Reactive Resume

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Choose a larger size if many people will use the instance at once.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. Also allow 443/tcp once you add TLS. Reactive Resume serves plain HTTP on port 80, so for production put it behind TLS with your own domain (see the final section).

Step 1 - Deploy from the Azure Marketplace

• In the Azure portal, choose Create a resource and search the Marketplace for the SecureAnyCloud Reactive Resume offer.
• Select the plan, then select Create.
• On the Basics tab, pick your subscription, resource group and region, name the VM, and select Standard_B2s or larger.
• Choose SSH public key authentication, enter the admin username azureuser, and provide your public key.
• On the Networking tab, allow inbound 22/tcp from your management network and 80/tcp for the web interface.
• Review and create the VM. When it is running, note its public IP address.

Step 2 - Deploy from the Azure CLI

az vm image terms accept --urn sac1647283583153:reactive-resume-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-reactive-resume-rg \
  --name reactive-resume \
  --image sac1647283583153:reactive-resume-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the port for the web interface. SSH is open by default:

az vm open-port --resource-group my-reactive-resume-rg --name reactive-resume --port 80 --priority 900

Step 3 - Connect to your VM

ssh azureuser@<vm-ip>

First boot generates every secret for this VM and creates your owner account before the web port answers. Allow a moment for it to settle after the VM reports running.

Step 4 - Confirm the services are running

Three systemd units matter: docker, reactive-resume (the Compose stack) and nginx (the reverse proxy on port 80).

sudo systemctl is-active docker reactive-resume nginx

active active active

The stack itself is three containers: the application, PostgreSQL and Redis.

sudo docker compose --env-file /etc/reactive-resume/reactive-resume.env -f /etc/reactive-resume/compose.yaml ps --format 'table {{.Service}}\t{{.Status}}'

SERVICE STATUS postgres Up 14 minutes (healthy) reactive-resume Up 2 minutes (healthy) redis Up 14 minutes (healthy)

Step 5 - Secure by default

On a self-hosted resume builder, the two classic exposures are an open sign-up form and a shipped default login. This image has neither.

Before nginx opened port 80, first boot generated a unique session signing key, encryption secret, database password and cache password for this VM. It then created your owner account with a random password and switched public sign-up off in the application.

You can verify all of this from the command line. A sign-up attempt is refused:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' -X POST http://127.0.0.1/api/auth/sign-up/email \
  -H 'Content-Type: application/json' \
  -d '{"name":"probe","email":"probe@example.com","password":"Pr0be-Guide-123","username":"probeguide"}'

HTTP 400

The bundled database and cache are never published to a host port, and the application itself listens only on loopback behind nginx:

ss -tln | awk 'NR==1 || /:80 |127.0.0.1:3000|:5432|:6379/'

State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 4096 127.0.0.1:3000 0.0.0.0:* LISTEN 0 511 [::]:80 [::]:*

Only 22 and 80 are reachable from outside the VM.

Step 6 - Get your sign-in details

Your owner email and the password generated for this VM are in a root-owned file. Read it with sudo:

sudo cat /root/reactive-resume-credentials.txt

REACTIVE_RESUME_URL=http://<vm-ip> REACTIVE_RESUME_ADMIN_EMAIL=admin@reactive-resume.local REACTIVE_RESUME_ADMIN_PASSWORD=<set-at-first-boot>

After you sign in, change that password under Settings, Profile.

Step 7 - Sign in

Browse to http://<vm-ip>/ and sign in with the email and password from the previous step.

Step 8 - Create your first resume

From the dashboard, choose Create and give the resume a name. The builder opens with sections such as basics, experience, education, skills and projects on the left. The resume renders live in the centre, and the template, layout, typography and export controls are on the right.

When the resume is ready, select Download in the builder header to export a PDF. Rendering happens inside the application, so there is no extra service to install or keep running.

Step 9 - Track your applications

Open Applications in the sidebar to record the roles you have applied for and which resume you sent. Your job search then stays in the same place as your documents.

