Tianji

Search the Azure Marketplace for Tianji, choose the plan and create the VM. In the networking step, attach an NSG that allows inbound TCP 22 (SSH) and TCP 80 (the dashboard) from your client networks only. Put a TLS reverse proxy in front of port 80 for production.

Tianji also listens on port 12345 (TCP and UDP) for its optional server telemetry reporter protocol. Open 12345 in the NSG only if you push metrics from remote servers, and only to those hosts.

RG="tianji-prod"; LOCATION="eastus"; VM_NAME="tianji-01" IMAGE_URN="sac1647283583153:tianji-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name tj-vnet --address-prefix 10.108.0.0/16 --subnet-name tj-subnet --subnet-prefix 10.108.1.0/24 az network nsg create -g "$RG" --name tj-nsg az network nsg rule create -g "$RG" --nsg-name tj-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name tj-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:tianji-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name tj-vnet --subnet tj-subnet --nsg tj-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

tianji.service, nginx.service and postgresql.service all start automatically on first boot, after tianji-firstboot.service has rotated the per-instance secrets.

sudo systemctl is-active tianji nginx postgresql tianji-firstboot
sudo test -f /var/lib/sac/data/tianji-firstboot.done && echo FIRSTBOOT_DONE
sudo ss -tlnp | grep -E ':80 |:12345 '

In the expected output, all four units are active and first boot has completed. nginx is bound to the public port 80, and the Tianji Node.js server listens on 12345.

active active active active FIRSTBOOT_DONE LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",...)) LISTEN 0 511 *:12345 *:* users:(("node",...))

The administrator password is generated uniquely on this VM's first boot and written to a root-only file. Read the file, then keep the password somewhere safe.

sudo cat /root/tianji-credentials.txt grep ALLOW_REGISTER /etc/tianji/tianji.env

The file holds the dashboard URL, the admin user and its per-instance password, and the PostgreSQL details. Open self-registration is disabled (ALLOW_REGISTER=false), so a visitor cannot claim the dashboard.

tianji.url=http://<vm-ip>/ tianji.admin.user=admin tianji.admin.pass=<unique-per-instance-password> tianji.db.name=tianji tianji.db.user=tianji tianji.db.pass=<unique-per-instance-password> ALLOW_REGISTER=false

Tianji's database migration ships a default admin / admin account. This image rotates that password on first boot, so the default no longer authenticates. To confirm this, log in with your per-instance password, which succeeds, and then with the default admin / admin, which is rejected.

ADMIN_PASS=$(sudo grep '^tianji.admin.pass=' /root/tianji-credentials.txt | cut -d= -f2-)
curl -s http://127.0.0.1:12345/health
curl -s -o /dev/null -w 'per-VM login -> HTTP %{http_code}\n' -m 10 -X POST http://127.0.0.1:12345/open/login \
  -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"$ADMIN_PASS\"}"
curl -s -o /dev/null -w 'admin/admin -> HTTP %{http_code}\n' -m 10 -X POST http://127.0.0.1:12345/open/login \
  -H 'Content-Type: application/json' -d '{"username":"admin","password":"admin"}'

The health endpoint reports the running version. The per-instance password returns HTTP 200 and a token is issued. The default admin / admin returns a non-200 rejection.

{"status":"healthy","version":"1.32.16","timestamp":"...","duration":0,"checks":{}} per-VM login -> HTTP 200 admin/admin -> HTTP 500

Open http://<vm-ip>/ in a browser and sign in as admin with the password from Step 5.

open http://<vm-ip>/

After you sign in, you land on the Website Overview. The image seeds a demo website, so the workspace is populated. The left sidebar lists every Tianji capability, and each website shows its recent event count.

Open a website to see its analytics dashboard, which shows views, visitors, bounce rate and average visit time, with a time range selector and a visitor trend chart. Add your own site (Step 11), and the charts fill in as real events arrive.

The Monitor section runs scheduled HTTP, TCP and ping checks and records uptime history. The image seeds a demo monitor that watches the Tianji service itself, so you can see a live monitor with response times and an uptime percentage immediately.

node -v
node -e "console.log('Tianji '+require('/opt/tianji/src/package.json').version)" ls -1 /opt/tianji/src/src/server/dist/src/server/main.js /etc/tianji/tianji.env /usr/local/sbin/tianji-firstboot.sh

The output shows the Node.js runtime, the pinned Tianji version, the seeded demo website and monitor, and the installed component paths.

v22.23.1 Tianji 1.32.16 /etc/tianji/tianji.env /opt/tianji/src/src/server/dist/src/server/main.js /usr/local/sbin/tianji-firstboot.sh

To collect analytics for your own site, add it in the dashboard under Website. Copy the tracking script that Tianji generates for it and paste it into your site's <head>. Tianji records page views and visitors with no cookies. You can also add monitors under Monitor, and register servers under Servers to push host metrics.

sudo systemctl status tianji.service --no-pager | head -n 8
sudo journalctl -u tianji.service --no-pager -n 15

systemd manages the service and restarts it automatically on failure. The service is hardened with NoNewPrivileges, ProtectSystem=full and ProtectHome, and reads its per-instance secrets from /etc/tianji/tianji.env.

Tianji is configured through the environment file /etc/tianji/tianji.env, which the first-boot service writes with per-instance values. The following keys are the most useful.

Setting Meaning Image default

DATABASE_URL PostgreSQL connection string per-instance rotated password

JWT_SECRET Signs login tokens per-instance random value

ALLOW_REGISTER Open self-registration false

ALLOW_OPENAPI Enable the /open REST API true

PORT Server listen port 12345

After you edit the file, apply the changes with sudo systemctl restart tianji.service.

For production, terminate TLS at nginx. Point a DNS record at the VM, then use the packaged nginx with a certificate from Let's Encrypt.

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

certbot installs the certificate, rewrites the nginx server block to listen on 443 and sets up automatic renewal.

• Restrict the NSG so that ports 80 and 22 only reach trusted networks. Keep 12345 closed unless you push remote server telemetry.
• Terminate TLS at nginx (Step 14) so that the dashboard and API travel encrypted.
• Change the admin password from the dashboard after your first sign-in if you prefer your own. Add named users instead of sharing the admin account.
• Keep open registration off (ALLOW_REGISTER=false) unless you deliberately want public sign-ups.
• Back up PostgreSQL with pg_dump if you need your analytics and uptime history to survive a rebuild.
• Patch the OS monthly with sudo apt-get update && sudo apt-get upgrade. Unattended security upgrades are already enabled.

Tianji is licensed under the Apache License 2.0, with no per-CPU or per-user fee. SecureAnyCloud provides commercial support separately.

• Email: sales@secureanycloud.com
• Website: secureanycloud.com
• Support hours: 24/7, 24h response SLA

Deploy on Azure

Launch Tianji on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7. sales@secureanycloud.com

Deploy on Azure

Launch Tianji on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

On the product page in AWS Marketplace, select Continue to Subscribe and accept the terms. Then select Continue to Configuration and Continue to Launch. Choose the recommended instance type (m5.large), your key pair and a security group with the ports above, then launch the instance.

You can also launch from the CLI. Replace the AMI id, key name, security group and subnet with your own values.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <your-security-group-id> \
  --subnet-id <your-subnet-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=tianji}]'
# Once it is running, find the instance's public IP address:
aws ec2 describe-instances --instance-ids <instance-id> \
  --query 'Reservations[0].Instances[0].PublicIpAddress' --output text

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched.

AMI variant SSH login user

Tianji 1.32.16 on Ubuntu 24.04 ubuntu

The first boot service runs before the SSH daemon becomes ready, so the credentials file is always in place when you log in for the first time.

ssh <login-user>@<public-ip>
sudo cat /root/tianji-credentials.txt

The command prints a plain text file that contains the Tianji URL, the administrator username (admin), the password, and the PostgreSQL database name and role. From the same SSH session, you can confirm that the deployment is healthy. The health endpoint is open and reports the running version and the database check.

curl -fsS http://127.0.0.1/health

{"status":"healthy","version":"1.32.16","timestamp":"2026-07-22T04:37:53.070Z","duration":0,"checks":{}}

A "healthy" status confirms that the full stack is serving: nginx, the Tianji Node.js server and PostgreSQL.

Open a web browser and go to http://<public-ip>/. Tianji presents its sign-in page. Enter the username admin and the password from /root/tianji-credentials.txt, then select Login.

The Tianji sign-in page is served on first boot with a per-instance administrator login.

After you sign in, you land on the dashboard. The left navigation gives you Website analytics, Monitors, Servers and Telemetry, status Pages, Surveys, Feeds and more. The image seeds a demo website, so the workspace is populated the moment you sign in. You can rename or delete the demo website and add your own.

The Tianji website analytics overview shows the seeded demo website.

Select Website, then Add. Give the site a name and its domain, and create it. Tianji generates a small privacy-friendly tracking script. Add that script to the pages you want to measure, and page views, visitors, referrers and events start appearing on the overview. Analytics are stored in PostgreSQL, and no third-party tracker or external analytics service is involved.

Select Monitor, then Add, to create an HTTP, TCP or ping monitor for any endpoint. Tianji checks the endpoint on the interval you set, records response time and uptime, and can alert you through notification channels when it goes down. The image seeds a health monitor, so you can see a working monitor immediately.

A Tianji uptime monitor reports UP, with response time and uptime history.

Publish a public status page under Pages to show the health of your monitors to your users. Add notification channels (email, webhook and many others through Apprise) so that outages reach you.

Tianji can collect status and metrics from your servers. A reporter agent on a remote host pushes metrics to this instance over UDP port 12345. If you use this feature, open UDP 12345 in the security group from the reporting hosts only. Then follow the reporter instructions under Servers in the dashboard.

# On the remote server you want to report from (open UDP 12345 to this instance first):
# follow the reporter command shown under Servers in the Tianji dashboard, pointing it at
# http://<public-ip>/ as the Tianji server URL.

For any production deployment, serve Tianji over HTTPS so that logins cannot be intercepted. The image ships with nginx, which certbot can configure automatically. The following steps assume a DNS record that points your fully qualified domain name at the instance's public IP address.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d tianji.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

Tianji derives its dashboard URLs from the request Host header. Once certbot has added the HTTPS server block, Tianji serves correctly on your domain with no further configuration.

Tianji keeps all state in PostgreSQL, including accounts, websites, analytics, monitors and telemetry. Back up the database regularly.

sudo -u postgres pg_dump tianji > <backup-dir>/tianji-db-$(date +%F).sql

The database is on its own EBS volume mounted at /var/lib/postgresql, and the application tree is on its own volume at /opt/tianji, so you can also take coordinated EBS snapshots. systemd manages the services.

systemctl is-active tianji nginx postgresql

To upgrade Tianji, follow the upstream release notes at https://tianji.msgbyte.com/. The application tree lives under /opt/tianji/src.

• Move PostgreSQL to Amazon RDS for PostgreSQL, update DATABASE_URL in /etc/tianji/tianji.env, then restart tianji.
• Put the web tier behind an Application Load Balancer with an ACM certificate for managed HTTPS and high availability.
• Grow either EBS data volume and expand the filesystem online as your analytics and telemetry history grows.