Vane

• In the Azure Portal, search the Marketplace for Vane on Ubuntu 24.04 LTS and select Create.
• Choose your subscription, resource group and region.
• Set the VM size to Standard_B2ms or larger.
• Under Administrator account, select SSH public key and supply your own key.
• Under Inbound port rules, allow HTTPS (443), HTTP (80) and SSH (22), then restrict all three to your own address ranges on the networking blade.
• Review the settings and create the VM.

Accept the Marketplace terms, create the VM, then open HTTPS and the HTTP redirect to your own network only. Replace the example resource group, VM name and address range with your own:

az vm image terms accept --urn sac1647283583153:vane-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-resource-group \
  --name my-vane \
  --image sac1647283583153:vane-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard
# Open HTTPS (and the HTTP redirect) to YOUR network only. MY_CIDR="203.0.113.0/24"
# replace with your own range
az network nsg rule create \
  --resource-group my-resource-group \
  --nsg-name my-vaneNSG \
  --name allow-https-from-office --priority 1010 \
  --source-address-prefixes "${MY_CIDR}" \
  --destination-port-ranges 80 443 --protocol Tcp --access Allow

Connect over SSH as azureuser:

ssh azureuser@<vm-ip>

First boot takes under a minute. It generates this VM's login, certificate and SearXNG secret, starts the services, and proves the login gate before it finishes. Check that the services are running:

# Every unit reports "active". vane-firstboot is a oneshot that stays active (exited).
systemctl is-active vane-firstboot searxng vane nginx
# Only SSH (22) and nginx (80, 443) listen publicly. Vane (3000) and SearXNG (8888)
# listen on loopback, and port 53 is the operating system's local DNS resolver.
sudo ss -lntH | awk '{print $4}' | sort -u

Expected output:

active active active active 0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:3000 127.0.0.1:8888 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

Read the credentials file. Everything in it was generated on this VM at first boot:

sudo cat /root/vane-credentials.txt

The file looks like this:

# Vane - per-VM login generated on first boot (...).
# Keep this file private. Change the password with:
sudo htpasswd -B /etc/nginx/vane.htpasswd admin VANE_URL=https://<vm-ip>/ VANE_USERNAME=admin VANE_PASSWORD=<VANE_PASSWORD>

• Open VANE_URL from the credentials file in your browser. The certificate is self-signed and generated for this VM, so your browser will warn you the first time. Accept it for this address, or follow Step 12 to use your own domain and a trusted certificate.
• Your browser asks for a username and password. Enter admin and VANE_PASSWORD.
• On the first visit Vane opens its setup screen. Select Add Connection, choose the connection type and fill it in:
• OpenAI, Anthropic, Gemini or Groq: a name for the connection and your API key. For any other OpenAI compatible service, choose OpenAI and change the Base URL
• Ollama, LM Studio or Lemonade: the base URL of your model server, for example http://10.0.1.5:11434 for an Ollama server on your virtual network
• Select Next. Choose the chat model that will write answers, and keep Transformers - all-MiniLM-L6-v2 as the embedding model unless your provider offers one you prefer. The Transformers models run on the VM and need no key.
• Select Finish. You land on Vane's search page. You can add, edit or remove connections later from Settings (the gear at the bottom of the sidebar), under Models.

Costs. Your provider bills you for the tokens Vane uses. Every answer makes several model calls, and Balanced and Quality modes make more than Speed. Vane can also run an extra image and video search after each answer. For fewer calls, turn off Auto video & image search under Settings > Preferences. Most providers let you set a monthly spending limit on the key you use here.

• Login. Vane itself has no accounts and no sign-in. Upstream treats it as a single-user app on a trusted network. An exposed instance lets anyone read its settings, including your provider API keys, and spend on them. In this image, nginx requires a login for every page and API route.
• Password storage. The password is stored as a bcrypt hash in /etc/nginx/vane.htpasswd. The plain-text password exists only in the root-only credentials file. Everyone who signs in sees the same Vane, with the same connections and history, so share the login only with people you would share the API key with.
• Network. nginx is the only public listener. It serves Vane on port 443 with a certificate generated for this VM, and port 80 only redirects to HTTPS. Vane and SearXNG listen on 127.0.0.1 only.
• Brute force. nginx limits each client address to 20 requests a second.
• Outbound requests. Vane fetches web pages and talks to your model provider, and SearXNG queries search engines. Both services are blocked from the Azure Instance Metadata Service (169.254.169.254) and the Azure wire server (168.63.129.16), so a link that points at them cannot read this VM's identity or managed identity tokens. Private address ranges stay reachable on purpose, so Vane can use a model server elsewhere on your network.

You can check the login from the VM itself:

PW=$(sudo sed -n 's/^VANE_PASSWORD=//p' /root/vane-credentials.txt) code() { curl -sk -o /dev/null -w '%{http_code}' "$@"; } echo "anonymous : $(code https://127.0.0.1/)" echo "wrong password : $(code -u admin:wrong-password-123 https://127.0.0.1/)" echo "this VM's login : $(printf 'user = "admin:%s"\n' "$PW" | code -K - https://127.0.0.1/)" echo "plain HTTP : $(code http://127.0.0.1/)"

Expected output:

anonymous : 401 wrong password : 401 this VM's login : 200 plain HTTP : 301

Type a question on the search page and press Enter. Vane shows the sources it found first, then writes the answer with numbered citations.

Select a source card to open the page it came from. Ask follow-ups in the box at the bottom of the answer.

• Modes. Speed answers from search snippets in one or two research steps. Balanced does more searching. Quality goes further and opens the most relevant pages in Chrome Headless Shell to read them in full, which takes longer and uses more tokens.
• Sources. Choose web, discussions or academic sources from the box under the question, or name a site in your question to focus on it.
• Files. Attach PDFs, documents or text files with the paperclip and ask questions about them. Uploaded files are searched with the local embedding model.
• Read a page. Ask Vane to summarise a specific URL and it reads that page.
• Library. Every conversation is saved on the VM and listed in the Library, where you can reopen or delete it.

Vane's search API is the same one the web page uses, behind the same login. List the connections to find the provider and model identifiers it needs:

PW=$(sudo sed -n 's/^VANE_PASSWORD=//p' /root/vane-credentials.txt) printf 'user = "admin:%s"\n' "$PW" | curl -sk -K - https://127.0.0.1/api/providers \
  | jq -r '.providers[] | "\(.name) chat models: \(.chatModels|length) embedding models: \(.embeddingModels|length)"'

On a new VM, only the built-in Transformers connection is listed. The connection you added in Step 6 appears after it:

Transformers chat models: 0 embedding models: 3

Then ask a question from any machine that can reach the VM, using the provider id and model key values from /api/providers:

curl -sk -u 'admin:<VANE_PASSWORD>' https://<vm-ip>/api/search \
  -H 'Content-Type: application/json' -d '{ "query": "What is the capital city of Australia?", "sources": ["web"], "optimizationMode": "speed", "stream": false, "history": [], "chatModel": {"providerId": "<your-connection-id>", "key": "<chat-model-key>"}, "embeddingModel": {"providerId": "<transformers-connection-id>", "key": "Xenova/all-MiniLM-L6-v2"} }'

The reply is a JSON object with the answer in message and the cited pages in sources. Set "stream": true to receive the answer as it is written, one JSON object per line.

Vane can use a model server you run yourself, for example Ollama on a GPU VM in the same virtual network. On that server:

• Ollama must listen on an address the Vane VM can reach, for example by setting OLLAMA_HOST=0.0.0.0:11434 in its service, and its network security group must allow port 11434 from the Vane VM only. Ollama has no authentication of its own.
• Pull the models you want there, for example ollama pull qwen3:8b. Choose a model with tool-calling support, because Vane's research step uses tools.

Then add an Ollama connection in Vane (Settings > Models > Add Connection) with the base URL http://<server-private-ip>:11434. Vane asks Ollama for a 32,000-token context on every request, so size the model server's memory for that context, not only for the model weights.

SearXNG runs on the VM and only Vane talks to it. Its settings live in /etc/searxng/settings.yml, which changes only what differs from SearXNG's defaults. You can query it directly from the VM:

curl -s 'http://127.0.0.1:8888/search?q=azure+virtual+machines&format=json' | jq '.results | length'

20

To enable or disable search engines, edit /etc/searxng/settings.yml (see the SearXNG documentation for the engines: list) and restart the service:

sudo nano /etc/searxng/settings.yml
sudo systemctl restart searxng

• Point a DNS record, for example vane.example.com, at the VM's public IP address and allow port 80 from the internet while the certificate is issued.
• Install certbot and request a certificate with the webroot nginx already serves for ACME challenges:

sudo apt-get install -y certbot
sudo certbot certonly --webroot -w /var/www/html -d vane.example.com

• Point nginx at the new certificate and reload it:

sudo sed -i 's#/etc/vane/tls/server.crt#/etc/letsencrypt/live/vane.example.com/fullchain.pem#; s#/etc/vane/tls/server.key#/etc/letsencrypt/live/vane.example.com/privkey.pem#' /etc/nginx/sites-available/vane
sudo nginx -t && sudo systemctl reload nginx

The login is a standard nginx password file. To set a new password for admin, or to add a separate login for a colleague, run htpasswd and type the password when prompted:

sudo htpasswd -B /etc/nginx/vane.htpasswd admin
sudo htpasswd -B /etc/nginx/vane.htpasswd alice

nginx reads the file on every request, so no restart is needed. Remove a login with sudo htpasswd -D /etc/nginx/vane.htpasswd alice. Update /root/vane-credentials.txt if you change the admin password, or delete that file once you have stored the password somewhere safe.

The exact versions in the image are recorded on the VM:

cat /usr/share/vane-appliance/VERSIONS

vane=1.12.2 vane_commit=9e8d883768c43520464345fefe58654f5cee451b searxng_commit=b00212a8366131936856b726ed4dd9bd281e4d7e chrome_headless_shell=155.0.8059.79 embedding_model=Xenova/all-MiniLM-L6-v2@751bff37182d3f1213fa05d7196b954e230abad9 node=v24.22.0

• Logs. sudo journalctl -u vane -f shows Vane's log, sudo journalctl -u searxng -f SearXNG's, and /var/log/nginx/ the web server's.
• Restart. sudo systemctl restart vane (or searxng, nginx).
• Back up. Vane keeps its settings, connections (including your API keys), conversation history and uploaded files in /var/lib/vane/data. Back up that directory, for example with sudo tar -C /var/lib/vane -czf vane-data-backup.tgz data, and keep the archive private because it contains your keys. Azure Backup or disk snapshots of the VM also work.
• Updates. Unattended upgrades install Ubuntu security updates automatically. SecureAnyCloud publishes new image versions with updated Vane releases.