openBIS

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is the recommended size. openBIS runs two JVMs (the Application Server and the Data Store Server) alongside PostgreSQL, and 8 GiB keeps the stack healthy.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the openBIS web interface.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for openBIS by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:openbis-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name openbis \
  --image sac1647283583153:openbis-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name openbis --port 80 --priority 1010

Step 3 - Connect to your VM over SSH

ssh azureuser@<vm-public-ip>

Step 4 - Confirm openBIS is running

On first boot the appliance generates a unique password for the openBIS admin account, starts the Application Server and Data Store Server, and writes the credentials to a root-only file. The application services do not start until the password rotation has finished, so the vendor default is never served.

Check that all four services are running:

systemctl is-active postgresql openbis-as openbis-dss nginx

Each service should report active.

Step 5 - Retrieve the per-VM administrator password

The password generated on first boot is stored in a root-only file. Read it with sudo:

sudo cat /root/openbis-credentials.txt

The file lists the login URL, the user name admin and the generated OPENBIS_ADMIN_PASSWORD. Store the password in your password manager. It is unique to this VM.

Step 6 - Sign in to openBIS ELN-LIMS

Browse to http://<vm-public-ip>/. You are redirected to the ELN-LIMS login page. Sign in as admin with the password from Step 5.

After you sign in, the Lab Notebook opens. From here you create Spaces, Projects, Collections and Objects to structure your experiments and data.

Step 7 - Organise samples and data in the Inventory

Open the Inventory tab to manage reusable entities (Materials, Methods and Publications) and stock. It gives the whole lab a shared, searchable catalogue.

Open the Tools tab to reach the administrator tools: the User Manager, Vocabulary Browser, Storage Manager, exports and settings.

Architecture

openBIS is a two-server application. The Application Server (AS) serves the ELN-LIMS web interface and the V3 programmatic API on an internal HTTPS port (8443). Users reach it through the nginx reverse proxy on port 80.

The Data Store Server (DSS) manages the dataset store and registers itself with the AS on start (internal port 8444).

Both servers run as the unprivileged openbis user. They keep their state on the dedicated data disk mounted at /home/openbis (the install tree), with the dataset store at /home/openbis/data. PostgreSQL 15 holds the openBIS database and is bound to localhost.

The firewall (ufw) denies all inbound traffic except ports 22 and 80, so the AS, DSS and database are never reachable from outside the VM.

Step 8 - Use the programmatic API

openBIS exposes a JSON-RPC V3 API through the same nginx proxy, so you can automate registration and integrate instruments and pipelines.

To obtain a session token, run the command below on the VM and substitute the administrator password from Step 5: when calling remotely, replace 127.0.0.1 with your VM's public address.

curl -s -H 'Content-Type: application/json' \
  -d '{"id":"1","jsonrpc":"2.0","method":"login","params":["admin","<OPENBIS_ADMIN_PASSWORD>"]}' \
  http://127.0.0.1/openbis/openbis/rmi-application-server-v3.json

The session token is returned in the result field of the response. The Python pybis library and the openBIS documentation describe the full API surface.

Maintenance

• Restart the servers: sudo systemctl restart openbis-as openbis-dss
• Logs: the AS log is under /home/openbis/openbis/servers/openBIS-server/jetty/logs/ and the DSS log is under /home/openbis/openbis/servers/datastore_server/log/.
• Database: PostgreSQL 15 runs locally. Back up the openbis_prod database with pg_dump on a schedule.
• Security updates: unattended-upgrades is enabled, so OS security patches are applied automatically.
• TLS: for production, front the appliance with your own TLS termination (for example an Azure Application Gateway or a customer-managed nginx certificate) so that browser traffic to port 80 is encrypted in transit.

Support

openBIS is developed by Scientific IT Services at ETH Zurich and is licensed under the Apache License 2.0. This SecureAnyCloud image comes with 24/7 support. For help with the image, contact SecureAnyCloud support. For questions about using openBIS itself, see the openBIS documentation.

Deploy on Azure

Launch openBIS Research Data Management on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com