SecureAnyCloud
Deployment guide

Rill

Overview

Rill Data is an open-source operational business-intelligence tool. It builds fast, interactive dashboards directly from your data using an embedded DuckDB engine. You define a project as a few YAML and SQL files: a source, a metrics view (the semantic layer) and an Explore dashboard. Rill compiles them into a live, sub-second dashboard that you slice and dice in the browser.

This SecureAnyCloud image installs Rill 0.87.4 as the single rill binary at /usr/local/bin/rill and runs it as a dedicated rill system user. It includes a ready-made sample analytics project, so the UI shows real dashboards on first login.

What you get:

  • Rill Data 0.87.4 at /usr/local/bin/rill
  • A ready-made sample Rill project (a CSV source, an Orders metrics view and an Orders Explore dashboard) at /var/lib/rill/sample
  • The Rill web UI behind an nginx reverse proxy on TCP :80, with the listener bound to loopback
  • nginx HTTP Basic auth (Rill's local UI has no built-in authentication) with a unique per-VM web password, generated on first boot and stored in a root-only file
  • A dedicated Azure data disk at /var/lib/rill holding the project and the embedded DuckDB data, separate from the OS disk and re-provisioned with every VM
  • A loopback firewall guard, so the Rill runtime port 9009 is reachable only from localhost
  • rill.service and nginx.service as systemd units, enabled and active
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting size. Choose a larger size for bigger datasets and more concurrent users.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web UI. For public exposure, front the UI with TLS (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Rill Data by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, create the VM and open port 80:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:rill-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name rill \
  --image sac1647283583153:rill-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name rill --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH as azureuser.

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that both services are active:

systemctl is-active rill.service nginx.service

Both services report active. Rill compiles the sample project at startup and serves it within a few seconds.

Step 5 - Retrieve your web password

Your VM generates a unique admin password on first boot and writes it to a root-only file. Read it with sudo:

sudo cat /root/rill-credentials.txt

The file contains RILL_ADMIN_USER (admin), RILL_ADMIN_PASSWORD and the URL for the web UI. Store the password somewhere safe.

Step 6 - Check the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/health

The endpoint returns ok.

Step 7 - Open the Rill web UI

Browse to http://<vm-public-ip>/ and sign in as admin with the password from Step 5. Rill opens on the project home, which lists the sample dashboards and resources compiled from /var/lib/rill/sample.

Open the Orders Explore dashboard to see the embedded DuckDB engine in action. It shows a time series of revenue, headline metric cards and dimension breakdowns, all interactive and sub-second.

The project's metrics view is the semantic layer. It declares the dimensions and measures that the dashboard exposes. Open it from the file browser to see how Rill maps SQL expressions to dashboard metrics.

Back in the Explore dashboard, click a dimension (Region or Category) to slice every chart and metric by that value. Rill recomputes the whole dashboard against DuckDB instantly.

Step 8 - Inspect the sample project

The sample project is a small set of plain-text files on the data disk. You can read it and copy it as a template for your own project:

ls -R /var/lib/rill/sample

The listing shows rill.yaml, the data/orders.csv source file, sources/orders.yaml (the CSV ingest), metrics/orders_metrics.yaml (the semantic layer) and dashboards/orders_explore.yaml (the Explore dashboard).

Step 9 - Look at the metrics view

The metrics view declares the time dimension, the dimensions you can slice by, and the measures that Rill aggregates. Print the file:

cat /var/lib/rill/sample/metrics/orders_metrics.yaml

Each measure is a SQL expression, for example SUM(revenue) for total revenue. When you add a measure or dimension to this file, Rill hot-reloads the dashboard.

Step 10 - Build your own project

Rill is project-driven. Drop a CSV, Parquet or JSON file into a project's data/ directory, point a source at it, declare a metrics view over it and add an Explore dashboard. The sample project is a working template that you can copy:

sudo cp -r /var/lib/rill/sample /var/lib/rill/myproject
sudo chown -R rill:rill /var/lib/rill/myproject

Next, edit /etc/default/rill to point RILL_ARGS at /var/lib/rill/myproject, then run sudo systemctl restart rill. Rill recompiles the new project and serves it behind the same authentication.

Step 11 - Confirm data lives on the dedicated disk

The project and the embedded DuckDB data are stored on the dedicated Azure data disk, so they survive OS changes and can be resized independently. Confirm the mount:

findmnt /var/lib/rill

A separate Azure data disk backs the mount. The disk is captured into the image and re-provisioned on every VM.

Enabling HTTPS

The nginx reverse proxy terminates plain HTTP on port 80. For public exposure, put a certificate in front of it.

The simplest approach is to add a DNS name for the VM and use the companion SecureAnyCloud nginx-ssl-certbot image as a TLS reverse proxy. Alternatively, install certbot and extend the existing nginx site with a listen 443 ssl; server block and your certificate paths.

Keep Rill itself bound to loopback, so the only public surface is the authenticated, TLS-terminated proxy.

Maintenance

  • Configuration. The project path and listener flags are set in the RILL_ARGS line of /etc/default/rill. Edit the file and run sudo systemctl restart rill to apply changes.
  • Backups. Snapshot the /var/lib/rill data disk, or copy your project directory (plain text plus data files) to Azure Blob Storage.
  • Upgrades. Replace /usr/local/bin/rill with a newer release and restart the service.
  • Security patches. unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Rill is a trademark of Rill Data, Inc. SecureAnyCloud produces this image, which is not affiliated with or endorsed by the Rill Data project. Rill Data is distributed under the Apache License 2.0.

Deploy on Azure

Launch Rill Data on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure