itself, follow the project's release notes. Keep your data directory and database, which are external to the application, when you do.

Support

Every SecureAnyCloud image is backed by 24/7 support. If you have any questions about deploying or operating MapStore on Azure, contact the SecureAnyCloud team.

Deploy on Azure

Launch MapStore 2026.02 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com