SORMAS

Prerequisites

• An active Azure subscription, an SSH key pair, and a VNet and subnet in the target region
• Standard_B4ms (4 vCPU / 16 GiB RAM) is the recommended size. SORMAS runs a Payara application server (with a 4 GiB JVM heap) alongside PostgreSQL, and 16 GiB keeps the stack healthy
• NSG inbound rules that allow 22/tcp from your management network and 80/tcp for the SORMAS web interface

Step 1 - Deploy from the Azure Marketplace

1. Sign in to the Azure Portal, choose Create a resource, search the Marketplace for SORMAS by SecureAnyCloud, and select Create.
2. On Basics, pick your subscription, resource group, region and size.
3. Under Administrator account, choose SSH public key and paste your key.
4. Under Inbound port rules, allow SSH (22) and HTTP (80).
5. Choose Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:sormas-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name sormas \
  --image sac1647283583153:sormas-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name sormas --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm SORMAS is running

On first boot, the appliance generates a unique administrator password and rotates the SORMAS admin account to it. It then starts the Payara application server and writes the credentials to a root-only file. The sormas service does not start until first boot has finished rotating the password, so the vendor default is never served.

systemctl is-active postgresql sormas nginx

All three should report active. You can also confirm the listeners. nginx proxies the SORMAS web UI on port 80, while Payara (6080/6048) and PostgreSQL (5432) stay bound to localhost.

Check the component versions: OpenJDK 11, PostgreSQL 15, Payara 5 and SORMAS 1.104.0.

Step 5 - Retrieve the per-VM administrator password

The unique password that first boot generates is stored in a root-only file. Read it with:

sudo cat /root/sormas-credentials.txt

The file shows the login URL, the user name admin, and the generated SORMAS_ADMIN_PASSWORD. Store this password in your password manager, because it is unique to this VM.

The SORMAS default login (admin / sadmin) is rotated away before the server ever serves a request. You can verify this against the REST API. The default is refused, and the unique password is accepted:

Step 6 - Sign in to SORMAS

Browse to http://<vm-public-ip>/. You are redirected to the SORMAS login page. Sign in as admin with the password from Step 5.

After you sign in, the Surveillance Dashboard opens, summarising cases by disease and epidemiological week. From the left-hand menu, you can reach Tasks, Persons, Cases, Contacts, Events, Samples, Immunizations, Reports, Statistics, Users and Configuration.

Step 7 - Manage cases and configure the system

The Cases directory is where cases are registered, filtered, imported, exported and line-listed. It is empty on a fresh appliance. Build your own case data, or import it.

As administrator, begin by opening Configuration to define your countries, regions, districts, facilities and user roles. Then create users under Users. The About page confirms the running version and links to the SORMAS components.

Architecture

SORMAS is a Jakarta EE application. The SecureAnyCloud image runs it on Payara 5.2022.5 in a Payara domain named sormas. The HTTP listener is bound to 127.0.0.1:6080 and the admin listener to 127.0.0.1:6048. You reach the web UI (/sormas-ui) and the REST API (/sormas-rest) through the nginx reverse proxy on port 80.

PostgreSQL 15 holds the sormas_db database and is bound to localhost. Authentication uses the built-in SORMAS realm, which is a real username/password login backed by the database, rather than an external identity provider. This keeps the appliance to a single node.

The firewall (ufw) denies all inbound traffic except ports 22 and 80, so Payara and the database are never reachable off-box. Only the admin account is seeded (createDefaultEntities=false), so none of the SORMAS demo users or demo passwords ship in the image.

Step 8 - Use the REST API

SORMAS exposes a REST API through the same nginx proxy, authenticated with HTTP Basic auth, so that you can automate and integrate. For example, obtain the running version and read the seeded disease configurations. Substitute the administrator password from Step 5:

curl -s -u admin:<SORMAS_ADMIN_PASSWORD> http://127.0.0.1/sormas-rest/info/version
curl -s -u admin:<SORMAS_ADMIN_PASSWORD> http://127.0.0.1/sormas-rest/diseaseconfigurations/all/0

The first command returns "1.104.0". The second returns the disease configuration list as JSON. The SORMAS documentation describes the full API surface.

Maintenance

• Start and stop SORMAS: run sudo systemctl restart sormas, which stops and starts the Payara domain
• Logs: the Payara/SORMAS server log is at /opt/domains/sormas/logs/server.log
• Database: PostgreSQL 15 runs locally; back up the sormas_db database with sudo -u postgres pg_dump -Fc sormas_db on a schedule
• Security updates: unattended-upgrades is enabled, so OS security patches are applied automatically
• TLS: front the appliance with your own TLS termination, for example an Azure Application Gateway or a customer-managed nginx certificate, so that browser traffic to port 80 is encrypted in transit. SORMAS handles sensitive health data, so terminating TLS is strongly recommended

Support

SORMAS is developed by the SORMAS Foundation and the Helmholtz Centre for Infection Research, and is licensed under the GNU General Public License v3. This SecureAnyCloud image is backed by 24/7 support.

For help with the image, contact SecureAnyCloud support. For questions about using SORMAS itself, see the SORMAS documentation.

Deploy on Azure

Launch SORMAS Disease Surveillance on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com