Sync in

Secure by default: a per-VM administrator credential

This image ships with no default or shared login. No database, no user accounts and no secrets ship in the image.

On first boot, a one-shot service resolves your public URL and regenerates a per-VM TLS certificate. It generates a fresh database password, encryption key and token-signing secrets, and recreates the stack on an empty database. It then creates the single administrator account with a unique per-VM password and writes the password to a root-only file.

Sync-in's upstream tooling would otherwise fall back to a well-known sync-in/sync-in login. The image always supplies an explicit login and a long random password, so that default account is never created. Retrieve the password over SSH and change it after your first login.

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting size, because the running stack idles well under 1 GiB used. Scale up for large teams or heavy file volumes.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, and 80/tcp and 443/tcp from wherever you browse Sync-in. Port :80 only redirects to :443.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Sync-in by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80) and HTTPS (443).

Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM and open ports 80 and 443.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:sync-in-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name sync-in \
  --image sac1647283583153:sync-in-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name sync-in --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name sync-in --port 443 --priority 1020

Step 3 - Connect to your VM

Connect over SSH as azureuser.

ssh azureuser@<vm-public-ip>

The message of the day shows your VM's Sync-in URL and administrator login.

Step 4 - Confirm the services are running

Sync-in runs as three systemd units: the Docker engine, the Sync-in Compose stack and nginx. Check that all three are active.

systemctl is-active docker.service sync-in.service nginx.service

active active active

The application and database are published only on the loopback and internal Docker network. nginx is the only service bound to public ports (:80 and :443). Confirm this with:

sudo ss -tln | grep -E ':(80|443|8080) '

LISTEN 0 4096 127.0.0.1:8080 0.0.0.0:* LISTEN 0 511 0.0.0.0:443 0.0.0.0:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:*

The web UI is served over HTTPS, and plain HTTP redirects to it. Verify both:

curl -sk -o /dev/null -w 'https:// -> %{http_code}\n' https://127.0.0.1/
curl -s -o /dev/null -w 'http:// -> %{http_code}\n' http://127.0.0.1/

https:// -> 200 http:// -> 301

Step 5 - Read the per-VM administrator credential

On first boot, the VM writes a root-only file with your Sync-in URL, the administrator login and the unique password generated for this VM. Read the URL and login:

sudo grep -E '^SYNC_IN_URL=|^SYNC_IN_ADMIN_LOGIN=' /root/sync-in-credentials.txt

SYNC_IN_URL=https://<vm-public-ip> SYNC_IN_ADMIN_LOGIN=admin

The SYNC_IN_ADMIN_PASSWORD line in that file holds your unique password.

Only the per-VM credential is accepted. A wrong password and the upstream default sync-in/sync-in are both rejected. A successful token request returns 201, and a rejected one returns 401:

L=$(sudo grep '^SYNC_IN_ADMIN_LOGIN=' /root/sync-in-credentials.txt | cut -d= -f2-)
P=$(sudo grep '^SYNC_IN_ADMIN_PASSWORD=' /root/sync-in-credentials.txt | cut -d= -f2-)
curl -sk -o /dev/null -w 'per-VM password -> HTTP %{http_code}\n' -X POST https://127.0.0.1/api/auth/token \
  -H 'Content-Type: application/json' --data "{\"login\":\"$L\",\"password\":\"$P\"}"
curl -sk -o /dev/null -w 'default sync-in -> HTTP %{http_code}\n' -X POST https://127.0.0.1/api/auth/token \
  -H 'Content-Type: application/json' --data '{"login":"sync-in","password":"sync-in"}'

per-VM password -> HTTP 201 default sync-in -> HTTP 401

Step 6 - First login

Open Sync-in in your browser. Accept the self-signed certificate warning, or install a trusted certificate first (see below).

https://<vm-public-ip>/

Enter the administrator login (admin) and the SYNC_IN_ADMIN_PASSWORD from Step 5, then click Sign in. Change your password in your account settings immediately after your first sign-in.

Working with files and spaces

Sync-in organises storage into Personal files and shared Spaces. Your Personal area is your private drive. Drag files into the file list to upload them, then browse, preview, download and share them.

Create Spaces to collaborate with a team. Each space has its own files and members, and granular permissions control who can view or edit.

The Recents view keeps your latest files and comments in one place, so you can pick up where you left off. The Shared section tracks what has been shared with you, by you, and via links.

Step 7 - The official pinned container images

Sync-in runs from the official upstream container images. They are pinned to exact tags and baked into the VM image, so nothing is pulled at runtime. The application is published on the loopback interface only. List the running containers:

sudo docker ps --format 'table {{.Image}}\t{{.Status}}\t{{.Ports}}'

IMAGE STATUS PORTS syncin/server:2.4.4 Up 6 minutes 127.0.0.1:8080->8080/tcp mariadb:11 Up 6 minutes

Adding more users

Sync-in is multi-user. Sign in as the administrator and open Administration in the web interface to create and manage user accounts. Then invite users into your spaces.

Each user gets their own Personal area and sees only the spaces they are a member of.

Security updates

The image is patched at build time, including Ubuntu phased updates. unattended-upgrades stays enabled, so security patches keep arriving on your VM. There should be no held-back packages:

apt-mark showhold

systemd manages the Docker engine and nginx. The application itself is the pinned container image described above. The running stack idles comfortably within the 4 GiB of a Standard_B2s:

free -m | head -2

Your data

Sync-in stores its database and your uploaded files in Docker named volumes on the VM's OS disk. List them:

sudo docker volume ls | grep sync-in

To back up your database and files, snapshot the VM's OS disk in Azure. Alternatively, export the sync-in_data volume to external storage on a schedule.

Enabling a trusted TLS certificate

The image ships a per-VM self-signed certificate, so HTTPS works out of the box. Browsers show a warning until you install a trusted certificate.

For production, point a DNS A record at the VM's public IP and make sure 443/tcp is open in the NSG. Then install certbot and let it manage the nginx certificate. In the last command, replace the example domain and email with your own.

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com -m you@example.com --agree-tos

certbot configures the HTTPS server block and sets up automatic renewal. Sync-in is then available at your domain with a trusted certificate that desktop and mobile sync clients accept.

Upgrading Sync-in

Sync-in runs from a pinned container image. To upgrade, edit the image tag in /opt/sync-in/docker-compose.yml. Then, from /opt/sync-in, run sudo docker compose pull followed by sudo docker compose up -d.

The database schema migrates automatically on start. Always snapshot the OS disk first. SecureAnyCloud support can assist with planning and performing upgrades.

Support

This image is backed by 24/7 SecureAnyCloud support covering deployment, upgrades, integrations, TLS termination and user administration. Contact us by email or chat.

Sync-in is a trademark of its respective owner. SecureAnyCloud is an independent image builder and is not an official Sync-in partner, distributor or reseller. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Sync-in on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com