Netdata - Hardened Real-Time Infrastructure Monitoring

What is Netdata

Netdata is a real-time, high-resolution infrastructure monitoring system. The agent auto-discovers and collects thousands of system and application metrics at per-second granularity - CPU, memory, disks, network, processes, containers, web servers, databases and more - stores them in its embedded time-series database, runs unsupervised machine-learning anomaly detection, evaluates health alerts, and serves an interactive live dashboard. It needs no external time-series database or separate query layer to monitor a single host out of the box. This image runs Netdata single-node and standalone.

Why self-host Netdata

Running Netdata on a VM you control keeps every metric - which exposes host topology, capacity, application behaviour and traffic patterns - inside your own tenant rather than a third-party monitoring service. This image is shipped cloud-disconnected: the agent is never claimed to Netdata Cloud and anonymous telemetry is disabled, so all metrics stay in your subscription. Self-hosting suits teams with data residency requirements, organisations under GDPR or ISO 27001, and any architecture where the monitoring agent must sit next to the workloads it observes. The Netdata Agent is GPL-3.0, fully auditable, with no vendor lock-in.

What this VM image adds

Security hardening:

• Dashboard and API bound to localhost only - the Netdata dashboard and API (port 19999) listen on 127.0.0.1 and are never exposed directly
• Nginx TLS reverse proxy on port 443 - the dashboard is reached only through Nginx, never the raw service port
• HTTP Basic Auth perimeter - a unique credential is generated per instance at first boot and stored in /root/netdata-credentials.txt (the Netdata dashboard has no native authentication)
• Shipped cloud-disconnected - the agent is not claimed to Netdata Cloud; anonymous telemetry is disabled and the local registry is turned off (no phone-home)
• Netdata runs as a non-root service with a restricted systemd unit
• certbot and the Nginx plugin pre-installed - one-command CA-signed HTTPS to replace the self-signed certificate
• UFW firewall - SSH on 22, plus 80 and 443 only; Azure IMDS and WireServer egress pre-configured
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control
• CVE scan - every image is scanned with Trivy before release

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd for system call auditing of critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access, PermitRootLogin no, LoginGraceTime 60
• Kernel hardening - SYN cookies, ASLR, rp_filter, kexec disabled, IPv6 off
• /tmp as tmpfs with nosuid, nodev, noexec

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report at /etc/lynxroute/cis-report.html (OpenSCAP, Azure tailoring profile, 0 FAIL rules)
• Tailored CIS profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Basic Auth credentials file at /root/netdata-credentials.txt with the admin username and password

Licensing

The Netdata Agent - metric collection, storage, ML, alerting and APIs - is licensed GPL-3.0. The bundled web dashboard user interface is provided under the Netdata Cloud UI License v1 (NCUL1), which permits free use and redistribution bundled with the agent; it is shipped unmodified.

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 recommended)
2. SSH: ssh -i key.pem azureuser@<PUBLIC_IP>, then sudo cat /root/netdata-credentials.txt for the admin Basic Auth password
3. Open NSG: TCP 443 and TCP 80 from your trusted sources, TCP 22 from your management IPs only
4. Open https://<PUBLIC_IP>/ in your browser, accept the self-signed certificate warning, and sign in as admin - the live dashboard loads with real-time, per-second metrics for this host
5. Replace the self-signed certificate with a CA-signed one: sudo certbot --nginx

The dashboard and API (port 19999) are bound to localhost; Nginx on port 443 is the only exposed door. The image ships cloud-disconnected with anonymous telemetry disabled.