Skip to content
broch
get started →

Azure CLI

Deploy the Broch appliance into your own Azure subscription with the Azure CLI. It’s the same appliance as the Azure Marketplace listing, deployed from the Bicep template in broch-io/broch-deploy.

Before You Deploy

Section titled “Before You Deploy”
  • The Azure CLI, signed in to your subscription, with Contributor on the resource group you deploy into. Azure DNS with a managed identity also needs Owner or User Access Administrator on the zone’s resource group, because the template grants that identity a DNS role. With only Contributor, use dnsProvider=AzureDnsServicePrincipal.
  • A DNS zone you control on Azure DNS, Cloudflare, Route 53, DigitalOcean or Google Cloud DNS (experimental). An Azure DNS zone must be in the subscription you deploy into. Broch serves broch.{your-domain} and every tunnel URL under *.broch.{your-domain}, with a certificate it issues and renews itself. Or bring your own certificate covering both names; renewing it is then up to you.
  • An identity provider app: a web (confidential) client with the redirect URI https://broch.{your-domain}/auth/callback. Note its client ID and secret, a role your first admin holds, and your provider’s own values: domain (Auth0, Okta), API Identifier (Auth0), tenant ID (Entra ID) or issuer URL (generic OIDC). See Auth0, Entra ID, Okta or Generic OIDC.
  • A master key: openssl rand -base64 48. Keep it in your own secret store and supply the same value on every redeploy.
  • An email address for your Let’s Encrypt account (acmeEmail), required even with your own certificate.
  • Connecting to your own PostgreSQL (databaseMode=Existing)? Create its database and least-privilege role first, as in the template’s Database setup.

Deploy

Section titled “Deploy”

  1. Get the template.

    Terminal window
    git clone https://github.com/broch-io/broch-deploy.git
    cd broch-deploy/bicep/azure-vm

  2. Fill in the parameters. Copy the example parameters file and set your domain, database, DNS provider and identity provider. Its comments and the template’s README explain each choice. DNS A records are automatic by default; add param dnsAutoRecords = 'Manual' only when a load balancer or NAT sits in front of the VM, or you manage DNS yourself. Leave the secrets as placeholders: the master key and every value marked prefer --parameters get their real values on the command line in step 3.

    Terminal window
    cp main.example.bicepparam main.bicepparam
    $EDITOR main.bicepparam

  3. Deploy, passing the secrets on the command line. The master key and client secret are always needed. The other two suit the example’s existing database and Cloudflare DNS; swap in the secrets your choices need. Each read takes a pasted value without showing it or saving it in your shell history. The template refuses any value that contains a single quote or a line break, or ends with a backslash; wrap a connection-string password containing ; in double quotes (Password="a;b").

    Terminal window
    az login
    az account set --subscription <subscription-id>
    az group create --name broch-rg --location eastus
    

    read -rs BROCH_MASTER_KEY
    read -rs AUTH_CLIENT_SECRET
    read -rs DATABASE_CONNECTION_STRING
    read -rs CLOUDFLARE_API_TOKEN
    

    az deployment group create \
      --resource-group broch-rg \
      --template-file main.bicep \
      --parameters main.bicepparam \
      --parameters \
          brochMasterKey="$BROCH_MASTER_KEY" \
          authClientSecret="$AUTH_CLIENT_SECRET" \
          databaseConnectionString="$DATABASE_CONNECTION_STRING" \
          cloudflareApiToken="$CLOUDFLARE_API_TOKEN"

First boot takes 3–10 minutes.

After It Deploys

Section titled “After It Deploys”

  1. Find the public IP:

    Terminal window
    az deployment group show -g broch-rg -n main \
      --query properties.outputs.publicIpAddress.value -o tsv

  2. Open the database firewall if you used Existing: allow the public IP through it.

  3. Check DNS. The appliance creates and maintains the A records for broch.{your-domain} and *.broch.{your-domain}, pointing at the public IP. With dnsAutoRecords=Manual or your own certificate (certMode=Byo), it creates none; add them yourself, DNS-only rather than proxied:

    A   broch.{your-domain}     → <public-ip>
    A   *.broch.{your-domain}   → <public-ip>

    Check that both names resolve to the public IP (test stands in for any tunnel name):

    Terminal window
    nslookup broch.{your-domain}
    nslookup test.broch.{your-domain}

    The server is ready when https://broch.{your-domain}/healthz returns 200.

  4. Sign in at https://broch.{your-domain} with an account holding an admin role. Setup offers the free trial or a purchase. The trial is free until the 1st of the month, at least 15 days, with a card upfront, first charged on that 1st. There’s no license key to get beforehand. See Licensing & Billing.

  5. Grant access. Share is deny-by-default: add a Share Policy for your developers’ IdP role.

  6. Invite developers. Send them Sharing Local Services to install the CLI and open their first tunnel.

What You Get

Section titled “What You Get”
  • The Broch appliance on one VM, in the resource group you created. Architecture describes how it fits together.
  • A static public IP, with ports 80 and 443 open and SSH closed.
  • PostgreSQL in the mode you chose.
  • Key Vaults for the deploy-time secrets and, unless you added an SSH key, the break-glass password.
  • A data disk holding the certificate store and, with databaseMode=Local, the database.
  • A wildcard certificate, issued and renewed automatically unless you brought your own.
  • No charge from Broch to deploy; your cloud provider bills the VM and database. After the trial, Broch Share is priced per active user (pricing).

Upgrades, secret rotation, backup and teardown: Operating the Appliance.

Next: Share Policies.

PrivacyTerms