Overte

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size for a small world.

Configure these network security group (NSG) inbound rules:

• 22/tcp from your management network, for SSH administration
• 40100/tcp from your management network, for the settings console. Restrict this port to trusted IP addresses.
• 40102/udp from your visitors, for the Overte client connection port

Only 40102/udp needs to be open to the public for visitors to connect. Keep the administration ports (22/tcp, 40100/tcp) restricted to your own network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Overte by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size (Standard_B2s recommended). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22).

After deployment, add inbound rules for 40102/udp (visitors) and 40100/tcp (restricted to your management network).

Step 2 - Deploy from the Azure CLI

Deploy the same image from the Azure CLI. Replace the resource group, location and SSH key path to suit your environment.

az group create --name overte-rg --location eastus
az vm create \
  --resource-group overte-rg \
  --name overte-domain \
  --image <sac-overte-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard
# Visitors connect over UDP 40102; keep the admin ports to your own network.
az vm open-port --resource-group overte-rg --name overte-domain --port 40102 --priority 1001

Step 3 - Confirm the world server is running

SSH in as azureuser and confirm that the domain server and its assignment-clients are active. The overte-server@default.target controls overte-domain-server@default.service and overte-assignment-client@default.service.

systemctl is-active overte-server@default.target \
  overte-domain-server@default.service \
  overte-assignment-client@default.service

All three units report active:

active active active

Confirm that the settings console listens on TCP 40100 and the client connection port on UDP 40102:

sudo ss -ltnp | grep :40100
sudo ss -lunp | grep :40102

Step 4 - Read your per-VM administrator credentials

Upstream ships the domain settings console with no authentication, so anyone who can reach it could take over the world. This image is different. On first boot it generates a unique administrator username and password, stores only a SHA256 hash of the password in the domain settings, and writes the credentials to a root-only file.

Read the credentials file:

sudo cat /root/overte-credentials.txt

The output looks like this. Your password differs because it is unique to this VM:

OVERTE_ADMIN_USERNAME=admin OVERTE_ADMIN_PASSWORD=<OVERTE_ADMIN_PASSWORD> OVERTE_DOMAIN_URL=<OVERTE_DOMAIN_URL> OVERTE_SETTINGS_URL=<OVERTE_SETTINGS_URL> OVERTE_CONNECT_ADDRESS=<vm-ip>:40102

Verify that the settings console rejects unauthenticated and wrong-password requests and accepts only the per-VM administrator credentials:

PASS='<OVERTE_ADMIN_PASSWORD>' curl -s -o /dev/null -w "no credentials -> HTTP %{http_code}\n" http://127.0.0.1:40100/settings/ curl -s -o /dev/null -w "wrong password -> HTTP %{http_code}\n" -u admin:wrong http://127.0.0.1:40100/settings/ curl -s -o /dev/null -w "per-VM credentials -> HTTP %{http_code}\n" -u "admin:$PASS" http://127.0.0.1:40100/settings/

Expected result:

no credentials -> HTTP 401 wrong password -> HTTP 401 per-VM credentials -> HTTP 200

Step 5 - Open the settings console

From your management network, browse to the settings console at http://<vm-ip>:40100/. Your browser prompts for the username and password from the credentials file.

After you sign in, the Nodes page shows the running world server with all six assignment-clients connected: the audio and avatar mixers, the entity and asset servers, the entity-script server and the messages mixer.

Use the Settings page to configure networking, directory services, security and the behaviour of the world. You can also change the administrator username and password there later.

Use the Content page to manage the objects installed in your world and the automatic content archives (backups) that the domain keeps.

Use the Assignment page to run assignment-client scripts inside your world for custom server-side behaviour.

Step 6 - Confirm the world is live and connect a client

Confirm that every assignment-client has registered with the domain. You can check from the settings console or from the command line. Query the node list with your administrator credentials:

PASS='<OVERTE_ADMIN_PASSWORD>'
NODES=$(curl -s -u "admin:$PASS" http://127.0.0.1:40100/nodes.json)
echo "$NODES" | jq -r '.nodes[].type' 2>/dev/null | sort || true

All six assignment-clients are connected:

asset-server audio-mixer avatar-mixer entity-script-server entity-server messages-mixer

To visit your world, install the Overte client on your desktop. In the client's address bar, enter your domain's connection address:

<vm-ip>:40102

The client connects to the domain over 40102/udp and you arrive in your world. Other people who connect to the same address can meet you there.

Step 7 - Day-two administration

Restart the whole world server. This brings the domain-server and assignment-clients down and up together:

sudo systemctl restart overte-server@default.target

Follow the domain-server log:

sudo journalctl -u overte-domain-server@default.service -f

The domain's configuration and content live under /var/lib/overte/default, owned by the overte user. To change the administrator credentials, edit the Security section of the settings console.

Secure by default

• No default administrator ships in the image. Upstream serves the settings console with no authentication. This image generates a unique administrator username and password on first boot and stores only a SHA256 hash of the password in the domain settings.
• The console never opens unprotected. The domain-server and assignment-clients do not start on first boot until the credential has been generated and seeded, so the console is never reachable without a password.
• The credential is unique per VM. It is written to /root/overte-credentials.txt (mode 0600, root only), so no two deployments share a secret.
• Only the client connection port needs to face the public. Keep 22/tcp and 40100/tcp restricted to your management network.

Source and licence

Overte is free and open source software licensed under the Apache License 2.0. The domain server is installed from the official upstream packages published at public.overte.org. The corresponding source is available from the Overte project on GitHub (release 2026.04.1). The Apache-2.0 licence text is included on the image at /opt/overte/LICENSE.

Deploy on Azure

Launch Overte Domain Server on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com