Step 10 - Check the stack health from the command line

The application exposes an unauthenticated liveness endpoint that also reports on the database and the upload store:

curl -s http://127.0.0.1/api/health

{ "service": "reactive-resume", "status": "healthy", "database": { "status": "healthy", "latencyMs": 11 }, "storage": { "type": "local", "status": "healthy", "message": "Local filesystem storage is accessible and has read/write permission.", "latencyMs": 1 } }

A healthy status means the application started, its database migrations were applied, PostgreSQL answered, and uploads can be written. It returns HTTP 503 otherwise, which makes it a good target for an Azure Load Balancer or Application Gateway health probe.

Step 11 - Letting other people sign up (optional)

Public sign-up is off by default. To let colleagues register their own accounts, set the flag and restart the service:

sudo sed -i 's/^FLAG_DISABLE_SIGNUPS=.*/FLAG_DISABLE_SIGNUPS=false/' /etc/reactive-resume/reactive-resume.env
sudo systemctl restart reactive-resume.service

Each account keeps its own resumes, and accounts cannot see one another's documents. Enable this only if the instance is on a trusted network or behind an authenticating proxy. Set the flag back to true to close registration again.

Step 12 - Production: your own domain with TLS

Reactive Resume derives sign-in callbacks and share links from APP_URL. When you put a domain name in front of the VM, update that value too:

sudo sed -i 's|^APP_URL=.*|APP_URL=https://resume.example.com|' /etc/reactive-resume/reactive-resume.env
sudo systemctl restart reactive-resume.service

Then terminate TLS in front of the application. The simplest route is certbot with the bundled nginx:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d resume.example.com

Point the DNS record at the VM's public IP first, allow 443/tcp in the NSG, and restrict 22/tcp to your management network.

Back up the reactive_resume_pgdata and reactive_resume_data Docker volumes regularly. They hold your resumes and uploads.

Support

Email sales@secureanycloud.com for help with this image. For questions about Reactive Resume itself, see the upstream documentation.

Deploy on Azure

Launch Reactive Resume on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Connecting to your instance

Connect over SSH as the default login user for your operating system variant, using the EC2 key pair you selected at launch:

OS variant SSH login user Connect

Ubuntu 24.04 ubuntu ssh -i your-key.pem ubuntu@<public-ip>

Prerequisites

You need an active AWS account, an EC2 key pair in the target region, and a VPC with a subnet.

m5.large (2 vCPU / 8 GiB RAM) is the recommended size. Choose a larger size if many people will use the instance at once.

Configure the security group to allow inbound 22/tcp from your management network and 80/tcp for the web interface. Also allow 443/tcp once you add TLS. Reactive Resume serves plain HTTP on port 80, so for production put it behind TLS with your own domain (see the final section).

Step 1 - Launch from AWS Marketplace

• Open the product in AWS Marketplace and choose Continue to Subscribe, then Continue to Configuration and Continue to Launch.
• Pick the region, the m5.large instance type or larger, your VPC and your subnet.
• Select or create a security group that allows inbound 22/tcp from your management network and 80/tcp for the web interface.
• Choose your EC2 key pair and launch the instance. When it is running, note its public IPv4 address.

Step 2 - Launch from the AWS CLI

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids <security-group-id> \
  --subnet-id <subnet-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=reactive-resume}]'

Subscribe to the listing in AWS Marketplace first so the AMI id is available in your account.

Step 3 - Connect to your instance

ssh -i your-key.pem ubuntu@<public-ip>

First boot generates every secret for this instance and creates your owner account before the web port answers. Allow a moment for it to settle after the instance reports running.

Step 4 - Confirm the services are running

Three systemd units matter: docker, reactive-resume (the Compose stack) and nginx (the reverse proxy on port 80).

sudo systemctl is-active docker reactive-resume nginx

active active active

The stack itself is three containers: the application, PostgreSQL and Redis.

sudo docker compose --env-file /etc/reactive-resume/reactive-resume.env -f /etc/reactive-resume/compose.yaml ps --format 'table {{.Service}}\t{{.Status}}'

SERVICE STATUS postgres Up 14 minutes (healthy) reactive-resume Up 2 minutes (healthy) redis Up 14 minutes (healthy)

Step 5 - Secure by default

On a self-hosted resume builder, the two classic exposures are an open sign-up form and a shipped default login. This image has neither.

