Yuvomi

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Yuvomi by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443).

Select Review + create, then Create.

RG="yuvomi-prod"; LOCATION="eastus"; VM_NAME="yuvomi-01" IMAGE_URN="sac1647283583153:yuvomi:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name yuvomi-vnet --address-prefix 10.100.0.0/16 --subnet-name yuvomi-subnet --subnet-prefix 10.100.1.0/24 az network nsg create -g "$RG" --name yuvomi-nsg az network nsg rule create -g "$RG" --nsg-name yuvomi-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name yuvomi-nsg --name allow-https --priority 110 \
  --destination-port-ranges 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:yuvomi:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name yuvomi-vnet --subnet yuvomi-subnet --nsg yuvomi-nsg --public-ip-sku Standard

Replace <sub-id> and <version> with your subscription ID and the image version shown on the listing. Replace <your-mgmt-cidr> with the network you administer from.

On the first boot of each VM, Yuvomi generates its own per-instance secrets and claims its own admin account before the web port is opened. Nothing is baked into the image.

Give the instance a minute after first boot, then SSH in and read the credentials file. The file is 0600 root:root:

sudo cat /root/yuvomi-credentials.txt

The file contains everything unique to this instance:

• YUVOMI_USERNAME and YUVOMI_PASSWORD are the admin login that you use in the web UI. The admin has full access, including member management.
• YUVOMI_URL is the web address of this instance, resolved from its public IP on first boot.

The session signing secret and the database encryption key are held in /opt/yuvomi/.env (also 0600 root:root) and never leave the VM.

Confirm that the services and container are healthy:

sudo systemctl is-active docker yuvomi-firstboot yuvomi yuvomi-postboot nginx

active active active active active

sudo docker compose -f /opt/yuvomi/docker-compose.yml ps --format 'table {{.Service}}\t{{.Status}}\t{{.Ports}}'

SERVICE STATUS PORTS yuvomi Up 8 minutes (healthy) 127.0.0.1:3000->3000/tcp

The application container publishes to loopback only. Host nginx on port 443 is the single public entry point and terminates TLS.

Upstream Yuvomi guides the first person who opens a new instance through the setup wizard that creates the admin account. On a VM with a public IP that is a real risk, so SecureAnyCloud removes it in two independent ways.

First, yuvomi-postboot.service claims the admin account itself, over the loopback port, with a password generated for this VM. Yuvomi's own setup endpoint then returns 404 forever in production once a user exists. The application's code enforces this, not a configuration flag.

Second, host nginx, the only public listener, does not start until the admin exists. It is gated on a bootstrap-ready marker that the post-boot service creates only after the admin exists. Port 443 is therefore closed for the whole bootstrap window.

The session signing secret and the database encryption key are also generated on first boot, before the stack can start. The upstream sample values (REPLACE_WITH_A_LONG_RANDOM_STRING, REPLACE_WITH_A_STRONG_ENCRYPTION_KEY) therefore never exist on your VM. A start-up guard refuses to launch the application if either secret is empty, too short or still a sample value. The database is encrypted at rest with the per-VM key.

Check the listening ports:

ss -tln | grep -E ':(443|3000) ' | awk '{print $1, $4}'

LISTEN 127.0.0.1:3000 LISTEN 0.0.0.0:443 LISTEN [::]:443

The setup wizard is closed, and authenticated data is not readable anonymously:

curl -sk -o /dev/null -w 'setup wizard (after admin claimed) -> %{http_code}\n' -X POST https://127.0.0.1/api/v1/auth/setup -H 'Content-Type: application/json' --data '{"username":"probe","display_name":"probe","password":"probe-should-never-work"}'
curl -sk -o /dev/null -w 'authenticated API (anonymous) -> %{http_code}\n' https://127.0.0.1/api/v1/auth/me

setup wizard (after admin claimed) -> 404 authenticated API (anonymous) -> 401

The on-disk database is encrypted at rest, so its header is not the plaintext SQLite marker. Check the header:

sudo head -c 16 /var/lib/yuvomi/data/yuvomi.db | grep -qa "SQLite format 3" && echo "plaintext" || echo "encrypted (no plaintext SQLite header)"

encrypted (no plaintext SQLite header)

The image ships a prover that exercises the whole security model through the public front door. It confirms that the app answers, the setup wizard is closed, and a wrong password is rejected. It also confirms that the per-instance admin password logs in, issues a session, and creates and reads back a real task.

sudo /usr/local/sbin/yuvomi-roundtrip.sh

Open https://<vm-ip>/ in your browser and sign in with the YUVOMI_USERNAME and YUVOMI_PASSWORD from the credentials file.

The image uses a per-VM self-signed certificate, so your browser shows a certificate warning the first time. Accept the warning, or install your own certificate at /etc/ssl/yuvomi/.

Once you are signed in, the dashboard is the home view. It gathers the household's day at a glance, with upcoming tasks and events, shopping lists, meals and more. The module navigation runs down the side, so you can open tasks, the calendar, shopping, meals, budget and contacts.

Choose Tasks to see and manage the household's shared to-do list. Each task can be assigned to a family member and given a due date, a priority and a category. Chores and jobs are then shared out and tracked rather than forgotten.

The Calendar brings the family's events together in one shared month view. Appointments, activities and reminders for everyone in the household are visible in one place.