Wavelog

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point for a personal or club logbook. Move up to Standard_D2s_v3 for very large logs or heavy contest use.

Configure the NSG to allow inbound 22/tcp from your management network, 80/tcp for the application, and 443/tcp if you terminate TLS on the VM. The bundled MariaDB listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

In the Azure portal, choose Create a resource, search for Wavelog Amateur Radio Logbook on Ubuntu 24.04 LTS by SecureAnyCloud, and select Create.

Pick your subscription, resource group and region, and choose the Standard_B2s size. Select SSH public key authentication with the username azureuser, and allow inbound 22, 80 and 443.

Your logbook data and the MariaDB database live on the OS disk, so you do not need to attach an extra disk.

Step 2 - Deploy from the Azure CLI

You launch the image like any other Marketplace VM. The two commands below create the VM and open the web ports. They depend on your subscription, so adapt them to your environment.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:wavelog-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name wavelog \
  --image sac1647283583153:wavelog-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name wavelog --port 80,443

Step 3 - Confirm the services are running

SSH to the VM as azureuser and confirm that Apache, MariaDB, the first-boot service and cron are all active. MariaDB is bound to 127.0.0.1:3306 only, while Apache serves on port 80.

systemctl is-active apache2 mariadb wavelog-firstboot cron

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g'

The health endpoint answers without authentication for the Azure Load Balancer. An unauthenticated request to / redirects to the Wavelog sign-in page, because Wavelog requires a login:

curl -s -o /dev/null -w 'GET /healthz -> %{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'GET / -> %{http_code} (redirect to %{redirect_url})\n' http://127.0.0.1/

Step 4 - Retrieve the per-VM administrator password

The first-boot service generates an administrator password that is unique to your VM and writes it to a root-only file, along with the loopback MariaDB details. Read the file over SSH:

sudo cat /root/wavelog-credentials.txt

WAVELOG_URL is the VM's own address as seen from inside the VM. Azure does not expose the public IP to the instance, so this is usually the private address. Browsing to the public IP shown in the Azure portal works identically, because this image derives Wavelog's base URL from the request rather than baking one in at build time:

sudo grep -nE "X_FORWARDED_HOST|base_url" /var/www/wavelog/application/config/config.php | head -3

Step 5 - Sign in

Browse to http://<vm-ip>/ and sign in with the username admin and the password from the credentials file.

You land on the dashboard, which summarises your QSO totals, recent activity, band and mode breakdowns and DXCC progress. The main menu runs across the top.

Step 6 - Set up your station

Before you start logging, set your own station details under Account > Station Logbooks and Account > Station Location. Enter your callsign, gridsquare locator, DXCC entity, CQ and ITU zones, and your rig and antenna.

The image ships one starter station logbook so that you can log immediately, but entering your real details makes DXCC, award and gridsquare tracking accurate. The same Account area is where you connect external services (LoTW, eQSL, QRZ and Clublog) and manage API keys for CAT and third-party logging.

Step 7 - Log and browse your QSOs

The Logbook view lists your logged contacts with a live map of worked stations, and lets you filter, edit and export them. Use QSO or the advanced logbook to log a contact by hand or straight from your rig over CAT, with automatic callsign, DXCC and gridsquare lookup as you type.

To bulk load an existing log, use Import / Export to upload an ADIF or ADX file. The same screen exports your log for LoTW, eQSL, QRZ, Clublog or a backup.

The DXCC reference data needed to resolve entities is already loaded. To confirm the pre-populated reference data and the sample log, run these commands on the VM:

sudo mariadb --protocol=socket -uroot -N wavelog -e "SELECT CONCAT('DXCC entities: ',COUNT(*)) FROM dxcc_entities;"

sudo mariadb --protocol=socket -uroot -N wavelog -e "SELECT CONCAT('Logged QSOs: ',COUNT(*)) FROM TABLE_HRD_CONTACTS_V01; SELECT CONCAT('Station logbooks: ',COUNT(*)) FROM station_logbooks;"

Step 8 - No known or default credentials

This image ships with no usable login. The admin password set at build time is rotated to a random value that is discarded and never recorded. The first-boot service then sets a fresh password that is unique to your VM, before Apache serves a single request.

The admin superuser is the only account that can sign in. The checks below confirm that the per-VM password authenticates through the real Wavelog login form, while a blank password and common weak guesses are all rejected. The bundled MariaDB stays bound to loopback only, and the installer is locked away.

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(user_name,' (the only Wavelog account that can sign in)') FROM wavelog.users WHERE user_type=99"

sudo bash /usr/local/sbin/wavelog-cred-roundtrip.sh

curl -s -o /dev/null -w 'GET /install/ -> %{http_code} (installer locked)\n' http://127.0.0.1/install/ ss -tlnp | grep ':3306 ' | sed 's/ */ /g'

After you sign in for the first time, change the administrator password to one of your own under Account.

Step 9 - Verify the stack and where your data lives

Confirm the application stack and the health endpoint. Your logbook lives entirely on the OS disk. The QSO database is in the bundled MariaDB under /var/lib/mysql, and Wavelog's code and its uploaded and generated files are under /var/www/wavelog.

php -v | head -1; apache2 -v | head -1; mariadb --version

curl -sI http://127.0.0.1/healthz | head -1

df -h --output=source,target,size /var/lib/mysql /var/www/wavelog

Adding your own domain and TLS

Wavelog derives its base URL from the request, so pointing a DNS name at the VM is all you need for links and redirects to use that name. No configuration change is required. To terminate TLS on the VM itself, install a certificate with Certbot:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d wavelog.your-domain.com

Certbot configures the Apache virtual host and renews the certificate automatically. Wavelog switches its generated links to https:// on its own once requests arrive over TLS, because the base URL follows the request scheme.

To pin one fixed public URL instead of following the request, replace the SecureAnyCloud host-derived block near the end of /var/www/wavelog/application/config/config.php with a single line, for example $config['base_url'] = 'https://wavelog.your-domain.com/';, then reload Apache.

Backing up

Your data consists of the MariaDB database and the Wavelog files tree. Dump the database and archive the application directory:

sudo mariadb-dump --protocol=socket -uroot --single-transaction --routines wavelog > /var/tmp/wavelog-db-backup.sql
sudo tar -czf /var/tmp/wavelog-files-backup.tar.gz -C /var/www wavelog

For a complete point-in-time backup, snapshot the VM's OS disk from the Azure portal or CLI.

Security notes

• Unique administrator password. The password is unique to every VM and is generated on first boot into a 0600 root:root file. No default or shared login ships in the image.
• No setup wizard. The installation wizard is denied from the web (/install returns 403), so you never see a setup wizard.
• Private database. The bundled MariaDB listens on 127.0.0.1:3306 only and is never reachable from the network. On-box maintenance uses sudo mariadb as root@localhost over the Unix socket, with no password. The Wavelog app connects as wavelog@localhost over the socket with a per-VM password held in application/config/database.php.
• Protected configuration. The virtual host denies web access to config.php and database.php, which hold the app-to-database secret and the CodeIgniter encryption key.
• Patched OS. The OS is fully patched at build time, and unattended security upgrades stay enabled on your VM.
• Restricted access. Restrict 22/tcp to your management network, and put the site behind TLS before you log over the public internet.

Trademark

Wavelog and Cloudlog are the property of their respective owners. SecureAnyCloud is not affiliated with or endorsed by the Wavelog or Cloudlog projects. All product and company names are trademarks or registered trademarks of their respective holders.

Support

SecureAnyCloud provides 24/7 technical support for this image by email (sales@secureanycloud.com) and live chat, with a one-hour average response time for critical issues.

Deploy on Azure

Launch Wavelog Amateur Radio Logbook on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com