SecureAnyCloud
Deployment guide

Temporal

Overview

Temporal is an open-source durable execution engine. Your application defines Workflows and Activities and runs them against the Temporal server. The server persists every execution's full event history, so work survives process and host failures and resumes exactly where it left off, with no bespoke retry, queue or state-machine code.

This SecureAnyCloud image ships the MIT-licensed Temporal server and its MIT-licensed Web UI, backed by a bundled PostgreSQL. It runs the officially supported way, as upstream containers orchestrated by Docker Compose under systemd and fronted by nginx. All images are pinned by digest and captured into the VM, so your instance starts in seconds.

Temporal's open-source Web UI has no built-in authentication. SecureAnyCloud fronts it with nginx HTTP Basic Auth, using a unique password created for each VM on first boot, before the port is reachable. The Temporal frontend and the bundled PostgreSQL are bound to the loopback interface only.

Temporal is a trademark of Temporal Technologies Inc. This image is produced by SecureAnyCloud and is not affiliated with, endorsed by, or sponsored by Temporal Technologies Inc. It ships only the MIT-licensed open-source Temporal server and Web UI.

What you get:

  • Temporal server 1.31.2 (the MIT-licensed engine: frontend, history, matching and worker services), pinned by image digest
  • Temporal Web UI 2.52.1 (namespaces, workflows, event history and schedules), pinned by image digest
  • A bundled PostgreSQL 16 database, pinned by image digest, reachable only inside a private Docker network and never published to a host port
  • Docker Engine (Docker CE) with the Temporal frontend and Web UI published to the loopback interface only, fronted by nginx on port 80
  • temporal.service, temporal-firstboot.service and nginx.service as systemd units, enabled and active on boot
  • A unique Web UI password (nginx HTTP Basic Auth, bcrypt) and a unique PostgreSQL password created per VM on first boot and never baked into the image
  • A clean, freshly initialized database and a preregistered default namespace on first boot: no default login, no shipped secret, no prior data
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point. Increase the size for heavier workloads.

For NSG inbound rules, allow 22/tcp from your management network. Allow 80/tcp (and 443/tcp once you add TLS) for the Web UI. The Web UI serves plain HTTP on port 80. In production, put it behind TLS with your own domain (see Step 10).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource and search the Marketplace for Temporal by SecureAnyCloud. Select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:temporal:default:latest
az vm create \
  --resource-group <your-rg> \
  --name temporal \
  --image sac1647283583153:temporal:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name temporal --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

On first boot, the image creates a unique Web UI password and database password. It initializes a clean PostgreSQL database, applies the Temporal schema, registers the default namespace and starts the stack. Confirm that the systemd services are active:

systemctl is-active docker temporal nginx

All three services report active. The public liveness endpoint returns 200 with no credentials. The Temporal frontend and the bundled PostgreSQL stay bound to the loopback interface only:

curl -s -o /dev/null -w 'health: HTTP %{http_code}\n' http://127.0.0.1/healthz

The full stack runs as containers under one Docker Compose project: the server, the Web UI, the admin tools and the bundled PostgreSQL.

Step 5 - Secure by default: the Web UI password gates everything

Temporal's open-source Web UI has no built-in authentication, so SecureAnyCloud fronts it with nginx HTTP Basic Auth. nginx rejects any request to the Web UI or its API that lacks the exact per-VM credential with 401. Confirm it yourself. This request sends no credential:

curl -s -o /dev/null -w 'no credential: HTTP %{http_code}\n' http://127.0.0.1/api/v1/namespaces

It returns HTTP 401. Guessable defaults such as admin:admin are rejected too. Your unique credential authenticates and returns 200. The block below reads the password from the notes file, so it never appears on screen:

P=$(sudo grep '^TEMPORAL_UI_PASSWORD=' /root/temporal-notes.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'authorized: HTTP %{http_code}\n' -u "admin:$P" http://127.0.0.1/api/v1/namespaces

Your unique Web UI user and password are written to /root/temporal-notes.txt, which only root can read:

sudo stat -c '%a %U:%G' /root/temporal-notes.txt

It reports 600 root:root. To view the notes, which include the Web UI user, the Web UI password and the URL, run:

sudo cat /root/temporal-notes.txt

Step 6 - Open the Temporal Web UI

Browse to http://<vm-public-ip>/. Your browser prompts for the Basic Auth credential. Enter the user admin and the password from /root/temporal-notes.txt. The Web UI opens on the workflows list for the default namespace, showing every running and closed workflow execution.

Select any workflow to open its detail page. It shows the workflow's status, input and result, the full event history, and a timeline of the activities it ran. This history makes execution durable. Temporal persists it to PostgreSQL and replays it to resume a workflow exactly where it left off.

The Namespaces page lists the namespaces on the server. A namespace is an isolation boundary for your workflows. The image registers a default namespace for you on first boot.

Step 7 - Run and inspect workflows

Point your Temporal SDK workers and clients at the frontend on port 7233. It is bound to the loopback interface, so reach it over an SSH tunnel or your own private network.

The bundled temporal command line, available through the admin tools container, lists and describes executions. For example, to list recent workflows in the default namespace, run:

docker compose -f /etc/temporal-appliance/compose.yaml exec temporal-admin-tools \
  temporal workflow list --namespace default

Each row shows the workflow's status, id, type and start time. This is durable, queryable execution state served from PostgreSQL.

Step 8 - Schedules

The Schedules page manages recurring workflows. A schedule runs a workflow on an interval or a calendar spec and records each run. You can drive nightly jobs and periodic pipelines without an external cron.

Step 9 - Rotate the Web UI password

The Web UI password is your access key. To set your own, rewrite the Basic Auth file, then reload nginx:

sudo htpasswd -B /etc/nginx/temporal.htpasswd admin
sudo systemctl reload nginx

Step 10 - Production: your own domain with TLS

In production, front the Web UI with your own domain and TLS. Point a DNS record at the VM public IP. Install a certificate with your preferred tool (for example Certbot with the nginx plugin), then reload nginx.

Once TLS is in place, restrict inbound access in your NSG to 443/tcp (and 22/tcp from your management network). Keep the Web UI credential confidential, because it grants full access to your namespaces, workflows and their inputs and results.

Support

SecureAnyCloud supports this image 24/7. For help with deployment or configuration, contact support through secureanycloud.com.

Deploy on Azure

Launch Temporal on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure