Deployment guide

OliveTin

Overview

OliveTin gives you a clean web interface of buttons, where each button runs one predefined shell command that an administrator has approved in advance. Instead of handing people SSH access to run ad hoc commands, you define a curated set of actions in a single YAML file. Users click to run them and watch the live output stream back to the page.

It is a natural fit for home labs and operations teams who want to let less technical users, or their future selves, safely trigger routine jobs from a browser or a phone. Examples include restarting a service, checking disk space, pinging a host or kicking off a backup.

Because every button is a real shell command running on the server, the entire value of OliveTin depends on it being locked down. An OliveTin that is reachable without authentication is, in effect, remote command execution. The SecureAnyCloud image is built around that fact and ships OliveTin 3000.17.1 as a single static Go binary on a hardened Ubuntu 24.04 LTS base, patched at build time and managed by systemd.

What you get:

OliveTin 3000.17.1, the official release, running as a dedicated non-root olivetin system user, managed by systemd.
An nginx reverse proxy on port 443 that terminates TLS with a self-signed certificate regenerated per VM at first boot and enforces HTTP Basic Auth. Port 80 redirects to HTTPS, and an unauthenticated /healthz probe serves load balancers. This proxy is the only network-facing surface.
OliveTin bound to the loopback interface only (127.0.0.1:1337), never exposed to the network.
A per-VM administrator password generated on first boot and recorded in a root-only file, with no shipped default login.
A small set of safe, non-destructive default actions: check disk usage, show memory, show uptime, ping a host from a fixed allow list, and restart a demo service through a narrowly scoped sudo rule.
24/7 SecureAnyCloud support.

OliveTin is free and open-source software licensed under the GNU Affero General Public License version 3.

Prerequisites

An Azure subscription and either the Azure portal or the Azure CLI (az).
An SSH key pair to administer the VM.
A network security group that allows inbound TCP 443 (and 80 for the HTTPS redirect) from the clients that need the web interface, plus TCP 22 from your admin location.

Step 1 - Deploy from the Azure Marketplace

Find the SecureAnyCloud OliveTin on Ubuntu 24.04 LTS offering in the Azure Marketplace. Choose the recommended Standard_B2s size, attach the VM to your virtual network, and allow inbound TCP 443 and 22. OliveTin is a tiny Go binary and runs comfortably on Standard_B2s.

Step 2 - Deploy from the Azure CLI

The commands below create a resource group, the VM from the SecureAnyCloud image, and inbound rules for HTTPS and the HTTPS redirect. Replace the image URN or plan details with the ones shown on the Marketplace listing page.

az group create --name olivetin-rg --location uksouth
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:olivetin-ubuntu-24-04:default:latest
az vm create \
  --resource-group olivetin-rg \
  --name olivetin \
  --image sac1647283583153:olivetin-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group olivetin-rg --name olivetin --port 443 --priority 900
az vm open-port --resource-group olivetin-rg --name olivetin --port 80 --priority 910
# When the VM is running, note its public IP address:
az vm show -d --resource-group olivetin-rg --name olivetin --query publicIps -o tsv

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that the command runner, the reverse proxy and the first-boot job are healthy. nginx serves OliveTin by proxying to the OliveTin binary on the loopback interface, and a one-shot first-boot service generates the per-VM secrets.

systemctl is-active olivetin nginx olivetin-firstboot.service

Expected output. The first-boot service reports active once it has completed on the first boot of the VM:

active active active

Confirm the pinned version that shipped:

cat /opt/olivetin/VERSION

Step 4 - Confirm the network shape

OliveTin binds to the loopback interface only. nginx, listening on ports 80 and 443, is the sole network-facing surface and reverse-proxies to it. Confirm the listeners:

ss -tln | grep -E ':1337|:80 |:443 '

You will see OliveTin on 127.0.0.1:1337 (loopback only) and nginx on 0.0.0.0:80 and 0.0.0.0:443.

Step 5 - Retrieve the per-VM administrator password

Every VM generates its own administrator password on first boot. It writes the password into the nginx HTTP Basic Auth file and records the login details in a root-only file. Read the file over SSH:

sudo cat /root/olivetin-credentials.txt

You will see the web URL, the administrator user (admin) and the generated password. These values are unique to your VM. The file is mode 0600 and owned by root.

Step 6 - Confirm authentication is enforced

The reverse proxy refuses unauthenticated requests and serves OliveTin only to a caller that passes HTTP Basic Auth. The unauthenticated /healthz probe is the one exception, provided for load balancers. Confirm all three behaviors:

curl -sk -o /dev/null -w 'anonymous: %{http_code}\n' https://127.0.0.1/
curl -sk -o /dev/null -w 'authenticated: %{http_code}\n' -u '<OLIVETIN_ADMIN_USER>:<OLIVETIN_ADMIN_PASSWORD>' https://127.0.0.1/
curl -sk -o /dev/null -w 'healthz: %{http_code}\n' https://127.0.0.1/healthz

An unauthenticated request is refused with 401, an authenticated request returns 200, and the health probe returns 200 without a login:

anonymous: 401 authenticated: 200 healthz: 200

Step 7 - Sign in to the web UI

Browse to your VM over HTTPS. The image ships a self-signed certificate generated per VM, so your browser warns once. Accept the warning, or place your own certificate in front for production.

https://<your-vm-public-ip>/

Your browser prompts for HTTP Basic Auth. Enter admin and the password from the credentials file. You land on the OliveTin Actions dashboard, which shows the shipped safe actions as buttons.

Step 8 - Run an action

Select any action button to run its command. OliveTin executes the predefined command on the server and streams the output back into an execution dialog. Select Check disk usage and you will see the real df output, with the execution marked Completed.

Every execution is recorded. Open the Logs view to see the history of who ran what and when, with each entry linking to its full output.

Step 9 - Trigger an action from the API

OliveTin exposes the same actions over a simple JSON API, so you can drive them from scripts, cron or another service. Authenticate with the same HTTP Basic Auth credential. This command triggers the check_disk action and waits for its output:

curl -sk -u '<OLIVETIN_ADMIN_USER>:<OLIVETIN_ADMIN_PASSWORD>' \
  -H 'Content-Type: application/json' \
  -d '{"actionId":"check_disk"}' \
  https://127.0.0.1/api/olivetin.api.v1.OliveTinApiService/StartActionAndWait

The response is a JSON logEntry containing the command exitCode and its output. Actions that take arguments receive them as an array, for example the shipped ping_host action:

curl -sk -u '<OLIVETIN_ADMIN_USER>:<OLIVETIN_ADMIN_PASSWORD>' \
  -H 'Content-Type: application/json' \
  -d '{"actionId":"ping_host","arguments":[{"name":"host","value":"1.1.1.1"}]}' \
  https://127.0.0.1/api/olivetin.api.v1.OliveTinApiService/StartActionAndWait

Step 10 - Add your own actions

Actions are defined in /etc/OliveTin/config.yaml. Each action gives a title, a stable id used by the API, and the shell command to run. Every action is a real shell command run on the server, so add actions with care. Constrain any argument to a fixed list of choices rather than accepting free-form input, keep destructive commands off the appliance, and never widen the reverse proxy authentication.

A minimal safe action looks like this:

actions: - title: Show running containers id: docker_ps shell: docker ps icon: box onclick: execution-dialog timeout: 15

OliveTin runs as the unprivileged olivetin user. If an action genuinely needs elevated privileges, grant exactly that one command through a narrow rule in /etc/sudoers.d/, as the shipped Restart demo service action does, rather than running OliveTin as root. After editing the config, restart the service so that OliveTin reloads it:

sudo systemctl restart olivetin

Use the Diagnostics view to confirm the running configuration and generate a support report.

Security model - no default login

The SecureAnyCloud image ships with no known credentials. Before the image is captured, the HTTP Basic Auth file is emptied and the credentials file is reset so that it holds no real credential.

On the first boot of every VM, a one-shot first-boot service performs these steps:

It regenerates the self-signed TLS certificate.
It generates a fresh random administrator password and writes it into the nginx Basic Auth file as a bcrypt hash.
It proves end to end that an unauthenticated request is refused, an authenticated request succeeds, and a shipped action executes and returns its output.
It records the login in the root-only credentials file.

