TuGraph 4.5

Search for TuGraph in Azure Marketplace, select the SecureAnyCloud publisher entry, and click Create.

Set the NSG rules to allow TCP 22 from your management IP and TCP 80 from your client IPs. TuGraph's HTTP and Bolt ports are bound to loopback, so only nginx on port 80 is exposed. Do not expose port 80 to the public internet without a TLS-terminating reverse proxy in front.

RG="tugraph-prod"; LOCATION="eastus"; VM_NAME="tugraph-01" IMAGE_URN="sac1647283583153:tugraph-db:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name tg-vnet --address-prefix 10.90.0.0/16 --subnet-name tg-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name tg-nsg az network nsg rule create -g "$RG" --nsg-name tg-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name tg-nsg --name allow-http --priority 110 \
  --source-address-prefixes "<your-client-cidr>" --destination-port-ranges 80 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:tugraph-db:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name tg-vnet --subnet tg-subnet --nsg tg-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

The TuGraph container and nginx.service start automatically after tugraph-firstboot.service initializes the database and generates the per VM administrator password on the first boot.

sudo systemctl is-active docker.service nginx.service
sudo test -f /var/lib/sac/data/tugraph-firstboot.done && echo FIRSTBOOT_DONE
sudo docker ps --format 'table {{.Names}}\t{{.Status}}'

Both services report active, the first boot sentinel is present, and the tugraph container is running.

TuGraph's HTTP port (7070) and Bolt port (7687) are published to 127.0.0.1 only, and nginx serves everything on port 80.

sudo ss -tln | grep -E ':80 |127.0.0.1:7070|127.0.0.1:7687'

Only nginx listens on a routable interface. The database ports never leave the host.

First boot generates the per VM administrator password and stores it in a root only file. Print the file:

sudo cat /root/tugraph-credentials.txt

The file shows the administrator user, the per VM password, and the endpoint URLs:

TUGRAPH_ADMIN_USER=admin TUGRAPH_ADMIN_PASSWORD=<TUGRAPH_PASSWORD> TUGRAPH_CONSOLE_URL=http://<vm-ip>/ TUGRAPH_REST_API_URL=http://<vm-ip>/ TUGRAPH_DEMO_GRAPH=default

A stock TuGraph accepts the well known default admin / 73@TuGraph. This image rotates the default at first boot, so the default is rejected and only the per VM password authenticates. Test both logins:

curl -s -H 'Content-Type: application/json' -X POST http://127.0.0.1/login \
  -d '{"user":"admin","password":"73@TuGraph"}' | grep -q '"jwt"' \
  && echo "default ACCEPTED (unexpected)" || echo "default 73@TuGraph rejected"

The default login returns no token. The per VM password does.

TuGraph exposes a REST API. Log in to obtain a token, then run a Cypher query against the seeded default graph:

PW=$(sudo grep '^TUGRAPH_ADMIN_PASSWORD=' /root/tugraph-credentials.txt | cut -d= -f2-)
JWT=$(curl -s -H 'Content-Type: application/json' -X POST http://127.0.0.1/login \
  -d "{\"user\":\"admin\",\"password\":\"$PW\"}" | jq -r '.jwt')
curl -s -H "Authorization: Bearer $JWT" -H 'Content-Type: application/json' \
  -X POST http://127.0.0.1/cypher \
  -d '{"graph":"default","script":"MATCH (a:person)-[e:knows]->(b:person) RETURN a.name AS from, b.name AS to"}'

The query returns the seeded relationships: Alice knows Bob, Bob knows Carol, Carol knows Alice.

The TuGraph web console is the built in graph workbench. From your workstation, open http://<vm-ip>/. The NSG must allow TCP 80. The sign in page asks for a connection address, an account and a password:

Sign in with these values:

Connection address: <vm-ip>:80. The console reaches the database's Bolt endpoint through nginx on port 80.

Account: admin

Password: the per VM password from /root/tugraph-credentials.txt

The console opens on the graph project home and shows the seeded default graph with its vertex and edge counts:

Open graph query on the default graph. Type a Cypher statement into the editor (for example match (n) return n limit 10) and press execute. The result reports success, and the graph view renders the vertices:

Switch between the graph and list result views to explore the returned vertices and relationships:

Component Path

Container image tugraph/tugraph-runtime-centos7:4.5.2 (pre pulled)

Container name tugraph (managed by Docker --restart=always)

Graph data directory /var/lib/tugraph/data (dedicated data disk)

Log directory /var/lib/tugraph/log (dedicated data disk)

Firstboot script /usr/local/sbin/tugraph-firstboot.sh

Firstboot service /etc/systemd/system/tugraph-firstboot.service

Credentials file /root/tugraph-credentials.txt (mode 0600)

Firstboot sentinel /var/lib/sac/data/tugraph-firstboot.done

nginx site /etc/nginx/sites-available/sac-tugraph

sudo docker ps --filter name=tugraph
sudo docker logs tugraph 2>&1 | tail -5

Docker's restart policy supervises the container and brings it back automatically after a reboot. To restart it manually, run sudo docker restart tugraph.

• Rotate the administrator password periodically and store it in your secrets manager.
• Keep the database ports on loopback as shipped. Expose only nginx on port 80, and put TLS in front of it with Azure Application Gateway or nginx with a real certificate.
• Restrict the NSG so that port 80 reaches only trusted client networks, and never the public internet without TLS.
• Create per application users in the console instead of using the administrator account for application traffic.
• Back up the graph data directory at /var/lib/tugraph/data.
• Patch the OS monthly with sudo apt-get update && sudo apt-get upgrade && sudo reboot.

TuGraph is licensed under the Apache License 2.0. There are no per node, per CPU, or per GB fees. SecureAnyCloud produces this image and is not affiliated with, endorsed by, or sponsored by the TuGraph project or Ant Group. TuGraph is a trademark of its respective owner and is used here only to describe the software included in the image.

SecureAnyCloud provides commercial support for this image separately from the upstream project.

Email: sales@secureanycloud.com

Website: secureanycloud.com

Support hours: 24/7 with guaranteed 24 hour response SLA

Deploy on Azure

Launch TuGraph 4.5 Graph Database on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Launch TuGraph 4.5 Graph Database on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com