Oqtane

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Choose a larger size for bigger or busier sites.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the site and admin. The embedded SQLite database is never exposed on the network, and Kestrel listens on 127.0.0.1 only.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Oqtane by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:oqtane-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name oqtane \
  --image sac1647283583153:oqtane-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the site and admin:

az vm open-port --resource-group <your-rg> --name oqtane --port 80 --priority 900

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that the Oqtane (Kestrel) service, nginx and the first-boot unit are all active. Kestrel listens only on 127.0.0.1:5000, and nginx is the only public listener, serving :80. The unauthenticated /healthz endpoint answers 200 for load balancer probes.

systemctl is-active oqtane nginx oqtane-firstboot

ss -ltnH | grep -E ':(80|5000)' | awk '{print $4}' | sort -u

curl -s -o /dev/null -w '/healthz -> %{http_code}\n' http://127.0.0.1/healthz

First boot completes the Oqtane install automatically. Immediately after a reboot, the .NET app performs a short just-in-time warm-up, so allow around 30 seconds before the first page request responds.

Step 4 - Retrieve the per-VM host administrator login

Every VM creates its own Oqtane host administrator on first boot. It writes the username, the generated password and the site URL to a root-only credentials file. Read the file with sudo:

sudo cat /root/oqtane-credentials.txt

Sign in with the OQTANE_ADMIN_USER value (which is host) and the OQTANE_ADMIN_PASSWORD value from this file.

Step 5 - Sign in

Browse to http://<vm-public-ip>/ and choose Login at the top right, or go straight to http://<vm-public-ip>/login. Sign in with the username host and the password from Step 4.

Step 6 - Open the Admin Dashboard

Signed in as the host user, open the Admin Dashboard from the gear icon in the top navigation, or at http://<vm-public-ip>/admin. The dashboard is the control center for the whole installation: Site Settings, Page Management, User and Role Management, Module and Theme Management, File Management, Scheduled Jobs, SQL Management and more.

Step 7 - View the public website

Your public site is served at http://<vm-public-ip>/. On a fresh install, the silent installer has already provisioned the default site and theme, so Oqtane serves a real, rendered welcome page immediately and you never see an install wizard. As you build and publish pages in the admin, they replace this starter content.

Step 8 - Build pages with the control panel

When you are signed in, Oqtane shows a control panel in the top navigation (the pencil and gear icons) for adding and editing pages and modules directly on the site. Use it to add your first page, add modules and publish content.

Step 9 - No known or default credentials

Oqtane ships no default login, and this image goes further. The captured image contains no database and no DataProtection keyring at all, and the host administrator is created with a unique per-VM secret the first time the VM boots.

You can verify that only the per-VM secret works by using the built-in round-trip check. It confirms that the per-VM host administrator authenticates through the sign-in API, while a blank password, common guesses and any build-time value are all rejected:

sqlite3 /var/lib/oqtane/data/Oqtane.db 'SELECT Username FROM "User";'

sudo bash /usr/local/sbin/oqtane-cred-roundtrip.sh

Step 10 - Verify the stack and where your data lives

Confirm the ASP.NET Core runtime and the Oqtane framework. The SQLite database, the ASP.NET Core DataProtection keyring and your uploaded content all live on this VM's disk, so your site persists across reboots and travels with the VM.

dotnet --list-runtimes | grep AspNetCore

ls /opt/oqtane/app/Oqtane.Server.dll

Adding your own domain

The image serves the site on the VM's public IP address out of the box. Oqtane routes requests using site aliases and enforces a single canonical alias for the site.

For production, add your own domain as an alias in Admin Dashboard -> Site Settings -> Aliases and make it the default. Then point your DNS at the VM, or at an Azure Load Balancer or Application Gateway in front of it. For TLS, terminate HTTPS at a load balancer or Application Gateway, or place your own reverse proxy or certificate in front of nginx.

Security notes

• Protect the host login. The host administrator account is unique per VM, and no known or blank credential authenticates. Keep /root/oqtane-credentials.txt protected, and change the password from within Oqtane if you share access.
• Per-VM authentication keys. The ASP.NET Core DataProtection keyring is generated per VM on first boot, so authentication cookies are never shared between customer VMs.
• Keep Kestrel private. Kestrel listens on 127.0.0.1:5000 only and is never reachable from the network. nginx is the only public listener.
• Know where the data lives. The SQLite database is at /var/lib/oqtane/data/Oqtane.db on the VM.
• Encrypt web traffic. Restrict inbound 80/tcp in your NSG to the networks that need the site, and front the site with your own TLS for production.

Support

SecureAnyCloud maintains this image and provides 24/7 support. For help deploying or operating Oqtane on Azure, contact us at secureanycloud.com.

Deploy on Azure

Launch Oqtane 10 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com