Tracim

Secure by default: a per-VM administrator credential

This image ships with no default or shared login. No database, no user accounts and no session secret ship in the image.

On first boot, a one-shot service resolves your public URL, regenerates a per-VM TLS certificate, and initialises a fresh SQLite database, which generates a unique session secret for your VM. It then rotates the upstream default administrator, changing both its e-mail and password to a unique per-VM administrator credential. The credential is written to a root-only file.

Tracim is held back until that rotation has happened, so a fresh VM is never reachable with the well-known default login. You retrieve the password over SSH and change it after your first login.

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting size, because the running stack uses roughly 1.3 GiB. Scale up for large teams or heavy file and document volumes.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, and 80/tcp and 443/tcp from wherever you browse Tracim. Port :80 only redirects to :443.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Tracim by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80) and HTTPS (443).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:tracim:default:latest
az vm create \
  --resource-group <your-rg> \
  --name tracim \
  --image sac1647283583153:tracim:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name tracim --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name tracim --port 443 --priority 1020

Step 3 - Connect to your VM

Connect over SSH as azureuser:

ssh azureuser@<vm-public-ip>

The message of the day shows your VM's Tracim URL and administrator e-mail.

Step 4 - Confirm the services are running

Tracim runs as three systemd units: the Docker engine, the Tracim container and nginx. Check that all three are active:

systemctl is-active docker.service tracim.service nginx.service

active active active

The Tracim container is published only on the loopback interface. nginx is the only service bound to public ports (:80 and :443):

sudo ss -tln | grep -E ':(80|443|8080) '

LISTEN 0 4096 127.0.0.1:8080 0.0.0.0:* LISTEN 0 511 0.0.0.0:443 0.0.0.0:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:*

The web UI is served over HTTPS, and plain HTTP redirects to it. Test both:

curl -sk -o /dev/null -w 'https:// -> %{http_code}\n' https://127.0.0.1/
curl -s -o /dev/null -w 'http:// -> %{http_code}\n' http://127.0.0.1/

https:// -> 200 http:// -> 301

Step 5 - Read the per-VM administrator credential

On first boot, the VM writes a root-only file with your Tracim URL, the administrator e-mail and the unique password generated for this VM. Show the URL and e-mail:

sudo grep -E '^TRACIM_URL=|^TRACIM_ADMIN_EMAIL=' /root/tracim-credentials.txt

TRACIM_URL=https://<vm-public-ip> TRACIM_ADMIN_EMAIL=admin@sac.local

The TRACIM_ADMIN_PASSWORD line in that file holds your unique password. Only the per-VM credential authenticates. A wrong password and the retired upstream default are both rejected, as this check shows:

E=$(sudo grep '^TRACIM_ADMIN_EMAIL=' /root/tracim-credentials.txt | cut -d= -f2-)
P=$(sudo grep '^TRACIM_ADMIN_PASSWORD=' /root/tracim-credentials.txt | cut -d= -f2-)
curl -sk -o /dev/null -w 'per-VM password -> HTTP %{http_code}\n' -X POST https://127.0.0.1/api/auth/login \
  -H 'Content-Type: application/json' --data "{\"email\":\"$E\",\"password\":\"$P\"}"
curl -sk -o /dev/null -w 'wrong password -> HTTP %{http_code}\n' -X POST https://127.0.0.1/api/auth/login \
  -H 'Content-Type: application/json' --data "{\"email\":\"$E\",\"password\":\"wrong-nope\"}"

per-VM password -> HTTP 200 wrong password -> HTTP 403

Step 6 - First login

Browse to Tracim. Accept the self-signed certificate warning, or install a trusted certificate first (see Enabling a trusted TLS certificate below).

https://<vm-public-ip>/

Enter the administrator e-mail (admin@sac.local) and the TRACIM_ADMIN_PASSWORD from Step 5, then sign in. Change your password in your account settings immediately after your first sign-in.

Working in shared spaces

Tracim organises collaboration into spaces. Create a space, then add content inside it: HTML documents, uploaded files (with automatic versioning), threads for discussion, comments, and a kanban board. Everything in a space is shared with the space's members, so a team's documents and conversations stay together.

Everyone with access to a space can work on its HTML documents, files, threads and kanban cards.

Documents and threads support comments and revisions, so discussion stays attached to the content it is about.

Step 7 - The official pinned container image

Tracim runs from the official upstream container image. The image is pinned to an exact build and baked into the VM image, so nothing is pulled at runtime. It is published on the loopback interface only. Confirm the running container:

sudo docker ps --format 'table {{.Image}}\t{{.Status}}\t{{.Ports}}'

IMAGE STATUS PORTS algoo/tracim:2025-04.00_build_164 Up 6 minutes 127.0.0.1:8080->80/tcp

Adding more users

Tracim is multi-user. Add accounts from the VM by running the built-in tracimcli user create command inside the running container. Choose the profile users, trusted-users or administrators:

sudo docker exec tracim su www-data -s /bin/bash -c \
  "cd /tracim/backend && tracimcli user create \
  --email alice@example.com --password '<choose-a-strong-password>' \
  --profile users -c /etc/tracim/development.ini"

Then invite the new user into your spaces from the web UI. Administrators can also create and manage users in Administration in the interface.

Security updates

The image is patched at build time, including Ubuntu phased updates, and unattended-upgrades stays enabled, so security patches keep flowing on your VM. No packages should be held back:

apt-mark showhold

The docker and nginx packages are managed by systemd units. The application itself is the pinned container image described above.

Your data

Tracim stores its SQLite database and uploaded files under /var/lib/tracim/data. Check how much space they use:

sudo du -sh /var/lib/tracim/data

To back up your workspace, snapshot the VM's OS disk in Azure, or copy /var/lib/tracim/data to external storage on a schedule.

Enabling a trusted TLS certificate

The image ships a per-VM self-signed certificate so HTTPS works out of the box. Browsers warn until you install a trusted certificate.

For production, point a DNS A record at the VM's public IP and make sure 443/tcp is open in the NSG. Then install certbot and let it manage the nginx certificate. Substitute your own domain and e-mail address in the command:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com -m you@example.com --agree-tos

certbot configures the HTTPS server block and sets up automatic renewal. When it completes, set basic_setup.website_base_url = https://your-domain.example.com in /var/lib/tracim/config/development.ini and run sudo systemctl restart tracim. Tracim is then available at your domain with a trusted certificate.

Upgrading Tracim

Tracim runs from a pinned container image. Always snapshot the OS disk before you upgrade. To upgrade, follow these steps:

• Edit the image tag in /etc/systemd/system/tracim.service.
• Run sudo docker pull algoo/tracim:<new-tag>.
• Run sudo systemctl daemon-reload.
• Run sudo systemctl restart tracim.

The database schema migrates automatically on start. SecureAnyCloud support can help you plan and perform upgrades.

Support

SecureAnyCloud backs this image with 24/7 support covering deployment, upgrades, integrations, TLS termination and user administration. Contact us by e-mail or chat.

Tracim is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Tracim on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com