SecureAnyCloud
Deployment guide

Zulip

Overview

Zulip is an open source team collaboration and chat application. It combines the immediacy of real-time chat with the threaded conversation model of email. Every message belongs to a topic within a channel, so you can follow many conversations at once and catch up efficiently without missing anything.

The SecureAnyCloud image installs Zulip Server 12.0 from the official upstream production installer, which provisions and manages the entire single-server stack. The image stores the PostgreSQL message database on a dedicated Azure data disk, and it creates a fresh organization with a unique owner password on the first boot of every VM.

What you get:

  • Zulip Server 12.0 served over HTTPS on port 443 by Zulip's own nginx with a self-signed certificate, and an HTTP-to-HTTPS redirect on port 80
  • The full single-server stack that the installer manages: PostgreSQL with full-text search, Redis, RabbitMQ, memcached, and the Django and Tornado application servers under supervisor
  • A dedicated Azure data disk at /var/lib/postgresql for the PostgreSQL message database
  • A fresh organization (realm) and owner account with a unique password generated on first boot
  • nginx.service and supervisor.service as systemd units, enabled and active
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B4ms (4 vCPU / 16 GiB RAM) is a good starting point for the multi-service Zulip stack.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, 443/tcp for the Zulip web interface, and 80/tcp for the HTTP-to-HTTPS redirect.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Zulip by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80) and HTTPS (443).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:zulip-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name zulip \
  --image sac1647283583153:zulip-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name zulip --port 443 --priority 1010
az vm open-port --resource-group <your-rg> --name zulip --port 80 --priority 1020

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the Zulip stack is running

On first boot, Zulip sets the server hostname to your instance address, restarts the stack, creates a fresh organization and owner account, and writes the credentials to a root-only file. Confirm that both services are active:

systemctl is-active nginx supervisor

Both services report active.

Next, confirm that the supervisor-managed Zulip processes are running and that the health endpoint answers:

sudo supervisorctl status zulip-django zulip-tornado curl -sk -o /dev/null -w 'HTTP %{http_code}\n' https://127.0.0.1/health

The health endpoint returns HTTP 200.

Step 5 - Retrieve the organization owner password

The organization owner account is unique to your VM and is generated on first boot. Read the credentials file as root:

sudo cat /root/zulip-credentials.txt

The file contains the owner email, a unique password and the https://<vm-public-ip>/ URL. After your first sign-in, change the email and password in your personal settings.

Step 6 - Sign in to Zulip

Browse to https://<vm-public-ip>/ and accept the self-signed certificate warning. Then sign in with the owner email and the password from the credentials file.

Step 7 - Explore your organization

After you sign in, you land in your new organization. The left sidebar lists channels and their topics, and the main pane shows the message view.

Every message belongs to a topic within a channel, so a single channel can carry many parallel conversations that stay separate. Select a topic to read just that thread.

Step 8 - Organization settings

Open the organization settings from the gear menu. The owner account can manage users, channels, permissions, authentication methods and the organization profile here. Invite your team, create channels and configure your organization.

Data on the dedicated data disk

The PostgreSQL cluster data directory lives on a dedicated Azure data disk mounted at /var/lib/postgresql. This keeps the Zulip message database, which is the heaviest and most valuable per-deployment state, on a managed disk. You can snapshot, resize and back up that disk independently of the OS disk.

df -h /var/lib/postgresql | tail -1 sudo -u postgres psql -tAc 'SHOW data_directory;'

The data directory reports a path under /var/lib/postgresql.

Replacing the self-signed certificate

The image ships a self-signed certificate so that the appliance is reachable over HTTPS immediately. For production, replace it with a trusted certificate. Once you have a DNS name that points at the VM, set Zulip's EXTERNAL_HOST to that name and use Zulip's built-in Certbot integration:

sudo sed -i 's/^EXTERNAL_HOST = .*/EXTERNAL_HOST = "your-domain.example.com"/' /etc/zulip/settings.py
sudo /home/zulip/deployments/current/scripts/setup/setup-certbot your-domain.example.com --email admin@your-domain.example.com
sudo /home/zulip/deployments/current/scripts/restart-server

setup-certbot obtains a Let's Encrypt certificate, installs it into Zulip's nginx and sets up automatic renewal.

Maintenance

Zulip ships new releases periodically. To upgrade, follow the official Zulip upgrade procedure with the management scripts that ship with the deployment:

sudo /home/zulip/deployments/current/scripts/upgrade-zulip-from-git main

The OS continues to receive unattended security updates. The PostgreSQL message database persists on the dedicated data disk across reboots and upgrades.

Support

SecureAnyCloud maintains this image and provides 24/7 support. For help with this image, contact sales@secureanycloud.com.

Zulip is open source software licensed under the Apache License 2.0. "Zulip" is a trademark of Kandra Labs, Inc. SecureAnyCloud is not affiliated with or endorsed by Kandra Labs.

Deploy on Azure

Launch Zulip on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure