Skip to content

Azure Deployment

One-click deploy

Deploy to Azure

Deploys an Azure Container Instance running the relay with a system-assigned managed identity. Optionally wires up Key Vault (TLS) and Table Storage (credential lookup).

Prerequisites: an Azure subscription and permission to create resources in a resource group.

After deployment:

  1. Note the container instance FQDN — this is your relay hostname.
  2. If you use Key Vault or Table Storage, grant the managed identity the matching role: Key Vault Certificate User and/or Storage Table Data Reader.
  3. Set up the Entra ID application and configure your clients.

Azure CLI

az group create --name smtp-relay-rg --location switzerlandnorth

az container create \
  --resource-group smtp-relay-rg \
  --name smtprelay-01-ci \
  --image ghcr.io/justiniven/smtp-oauth-relay:1 \
  --os-type Linux \
  --assign-identity [system] \
  --ports 8025 --protocol TCP \
  --dns-name-label smtprelay-01-ci \
  --ip-address Public \
  --environment-variables \
    TLS_SOURCE=keyvault \
    REQUIRE_TLS=true \
    AZURE_KEY_VAULT_URL=https://your-keyvault.vault.azure.net/ \
    AZURE_KEY_VAULT_CERT_NAME=smtp-relay-cert

az deployment group create \
  --resource-group smtp-relay-rg \
  --template-file azure_deployment/deployment.bicep \
  --parameters location=switzerlandnorth

Next steps