PdfDing

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point. PdfDing is light on resources, though a large library benefits from a bigger OS disk because uploaded PDFs are stored on it.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, 80/tcp for the web application, and 443/tcp if you add TLS. PdfDing serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain and restrict access to trusted IP ranges (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for PdfDing by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:pdfding-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name pdfding \
  --image sac1647283583153:pdfding-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 so you can reach the web application:

az vm open-port --resource-group <your-rg> --name pdfding --port 80

Step 3 - Connect to your VM

Connect over SSH as the azureuser administrator:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that both services are active:

systemctl is-active pdfding.service nginx.service

Both report active. PdfDing runs under gunicorn on the loopback address 127.0.0.1:8000, and nginx fronts it on port 80. The application is never bound to a public interface, so nginx is the only way in.

Step 5 - Retrieve your admin credentials

PdfDing signs you in with an email address, not a username. The first boot of your VM generates a single administrator account and a unique password and writes them to a root-only file. Read it with sudo:

sudo cat /root/pdfding-credentials.txt

The file contains PDFDING_USERNAME (the admin email address), PDFDING_PASSWORD and the PDFDING_URL to open in a browser. Its mode is 0600 root:root. PdfDing ships no default account, so no shared or predictable credential exists anywhere in the image.

Store the password somewhere safe, and change it after your first sign-in (see Maintenance).

Step 6 - Confirm the health endpoint

PdfDing provides an unauthenticated health endpoint for load balancers and probes. Request it:

curl -s -o /dev/null -w 'health: %{http_code}\n' http://localhost/healthz

The command returns health: 200. This endpoint never requires authentication, so you can point an Azure Load Balancer health probe at it.

Step 7 - Confirm authentication is required

PdfDing manages its own login, so your document library cannot be reached without signing in. An unauthenticated request to the library returns HTTP 302 and redirects to the sign-in page, while the health endpoint stays open. Verify both:

echo "health : $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/healthz)"
echo "library : $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/pdf/)"

The output is health : 200 and library : 302. Every document view, the tag browser and the settings pages require the per-VM administrator password. Only the health endpoint is open. gunicorn is bound to loopback, and nginx is the only way in.

Step 8 - Confirm the installed version and components

PdfDing runs on Django in a dedicated virtual environment. Confirm the framework version, the PdfDing release and that the core components are in place:

/opt/pdfding/venv/bin/python -c "import django; print('Django', django.get_version())"
sudo grep VERSION /opt/pdfding/app/pdfding/core/settings/version.py
sudo ls -1 /opt/pdfding/venv/bin/gunicorn /opt/pdfding/data/db/db.sqlite3 /etc/systemd/system/pdfding.service

The output reports Django 5.2.15 and VERSION = 'v1.10.0', and lists the gunicorn binary, the SQLite database and the systemd unit.

Then confirm that the in-browser PDF viewer's assets are being served, which is what makes the reader work:

curl -s -o /dev/null -w 'pdf.js viewer: %{http_code}\n' http://127.0.0.1/static/pdfjs/web/viewer.mjs

The command returns pdf.js viewer: 200.

Step 9 - Sign in

Browse to http://<vm-public-ip>/. PdfDing shows its sign-in page. Enter the email address and password from Step 5. The field takes an email address, so entering a username will not work.

After you sign in, you land on your document library. It is empty on a fresh instance: the image ships no sample documents and no other user's data.

Step 10 - Upload your first PDF

Choose the add or upload control in the library. Give the document a name and, optionally, one or more tags, then confirm. PdfDing stores the file on the VM's own disk under /opt/pdfding/data/media and adds it to your library.

Tags are hierarchical. A tag such as finance/invoices creates a nested structure in the sidebar, so a large library stays navigable. You can also mark documents as favourites and filter by tag or search term from the library toolbar.

Step 11 - Read a PDF in the browser viewer

Select a document to open it in PdfDing's built-in reader. The viewer runs entirely in your browser and gives you page navigation, zoom, text selection and search within the document.

PdfDing remembers the page you stopped on. Reopening a long document returns you to where you were, not to page one.

Step 12 - Add more users

Self-service registration is disabled on this image by default, so strangers cannot sign up to a public-facing instance. To add another user, open the admin area from the profile menu and create the account there.

To open self-service registration instead, set DISABLE_USER_SIGNUP=FALSE in the environment file and restart the service:

sudo sed -i 's/^DISABLE_USER_SIGNUP=TRUE/DISABLE_USER_SIGNUP=FALSE/' /opt/pdfding/pdfding.env
sudo systemctl restart pdfding.service

Do this only if the instance is not reachable from the public internet, or if you are comfortable with anyone who can reach it creating an account.

Maintenance

• Password. The administrator password is generated on first boot and stored in /root/pdfding-credentials.txt (mode 0600 root:root). The recommended way to change it is the web interface: open the profile menu and choose Settings.
• Where your documents live. Uploaded PDFs, the SQLite database and the consume drop box are all under /opt/pdfding/data on the OS disk. Back up that directory, or take Azure disk snapshots, to protect your library. Growing the OS disk is the simplest way to make room for more documents.
• Adding a custom domain. PdfDing validates the hostname each request arrives on. Add the new domain to HOST_NAME in /opt/pdfding/pdfding.env as a comma-separated entry, then run sudo systemctl restart pdfding.service. If you skip this, requests on the new name are rejected with a bare HTTP 400 even though every service is healthy.
• Adding TLS. Terminate TLS in front of PdfDing with your own certificate. Once you serve over HTTPS, set CSRF_COOKIE_SECURE=TRUE and SESSION_COOKIE_SECURE=TRUE in /opt/pdfding/pdfding.env and restart the service, so the session and CSRF cookies are only ever sent over an encrypted connection. These settings are FALSE by default on a plain-HTTP appliance, because browsers refuse to store secure cookies over HTTP, which would make signing in impossible.
• Logs. Run sudo journalctl -u pdfding.service -f for the application and gunicorn, and sudo journalctl -u nginx.service for the reverse proxy.
• Updates. The OS is fully patched at build time and continues to receive unattended security updates. PdfDing itself is pinned to the release this image ships. Upgrade it deliberately rather than automatically, so a schema migration never runs unattended against your library.
• Health probes. Point Azure Load Balancer or Application Gateway probes at /healthz, which returns 200 without authentication.

Support

This image is published and supported by SecureAnyCloud with 24/7 support. For product documentation, see the PdfDing documentation. For image or deployment questions, contact SecureAnyCloud support.

Deploy on Azure

Launch PdfDing on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com