Rocket.Chat

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B4ms (4 vCPU / 16 GiB RAM) is a good starting size, because Rocket.Chat and MongoDB both benefit from RAM.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp from the clients that will use Rocket.Chat. For production, front the VM with TLS (see the final step) and allow 443/tcp instead of plain 80.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Rocket.Chat Community by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size (Standard_B4ms). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:rocketchat-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name rocketchat \
  --image sac1647283583153:rocketchat-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name rocketchat --port 80 --priority 900

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm Rocket.Chat, MongoDB and nginx are running

systemctl is-active mongod rocketchat nginx

You should see three active lines:

active active active

Rocket.Chat binds loopback only, and nginx fronts it on port 80. Confirm the listeners:

ss -tln | grep -E ':3000|:27017|:80'

LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 511 127.0.0.1:3000 0.0.0.0:* LISTEN 0 4096 127.0.0.1:27017 0.0.0.0:*

The Rocket.Chat API answers an unauthenticated info request with 200, and nginx exposes a static /health endpoint for load balancers:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:3000/api/info

200

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/health

200

Step 5 - Retrieve your per-VM admin password

Each VM generates its own unique admin password on first boot and writes it to a root-only credentials file:

sudo cat /root/rocketchat-credentials.txt

The file contains ROCKETCHAT_ADMIN_PASSWORD, the username (admin), the email (admin@sac.local) and the web URL. Store the password in your secrets manager.

In the commands below, <ROCKETCHAT_ADMIN_PASSWORD> stands for the value of ROCKETCHAT_ADMIN_PASSWORD.

Step 6 - Sign in to the Rocket.Chat web UI

Open http://<vm-public-ip>/ in a browser. Sign in with the username admin (or the email admin@sac.local) and the per-VM password from Step 5.

After you sign in, you land on your workspace home, ready to add users and create channels.

Rocket.Chat keeps every conversation on your own Azure VM. Create channels, threads and direct messages as you would in any modern team messenger. The default #general channel is ready to use.

Step 7 - Administer the workspace from the admin area

Open the administration area at http://<vm-public-ip>/admin to manage users, rooms, permissions, authentication and server settings. The Workspace page confirms that you are running Rocket.Chat 8.6.0 Community.

Step 8 - Verify authentication from the API

The credentials file drives a real login round-trip. The command below reads the per-VM password from the file and posts it to the login API. For the correct password, the API returns a JSON payload containing "status":"success" and an authToken. It rejects a wrong password with 401:

PW=$(sudo grep '^ROCKETCHAT_ADMIN_PASSWORD=' /root/rocketchat-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'login=%{http_code}\n' -X POST -H 'Content-Type: application/json' \
  -d "{\"user\":\"admin\",\"password\":\"$PW\"}" \
  http://127.0.0.1:3000/api/v1/login

login=200

Step 9 - Where your data lives

All Rocket.Chat state is in MongoDB. Its data directory is on the dedicated Azure data disk mounted at /var/lib/rocketchat, so it survives image updates and can be snapshotted independently:

df -h /var/lib/rocketchat | tail -1

/dev/sdc 40G 420M 37G 2% /var/lib/rocketchat

Every message, user, setting and uploaded file lives in MongoDB under /var/lib/rocketchat/mongo.

Step 10 - Put TLS in front for production

The image serves plain HTTP on port 80 so you can validate it immediately. Before exposing Rocket.Chat to real users, terminate TLS with your own domain and a certificate.

A common approach is to point a DNS record at the VM, add a 443 inbound rule to the NSG, and use Certbot with the nginx plugin to obtain and install a certificate.

Then set the admin area's Site URL (Administration, Settings, General) to your https:// URL, so that links and the realtime WebSocket use the correct host. You can also set ROOT_URL in /etc/rocketchat/rocketchat.env and restart rocketchat.service.

Support

SecureAnyCloud maintains this image and provides 24/7 support. Rocket.Chat Community is distributed under the MIT license. For product help, contact SecureAnyCloud support through the Azure Marketplace listing.

Deploy on Azure

Launch Rocket.Chat Community on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com