VictoriaMetrics - Hardened Time-Series Database

What is VictoriaMetrics

VictoriaMetrics is a Go-based, single-binary time-series database and monitoring solution designed for high performance and low resource usage. It speaks the Prometheus ecosystem natively: ingest metrics via Prometheus remote_write, the InfluxDB line protocol, Graphite, OpenTSDB, CSV, or its JSON import API, and query them back with PromQL or the more expressive MetricsQL through a Prometheus-compatible HTTP API. A built-in web UI (vmui) lets you explore and graph metrics straight from the browser. This is the single-node community edition (Apache-2.0): one self-contained process that stores samples in its own on-disk TSDB, so there is nothing else to operate. Data is kept with a 12-month retention window by default on a dedicated data path.

Why self-host VictoriaMetrics

Running VictoriaMetrics on a VM you control keeps every metric - which often reveals infrastructure topology, traffic patterns and capacity - inside your own tenant rather than a third-party observability service. Self-hosting suits teams with data residency requirements, organisations operating under GDPR or ISO 27001, and any architecture where a long-retention metrics store must sit next to the workloads it monitors with no per-sample fees. The community edition is Apache-2.0, fully auditable, with no vendor lock-in.

What this VM image adds

Security hardening:

• Database bound to localhost only - VictoriaMetrics (port 8428) listens on 127.0.0.1 and is never exposed directly
• Nginx TLS reverse proxy on port 443 - the HTTP API and vmui are reached only through Nginx, never the raw database port
• HTTP Basic Auth perimeter - a unique credential is generated per instance at first boot and stored in /root/victoriametrics-credentials.txt (single-node VictoriaMetrics has no built-in authentication)
• Community single-node build only - the enterprise build is never downloaded or shipped, verified by a build-time assertion
• certbot and the Nginx plugin pre-installed - one-command CA-signed HTTPS to replace the self-signed certificate
• UFW firewall - SSH on 22, plus 80 and 443 only; Azure IMDS and WireServer egress pre-configured
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control
• CVE scan - every image is scanned with Trivy before release

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd for system call auditing of critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access, PermitRootLogin no, LoginGraceTime 60
• Kernel hardening - SYN cookies, ASLR, rp_filter, kexec disabled, IPv6 off
• /tmp as tmpfs with nosuid, nodev, noexec

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json with VictoriaMetrics pinned by version, PURL, Apache-2.0 license, supplier, and SHA-256 hash of the binary
• CIS Conformance Report at /etc/lynxroute/cis-report.html (OpenSCAP, Azure tailoring profile, 0 FAIL rules)
• Tailored CIS profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Basic Auth credentials file at /root/victoriametrics-credentials.txt with the admin username and password

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 recommended)
2. SSH: ssh -i key.pem azureuser@<PUBLIC_IP>, then sudo cat /root/victoriametrics-credentials.txt for the admin Basic Auth password
3. Open NSG: TCP 443 and TCP 80 from your trusted sources, TCP 22 from your management IPs only
4. Open https://<PUBLIC_IP>/vmui/ in your browser, accept the self-signed certificate warning, and authenticate as admin
5. Send metrics with Prometheus remote_write to https://<PUBLIC_IP>/api/v1/write, then query them at https://<PUBLIC_IP>/api/v1/query?query=up

Single-node VictoriaMetrics has no built-in authentication; the Nginx HTTP Basic Auth credential (user admin) protects the entire HTTP API and vmui. The database listens on localhost only and is reached through Nginx on port 443.