> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/getting-started/deployment-guide/deploying-on-azure-private-cloud.md).

# Deploying on azure private cloud

The Azure deployment is two virtual machines in a single virtual network, administered through Azure Bastion or a jump host. End users reach the portal over your private network. No public IP addresses are required on either workload VM.

## What you provide

* An Azure subscription with sufficient compute, storage and networking quota.
* A dedicated resource group for the deployment.
* A target region within India — for example Central India, South India or West India.
* RBAC permissions for the eMudhra deployment team on that resource group, scoped to virtual machines, virtual networks, network security groups and managed disks, for the duration of the engagement.

## Virtual machine sizing

Both the application and database servers use the same shape:

|                  | Specification                                                       |
| ---------------- | ------------------------------------------------------------------- |
| VM SKU           | Standard\_D8s\_v5 recommended; Standard\_F8s\_v2 minimum            |
| Processor        | 8 vCPU                                                              |
| RAM              | 16 GB minimum                                                       |
| Disk             | 256 GB Premium SSD managed disk (P15)                               |
| Operating system | Windows Server 2019 or later, or RHEL 9, from the Azure Marketplace |

The application server runs JDK 21 — Eclipse Temurin, Oracle JDK, or any other JDK 21 build — with Apache Tomcat 10. The database server runs PostgreSQL 16, self-managed on the VM.

## Network security group rules

| Target                      | Rule                                                                                  |
| --------------------------- | ------------------------------------------------------------------------------------- |
| Application server, inbound | HTTPS (TCP 443) from the authorised end-user network                                  |
| Application server, inbound | RDP (TCP 3389) or SSH (TCP 22) from the Bastion or jump host only                     |
| Database server, inbound    | PostgreSQL (TCP 5432) from the application server only                                |
| Database server, inbound    | RDP (TCP 3389) or SSH (TCP 22) from the Bastion or jump host only                     |
| Both, outbound              | HTTPS (TCP 443) for OS updates, subscription activation, and Java and Tomcat packages |

In an air-gapped environment, substitute equivalent access to internal repositories for the outbound rule.

## DNS, certificates and time

Provide an Azure Private DNS zone or integration with your internal DNS, and allocate an FQDN for the portal endpoint. Azure Key Vault is recommended, though not required, for storing the certificate and its private key. Azure host-provided time synchronisation is acceptable.

## Backup

Backup is not a mandatory prerequisite for a proof of concept. If you intend to keep the environment for an extended evaluation, enable Azure Backup on both VMs under your standard policy.