Tengine

Open the Marketplace in the Azure Portal and search for Tengine. Select the SecureAnyCloud publisher entry and click Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range. Also allow TCP 80 and TCP 443 from the client networks that should reach your site.

Click Review + create, wait for validation, then click Create. Deployment takes around two minutes.

Create a resource group and the VM:

RG="tengine-prod" LOCATION="eastus" VM_NAME="tengine-01" ADMIN_USER="azureuser" IMAGE_URN="sac1647283583153:tengine-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:tengine-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" \
  --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username "$ADMIN_USER" \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard

Open the web ports on the VM's network security group. Adjust the source ranges to your own networks:

az network nsg rule create --resource-group "$RG" --nsg-name "${VM_NAME}NSG" \
  --name allow-http --priority 1001 --destination-port-ranges 80 --access Allow --protocol Tcp
az network nsg rule create --resource-group "$RG" --nsg-name "${VM_NAME}NSG" \
  --name allow-https --priority 1002 --destination-port-ranges 443 --access Allow --protocol Tcp

SSH to the VM and confirm that Tengine is active, enabled at boot, and listening on TCP 80 and 443. tengine-firstboot.service generates the self-signed certificate and DH parameters once, on the first boot.

systemctl status tengine --no-pager tengine -v ss -tln | grep -E ':80 |:443 '

Expected output:

● tengine.service - Tengine - high performance web server (sac) Loaded: loaded (/etc/systemd/system/tengine.service; enabled; preset: enabled) Active: active (running) Tengine version: Tengine/3.1.0 nginx version: nginx/1.24.0 LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 511 0.0.0.0:443 0.0.0.0:*

The image is compiled from the official Tengine source tarball. Inspect the exact modules and compiler flags it was built with, and confirm that the running configuration passes a syntax test:

tengine -V tengine -t

The build includes the SSL, HTTP/2, real-IP, stub-status, gzip-static and sub-filter modules, with stack-protector and RELRO hardening flags. tengine -t reports that the configuration syntax is OK.

Check that the server version is hidden, the security headers are present, the per-VM self-signed certificate is in place, and HTTP/2 is negotiated on TCP 443:

curl -sI http://localhost/ | grep -iE '^HTTP|^Server:|^X-|^Referrer' echo | openssl s_client -connect 127.0.0.1:443 2>/dev/null | openssl x509 -noout -subject -issuer -dates
curl -skI --http2 https://localhost/ | grep -iE '^HTTP|^strict-transport'

The output shows these results:

• Server: Tengine appears with no version number (server_tokens off).
• The X-Content-Type-Options, X-Frame-Options and Referrer-Policy headers are set.
• The certificate is this VM's own self-signed certificate.
• HTTP/2 200 confirms that HTTP/2 is active, with HSTS on HTTPS.

The default landing page is served from /var/www/html over both HTTP and HTTPS.

Drop your files into the document root, or edit the default site. The document root is /var/www/html. List the files and review the default site:

ls -la /var/www/html/ cat /etc/tengine/conf.d/default.conf

To serve your own static site, replace the contents of /var/www/html. Then test the configuration and reload Tengine:

sudo tengine -t sudo systemctl reload tengine

Tengine works well as a reverse proxy and load balancer. The default site ships a commented location /app/ block. Uncomment it in /etc/tengine/conf.d/default.conf and point proxy_pass at your backend:

location /app/ { proxy_pass http://127.0.0.1:8080/; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; }

To load-balance across several backends, declare an upstream block and proxy to it:

upstream app_pool { server 10.0.0.4:8080; server 10.0.0.5:8080; } server { listen 80; location / { proxy_pass http://app_pool; } }

After you edit any configuration, validate it before you reload. A reload never drops live connections:

sudo tengine -t sudo systemctl reload tengine

The image ships with a per-VM self-signed certificate so HTTPS works immediately. To serve a certificate that browsers trust, replace the two files referenced by the default :443 server block, then reload:

• /etc/tengine/ssl/sac.crt: your certificate (full chain)
• /etc/tengine/ssl/sac.key: your private key

ssl_certificate /etc/tengine/ssl/sac.crt; ssl_certificate_key /etc/tengine/ssl/sac.key;

Copy your certificate and key over those paths, keeping the key readable only by root. Then test the configuration and reload:

sudo tengine -t sudo systemctl reload tengine

For automated Let's Encrypt certificates, install certbot (sudo apt-get install -y certbot) and obtain a certificate in standalone or webroot mode. Point the ssl_certificate and ssl_certificate_key directives at the issued files and reload Tengine.

Tengine keeps the nginx configuration layout, so a renewal --deploy-hook of systemctl reload tengine keeps the served certificate current.