TDengine

Prerequisites

• An active Azure subscription, an SSH key pair, and a VNet and subnet in the target region
• Standard_B2s (2 vCPU / 4 GiB RAM) runs the full stack comfortably. Scale up for higher ingestion rates and larger datasets.
• NSG inbound rules that allow 22/tcp from your management network and 80/tcp for the web console. Front the console with TLS for public exposure (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for TDengine by SecureAnyCloud, and select Create. On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then choose Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:tdengine:default:latest
az vm create \
  --resource-group <your-rg> \
  --name tdengine \
  --image sac1647283583153:tdengine:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name tdengine --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active taosd.service taosadapter.service taos-explorer.service nginx.service

All four services report active. The taos --version command reports the running build. The host firewall keeps everything except SSH and the web console off the network.

Step 5 - Retrieve your root password

The root password is generated uniquely on the first boot of your VM and written to a root-only file. Print the file with the following command.

sudo cat /root/tdengine-credentials.txt

The file contains TDENGINE_ROOT_USER (root), TDENGINE_ROOT_PASSWORD and the web console URL. Store the password somewhere safe. The upstream default root/taosdata is rotated away on first boot and no longer works.

Step 6 - Check the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes. Request it with the following command.

curl -s http://localhost/health

The endpoint returns ok. Every other path proxies through to the taosExplorer web console.

Step 7 - Open the taosExplorer web console

Go to http://<vm-public-ip>/ in a browser and sign in as root with the password from Step 5.

On your first sign-in, taosExplorer shows an optional "register for support" page. Registration is not required to use the database. To reach the console, click the TDengine icon (top-right) or go to the home page. The Explorer view lists your databases on the left and gives you a SQL editor on the right.

Step 8 - Run SQL in the web console

Type a query in the editor and click Run. The results appear in the grid below, and the Chart tab visualizes them as a time series. The example here queries the pre-loaded demo super-table.

The Databases tree on the left lets you browse every database, super-table and child table, with their columns, types and tags.

Step 9 - Query with the taos CLI

The taos command-line client is installed on the VM. Run a time-series round trip: list databases, inspect a super-table schema and read rows back.

taos -u root -p'<TDENGINE_ROOT_PASSWORD>' -s "SHOW DATABASES;" taos -u root -p'<TDENGINE_ROOT_PASSWORD>' -s "DESCRIBE demo.sensors;" taos -u root -p'<TDENGINE_ROOT_PASSWORD>' -s "SELECT ts, device_id, temperature, humidity FROM demo.sensors ORDER BY ts DESC LIMIT 5;"

The demo database ships with a sensors super-table and a few child tables, so you have data to query immediately.

To start ingesting your own data, create a super-table of your own.

taos -u root -p'<TDENGINE_ROOT_PASSWORD>' -s "CREATE DATABASE IF NOT EXISTS iot;" taos -u root -p'<TDENGINE_ROOT_PASSWORD>' -s "CREATE STABLE iot.meters (ts TIMESTAMP, current FLOAT, voltage INT) TAGS (groupid INT, location BINARY(32));" taos -u root -p'<TDENGINE_ROOT_PASSWORD>' -s "INSERT INTO iot.d1 USING iot.meters TAGS (1, 'floor-1') VALUES (NOW, 11.5, 220);"

Step 10 - Query with the taosAdapter REST API

taosAdapter exposes a REST/HTTP API on port 6041, which is reachable from the VM itself. First confirm the security model. The upstream default credential is rejected, and the per-VM password authenticates and returns a session token.

curl -s http://localhost:6041/rest/login/root/<TDENGINE_ROOT_PASSWORD>

Then run SQL with HTTP Basic auth. On success, the response is JSON with a code of 0.

curl -s -u root:'<TDENGINE_ROOT_PASSWORD>' -d 'SELECT COUNT(*), AVG(temperature) FROM demo.sensors' http://localhost:6041/rest/sql

Security model and connecting remotely

The host firewall (ufw) allows only 22/tcp (SSH) and 80/tcp (the web console) from the network. TDengine's native port 6030 and the taosAdapter REST API 6041 are reachable only from the VM itself. To reach the REST API from your workstation, use an SSH tunnel.

ssh -L 6041:127.0.0.1:6041 azureuser@<vm-public-ip>

Then point a REST client at http://localhost:6041 on your workstation. The data directory is /var/lib/taos. The built-in root user is a superuser, and you can create additional least-privilege users for applications with CREATE USER.

Enabling HTTPS

The nginx reverse proxy terminates plain HTTP on port 80. For public exposure, put a certificate in front of it. Add a DNS name for the VM, then do one of the following. Use the companion SecureAnyCloud nginx-ssl-certbot image as a TLS reverse proxy. Alternatively, install certbot and extend the existing nginx site (/etc/nginx/sites-available/sac-tdengine) with a listen 443 ssl; server block and your certificate paths. Keep taosExplorer bound to loopback, so the only public surface is the TLS-terminated proxy.

Maintenance

• Configuration: The engine configuration is /etc/taos/taos.cfg. The image pins fqdn localhost and disables the taoskeeper telemetry subsystem. The REST API configuration is /etc/taos/taosadapter.toml, and the web console configuration is /etc/taos/explorer.toml. Edit the file, then run sudo systemctl restart taosd (or the relevant unit) to apply the change.
• Users: Create least-privilege application users with CREATE USER <name> PASS '<password>'; and grant scoped read/write access, rather than sharing root.
• Backups: Snapshot the OS disk, or use TDengine's taosdump utility to export databases.
• Upgrades: The shipped version is held with apt-mark hold tdengine-tsdb. To move to a newer release, run sudo apt-mark unhold tdengine-tsdb, install the target version from the TDengine apt repository and restart the services.
• Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch TDengine on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com