Suwayomi

Confirm that both services are active and that the unauthenticated health endpoint responds:

sudo systemctl is-active suwayomi.service nginx.service curl -s -o /dev/null -w 'healthz: HTTP %{http_code}\n' http://127.0.0.1/healthz

Both units report active, and /healthz returns HTTP 200. nginx serves /healthz directly and never proxies it to Suwayomi. You can point a load balancer or monitor at it as a front-door liveness signal, with no credential.

First boot wrote the admin password, which is unique to this VM, to a root-only file. Read it with sudo:

sudo cat /root/suwayomi-credentials.txt

The file lists SUWAYOMI_ADMIN_USER (admin), SUWAYOMI_ADMIN_PASSWORD (the per-VM password) and SUWAYOMI_URL. Store the password safely. It is the only credential that unlocks the reader.

Confirm that the proxy refuses anonymous requests, accepts the per-VM password and refuses a wrong password:

curl -s -o /dev/null -w 'anonymous: HTTP %{http_code}\n' http://127.0.0.1/
curl -s -u 'admin:<SUWAYOMI_ADMIN_PASSWORD>' -o /dev/null -w 'with password: HTTP %{http_code}\n' http://127.0.0.1/
curl -s -u 'admin:wrong-password' -o /dev/null -w 'wrong password: HTTP %{http_code}\n' http://127.0.0.1/

You get 401, 200, 401. The GraphQL API behaves the same way through the proxy: /api/graphql on port 80 also requires the credential. Nothing on the server is reachable anonymously except /healthz.

From the VM itself, Suwayomi's own GraphQL API answers without a credential on 127.0.0.1:4567. That interface is not exposed to the network. Run these checks on the VM:

curl -sS -H 'Content-Type: application/json' \
  --data '{"query":"{ aboutServer { version buildType } }"}' \
  http://127.0.0.1:4567/api/graphql; echo java -version 2>&1 | head -1 ss -tlnH | grep 4567 findmnt /var/lib/suwayomi

aboutServer reports v2.3.2243 / Stable. The socket line matters most for security. It reads [::ffff:127.0.0.1]:4567, an IPv4-mapped loopback socket, which confirms the server is not listening on any routable interface. findmnt confirms that the data root is the dedicated Azure data disk and not the OS disk.

Browse to http://<vm-ip>/. When your browser prompts for credentials, enter admin and the password from Step 5. The Library view loads. It is empty on a fresh VM, because no library data ships in the image.

The left-hand rail holds the whole application: Library (your saved titles), Updates, History, Browse (sources and extensions), Downloads, Settings and About.

Suwayomi reads catalogs through Tachiyomi-compatible extensions. Extensions come from repositories that you choose and add yourself. No repository is pre-configured in this image.

In the UI, open Browse. The Source tab lists the available sources. On a fresh VM it shows only Local source, the built-in source that serves comics you place on the VM yourself (Step 10). Installed extensions appear on the Extension tab after you add a repository under Settings > Browse > Extension repositories.

Choose your repositories deliberately. You are responsible for the sources you add and the content you access through them. SecureAnyCloud does not bundle, endorse or host any catalog.

The Local source reads directly from the data disk, so you can host your own scans or legally obtained archives without any extension. Use one directory per title, and one directory (or one CBZ file) per chapter:

/var/lib/suwayomi/local/ └── My Comic/ ├── cover.jpg ├── details.json └── Chapter 1/ ├── 001.jpg ├── 002.jpg └── 003.jpg

Create the directory, copy your page images in, then restart the server so it re-indexes:

sudo install -d -o suwayomi -g suwayomi -m 0755 "/var/lib/suwayomi/local/My Comic/Chapter 1"
sudo systemctl restart suwayomi.service for i in $(seq 1 60); do curl -sf -o /dev/null http://127.0.0.1:4567/ && break; sleep 2; done curl -s -u 'admin:<SUWAYOMI_ADMIN_PASSWORD>' -o /dev/null -w 'reader after restart: HTTP %{http_code}\n' http://127.0.0.1/

The reader returns HTTP 200 again after the restart. In the UI, Browse > Local source > Latest now lists your title. Open it and tap the heart to add it to your Library.

Open a title from the Library to reach its detail view, which shows the cover, metadata, description and chapter list. For local titles, the optional details.json fields (title, author, artist, description, genre, status) appear here.

Click a chapter to open the reader. Pages render full width with a page counter. You can set the reading mode (paged, continuous vertical, right-to-left) per title and globally under Settings > Reader. Reading progress is stored server-side, so you resume in the same place from any browser.

The service runs with a 1024 MB maximum heap, which suits a personal library on Standard_B2s. Check the current setting:

systemctl cat suwayomi.service | grep -E 'ExecStart|Xmx'

To raise it, move to a larger VM size first, then add a systemd drop-in. The heap flags are part of ExecStart, so the override must clear and restate the whole line. Create /etc/systemd/system/suwayomi.service.d/10-heap.conf:

[Service] ExecStart= ExecStart=/usr/bin/java -Djava.awt.headless=true -Xms512m -Xmx3072m -Dsuwayomi.tachidesk.config.server.rootDir=/var/lib/suwayomi -jar /opt/suwayomi/Suwayomi-Server.jar

Then run sudo systemctl daemon-reload && sudo systemctl restart suwayomi.service.

Never set a maximum heap larger than about 75% of the VM's RAM. The image deliberately ships no swap, because Azure manages swap on the ephemeral resource disk and a swap file baked into an image fails Azure certification. An oversized heap is therefore killed by the OOM reaper rather than paged.

Everything Suwayomi exposes is under Settings: reader defaults, library categories and update behavior, download locations, extension repositories, backups, and the server settings that mirror server.conf.

Take care with two settings, because changing them removes the protection this image adds:

• Do not change the server IP or port from 127.0.0.1:4567. The proxy expects the server there, and exposing it directly would publish an unauthenticated reader.
• Suwayomi's own authentication is deliberately off. The nginx layer authenticates you. You can also turn on Suwayomi's built-in authentication, but then you manage two credentials.

Suwayomi writes automatic backups into the data root. List them and inspect what the data disk holds:

sudo ls -la /var/lib/suwayomi/backups
sudo du -sh /var/lib/suwayomi 2>/dev/null df -h /var/lib/suwayomi | tail -1

The library, downloads and backups all live on the dedicated data disk. You can snapshot that disk in Azure for a point-in-time copy of the whole library, and grow it without touching the OS disk.

The reader credential is an nginx htpasswd entry, so rotate it with htpasswd. Replace <new-password> with your own password:

sudo htpasswd -bB /etc/nginx/.suwayomi_htpasswd admin '<new-password>'
sudo chown root:www-data /etc/nginx/.suwayomi_htpasswd
sudo chmod 0640 /etc/nginx/.suwayomi_htpasswd
sudo nginx -t && sudo systemctl reload nginx.service

-B stores the password bcrypt-hashed. To keep the password out of your shell history, drop the -b flag and the argument (sudo htpasswd -B /etc/nginx/.suwayomi_htpasswd admin). htpasswd then prompts for the password instead.

Update /root/suwayomi-credentials.txt yourself if you want that file to stay accurate. Nothing reads it at runtime. It is a record for you.

Unattended security upgrades are enabled, so the OS patches itself. Check their status:

systemctl is-enabled unattended-upgrades.service cat /etc/apt/apt.conf.d/20auto-upgrades

Server logs go to the journal. Suwayomi also writes its own log files to the data disk:

sudo journalctl -u suwayomi.service -n 20 --no-pager sudo ls -la /var/lib/suwayomi/logs

Common checks:

• Browser prompts repeatedly (401 loop). The password is wrong. Re-read it with sudo cat /root/suwayomi-credentials.txt, or set a new one (Step 14).
• HTTP 502 from the proxy. Suwayomi is not up. Run sudo systemctl status suwayomi.service and sudo journalctl -u suwayomi.service -n 50. A JVM start takes a few seconds. A heap set larger than the VM's RAM (Step 12) fails here.
• HTTP 500 on the reader but /healthz returns 200. The proxy's credential file is missing. This is the fail-closed state. Restore the file with Step 14.
• A new title does not appear. Restart the server so the Local source re-indexes (Step 10), and check that suwayomi owns the directory. A chapter directory with no page images is indexed as an empty chapter.
• ERROR CEFManager -- Failed to set up CEF / CefException: CEF is disabled in the journal at every start. This is expected and harmless. CEF is Suwayomi's optional embedded Chromium WebView, used only for sources that need to solve an in-browser challenge. This image sets server.kcefEnabled = false, because CEF downloads a full Chromium runtime at first use. A headless server does not need that runtime, and it would add a large unpatched attack surface to the image. Suwayomi logs the refusal at ERROR level, but nothing is broken. If you need a source that requires a browser challenge, enable kcefEnabled under Settings and accept that download, or configure FlareSolverr instead.
• Suwayomi rewrites server.conf. This is normal. On its first start, Suwayomi normalizes the file into its own flat server.<key> = <value> reference form and keeps your values. Edit the file in that form, or use the UI.

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Suwayomi Server. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Suwayomi is a JVM workload, so size it for your library and reading concurrency. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that opens port 22 from your management network and port 80 for the web UI. Leave the root volume at the default size or larger, and keep the attached data volume that holds your library.

Select Launch instance. First-boot initialization takes about one minute after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud Suwayomi Server Marketplace AMI into an existing subnet and security group. Replace the values in angle brackets:

• <ami-id>: the AMI ID shown on the Marketplace listing
• <key-name>: your EC2 key pair name
• <subnet-id>: your subnet ID
• <security-group-id>: a security group that opens ports 22 and 80, as described above

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=suwayomi}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can find it in the EC2 console or with aws ec2 describe-instances.

Connect over SSH with your key pair and the login user for your operating system variant.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i /path/to/your-key.pem ubuntu@<public-ip>

HTTP Basic authentication protects the reader. First boot generates a unique administrator password and stores it in a root-only file. Retrieve it over SSH:

sudo cat /root/suwayomi-credentials.txt

The file lists the reader URL, the user name (admin) and the generated password. Store it safely. The password is unique to this instance.

Confirm that the Suwayomi server and the nginx reverse proxy are both active, and that the anonymous health endpoint answers:

systemctl is-active suwayomi.service nginx.service

curl -fsS http://127.0.0.1/healthz

The first command prints active for both services. The health check prints ok.

Open a browser and go to http://<public-ip>/. When prompted, sign in with the user name admin and the password from Step 4. The library view loads. It is empty until you add sources and titles.

The Suwayomi server itself binds only to the loopback interface on port 4567 and is never exposed directly. All access goes through the nginx reverse proxy on port 80, which enforces authentication.

Confirm that the reader accepts the generated credential and rejects an anonymous request. The first command reads the password from the credentials file and requests the UI as admin. The second command confirms that an unauthenticated request is refused.

PASS=$(sudo grep '^suwayomi.admin.pass=' /root/suwayomi-credentials.txt | cut -d= -f2-)
curl -fsS -u "admin:${PASS}" -o /dev/null -w 'authenticated: HTTP %{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'anonymous: HTTP %{http_code}\n' http://127.0.0.1/

The authenticated request returns HTTP 200 and the anonymous request returns HTTP 401.

Suwayomi exposes a GraphQL API. Query the server version directly on the instance. The loopback API is not behind the reverse proxy.

curl -fsS -H 'Content-Type: application/json' \
  --data '{"query":"{ aboutServer { version buildType } }"}' \
  http://127.0.0.1:4567/api/graphql

This returns the running Suwayomi version and build type as JSON.

Suwayomi is compatible with Tachiyomi extension sources. In the web UI, open Browse, then the Extension tab. Add an extension repository (a source repo URL) under the repository settings, then install the extensions you want.

Installed sources appear under the Source tab. There you can browse and search catalogs, open a title, add it to your library, and read or download chapters. A built-in Local source is available for manga you upload yourself.

Your library, downloads, thumbnails, extension sources and server configuration live on a dedicated EBS data volume mounted at /var/lib/suwayomi. It is separate from the operating system disk, so you can resize or snapshot it independently.

df -h /var/lib/suwayomi

To grow storage later, expand the EBS volume in the AWS console and then grow the filesystem on the instance.

Suwayomi runs under systemd. Common operations:

systemctl status suwayomi.service --no-pager

After you change the configuration at /var/lib/suwayomi/server.conf, restart the server:

sudo systemctl restart suwayomi.service

The nginx credential store is at /etc/nginx/.suwayomi_htpasswd. To rotate the reader password, regenerate the entry with htpasswd for user admin and reload nginx. Then update your saved credentials.