Rundeck

Prerequisites

Before you deploy, make sure you have an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2ms (2 vCPU / 8 GiB RAM) is a reasonable starting point for a Java web application. Size up for more concurrent executions and nodes.

In the network security group, allow inbound 22/tcp from your management network and 80/tcp for the web UI. Also allow 443/tcp if you add TLS. The web UI is served over plain HTTP by default, so put your own domain and a trusted certificate in front of it for real use (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource and search the Marketplace for Rundeck by SecureAnyCloud. Select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab. Then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:rundeck-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name rundeck \
  --image sac1647283583153:rundeck-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name rundeck --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active rundeckd.service nginx.service ss -tlnp | grep -E '4440|80'

Both services report active. Rundeck listens only on the loopback address 127.0.0.1:4440, and nginx on port 80 proxies requests to it. The web connector is never exposed directly on a public interface.

Step 5 - Retrieve your admin password

The Rundeck admin password is generated on the first boot of your VM and written to a root-only file. Read it:

sudo cat /root/rundeck-credentials.txt

This file contains RUNDECK_USERNAME (admin), RUNDECK_PASSWORD and the web UI URL. Store the password somewhere safe. The file is mode 0600 and owned by root, so only an administrator can read it. The embedded H2 database that holds your jobs and executions lives on the dedicated Azure data disk mounted at /var/lib/rundeck.

Step 6 - Confirm the health endpoints

nginx serves an unauthenticated health endpoint for load balancers and probes. It also fronts the Rundeck login page. Check both:

curl -s http://localhost/healthz
curl -s -o /dev/null -w 'healthz HTTP %{http_code}\n' http://localhost/healthz
curl -s -o /dev/null -w 'login HTTP %{http_code}\n' http://localhost/user/login

/healthz returns ok with HTTP 200 and never requires authentication, so it is safe for an Azure Load Balancer health probe. The login page at /user/login returns HTTP 200, which confirms that Rundeck is up behind nginx and ready for sign-in.

Step 7 - Verify authentication from the command line

Rundeck signs in with a standard form login that posts to /j_security_check. The check below signs in with the correct per-VM password. A successful sign-in authenticates the session, so a follow-up request to the authenticated home page returns HTTP 200. For contrast, the check also tries the default admin password and a wrong password. Both are rejected, the session stays unauthenticated, and the home page redirects with HTTP 302.

The command embeds your unique password, so run it interactively instead of from a script. Substitute the value of RUNDECK_PASSWORD from Step 5 for <RUNDECK_PASSWORD>:

login() {
J=$(mktemp)
curl -s -c "$J" -o /dev/null http://localhost/user/login
curl -s -b "$J" -c "$J" -o /dev/null \
  --data-urlencode "j_username=admin" --data-urlencode "j_password=$1" \
  http://localhost/j_security_check
curl -s -b "$J" -o /dev/null -w "%{http_code}\n" http://localhost/menu/home rm -f "$J" } echo "per-VM password -> HTTP $(login '<RUNDECK_PASSWORD>')" echo "default admin -> HTTP $(login 'admin')" echo "wrong password -> HTTP $(login 'wrong')"

The correct per-VM password prints HTTP 200, which means you are signed in and the authenticated home page loads. The default admin password prints HTTP 302, which shows that the appliance rotated the default login away on first boot. A wrong password also prints HTTP 302 (rejected).

Step 8 - Sign in to the web UI

Browse to http://<vm-public-ip>/. The Rundeck login page opens. Enter admin as the username and the password from Step 5, then select Log In.

Step 9 - Explore the projects dashboard

After you sign in, the projects home opens. Rundeck organizes your automation into projects. Each project has its own jobs, nodes and execution history. Create a new project here with New Project. The page also shows a rolling count of recent executions across your server.

Step 10 - Create a project and define a job

Select New Project, give it a name and open it. Inside the project, choose Jobs, then New Job. To import a job from a YAML or XML file, choose Upload Definition instead.

A job has a name and a Workflow of one or more steps: shell commands, scripts or calls to other jobs. You choose which Nodes it runs on, an optional Schedule and Notifications. The screenshot below shows a project with a simple Hello World job in the examples group. The job prints a greeting and the date on the server node.

Step 11 - Run a job and read the execution log

Open a job and select Run Job Now. Rundeck dispatches the workflow to the selected nodes and streams the output live. When the run finishes, you get a full execution record: the overall result, per-node status, timing and the complete Log Output. Every run is kept in the audit log, so you can see who ran what and when, and rerun it with a click.

Step 12 - Confirm data lives on the dedicated disk

Rundeck stores its data under /var/lib/rundeck on the dedicated Azure data disk. This includes the embedded H2 database that holds your jobs, executions and key storage, along with your projects and logs. The data survives OS changes and you can resize the disk independently. Confirm the mount:

findmnt /var/lib/rundeck

The mount is backed by a separate Azure data disk that is captured into the image and reprovisioned on every VM.

Maintenance

• Password: the admin password is set on first boot and stored in /etc/rundeck/realm.properties. To change it, edit that file (the format is admin:<password>,user,admin,architect,deploy,build) and restart with sudo systemctl restart rundeckd.
• Serve a real domain and TLS: the appliance serves the web UI over plain HTTP on port 80. Point a DNS name at the VM, obtain a trusted certificate (for example with certbot and Let's Encrypt), and front Rundeck with nginx TLS on port 443. Then set grails.serverURL in /etc/rundeck/rundeck-config.properties to your https:// URL so the links Rundeck generates are correct, and restart the service.
• LDAP and single sign-on: the image uses a local file realm for the admin account. For teams, connect Rundeck to your directory by configuring a JAAS LDAP login module in /etc/rundeck/jaas-loginmodule.conf, or enable SSO with the appropriate Rundeck plugin.
• Access control: Rundeck authorizes actions with ACL policies under /etc/rundeck. Add project and system ACL policy files to grant teams the exact rights they need.
• Nodes: by default, jobs run on the Rundeck server node. Add your fleet by defining node sources (SSH, cloud model sources or a resources file) in each project. Rundeck then dispatches commands and scripts across them.
• Storage and backup: all Rundeck state lives under /var/lib/rundeck on the data disk. Back up that volume to protect your jobs, executions and key storage.
• Security patches: unattended-upgrades stays enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Rundeck Runbook Automation on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com