Razzia

• Open the Azure Marketplace and search for Razzia on Ubuntu 24.04 LTS by SecureAnyCloud.
• Select Create, then choose your subscription, resource group and region.
• Pick a VM size of Standard_B2s or larger.
• Under Administrator account, select SSH public key and supply your public key.
• Under Inbound port rules, allow SSH (22), HTTPS (443) and HTTP (80).
• Select Review + create, then Create.

az group create --name razzia-rg --location eastus

az vm image terms accept --urn sac1647283583153:razzia:default:latest
az vm create \
  --resource-group razzia-rg \
  --name razzia-vm \
  --image sac1647283583153:razzia:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group razzia-rg --name razzia-vm --port 443 --priority 1010
az vm open-port --resource-group razzia-rg --name razzia-vm --port 80 --priority 1011

ssh azureuser@<vm-ip>

Five units make up the deployment: docker, razzia-firstboot (which generates this VM's host password), razzia (the game container), razzia-postboot (which proves the security model and writes the credentials) and nginx. Check that all five are running:

systemctl is-active docker razzia-firstboot razzia razzia-postboot nginx

All five report active. Then check that the game container is up:

sudo docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'

NAMES STATUS PORTS razzia Up 12 minutes 127.0.0.1:3000->3000/tcp

Razzia is deliberately not reachable directly. Only nginx listens publicly, and it terminates TLS. Check the listeners:

ss -tlnH | grep -E ':(80|443|3000) ' | sort

You will see 127.0.0.1:3000 for the game app and 0.0.0.0:443 / 0.0.0.0:80 for nginx. The 3000 entry is bound to 127.0.0.1 only, so the app itself is not reachable off the machine. Every visitor goes through nginx.

LISTEN 0 4096 127.0.0.1:3000 0.0.0.0:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 511 0.0.0.0:443 0.0.0.0:*

Every VM generates its own host/manager password on first boot. The password is written to a file that only root can read:

sudo cat /root/razzia-credentials.txt

The file records the MANAGER_PASSWORD, which the host uses to sign in to the manager area, and this VM's URL. Confirm that the file is locked down:

sudo stat -c '%a %U:%G %n' /root/razzia-credentials.txt

600 root:root /root/razzia-credentials.txt

Razzia protects its host/manager area with a password, and this image controls carefully how that password is seeded.

• No shipped default. Upstream ships a literal default host password ("PASSWORD"), and while it is left as the default, the manager login is blocked entirely. This image never ships that default. It generates a fresh, random host/manager password on first boot and writes it into the game configuration before the game container is allowed to start, so the game never comes up on the published default.
• Player join is open, quiz authoring is not. Players join a running game with a room code and need no account, which is the whole point of the game. Only the host/manager area, where quizzes are built and games are controlled, is gated by the per-VM manager password.
• Only nginx is public. The game app binds to 127.0.0.1:3000, and nginx is the single public listener. It terminates self-signed TLS on port 443 (port 80 redirects) and is configured for the socket.io WebSocket upgrades that the live game needs.

The image ships a self test that proves the whole model, not merely that a page loads. It drives a real socket.io manager authentication. The per-VM manager password authenticates, the upstream default "PASSWORD" and a wrong password are both refused, and the WebSocket transport upgrades through nginx (a 101 response):

sudo /usr/local/sbin/razzia-roundtrip.sh

You can also confirm directly that the shipped configuration does not carry the upstream default password:

sudo grep -q '"managerPassword": *"PASSWORD"' /var/lib/razzia/config/game.json && echo DEFAULT || echo 'NON_DEFAULT (a unique per-VM host password is set)'

nginx uses a self-signed certificate out of the box, so your browser shows a certificate warning the first time. This is expected, so proceed to the site. To install your own certificate for production, see Step 14.

Browse to your VM's address (the RAZZIA_URL from your credentials file) and add /manager, for example https://<vm-ip>/manager. Enter the MANAGER_PASSWORD value from /root/razzia-credentials.txt and select Submit.

After you sign in, you land on the Configurations dashboard with Play, Quizz and Results tabs. The Play tab lists your quizzes, including the shipped Example Quizz, and a Start game button. Use the Quizz tab to build and edit your own quizzes. The Results tab shows reports from finished games.

On the Play tab, select a quiz (the Example Quizz is ready to go), then select Start game. Razzia opens the host game view and generates a short Game PIN, which is the room code. The PIN is shown large on screen along with a QR code and the join URL. Put this screen on the big display in the room.

Players open your VM's address on their phones, or scan the QR code. They enter the Game PIN, choose a username, and land in the lobby. When everyone is in, the host selects Start Game and the first question begins.

Each player sees the question and its colour-coded answer options on their phone, and taps an answer before the timer runs out. Faster correct answers score more, and a leaderboard is shown between questions.

Switch to the Quizz tab in the host dashboard to create your own quiz. Add questions, provide the answer options and mark the correct ones, and set a time limit and points per question.

Your quizzes are saved on the VM and appear on the Play tab, ready to run. When a game finishes, its report is available under the Results tab.

sudo systemctl status razzia --no-pager

sudo docker logs razzia --tail 50

Restart or stop the game with sudo systemctl restart razzia and sudo systemctl stop razzia.

The image ships a self-signed TLS certificate so that the site works over HTTPS the moment the VM boots, which is why browsers show a warning. For production, point a DNS name at the VM and install your own certificate. For example, replace /etc/ssl/razzia/razzia.crt and /etc/ssl/razzia/razzia.key with your certificate and private key, or obtain one automatically with a tool such as Certbot. Then reload nginx:

sudo systemctl reload nginx

To change the host/manager password, edit the managerPassword value in /var/lib/razzia/config/game.json and restart the game:

sudo systemctl restart razzia

• Restrict inbound ports 443 and 80 to the networks that genuinely need them.
• Replace the self-signed certificate with your own before you use the game with real audiences, so that neither the manager login nor gameplay travels behind an untrusted certificate.
• Keep /root/razzia-credentials.txt at mode 0600 and never copy it onto a shared system.
• Change the host/manager password from the shipped per-VM value if you share console access, and keep it private.
• Back up /var/lib/razzia/config, which holds your quizzes and game results.

Razzia is open source software distributed under the MIT License. This image also carries Node.js and the bundled socket.io real-time stack under the MIT License, nginx under the BSD 2-Clause Licence, and Docker Engine under Apache 2.0. All are redistributed unmodified.

Commercial support for the SecureAnyCloud image is available 24/7. The upstream project documentation is at github.com/Ralex91/Razzia.

Deploy on Azure

Find Razzia on Ubuntu 24.04 LTS by SecureAnyCloud on the Azure Marketplace.

Deploy on Azure

Launch Razzia on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com