Uguu

Find the Uguu on Ubuntu 24.04 LTS by SecureAnyCloud image in the Azure Marketplace and select Create.

Choose your subscription, resource group and region.

Select a VM size (Standard_B2s or larger) and provide your SSH public key for the azureuser account.

On the Networking tab, allow inbound 443 and 80 from your users, and restrict 22 to your management network.

Select Review + create, then Create. When the VM is running, browse to https://<your-public-ip>/.

You can deploy the same image from the Azure CLI. Replace the resource group, location and image URN with your own values:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:uguu-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-uguu-rg \
  --name uguu \
  --image sac1647283583153:uguu-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
# then open the required ports
az vm open-port --resource-group my-uguu-rg --name uguu --port 443 --priority 1001
az vm open-port --resource-group my-uguu-rg --name uguu --port 80 --priority 1002

Connect over SSH as azureuser. Confirm that nginx and php-fpm are active, that nginx is the only public listener, and that the dedicated data disk is mounted at /data, where uploaded files are stored:

sudo systemctl is-active nginx php8.3-fpm

sudo ss -tln | grep -E ':80 |:443 '

df -h /data | tail -1

nginx listens on :80 and :443. php-fpm runs over a local unix socket, not a TCP port. The data disk (/dev/sdc) is mounted at /data.

Uploading is gated by a key that is unique to this VM and generated on first boot. Read the key from the credentials file. The file also records the public URL and the appliance configuration. The key is shown in full only on the VM itself:

sudo cat /root/uguu-credentials.txt

You can also confirm the appliance configuration: SQLite metadata, blobs stored under /data/uguu/files/, the 8-hour expiry, the 128 MB upload limit and rate limiting:

jq '{DB_MODE,FILES_ROOT,expireTime,expireTimeUnit,max_upload_size,RATE_LIMIT}' /var/www/uguu/dist/config.json

Browse to https://<your-public-ip>/. The certificate is self-signed and generated per VM, so your browser warns about it the first time. Accept the warning, or install your own certificate (see Step 14).

Your browser then prompts for a username and password. Enter user uguu and the upload key from Step 4. The Uguu uploader opens and states the maximum upload size and the expiry window.

Drag a file onto the Drop or paste file(s) area, paste from the clipboard, or click to choose a file. Uguu uploads the file and shows the generated shareable link next to the file name, with a copy button. Send that link to whoever needs the file.

Opening a shared link downloads the file directly over TLS. Downloads are public by design, which is what lets you share the link. Uploading always requires your key. The file is served from the dedicated /data volume.

Uguu also has a simple HTTP upload API, which suits scripts and screenshot tools such as ShareX. POST an array of files to /upload.php. By default you get a JSON response. You can request csv, text, html or gyazo with ?output=. Uploads are gated, so pass your key with HTTP Basic auth (user uguu). The API page on the appliance shows the endpoint for this VM:

From a shell, you can upload with curl and pass your key. This example reads the key from the credentials file. Replace 127.0.0.1 with your VM public IP when you upload from your workstation:

KEY=$(sudo grep '^uguu.upload.key=' /root/uguu-credentials.txt | cut -d= -f2-)
echo "hello from sac" > /tmp/uguu-demo.txt curl -k -s -u "uguu:$KEY" -F "files[]=@/tmp/uguu-demo.txt" "https://127.0.0.1/upload.php?output=json"

The response contains the shareable url for the uploaded file. For a screenshot tool such as ShareX, set the request URL to https://<your-public-ip>/upload.php and the file form name to files[]. Add an HTTP Basic authorization header with user uguu and your key.

The image ships a self-test that checks the whole security model end to end over TLS. An unauthenticated upload is rejected with 401. A gated upload with the key returns a share URL. The blob lands on the /data volume. The file downloads back with identical content:

sudo /opt/uguu/uguu-selftest.sh

Confirm that plain HTTP redirects to HTTPS, that the unauthenticated /healthz probe answers, and that the uploader page is gated and returns 401 without a key. Then inspect the per-VM self-signed certificate:

curl -s -o /dev/null -w '%{http_code} -> %{redirect_url}\n' http://127.0.0.1/

curl -sk -o /dev/null -w 'healthz=%{http_code}\n' https://127.0.0.1/healthz

curl -sk -o /dev/null -w 'upload UI (no key)=%{http_code}\n' https://127.0.0.1/

sudo openssl x509 -in /etc/nginx/ssl/uguu.crt -noout -subject -ext subjectAltName

The /healthz probe returns 200. The uploader page returns 401 without a key, which shows the gate is enforced. The certificate subject and Subject Alternative Name carry this VM's IP.

Uguu. A PHP application deployed under /var/www/uguu/dist and served by php8.3-fpm behind nginx. The web root is dist/public.

SQLite. A local metadata database at /var/lib/uguu/db/uguu.sq3. It records the filename, size, hash and upload time of each file. No external database is required.

Data disk. A dedicated Azure data disk mounted at /data. Uploaded blobs are stored under /data/uguu/files/ (the FILES_ROOT in the configuration).

nginx. nginx.service terminates TLS on :443 and redirects :80 to HTTPS. It gates the uploader page and /upload.php with the per-VM key, and serves public downloads and the unauthenticated /healthz probe.

First boot. uguu-firstboot.service runs once on first boot. It generates the per-VM upload key and the self-signed TLS certificate, and writes this VM's public address into the configuration and the documentation pages. It also ensures that the data disk directories and the database exist, and writes /root/uguu-credentials.txt.

Expiry. uguu-expire.timer runs checkExpire.php every 15 minutes and deletes files past their retention window from both disk and the database.

Files expire automatically. The retention window is set by expireTime and expireTimeUnit in /var/www/uguu/dist/config.json (8 hours by default). To change it, edit those values, for example to keep files for 3 days. The change takes effect on the next timer run. Confirm that the expiry timer is scheduled:

systemctl list-timers uguu-expire.timer --no-pager

Other limits also live in config.json: max_upload_size (MB), the FILTER_EXTENSIONS and FILTER_MIME blacklists, and the RATE_LIMIT settings. The blacklists reject executables, scripts and other risky types. The image ships with a 128 MB limit, blacklisting enabled and rate limiting on.

Your upload key gates the uploader page and the API. To rotate it, set a new password for the uguu user in the nginx htpasswd file, and record the password wherever you keep the appliance secrets. Replace <new-password> with a strong secret. Omit -b to be prompted instead of passing the password on the command line:

sudo htpasswd -bB /etc/nginx/uguu.htpasswd uguu <new-password>

nginx picks up the change immediately, so the next upload requires the new key. Downloads are unaffected. Keep the key private, because anyone who has it can upload to your instance.

The image ships a self-signed certificate, so it is secure out of the box, but browsers warn about it. Point a DNS name at the VM and install a CA-signed certificate. With your own domain, you can obtain a free certificate from Let's Encrypt:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

Certbot installs the certificate into nginx and sets up automatic renewal.

Restrict SSH. Allow inbound 22 only from your management network. Keep 443 (and 80 for the redirect) open to your users.

Keep the upload key private and rotate it. It is the only thing between your instance and an open public file drop. Rotate it if it may have leaked (Step 13).

Install a trusted certificate. Replace the self-signed certificate with a CA-signed one (Step 14) so that users are not trained to click through warnings.

Keep expiry short. The shortest retention window that suits your workflow limits how long a shared file is reachable. Files delete themselves automatically.

Keep the image updated. Unattended security upgrades remain enabled, so the OS keeps receiving patches.

Uguu is free software distributed under the GNU General Public License v3.0. This image bundles the upstream Uguu release; the licence file is retained on the image. SecureAnyCloud packaging, the per VM upload gate, hardening and support are provided by SecureAnyCloud.

Deploy on Azure

Find this image on the Azure Marketplace and deploy it in minutes. See secureanycloud.com for the full catalogue.

Need Help?

SecureAnyCloud provides 24/7 support with a guaranteed 24 hour response SLA. Contact us through secureanycloud.com for deployment assistance, configuration help or any questions about this image.

Deploy on Azure

Launch Uguu on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com