RabbitMQ - Hardened Open-Source Message Broker

What is RabbitMQ

RabbitMQ is an open-source message broker implemented in Erlang/OTP, one of the most widely deployed brokers for the AMQP 0-9-1 protocol, with STOMP, MQTT and WebSocket support via plugins. It routes messages between producers and consumers through exchanges, queues and bindings, supporting work queues, publish/subscribe, routing, topics and request/reply. Durable queues, publisher confirms, consumer acknowledgements, dead-lettering, TTLs and quorum queues provide replicated, fault-tolerant delivery. A bundled web management UI gives queue, exchange, connection and user administration plus live metrics over an HTTP API. This image runs a single node on Erlang/OTP 27. MPL-2.0 license, fully auditable, no vendor lock-in.

Why self-host RabbitMQ

Running RabbitMQ on a VM you control keeps every message - which often carries sensitive customer, transactional or operational data - inside your own tenant rather than a managed queue service. Self-hosting suits teams with data residency requirements, organisations operating under GDPR, HIPAA or ISO 27001, and any product where the message bus must stay within your own perimeter with no per-message fees. RabbitMQ is MPL-2.0, fully auditable, with no vendor lock-in.

What this VM image adds

Security hardening:

• Unique admin user (administrator tag) generated per instance at first boot, stored in /root/rabbitmq-credentials.txt (mode 0600) - the default guest/guest account is deleted
• Per-instance Erlang cookie generated at first boot - not a shared baked-in secret
• Management UI bound to 127.0.0.1 only behind an nginx TLS reverse proxy on 443; RabbitMQ enforces its own login
• Native AMQPS (TLS) on 5671 with a per-instance self-signed certificate; plaintext AMQP on 5672
• Self-signed TLS certificate generated at first boot and replaceable with your own CA-signed certificate (certbot is pre-installed)
• CVE scan - every image is scanned with Trivy before release
• UFW firewall - TCP 22 (SSH), 443 (management UI), 5672 (AMQP), 5671 (AMQPS) only; all other inbound dropped
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access, PermitRootLogin no, LoginGraceTime 60
• Kernel hardening - SYN cookies, ASLR, rp_filter, kexec disabled, IPv6 off
• /tmp as tmpfs - nosuid, nodev, noexec
• Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json with RabbitMQ pinned by version, PURL, MPL-2.0 license, supplier and hash
• CIS Conformance Report at /etc/lynxroute/cis-report.html (OpenSCAP, Azure tailoring profile, 0 FAIL rules)
• Tailored CIS profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Operator credentials file at /root/rabbitmq-credentials.txt (mode 0600) with the admin username, password and the management UI HTTPS URL

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 recommended)
2. Open NSG: TCP 443 from your trusted sources, TCP 5672/5671 from your app clients, TCP 22 from your management IPs only
3. SSH: ssh -i key.pem azureuser@<PUBLIC_IP>, then sudo cat /root/rabbitmq-credentials.txt for the admin password
4. Open https://<PUBLIC_IP>/ in your browser, accept the self-signed certificate warning, and log in to the management UI with the admin credential
5. Connect AMQP clients with the same credential: amqp://admin:<password>@<PUBLIC_IP>:5672/ or amqps://admin:<password>@<PUBLIC_IP>:5671/ (TLS)

The management UI listens on 127.0.0.1:15672 only; nginx is the TLS perimeter on 443 - do not expose 15672 directly. Replace the self-signed certificate with a CA-signed one for production, then run sudo systemctl reload nginx.