Pingvin Share

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.

Standard_D2s_v3 (2 vCPU / 8 GiB RAM) is a good starting point. Scale up for heavier upload activity or more users.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp (HTTP) from your users. Add 443/tcp if you enable HTTPS. The backend API on 8080 and the frontend on 3333 are private to the VM and never exposed by the NSG.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Pingvin Share by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:pingvin-share-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name pingvin-share \
  --image sac1647283583153:pingvin-share-ubuntu-24-04:default:latest \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open HTTP so you can reach the web UI:

az vm open-port --resource-group <your-rg> --name pingvin-share --port 80 --priority 900

Step 3 - Connect to your VM

Connect over SSH as the azureuser administrator:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

The three services that back Pingvin Share should all report active. The unauthenticated /api/health health endpoint answers through nginx on port 80. Check both:

systemctl is-active pingvin-share-backend pingvin-share-frontend nginx curl -s http://127.0.0.1/api/health; echo

Expect three lines of active, then OK. The frontend listens only on the loopback address 127.0.0.1:3333 and the backend on :8080. nginx on port 80 is the only exposed application port, so the app servers are never reachable directly from the network.

Step 5 - Retrieve your administrator password

On the first boot of every VM, a one-shot service (pingvin-share-firstboot.service) starts the backend. The backend creates the database, generates a fresh application secret unique to that VM, and registers an administrator account with a random password. No shared or default password ships in the image.

Read the credentials file as root:

sudo cat /root/pingvin-share-credentials.txt

The file (mode 0600, root only) contains the sign-in URL, the administrator username (admin) and the generated password.

You can verify the sign-in round trip from the VM's own shell. The command below reads the per-VM password and posts a real sign-in. A wrong password is rejected with HTTP 401, and the correct password answers HTTP 200:

PASS=$(sudo grep '^pingvin.admin.pass=' /root/pingvin-share-credentials.txt | cut -d= -f2-)
echo -n 'health -> HTTP '; curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/api/health
echo -n 'bad pass -> HTTP '; curl -s -o /dev/null -w '%{http_code}\n' -X POST -H 'Content-Type: application/json' -d '{"username":"admin","password":"wrong"}' http://127.0.0.1/api/auth/signIn
echo -n 'admin -> HTTP '; curl -s -o /dev/null -w '%{http_code}\n' -X POST -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"$PASS\"}" http://127.0.0.1/api/auth/signIn

Expect health -> HTTP 200, bad pass -> HTTP 401 and admin -> HTTP 200. The last result confirms that the password in the file signs in.

Step 6 - Sign in and create a share

Browse to http://<vm-public-ip>/, choose Sign in, and enter admin with the password from the credentials file.

To create a share, open Upload and drag your files into the drop zone. Optionally set a password, an expiration date and a visitor limit. Then generate a secure link to send to recipients.

Step 7 - Manage your shares and administer the platform

Open My shares to see every share you have created, copy or revoke its link, and track downloads. Reverse shares let you generate an upload link, so external parties can send files to you without an account.

As the administrator, you also get an Administration area. From User management, you can create additional users, grant or revoke admin rights, and remove accounts. The configuration section controls registration, SMTP email, OAuth providers and storage back ends.

Step 8 - Confirm the version, the stack and the data disk

Check the Node.js version, the health endpoint and the data disk mount:

node --version curl -s http://127.0.0.1/api/health; echo findmnt -no SOURCE,TARGET,FSTYPE /data/pingvin

Expect Node.js v22, OK from the health endpoint, and /data/pingvin mounted from the dedicated data disk (/dev/sdc, ext4). The SQLite database and all uploaded files live on that disk. It is independently resizable and survives instance replacement. Resize it from the Azure portal if you need more room.

First-boot service and security model

A one-shot pingvin-share-firstboot.service runs after the network is up. It does the following:

• Starts the backend, which creates the SQLite database and seeds a fresh per-VM application secret.
• Registers an administrator with a random password through the application's own sign-up endpoint.
• Resolves the instance address from the Azure instance metadata service.
• Writes the credentials file at mode 0600 (root only).
• Drops a sentinel so it runs exactly once.

The image ships with an empty database and no usable login. The per-VM administrator is created on first boot. Verify the service state and the file permissions:

systemctl is-active pingvin-share-firstboot.service
sudo stat -c '%a %U:%G %n' /root/pingvin-share-credentials.txt

Expect active, then 600 root:root /root/pingvin-share-credentials.txt.

Enabling HTTPS with your own domain

The image serves the web UI over plain HTTP on port 80. For a browser-trusted certificate, point a DNS record at the VM and open port 443 in the NSG. Then install a certificate from your CA, for example Let's Encrypt:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot updates the nginx site to serve your domain certificate. Pingvin Share is served behind the proxy on loopback, so no application configuration change is needed. Your file sharing platform is then reachable over HTTPS at your domain.

Backup and maintenance

Pingvin Share stores everything, including the pingvin-share.db database and every uploaded file, under /data/pingvin on the dedicated data disk, so a backup is a single directory. For a full point-in-time copy, snapshot the data disk and the OS disk from the Azure portal. Alternatively, archive the directory tree:

sudo tar -C /data -czf /var/backups/pingvin-$(date +%F).tar.gz pingvin

Keep the OS current with sudo apt-get update && sudo apt-get upgrade. The image ships with unattended security updates enabled. Review the Pingvin Share documentation before moving between releases, and always back up before an upgrade.

Support

This image is backed by 24/7 SecureAnyCloud support. Support covers deployment and initial configuration, retrieving the first-boot administrator password, reverse proxy and TLS termination, SMTP email and OAuth provider configuration, S3-compatible storage back ends, SQLite database administration and backups, performance tuning, and storage administration.

Email sales@secureanycloud.com or use the live chat in the support portal. Critical issues receive a one-hour average response.

Deploy on Azure

Launch Pingvin Share on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Prerequisites

Before you deploy this image, you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users will reach Pingvin Share on
• The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Support

This image is published by SecureAnyCloud with 24/7 technical support by email and chat. Support covers Pingvin Share deployment, upgrades, reverse proxy and TLS termination, SMTP and OAuth configuration, S3 storage back ends, and database administration.

Pingvin Share is open-source software licensed under the BSD 2-Clause License. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Pingvin Share on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com