MiroTalk SFU

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a reasonable starting size for small meetings. Choose a larger size for more participants and rooms. A public IP is required so that WebRTC media can reach remote browsers.

Configure these network security group (NSG) inbound rules. All of them are required for a working meeting:

• 22/tcp from your management network (SSH)
• 80/tcp and 443/tcp (the web console and Socket.IO signaling)
• 40000-40100/udp (mediasoup WebRTC media; audio and video will not connect without this range open)

The appliance ships a self-signed certificate. For production, put your own domain and a trusted certificate (for example Let's Encrypt) in front of it (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for MiroTalk SFU by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80) and HTTPS (443).

Review the dedicated data disk on the Disks tab, then select Review + create and Create. After the VM is created, add an inbound NSG rule for UDP 40000-40100 (see Step 3) so media can flow.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:mirotalk-sfu-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name mirotalksfu \
  --image sac1647283583153:mirotalk-sfu-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name mirotalksfu --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name mirotalksfu --port 443 --priority 1020

Step 3 - Open the mediasoup media ports (required)

WebRTC media uses a bounded UDP range that participants' browsers must be able to reach. Open 40000-40100/udp on the VM's network security group:

az network nsg rule create \
  --resource-group <your-rg> \
  --nsg-name <your-nsg> \
  --name Allow-MiroTalk-Media \
  --priority 1030 \
  --direction Inbound --access Allow --protocol Udp \
  --destination-port-ranges 40000-40100 \
  --source-address-prefixes '*'

Without this rule the web console still loads and hosts can sign in, but audio and video will fail to connect.

Step 4 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 5 - Confirm the services and media ports

systemctl is-active mirotalksfu.service nginx.service

Both services report active. MiroTalk SFU handles signaling on the loopback port 3010. nginx fronts it with TLS on port 443, including the Socket.IO WebSocket upgrade. The mediasoup media engine binds a set of UDP ports inside 40000-40100.

The per-VM configuration and recordings live on the dedicated Azure data disk mounted at /var/lib/mirotalksfu.

Step 6 - Confirm the announced public IP

WebRTC needs a routable address. On first boot, the appliance detects this VM's public IP and writes it into the media configuration as announcedIp. Confirm that it matches the VM's live public IP:

sudo grep -E '^(SFU_SERVER|SFU_ANNOUNCED_IP|SFU_MIN_PORT|SFU_MAX_PORT|HOST_PROTECTED)=' /var/lib/mirotalksfu/.env

SFU_ANNOUNCED_IP should equal your VM's public IP address. SFU_MIN_PORT and SFU_MAX_PORT bound the media range to 40000-40100. HOST_PROTECTED=true shows that host login is enforced.

If you later reassign the VM's public IP, restart the first boot service to re-detect it: sudo rm -f /var/lib/sac/data/mirotalksfu-firstboot.done && sudo systemctl restart mirotalksfu-firstboot.service.

Step 7 - Confirm the health endpoints

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/healthz
curl -sk https://localhost/healthz

Both return ok. Port 80 returns HTTP 301 and redirects to HTTPS. Because host protection is enabled, the root of the site over HTTPS returns HTTP 302 and redirects to the /login page.

The /healthz endpoint never requires authentication, so you can use it for an Azure Load Balancer health probe.

Step 8 - Retrieve your host password

The MiroTalk SFU host password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/mirotalksfu-credentials.txt

The file contains MIROTALK_USERNAME (always admin), MIROTALK_PASSWORD and the URL to open. It is mode 0600 and owned by root, so only an administrator can read it. Store the password somewhere safe.

Step 9 - Verify the host login from the command line

The MiroTalk SFU login is a JSON request over the TLS edge that returns a host token on success. The check below authenticates with the correct per-VM password. A wrong password returns HTTP 401.

The command embeds your unique password, so run it interactively rather than from a script. Substitute the value of MIROTALK_PASSWORD from Step 8 for <MIROTALK_PASSWORD>:

curl -sk -o /dev/null -w 'host login -> HTTP %{http_code}\n' \
  -H 'Content-Type: application/json' \
  --data '{"username":"admin","password":"<MIROTALK_PASSWORD>"}' \
  https://127.0.0.1/login

The correct per-VM password prints host login -> HTTP 200, and the server returns a host token. A wrong password returns HTTP 401. The Socket.IO signaling endpoint upgrades to a WebSocket through nginx, so real-time messaging works over the same TLS edge.

Step 10 - Sign in as the host

Browse to https://<vm-public-ip>/. The appliance uses a self-signed certificate, so accept the browser warning. For production, put your own domain and certificate in front instead (see Maintenance).

Because host protection is enabled, the site takes you to the sign-in page. Enter the username admin and the password from Step 8.

Step 11 - Start a room

After you sign in, name a room and start a conference. Type a room name, or generate a random one, and select Join Room. Share the room URL with participants. They join straight from their browser with no app to install.

Step 12 - Choose your camera and microphone

Before you enter the room, MiroTalk SFU shows a camera preview, a device picker for camera, microphone and speakers, and the in-call controls for video, audio and screen sharing. Confirm your devices and select Join meeting.

Step 13 - In the meeting

Inside the room, you see the participant video grid and a control bar. Use it to mute audio and video, share your screen, open the group chat, raise a hand, record and invite others. Select Share the room to invite people by link or QR code.

Step 14 - Confirm data lives on the dedicated disk

MiroTalk SFU stores its per-VM state under /var/lib/mirotalksfu on the dedicated Azure data disk. This state includes the environment file that holds the host password, the announced IP and the application secrets, plus any recordings. Because it sits on its own disk, it survives OS changes and can be resized independently:

findmnt /var/lib/mirotalksfu

The mount is backed by a separate Azure data disk that is captured into the image and re-provisioned on every VM.

Maintenance

• Host password. The host password is set on first boot and stored in /root/mirotalksfu-credentials.txt. To rotate it, edit HOST_USERS in /var/lib/mirotalksfu/.env (format admin:<password>:Admin:*) and restart mirotalksfu.service.
• Media and announced IP. WebRTC media needs the VM's public IP reachable on UDP 40000-40100. If you reassign the public IP, clear the first boot marker and restart the first boot service so the new address is re-detected: sudo rm -f /var/lib/sac/data/mirotalksfu-firstboot.done && sudo systemctl restart mirotalksfu-firstboot.service.
• TLS and your own domain. The appliance ships a per-VM self-signed certificate on port 443. For production, point a DNS name at the VM and install a trusted certificate (for example with certbot / Let's Encrypt) in the nginx site at /etc/nginx/sites-available/sac-mirotalksfu, then reload nginx.
• Configuration. All settings are environment variables in /var/lib/mirotalksfu/.env (documented in /opt/mirotalksfu/app/src/config.js). Change a value and restart mirotalksfu.service.
• Recording. Server-side recording is off by default. Enable it by setting RECORDING_ENABLED=true in the environment file. Recordings are written under the data disk.
• Storage. All per-VM state lives under /var/lib/mirotalksfu on the data disk. Back up that volume to protect your configuration and recordings.
• Security patches. unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Licensing

MiroTalk SFU is distributed under the GNU Affero General Public License v3.0 (AGPL-3.0). The AGPL includes a network use clause: if you modify the MiroTalk SFU source and offer it to users over a network, you must make your modified source available to those users.

SecureAnyCloud ships the pinned upstream MiroTalk SFU source unmodified, together with appliance packaging (systemd units, the nginx front end and the first boot configuration). Review the AGPL-3.0 terms before you modify the application for a public service.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch MiroTalk SFU on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com