WBO

Open Marketplace in the Azure Portal and search for WBO (or Whitebophir). Select the SecureAnyCloud publisher entry and click Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range and TCP 443 from the networks whose users will open the whiteboard. Port 80 only redirects to HTTPS. A per-VM Basic Auth password protects the whiteboard, but you should still restrict the source ranges that can reach it.

Click Review + create, wait for validation, then click Create. Deployment takes around two minutes.

Run these commands to create the resource group, accept the Marketplace terms, create the VM and open port 443:

RG="wbo-prod" LOCATION="eastus" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:wbo-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" \
  --name wbo-01 \
  --image sac1647283583153:wbo-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard
# open the ports the whiteboard uses (SSH from your management range, HTTPS from your users)
az vm open-port --resource-group "$RG" --name wbo-01 --port 443 --priority 900

Connect as azureuser, the login user for this image:

ssh azureuser@<vm-ip>

WBO runs on the Node.js 22 runtime, bound to loopback, behind nginx TLS. Run the commands below to confirm the runtime and WBO version, that both services are active, that WBO listens only on 127.0.0.1:5001, and that the AGPL-3.0 license ships with the image:

node --version jq -r '"WBO "+.version' /opt/wbo/package.json systemctl is-active wbo nginx
sudo ss -ltn | grep -E ':443 |:5001 ' head -2 /usr/local/share/wbo/LICENSE

Expected output:

v22.23.2 WBO 2.17.0 active active LISTEN 0 511 127.0.0.1:5001 0.0.0.0:* LISTEN 0 511 0.0.0.0:443 0.0.0.0:* LISTEN 0 511 [::]:443 [::]:* GNU AFFERO GENERAL PUBLIC LICENSE Version 3, 19 November 2007

On first boot the image generated a Basic Auth password and a self-signed TLS certificate that are unique to this VM. It wrote the password to a root-only file. Read the file with:

sudo cat /root/wbo-credentials.txt

The file contains the whiteboard URL, the Basic Auth user (admin) and the generated password. Its structure is shown below, and the values are unique to your instance:

wbo.url=https://<vm-public-ip>/ wbo.basicauth.user=admin wbo.basicauth.pass=<generated-per-vm>

To confirm the per-VM credential and the end-to-end draw path, run the self test. It prints OK:

sudo bash /usr/local/sbin/wbo-credcheck.sh

The only unauthenticated endpoint is /healthz. The rest of the whiteboard returns 401 without the per-VM Basic Auth password and responds normally with it. The commands below read the generated password from the root-only file and prove each case over TLS. The -k flag accepts the per-VM self-signed certificate.

BP=$(sudo grep '^wbo.basicauth.pass=' /root/wbo-credentials.txt | cut -d= -f2-)
curl -ks -o /dev/null -w 'GET /healthz (no auth) -> HTTP %{http_code}\n' https://127.0.0.1/healthz
curl -ks -o /dev/null -w 'GET / (no auth) -> HTTP %{http_code}\n' https://127.0.0.1/
curl -ks -o /dev/null -w 'GET / (wrong pw) -> HTTP %{http_code}\n' -u admin:wrong https://127.0.0.1/
curl -ks -o /dev/null -w 'GET /boards/demo (ok) -> HTTP %{http_code}\n' -u admin:"$BP" https://127.0.0.1/boards/demo

Expected output:

GET /healthz (no auth) -> HTTP 200 GET / (no auth) -> HTTP 401 GET / (wrong pw) -> HTTP 401 GET /boards/demo (ok) -> HTTP 200

In your browser, go to https://<vm-public-ip>/. The certificate is self-signed and generated per VM, so your browser warns you the first time. Accept the warning to continue. Step 9 covers installing a certificate for a custom domain.

When prompted, enter the Basic Auth credential: user admin and the password from Step 5.

A fresh board opens with the drawing toolbar on the left: pen, straight line, rectangle, ellipse, text, eraser, hand (pan), grid, download, zoom and a color picker. Select the pen and draw, and your strokes appear instantly. Add shapes, text and freehand strokes as you like.

To collaborate, open a board at a memorable URL, for example https://<vm-public-ip>/boards/team-planning, and share that URL and the Basic Auth password with your collaborators. Everyone who opens the same board draws on the same canvas in real time. Each board is persisted to disk, so reopening it later brings back exactly what was drawn.

WBO saves each board to disk shortly after it changes. It serves the current state of any board as an SVG at /boards/<name>.svg. After you draw on a board in the browser, for example demo, fetch its SVG to see the saved shapes:

BP=$(sudo grep '^wbo.basicauth.pass=' /root/wbo-credentials.txt | cut -d= -f2-)
curl -ks -u admin:"$BP" https://127.0.0.1/boards/demo.svg | head -c 400; echo

A board that has been drawn on contains the stored shapes: lines, paths, rectangles and ellipses. A stroke drawn over the real websocket path is persisted and rendered back, which is what makes real-time collaboration work.

The image ships a per-VM self-signed certificate. For a public deployment, point a DNS name at the VM and install a CA-issued certificate, for example with Let's Encrypt. After you issue a certificate for <your-domain>, copy the files into place to replace the certificate nginx serves, then reload nginx:

# after issuing a certificate for <your-domain>, install it:
sudo cp /path/to/fullchain.pem /etc/nginx/wbo/wbo.crt
sudo cp /path/to/privkey.pem /etc/nginx/wbo/wbo.key
sudo nginx -t && sudo systemctl reload nginx

Alternatively, issue a certificate for <your-domain> automatically with certbot:

sudo certbot --nginx -d <your-domain>

You can set your own whiteboard password at any time. The user is admin. Run sudo htpasswd /etc/nginx/.wbo.htpasswd admin for an interactive prompt, or set a value you choose non-interactively:

sudo htpasswd -b /etc/nginx/.wbo.htpasswd admin '<new-password>'
sudo systemctl reload nginx

Every board is a file under /var/lib/wbo/server-data. Back up the directory with tar:

sudo tar czf ~/wbo-boards-backup.tgz -C /var/lib/wbo server-data ls -lh ~/wbo-boards-backup.tgz

To restore, extract the archive back into /var/lib/wbo and restart WBO:

sudo systemctl restart wbo