Sharry 1.16

Search for Sharry in Marketplace, select the SecureAnyCloud publisher entry, then click Create.

Set the NSG rules to allow TCP 22 from your management IP and TCP 80 from your client IPs. The Sharry HTTP listener is bound to loopback, so only nginx on port 80 is exposed.

Do not expose port 80 to the public internet without a TLS-terminating reverse proxy in front, because file shares travel over this port.

RG="sharry-prod"; LOCATION="eastus"; VM_NAME="sharry-01" IMAGE_URN="sac1647283583153:sharry-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name sh-vnet --address-prefix 10.80.0.0/16 --subnet-name sh-subnet --subnet-prefix 10.80.1.0/24 az network nsg create -g "$RG" --name sh-nsg az network nsg rule create -g "$RG" --nsg-name sh-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name sh-nsg --name allow-http --priority 110 \
  --source-address-prefixes "<your-client-cidr>" --destination-port-ranges 80 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:sharry-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name sh-vnet --subnet sh-subnet --nsg sh-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

sharry.service, nginx.service and postgresql.service start automatically once sharry-firstboot.service has generated the per-VM admin password on first boot.

sudo systemctl is-active sharry.service nginx.service postgresql.service
sudo test -f /var/lib/sac/data/sharry-firstboot.done && echo FIRSTBOOT_DONE
sudo systemctl status sharry.service --no-pager | head -8

All three services report active, and the first-boot sentinel is present.

Check the listeners. The Sharry HTTP listener is bound to 127.0.0.1:9090 and PostgreSQL to 127.0.0.1:5432. nginx serves Sharry on port 80, and nothing but nginx listens on a public interface.

sudo ss -tln | grep -E ':9090|:80 |:5432'

The per-VM admin password is generated at first boot and stored in a root-only file:

sudo cat /root/sharry-credentials.txt

The file shows the admin user, the per-VM password and the endpoint URLs:

SHARRY_ADMIN_USER=admin SHARRY_ADMIN_PASSWORD=<SHARRY_ADMIN_PASSWORD> SHARRY_URL=http://<vm-ip>/ SHARRY_API_URL=http://<vm-ip>/api/v2/ SHARRY_LOCAL_HTTP=http://127.0.0.1:9090/ SHARRY_SIGNUP_INVITE_PASSWORD=<generated at first boot>

Sharry exposes a full REST API. Extract the password into a shell variable, obtain an authentication token, and list your shares:

PW=$(sudo grep '^SHARRY_ADMIN_PASSWORD=' /root/sharry-credentials.txt | cut -d= -f2-)
TOKEN=$(curl -s -H 'Content-Type: application/json' -X POST http://127.0.0.1/api/v2/open/auth/login \
  -d "{\"account\":\"admin\",\"password\":\"$PW\"}" | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')
curl -s -H "Sharry-Auth: $TOKEN" 'http://127.0.0.1/api/v2/sec/share/search?q='

The first call authenticates the admin account and returns a token. The second lists the shares owned by that account. On a fresh VM it returns an empty items array until you create your first share.

Open http://<vm-ip>/ from your workstation. The NSG must allow TCP 80. The sign-in page asks for a username and password:

Sign in with user admin and the per-VM password from /root/sharry-credentials.txt.

Choose Create Share. Drop files onto the upload area or use Select Files, and add an optional description that supports Markdown. The upload screen shows the queued files and their sizes:

Press Submit to create the share and upload the files.

Open a share and select the Share Link tab. Press Publish to make it publicly available, then copy the generated link or scan the QR code. Anyone with the link can download the files until the validity time or maximum view count is reached:

The Your Shares list shows every share you own, with its published state, number of files, size and creation time. Use it to open, edit, unpublish or delete a share:

• Server home: /opt/sharry
• Start script: /opt/sharry/bin/sharry-restserver
• Server config: /etc/sharry/sharry.conf
• Launcher environment: /etc/default/sharry
• PostgreSQL data directory: /var/lib/sharry/pgdata (dedicated data disk)
• Uploaded file store: /var/lib/sharry/files (dedicated data disk)
• Systemd unit: /etc/systemd/system/sharry.service
• First-boot script: /usr/local/sbin/sharry-firstboot.sh
• First-boot service: /etc/systemd/system/sharry-firstboot.service
• Credentials file: /root/sharry-credentials.txt (mode 0600)
• First-boot sentinel: /var/lib/sac/data/sharry-firstboot.done
• nginx site: /etc/nginx/sites-available/sac-sharry

sudo systemctl status sharry.service --no-pager | head -6 sudo journalctl -u sharry.service --no-pager | tail -5

To restart the service after a configuration change, run sudo systemctl restart sharry.service.

• Rotate the admin password by editing /etc/default/sharry (the -Dsharry.restserver.backend.auth.fixed.password option) and restarting the service. Store the new password in your secrets manager.
• Set the base URL to your real hostname in /etc/default/sharry (-Dsharry.restserver.base-url=https://files.example.com), so that public share links and the sign-in cookie are correct.
• Keep the HTTP listener on loopback as shipped. Expose only nginx on port 80, and put TLS in front of it with Azure Application Gateway, or with nginx and a real certificate.
• Restrict the NSG so that port 80 only reaches trusted client networks, never the public internet without TLS.
• Choose the signup mode in /etc/default/sharry (invite as shipped, or closed), and control who can create accounts.
• Back up the data disk at /var/lib/sharry, which holds the PostgreSQL cluster and the uploaded files, or take Azure disk snapshots.
• Patch the OS monthly with sudo apt-get update && sudo apt-get upgrade && sudo reboot.

Sharry is licensed under the GNU General Public License v3.0. There are no per-node, per-CPU or per-GB fees.

SecureAnyCloud produces this image, which is not affiliated with, endorsed by, or sponsored by the Sharry project. Sharry is a trademark of its respective owner and is used here only to describe the software included in the image.

SecureAnyCloud provides commercial support for this image separately from the upstream project.

Email: sales@secureanycloud.com

Website: secureanycloud.com

Support hours: 24/7 with guaranteed 24 hour response SLA

Deploy on Azure

Launch Sharry 1.16 Secure File Sharing on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Launch Sharry 1.16 Secure File Sharing on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com