SecureAnyCloud
Deployment guide

Scoold

Overview

Scoold is an open source question-and-answer knowledge base for teams and communities. It gives your organization a private, Stack Exchange-style place to ask questions, post answers, vote on the best ones, accept solutions and build a searchable library of shared knowledge that grows with your team. Members earn reputation as they contribute, tags keep topics organized, and a full moderation and permission system keeps the content healthy.

Scoold is a Spring Boot application that always needs a companion backend called Para for storage, search and identity. The SecureAnyCloud image ships both, wired together and ready on the first boot of every VM. Scoold 1.69.3 and Para 1.54.7 (both Apache 2.0) run as systemd services on a hardened Ubuntu 24.04 LTS base, patched at build time.

Para runs in its fully embedded mode with an H2 database for storage, a Lucene index for search and an in-memory cache, so there is no external database to run and nothing else to install. An nginx reverse proxy serves the site on port 80. Scoold and Para both listen only on the loopback interface, so neither is exposed to the network. A unique administrator login and fresh backend secrets are generated on the first boot of every VM, and no default credential ships in the image. The image is backed by 24/7 SecureAnyCloud support.

What you get:

  • Scoold 1.69.3 served on port 80 through nginx, managed by systemd
  • Para 1.54.7 as the bundled backend, running fully embedded with H2 storage, Lucene search and an in-memory cache, with no external database
  • A per-VM administrator login generated on first boot and recorded in a root-only file
  • No shipped default login: the admin and all backend secrets are unique per VM, and no known or blank credential authenticates
  • Scoold and Para bound to 127.0.0.1 only, never exposed to the network; only nginx listens publicly on port 80
  • Java heaps tuned to fit a 4 GiB VM (Para 512 MiB, Scoold 640 MiB)
  • para.service, scoold.service, nginx.service and scoold-firstboot.service as systemd units
  • An unauthenticated /healthz endpoint for Azure Load Balancer health probes
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is the recommended size and is what the image is tuned for. Size up for larger or busier teams.

Configure the NSG inbound rules to allow 22/tcp from your management network and 80/tcp for the site. Scoold serves plain HTTP on port 80, so for production, put your own domain and TLS in front of it.

The bundled Para backend is never exposed. It listens on 127.0.0.1:8080 only, and Scoold listens on 127.0.0.1:8000 only, so neither port is reachable from the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, select Create a resource, search the Marketplace for Scoold by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:scoold-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name scoold \
  --image sac1647283583153:scoold-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 for the site:

az vm open-port --resource-group <your-rg> --name scoold --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that Para, Scoold and nginx are all active. The scoold-firstboot unit is a one-shot service that runs once on the first boot to generate the per-VM secrets and administrator, then stays satisfied. Para and Scoold listen only on the loopback interface, while nginx serves the site on port 80.

systemctl is-active para scoold nginx scoold-firstboot
active active active active
ss -tlnp | grep -E ':80 |:8000 |:8080 '

The listing confirms nginx on 0.0.0.0:80 (public), with Para on 127.0.0.1:8080 and Scoold on 127.0.0.1:8000 bound to the loopback interface only.

Step 4 - Retrieve the administrator login

A unique administrator email and password are generated on the first boot of every VM and written to a root-only file. Read the file with sudo:

sudo cat /root/scoold-credentials.txt
SCOOLD_URL=http://<your-vm-ip>/ SCOOLD_ADMIN_EMAIL=admin@scoold.local SCOOLD_ADMIN_PASSWORD=<generated-on-first-boot>

The password shown in the output is masked. On your VM, the file holds the real per-VM value. This account is a full administrator, and Scoold ships no other login.

Step 5 - Sign in and explore the questions feed

Open http://<your-vm-ip>/ in a browser. Select Sign in, choose the email and password option, and enter the administrator email and password from Step 4.

The home page is the questions feed: a searchable, sortable list of every question, with filters for newest, most voted, recently updated, answered and unanswered, and a tags sidebar. To ask a new question, select the Ask Question button in the top navigation.

Step 6 - Ask and answer questions

Select Ask Question to open the compose form. Give the question a clear title, write the details in the Markdown editor (with a toolbar for formatting, code, lists, links, images and tables), pick a space, and add tags so that the question is easy to find. After you publish the question, teammates can post answers, comment and vote. The asker marks the best response as the accepted answer.

Each question has its own page that shows the full question, its votes and views, the answers, and the actions available to you, such as edit, comment, close and share. This is where your team captures the detail behind an answer so that it is never lost.

Step 7 - Administer Scoold

Open the Administration area from the menu under your avatar. From here, an administrator manages spaces (isolated areas of questions for different teams), webhooks, backup and restore, themes, API keys and the full site configuration. An administrator can also review the environment and system information.

Step 8 - Confirm the no default credential security model

The image ships with no known login. The administrator and every backend secret are generated uniquely on the first boot of each VM, and the credentials file is 0600 root:root. The backend secrets are the Para root secret, the app secret used to sign sessions, and the child app credentials that Scoold creates for itself.

A round-trip check proves that the per-VM administrator authenticates while a blank password and common weak guesses are rejected:

sudo bash /usr/local/sbin/scoold-cred-roundtrip.sh
OK per-VM admin authenticates via /signin; blank + weak guesses rejected

A sign-in attempt with the wrong password is refused and redirected back to the sign-in page with an error. It is never granted a session:

Step 9 - Architecture and where your data lives

nginx on port 80 reverse-proxies to Scoold on 127.0.0.1:8000, which talks to Para on 127.0.0.1:8080. Para stores everything in an embedded H2 database on disk and indexes it with Lucene, so there is no external database to manage. The /healthz endpoint returns 200 for load balancer probes.

curl -sI http://127.0.0.1/healthz | head -1 du -sh /opt/para/data; ls /opt/para/data
HTTP/1.1 200 OK 88K /opt/para/data para.mv.db

Your questions, answers, users and tags all live in /opt/para/data/para.mv.db on the VM disk. To protect your knowledge base, back up that file or use the backup feature in the Administration area.

Using your own domain and TLS

Scoold serves plain HTTP on port 80. For production, put your own domain and a TLS-terminating proxy or load balancer in front of the VM. Then set scoold.host_url in /opt/scoold/application.conf to your public URL and restart Scoold, so that links and sessions use the correct address:

sudo systemctl restart scoold

Support

SecureAnyCloud publishes this image and provides 24/7 support. Scoold is developed by Erudika and released under the Apache 2.0 license, as is its Para backend. For product documentation, see the Scoold project. For issues with the SecureAnyCloud image, contact SecureAnyCloud support.

Deploy on Azure

Launch Scoold on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure