Medusajs

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B4ms (4 vCPU / 16 GiB RAM) is a good starting size for the build and the admin dashboard.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the admin dashboard and API. For public exposure, put TLS in front of the VM as described in Enabling HTTPS.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Medusa by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:medusajs-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name medusa \
  --image sac1647283583153:medusajs-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name medusa --port 80 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH as azureuser:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that all four services are active:

systemctl is-active medusa.service nginx.service postgresql.service redis-server.service

All four services report active. On first boot, Medusa rotates its secrets and database password, creates the admin user and starts serving the dashboard.

Step 5 - Retrieve your admin credentials

The first boot of your VM generates a unique admin password and writes it to a root-only file. Read the file with sudo:

sudo cat /root/medusajs-credentials.txt

The file contains medusa.admin.email (admin@sac.local) and medusa.admin.pass. Store the password somewhere safe.

Step 6 - Check the health endpoint

Medusa exposes a liveness endpoint that returns 200 when the backend is ready. Query it from the VM:

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/health

Step 7 - Open the admin dashboard

Browse to http://<vm-public-ip>/app and sign in with admin@sac.local and the password from Step 5.

The dashboard opens on the orders overview, your starting point for running the store.

Manage your catalogue from Products. There you can create products, variants, prices and inventory, all served through the commerce API.

Configure regions, currencies, sales channels, API keys and users under Settings.

Step 8 - Authenticate against the admin API

Medusa issues an admin JWT from /auth/user/emailpass. Request a token to confirm that the generated credentials work:

curl -s -H 'Content-Type: application/json' --data '{"email":"admin@sac.local","password":"<MEDUSA_ADMIN_PASSWORD>"}' http://localhost/auth/user/emailpass | head -c 80; echo

A successful login returns a JSON object that contains a "token". Use that bearer token to call the admin API.

Step 9 - Use the commerce API

Medusa serves the store and admin APIs on the same port 80. The store API is published under /store and the admin API under /admin.

For example, list products from the admin API with the token from Step 8:

TOKEN=$(curl -s -H 'Content-Type: application/json' \
  --data '{"email":"admin@sac.local","password":"<password>"}' \
  http://<vm-public-ip>/auth/user/emailpass | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')
curl -H "Authorization: Bearer ${TOKEN}" http://<vm-public-ip>/admin/products

To access the storefront /store endpoints, create a publishable API key under Settings -> Publishable API Keys in the dashboard.

Step 10 - Confirm data lives on the dedicated disk

The PostgreSQL database and uploaded media live on the dedicated Azure data disk, so they survive OS changes and can be resized independently. Confirm the mount:

findmnt /var/lib/medusa

A separate Azure data disk backs the mount. It is captured into the image and re-provisioned on every VM.

Enabling HTTPS

The nginx reverse proxy serves plain HTTP on port 80. For public exposure, put a certificate in front of it. Add a DNS name for the VM and install certbot, or use the companion SecureAnyCloud nginx-ssl-certbot image as a TLS reverse proxy.

Keep Medusa bound to loopback (127.0.0.1:9000) so the only public surface is the TLS-terminated proxy. Set MEDUSA_BACKEND_URL and the CORS values in /opt/medusa/medusa-app/.env to your HTTPS address, then restart Medusa.

Maintenance

• Backups. Snapshot the /var/lib/medusa data disk, or use pg_dump medusa_store, to back up the database and media.
• Database. PostgreSQL 16 runs locally with its data directory on the data disk. Redis 7 backs the event bus, cache and workflow engine.
• Service. Run sudo systemctl restart medusa after configuration changes. Read the logs with journalctl -u medusa.
• Security patches. Unattended upgrades stay enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. For questions or help with your deployment, contact sales@secureanycloud.com.

Deploy on Azure

Launch Medusa.js on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com