The design uses defense in depth. The OliveTin binary is bound to loopback and is never reachable from the network directly. nginx is the only public surface, and it forwards the authenticated identity to OliveTin as a request header that a client cannot spoof. OliveTin is configured to deny any request that is not an authenticated administrator, so even a request that reached the loopback port without going through nginx would be refused.

To rotate the administrator password at any time, run:

sudo htpasswd -B /etc/nginx/olivetin.htpasswd admin

Corresponding source (AGPL-3.0)

OliveTin is distributed under the GNU Affero General Public License version 3. The complete corresponding source for the version in this image is published by the OliveTin project at github.com/OliveTin/OliveTin, and the exact release and its sha256 digest are recorded on the VM at /opt/olivetin/VERSION. The SecureAnyCloud image adds only configuration and an nginx reverse proxy; it does not modify the OliveTin source.

Support

Every SecureAnyCloud deployment is paired with this guide and backed by 24/7 SecureAnyCloud support. For questions about running OliveTin on Azure, contact the SecureAnyCloud team.

Deploy on Azure

Launch OliveTin on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs OliveTin 3000.17.1, an open-source, self-hosted web interface that turns a curated set of predefined shell commands into safe, one-click buttons. Instead of handing people SSH access to run ad hoc commands, an administrator defines a vetted set of actions in a single YAML file. Users click to run them and watch the live output stream back to the page.

It is a natural fit for home labs and operations teams who want to let less technical users safely trigger routine jobs from a browser or a phone.

Because every button runs a real shell command on the server, an OliveTin that is reachable without authentication is, in effect, remote command execution. The SecureAnyCloud image is built around that fact and is secure by default. OliveTin is bound only to the loopback interface and is fronted by nginx on port 443, which terminates TLS and enforces HTTP Basic authentication. The administrator password is a unique value generated on first boot for each instance and written to a root-only file. No credential is baked into the image, and no two deployments share one.

What you get:

OliveTin 3000.17.1 installed from the official vendor package, running as a dedicated non-root olivetin service bound to 127.0.0.1:1337.
nginx on port 443 terminating TLS with a per-instance self-signed certificate and enforcing HTTP Basic authentication. It redirects port 80 to HTTPS and serves an unauthenticated /healthz endpoint for load-balancer probes.
Spoof-proof identity forwarding: nginx authenticates the request and passes the identity to OliveTin as headers, so a request that reaches the loopback port without the proxy header is treated as an unauthenticated guest and denied.
A one-shot olivetin-firstboot.service that regenerates the TLS certificate, generates a per-instance administrator password on first boot, and writes it to /root/olivetin-credentials.txt (mode 0600).
A small set of safe, non-destructive sample actions, so the dashboard is usable immediately.
A dedicated EBS data volume mounted at /var/lib/olivetin for the runtime's state and logs.
A fully patched Ubuntu 24.04 LTS base with unattended security upgrades enabled.
24/7 SecureAnyCloud support.

OliveTin is published by the OliveTin project under the GNU Affero General Public License version 3. This image is packaged by SecureAnyCloud and is not affiliated with or endorsed by the OliveTin project.

Prerequisites

An AWS account, an EC2 key pair in the target region, and a VPC with a public subnet.
m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type. OliveTin itself is light, so smaller types work for low-traffic use.
Security group inbound rules: allow 22/tcp from your management network for SSH and 443/tcp for the web UI. Port 80/tcp is optional and only redirects to HTTPS.
OliveTin serves HTTPS with a per-instance self-signed certificate. For production or shared access, terminate TLS in front of it with your own domain, using a reverse proxy or an Application Load Balancer.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace, then launch an instance from the AMI with your key pair, a public subnet and the security group described above. Leave the default root volume. The image also attaches a small dedicated data volume for OliveTin's state.

Step 2 - Connect to your instance

Connect over SSH with your key pair, as the default login user for the OS variant you launched:

OS variant: Ubuntu 24.04 LTS
SSH login user: ubuntu
Example: ssh -i your-key.pem ubuntu@<instance-public-ip>

The instance login banner (MOTD) prints the web URL, the health-check URL and the location of your credentials.

