Deployment guide

Node-RED

Overview

Node-RED is a low-code, flow-based development tool for event-driven applications. Its browser-based editor lets you wire together hardware devices, APIs and online services from a palette of nodes, then deploy flows to its lightweight Node.js runtime in a single click. It is widely used for IoT integration, API orchestration, home and industrial automation, and rapid prototyping of event-driven logic.

The SecureAnyCloud image installs Node-RED 5.0.0 on Node.js 22 LTS and runs it as a dedicated systemd service bound to loopback. An nginx reverse proxy on port 80 protects the editor with HTTP Basic auth. All flows and settings persist on a dedicated Azure data disk, and a unique editor password is generated on the first boot of every VM.

What you get:

Node-RED 5.0.0 on Node.js 22 LTS, installed globally with npm
The browser flow editor and runtime, fronted by nginx on :80 with the editor websocket proxied
HTTP Basic auth with a per-VM password in a root-only file. The editor controls a runtime that can execute code, so the runtime is bound to loopback
A dedicated Azure data disk at /var/lib/node-red that holds flows, settings and palette nodes, separate from the OS disk and re-provisioned with every VM
node-red.service and nginx.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

Before you deploy this image, make sure you have an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B2ms (2 vCPU, 8 GiB RAM) is a good starting point. Scale up for large flows or many concurrent messages.

On the network security group, allow inbound 22/tcp from your management network and 80/tcp for the editor. For public exposure, front the editor with TLS as described in Enabling HTTPS.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, select Create a resource, and search the Marketplace for Node-RED by SecureAnyCloud. Select the listing, then select Create.

On the Basics tab, choose your subscription, resource group, region and size. Under Administrator account, select SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

On the Disks tab, review the dedicated data disk. Then select Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

Create the VM from the SecureAnyCloud Node-RED image, then open port 80. Replace the values in angle brackets with your own.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:node-red-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name node-red \
  --image sac1647283583153:node-red-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name node-red --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH as the administrator user you set at deploy time.

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that Node-RED and nginx are both active.

systemctl is-active node-red.service nginx.service

Both services report active. Node-RED takes a few seconds to start while the Node.js runtime loads the flow file.

Step 5 - Retrieve your editor password

The admin password is generated uniquely on the first boot of your VM and written to a root-only file. Read it as root.

sudo cat /root/node-red-credentials.txt

The file contains NODE_RED_ADMIN_USER (admin), NODE_RED_ADMIN_PASSWORD and the editor URL. Store the password somewhere safe.

Step 6 - Check the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes.

curl -s http://localhost/health

The endpoint returns ok.

Step 7 - Open the flow editor

Browse to http://<vm-public-ip>/ and sign in as admin with the password from Step 5. The editor opens with the node palette on the left, the flow canvas in the centre, and the information and debug sidebars on the right.

Drag nodes from the palette onto the canvas, wire them together, and select Deploy to run your flow. Double-click any node to configure it. Function nodes let you transform messages with JavaScript.

The main menu gives you import and export, flow management and settings.

Step 8 - Confirm the runtime from the command line

The Node-RED runtime exposes a /settings endpoint behind the same Basic auth. Confirm that it is serving and reports its version.

curl -s -u admin:<NODE_RED_ADMIN_PASSWORD> http://localhost/settings | head -c 300; echo

The JSON response includes "version":"5.0.0" along with the runtime configuration.

Step 9 - Install extra palette nodes

Node-RED has a catalogue of thousands of community nodes for databases, messaging, cloud services, dashboards and protocols. Install them from the editor with Menu > Manage palette > Install, or from the command line into the user directory.

sudo -u node-red npm --prefix /var/lib/node-red install node-red-dashboard

After you install from the command line, restart Node-RED so that it loads the new nodes.

sudo systemctl restart node-red

Step 10 - Confirm flows live on the dedicated disk

Your flows, settings, credentials and installed nodes are stored on the dedicated Azure data disk, so they survive OS changes and can be resized independently. Check the mount with this command.

findmnt /var/lib/node-red

The mount is backed by a separate Azure data disk that is captured in the image and re-provisioned on every VM.

Enabling HTTPS

The nginx reverse proxy terminates plain HTTP on port 80. For public exposure, put a certificate in front of it. Add a DNS name for the VM, then either use the companion SecureAnyCloud nginx-ssl-certbot image as a TLS reverse proxy, or install certbot and extend the existing nginx site with a listen 443 ssl; server block.

Keep Node-RED itself bound to loopback, so the only public surface is the authenticated, TLS-terminated proxy. The proxy already forwards the websocket that the editor needs.

Maintenance

Flows: edit and deploy from the browser editor. The flow file is at /var/lib/node-red/flows.json.
Backups: snapshot the /var/lib/node-red data disk to back up flows, credentials and installed nodes.
Upgrades: run sudo npm install -g node-red@latest, then sudo systemctl restart node-red.
Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact us at sales@secureanycloud.com.

Deploy on Azure

Launch Node-RED on Ubuntu 24.04 LTS on Azure, with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs Node-RED, the open-source, flow-based, low-code programming tool for wiring together hardware devices, APIs and online services. Node-RED is built on Node.js. Its browser-based editor lets you drag nodes from a palette onto a canvas and wire them into flows that react to events, transform messages and call out to services.

Node-RED ships with core nodes for HTTP, MQTT, TCP, WebSocket, file, function and dashboard work. The built-in palette manager lets you install thousands of community nodes from the public catalogue.

Node-RED 5.0.0 is installed globally on Node.js 22 LTS. It runs under a systemd service that starts it on boot and restarts it on failure, as a dedicated unprivileged nodered system account. The Node-RED user directory holds flows.json, the encrypted credentials store, settings.js and any installed extra nodes. It lives at /var/lib/node-red, on a dedicated, independently resizable EBS data volume that survives instance replacement.

Node-RED ships with no authentication by default, so the runtime binds to the loopback interface only (127.0.0.1:1880) and is never exposed directly. An nginx reverse proxy publishes the flow editor and the admin HTTP API on port 80, with WebSocket support for the live editor. Node-RED's own adminAuth gates the editor with a login page and a bcrypt-hashed admin password.

The password is generated on the first boot of every instance, so two instances launched from the same Amazon Machine Image never share a password. It is written to /root/node-red-credentials.txt with mode 0600, so only the root user can read it.

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and port 80 for the flow editor
The AWS CLI version 2 installed locally if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Node-RED. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Choose an instance type of t3.medium or larger. Under Key pair (login), choose your EC2 key pair. Under Network settings, select your VPC and subnet, then create or select a security group that opens port 22 from your management network and port 80 for the flow editor. Keep the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass. This is when the per-instance admin password is generated.

Launch the Instance from the AWS CLI

Launch an instance from the SecureAnyCloud Node-RED Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing. Replace <key-name> with your EC2 key pair name and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens ports 22 and 80, as described in Step 1.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.medium \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=node-red}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can find it in the EC2 console or with aws ec2 describe-instances.

Connect to Your Instance

Connect over SSH with your key pair and the login user for your operating system variant. For Ubuntu 24.04, the SSH login user is ubuntu.

ssh -i <key-name>.pem ubuntu@<public-ip>

Retrieve the Admin Password

The flow editor admin password is unique to your instance and is generated on first boot. Read the credentials file as root.

sudo cat /root/node-red-credentials.txt

The file lists the editor URL, the admin user (admin) and the generated password. It also includes an example of how to obtain an admin API bearer token. Keep the password somewhere safe.

Sign In to the Flow Editor

The Node-RED flow editor is served on port 80 by nginx, which proxies to the runtime on 127.0.0.1:1880. In a browser, go to this address.

http://<instance-public-ip>/

The Node-RED sign-in page opens. Sign in as admin with the password from the credentials file. The flow editor canvas loads, with the node palette on the left, the workspace in the centre, and the information, help and debug sidebar on the right.

To build a flow, drag a node from the palette onto the canvas and wire its output port to the input of the next node. Double-click a node to open its edit tray and configure it. The function node, for example, lets you write JavaScript to transform each message as it passes through.

To add community nodes, open the main menu in the top right and select Manage palette. Then use the Install tab to search for and add nodes from the public catalogue.

When you have wired a flow, select Deploy in the top right to make it live. Flows are stored as JSON in flows.json in the user directory. You can export, import and version-control them.

Confirm Node-RED Is Running

Over SSH, confirm that the runtime and the nginx proxy are active and that the ports are listening.

sudo systemctl is-active nodered nginx
sudo ss -tlnp | grep -E ':(80|1880) '

Both services report active. The Node-RED runtime listens on 127.0.0.1:1880 (loopback only), and nginx listens on port 80.

Use the Admin HTTP API

Node-RED's admin HTTP API is served on the same port 80 behind the same login, so you can manage flows and the runtime programmatically. First, obtain a bearer token by posting your credentials to /auth/token. On the instance, use the loopback address. From outside, use the public IP. Replace <password> with the value from the credentials file.

curl -s http://127.0.0.1/auth/token \
  --data 'client_id=node-red-admin&grant_type=password&scope=*&username=admin&password=<password>'

A successful request returns a JSON object that contains an access_token. Pass it as a bearer token on later admin API calls. This example retrieves the current flows.

curl -s http://127.0.0.1/flows -H 'Authorization: Bearer <access-token>'

The admin API can deploy flows, install nodes and inspect the runtime. The Node-RED documentation lists the full set of endpoints.

The Data Volume

The Node-RED user directory lives on a dedicated EBS volume mounted at /var/lib/node-red. This keeps your flows, the encrypted credentials store, settings.js and any installed extra nodes off the operating system disk, and lets you resize or snapshot them independently. Confirm the mount with this command.

df -h /var/lib/node-red

To grow the user directory, expand the EBS volume in the AWS console. Then grow the filesystem on the instance by running sudo resize2fs on the underlying device.

The user directory holds all of your flows and configuration, so a snapshot of this volume captures the complete state of your Node-RED deployment.

Enable HTTPS

nginx serves the flow editor and admin API over plain HTTP on port 80. Place them behind TLS before you expose the editor to users or the internet.

Obtain a certificate for your domain, for example with a managed certificate on an Application Load Balancer in front of the instance, or with Certbot installed on the instance. Then configure nginx to listen on 443 with your certificate and proxy to 127.0.0.1:1880, exactly as the bundled site does for port 80. Keep the WebSocket upgrade headers in place so the live editor continues to work.

Restrict the security group so that ports 80 and 443 are reachable only from the networks that need the editor and the API.

Backup and Maintenance

Back up your deployment by snapshotting the /var/lib/node-red EBS volume. The snapshot captures all of your flows, the encrypted credentials store and installed nodes. You can also export individual flows as JSON from the editor for version control.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed. Node-RED and nginx start automatically on boot.

Support

This image is published and supported by SecureAnyCloud. Support covers deployment, flow design, node installation, the credentials store, dashboard configuration, MQTT and API integration, TLS and runtime tuning. Contact SecureAnyCloud through the support channel on the AWS Marketplace listing.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Node-RED on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS