Mercator

Search the Azure Marketplace for Mercator, select the SecureAnyCloud publisher, and click Create. Choose Standard_B2s or larger.

Configure the network security group to allow TCP 80 for the application from your own networks, and TCP 22 for administration from your administrative networks only. The database and the PHP runtime stay on loopback and are never exposed.

RG="mercator-prod"; LOCATION="eastus"; VM_NAME="mercator" IMAGE_URN="sac1647283583153:mercator-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:mercator-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 80 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

On first boot the image generates this VM's application key, database password and administrator password, and creates the database schema. It rotates the seeded administrator to your per-instance password, opens the bootstrap gate and starts the web server. It then verifies that the new credentials work and the defaults are rejected, and writes /root/mercator-credentials.txt. This completes within a minute or two.

SSH in as azureuser and read the details:

sudo cat /root/mercator-credentials.txt

The file is mode 0600 and owned by root, so only a privileged user can read it. It contains the instance URL, the administrator login and password, and the database name, user and password.

Run the commands below. All three services should report active. The ss output confirms that the application listens on port 80 while MariaDB is bound to loopback only, and the response headers carry no server version banner.

systemctl is-active mariadb.service php8.4-fpm.service nginx.service php -r 'echo "PHP ".PHP_VERSION."\n";' mysql --version nginx -v dot -V ss -tlnp | grep -E ':(80|3306) ' | sed 's/users:.*//' | sort curl -sI http://127.0.0.1/login | head -4

Browse to http://<your-vm-public-ip>/. Mercator redirects you to the sign-in page. Enter the login admin@admin.com and the password from the credentials file.

You can verify the same sign-in from the command line. The script uses the per-instance password from the credentials file to complete a real login through the form. It then checks that the seeded default and other common passwords are refused:

sudo /usr/local/sbin/mercator-login-check.sh admin@admin.com '<MERCATOR_ADMIN_PASSWORD>' && echo "per-VM password: ACCEPTED (correct)"
sudo /usr/local/sbin/mercator-login-check.sh admin@admin.com 'password' || echo "admin@admin.com/password: REJECTED (correct)"
sudo /usr/local/sbin/mercator-login-check.sh admin@admin.com '' || echo "blank password: REJECTED (correct)"

After you sign in, you land on the dashboard. The left navigation holds the whole cartography model, grouped into views: the GDPR view, the Ecosystem view, the Business view of the information system, the Applications view, the Administration view, and the views of logical and physical infrastructure.

The main panel shows the maturity levels of your cartography and a breakdown by domain. Both start at zero on a fresh instance and fill in as you record your estate.

Set your own password as soon as you have signed in. Open Preferences in the top bar, choose your profile, and use the change password form. Enter the per-instance password from the credentials file as the current password, then choose a new one.

Mercator stores passwords as bcrypt hashes, so the new password cannot be recovered from the database. After the change, the administrator password in /root/mercator-credentials.txt is out of date. Keep the file for the database password, or remove the administrator password line from it.

Cartography starts with the inventory. Open Applications view > Applications and click the add button. Give the application a name. When you have them, link the entities, processes, application services, databases and logical servers it depends on. Save it, and it appears in the application inventory.

Every layer of the model works the same way. Record your entities and processes in the business view, your logical and physical servers in the infrastructure views, and your networks and equipment in the ecosystem view. Each object can be linked to the others, and those links are what the diagrams draw.

Diagrams are the core of Mercator. Open Applications view > Applications cartography. Mercator renders the applications you have recorded as a diagram drawn by Graphviz, with the relationships between them as edges.

Use the Rendu selector to switch between the Graphviz layout engines (dot, fdp, osage, circo) and pick the layout that reads best for your estate. You can export the diagram.

The other views generate their own diagrams the same way: the ecosystem map, the network map and the physical infrastructure map. As your inventory grows, the cartography grows with it.

Open the Tools and report menus. Mercator scores the maturity of your cartography against its model and produces reports you can use in an audit or a steering committee.

The maturity gauges on the dashboard (Step 6) summarise the same data. As you record more of your estate and link the objects together, the maturity levels rise. This gives you a measurable picture of how complete and current your cartography is.

A fresh instance has no working mail transport, so password reset email is not delivered until you configure one. Edit the MAIL_ values in /var/www/mercator/.env to point at your SMTP server: MAIL_HOST, MAIL_PORT, MAIL_USERNAME, MAIL_PASSWORD and MAIL_FROM_ADDRESS. Then clear the cached configuration:

sudo -u www-data php /var/www/mercator/artisan config:clear

Leave the file's ownership and permissions unchanged. It is root:www-data with mode 0640 on purpose, because it holds this VM's application key and database password.

Mercator can authenticate against your own directory. LDAP and Keycloak both ship disabled in this image.

To enable LDAP, set LDAP_ENABLED=true in /var/www/mercator/.env. Then fill in LDAP_HOST, LDAP_PORT, the bind LDAP_USERNAME and LDAP_PASSWORD, and LDAP_USERS_BASE_DN for your directory. Set LDAP_FALLBACK_LOCAL=true to keep local logins working alongside LDAP.

To enable Keycloak single sign-on, set KEYCLOAK_ENABLED=true and fill in KEYCLOAK_CLIENT_ID, KEYCLOAK_CLIENT_SECRET, KEYCLOAK_BASE_URL, KEYCLOAK_REALM and KEYCLOAK_REDIRECT_URI.

After editing .env, clear the cached configuration:

sudo -u www-data php /var/www/mercator/artisan config:clear

Point a DNS A record at the VM's public IP, then set APP_URL in /var/www/mercator/.env to https://your.domain.

For TLS, the simplest option is a certificate from Let's Encrypt with the nginx plugin. The plugin edits the shipped nginx site in place and reloads it. Replace <your-domain> with your fully qualified domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> --redirect --agree-tos -m admin@<your-domain> -n

After certbot has installed the certificate, set APP_FORCE_HTTPS=true in .env and clear the cache, so that every generated URL uses HTTPS.

The image ships no .env, no application key and no database schema, so the seeded default administrator does not exist in it. nginx and php8.4-fpm are gated on a bootstrap marker. First boot writes the marker only after your per-instance secrets exist and the seeded administrator has been rotated. Until then, systemd skips the serving units and nothing is reachable.

Run the following to inspect the gate and the enabled units:

grep -E 'ConditionPathExists|After=' /etc/systemd/system/nginx.service.d/sac-bootstrap-gate.conf ls -l /var/lib/sac/data/ systemctl is-enabled php8.4-fpm.service nginx.service mercator-firstboot.service

The document root is the Laravel public/ directory and nothing above it, and only the front controller executes PHP. To confirm that nothing above public/ is reachable over HTTP, run:

grep -E '^\s+root ' /etc/nginx/sites-available/mercator for p in /.env /config/app.php /vendor/autoload.php /artisan; do printf '%-28s HTTP %s\n' "$p" "$(curl -s -o /dev/null -w '%{http_code}' -m 10 http://127.0.0.1$p)" done curl -s -o /dev/null -w '/login HTTP %{http_code}\n' http://127.0.0.1/login

The whole state of your cartography lives in the MariaDB database and the .env file. Take a consistent dump on a schedule and copy it off the VM, for example to Azure Blob Storage:

TS="$(date +%F-%H%M)" DB_PASS="$(sudo sed -n 's/^mercator.db.password=//p' /root/mercator-credentials.txt)"
sudo mysqldump --single-transaction -u mercator_user -p"$DB_PASS" mercator > "/tmp/mercator-$TS.sql" echo "wrote /tmp/mercator-$TS.sql"

Keep a copy of /var/www/mercator/.env with the backup. It holds the application key that signs your sessions and the database password, so restoring the database without it invalidates existing sessions.

The operating system patches itself through unattended upgrades. For Mercator itself, SecureAnyCloud publishes refreshed images as upstream releases new versions.

The supported upgrade path is to deploy the new image and restore your database into it, which keeps the appliance hardening intact. SecureAnyCloud support can help you plan and carry out an upgrade.