SecureAnyCloud
Deployment guide

Weaviate

Overview

Weaviate is an open source vector database for AI. It stores data objects together with their vector embeddings, and runs fast semantic, keyword and hybrid search over them through GraphQL and REST APIs. This makes it a strong backend for retrieval-augmented generation (RAG), recommendation and similarity search.

The SecureAnyCloud image installs Weaviate 1.38 from the official release binary at /opt/weaviate. An unprivileged weaviate system account runs it behind an nginx reverse proxy on TCP 80. All data persists on a dedicated Azure data disk, and every VM generates a unique API key on first boot.

What you get:

  • Weaviate 1.38 server binary at /opt/weaviate, run by an unprivileged weaviate account.
  • An nginx reverse proxy on :80 in front of the Weaviate server (bound to loopback :8080, REST and GraphQL).
  • A dedicated Azure data disk at /var/lib/weaviate that holds stored objects, vector indexes and metadata (PERSISTENCE_DATA_PATH). It is separate from the OS disk and is re-provisioned with every VM.
  • Secure defaults: anonymous access is disabled and API-key authentication is enabled. A per-VM key (WEAVIATE_API_KEY) is generated at first boot in a root-only file.
  • weaviate.service and nginx.service as systemd units, enabled and active.
  • 24/7 SecureAnyCloud support.

The image ships no embedding model and is CPU only. Bring your own vectors or configure an external vectorizer.

Prerequisites

  • An active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.
  • A VM size of Standard_B2s (2 vCPU / 4 GiB RAM) as a good starting point. Scale up for larger collections or higher query volume.
  • NSG inbound rules that allow 22/tcp from your management network and 80/tcp from the clients that query Weaviate. For public exposure, front port 80 with TLS (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, choose Create a resource, search the Marketplace for Weaviate by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:weaviate-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name weaviate \
  --image sac1647283583153:weaviate-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name weaviate --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active weaviate.service nginx.service ss -tln | grep -E ':80 |:8080 ' curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/v1/.well-known/ready

Both services report active. The server listens on loopback 127.0.0.1:8080, nginx listens on :80, and the readiness endpoint returns 200.

Step 5 - Retrieve your API key

Your VM generates a unique API key on first boot and writes it to a root-only file. Read the file:

sudo cat /root/weaviate-credentials.txt

The WEAVIATE_API_KEY value is the key. Callers authenticate with the standard Authorization: Bearer <api-key> header.

Step 6 - Call the API

The readiness probe is open, but the data APIs require the key as a Bearer token. Confirm the server version:

KEY=$(sudo grep '^WEAVIATE_API_KEY=' /root/weaviate-credentials.txt | cut -d= -f2-)
curl -s -H "Authorization: Bearer $KEY" http://127.0.0.1/v1/meta | python3 -c "import sys,json; print('version:', json.load(sys.stdin)['version'])"

A request without the key is rejected with 401:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/v1/schema

Step 7 - Create a collection and add objects

Point the Weaviate client at the VM, or use REST. Create a collection (class), then add objects with your own vectors. Replace <vm-public-ip> with your VM's address:

curl http://<vm-public-ip>/v1/schema -H "Authorization: Bearer $KEY" \
  -H 'Content-Type: application/json' \
  -d '{"class":"Article","vectorizer":"none"}'
curl http://<vm-public-ip>/v1/objects -H "Authorization: Bearer $KEY" \
  -H 'Content-Type: application/json' \
  -d '{"class":"Article","properties":{"title":"Hello"},"vector":[0.1,0.2,0.3]}'

Query with GraphQL at /v1/graphql, including nearVector semantic search and hybrid search. Collections you create persist on the dedicated data disk at /var/lib/weaviate.

Production notes

  • Configure a vectorizer or generative module, and its provider key, in /etc/weaviate/weaviate.env. Then run sudo systemctl restart weaviate.service.
  • The gRPC API is available on port 50051 for high-throughput clients. Open that port in the NSG if you need it.

Enabling HTTPS

For production, terminate TLS at nginx with a real domain that points at the VM's public IP. Install certbot and request a certificate. Replace the domain with yours:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

certbot edits the nginx site at /etc/nginx/sites-available/sac-weaviate to add the TLS listener, and it arranges automatic renewal.

Backup and maintenance

All Weaviate data (stored objects, vector indexes and metadata) lives on the dedicated data disk at /var/lib/weaviate. To back up your vector store, snapshot that disk in Azure or configure Weaviate's backup module.

The API key is also in /etc/weaviate/weaviate.env (AUTHENTICATION_APIKEY_ALLOWED_KEYS). Keep the OS patched with sudo apt update && sudo apt upgrade.

Restart Weaviate with sudo systemctl restart weaviate.service. Read its logs with sudo journalctl -u weaviate.service.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email or chat for help with schema and collection design, vectorizer and module configuration, backups, TLS termination and scaling.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Weaviate on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure