NethServer 8 on Alma 9

In the Azure Portal, go to Marketplace, search for NethServer 8, and select the SecureAnyCloud publisher entry. Choose Create.

On the Basics tab, choose your subscription, target resource group and region, and set the virtual machine name. Choose SSH public key as the authentication type, set the username to azureuser, and paste your SSH public key. Standard_B2s (2 vCPU / 4 GiB) is the supported minimum for the NethServer 8 core and comfortably runs the console and a small number of applications. For heavier applications (mail, groupware, file sharing), choose Standard_B2ms (2 vCPU / 8 GiB) or larger.

On the Disks tab, select Standard SSD for the OS disk. Application containers and their data live under /home and /var/lib/nethserver. The image provisions a 64 GB OS disk, which clears NethServer's 40 GB minimum. Attach and grow storage if you plan to run data-heavy applications.

On the Networking tab, select your existing virtual network and subnet. Attach a network security group that opens TCP 22 from your management IP range and TCP 443 from the client IPs that need the console. Do not expose the console to the entire public internet until you have replaced the self-signed certificate (Step 9) and reviewed Step 12.

Review and create the VM. When provisioning finishes, note the public IP address on the VM's Overview page.

Run the following commands to create a resource group, open the required ports and launch the image. If the offer and plan URN differs from the one shown on the SecureAnyCloud listing page, replace it with the listed value.

az group create --name nethserver-rg --location eastus
az network nsg create --resource-group nethserver-rg --name nethserver-nsg
az network nsg rule create --resource-group nethserver-rg --nsg-name nethserver-nsg \
  --name allow-ssh --priority 1001 --protocol Tcp --destination-port-ranges 22 \
  --source-address-prefixes "<your-management-ip>/32" --access Allow
az network nsg rule create --resource-group nethserver-rg --nsg-name nethserver-nsg \
  --name allow-https --priority 1002 --protocol Tcp --destination-port-ranges 443 \
  --source-address-prefixes "<your-management-ip>/32" --access Allow
az vm create \
  --resource-group nethserver-rg \
  --name nethserver-vm \
  --image sac1647283583153:nethserver:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --nsg nethserver-nsg \
  --public-ip-sku Standard

If prompted, accept the marketplace image terms once per subscription with az vm image terms accept --urn sac1647283583153:nethserver:default:latest.

On the first boot, nethserver-firstboot.service creates the single-node cluster, rotates the cluster-admin password to a value unique to this VM, and writes it to /root/nethserver-credentials.txt (mode 0600, root only). Connect over SSH as azureuser and read the file:

ssh azureuser@<public-ip>
sudo cat /root/nethserver-credentials.txt

The file looks like this (the password is unique to your VM):

# NethServer 8 — generated on first boot. These credentials are unique to this
# VM. Store them somewhere safe, then log in and change the password if you wish.
# Web console (cluster-admin) console.url=https://<your-vm-public-ip>/cluster-admin/ admin.username=admin admin.password=<unique-to-your-vm>

Confirm the core platform is up and the first-boot service completed:

sudo systemctl is-active nethserver-firstboot.service for u in redis api-server agent@cluster agent@node; do echo "$u.service = $(systemctl is-active $u.service)"; done

Open https://<your-vm-public-ip>/cluster-admin/ in your browser. The console uses a self-signed certificate on first boot, so your browser warns you on the first visit. This is expected, and Step 9 resolves it. NethServer's sign-in is a two-step form: enter the username admin, choose Continue, then enter the per-VM password from /root/nethserver-credentials.txt.

From the command line, you can verify that the web console is healthy, that the per-VM password authenticates, and that the vendor default password is rejected:

curl -sk -o /dev/null -w "cluster-admin console: HTTP %{http_code}\n" https://127.0.0.1/cluster-admin/
curl -sk -X POST http://127.0.0.1:9311/api/login -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"<admin.password>"}' | grep -q '"token"' \
  && echo "per-VM admin login: PASS" || echo "per-VM admin login: FAIL"

After you sign in, the Cluster status dashboard opens. It shows available updates, installed applications, the number of nodes (1 on a fresh install), scheduled backups, email-notification status and system logs. The left navigation lists Nodes, Domains and users, Software center, Applications, Backup and restore, System logs, Audit trail, Settings and About.

The Software center is the application catalog. Search for an application, for example CrowdSec, DNSMasq, Ejabberd, Nextcloud or a mail server, and choose Install. NethServer downloads the application's container images and provisions it as an isolated, rootless-Podman module with its own user, so applications are cleanly separated from each other and from the host.

Under Domains and users, create a local or LDAP/Active Directory account provider, then add the users and groups your applications authenticate against. Under Settings, manage the node name, TLS certificates, email notifications, software repositories and other system-wide options.

The first-boot service is a one-shot that disables itself after it succeeds, and the node's WireGuard identity is generated per VM. Confirm the state directly:

systemctl is-enabled nethserver-firstboot.service ip -brief addr show wg0 firewall-cmd --list-services

The first-boot console uses a self-signed certificate. For production, point a DNS name at your VM's public IP and request a trusted certificate from the console. Go to Settings > TLS certificates and add a certificate for your fully qualified domain name. NethServer then obtains and renews a Let's Encrypt certificate automatically through Traefik. Afterwards, open the console at https://<your-fqdn>/cluster-admin/.

NethServer manages the host firewall with firewalld. The first-boot service opens http and https so the console is reachable, and opens UDP 55820 for the cluster VPN. Review the open services:

firewall-cmd --list-services firewall-cmd --list-ports

On the Azure side, mirror only what you need in your network security group: TCP 443 for the console, plus the ports that the applications you install require (for example TCP 25/143/993 for a mail module). Keep TCP 22 restricted to your management IP.

NethServer 8 backs up applications, not the whole VM. Under Backup and restore, configure one or more backup destinations (S3-compatible object storage, Backblaze B2 or any WebDAV target), select which application instances to include, and set a schedule. Because each application is a self-contained module, you can restore an individual application onto this node or onto a different NethServer 8 cluster. For infrastructure-level protection, also enable Azure Backup or periodic managed-disk snapshots on the VM.

Before you expose the console to the internet:

• Replace the self-signed certificate with a trusted one (Step 9) and access the console only over your FQDN.
• Restrict TCP 443 in the network security group to the IP ranges that administer the server.
• Sign in and change the admin password, or add a dedicated named admin account and enable two-factor authentication under the user's settings.
• Keep TCP 22 restricted to your management IP and prefer key-only SSH. The image ships with password authentication disabled.
• Apply operating-system updates regularly (Step 13), and apply application updates from the Software center as they appear on the dashboard.

Patch the underlying AlmaLinux 9 host with dnf:

sudo dnf -y upgrade --refresh sudo systemctl reboot

NethServer application and core updates are surfaced on the Cluster status dashboard under Available updates and applied from the console.