Ralph DCIM

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Ralph DCIM by SecureAnyCloud and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443).

Then select Review + create, and Create.

Replace the example values with your own resource group, VM name and region.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:ralph-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-resource-group \
  --name ralph-01 \
  --image sac1647283583153:ralph-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group my-resource-group --name ralph-01 --port 443 --priority 1001

The first boot generates this VM's secrets, applies the database schema and creates your administrator account before the web interface is allowed to serve anything. It normally takes under a minute. Confirm that it has finished:

sudo systemctl is-active ralph-firstboot.service
sudo test -f /var/lib/sac/data/ralph-firstboot.done && echo "first boot complete"

Then confirm the whole stack is running. ralph is the application container, ralph-rqworker its background worker:

sudo systemctl is-active mysql redis-server docker ralph ralph-rqworker nginx

The image is pinned to an exact upstream digest rather than a floating tag, so every VM from this image runs byte-identical application code:

cat /etc/ralph/image-digest

Every VM generates its own credentials on first boot. They are written to /root/ralph-credentials.txt, readable only by root:

sudo stat -c '%a %U:%G %n' /root/ralph-credentials.txt
sudo cat /root/ralph-credentials.txt

The file contains your web address, the administrator username and password, the Ralph database credentials and the MySQL root password.

To read just the administrator login:

sudo grep -E '^RALPH_(URL|ADMIN_USER)=' /root/ralph-credentials.txt

Store the password in your own secret manager. Then sign in at https://<vm-public-ip>/. The browser warns about the self-signed certificate until you add your own in Step 9.

Only SSH and the two web ports are reachable from outside the VM. MySQL (3306), Redis (6379) and gunicorn (8000) are bound to the loopback address and cannot be reached from the network:

sudo ss -H -lnt | awk '{print $4}' | sort -u curl -s -o /dev/null -w '%{http_code} -> %{redirect_url}\n' http://127.0.0.1/

Every address in that list other than 0.0.0.0:22, 0.0.0.0:80 and 0.0.0.0:443 is a loopback address.

Alongside the three application services, you also see 127.0.0.53 and 127.0.0.54 on port 53, which are the system resolver. You also see one high-numbered 127.0.0.1 port that belongs to containerd and changes on every boot. None of them is reachable from outside the VM.

Port 80 answers only with a redirect to HTTPS, plus an unauthenticated /healthz endpoint for load balancer probes:

curl -s http://127.0.0.1/healthz

The image ships a self-test that signs in through nginx with your VM's own administrator password, exactly as a browser does, and then proves that a wrong password and an anonymous request are both refused:

sudo /usr/local/sbin/ralph-selftest.sh

You can also check that Ralph's own published default account does not exist on your VM. It never does, because this image creates only your per-VM administrator:

sudo /usr/local/sbin/ralph-mysql -N -B -e \
  "SELECT COUNT(*) AS default_account_count FROM ralph_ng.accounts_ralphuser WHERE username='ralph'"

Sign in at https://<vm-public-ip>/ with the username and password from Step 4. Ralph opens on a dashboard that summarizes your estate. It is empty on a new VM and fills in as you add hardware.

Build the physical hierarchy from the top down, using the Data Center menu:

• Data Center: create one entry per site.
• Server Room: create the rooms inside each data center.
• Rack: create racks inside each server room, setting the rack's height in U.
• Data Center Asset: add hardware, choosing its model, status, service environment, rack and U position.

Assets are listed with their full physical path, so you can always see which data center, server room, rack and U position a machine occupies:

Filtering the asset list by rack gives you that rack's contents, which is the inventory view an engineer needs before visiting the floor:

The Back Office menu tracks non-rack equipment (laptops, phones, monitors) through the same lifecycle. Licenses, Supports and Domains attach contracts and entitlements to the assets they cover.

Ralph exposes its whole data model over a REST API, which is how most teams load an existing estate in bulk and keep it in sync. Authenticate with an API token. Create it in the web interface under your username, then My API token.

The API root lists every available endpoint:

curl -s -k https://127.0.0.1/api/ -H 'Accept: application/json' | head -c 400

With a token, list your data center assets. Replace <your-api-token> with the token you generated:

curl -s -k https://127.0.0.1/api/data-center-assets/ \
  -H 'Authorization: Token <your-api-token>' \
  -H 'Accept: application/json' | head -c 400

The same API accepts POST to create assets and PATCH to update them, so you can load an existing CMDB export with a short script.

The image generates a self-signed certificate for your VM's addresses. For production, point a DNS name at the VM and install a real certificate.

Ralph validates the Host header of every request, so first add your DNS name to the allowed hosts and trusted origins.

Edit /etc/ralph/conf.d/sac.conf and append your name to both RALPH_ALLOWED_HOSTS and RALPH_CSRF_TRUSTED_ORIGINS. The latter needs the https:// scheme. Then restart:

sudo sed -i 's#^RALPH_ALLOWED_HOSTS="\(.*\)"#RALPH_ALLOWED_HOSTS="\1,ralph.example.com"#' /etc/ralph/conf.d/sac.conf
sudo sed -i 's#^RALPH_CSRF_TRUSTED_ORIGINS="\(.*\)"#RALPH_CSRF_TRUSTED_ORIGINS="\1,https://ralph.example.com"#' /etc/ralph/conf.d/sac.conf
sudo systemctl restart ralph.service

Then obtain a certificate. With the DNS name resolving to the VM and port 80 reachable:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d ralph.example.com

Certbot updates the nginx server block and installs a renewal timer.

Everything you enter lives in the MySQL database, plus any uploaded files under /var/lib/ralph/media. Back up both.

sudo mysqldump --defaults-file=/etc/mysql/debian.cnf --single-transaction ralph_ng \
  | sudo tee /var/backups/ralph-$(date +%F).sql > /dev/null
sudo tar czf /var/backups/ralph-media-$(date +%F).tar.gz -C /var/lib/ralph media
sudo ls -la /var/backups/

/etc/mysql/debian.cnf holds this VM's own maintenance credential, so a scheduled dump needs no password in the crontab.

Restore by loading the dump back into an empty database and restarting the application:

sudo /usr/local/sbin/ralph-mysql -e "DROP DATABASE ralph_ng; CREATE DATABASE ralph_ng CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
sudo /usr/local/sbin/ralph-mysql ralph_ng < <backup-dir>/ralph-2026-09-20.sql
sudo systemctl restart ralph.service ralph-rqworker.service </dev/null

This replaces the whole database, so run it only against a VM you intend to overwrite.

Ubuntu security updates are applied automatically by unattended-upgrades. Check for pending updates at any time:

sudo apt-get update && apt-get -s dist-upgrade | grep -c '^Inst ' || true

To move to a newer Ralph release, pull the new upstream image, repin the digest, apply any new migrations and restart. Replace the tag with the release you want:

sudo docker pull allegro/ralph:<version>
sudo docker image inspect allegro/ralph:<version> --format '{{index .RepoDigests 0}}' | sudo tee /etc/ralph/image-digest
sudo /usr/local/sbin/ralph-manage migrate --noinput sudo systemctl restart ralph.service ralph-rqworker.service </dev/null

Take a backup (Step 10) before upgrading, and read the upstream release notes for the versions you are skipping.