rConfig

Prerequisites

• An active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region
• NSG inbound rules that allow 22/tcp from your management network and 80/tcp (HTTP) from your users. Add 443/tcp if you enable HTTPS

Standard_B2s (2 vCPU, 4 GiB RAM) is a good starting point.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal. Choose Create a resource, search the Marketplace for rConfig by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:rconfig:default:latest
az vm create \
  --resource-group <your-rg> \
  --name rconfig \
  --image sac1647283583153:rconfig:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open HTTP so that you can reach the web UI:

az vm open-port --resource-group <your-rg> --name rconfig --port 80 --priority 900

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the application stack is running

Five services back rConfig. The Horizon queue worker, which runs scheduled device backups, reports RUNNING under Supervisor:

systemctl is-active nginx php8.4-fpm mariadb redis-server supervisor
sudo supervisorctl status rconfig-horizon curl -s -o /dev/null -w 'GET /api/auth/providers -> %{http_code}\n' http://127.0.0.1/api/auth/providers

Expected: five lines of active, RUNNING for rconfig-horizon, then GET /api/auth/providers -> 200.

Step 5 - Retrieve your administrator password

On the first boot of every VM, a one-shot service (rconfig-firstboot.service) generates credentials that are unique to that VM: a fresh MariaDB password, a fresh Laravel application encryption key, and a fresh administrator password.

The web service (nginx) does not start until this has completed, so a default or shared credential is never reachable. Read the credentials file:

sudo cat /root/rconfig-credentials.txt

The file (mode 0600, root only) contains the sign-in URL, the administrator email (rconfig.admin.user, which is admin@domain.com) and the administrator password (rconfig.admin.pass).

You can prove the credential and core-function round trip from the VM's own shell. The script confirms the following:

• The upstream default admin@domain.com / admin is rejected.
• A wrong password is rejected.
• Your real per-VM credential signs in.
• The authenticated dashboard is reachable.
• A real write against the REST API (creating a vendor) reaches the database.

sudo /usr/local/sbin/rconfig-roundtrip.sh

Expected: six numbered checks, each ending (rejected, good), (accepted, good), HTTP 200 or (created), followed by a final OK.

Step 6 - Sign in and explore the dashboard

Browse to http://<vm-public-ip>/ and sign in with the administrator email and password from the credentials file.

The dashboard shows your device count, down devices, stored configuration files and system health, all computed live from the database.

Step 7 - Add your first device and schedule a backup

Open Inventory -> Devices and select New Device to register a router, switch or firewall. Supply the hostname or IP, vendor, device model, credential set and command template.

rConfig connects out to the device on its own schedule to pull the running and startup configuration and version it. It flags any change with a side-by-side diff.

Vendors, categories, tags and command templates are all managed the same way. The automated round-trip check from Step 5 creates a vendor named sac-smoke-* through the REST API to prove that authenticated writes reach the database. The check deletes it before the image ships.

Step 8 - Confirm the version and OS patch baseline

cat /var/www/html/rconfig/VERSION php -v | head -1

Expected: 8.2.12, then PHP 8.4.

First-boot service and security model

A one-shot rconfig-firstboot.service runs after the network is up and before nginx is allowed to start. The systemd unit is Before=nginx.service, so nginx cannot start until first boot completes. The service does the following:

• Rotates the MariaDB rconfig_user password.
• Regenerates the Laravel APP_KEY.
• Pins the application URL to the VM's own address, resolved from the Azure instance metadata service.
• Rotates the administrator password to a fresh per-VM value through a direct database update.
• Writes the credentials file at mode 0600 (root only).
• Starts the Horizon queue worker.
• Drops a sentinel so that it runs exactly once.

The image ships with the upstream default admin password already rotated, at build time, to an unrecorded, discarded value. The per-VM administrator credential is created only on first boot.

systemctl is-active rconfig-firstboot.service
sudo stat -c '%a %U:%G %n' /root/rconfig-credentials.txt

Expected: active, then 600 root:root /root/rconfig-credentials.txt.

Enabling HTTPS with your own domain

The image serves the web UI over plain HTTP on port 80. For a browser-trusted certificate, point a DNS record at the VM and open port 443 in the NSG. Then install a certificate from your CA (for example Let's Encrypt):

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot updates the nginx site to serve your domain certificate. Then set APP_URL=https://your-domain.example.com in /var/www/html/rconfig/.env. Run sudo -u www-data php /var/www/html/rconfig/artisan config:cache so that generated links use your domain.

Backup and maintenance

The rConfig application, its MariaDB database and Redis all live on the OS disk. Back up the MariaDB database and the application tree together:

sudo mariadb-dump rconfig | gzip > /var/backups/rconfig-db-$(date +%F).sql.gz
sudo tar -C /var/www/html -czf /var/backups/rconfig-app-$(date +%F).tar.gz rconfig

Alternatively, snapshot the whole OS disk from the Azure portal for a full point-in-time copy.

Keep the OS current with sudo apt-get update && sudo apt-get upgrade. The image ships with unattended security updates enabled. Review the rConfig documentation before you move between major versions, and always back up before an upgrade.

Support

This image is backed by 24/7 SecureAnyCloud support. Email sales@secureanycloud.com or use the live chat in the support portal. Critical issues receive a one-hour average response.

Support covers:

• Deployment and initial configuration
• Retrieving first-boot administrator credentials
• Adding devices and credential sets
• Scheduling backups
• REST API integration
• HTTPS and custom domain setup
• Application upgrades and patch management
• Performance tuning and troubleshooting

Deploy on Azure

Launch rConfig on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com