Apache CouchDB - Hardened Self-Hosted NoSQL Document Databas

What is Apache CouchDB

Apache CouchDB is an open-source, document-oriented NoSQL database written in Erlang/OTP that stores schema-free JSON documents and exposes everything over a native HTTP/JSON REST API. It uses an append-only, crash-resilient storage engine with MVCC (no read locking), secondary indexes through JavaScript MapReduce views and the Mango declarative query language, a real-time changes feed, document attachments, and the built-in Fauxton web administration UI. Its standout feature is incremental, bidirectional replication: CouchDB syncs reliably between servers and with offline-first clients (PouchDB in the browser, Couchbase Lite on mobile), making it a natural fit for edge, mobile, and multi-region data. This image runs CouchDB in single-node mode with the system databases created automatically.

Why self-host Apache CouchDB

Running CouchDB on a VM you control keeps your documents - which often carry user records, application state, and business data - inside your own tenant rather than a managed third-party database. Self-hosting suits teams with data residency requirements, organisations operating under GDPR or ISO 27001, and any architecture where a syncing document store must sit next to the workloads and offline-first clients it serves. Apache CouchDB is Apache-2.0, fully auditable, with no vendor lock-in.

What this VM image adds

Security hardening:

• Random administrator password generated at first launch - no "admin party", no default credentials; saved to /root/couchdb-credentials.txt
• Native TLS: HTTPS on port 6984 with a self-signed certificate generated at first launch, replaceable with your own CA-signed certificate
• Anonymous access refused by default - databases are admin-only until you grant access (default_security = admin_only)
• Plain HTTP (5984) bound to the host and firewalled - only HTTPS 6984 is exposed
• UFW firewall - SSH on 22 and CouchDB HTTPS on 6984 only; Azure IMDS and WireServer egress pre-configured
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control
• CVE scan - every image is scanned with Trivy before release

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd for system call auditing of critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access, PermitRootLogin no, LoginGraceTime 60
• Kernel hardening - SYN cookies, ASLR, rp_filter, kexec disabled, IPv6 off
• /tmp as tmpfs with nosuid, nodev, noexec

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json with CouchDB pinned by version, PURL, Apache-2.0 license, supplier, and SHA-256 hash
• CIS Conformance Report at /etc/lynxroute/cis-report.html (OpenSCAP, Azure tailoring profile, 0 FAIL rules)
• Tailored CIS profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Admin credentials file at /root/couchdb-credentials.txt with the administrator username and password

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 recommended)
2. SSH: ssh -i key.pem azureuser@<PUBLIC_IP>, then sudo cat /root/couchdb-credentials.txt for the admin password
3. Open NSG: TCP 6984 from your trusted sources, TCP 22 from your management IPs only
4. Open https://<PUBLIC_IP>:6984/_utils in your browser, accept the self-signed certificate warning, and log in with the admin credentials to reach the Fauxton UI
5. Or use the REST API: curl -k -u admin:<password> https://<PUBLIC_IP>:6984/_all_dbs

CouchDB serves its HTTP API and Fauxton over native TLS on port 6984; plain HTTP on 5984 is bound to the host and blocked by the firewall. Replace the self-signed certificate under /opt/couchdb/etc/cert/ with a CA-signed certificate for production, then run sudo systemctl restart couchdb.