Tigase

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is the recommended size for a single node. Scale up for more concurrent sessions.

Configure the NSG inbound rules as follows:

• 22/tcp from your management network
• 8080/tcp for the web console. For public exposure, front it with TLS (see Step 10).
• 5222/tcp (c2s) for client connections
• 5269/tcp (s2s), if you federate with other XMPP servers

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Tigase XMPP Server by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size (Standard_B2s). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22).

Select Review + create, then Create. After deployment, open 8080, 5222 and 5269 on the VM's network security group.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:tigase-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name tigase \
  --image sac1647283583153:tigase-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name tigase --port 8080 --priority 1010
az vm open-port --resource-group <your-rg> --name tigase --port 5222 --priority 1020
az vm open-port --resource-group <your-rg> --name tigase --port 5269 --priority 1030

Step 3 - Connect to your VM

ssh azureuser@<public-ip>

Step 4 - Confirm the service is running

systemctl is-active tigase.service

The service reports active. On first boot, the JVM server can take a minute or two to start fully while it loads the database schema and warms up. Confirm that the XMPP and HTTP listeners are bound:

ss -tln | grep -E ':(5222|5223|5269|5280|8080) '

You should see listeners on 5222 (c2s), 5223 (legacy-TLS c2s), 5269 (s2s), 5280 (BOSH/WebSocket) and 8080 (HTTP console).

Step 5 - Retrieve the per-VM administrator credentials

First boot generates a unique administrator account and password on every VM and writes them to a root-only file. There is no default login. Read the file with sudo:

sudo cat /root/tigase-credentials.txt

The file shows TIGASE_DOMAIN (the XMPP virtual host, set to the VM's resolvable address at first boot), TIGASE_ADMIN_JID (admin@<domain>) and TIGASE_ADMIN_PASSWORD. Store the password safely.

Step 6 - Open the web admin console

Browse to http://<public-ip>:8080/admin and sign in with admin@<domain> and the password from Step 5.

The admin console manages the running server. You can add, modify and delete users, configure virtual-host domains, view statistics, set the message of the day, and run ad-hoc administrative commands. For example, the Configuration > Add Domain command opens a form to add and configure an XMPP virtual host on the running server.

The console requires authentication. Confirm that it rejects unauthenticated access and accepts the per-VM administrator:

echo -n 'no credentials -> '; curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080/admin/
DOM=$(sudo sed -n 's/^TIGASE_DOMAIN=//p' /root/tigase-credentials.txt)
PW=$(sudo sed -n 's/^TIGASE_ADMIN_PASSWORD=//p' /root/tigase-credentials.txt)
echo -n 'per-VM admin -> '; curl -s -o /dev/null -w '%{http_code}\n' -u "admin@$DOM:$PW" http://127.0.0.1:8080/admin/

no credentials -> 401 and per-VM admin -> 200.

Step 7 - Verify an XMPP client login

Tigase authenticates XMPP clients over c2s on 5222 using STARTTLS. The image ships a small helper that performs a real c2s SASL PLAIN login. Use it to confirm that the administrator credential authenticates end to end:

DOM=$(sudo sed -n 's/^TIGASE_DOMAIN=//p' /root/tigase-credentials.txt)
PW=$(sudo sed -n 's/^TIGASE_ADMIN_PASSWORD=//p' /root/tigase-credentials.txt)
sudo python3 /usr/local/sbin/tigase-auth-check.py 127.0.0.1 5222 "admin@$DOM" "$PW"

AUTH_OK confirms that the credential authenticates over XMPP. A wrong password is rejected with AUTH_FAIL. This includes the upstream setup default, tigase, so the published default never works on a SecureAnyCloud VM.

To connect from a desktop or mobile XMPP client (Gajim, Conversations, Dino, Siskin and others), use the JID admin@<domain> and the password from Step 5. Use <public-ip> as the server address on port 5222.

By default, the image uses a self-signed certificate for the virtual host. Accept the certificate on first connect, or install your own (see Step 10).

Step 8 - Use the Tigase Web Client

Tigase also ships a browser-based XMPP client at http://<public-ip>:8080/ui. Enter the username admin, set the domain to your <domain>, and enter the password. You can then chat directly from the browser.

Step 9 - Add user accounts

In-band registration is disabled by default, so you create accounts as the administrator. In the admin console (Step 6), expand USERS > Add user. Enter the new user's JID (someone@<domain>) and a password.

Users then sign in with any XMPP client or the Tigase Web Client. The landing page at http://<public-ip>:8080/ lists all of the server's HTTP surfaces.

Step 10 - Set a production domain and TLS

XMPP works best with a real DNS domain rather than an IP address. Point a DNS name at your VM, then set it as the virtual host:

• Edit default-virtual-host and the admins list in /opt/tigase/current/etc/config.tdsl.
• Restart with sudo systemctl restart tigase.service.
• Recreate the admin@<domain> account for the new domain from the admin console.

Add the standard XMPP SRV records (_xmpp-client._tcp and _xmpp-server._tcp) so that clients and federated peers discover the server. For production, install a CA-issued certificate for the domain in place of the default self-signed certificate.

Maintenance

• Restart the server: sudo systemctl restart tigase.service
• Server log: /opt/tigase/current/logs/tigase-console.log
• Configuration: /opt/tigase/current/etc/config.tdsl (server) and /opt/tigase/current/etc/tigase.conf (JVM options)
• Updates: the OS receives automatic security updates through unattended-upgrades. To scale up, resize the VM in the Azure Portal and raise the JVM heap (PRODUCTION_HEAP_SETTINGS) in tigase.conf.

Support

Every SecureAnyCloud image comes with 24/7 support. If you have questions about Tigase XMPP Server on Azure, contact sales@secureanycloud.com.

Deploy on Azure

Launch Tigase XMPP Server on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com