temBoard on Ubuntu 24.04 by cloudimg

temBoard on Ubuntu 24.04 by cloudimg

temBoard is Dalibo's PostgreSQL monitoring and remote administration console. Most monitoring tools stop at drawing charts; temBoard also acts on your databases. From the browser you can watch live sessions and terminate the one that is blocking everything, edit postgresql.conf and reload the cluster, schedule VACUUM and ANALYZE, and read query performance straight from pg_stat_statements. This image ships the complete appliance on a single virtual machine: the temBoard 10.0.0 server, a PostgreSQL 16 repository database, and a temBoard agent installed beside that database.

It manages a real database from the first boot. The bundled PostgreSQL instance is registered as temBoard's first managed instance automatically, so the console begins collecting real metrics the moment the machine boots. Sign in a few minutes later and the dashboard already shows live gauges for CPU, memory, cache hit ratio and sessions, with load average and transactions per second charting alongside a full alerting status grid. There is nothing to configure to see the product working, and no external database is required.

Monitoring and administration in one console. The Monitoring tab plots historical metrics across load, CPU, memory, sessions, transactions, locks, replication lag, WAL volume, database and table sizes, and bloat estimates. The Activity tab lists running, waiting and blocking backends with per session CPU, memory and I/O, and lets you terminate any of them. The Configuration tab reads and writes the managed instance's settings, grouped by category and searchable, flagging which changes need a reload and which need a restart. Maintenance schedules VACUUM, ANALYZE and REINDEX per table or per database. Statements surfaces the slowest and most frequent queries. Alerting ships with sensible checks and records who performed each administrative action.

Manage your whole estate. Install a temBoard agent beside each PostgreSQL server you run, fetch the console's signing key, and register it. Instances are grouped into environments so teams see only what they should. The server to agent channel is authenticated with an RSA signing key pair unique to your console, so an agent only accepts instructions from the temBoard that owns it.

Secure by default. temBoard is remote administration software, so this image treats it as a privileged control plane rather than another web app. The web console on port 8888 is the only listener reachable from the network. The agent, which is the component that actually executes administration against PostgreSQL, is bound to loopback and additionally fenced at the kernel level with systemd address filtering, so it cannot be reached from off the machine at all. The repository database is bound to loopback and fenced the same way.

On every fresh virtual machine a first boot service generates a unique administrator password, a unique repository password, a fresh session signing secret, a new server to agent RSA key pair and a new TLS certificate before the console ever starts. temBoard's documented default admin login is replaced and rejected, no credential is baked into the image, and a fail closed guard refuses to open the public listener if any secret still matches a published upstream default. Credentials are written to a root only file. The image also ships an end to end self test that generates real database activity, proves monitoring data is accumulating live, and terminates a backend through the console to prove administration works.

Sizing. Standard_B2s comfortably runs the console, the repository and the bundled agent. Move to Standard_D2s_v5 or larger as you register more instances or extend retention. Metrics are retained for ninety days by default and log rotation is configured, so the disk cannot fill unattended.

Licensing. temBoard is distributed under the PostgreSQL Licence, a permissive BSD style licence, and PostgreSQL uses the PostgreSQL Licence. There is no per seat, per server or per site fee. The cloudimg charge of 0.04 US dollars per vCPU hour covers packaging, security patching, image maintenance and 24/7 expert support.

Prerequisites. An Azure subscription, a virtual network and an SSH key. The network security group should permit port 22 for administration and port 8888 for the console, restricted to your own address ranges. The console serves a self signed certificate generated on first boot; put a trusted certificate in front before exposing it publicly.