Deployment guide

Squash TM

Overview

Squash TM is Henix's open-source test and requirement management platform. Teams capture requirements, write and organize reusable test cases in structured libraries, plan and run test campaigns and iterations, and track execution results and coverage, all from a single web application.

The SecureAnyCloud image installs the Squash TM 12 open-source core (the LGPL-v3 squash-tm.war on the OpenJDK 21 JRE) behind nginx as a reverse proxy, with PostgreSQL as the application database. Only the LGPL open-source core is shipped. The commercial Squash TM Premium plugin bundle that ships in the upstream tarball is removed at build time.

The Squash TM server listens on 127.0.0.1:8080 under the /squash context path and is reached through nginx on port 80. PostgreSQL binds to the loopback interface only.

The upstream distribution seeds a default admin/admin login, which this image does not keep. On the first boot of every deployed VM, two unique secrets are generated: the PostgreSQL role password and the Squash TM administrator web password. The administrator login is written to /root/squash-tm-credentials.txt with mode 0600. The default admin/admin login no longer works after first boot, and this happens before the application is exposed.

What you get:

Squash TM 12.0.8 open-source core (/opt/squash-tm, LGPL-v3) on the OpenJDK 21 JRE, with the commercial premium plugin removed
nginx reverse proxy on :80 in front of the Squash TM server (bound to loopback :8080)
PostgreSQL as the application database, bound to loopback only, with the uuid-ossp extension enabled
A per-VM administrator web password and PostgreSQL password, generated at first boot and stored in a root-only file
squash-tm.service, postgresql.service and nginx.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting point. Squash TM runs on the JVM (a 2 GiB heap) alongside PostgreSQL and benefits from memory. Scale up for more users or larger repositories.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp from the networks your users will reach Squash TM from. For public exposure, front port 80 with TLS (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Squash TM by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create and Create.

First-boot initialization takes approximately one to three minutes after the VM starts. Squash TM rotates its secrets, starts the application and its database migrations, and then opens port 80.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:squash-tm-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name squash-tm \
  --image sac1647283583153:squash-tm-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name squash-tm --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Squash TM runs as three systemd units: the application on loopback :8080, PostgreSQL as its database, and nginx as the reverse proxy on :80. Squash TM also exposes an unauthenticated liveness endpoint at /squash/isSquashAlive.

systemctl is-active squash-tm.service postgresql.service nginx.service ss -tlnp | grep -E ':8080 |:80 ' | awk '{print $1, $4}' curl -s -o /dev/null -w 'health: HTTP %{http_code}\n' http://127.0.0.1/squash/isSquashAlive

All three services report active. The application listens on 127.0.0.1:8080 (loopback only) with nginx on :80, and the health check returns HTTP 200.

Step 5 - Retrieve your administrator login

The administrator web password is generated uniquely on this VM's first boot and written to a root-only file. Read the file over SSH:

sudo cat /root/squash-tm-credentials.txt

The file contains the site URL, the administrator login (admin) and its per-VM password, and the PostgreSQL database name, user and password. Store the file's contents securely.

Step 6 - Verify the image is secure by default

The upstream distribution ships a default admin/admin login. On the SecureAnyCloud image, this credential is rotated away on first boot, before nginx starts, so it is never reachable.

Confirm that the default login no longer works and that unauthenticated requests are redirected to the login page:

j=$(mktemp); curl -s -c "$j" -o /dev/null http://127.0.0.1/squash/login t=$(awk '/XSRF-TOKEN/{print $7}' "$j" | tail -1)
echo -n 'admin/admin -> '; curl -s -b "$j" -H "X-XSRF-TOKEN: $t" \
  --data-urlencode 'username=admin' --data-urlencode 'password=admin' \
  http://127.0.0.1/squash/backend/login;
echo curl -s -o /dev/null -w 'GET /squash/ (no session) -> HTTP %{http_code}\n' http://127.0.0.1/squash/ rm -f "$j"

The default admin/admin login returns {"authenticated":false}, and the unauthenticated page returns a redirect (HTTP 302/303) to the login form.

Step 7 - Sign in to Squash TM

Browse to http://<vm-public-ip>/. The bare root redirects to the Squash TM login page at /squash/. Sign in with the login admin and the per-VM password from Step 5.

After you sign in, you land on the Home workspace. The left-hand navigation gives access to Requirements, Test cases, Executions, Reporting and Administration.

After your first sign-in, change the administrator password under the My account menu (top right). Create additional users and projects from the Administration menu.

Step 8 - Organize test cases

Open the Test cases workspace to build your test case library. Create projects, folders and test cases, add test steps, parameters and datasets, and link test cases to the requirements they cover. Test cases are reusable across campaigns.

Step 9 - Plan and run campaigns

Open the Campaigns workspace to plan execution. Create a campaign, add iterations and test suites, populate the test plan from your test case library, and assign testers. Record execution status and results as testing progresses. The Reporting workspace summarizes coverage and execution progress.

Step 10 - Confirm the shipped build

The image ships the LGPL-v3 open-source core with its default open-source plugins. The commercial premium plugin bundle is removed.

ls /opt/squash-tm/plugins/*.jar | xargs -n1 basename test -d /opt/squash-tm/plugin-files/squash-tm-premium && echo "premium present" || echo "premium removed (LGPL core only)" java -version

Enabling HTTPS

For public exposure, terminate TLS at nginx. Point a DNS record at the VM's public IP and allow 443/tcp in the NSG. Then install a certificate with Certbot:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d squash.your-domain.com

Certbot edits the nginx server block to listen on 443 with your certificate and sets up automatic renewal. Squash TM sits behind nginx and needs no change.

Backup and maintenance

Squash TM's state lives entirely in its PostgreSQL database. Back it up with pg_dump:

sudo -u postgres pg_dump squashtm | gzip > "squashtm-$(date +%F).sql.gz"

To restore, create a fresh empty database and load the dump into it.

The application and configuration live under /opt/squash-tm, and the datasource credentials are in /opt/squash-tm/conf/squash.tm.cfg.properties. Manage the service with systemctl restart squash-tm.service. Read application logs under /opt/squash-tm/logs or with journalctl -u squash-tm.service.

The image installs OS security updates unattended. To upgrade Squash TM itself, take a database backup first and then follow Henix's upgrade procedure for the version you are moving to.

Support

Every SecureAnyCloud image includes 24/7 support. For help deploying or operating Squash TM on Azure, contact sales@secureanycloud.com.

Deploy on Azure

Launch Squash TM on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Squash TM is the open-source test and requirement management platform from Henix. QA and test teams use it to manage requirements, author and organize test cases in libraries, plan and run test campaigns, and track execution and coverage from a single web application. This image delivers it as a ready-to-run application, so a complete test management platform is running within minutes of launch.

Squash TM runs as a Java application on the OpenJDK 21 JRE, bound to loopback 127.0.0.1:8080, behind nginx acting as a reverse proxy on port 80. A PostgreSQL database, listening on loopback only, stores every project, requirement, test case, campaign and execution. Systemd manages the Squash TM service, PostgreSQL and nginx, starting them on boot and restarting them on failure. The application is served under the /squash context path, so the bare root redirects there.

Squash TM secures its web interface with its own administrator login. On the first boot of every deployed instance, a one-shot service generates a fresh PostgreSQL role password and a fresh administrator password, both unique to that instance. The service also rotates the shipped default admin login so it no longer works, all before the public web interface starts. Two instances launched from the same Amazon Machine Image therefore never share credentials, and the well-known default admin/admin login never works on a deployed instance. The administrator password is written to /root/squash-tm-credentials.txt with mode 0600, so only the root user can read it.

This image ships the LGPL-3.0 open-source core of Squash TM. The commercial premium plugin bundle that is included in the upstream distribution is removed at build time, so only the open-source core and its LGPL plugins are present.

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and port 80 for the Squash TM web interface
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Squash TM. Select the SecureAnyCloud listing, choose Select, and then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Squash TM is a Java application that runs with a 2 GiB heap alongside PostgreSQL, so 8 GiB of memory is a sensible minimum. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and create or select a security group that opens port 22 from your management network and port 80 for the web interface. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization takes a minute or two after the instance state becomes Running and the status checks pass. During this time, the per-instance database and administrator passwords are generated, the default login is rotated and the application starts.

Launch the Instance from the AWS CLI

Run the following command to launch an instance from the SecureAnyCloud Squash TM Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=squash-tm}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can find it in the EC2 console or with aws ec2 describe-instances.

