Deploy on Azure

Loams on Azure today is one Azure VM running the 0.1.4 compose stack, reached only over your own Tailscale tailnet. For production, the same VM keeps the engine's data in a Blob Storage container in your subscription. A cloud-init file, a guide and an OpenTofu module for the VM are Experimental on the dev branch; Container Apps and AKS are planned; the overview compares the clouds.

Read Self-hosting over Tailscale steps 1 to 4 first: create the tailnet, turn on MagicDNS and HTTPS certificates, add the tag:loams policy, and create an auth key. This page does not repeat them.

Development (VM)Copy Anchor Link

Available The light default stack on one Azure VM.

1. Create the VMCopy Anchor Link

Ubuntu 24.04 ships a 6.8 kernel. Loams House needs Linux 6.7 or later for its workers' Landlock rules.

The VM needs a public IP or a NAT gateway for outbound traffic only: to pull images, download the bundle and reach Tailscale's coordination servers. Nothing listens on that address.

2. Run commands without opening a portCopy Anchor Link

With no inbound port, use the portal's Serial console, Azure Bastion, or Run command. For the first step only, Run command from your machine is enough:

az vm run-command invoke --resource-group my-rg --name my-loams-vm \
  --command-id RunShellScript \
  --scripts "curl -fsSL https://tailscale.com/install.sh | sh && tailscale up --ssh --authkey tskey-auth-…"

That puts the VM itself on your tailnet, so you can SSH to it there for the rest. Use a separate single-use auth key for the host, not the stack's tag:loams key, and treat the command's record as holding it.

3. Install DockerCopy Anchor Link

Over SSH on the tailnet:

curl -fsSL https://get.docker.com | sudo sh        # Docker Engine with the Compose plugin
sudo usermod -aG docker "$USER"                    # then open a new shell

The stack does not need Tailscale on the host. Its own tailscale sidecar container joins the tailnet as loams. The host client is only your way in.

4. Download the bundle, verify it, start the stackCopy Anchor Link

base=https://github.com/ostrium-labs/loams/releases/download/v0.1.4
curl -fLO $base/loams-compose-0.1.4.tar.gz -fLO $base/SHA256SUMS -fLO $base/SHA256SUMS.asc

# the release signing keys; the signature must come from one of these fingerprints:
# 29C5 CC3F 0FD6 6A2A D32E CB30 9E8E C3E0 AAB5 BA68  (current: 0.1.2's SHA256SUMS.asc and later releases)
# 333A C945 99D5 A1EB 2A41 6D1E 83DC 134D 8CAF 895D  (previous: 0.1.0, 0.1.1, 0.1.2's package and desktop signatures)
curl -fsSL https://loams.dev/gpg.asc | gpg --import
gpg --verify SHA256SUMS.asc SHA256SUMS            # "Good signature from Loams Release Signing Key"
sha256sum --ignore-missing -c SHA256SUMS          # loams-compose-0.1.4.tar.gz: OK

tar -xzf loams-compose-0.1.4.tar.gz
cd loams-compose-0.1.4/release
cp .env.example .env

Edit .env:

TS_AUTHKEY=tskey-auth-…                          # tagged tag:loams
LOAMS_TAILSCALE_ALLOWED_USERS=you@example.com
LOAMS_SETUP_TOKEN=                               # the output of: openssl rand -hex 32
# COMPOSE_PROFILES=tikv                          # only on a B2ms, before the first start

Then:

docker compose up -d
docker compose ps                                # every service running
docker compose exec tailscale tailscale status   # the stack is on your tailnet

Or from your own machine, once the VM is on your tailnet: unpack the same bundle locally and run the installer over SSH. It installs Docker if missing, copies the bundle to ~/loams, writes .env with mode 0600, generates LOAMS_SETUP_TOKEN and starts the stack.

cd loams-compose-0.1.4
release/byoc/install.sh azureuser@<vm-tailnet-name>          # asks for TS_AUTHKEY
release/byoc/install.sh --tikv azureuser@<vm-tailnet-name>   # with PD, TiKV and TiDB

5. Use itCopy Anchor Link

From a device on the same tailnet, the engine is at https://loams.<tailnet>.ts.net.

• Loams Desktop: add that URL as a server. Get it from the download page.
• The console the engine serves at /ui/: Available in 0.1.4, at https://loams.<tailnet>.ts.net/ui/, same-origin with the API.
• Run first-run setup once, with the setup token, as in Self-hosting step 7.

Free tier and creditsCopy Anchor Link

The free account's 12-month VM allowance covers B1-class sizes with 1 GiB of memory, too little for the stack. New Azure accounts get $200 of credit for the first 30 days, which covers a B2s or a B2ms for that month (verify on Azure free account). A B2s costs about $30 a month on demand (estimate). Deallocate the VM when you are not using it; the disk keeps the data.

To estimate the whole monthly bill on Azure (compute, disk, bucket, requests and egress, from public list prices), use the cost calculator. Loams itself is free.

ProductionCopy Anchor Link

What is supported todayCopy Anchor Link

Available One Azure VM with the engine's bucket on Blob Storage. This is the development VM, sized up and with the bucket moved off the VM:

• Size: Standard_D2s_v5 (2 vCPU, 8 GiB) with a 64 GiB Standard SSD data disk is design 70's small install, about $82 a month with Blob Storage and a public IPv4 (estimate). Standard_B2ms is cheaper for a mostly idle install.
• The bucket: a StorageV2 account with public network access off or limited to the VM's virtual network, blob versioning and soft delete on, and a container for Loams. Blob Storage supports the conditional writes the engine needs.

# .env
LOAMS_BUCKET=az://my-container/loams

# secrets/engine.env (mode 0600)
AZURE_STORAGE_ACCOUNT_NAME=myaccount
AZURE_STORAGE_ACCOUNT_KEY=...

The storage account key is the documented path in 0.1.4. The engine's Azure client also reads a managed identity from the instance metadata service when AZURE_CREDENTIAL_TYPE=managed_identity is set (add AZURE_STORAGE_CLIENT_ID for a user-assigned identity), with no key on disk: that is what the cloud-init file below configures. It is Experimental: confirmed in the code and a unit test, not yet run against a real storage account. Set LOAMS_BUCKET before the first start.

What stays on the VM's disk: the embedded metastore, Live, Durable, and Loams Postgres's pageserver and safekeeper storage. The container holds the engine's data, but the catalog that points into it is on the managed disk. It is one node: there is no replica and no failover.

Loams House runs on chDB today, inside the loams-fabric image, and is experimental. Our own Rust engine for it is designed (design 75), not built.

Create it with cloud-init or OpenTofuCopy Anchor Link

Experimental The v0.1.4 tag of ostrium-labs/loams has the files to create the whole install in your Azure account: deploy/byoc/azure/ (a cloud-init file for Ubuntu 24.04, no inbound rule, no static key: it reads Key Vault with the VM's own identity, checks the release signature and starts the stack), the step-by-step guide and an OpenTofu module (deploy/tofu/modules/azure-vm, example deploy/tofu/examples/azure-vm). The module also creates the storage account (shared keys off), a Key Vault with the key and the managed identities. They are tested without a cloud account (cloud-init schema, local mocks of the secret store, tofu validate, tofu test and tflint). They have not been run on a real Azure account yet, so treat first-boot timing and permission edge cases as unverified. They are in the 0.1.4 release, as a preview.

BackupsCopy Anchor Link

What you can do today:

• Azure Backup or a disk snapshot policy for the VM's disks. For a consistent copy, docker compose stop first, or accept a crash-consistent snapshot.
• Blob versioning and soft delete on the storage account.
• Keep .env and secrets/ somewhere safe; they are not in the volumes.
• loams upgrade takes a snapshot before each upgrade, in a local volume on the VM. It is not an off-machine backup.

Planned loams backup create, writing the same snapshot into your own bucket (design 70, BY1).

NetworkingCopy Anchor Link

• Today: your tailnet only. The network security group allows no inbound traffic; the tailscale sidecar is the stack's only door. Machines on the tailnet, such as CI runners, use an API key.
• Planned Azure workloads off the tailnet, such as Azure Functions, reach the gateway's edge listener behind an internal Standard Load Balancer, or a Private Link service for other virtual networks and subscriptions (design 69). The engine is never public.

IdentityCopy Anchor Link

• Today: one organization per install, created by first-run setup. Sign-in is your Tailscale login (tailscale), an OIDC issuer you choose (oidc), such as your Microsoft Entra tenant, or API keys (apikey). Authorization is coarse.
• Planned Zitadel and OpenFGA (design 76), and a managed-identity token exchanged for a Loams token (design 69).

UpgradesCopy Anchor Link

There are no migrations and no pin changes in 0.1.4. A stack with the tikv profile upgrades in place with release/byoc/upgrade.sh azureuser@<host> --to 0.1.4 or loams upgrade --to 0.1.4 on the VM, which takes a snapshot first. The light default stack is upgraded by hand for now (loams upgrade does not handle it yet): back up the volumes, docker compose stop, set LOAMS_VERSION=0.1.4 in .env, then docker compose up -d. Take compose.yaml and config/ from the 0.1.4 bundle, keep the directory name (it names the volumes), and remove LOAMS_CORS_ORIGINS=https://console.loams.dev from .env.

Planned for AzureCopy Anchor Link