Deployment guide

Scriberr

Overview

Scriberr is an open-source, self-hosted AI audio transcription application. Upload an audio recording and Scriberr returns an accurate, searchable transcript through a web interface, powered by OpenAI Whisper models via WhisperX. It runs entirely on your own VM, so your recordings never leave your infrastructure. Speaker diarization and LLM summarisation and chat over your transcripts are optional.

This SecureAnyCloud image ships Scriberr v1.2.0 as a single Docker Compose service under /opt/scriberr, bound to loopback 127.0.0.1:8080 and fronted by nginx on port 80. The WhisperX Python environment, a compact small Whisper model, the silero voice activity model and the English alignment model are baked into the image. Transcription therefore works immediately and fully offline the first time you log in, with no multi-gigabyte model download.

What you get:

  • Scriberr v1.2.0 as ghcr.io/rishikanthc/scriberr:v1.2.0
  • WhisperX transcription environment and a baked small Whisper model (offline ready)
  • PyAnnote speaker diarization support (bring your own HuggingFace token)
  • Docker Engine with the Compose plugin from the official Docker repository
  • scriberr.service managing the container, with the app bound to 127.0.0.1:8080
  • An nginx reverse proxy on port 80 that streams progress, handles large uploads and is ready for TLS
  • scriberr-firstboot.service for first-boot admin creation, the per-instance secret and the default profile
  • A CPU-only setup that needs no GPU. The default transcription profile is tuned for a modest CPU VM (the small model with int8 compute and silero voice activity detection). The advanced NVIDIA GPU models (Parakeet, Canary, Sortformer) are disabled on this CPU image, so run Scriberr on a GPU VM if you need them.
  • An Ubuntu 24.04 LTS base, patched at build time, with unattended security upgrades enabled
  • 24/7 SecureAnyCloud support, 24h response SLA

Secure by default, no default login. The image ships with zero user accounts. On first boot, the scriberr-firstboot.service oneshot generates a unique administrator password for your instance and registers that single administrator. Self-registration is then closed automatically, so no one else can create an account. The password is written to a root-only file on the VM, and public access on port 80 opens only after first-boot registration completes.

Per-instance secrets. The first boot also generates the JWT session signing secret into /opt/scriberr/.env (readable only by root). No two instances share a signing key, and nothing secret ships inside the image.

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet.

The recommended VM size is Standard_B2s (2 vCPU, 4 GB RAM), which comfortably runs the default small model on CPU. For faster or more accurate transcription with larger models, choose a VM with more vCPUs and RAM. No GPU is required.

1

Deploy from the Azure Portal

Launch the image from the Azure Marketplace into your resource group, and choose your VNet, subnet and SSH key. Open port 80 (HTTP) to the networks that should reach the web interface, and port 22 (SSH) to your admin network.

The first boot prepares the service and creates your administrator. Allow a minute or two after the VM reports running.

2

Retrieve your administrator password

There is no default password. The first boot generates a unique administrator credential for your instance and writes it to a root-only file. SSH in and read the file:

sudo cat /root/scriberr-credentials.txt

The file shows the generated username and password and your instance URL:

# Scriberr on Ubuntu 24.04 — Per-VM Credentials (root only) SCRIBERR_ADMIN_USERNAME=admin SCRIBERR_ADMIN_PASSWORD=<ADMIN_PASSWORD> SCRIBERR_URL=http://<your-vm-ip>/

The file has mode 0600, so only root can read it. Self-registration is already closed, so this administrator is the only account. Confirm both:

sudo ls -l /root/scriberr-credentials.txt curl -s http://127.0.0.1/api/v1/auth/registration-status

The registration status returns {"registration_enabled":false}, so no one can register a second account.

3

Log in

Browse to http://<your-vm-ip>/. On the Sign In screen, enter the username and password from the credentials file.

To confirm from the command line that the credential works and that the default admin/admin is rejected, run:

# the per-VM admin authenticates and returns a JWT curl -s -o /dev/null -w 'admin login: HTTP %{http_code}\n' -X POST http://127.0.0.1/api/v1/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"<ADMIN_USERNAME>","password":"<ADMIN_PASSWORD>"}'
# a guessed default credential is refused curl -s -o /dev/null -w 'default admin/admin: HTTP %{http_code}\n' -X POST http://127.0.0.1/api/v1/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"admin"}'

The per-VM login returns 200, and the default admin/admin returns 401.

4

Transcribe an audio file

After you sign in, you land on your recordings dashboard. Click the + button to upload an audio file. Keep the default CPU (Standard_B2s) profile, which uses the baked small model, int8 compute and silero voice activity detection, and start the transcription. Progress streams live. When the transcription completes, the recording appears in the list with a green tick.

Open the recording to read the transcript. Scriberr shows an audio player and the transcript text, with word-level timings available underneath.

The whole flow works offline against the baked model. You can also drive it from the API. The following script transcribes a short clip end to end and prints the transcript:

# log in and capture a JWT
TOKEN=$(curl -s -X POST http://127.0.0.1/api/v1/auth/login -H 'Content-Type: application/json' \
  -d '{"username":"<ADMIN_USERNAME>","password":"<ADMIN_PASSWORD>"}' | python3 -c 'import sys,json;print(json.load(sys.stdin)["token"])')
# submit the bundled sample clip for a quick transcription
JOB=$(curl -s -X POST http://127.0.0.1/api/v1/transcription/quick -H "Authorization: Bearer $TOKEN" \
  -F 'audio=@/opt/scriberr/sample/sample-english.wav;type=audio/wav' \
  -F 'parameters={"model":"small","compute_type":"int8","device":"cpu","vad_method":"silero","diarize":false,"batch_size":4}' \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["id"])')
# poll until it finishes and print the transcript for i in $(seq 1 40); do
S=$(curl -s http://127.0.0.1/api/v1/transcription/quick/$JOB -H "Authorization: Bearer $TOKEN")
echo "$S" | grep -q '"status":"completed"' && {
echo "$S" | python3 -c 'import sys,json;print(json.load(sys.stdin)["transcript"].strip())'; break; } sleep 3 done
5

Larger models, speaker diarization and summaries

  • Higher accuracy: in the transcription profile, choose a larger Whisper model (medium or large-v3). Larger models need more RAM and CPU, so pair them with a larger VM size.
  • Speaker diarization: PyAnnote diarization requires a free HuggingFace access token and acceptance of the pyannote model licence. Add your token to a profile and enable diarization to label speakers.
  • Summaries and chat: to summarise or chat over a transcript, add an OpenAI-compatible API key in the settings, or point Scriberr at a local model endpoint.

Enable HTTPS for production

The image serves plain HTTP on port 80 so that login works out of the box. For production, put a certificate in front of it. Point a DNS name at the VM and use certbot with nginx:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

After you enable HTTPS, re-enable secure cookies by setting SECURE_COOKIES=true in /opt/scriberr/.env and restarting scriberr.service.

Change the administrator password after your first login, from the account menu.

Managing the service

# service status systemctl status scriberr.service nginx.service --no-pager
# the container
sudo docker ps
# application logs
sudo docker logs --tail 50 scriberr
# restart the stack
sudo systemctl restart scriberr.service

Data (the SQLite database, uploaded audio, transcripts and the model cache) lives under /opt/scriberr/data on the OS disk and is captured with the VM. The transcription environment is under /opt/scriberr/whisperx-env.

Support

Every SecureAnyCloud image includes 24/7 support with a 24 hour response SLA. Contact sales@secureanycloud.com for help deploying or operating Scriberr on Azure.

Scriberr is a trademark of its respective owner. This image repackages open-source software, and SecureAnyCloud charges for support services.

Deploy on Azure

Launch Scriberr on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure