OpenList

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point, because OpenList is lightweight. Scale up for very large libraries or many concurrent users.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network. Also allow 80/tcp (plus 443/tcp once you enable HTTPS) from the networks your users will reach OpenList on.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for OpenList by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create and Create.

First-boot initialization takes a few seconds after the VM starts.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:openlist-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name openlist \
  --image sac1647283583153:openlist-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name openlist --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Verify the OpenList stack

Two systemd services make up the stack. Confirm that both are active and that the unauthenticated health endpoint answers through nginx:

systemctl is-active openlist nginx curl -s http://127.0.0.1/ping

Both services report active, and the health endpoint returns pong.

Next, confirm that the OpenList server binds to loopback only, with nginx as the sole public listener:

sudo ss -tlnp | grep -E ':80 |:5244 '

Port 80 (nginx) listens on all interfaces. Port 5244 (OpenList) is bound to 127.0.0.1 only.

Step 5 - Retrieve your administrator login

First boot stores the generated login for the admin account in a root-only file. It lists the OpenList URL, the administrator username (admin) and the password:

sudo cat /root/openlist-credentials.txt

Store the password in your password manager and treat the file as sensitive. To set a new password from the command line, use OpenList's own admin command:

cd /opt/openlist && sudo -u openlist ./openlist admin set 'your-new-password'

Step 6 - Verify authentication

The login API rejects a wrong password and issues a token for the generated administrator password. Run the commands below. The first request reports code 401, the second returns a token, and the authenticated /api/me call reports the admin user:

PASS=$(sudo grep '^openlist.admin.pass=' /root/openlist-credentials.txt | cut -d= -f2-)
curl -s -X POST http://127.0.0.1/api/auth/login -H 'Content-Type: application/json' -d '{"username":"admin","password":"wrong"}' | jq -r '.code'
TOKEN=$(curl -s -X POST http://127.0.0.1/api/auth/login -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"$PASS\"}" | jq -r '.data.token')
curl -s http://127.0.0.1/api/me -H "Authorization: $TOKEN" | jq -r '.data.username'

Step 7 - Sign in to the web app

Open http://<vm-public-ip>/ in a web browser. Sign in with the username admin and the password from /root/openlist-credentials.txt.

The web app opens the file browser. Once you add a storage backend in the next step, your files, folders and previews appear here in a list you can navigate, search, sort and share.

Step 8 - Add a storage backend

A fresh install has no storage mounted yet. Open Manage (at the bottom of the page, or go to /@manage), then choose Storages and Add. Choose a driver and a mount path, and save.

OpenList supports many backends. Start with Local, a directory on the VM, and add object storage or cloud drives later:

• Local: a directory on the VM disk, for example mount path / with root folder /srv/files
• S3: any S3-compatible object store (AWS S3, MinIO, Backblaze B2, Wasabi and others)
• WebDAV, FTP/SFTP and dozens of cloud-drive providers

Each storage is mounted at a virtual path and can be enabled, disabled or reordered independently. A working storage shows Status: Working.

You can also add a storage over the API with your admin token. This example mounts a Local backend at /:

curl -s -X POST http://127.0.0.1/api/admin/storage/create \
  -H "Authorization: $TOKEN" -H 'Content-Type: application/json' \
  -d '{"mount_path":"/","driver":"Local","order":0,"status":"work", "addition":"{\"root_folder_path\":\"/srv/files\"}"}'

Once a storage is mounted, list its contents over the API to confirm that files are served:

curl -s -X POST http://127.0.0.1/api/fs/list -H 'Content-Type: application/json' -d '{"path":"/","page":1,"per_page":0,"refresh":true}' | jq -r '.data.content[]?.name // "(add a storage to see files)"'

Step 9 - Configure global settings

Open Manage, then Settings, then Global to control site-wide behavior. The options include hide-file patterns, package downloads, link expiry, custom head and body, sign-all for direct links, and single sign-on and LDAP integration.

The site, style and preview options let you brand the front page and choose how documents, images, audio and video are previewed in the browser.

Step 10 - Access files over WebDAV

Every mounted storage is also available over WebDAV, so you can map OpenList as a network drive or use it from sync clients. The WebDAV root is served at /dav. Connect with the admin user and password, or with a dedicated user you create under Manage and Users:

# macOS Finder: Go → Connect to Server → http://<vm-public-ip>/dav
# Linux: rclone / davfs2 against http://<vm-public-ip>/dav

OpenList runs on your own VM, so your files and traffic stay on infrastructure you control.

Security baseline

The image is captured with the Ubuntu 24.04 security baseline fully applied, including phased updates. It ships with unattended security upgrades enabled, so your VM keeps patching itself after deployment:

cat /etc/apt/apt.conf.d/20auto-upgrades systemctl is-enabled unattended-upgrades || true

The OpenList server binds to loopback only, and nginx is the single public listener. The shipped image contains no database, so no default account exists until first boot creates a unique one:

jq -r '.scheme.address, .scheme.http_port' /opt/openlist/data/config.json

Enabling HTTPS

For production use, serve OpenList over HTTPS so that logins and file transfers are encrypted in transit. Point a DNS A record at the VM's public IP address, then install a certificate with Certbot. Replace the example domain with your own:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

After you enable HTTPS, open 443/tcp in the NSG. Set the site URL under Manage, Settings, Site to your https:// address. Then restrict or close inbound port 80.

Backup and maintenance

All OpenList state lives under /opt/openlist/data: the SQLite database data.db (users, storages, settings) and the search index. The simplest logical backup is to copy that file while the service is stopped. You can also snapshot the OS disk.

sudo systemctl stop openlist
sudo cp /opt/openlist/data/data.db /var/backups/openlist-data-$(date +%F).db
sudo systemctl start openlist

Apply operating system security updates with sudo apt update && sudo apt upgrade. The services restart cleanly. Restart the server at any time with sudo systemctl restart openlist.

License and source

OpenList is free software licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). In compliance with the license, the complete, unmodified upstream source for the exact version shipped in this image is on disk at /opt/openlist/SOURCE/openlist-v4.2.3-source.tar.gz. A NOTICE file points to it and to the upstream repository.

SecureAnyCloud makes no modifications to the OpenList program itself.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email and chat for help with deployment, storage-backend configuration, TLS termination and access-control setup.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch OpenList on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com