Razzia 4.0.1

• Open the Hardened Moodle & E-Learning Platforms AMIs listing by SecureAnyCloud, choose View purchase options, and subscribe.
• Choose Continue to Configuration. Under Software version, choose Razzia 4.0.1 on Ubuntu 24.04, pick your Region, and choose Continue to Launch.
• Under Choose Action, select Launch through EC2.
• Set the instance type to m5.large and choose your key pair. Use the seller's security group settings (ports 22, 80 and 443), and narrow port 22 to your management network.
• Launch the instance. First boot finishes within about a minute.

Run these commands from your workstation. Replace <ami-id> with the AMI ID shown for the Razzia 4.0.1 on Ubuntu 24.04 software version on the listing's launch page. Use your own VPC, subnet, key pair and address ranges.

aws ec2 create-security-group --group-name razzia-sg \
  --description "Razzia" --vpc-id <vpc-id>
aws ec2 authorize-security-group-ingress --group-id <security-group-id> \
  --protocol tcp --port 22 --cidr <your-ip>/32
aws ec2 authorize-security-group-ingress --group-id <security-group-id> \
  --protocol tcp --port 80 --cidr <players-cidr>
aws ec2 authorize-security-group-ingress --group-id <security-group-id> \
  --protocol tcp --port 443 --cidr <players-cidr>
aws ec2 run-instances --image-id <ami-id> --instance-type m5.large \
  --key-name <key-name> --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> --associate-public-ip-address \
  --metadata-options HttpTokens=required \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=razzia}]'
aws ec2 describe-instances --instance-ids <instance-id> \
  --query "Reservations[].Instances[].[PublicDnsName,PublicIpAddress]" --output text

ssh -i <key.pem> ubuntu@<public-dns>

The login user is ubuntu.

First boot generates this instance's secrets and certificate and starts the Razzia container. It proves that the manager password works, and only then starts the web server. When the three units are active, the game is ready.

systemctl is-active docker razzia nginx

active active active

Confirm that Razzia answers over HTTPS on the instance itself. The certificate is self-signed per instance, so -k is expected until you install your own (Step 10).

curl -sk https://127.0.0.1/api/health; echo

{"status":"ok"}

List the container and the image it runs.

sudo docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}"

NAMES IMAGE STATUS PORTS razzia sac/razzia:4.0.1 Up 20 seconds 127.0.0.1:3000->3000/tcp

Check the updated packages inside the container.

sudo docker exec razzia sh -c 'apk info -v 2>/dev/null | grep -E "^(nginx|nodejs|brotli-libs)-[0-9]"'

brotli-libs-1.2.1-r0 nginx-1.30.6-r0 nodejs-24.22.1-r0

List the listening sockets on the instance.

sudo ss -Htln | awk '{print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:3000 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

Only SSH, HTTP (redirect) and HTTPS listen on the network. Razzia is on loopback. Then confirm that the container cannot reach the instance metadata service.

sudo docker exec razzia wget -q -T 5 -O - http://169.254.169.254/latest/meta-data/ || true

wget: download timed out

Read the credentials file with sudo.

sudo cat /root/razzia-credentials.txt

# Razzia 4.0.1 - generated on this instance's first boot by razzia-postboot.service # This password is unique to this instance. Keep this file secret (0600 root). # # Players join at RAZZIA_URL with the game PIN the host shows (no account needed). # The host signs in at RAZZIA_URL/manager with MANAGER_PASSWORD (self-signed certificate made on first boot). RAZZIA_URL=https://ec2-203-0-113-10.compute-1.amazonaws.com/ MANAGER_PASSWORD=<the 24-character password generated for this instance> # # Change the password: edit /etc/razzia/secrets/razzia.env, then sudo systemctl restart razzia # Change the served name + certificate:
sudo razzia-set-hostname <your-dns-name>
# Quizzes, media and results live in /var/lib/razzia/config (back this directory up).

Keep this password private. It controls every quiz and game on the instance.

Open https://<public-dns>/manager in your browser. Your browser warns about the self-signed certificate until you install your own (Step 10). Accept the warning for this address.

Enter the manager password from Step 6. A wrong password is refused with "Invalid password".

After you sign in, your quizzes are listed. You can Play a quiz, edit or create quizzes under Quizz, and review finished games under Results.

• Select Example Quizz (or your own quiz) and choose Start game. The lobby shows the address players should open, a QR code and the six-digit Game PIN.
• Have players open https://<public-dns>/ on a phone or laptop, type the PIN, choose Submit, then enter a name. They appear in your lobby as they join.
• Choose Start when everyone is in. Each question shows on your screen, and the answer buttons appear on the players' devices. A leaderboard follows each question, and a podium ends the game.

Use the lock button in the lobby to stop new players joining once your group is complete.

Run razzia-roundtrip.sh to exercise the real public path on the instance. It checks HTTPS with this instance's certificate, the manager sign-in (including the refusal of wrong passwords) and the API's access rules. It then creates a game, joins a test player over the game's live connection, and confirms that the host's connection sees the player arrive.

The script also sends the malformed message fixed in 4.0.1 and checks that the server keeps serving. Everything it creates lives in memory only, and nothing is written to your quizzes or results.

sudo razzia-roundtrip.sh

OK round-trip https://ec2-203-0-113-10.compute-1.amazonaws.com/: health, web app, manager auth (per-VM ok; wrong, PASSWORD, empty refused), API gates, game created, player joined over socket.io, host saw the player, malformed payload rejected and the server kept serving

Point a DNS name at the instance. An Elastic IP keeps the address across stop/start. Then set the name as the served name. This regenerates the self-signed certificate for the name, updates nginx's allowed name and the cross-site guard, and updates RAZZIA_URL in the credentials file.

sudo razzia-set-hostname quiz.example.com

To use a certificate from your own certificate authority, replace the pair that nginx reads and reload nginx.

sudo install -m 0644 your-cert-chain.pem /etc/ssl/razzia/razzia.crt
sudo install -m 0600 your-key.pem /etc/ssl/razzia/razzia.key
sudo nginx -t && sudo systemctl reload nginx

A name set with razzia-set-hostname is pinned in /etc/sac/razzia-hostname. If you set no name, the instance follows its public DNS name across stop and start.

Edit MANAGER_PASSWORD in /etc/razzia/secrets/razzia.env (letters and digits, at least 16 characters), update the credentials file to match, and restart Razzia.

Host sessions that are already signed in stay valid until they expire (12 hours). To end them at once, also replace JWT_SECRET with a new value of at least 32 letters and digits, for example the output of openssl rand -hex 32.

sudo nano /etc/razzia/secrets/razzia.env
sudo nano /root/razzia-credentials.txt
sudo systemctl restart razzia

The start-time check refuses an empty, short or well-known password. Razzia then stays stopped until you fix it, and journalctl -u razzia shows why. Keep the file at mode 0600, owned by root.

Quizzes, uploaded media and game results are stored under /var/lib/razzia/config on the instance's root volume. Each media upload can be up to 100 MiB, so a busy media library grows quickly. Check the space in use, and grow the EBS volume when you need to.

sudo du -sh /var/lib/razzia/config; df -h / | tail -1

Back up the whole configuration directory, which holds quizzes, media and results.

sudo tar -C /var/lib/razzia -czf /root/razzia-config-backup.tar.gz config && sudo ls -l /root/razzia-config-backup.tar.gz

Copy the archive off the instance, for example to Amazon S3. To restore on this or a new SecureAnyCloud Razzia instance, run:

sudo systemctl stop razzia
sudo tar -C /var/lib/razzia -xzf razzia-config-backup.tar.gz
sudo systemctl start razzia

The manager password and session key are per instance and are not part of the backup.

Ubuntu security updates and Docker Engine updates install automatically through unattended upgrades.

The Razzia container image is fixed at build time and never pulled on boot. New Razzia releases arrive as new software versions of this listing. Launch the new version and restore a backup into it (Step 13).