Deploy on Azure

Loams on Azure today is one Azure VM running the 0.1.1 compose stack, reached only over your own Tailscale tailnet. For production, the same VM keeps the engine's data in a Blob Storage container in your subscription. The OpenTofu module, Container Apps and AKS paths are planned; the overview compares the clouds.

Read Self-hosting over Tailscale steps 1 to 4 first: create the tailnet, turn on MagicDNS and HTTPS certificates, add the tag:loams policy, and create an auth key. This page does not repeat them.

Development (VM)Copy Anchor Link

Available The light default stack on one Azure VM.

1. Create the VMCopy Anchor Link

Ubuntu 24.04 ships a 6.8 kernel. Loams House needs Linux 6.7 or later for its workers' Landlock rules.

The VM needs a public IP or a NAT gateway for outbound traffic only: to pull images, download the bundle and reach Tailscale's coordination servers. Nothing listens on that address.

2. Run commands without opening a portCopy Anchor Link

With no inbound port, use the portal's Serial console, Azure Bastion, or Run command. For the first step only, Run command from your machine is enough:

az vm run-command invoke --resource-group my-rg --name my-loams-vm \
  --command-id RunShellScript \
  --scripts "curl -fsSL https://tailscale.com/install.sh | sh && tailscale up --ssh --authkey tskey-auth-…"

That puts the VM itself on your tailnet, so you can SSH to it there for the rest. Use a separate single-use auth key for the host, not the stack's tag:loams key, and treat the command's record as holding it.

3. Install DockerCopy Anchor Link

Over SSH on the tailnet:

curl -fsSL https://get.docker.com | sudo sh        # Docker Engine with the Compose plugin
sudo usermod -aG docker "$USER"                    # then open a new shell

The stack does not need Tailscale on the host. Its own tailscale sidecar container joins the tailnet as loams. The host client is only your way in.

4. Download the bundle, verify it, start the stackCopy Anchor Link

base=https://github.com/ostrium-labs/loams/releases/download/v0.1.1
curl -fLO $base/loams-compose-0.1.1.tar.gz -fLO $base/SHA256SUMS -fLO $base/SHA256SUMS.asc

# the release signing key; check that its fingerprint is
# 333A C945 99D5 A1EB 2A41 6D1E 83DC 134D 8CAF 895D
curl -fsSL https://raw.githubusercontent.com/ostrium-labs/loams/main/docs/release/loams-release-key.asc | gpg --import
gpg --verify SHA256SUMS.asc SHA256SUMS            # "Good signature from Loams Release Signing Key"
sha256sum --ignore-missing -c SHA256SUMS          # loams-compose-0.1.1.tar.gz: OK

tar -xzf loams-compose-0.1.1.tar.gz
cd loams-compose-0.1.1/release
cp .env.example .env

Edit .env:

TS_AUTHKEY=tskey-auth-…                          # tagged tag:loams
LOAMS_TAILSCALE_ALLOWED_USERS=you@example.com
LOAMS_SETUP_TOKEN=                               # the output of: openssl rand -hex 32
# COMPOSE_PROFILES=tikv                          # only on a B2ms, before the first start

Then:

docker compose up -d
docker compose ps                                # every service running
docker compose exec tailscale tailscale status   # the stack is on your tailnet

Or from your own machine, once the VM is on your tailnet: unpack the same bundle locally and run the installer over SSH. It installs Docker if missing, copies the bundle to ~/loams, writes .env with mode 0600, generates LOAMS_SETUP_TOKEN and starts the stack.

cd loams-compose-0.1.1
release/byoc/install.sh azureuser@<vm-tailnet-name>          # asks for TS_AUTHKEY
release/byoc/install.sh --tikv azureuser@<vm-tailnet-name>   # with PD, TiKV and TiDB

5. Use itCopy Anchor Link

From a device on the same tailnet, the engine is at https://loams.<tailnet>.ts.net.

