Swagger Editor

Prerequisites

You need an active Azure subscription, an SSH public key, and a VNet with a subnet in the target region.

Configure a network security group that allows inbound TCP 22 (SSH), 80 (HTTP redirect) and 443 (HTTPS).

Important: Swagger Editor has no login and no access control of its own, so anyone who can reach the editor can use it. Restrict the inbound rule for ports 80 and 443 to trusted source ranges in your network security group, or place the VM behind an authenticating reverse proxy or VPN.

Deploy from the Azure Marketplace

In the Azure portal, choose Create a resource and search for Swagger Editor on Ubuntu 24.04 LTS by SecureAnyCloud. Select the plan and click Create.

On the Basics tab, pick your subscription, resource group and region, name the VM, and choose a size. Standard_B2s is a good starting point for evaluation and light use. Scale up for heavier concurrent use.

Set the authentication type to SSH public key and provide your key. Set the inbound ports to allow SSH (22), HTTP (80) and HTTPS (443).

Review and create the VM. When the deployment finishes, note the VM's public IP address.

On first boot, swagger-editor-firstboot.service generates a per-VM self-signed TLS certificate and starts nginx. It then confirms that the editor and a known asset are serving and writes a short access note. This usually completes within a minute of the VM reaching the running state.

Open the editor

Browse to https://<VM-public-IP>/. The image ships a self-signed certificate, so your browser warns on the first visit. Accept the exception, or install your own certificate as described below. Swagger Editor then loads, with the YAML or JSON editor on the left and the live API documentation on the right.

Out of the box, the editor opens with the classic Swagger Petstore OpenAPI 3.0 example. You have a complete, valid definition to explore before you author your own.

Edit the definition on the left and the documentation updates as you type. Expand any operation to see its parameters, request body and responses, including an example value generated from your schema.

Reusable schemas defined under components render in the Schemas section, with each property, type and constraint shown.

Your definitions are held client-side, in your browser. Use File > Save as YAML (or JSON) to download the definition to your device, and File > Import file to load one back. Nothing is written to the server, so there is nothing to back up on the VM.

Verify the deployment

SSH in to the VM as azureuser and confirm that nginx is active. nginx is the only network-facing process. It serves the static bundle over TLS on :443 and redirects :80 to HTTPS.

sudo systemctl start nginx.service for i in $(seq 1 60); do code=$(curl -sk -o /dev/null -w '%{http_code}' -m 5 https://127.0.0.1/) [ "$code" = "200" ] && break sleep 2 done systemctl is-active nginx.service

nginx reports active once first boot has completed.

Check the health endpoint, the editor page and a known editor asset over TLS. The health check needs no authentication, so it suits a load balancer probe.

curl -sk -o /dev/null -w 'GET /healthz -> HTTP %{http_code}\n' https://127.0.0.1/healthz
curl -sk -o /dev/null -w 'GET / (editor) -> HTTP %{http_code}\n' https://127.0.0.1/
curl -sk -o /dev/null -w 'GET /swagger-editor-bundle.js -> HTTP %{http_code}\n' https://127.0.0.1/swagger-editor-bundle.js

All three return HTTP 200. The listener check confirms that only nginx (ports 80 and 443) is exposed:

ss -tln | grep -E ':80 |:443 '

A static app with no backend and no login

Swagger Editor is served as a set of static files. There is no application server, no database and no login, so there is no admin console and no default credential. You can confirm this on the VM: nginx serves the bundle from /var/www/swagger-editor, :80 redirects to HTTPS, and the upstream Apache 2.0 license is vendored into the served root.

sudo ls /var/www/swagger-editor curl -sk -o /dev/null -w 'GET / (editor) -> HTTP %{http_code}\n' https://127.0.0.1/ curl -s -o /dev/null -w 'GET :80/ (301) -> HTTP %{http_code}\n' http://127.0.0.1/
sudo grep -m1 'Apache License' /var/www/swagger-editor/LICENSE

Swagger Editor has no login of its own, so the editor is open to anyone who can reach it. Keep your inbound network security group rules tight.

Runtime and versions

You can inspect the runtime stack, the exact Swagger Editor distribution version and checksum, and the systemd units enabled for first boot on the VM:

nginx -v cat /var/www/swagger-editor/SAC_VERSION systemctl is-enabled nginx.service swagger-editor-firstboot.service

The access note

On first boot, the image writes a short access note to /root/swagger-editor-credentials.txt. The note contains no secrets. Swagger Editor has no login, so no credential is generated or stored. The note records the editor URL and a reminder to restrict inbound access.

sudo cat /root/swagger-editor-credentials.txt

Offline and air-gapped use

The editor itself runs entirely offline. The bundle, styles and scripts are all served from the VM, so it works with no internet access.

One optional feature does reach out from the browser: the spec validity badge asks the public validator.swagger.io service to validate your definition. Your browser makes this request, not the server. To turn it off for fully offline or air-gapped use, add validatorUrl: null to the SwaggerEditorBundle({ ... }) options in /var/www/swagger-editor/index.html, or block outbound access from your clients to that host.

Bring your own TLS certificate

The image serves HTTPS with a self-signed certificate that is regenerated per VM at first boot. It is unique to your instance but not trusted by browsers. For production, replace it with a certificate for your own domain.

Point a DNS record at the VM's public IP.

Copy your certificate chain to /etc/nginx/tls/swagger-editor.crt and your private key to /etc/nginx/tls/swagger-editor.key. Keep the key mode at 0600.

Alternatively, place the VM behind an Azure Application Gateway or another reverse proxy that terminates TLS with a managed certificate.

After replacing the files, validate the configuration before you reload nginx:

sudo nginx -t

When nginx -t reports success, the configuration is valid and you can reload nginx.

Support

SecureAnyCloud maintains this image and provides 24/7 support with a guaranteed 24 hour response SLA. Swagger Editor is free, open-source software licensed under the Apache License 2.0. The SecureAnyCloud charge covers packaging, security patching, image maintenance and support. For help, contact sales@secureanycloud.com.

Deploy on Azure

Launch Swagger Editor on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com