Connect to Your Instance

Connect over SSH with your key pair and the login user for your operating system variant.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i /path/to/your-key.pem ubuntu@<public-ip>

Retrieve Your Administrator Password

On the first boot, Squash TM generates an administrator password that is unique to this instance. It writes the password, together with the database credentials, to a root-only file. Read the file with sudo:

sudo cat /root/squash-tm-credentials.txt

The file lists the sign-in URL, the administrator login and password, and the PostgreSQL database name, user and password:

squash.url=http://<instance-public-ip>/ squash.admin.login=admin squash.admin.pass=<generated-password> squash.db.name=squashtm squash.db.user=squashtm squash.db.pass=<generated-password>

The administrator login is admin, but the password is the generated value from this file, not the upstream default. The shipped admin/admin login is rotated on first boot and does not work.

Sign In to Squash TM

Browse to http://<instance-public-ip>/ in your web browser. The bare root redirects to the Squash TM sign-in page under the /squash context path. Sign in with the login admin and the password from /root/squash-tm-credentials.txt.

After you sign in, you land on the home workspace. The left-hand navigation gives access to Requirements, Test cases, Executions, Reporting and Administration.

Change the administrator password to one of your own under My account. Then create additional user accounts under Administration > Users, so each team member signs in with their own login.

Create Your First Project

Everything in Squash TM lives inside a project. Open Administration in the left navigation, choose Projects, and use the add button to create a project and give it a name.

Select the project to open its configuration. There you can add a description, connect a bug tracker, set clearance, and manage permissions for the users and teams who work on it.

Add Requirements, Test Cases and Campaigns

With a project in place, build out your test assets:

Requirements: open the Requirements workspace, select your project, and create requirement folders and requirements to capture what the system under test must do.
Test cases: open the Test cases workspace, organize test cases into folders and libraries, and write each test case as a set of steps with actions and expected results. Link test cases to the requirements they cover to build a coverage matrix.
Campaigns and executions: open the Executions workspace to plan test campaigns and iterations, add the test cases to run, assign them to testers, and record execution results. Dashboards and the Reporting workspace show progress and coverage.

Use the REST API

Squash TM exposes a REST API on the same port 80, under the /squash/api/rest/latest/ path, for integration with CI pipelines and other tools. Authenticate with the administrator credentials or a dedicated API user. For example, list the projects visible to your account:

curl -u admin:<your-token> http://<public-ip>/squash/api/rest/latest/projects

For automated access, create a dedicated API user under Administration > Users instead of using the administrator account.

Architecture and Security

The image is secure by default:

Squash TM binds to loopback only. nginx on port 80 is the sole public listener and reverse proxies to the application:

LISTEN 127.0.0.1:5432 (PostgreSQL, loopback only) LISTEN 0.0.0.0:80 (nginx reverse proxy) LISTEN 127.0.0.1:8080 (Squash TM, loopback only)

Authentication is enforced. An unauthenticated request to a protected page redirects to the sign-in form, and the bare root returns a 302 redirect into the /squash context.
The shipped default admin/admin login is rotated on first boot and does not work. Only the generated per-instance password authenticates.
The administrator password is stored in /root/squash-tm-credentials.txt with mode 0600, readable only by root.

Confirm the service state and health on the instance:

systemctl is-active squash-tm.service postgresql.service nginx.service
# active active active curl -o /dev/null -w '%{http_code}\n' http://127.0.0.1/squash/isSquashAlive
# 200

Enable HTTPS with a Custom Domain

For production use, place your instance behind a domain name and enable TLS. Point a DNS A record at the instance's public IP. Then either terminate TLS at an AWS Application Load Balancer in front of the instance, or install a certificate directly on the instance with Certbot and the nginx plugin:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot obtains a certificate and updates the nginx site to serve Squash TM over HTTPS on port 443, with automatic renewal.

Backup and Maintenance

Database: the application data lives in the PostgreSQL squashtm database. Back it up with pg_dump:

sudo -u postgres pg_dump squashtm | gzip > squashtm-$(date +%F).sql.gz

Attachments and configuration: the application directory /opt/squash-tm holds the configuration under conf/ and any attachments. Include the directory in your backups.
Snapshots: take periodic EBS snapshots of the root volume for point-in-time recovery.
Updates: apply operating system security updates with sudo apt-get update && sudo apt-get upgrade. For Squash TM version upgrades, contact SecureAnyCloud support for a guided procedure that preserves your database.

Support

SecureAnyCloud provides 24/7 technical support for this image by email and live chat at sales@secureanycloud.com. Our engineers help with deployment, project and workspace setup, the REST API, bug tracker and CI integration, user management, database tuning, TLS and scaling. Critical issues receive a one-hour average response.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Squash TM on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS