Visit Azul.com Support

Installing Azul Intelligence On-Premises

Table of Contents
Need help?
Schedule a consultation with an Azul performance expert.
Contact Us

The installation ships as one jar bundle that runs on the Java of your host and is started by systemd. Work through the steps below in order. Check Requirements first: the host needs Linux with Java 21 or newer on the PATH, and Java 25 is recommended.

Downloading the Bundle

Download ljvmi-1.0.0-<sha>-jar.tar.gz together with its .sha256 file. The <sha> is the short commit identifier of the build. The bundle needs no network access to install, because it never pulls anything.

Each release also comes with two Software Bills of Materials (SBOMs) in CycloneDX format, published next to the bundle rather than inside it: ljvmi-1.0.0-<sha>-server.cdx.json for the application and ljvmi-1.0.0-<sha>-client.cdx.json for the web interface. They list the third-party components that the release contains, so you can scan them without extracting the bundle.

Verifying the Download

Every bundle comes with a SHA-256 checksum file for the archive. Verify the archive before you extract it:

 
sha256sum -c ljvmi-1.0.0--jar.tar.gz.sha256

The bundle itself contains CHECKSUMS.txt with a SHA-256 checksum for every other file in it. After you extract the bundle, run sha256sum -c --quiet CHECKSUMS.txt from inside its directory to check them.

What the Bundle Contains

 
ljvmi-1.0.0--jar/
├── lib/
├── app/
├── quarkus/
├── quarkus-run.jar
├── run.sh
├── ljvmi.env.example
├── VERSION
├── CHECKSUMS.txt
├── DEPLOY.md
├── AGENTS.md
└── CLAUDE.md

run.sh starts the application on the Java of the host. ljvmi.env.example is the example configuration, and VERSION records the version and the build stamp. DEPLOY.md is a deployment guide that ships with every release. AGENTS.md and CLAUDE.md point AI coding assistants to that guide.

Running the Installation

  1. Verify the archive, then extract it to /opt/ljvmi:

     
    sha256sum -c ljvmi-1.0.0--jar.tar.gz.sha256
sudo mkdir -p /opt/ljvmi
sudo tar -xzf ljvmi-1.0.0--jar.tar.gz -C /opt/ljvmi

  2. Check the extracted files from inside the release directory:

     
    cd /opt/ljvmi/ljvmi-1.0.0--jar
sha256sum -c --quiet CHECKSUMS.txt

  3. Point the current symlink at the release directory. The service always starts current, which is what makes an upgrade a matter of switching the link:

     
    sudo ln -sfn /opt/ljvmi/ljvmi-1.0.0--jar /opt/ljvmi/current

  4. Create a system user for the service, and the inbox directory owned by it. The application creates db/, events/ and vuln-data/ itself.

     
    sudo useradd --system --home-dir /var/lib/ljvmi --shell /usr/sbin/nologin ljvmi
sudo install -d -o ljvmi -g ljvmi /var/lib/ljvmi /var/lib/ljvmi/inbox

  5. Install the example configuration as /etc/ljvmi/ljvmi.env, readable by root only, and edit it for your host:

     
    sudo install -d /etc/ljvmi
sudo install -m 600 /opt/ljvmi/current/ljvmi.env.example /etc/ljvmi/ljvmi.env

    Generate SESSION_SECRET and FORWARDER_KEY_SECRET once, with openssl rand -base64 48 for each, and put the values in the file. Add LJVMI_WEB_PUBLIC_BASE_URL, set to the address people use to reach the installation, because links in invitation and password-reset messages are built from it. The example lists it commented out, and the application starts without it, but self-service password reset stays off until it is set. Set APP_DB_PATH, EVENTS_DB_PATH, INBOX_DIR and VULN_DATA_DIR as in the example, under /var/lib/ljvmi. See Configuration Options for every setting.

    Important
    		 Never change SESSION_SECRET or FORWARDER_KEY_SECRET after the first start. A new FORWARDER_KEY_SECRET makes every stored Forwarder key unreadable.

  6. In the same file, choose how the installation serves HTTPS. HTTPS is required: with neither of the two choices below, the application refuses to start and names both settings.

    • Direct TLS, the recommended setup. Set TLS_KEYSTORE_FILE and TLS_KEYSTORE_PASSWORD to a JKS or PKCS12 keystore with your certificate and its private key. The installation then serves HTTPS on HTTPS_PORT, 8443 by default, and the plain port redirects there. Keep the keystore outside the release directory and outside /var/lib/ljvmi, and make it readable by the ljvmi user. A PEM certificate and key convert with openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out ljvmi.p12.

    • TLS terminated by your reverse proxy. Set ALLOW_PLAIN_HTTP=true, so that the application serves plain HTTP on PORT behind the proxy, and set COOKIE_SECURE=true when browsers reach the proxy over HTTPS. The application logs a warning about plain HTTP at every start.

      The installation issues no certificate of its own. Use one from your internal CA, trusted by your browsers and by the Java runtime of every Forwarder host. See HTTPS and Sessions.

  7. Create the systemd unit /etc/systemd/system/ljvmi.service:

     
    [Unit]
Description=Azul Intelligence On-Premises
After=network.target

[Service]
User=ljvmi
EnvironmentFile=/etc/ljvmi/ljvmi.env
ExecStart=/opt/ljvmi/current/run.sh
TimeoutStopSec=60
Restart=on-failure

[Install]
WantedBy=multi-user.target

    run.sh does not read the configuration file itself. systemd passes it to the process through EnvironmentFile=. run.sh refuses to start without the three data paths, and with an empty or placeholder secret. The application itself refuses to start without a keystore or ALLOW_PLAIN_HTTP=true. Either way, a missing setting stops the service at once with a message instead of running with a broken configuration.

  8. Start the service and let it start at every boot:

     
    sudo systemctl enable --now ljvmi

  9. Sign in with the generated password of the first Admin account. It is in the file .initial-admin-password in the directory of APP_DB_PATH, for example /var/lib/ljvmi/db/.initial-admin-password. Your first sign-in requires you to change that password before anything else. The file is deleted once you do.

    With direct TLS, the address is https://<your-host>:8443 with the default port, and http://<your-host>:5173 redirects there. Behind your reverse proxy, use the address the proxy serves.

Stop the service with sudo systemctl stop ljvmi, which sends SIGTERM and gives the application time to finish its work. Never stop it with kill -9, because that can lose the last commits of the application database.

Next Steps

  1. Review the configuration options.

  2. Register a Forwarder and connect your data sources so JVM data starts flowing.

  3. Configure an email provider, if you want invitations and notices to arrive automatically. A deployment without one stays fully functional.

  4. Load a vulnerability dataset, so that Security Exposure has data to judge your installations against.

  5. Invite the rest of your team, and add a second Admin.

  6. Plan your backups before the first data arrives.

Once data arrives, The Web Interface is the tour.