• Loams Desktop, in 0.1.1: add that URL as a server. Get it from the download page.
• The console the engine serves at /ui/: Planned for 0.1.2.
• Run first-run setup once, with the setup token, as in Self-hosting step 7.

Free tier and creditsCopy Anchor Link

The free account's 12-month VM allowance covers B1-class sizes with 1 GiB of memory, too little for the stack. New Azure accounts get $200 of credit for the first 30 days, which covers a B2s or a B2ms for that month (verify on Azure free account). A B2s costs about $30 a month on demand (estimate). Deallocate the VM when you are not using it; the disk keeps the data.

To estimate the whole monthly bill on Azure (compute, disk, bucket, requests and egress, from public list prices), use the cost calculator. Loams itself is free.

ProductionCopy Anchor Link

What is supported todayCopy Anchor Link

Available One Azure VM with the engine's bucket on Blob Storage. This is the development VM, sized up and with the bucket moved off the VM:

• Size: Standard_D2s_v5 (2 vCPU, 8 GiB) with a 64 GiB Standard SSD data disk is design 70's small install, about $82 a month with Blob Storage and a public IPv4 (estimate). Standard_B2ms is cheaper for a mostly idle install.
• The bucket: a StorageV2 account with public network access off or limited to the VM's virtual network, blob versioning and soft delete on, and a container for Loams. Blob Storage supports the conditional writes the engine needs.

# .env
LOAMS_BUCKET=az://my-container/loams

# secrets/engine.env (mode 0600)
AZURE_STORAGE_ACCOUNT_NAME=myaccount
AZURE_STORAGE_ACCOUNT_KEY=...

The storage account key is the documented path in 0.1.1. A managed identity on the VM, with no key on disk, is what design 70 plans; whether 0.1.1's engine picks one up is not documented, so do not rely on it yet. Set LOAMS_BUCKET before the first start.

What stays on the VM's disk: the embedded metastore, Live, Durable, and Loams Postgres's pageserver and safekeeper storage. The container holds the engine's data, but the catalog that points into it is on the managed disk. It is one node: there is no replica and no failover.

Loams House runs on chDB today, inside the loams-fabric image, and is experimental. Our own Rust engine for it is designed (design 75), not built.

BackupsCopy Anchor Link

What you can do today:

• Azure Backup or a disk snapshot policy for the VM's disks. For a consistent copy, docker compose stop first, or accept a crash-consistent snapshot.
• Blob versioning and soft delete on the storage account.
• Keep .env and secrets/ somewhere safe; they are not in the volumes.
• loams upgrade takes a snapshot before each upgrade, in a local volume on the VM. It is not an off-machine backup.

Planned loams backup create, writing the same snapshot into your own bucket (design 70, BY1).

NetworkingCopy Anchor Link

• Today: your tailnet only. The network security group allows no inbound traffic; the tailscale sidecar is the stack's only door. Machines on the tailnet, such as CI runners, use an API key.
• Planned Azure workloads off the tailnet, such as Azure Functions, reach the gateway's edge listener behind an internal Standard Load Balancer, or a Private Link service for other virtual networks and subscriptions (design 69). The engine is never public.

IdentityCopy Anchor Link

• Today: one organization per install, created by first-run setup. Sign-in is your Tailscale login (tailscale), an OIDC issuer you choose (oidc), such as your Microsoft Entra tenant, or API keys (apikey). Authorization is coarse.
• Planned Zitadel and OpenFGA (design 76), and a managed-identity token exchanged for a Loams token (design 69).

UpgradesCopy Anchor Link

0.1.1 changes the default stack; reinstall. Start from the 0.1.1 bundle with a fresh .env. After that, a stack with the tikv profile upgrades in place with release/byoc/upgrade.sh azureuser@<host> --to <version> or loams upgrade on the VM. A stack on the default embedded stores is upgraded by hand for now: back up, docker compose stop, set LOAMS_VERSION, docker compose up -d.

Planned for AzureCopy Anchor Link