Timeplus Proton

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B4ms (4 vCPU / 16 GiB RAM) is a good starting size.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network. No inbound application ports are needed, because you reach Proton over an SSH tunnel.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Timeplus Proton by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) only.

Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:timeplus-proton-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name timeplus-proton \
  --image sac1647283583153:timeplus-proton-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

Connect over SSH as azureuser:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm Proton is installed and running

Check the Proton version, the service state, the listening ports and the host firewall:

proton server --version systemctl is-active proton.service timeplus-proton-firstboot.service ss -tln | grep -E ':8463 |:3218 '
sudo nft list table inet sac_proton

The output shows Proton 3.0.26, both services active and the ports listening. It also shows the host firewall dropping every Proton port from anything but loopback:

proton server version 3.0.26. active active LISTEN 0 4096 0.0.0.0:8463 0.0.0.0:* LISTEN 0 4096 0.0.0.0:3218 0.0.0.0:* table inet sac_proton { chain input { type filter hook input priority filter; policy accept; iif "lo" accept ct state established,related accept tcp dport { 3218, 5432, 7587, 8123, 8463 } drop } }

Proton binds its ports on all interfaces. The sac_proton firewall table accepts loopback traffic and drops every Proton port (3218, 5432, 7587, 8123, 8463) from any other interface. The engine is therefore reachable on the VM itself but not from the network.

Step 5 - Retrieve your per-VM password

Each VM generates its own unique Proton password on first boot and writes it to a root-only credentials file. Read it with:

sudo cat /root/timeplus-proton-credentials.txt

The file contains PROTON_PASSWORD, the connection details and the SSH-tunnel instructions. Store the password in your secrets manager. In the commands below, <PROTON_PASSWORD> stands for the value of PROTON_PASSWORD.

Step 6 - Run streaming SQL with the proton client

Proton speaks SQL over its native protocol on port 8463. The example below connects as the default user. It creates a stream, inserts events and reads a historical aggregate over them with the table() function, which turns a stream into a bounded, point-in-time query.

Create the stream and insert some events:

proton client --host 127.0.0.1 --port 8463 --user default --password <PROTON_PASSWORD> --multiquery --query "DROP STREAM IF EXISTS sales; CREATE STREAM sales (region string, amount int32); INSERT INTO sales (region, amount) VALUES ('emea', 100), ('emea', 250), ('amer', 400);"

Next, read a historical aggregate over the stream with table():

proton client --host 127.0.0.1 --port 8463 --user default --password <PROTON_PASSWORD> --query "SELECT region, sum(amount) AS total FROM table(sales) GROUP BY region ORDER BY region"

┌─region─┬─total─┐ │ amer │ 400 │ │ emea │ 350 │ └────────┴───────┘

The same sales stream also powers continuous streaming queries, which are the core of streaming SQL. SELECT region, sum(amount) FROM sales GROUP BY region, without table(), runs forever and emits a new result every time an event arrives.

Step 7 - Confirm persistence on the dedicated data disk

Proton's streams and historical store live on the dedicated Azure data disk at /var/lib/proton. Your data survives restarts, and you can resize the volume independently. Confirm the stream, the mount and the HTTP health endpoint:

proton client --host 127.0.0.1 --port 8463 --user default --password <PROTON_PASSWORD> \
  --query "SHOW STREAMS" findmnt /var/lib/proton curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:3218/

┌─name──┐ │ sales │ └───────┘ TARGET SOURCE FSTYPE OPTIONS /var/lib/proton /dev/sdc ext4 rw,relatime 200

The mount on /dev/sdc confirms that Proton's data is on the dedicated data disk. The 200 confirms that the HTTP interface is serving locally.

Step 8 - Verify the authentication wall

The per-VM password is enforced on the default user. The correct password is accepted, and a wrong password is rejected. First confirm that the correct password authenticates:

proton client --host 127.0.0.1 --port 8463 --user default --password <PROTON_PASSWORD> \
  --query "SELECT current_user() AS user, version() AS proton_version"

┌─user────┬─proton_version─┐ │ default │ 3.0.26 │ └─────────┴────────────────┘

To see the rejection for yourself, connect with a wrong password, for example proton client --host 127.0.0.1 --port 8463 --user default --password wrongpw --query 'SELECT 1'. Proton responds with Authentication failed: password is incorrect, or there is no user with such name. The engine is never open without the credential.

Step 9 - Connect remotely over an SSH tunnel

Proton's ports are reachable on the VM itself but blocked from the network by the host firewall. This is the secure default. To reach the native protocol from your workstation, open an SSH tunnel and point a local proton client at localhost:8463:

# On your workstation:
ssh -L 8463:127.0.0.1:8463 azureuser@<vm-public-ip>
# In another terminal, with a local proton client: proton client --host 127.0.0.1 --port 8463 --user default --password <PROTON_PASSWORD> --query "SELECT 1"

For production remote access without a tunnel, bind Proton to a private NIC and front it with TLS. Alternatively, open 8463 in your own NSG, restricted to known source ranges, and remove the corresponding firewall drop. Never expose Proton to the internet without transport encryption and source restrictions.

Maintenance

• Persistence: streams and the historical store live on the dedicated data disk at /var/lib/proton. Your data survives reboots, and you can resize the volume independently.
• Password: the first boot sets the per-VM password on the default user through /etc/proton-server/users.d/sac-default-password.xml. To change it, generate a new SHA-256 hash, update that file, and run sudo systemctl restart proton.service.
• Service: Proton runs as proton.service under a dedicated proton system user. Restart it with sudo systemctl restart proton.service.
• Firewall: the sac_proton nftables table in /etc/nftables.conf enforces loopback-only access. Adjust it only if you deliberately expose a port to a private network.
• Security patches: unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Timeplus and Proton are trademarks of Timeplus Inc. SecureAnyCloud provides this image, and it is not affiliated with or endorsed by Timeplus Inc. Timeplus Proton is licensed under the Apache License 2.0.

Deploy on Azure

Launch Timeplus Proton on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com