Step 3 - Read your unique administrator credential

The administrator password is generated on the first boot of this instance and stored in a root-only file. Read it with:

sudo cat /root/olivetin-credentials.txt

You will see the per-instance values, for example:

olivetin.url=https://<instance-public-ip> olivetin.admin_user=admin olivetin.admin_password=<unique-per-instance-password>

This password is unique to this instance and is not baked into the image. Keep it safe. Rotate it at any time with sudo htpasswd -B /etc/nginx/olivetin.htpasswd admin.

Step 4 - Confirm the secure-by-default posture from the command line

Before opening a browser, confirm from the shell that OliveTin is not reachable without authentication and is bound only to the loopback interface:

# Unauthenticated request to the web UI is refused (expect 401)
curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/
# The unauthenticated health endpoint is available for load balancers (expect 200)
curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/healthz
# OliveTin listens on the loopback interface only, never 0.0.0.0
sudo ss -tlnp | grep 1337

The first command returns 401, the second 200, and the listener shows 127.0.0.1:1337. The reverse proxy is the only network-facing surface.

Step 5 - Sign in to the web UI

Open https://<instance-public-ip>/ in your browser. The certificate is a per-instance self-signed certificate, so your browser warns about it the first time. Accept the warning to proceed, or install your own certificate for production. Sign in with the admin username and the password from Step 3.

You land on the Actions dashboard, where each shipped sample action is a button:

The shipped safe actions are Check disk usage, Show memory usage, Show system uptime, Ping a host (constrained to a fixed allow-list of hosts) and Restart demo service (a controlled privileged example granted through a single-command sudoers rule).

Step 6 - Run an action and read its live output

Select an action, for example Check disk usage. OliveTin runs its predefined shell command and streams the output back to the page in real time, showing the run duration and a completed or failed status:

Every button runs exactly the command defined for it in the configuration. The shipped actions have no free-form command entry, so there is no command-injection surface.

Step 7 - Review the execution log

The Logs view lists every action that has been executed, with its timestamp, the user who ran it and its status. It is a searchable audit trail of who ran what and when:

Step 8 - Add your own actions

OliveTin's actions are defined in a single YAML file at /etc/OliveTin/config.yaml. To add your own action, edit that file with your preferred editor (for example sudo nano /etc/OliveTin/config.yaml) and add an entry under actions:. Then restart OliveTin with sudo systemctl restart olivetin.

A minimal action looks like this:

actions: - title: Show running containers id: docker_ps shell: docker ps icon: box onclick: execution-dialog timeout: 15

Security guidance. Every action is a real shell command run as the unprivileged olivetin user. The OliveTin login is the only thing standing between an action button and shell execution on the server. When you add actions, follow these rules:

Prefer fixed choices for any argument rather than free-form input, so a user cannot inject arbitrary commands.
Keep the reverse proxy authentication in place and use a strong password, or wire OliveTin's header authentication to your own identity provider.
Grant privileged actions through a narrow sudoers rule scoped to exactly the command you intend, as the shipped Restart demo service action does. Never grant blanket root.
Ship only the actions you actually need.

Managing the services

# Service status systemctl status olivetin nginx
# Restart after editing the config
sudo systemctl restart olivetin
# Follow the logs journalctl -u olivetin -f

Troubleshooting

Browser certificate warning: this is expected, because the image ships a per-instance self-signed certificate. Accept the warning, or replace /etc/nginx/tls/olivetin.crt and /etc/nginx/tls/olivetin.key with your own and reload nginx.
401 when signing in: confirm the password from /root/olivetin-credentials.txt. It is unique per instance. Rotate it with sudo htpasswd -B /etc/nginx/olivetin.htpasswd admin.
An action shows a non-zero exit: the command it runs failed. Check the live output in the execution dialog and the journalctl -u olivetin logs.
Health check: curl -sk https://<instance-public-ip>/healthz returns ok without authentication, for load balancers.

Support

SecureAnyCloud provides 24/7 technical support for this image by email and live chat at sales@secureanycloud.com. Support covers deployment, terminating TLS with your own domain and certificate, authoring and safely constraining your own actions, wiring OliveTin's header authentication to your own identity provider, and integrating actions with your operational tooling.

Deploy on AWS

Launch OliveTin with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS