DCA Hardened Message Broker — documentation & support card

At a glance

Type	Hardened VM image
Upstream / license	RabbitMQ (MPL-2.0) — see licenses
Version	RabbitMQ 4.3.6 on Erlang/OTP 27.3.4.18 (Team RabbitMQ's signed apt repositories, versions pinned), Ubuntu 24.04 LTS; Google Cloud image built 2026-10-07. Exact image version: see the listing. Current builds: release notes.
Architecture	x86-64
Sizing	Any current-generation instance with ≥ 4 vCPU (pay-as-you-go floor); 8 vCPU recommended for production.

Marketplaces

• Google Cloud Marketplace — listing in preparation — Compute Engine image and deployment package built and verified on booted VMs; not yet public (base: Ubuntu 24.04 LTS)

Network ports

Port	Purpose	State
22	SSH — key-only, OS Login (IAM); the deployment package adds no SSH rule	your VPC's firewall rules
5672	AMQP — bound to 127.0.0.1 (listeners.tcp.default)	customer-must-open (config + firewall toggle)
15672	Management UI and HTTP API — bound to 127.0.0.1 (management.tcp.ip)	customer-must-open (config + firewall toggle)
25672	Erlang distribution — 127.0.0.1	loopback only (never exposed by the package)
4369	epmd — 127.0.0.1 and ::1	loopback only (never exposed by the package)

"customer-must-open" means a cloud firewall rule and, where noted, an in-image configuration change — both deliberate. Closed by default is the design.

Access & credentials

No shared or default credentials are included in this image. Access uses the SSH key you supply at launch; any application credential is generated uniquely on your instance at first boot and stored only there — we never know it.

Log in: SSH in with OS Login and forward port 15672 (gcloud compute ssh INSTANCE_NAME --zone ZONE --tunnel-through-iap -- -L 15672:127.0.0.1:15672), then open http://localhost:15672/ as admin. CLI tools run with sudo.

An administrator, admin, with a 32-character password, and the node's Erlang cookie — both generated on THIS VM's first boot. The password is in /root/rabbitmq-admin-credentials.txt (root-only, 0600); the cookie is /var/lib/rabbitmq/.erlang.cookie (rabbitmq, 0400). The default guest account is deleted. Nothing credential-like exists in the image.

sudo cat /root/rabbitmq-admin-credentials.txt

Rotation: Change it in the management UI (Admin → Users → admin) or with sudo rabbitmqctl change_password admin NEW_PASSWORD, then update /root/rabbitmq-admin-credentials.txt or your secret store. Create one user per application instead of sharing admin.

Step-by-step: first login / credentials.

Data & dependencies

• Data locations: /var/lib/rabbitmq (node data in /var/lib/rabbitmq/mnesia/rabbit@localhost) — all data stays on your instance and volumes.
• Does any data leave your tenant? No. Telemetry: none. Our images contain no phone-home, no usage beacons, no license servers. The only parties that know you deployed our software are you and your cloud provider's billing system.
• We have no access to your deployment. Your instance runs in your tenancy under your IAM; remote access for a support session exists only if you explicitly grant it, and you can revoke it at any time.
• External dependencies at deploy/runtime: None — the image is fully self-contained at deploy time; no internet access is required to boot and run.

Operate

• First boot: rabbitmq-firstboot.service mints the Erlang cookie and the administrator password before the broker first starts; rabbitmq-admin-firstboot then creates admin (tag administrator, full permissions on /), deletes guest, and proves admin signs in while a wrong password and guest/guest are refused, the versions are 4.3.6 / 27.3.4.18 and every listener is loopback-only, then writes /var/lib/dca-firstboot/rabbitmq.verified.
• Update / patch: Recommended: deploy the newest image version, move your definitions (rabbitmqctl export_definitions / import_definitions), switch clients over and let the old queues drain. In place, Team RabbitMQ's apt repositories stay configured, so apt can move the broker forward; unattended-upgrades does not touch the broker or Erlang.
• Backup / restore: sudo rabbitmqctl export_definitions /root/definitions.json saves users, vhosts, permissions, queues, exchanges, bindings and policies (not messages). For messages, stop the broker and snapshot the boot disk.
• Uninstall: delete the VM/deployment and its volumes — nothing else persists, and software billing stops with the instance under your cloud's marketplace terms.
• Logs: /var/log/rabbitmq/ (node log) and journalctl -u rabbitmq-server
• Health check: sudo rabbitmq-diagnostics -q ping → succeeds (exit status 0)

Known limitations

Single node: clustering, TLS listeners and off-box Erlang distribution are deliberate customer steps. Based on the RabbitMQ software; not affiliated with or endorsed by Broadcom. The Marketplace product name is still being finalized.

Support

Email support@dcassociatesgroup.com — first response within 1 business day (US Eastern), most tickets same-day. To escalate an open ticket, reply "ESCALATE"; it is reviewed by the founder within 1 business day. Security reports: vulnerability disclosure.

Privacy: policy · Terms: terms · Security practices: security & trust · Vulnerability reports: disclosure policy

This product is based on the open-source RabbitMQ software (MPL-2.0). RabbitMQ is a trademark of its owner, Broadcom; Derek Coleman & Associates Inc is not affiliated with or endorsed by Broadcom.