SecureAnyCloud
Deployment guide

Nezha

Overview

Nezha is an open-source, lightweight tool for monitoring your servers and websites. It provides a real-time status dashboard, HTTP, TCP and Ping service checks, push notifications and alerting, scheduled tasks and a browser-based web terminal. The SecureAnyCloud image installs the pinned Nezha 2.2.10 dashboard binary and runs it as the nezha-dashboard systemd service.

What you get:

  • Nezha 2.2.10 installed as a single self-contained Go binary and running as the nezha-dashboard systemd service
  • Real-time server and website monitoring with a built-in web dashboard on :8008
  • The browser dashboard and the agent gRPC channel multiplexed on one port, 8008, as in every Nezha release since version 1
  • Native username and password admin login, with no external OAuth provider required
  • No default login. Upstream Nezha seeds a well-known default admin / admin login, which this image never ships. On the first boot of every VM, the admin password is rotated to a unique, randomly generated per-VM value.
  • Per-VM agent secret and JWT secret generated freshly on first boot, never shared between VMs
  • An embedded SQLite store that keeps all state, so a single node runs the full dashboard, agent gRPC channel and alerting with no external database or object store
  • The admin password stored bcrypt-hashed, never in plaintext, with the credentials file 0600 root:root
  • nezha-dashboard.service as a systemd unit, enabled and active
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B2s (2 vCPU, 4 GiB RAM) is a comfortable starting size for evaluation and for monitoring dozens of servers. Scale the VM up as your fleet grows.

In the network security group, allow inbound 22/tcp from your management network and 8008/tcp for the dashboard and the agents. Port 8008 carries both the browser dashboard and the agent gRPC channel, so your monitored servers connect to the same host and port you browse to.

Nezha serves plain HTTP on 8008. Front it with TLS on your own domain and restrict access to trusted IP ranges (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Nezha Monitoring by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22). Then select Review + create and Create.

After deployment, add an inbound rule for 8008/tcp in the network security group so you and your agents can reach the dashboard.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM and open port 8008:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:nezha-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name nezha \
  --image sac1647283583153:nezha-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name nezha --port 8008 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the service is running

Check that the Nezha service is active:

systemctl is-active nezha-dashboard.service

The command reports active. Nezha serves the browser dashboard and the agent gRPC channel on port 8008. It keeps its state in the embedded SQLite database under /opt/nezha/dashboard/data.

Step 5 - Retrieve your admin login

Nezha uses native admin accounts. First boot rotates the weak upstream default password to a value unique to your VM and writes it to a root-only file. Read the file:

sudo cat /root/nezha-credentials.txt

The file contains NEZHA_USERNAME (admin), the rotated NEZHA_PASSWORD, the NEZHA_URL to open in a browser, and NEZHA_AGENT_CONNECT (the host and port your monitoring agents connect to).

First boot generates the per-VM agent and JWT secrets and stores them in the dashboard config. The image never ships them. Store the password somewhere safe.

Step 6 - Confirm the default login is disabled

Upstream Nezha ships a well-known admin / admin login. This image rotates it on first boot, so the default no longer works and only your per-VM password authenticates.

The following command reads the per-VM password from the credentials file and tests the login API. The correct password authenticates and issues a token, while both the old default and a wrong password are rejected:

PW=$(sudo grep '^NEZHA_PASSWORD=' /root/nezha-credentials.txt | cut -d= -f2-) L(){ curl -s -m 10 -X POST http://127.0.0.1:8008/api/v1/login -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"$1\"}"; } echo "per-VM password : $(L "$PW" | jq -r 'if .success==true then "authenticated (token issued)" else "rejected" end')" echo "default admin : $(L admin | jq -r 'if .success==true then "authenticated" else "rejected (default disabled)" end')" echo "wrong password : $(L nope | jq -r 'if .success==true then "authenticated" else "rejected" end')"

The command prints per-VM password : authenticated (token issued), default admin : rejected (default disabled) and wrong password : rejected. The dashboard is reachable only with your unique per-VM credentials.

Step 7 - Sign in to the web dashboard

Browse to http://<vm-public-ip>:8008/dashboard/. Nezha shows its login page. Enter the username admin and the password from Step 5, then select Log in.

Step 8 - Explore the server dashboard

After you sign in, you land on the admin dashboard. The Server view lists every monitored machine with its group, owner, IP, agent version and status.

The top navigation gives you Service (HTTP, TCP and Ping checks), Task, Notification, Dynamic DNS, NAT Traversal, Group and Server Transfers. A fresh VM starts with no servers. You add them in the next step.

Step 9 - Add a server to monitor

Select Installation command on the Server page and pick the target operating system (Linux, macOS or Windows).

Nezha generates a one-line installer that downloads the agent, registers it with this dashboard at the agent connect address, and starts reporting metrics. Run that command on each server you want to watch. The server appears in the Server list within seconds and begins streaming CPU, memory, disk, network and uptime.

Step 10 - Review the settings

Open the Settings page from the profile menu. Under System settings, you can set the site name, language and theme. The tabs across the top give you User management, Online User sessions, a Web Application Firewall and API Tokens for automation.

The SecureAnyCloud image ships with the site name preset and English selected.

Step 11 - Confirm the embedded SQLite store

Nezha keeps everything in a single embedded SQLite database, so there is no separate database server to run. This includes the admin user, your monitored servers, service checks and history. Check the database file and the user count:

ls -l /opt/nezha/dashboard/data/sqlite.db
sudo sqlite3 /opt/nezha/dashboard/data/sqlite.db "SELECT 'users: '||count(*) FROM users;"

The database file lives under /opt/nezha/dashboard/data. The admin password inside it is stored bcrypt-hashed, never in plaintext.

Maintenance

  • Password and users: The admin password is rotated to a unique value on first boot and written to /root/nezha-credentials.txt. Change it at any time from the avatar menu under Profile in the web UI, and manage additional users under Settings > User.
  • Add servers: Use Installation command on the Server page to enrol agents. They connect to this host on port 8008 using the per-VM agent secret.
  • Restrict access: Nezha serves plain HTTP on port 8008. Restrict the port to trusted IP ranges in your network security group, and front the dashboard with TLS (for example, a reverse proxy with your own domain) terminating on :443.
  • One port: Since version 1, the browser dashboard and the agent gRPC channel share port 8008 (listen_port in /opt/nezha/dashboard/data/config.yaml). Your agents use the same host and port you browse to.
  • Secrets: The agent secret and JWT secret are generated per VM on first boot and kept in config.yaml. They are never shipped in the image, so no two deployments share a secret.
  • Storage and backup: All Nezha state lives in the embedded SQLite database under /opt/nezha/dashboard/data. Back up that directory to protect your monitoring configuration and history.
  • Licensing (Apache-2.0): Nezha is licensed under the Apache License 2.0. The image ships the unmodified upstream 2.2.10 binary.
  • Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Nezha Monitoring on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure