SecureAnyCloud
Deployment guide

Mayfly-Go

Overview

Mayfly-Go is an open-source, web-based platform that gives DevOps and operations teams a single audited entry point to their infrastructure. From one console, it manages SSH and RDP hosts, relational and non-relational databases (MySQL, PostgreSQL, SQLite and more), Redis, MongoDB, Elasticsearch and Kubernetes.

It includes a built-in web terminal, a file manager, per-resource authorization, approval workflows and full audit logging of every session and command.

The SecureAnyCloud image installs Mayfly-Go v1.11.5 from the official release archive (sha256 verified) as a single hardened Go service, backed by a self-contained SQLite datastore. A production-grade DevOps bastion is online within a minute or two of launch, with no external database to provision.

What you get:

  • Mayfly-Go v1.11.5 (Apache-2.0) installed from the official release archive, pinned and sha256 verified, so the image never silently changes at build time
  • A self-contained SQLite metadata datastore, with no external MySQL or PostgreSQL to run
  • One systemd service, mayfly-go.service, which serves the web console on port 18888 under a dedicated, unprivileged mayfly system user
  • Secure by default: no default login ships in the image. A unique administrator password, a per-VM JWT signing secret and a per-VM AES encryption key (which protects the credentials you store for managed resources) are generated on the first boot of every VM and written to a root-only file
  • Full OS security patching applied at build time, with Ubuntu unattended security updates left enabled for the running image
  • 24/7 SecureAnyCloud support

Deploying on Azure

  • Launch the image from the Azure Marketplace. The recommended size is Standard_B2s (2 vCPU / 4 GB) or larger.
  • In the Network Security Group of the VM, add an inbound rule that allows TCP port 18888 from your administrative IP range. This is the Mayfly-Go web console. Keep SSH (port 22) restricted to your own IP as well.
  • Allow the VM a minute to complete first boot. This is when your unique admin password and encryption keys are generated.

Retrieve your first-boot credentials

Every VM generates its own administrator password and encryption keys on first boot and writes them to a root-only file. Connect over SSH and read them:

sudo cat /root/mayfly-go-credentials.txt

The output shows your unique dashboard URL, the admin username (admin) and the per-VM password. The file is 0600 root:root. The jwt.key and aes.key values in /opt/mayfly-go/config.yml are likewise unique to this VM:

Verify the service

Confirm that the console service is active, first boot has completed and the login page is served on port 18888:

systemctl is-active mayfly-go.service test -f /var/lib/sac/data/mayfly-go-firstboot.done && echo "first boot: complete" curl -s -o /dev/null -w 'login page: HTTP %{http_code}\n' http://127.0.0.1:18888/

Sign in

Browse to http://<your-vm-ip>:18888/ and sign in with username admin and the password from your credentials file.

After you sign in, the console home opens. It shows your account, the last login IP and time, recent operations and quick access to every module. Each page carries the built-in session watermark of Mayfly-Go for audit.

Manage your resources

Open Resource > Machine to reach the resource console. From here, you add the SSH and RDP hosts, databases, Redis, MongoDB and Kubernetes clusters that you want to manage.

The image ships with zero managed hosts, and no target is ever wired up with a baked credential. The console below shows an example SSH host that was added to illustrate the workflow.

Once a host is added, you can open a browser-based web terminal, transfer files and run database queries. Mayfly-Go mediates all of these through its per-resource authorization and records them in its audit log. Credentials that you enter for a managed resource are encrypted with the AES key of this VM before they are stored.

Audit every operation

Every action an operator takes is recorded in System > Operation Log. This includes each sign-in, host connection and command. Each entry shows the operator, time, description, result and source IP, and every console page carries a per-session watermark.

This audit trail makes Mayfly-Go a controlled, accountable entry point to your infrastructure rather than shared, unaudited access. To change your own password and manage your profile, open Personal Center in the top-right user menu.

Security posture

The image is secure by default. The upstream demo credential (admin / admin123) is not present. The admin password is rotated to a unique per-VM value on first boot, so the published default is rejected. There is a single built-in account, and the login brute-force lockout (5 failed attempts per 10 minutes) is retained:

sudo sqlite3 /opt/mayfly-go/data/mayfly-go.db "SELECT count(*) FROM t_sys_account;"

The login image captcha is disabled by default so that the appliance can be integrated and automated. You can re-enable it, and enable OTP two-factor authentication, under System > System Config in the console.

Security patching

The image is fully patched at build time and keeps Ubuntu unattended security updates enabled, so the running VM continues to receive security fixes. Confirm the status:

systemctl is-active mayfly-go-firstboot.service
systemctl is-enabled unattended-upgrades.service uname -r

Support

SecureAnyCloud builds and maintains this image and provides 24/7 support. If you need help deploying or operating Mayfly-Go, contact us at sales@secureanycloud.com.

Deploy on Azure

Launch Mayfly-Go v1.11.5 DevOps Bastion Platform on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure