Apache OFBiz on Ubuntu 24.04 on Azure User Guide

Overview

Apache OFBiz is a full open-source suite of enterprise business applications - accounting, order management, product catalog, party/CRM, manufacturing, inventory and warehouse, plus the webtools administration console - built on a common data model and service engine. The cloudimg image installs Apache OFBiz 24.09.07 built from the official Apache release with the bundled Gradle build on OpenJDK 17, seeded with the full seed + demo dataset in the embedded Apache Derby database so every application is immediately explorable. OFBiz runs as a dedicated unprivileged ofbiz service account bound to its loopback HTTPS connector behind an nginx reverse proxy on port 80, keeps the Derby database, search indexes, logs and all runtime data on a dedicated Azure data disk, and rotates the built-in admin account to a unique per-VM password on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• Apache OFBiz 24.09.07 (ERP / CRM / e-commerce / SCM suite) on OpenJDK 17
• The full seed + demo dataset loaded into the embedded Apache Derby database
• The OFBiz web applications: webtools (admin), accounting, party (CRM), catalog, order, facility, manufacturing and more
• nginx on :80 as a reverse proxy to the loopback OFBiz HTTPS connector on 127.0.0.1:8443
• A per-VM admin account generated on first boot and recorded in a root-only file
• A dedicated Azure data disk at /var/lib/ofbiz for the Derby database, Lucene indexes, logs and runtime data
• ofbiz.service (running as the unprivileged ofbiz user) + nginx.service as systemd units, enabled and active
• An unauthenticated /health endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B4ms (4 vCPU / 16 GiB RAM) is a reasonable starting point for the OFBiz JVM plus the embedded Derby database and demo data; size up for heavier workloads. NSG inbound: allow 22/tcp from your management network and 80/tcp. OFBiz is fronted by nginx on plain HTTP port 80; for production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Apache OFBiz by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name ofbiz \
  --image <marketplace-image-urn> \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name ofbiz --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active ofbiz.service nginx.service

Both report active. OFBiz runs as the dedicated ofbiz user and listens on its loopback HTTPS connector 127.0.0.1:8443; nginx fronts it on port 80. The embedded Derby database, Lucene indexes, logs and all runtime data live on the dedicated Azure data disk mounted at /var/lib/ofbiz.

Step 5 - Retrieve your admin password

The OFBiz admin password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/ofbiz-credentials.txt

This file contains OFBIZ_ADMIN_USER (admin) and OFBIZ_ADMIN_PASSWORD, along with the OFBiz URL. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/health

It returns ok. This endpoint never requires authentication, so it is safe for an Azure Load Balancer health probe.

Step 7 - Sign in to the OFBiz web applications

Browse to http://<vm-public-ip>/webtools/control/main and sign in as admin with the password from Step 5. The login form is served over the nginx reverse proxy; OFBiz treats the proxied request as secure so the form submits without a redirect loop.

Once signed in, the Web Tools console is the administration hub - entity engine tools, the service engine, import/export, cache and debug tools, and system configuration.

The Accounting application manages invoices, payments, billing accounts, financial accounts, agreements, fixed assets, budgets and the general ledger. The seeded demo dataset populates accounts-receivable and accounts-payable invoices so you can explore the flows immediately.

The Party application is OFBiz's CRM - people, groups, customers, prospects and employees, with communications, classifications and contact management. Use Find Party to search the seeded demo parties or create new ones.

The other seeded applications are reachable under their own context paths - http://<vm-public-ip>/catalog (product catalog), http://<vm-public-ip>/ordermgr (order management), http://<vm-public-ip>/facility (inventory / warehouse) and more. Each application prompts for the same admin credentials.

Step 8 - Verify admin authentication from the command line

OFBiz's webtools login rejects a wrong password and authenticates the per-VM admin password. Read the password from the credentials file first, then post the login form. Because the command embeds your unique password, run it interactively rather than from a script - substitute the value of OFBIZ_ADMIN_PASSWORD from Step 5 for <OFBIZ_ADMIN_PASSWORD>:

B=https://127.0.0.1:8443; CJ=$(mktemp); curl -ks -c $CJ "$B/webtools/control/login" -o /dev/null; curl -ks -b $CJ --data-urlencode 'USERNAME=admin' --data-urlencode 'PASSWORD=<OFBIZ_ADMIN_PASSWORD>' "$B/webtools/control/login" | grep -q Logout && echo LOGIN-OK

A successful login prints LOGIN-OK (the authenticated page contains a Logout link); a wrong password returns the login page again with no Logout link.

Step 9 - Confirm runtime data lives on the dedicated disk

OFBiz's runtime/ directory - the embedded Derby database, the Lucene search indexes, the Tomcat work directories and the logs - is stored on the dedicated Azure data disk so it survives OS changes and can be resized independently:

findmnt /var/lib/ofbiz

The mount is backed by a separate Azure data disk captured into the image and re-provisioned on every VM.

Maintenance

• Users and security: manage user logins, security groups and permissions under Party and the Security tools in Web Tools.
• Applications: the seeded demo data spans accounting, catalog, order, party, facility and manufacturing so each application is immediately explorable; adapt or clear it for your own organisation.
• Storage: the Derby database, search indexes and logs live under /var/lib/ofbiz on the data disk; back up that volume to protect your data and configuration.
• Logs: OFBiz logs are under /var/lib/ofbiz/runtime/logs on the data disk.
• Tuning: edit the JVM heap (-Xms / -Xmx) in the ofbiz.service unit (/etc/systemd/system/ofbiz.service), then sudo systemctl daemon-reload && sudo systemctl restart ofbiz.
• Database: the embedded Apache Derby database suits evaluation and small deployments; for production scale, migrate OFBiz to an external RDBMS (PostgreSQL) by editing framework/entity/config/entityengine.xml.
• TLS: OFBiz is fronted by nginx on plain HTTP port 80; front it with TLS (e.g. certbot) and your own domain before production use.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.