SecureAnyCloud
Deployment guide

Opengist

Overview

Opengist is an open source, self-hosted pastebin powered by Git. Every snippet you save, called a gist, is a real Git repository, so each paste carries full version history and can be cloned and pushed over HTTP.

This SecureAnyCloud image serves Opengist 1.13.1 behind an nginx reverse proxy on a hardened Ubuntu 24.04 LTS base, patched at build time. It ships with no administrator account, so the first user to register becomes the admin. Each instance also generates its own session secret on first boot, so no shared or default credential is baked into the image.

What you get:

  • Opengist 1.13.1 served behind nginx, managed by systemd
  • The Opengist web interface, Git over HTTP and the REST API on :80
  • Syntax highlighting, code search, public, unlisted and private visibility, and optional sign-in through OAuth, OpenID Connect or LDAP
  • No default administrator: the first user to register becomes the admin
  • An embedded SQLite datastore and on-disk Git repositories, with no separate database to run
  • The server bound to 127.0.0.1:6157 only, never exposed directly to the network
  • A dedicated Azure data disk at /opt/opengist for the database, the gist repositories and the search index
  • opengist.service and nginx.service as enabled systemd units
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Choose a larger size for busier instances or larger repositories.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. Opengist serves plain HTTP on port 80, so for production terminate TLS in front of it with your own domain. The server listens on 127.0.0.1:6157 only, so port 6157 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Opengist by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:opengist-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name opengist \
  --image sac1647283583153:opengist-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the web interface:

az vm open-port --resource-group <your-rg> --name opengist --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that Opengist and nginx are active. The server listens only on 127.0.0.1:6157, while nginx serves the web interface on port 80.

systemctl is-active opengist nginx opengist-firstboot
sudo ss -tlnp | grep -E ':80 |:6157 ' | sed 's/ */ /g'

Step 4 - Read the instance info note

Opengist ships with no administrator account. On the first boot of every VM, a one-shot service writes an instance info note that records the site URL and the register instruction. The note contains no password, because the first user to register becomes the admin. Read it with sudo:

sudo cat /root/opengist-credentials.txt

Then check that the server is healthy. The health endpoint returns 200:

curl -s -o /dev/null -w 'GET /healthcheck -> HTTP %{http_code}\n' http://127.0.0.1/healthcheck

Step 5 - Register your admin on first visit

Browse to http://<vm-public-ip>/. The image ships with no user, so open the Register page and create the first account. The first user to register automatically becomes the administrator.

Choose a username and a strong password, then select Register. There are no default credentials to change, because none ship.

Step 6 - Create your first gist

Once you are signed in, select New to open the gist editor. Give the file a name with an extension (for example healthcheck.sh) and paste or type your snippet into the editor. Opengist detects the language from the file extension and applies syntax highlighting.

Choose the visibility: public, unlisted or private. To add a title, description and topics, use Metadata.

Step 7 - View and share the gist

Select Create. Opengist saves the snippet as a Git repository and opens its view page.

The page shows the highlighted code and a Revisions tab that tracks every change. Use the controls to Like, Edit or Download ZIP, to view the Raw file, or to copy an Embed snippet for a blog or wiki.

Step 8 - Browse your gists

Your profile page lists every gist you own, with a preview of each snippet and filters for visibility, language and topics. Public and unlisted gists from other users appear under All in the top navigation. The code search box searches across the whole instance.

Step 9 - Clone and push over Git

Every gist is a real Git repository, so you can clone it, commit locally and push changes back over HTTP. Copy the gist URL from its view page and use ordinary Git commands. Sign in with the account you registered in Step 5:

git clone http://<vm-public-ip>/<username>/<gist-id>.git cd <gist-id>
# edit files, then
git add -A && git commit -m "update snippet"
git push

To create a new gist by pushing a repository, create the gist in the web interface first. Then set its URL as a remote and push.

Step 10 - Verify the stack

Check the Opengist version, confirm that the services are enabled and that the web interface responds through nginx, and confirm the dedicated data disk mount:

/usr/local/bin/opengist version
systemctl is-enabled opengist nginx
curl -s -o /dev/null -w 'GET /healthcheck -> HTTP %{http_code}\n' http://127.0.0.1/healthcheck
findmnt -no SOURCE,TARGET,FSTYPE /opt/opengist

Step 11 - Where your data lives

The SQLite database, every gist Git repository and the search index live on a dedicated Azure data disk mounted at /opt/opengist, separate from the OS disk. The disk is captured into the image and re-provisioned on every VM. You can snapshot and resize it independently.

Confirm the mount and the free space:

df -h /opt/opengist | tail -1
sudo ls -la /opt/opengist

Security notes

  • Encrypt web traffic. Opengist serves plain HTTP on port 80. For production, put it behind your own TLS-terminating reverse proxy or an Azure Application Gateway with a certificate for your domain, and restrict port 80 in the NSG to trusted networks. A common approach is certbot with your domain on a front-end proxy.
  • Keep the server private. It listens on 127.0.0.1:6157 only, so only nginx on port 80 faces the network. The built-in Git over SSH server is disabled, so only ports 22, 80 and 443 are in play.
  • Secure the first admin. The image ships with no administrator, so there are no shared or default credentials to rotate. After you register, open the admin settings and disable open sign-up if the instance is not meant to be public. Keep your admin password somewhere safe.
  • Keep the VM patched. The image is patched at build time and ships with unattended security upgrades enabled.

Support

SecureAnyCloud images come with 24/7 support. For questions about this Opengist image or help with your deployment, contact us through the SecureAnyCloud website.

Deploy on Azure

Launch Opengist on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure