Memos

Secure by default - you create the host account

Memos has no default administrator, and this image does not bake one in. The image ships at Memos' built-in first-run sign-up form.

The first time you browse to your VM, you create your own host (administrator) account with your own username and password. No shared credentials and no database rows ship in the image, so every VM starts as a clean slate that only you secure.

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting size. Scale up for many users or large upload volumes.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp from wherever you browse Memos. For public exposure, put TLS in front of port 80 (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Memos by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, create the VM, then open port 80.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:memos-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name memos \
  --image sac1647283583153:memos-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name memos --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

When you connect, the message of the day shows your VM's sign-up URL.

Step 4 - Confirm the services are running

Memos runs as two systemd units, the Go server and nginx. Check that both are active:

systemctl is-active memos.service nginx.service

Both report active. The Memos server listens only on the loopback interface, and nginx is the only service bound to a public port:

ss -tlnp | grep -E ':80 |:5230 '

LISTEN 0 4096 127.0.0.1:5230 0.0.0.0:* users:(("memos",pid=2800,fd=8)) LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=2811,fd=5),...) LISTEN 0 511 [::]:80 [::]:* users:(("nginx",pid=2811,fd=6),...)

The Memos server also serves a health endpoint, which nginx proxies, for monitoring:

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/healthz

200

Step 5 - Read the per-VM info file

The image ships no credentials. On first boot, the VM writes a root-only info file that contains your VM's sign-up URL:

sudo cat /root/memos-credentials.txt

The MEMOS_URL value is the address where you create your host account.

Step 6 - First visit: create your host account

Open Memos in your browser:

http://<vm-public-ip>/

The Create your account sign-up form opens. Enter a username, choose a strong password and select Sign up. Because the database is empty, this first account automatically becomes the Site Host (administrator).

That single step secures your VM. You are signed straight in, and the sign-up form never appears again for this VM. Later visits show the sign-in page.

Enable HTTPS before you expose the VM to the public internet (see Enabling HTTPS with Let's Encrypt below). Until then, treat the password you set here as a credential sent over plain HTTP.

Capturing memos

From the home timeline, type into the editor at the top. Memos uses Markdown, so headings, bold text, lists and task checklists all render. Add #tags inline to organise your notes, and use the tags in the sidebar for quick filtering. Set each memo's visibility (Private, Protected or Public) and select Save.

Your memos appear in a reverse-chronological timeline with a calendar heat-map and a tag list. Use the search box to find memos by content. Use the Explore view to browse memos you have marked Public.

Workspace settings

Open Settings from the user menu to manage your account, preferences, members, storage, notifications, SSO, webhooks and access tokens.

The My Account page is where you change your password and create personal access tokens for the Memos API. The Admin sections let the Site Host tune the workspace.

Step 7 - Confirm the runtime

Print the installed Memos version:

/usr/local/bin/memos version

0.29.1

The data disk

The Memos SQLite database (memos_prod.db), uploads and resources live on a dedicated Azure data disk mounted at /var/lib/memos. The disk is independently resizable and separate from the OS disk. Confirm the mount:

df -h /var/lib/memos

Filesystem Size Used Avail Use% Mounted on /dev/sda 30G 1.1M 28G 1% /var/lib/memos

The device letter can vary between boots. The mount is keyed by filesystem UUID, so /var/lib/memos is always the dedicated data disk.

The disk is mounted by its filesystem UUID in /etc/fstab, so the mount is stable across reboots. To grow it, resize the data disk in the Azure portal, then extend the filesystem with sudo resize2fs against the device shown by lsblk. Snapshot the data disk in Azure to back up your notes.

Security updates

The image is patched at build time, including Ubuntu phased updates, and unattended-upgrades stays enabled. Security patches therefore keep flowing on your VM:

apt-mark showhold; systemctl is-enabled unattended-upgrades.service

enabled

Enabling HTTPS with Let's Encrypt

For production use, terminate TLS at nginx. Point a DNS A record at the VM's public IP and open 443/tcp in the NSG. Then install certbot and follow its prompts, which edit the nginx site for you. Substitute your own domain and email address for the example values:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com -m you@example.com --agree-tos

certbot configures the HTTPS server block and sets up automatic renewal. After it completes, Memos is available at https://your-domain.example.com/. For the cleanest links, also set the Instance URL in the Memos workspace settings to your HTTPS address.

Upgrading Memos

Memos is installed as a single Go binary at /usr/local/bin/memos. To upgrade within the 0.x line, download the new release's memos_<version>_linux_amd64.tar.gz from the official GitHub releases, replace the binary and restart the service.

Snapshot the data disk first, because the schema migrates on start. SecureAnyCloud support can assist with planning and performing upgrades.

Support

This image is backed by 24/7 SecureAnyCloud support covering deployment, upgrades, integrations, TLS termination and database administration. Contact us by email or chat.

Memos is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Memos on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Secure by default - you create the host account

Memos has no default administrator, and this image does not bake one in. The AMI ships at Memos' built-in first-run sign-up form.

The first time you browse to your instance, you create your own host (administrator) account with your own username and password. The form confirms this with the message "You are registering as the Site Host." No shared credentials and no database rows ship in the image, so every instance starts as a clean slate that only you secure.

Connecting to your instance

Connect over SSH on port 22 with the EC2 key pair you launched with. On the Ubuntu 24.04 image, the SSH login user is ubuntu:

ssh -i your-key.pem ubuntu@<instance-public-ip>

Replace <instance-public-ip> with your instance's public IPv4 address, or with its private address if you reach it over a VPN or Direct Connect.

First visit - create your host account

Open Memos in your browser:

http://<instance-public-ip>/

The Create your account sign-up form opens. Enter a username, choose a strong password and select Sign up. Because the database is empty, this first account automatically becomes the Site Host (administrator).

That single step secures your instance. You are signed straight in, and the sign-up form never appears again for this instance. Later visits show the sign-in page.

Enable HTTPS before you expose the instance to the public internet (see Enabling HTTPS with Let's Encrypt below). Until then, treat the password you set here as a credential sent over plain HTTP.

Capturing memos

From the home timeline, type into the editor at the top. Memos uses Markdown, so headings, bold text, lists and task checklists all render. Add #tags inline to organise your notes, and use the tags in the left sidebar for quick filtering. Set each memo's visibility (Private, Protected or Public) and select Save.

Your memos appear in a reverse-chronological timeline with a calendar heat-map and a tag list in the sidebar. Use the search box to find memos by content. Use the Explore view to browse memos you have marked Public.

Workspace settings

Open Settings from the user menu to manage your account, preferences, members, storage, notifications, SSO, webhooks and access tokens.

The My Account page is where you change your password and create personal access tokens for the Memos API. The Admin sections let the Site Host tune the workspace.

Managing the services

Memos runs as two systemd units, the Go server and nginx. Check their status:

systemctl status memos nginx

The Memos server listens only on the loopback interface, and nginx is the only service bound to a public port:

ss -tlnp | grep -E ':80 |:5230 '

LISTEN 0 4096 127.0.0.1:5230 0.0.0.0:* users:(("memos",...)) LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",...))

The Memos server also serves a health endpoint, which nginx proxies, for monitoring:

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/healthz

200

The data volume

The Memos SQLite database (memos_prod.db), uploads and resources live on a dedicated EBS volume mounted at /var/lib/memos. The volume is independently resizable and separate from the OS disk. Confirm the mount:

df -h /var/lib/memos

Filesystem Size Used Avail Use% Mounted on /dev/nvme1n1 30G ... ...% /var/lib/memos

The volume is mounted by its filesystem UUID in /etc/fstab, so the mount is stable across reboots and instance re-launches. To grow it, resize the EBS volume in the AWS console, then run sudo resize2fs /dev/nvme1n1, substituting the device shown by lsblk. Back up /var/lib/memos, or snapshot the EBS volume, to protect your notes.

Enabling HTTPS with Let's Encrypt

For production use, terminate TLS at nginx. Point a DNS A record at the instance's public IP, then install certbot:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx

Run certbot interactively and follow its prompts, which edit the nginx site for you. Substitute your own domain and email address for the example values:

sudo certbot --nginx -d your-domain.example.com -m you@example.com --agree-tos

certbot configures the HTTPS server block and sets up automatic renewal. After it completes, Memos is available at https://your-domain.example.com/. Make sure your security group allows inbound TCP 443. For the cleanest links, also set the Instance URL in the Memos workspace settings to your HTTPS address.

Upgrading Memos

Memos is installed as a single Go binary at /usr/local/bin/memos. To upgrade within the 0.x line, download the new release's memos_<version>_linux_amd64.tar.gz from the official GitHub releases, replace the binary and restart the service.

Snapshot the data volume first, because the schema migrates on start. SecureAnyCloud support can assist with planning and performing upgrades.

Support

This Amazon Machine Image is provided by SecureAnyCloud with 24/7 technical support covering deployment, upgrades, integrations, TLS termination and database administration. Contact us through your AWS Marketplace seller support channel.

Memos is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com