Today

1. Sign in to your cloud account.
2. Start Assignment 1. Due 13.09.2026 23:59, submitted on Moodle.

Stuck at any step — that's what we're here for.

Sign-up: Azure for Students — no credit card

https://azure.microsoft.com/free/students → Start free with your @taltech.ee account

Sign-up: AWS Free Tier

https://aws.amazon.com/free/ — card needed for validation; not billed unless you upgrade

Assignment 1 · Hello, cloud — 2 pts

https://<your-domain>/hello → {"student":"<your student code>"}

One VM, set up by hand: nginx serving the JSON · a DNS A record you created · a valid HTTPS certificate. The next slides walk through every step.

Submit on Moodle: the URL + a screenshot of your cloud portal showing the VM.
I request the URL directly — keep the VM running until you see your points (the free tier covers it).

Due 13.09.2026 23:59.

A resource group is a folder for your resources

Everything you create (VM, disk, IP address…) lives in a resource group. Delete the group → everything in it is gone. One group per course keeps cleanup one click.

Portal → search Resource groups → Create

Create the resource group

Subscription Azure for Students · name ITI8801 · region: one from the list your subscription offers. The list differs from student to student; pick one and keep it all semester → Review + create → Create

Choose the operating system: Ubuntu

Marketplace → the newest Ubuntu LTS by Canonical → Create.

Linux images cost nothing; the free hours apply to the VM size (B2ats_v2). Windows and SQL Server images carry licence fees — avoid.

Plan: plain Ubuntu Server — no need for Pro

Plan = Ubuntu Server … LTS (the plain one). Ubuntu Pro adds a paid subscription for 10-year enterprise patching — your VM lives for hours, no need for Pro.

Watch out: on the VM form the Image field can still default to Ubuntu Pro. Check it says plain Ubuntu Server — no "Pro".

Size: don't take the default

The form defaults to D2s_v3 — US$74/month — and on the student subscription it's blocked anyway:

Click See all sizes.

Size: the free B-series one

B-Series v2 → B2ats_v2 (2 vCPU, 1 GiB, ~US$7/month list price — and free-tier on Azure for Students). Regions without v2 sizes offer B1s instead, under B-Series, on the same free-tier terms.

Why the B-series size is free

Your subscription's free services include 750 hours/month — enough to run one VM around the clock:

Which of the two your region has depends on the region; both are 750 free hours. B2pts v2 is Arm — software built for x86 won't run there; take B2ats_v2, not B2pts.

Inbound ports — and read the warning

Select HTTP (80), HTTPS (443) and SSH (22). 80 serves the assignment, 443 is for the certificate step, 22 is how you get in.

The warning is real: this opens the ports to every IP address on the internet. Good practice: after creation, edit the SSH rule in the network settings to allow only your own IP.

One click, many resources

You asked for one VM. Azure creates a virtual network, a network security group, a public IP, a network card, a disk — and the VM. Each is a separate object with its own lifecycle.

That's why cleanup means deleting the resource group — not just the VM.

The VM's addresses — and logging in

VM → Properties: a public IP (the internet reaches this) and a private IP (172.16.x.x — one of the reserved local ranges). The public IP is what your A record will point at.

Log in with the username from the form — Azure's default is azureuser:

ssh azureuser@<public-ip>

(ubuntu@ is AWS's convention, not Azure's.)

First login

ssh azureuser@<public-ip>

The fingerprint question appears once per new machine — answer yes. Then you're on your VM; the message of the day even shows your private IP.

Install nginx and answer /hello

sudo apt update && sudo apt install -y nginx
sudo nano /etc/nginx/sites-enabled/hello.conf

Put this in the file (use nano — pasting multi-line commands into the shell breaks):

server {
    listen 80 default_server;
    location /hello {
        default_type application/json;
        return 200 '{"student":"<your student code>"}';
    }
}

sudo rm /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx
curl localhost/hello                # on the VM
curl http://<public-ip>/hello      # from your laptop — if this hangs, check the port-80 rule

Getting a name — you create the A record yourself

The point of this step is that you create a DNS A record pointing at your VM's public IP. A provider-generated name (Azure's DNS label, nip.io) doesn't count — no record of yours involved.

A domain of your own is one record

An A record: name → IPv4 address. This is my domain, in AWS (Route 53) — your screen depends on where your domain lives, but the record is the same everywhere: name, type A, the VM's public IP. Here it points at an Azure VM — DNS does not care where the machine is.

TTL 300 = resolvers cache the answer for 5 minutes; short TTL means changes take effect fast.

HTTPS: a certificate is bound to a name

That's why HTTPS had to wait for DNS. With the domain in place it's three commands:

sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>
curl https://<your-domain>/hello

Port 443 must be open in the network rules, and the nginx block needs server_name <your-domain>;.

What certbot just did

Proved to Let's Encrypt over port 80 that this machine answers for the name → got a certificate → rewrote the nginx config itself → scheduled automatic renewal. Certificates live 90 days; the renewal timer means nobody has to remember.

Stuck?

Problems, questions — ask. That's what this session is for.

The problems that blocked people in week 1, with their fixes, are a deck of their own on the course site: Practice 1 · Known problems and fixes. Start there if the VM form shows no usable size.