Appsmith - Hardened Low-Code Internal Tools Platform

What is Appsmith

Appsmith Community Edition is an open-source low-code platform for building internal tools - admin panels, dashboards, CRUD apps, support consoles and approval workflows - without writing front-end code. You drag and drop from 45+ pre-built UI widgets (tables, forms, charts, lists, modals), bind them to data with a visual query editor, and add logic in plain JavaScript anywhere a value is accepted. It ships as a single all-in-one stack: a Java application server with an embedded MongoDB metadata store, PostgreSQL and Redis, fronted by a Caddy reverse proxy. Appsmith connects to 25+ data sources including PostgreSQL, MySQL, Microsoft SQL Server, MongoDB, Snowflake, Redis, REST APIs and GraphQL. Apache-2.0 license - the community binary is the production binary, fully auditable, no vendor lock-in.

Why self-host Appsmith

Running a low-code platform on a VM you control keeps your apps, queries, connection credentials and the data they touch inside your own tenant rather than a managed builder service - fitting data residency requirements and GDPR, HIPAA or ISO 27001 obligations, with no per-seat or per-app fees. Apache-2.0, fully auditable, no vendor lock-in.

What this VM image adds

Security hardening:

• Per-instance secrets - the encryption keys and the embedded MongoDB, PostgreSQL and Redis passwords are generated uniquely at first boot, never baked into the image
• No administrator account baked in - the first user to register becomes the Instance Administrator; restrict access to port 443 to your own IP until you have registered so that only you can claim it. After the first admin registers, the self-signup option is removed from the sign-in screen
• HTTPS on by default - the in-container Caddy reverse proxy serves a self-signed certificate on 443 at first boot; set a custom domain to switch to a built-in Let's Encrypt certificate
• Embedded datastores bound to localhost inside the container - MongoDB, PostgreSQL and Redis are never exposed on the network
• Anonymous usage telemetry disabled - nothing phones home on boot
• UFW firewall - only TCP 22, 80 and 443 are reachable; all other inbound dropped
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control
• CVE scan - every image is scanned with Trivy before release

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd for system call auditing of critical paths
• SSH hardening - key-only access, PermitRootLogin no, LoginGraceTime 60
• Kernel hardening - SYN cookies, ASLR, rp_filter, IPv6 off
• /tmp as tmpfs with nosuid, nodev, noexec

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json with Appsmith pinned by version, PURL, license and hash
• CIS Conformance Report at /etc/lynxroute/cis-report.html (OpenSCAP, Azure tailoring profile, 0 FAIL rules)
• Tailored CIS profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Operator notes file at /root/appsmith-credentials.txt (mode 0600) with the registration guidance and access URLs

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 recommended - the Java server plus embedded MongoDB, PostgreSQL and Redis need 8 GB RAM)
2. Open NSG: TCP 443 from your own IP only (keep it restricted until you have registered), TCP 22 from your management IPs
3. SSH: ssh -i key.pem azureuser@<PUBLIC_IP>, then sudo cat /root/appsmith-credentials.txt for the registration notes
4. Open https://<PUBLIC_IP>/ in your browser and accept the self-signed certificate warning - the FIRST account you create on the welcome screen becomes the Instance Administrator
5. Build your first app: add a datasource (PostgreSQL, MySQL, MongoDB, REST, GraphQL and more), write a query, and bind it to drag-and-drop UI widgets

First boot takes a few minutes while the platform initializes its embedded databases; a loading page is shown until it is ready. Restrict NSG 443 to your own IP until you have registered so that only you can claim the administrator account; the self-signup option is removed from the sign-in screen after the first admin registers. For a CA-signed certificate, set APPSMITH_CUSTOM_DOMAIN to your domain in /etc/appsmith/appsmith.env to enable the built-in Let's Encrypt integration, then restart with sudo systemctl restart appsmith.