Before nginx opened port 80, first boot generated a unique session signing key, encryption secret, database password and cache password for this instance. It then created your owner account with a random password and switched public sign-up off in the application.

You can verify all of this from the command line. A sign-up attempt is refused:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' -X POST http://127.0.0.1/api/auth/sign-up/email \
  -H 'Content-Type: application/json' \
  -d '{"name":"probe","email":"probe@example.com","password":"Pr0be-Guide-123","username":"probeguide"}'

HTTP 400

The bundled database and cache are never published to a host port, and the application itself listens only on loopback behind nginx:

ss -tln | awk 'NR==1 || /:80 |127.0.0.1:3000|:5432|:6379/'

State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 4096 127.0.0.1:3000 0.0.0.0:* LISTEN 0 511 [::]:80 [::]:*

Only 22 and 80 are reachable from outside the instance.

Step 6 - Get your sign-in details

Your owner email and the password generated for this instance are in a root-owned file. Read it with sudo:

sudo cat /root/reactive-resume-credentials.txt

REACTIVE_RESUME_URL=http://<public-ip> REACTIVE_RESUME_ADMIN_EMAIL=admin@reactive-resume.local REACTIVE_RESUME_ADMIN_PASSWORD=<set-at-first-boot>

After you sign in, change that password under Settings, Profile.

Step 7 - Sign in

Browse to http://<public-ip>/ and sign in with the email and password from the previous step.

Step 8 - Create your first resume

From the dashboard, choose Create and give the resume a name. The builder opens with sections such as basics, experience, education, skills and projects on the left. The resume renders live in the centre, and the template, layout, typography and export controls are on the right.

When the resume is ready, select Download in the builder header to export a PDF. Rendering happens inside the application, so there is no extra service to install or keep running.

Step 9 - Check the stack health from the command line

The application exposes an unauthenticated liveness endpoint that also reports on the database and the upload store:

curl -s http://127.0.0.1/api/health

{ "service": "reactive-resume", "status": "healthy", "database": { "status": "healthy", "latencyMs": 11 }, "storage": { "type": "local", "status": "healthy", "message": "Local filesystem storage is accessible and has read/write permission.", "latencyMs": 1 } }

A healthy status means the application started, its database migrations were applied, PostgreSQL answered, and uploads can be written. It returns HTTP 503 otherwise, which makes it a good target for an Application Load Balancer health check.

Step 10 - Letting other people sign up (optional)

Public sign-up is off by default. To let colleagues register their own accounts, set the flag and restart the service:

sudo sed -i 's/^FLAG_DISABLE_SIGNUPS=.*/FLAG_DISABLE_SIGNUPS=false/' /etc/reactive-resume/reactive-resume.env
sudo systemctl restart reactive-resume.service

Each account keeps its own resumes, and accounts cannot see one another's documents. Enable this only if the instance is on a trusted network or behind an authenticating proxy. Set the flag back to true to close registration again.

Step 11 - Production: your own domain with TLS

Reactive Resume derives sign-in callbacks and share links from APP_URL. When you put a domain name in front of the instance, update that value too:

sudo sed -i 's|^APP_URL=.*|APP_URL=https://resume.example.com|' /etc/reactive-resume/reactive-resume.env
sudo systemctl restart reactive-resume.service

Then terminate TLS in front of the application. The simplest route is certbot with the bundled nginx:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d resume.example.com

Point the DNS record at the instance's public IP first, allow 443/tcp in the security group, and restrict 22/tcp to your management network.

All application data lives on the dedicated data volume mounted at /var/lib/docker. Take regular EBS snapshots of it, or back up the reactive_resume_pgdata and reactive_resume_data Docker volumes, which hold your resumes and uploads.

Support

Email sales@secureanycloud.com for help with this image. For questions about Reactive Resume itself, see the upstream documentation.

Deploy on AWS

Launch Reactive Resume with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com