SecureAnyCloud
Deployment guide

Nexterm

Overview

Nexterm is an open source, self-hosted server management platform. It gives your team a single browser-based console for connecting to servers over SSH, VNC, RDP and Telnet, transferring files with an SFTP manager, and organising everything with organizations, folders and an encrypted credential vault. It also covers server monitoring, reusable command snippets, Docker and Proxmox administration, two-factor authentication, passkeys, and OIDC and LDAP single sign-on.

The SecureAnyCloud image runs Nexterm from the vendor's official all-in-one container (nexterm/aio, pinned by digest), published only on loopback 127.0.0.1:6989, and fronts it with nginx on port 80. nginx is configured for the WebSocket traffic that the live terminal, remote desktop and SFTP channels rely on, and is ready for your TLS certificate. The embedded SQLite datastore lives in a Docker volume captured into the image.

Secure by default: the image ships with no administrator and no stored data. The at-rest encryption key that protects your saved server passwords, SSH keys and passphrases is created uniquely on the first boot of every instance. It is written 0600 root:root to /etc/nexterm/nexterm.env and is never baked into the image. Your first visit lands on the first-run setup, where you create your own admin. A nexterm-firstboot.service oneshot creates the key, resolves the instance URL and starts the stack on first boot, then disables itself.

What you get:

  • Nexterm 1.2.2-BETA (MIT) from the official nexterm/aio image, pinned by digest
  • An embedded SQLite datastore in the Docker volume nexterm at /app/data, so there is no separate database to run
  • nexterm.service running the container, published on 127.0.0.1:6989
  • A per-VM encryption key created at first boot and stored 0600 root:root in /etc/nexterm/nexterm.env
  • An nginx reverse proxy on port 80, WebSocket-aware and ready for TLS
  • nexterm-firstboot.service for first boot key creation and stack start
  • Docker Engine runtime
  • Ubuntu 24.04 LTS base, patched at build time
  • 24/7 SecureAnyCloud support, with a 24-hour response SLA

Prerequisites

Before you deploy this image, make sure you have:

  • An active Azure subscription
  • An SSH key pair
  • A VNet with a subnet
  • A VM size of Standard_B2s. This is the recommended size. Nexterm is lightweight, and 4 GB RAM is comfortable.
1

Deploy from the Azure Portal

Search the Azure Marketplace for Nexterm on Ubuntu 24.04 and choose your VM size.

Attach an NSG that allows TCP 22 (SSH) from your management network and TCP 80 and 443 (the console) from the networks that need it. In production, front port 80 with TLS (see Step 12).

2

Deploy from the Azure CLI

Run the following commands to create the network, accept the Marketplace terms once per subscription, and create the VM.

RG="nexterm-prod"; LOCATION="eastus"; VM_NAME="nexterm-01" IMAGE_URN="sac1647283583153:nexterm-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name nexterm-vnet --address-prefix 10.90.0.0/16 --subnet-name nexterm-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name nexterm-nsg az network nsg rule create -g "$RG" --nsg-name nexterm-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name nexterm-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:nexterm-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name nexterm-vnet --subnet nexterm-subnet --nsg nexterm-nsg --public-ip-sku Standard
3

Connect via SSH

Connect to the VM over SSH.

ssh azureuser@<vm-ip>
4

Verify the services are running

Nexterm runs in a container published on loopback 127.0.0.1:6989. nginx fronts the console on port 80 and proxies its WebSocket traffic.

systemctl is-active docker nexterm nginx nexterm-firstboot
sudo ss -tlnp | grep -E ':80 |127.0.0.1:6989'
sudo docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'

All services report active, nginx is bound to :80, the container is published on 127.0.0.1:6989, and the nexterm container is Up.

5

Secure by default, per VM encryption key

Nothing sensitive ships in the image. The first-run setup is still pending (is-fts is true, so no administrator ships). The at-rest encryption key was created uniquely for this VM at first boot and is readable by root only.

Check the setup state, the key file permissions, and the masked key.

curl -s http://127.0.0.1/api/service/is-fts
sudo stat -c '%n perms=%a owner=%U:%G' /etc/nexterm/nexterm.env
sudo sed -E 's/(ENCRYPTION_KEY=)[0-9a-f]+/\1************/' /etc/nexterm/nexterm.env

is-fts returns true, the key file is 600 root:root, and it holds a unique per-VM ENCRYPTION_KEY (masked above). Keep this key safe. You need it to decrypt your credential vault.

6

Complete the first run setup

Open http://<vm-ip>/ in your browser. Because no administrator ships, Nexterm shows its first-run Registration screen.

Enter a First Name, Last Name, Username and a strong Password, then select Register. This step secures the instance, so choose a strong password.

7

The server console

After you register, you are signed in and land on the server console. Add servers from the sidebar and group them into folders. Together they make up the infrastructure you manage from the browser.

8

Add and edit a server

Right-click in the sidebar to add a server. To change an existing server, right-click its entry and choose Edit Server.

  • Give the server a name.
  • Choose the protocol (SSH, VNC, RDP, Telnet or SFTP).
  • Enter the host and port.
  • Attach an identity from the encrypted credential vault under the Identities tab.
  • Select Save.

Double-click the server to open a live session in your browser.

9

Settings, identities and two-factor authentication

The Settings area holds your account, the Identities credential vault, Organizations for team sharing, Users, Roles & Permissions, and Authentication, where you can enable OIDC or LDAP single sign-on.

Enable two-factor authentication on your account for an extra layer of security.

10

The stack

Check the pinned image, the Nexterm version, the nginx version and the console response.

sudo docker inspect --format '{{.Image}}' nexterm curl -s http://127.0.0.1/api/service/version nginx -v curl -s -o /dev/null -w 'GET / -> HTTP %{http_code}\n' http://127.0.0.1/

The pinned nexterm/aio image runs the server, nginx 1.24 fronts it, the Nexterm version is 1.2.2-BETA, and the console returns HTTP 200 through nginx.

11

Data and persistence

All Nexterm data lives in the embedded SQLite database inside the Docker volume nexterm. The volume is captured into the image and carried onto every instance. Check the volume, the database file, the first boot service and held packages.

sudo docker volume ls | grep nexterm
sudo docker exec nexterm ls -lh /app/data/nexterm.db systemctl is-enabled nexterm-firstboot.service apt-mark showhold

The volume is present and the database file is on disk inside it. The first boot service is enabled for the next fresh instance, and there are no held packages, so the OS security baseline is intact.

12

Enable HTTPS

nginx already fronts Nexterm on port 80 and is ready for TLS. Point a DNS record at your VM, then get a certificate with certbot.

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> --agree-tos -m <your-email> --redirect

certbot installs the certificate, rewrites the nginx server block for TLS and sets up automatic renewal. Your console is then served over HTTPS.

Managing the service

Check the service status and read the recent container logs.

sudo systemctl status nexterm --no-pager | head -n 6
sudo docker logs --tail 8 nexterm

Restart the stack with sudo systemctl restart nexterm and follow the live container logs with sudo docker logs -f nexterm. nginx logs are under /var/log/nginx/.

Back up the instance by snapshotting the OS disk. Keep a copy of /etc/nexterm/nexterm.env (your per-VM encryption key) somewhere safe, because you need it to decrypt the credential vault.

Support

SecureAnyCloud provides 24/7 support for this image by email and live chat. Support covers deployment, nginx TLS termination, upgrades, identity providers and performance tuning. Email sales@secureanycloud.com.

This is a repackaged open source software product, with additional charges for SecureAnyCloud support services. Nexterm is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Nexterm on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure