Applications AWS

AureusERP 1.8.0 on AWS User Guide

| Product: AureusERP 1.8.0 on Ubuntu 24.04 on AWS

Overview

This guide covers launching and using the AureusERP 1.8.0 on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg ERP and CRM listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

AureusERP is an open source enterprise resource planning system built on Laravel and Filament. Its business areas are modules you install when you need them: sales, purchases, inventory, invoicing, accounting, payments, CRM, contacts, employees, recruitment, time off, timesheets, projects, manufacturing, maintenance, point of sale, barcode operations, a website and blogs. Roles and permissions control what each user can see and do.

The cloudimg image is a hardened, ready-to-use AureusERP server:

  • The upstream release. AureusERP 1.8.0 from its GitHub tag, verified against its SHA-256. No AureusERP source file is modified. Its PHP dependencies are installed from the tag's lock file, with seven packages (Livewire and six Symfony components) raised to their current security releases within the versions the lock allows; the front end is built from the tag's own lock, with two browser libraries raised the same way. SOURCE.txt lists exactly what changed.
  • No default login. First boot creates one administrator, admin@example.com, with a random password unique to your instance. APP_KEY (Laravel's encryption key) and the MySQL password are also generated on your instance. Until first boot has finished, neither nginx nor PHP starts.
  • HTTPS from the first boot. nginx serves AureusERP on 443 with a certificate generated on your instance (an end-entity certificate, not a certificate authority). Port 80 redirects to HTTPS. The server's name is set from the instance's EC2 public DNS name at first boot, and requests for any other name are dropped. You can change it to your own domain.
  • MySQL 8.0 on the local socket only. The database server does not listen on any network port. AureusERP connects over the Unix socket with its own user, which can reach only the aureuserp database. The image ships an empty data directory: the database, its keys and its users are created on your instance.
  • Hardened web tier. PHP runs as its own unprivileged user on a Unix socket only nginx can reach. nginx passes AureusERP the real client address from the connection, never a header a client sends, limits sign-in attempts per address (AureusERP also locks an address out after five failed attempts), refuses cross-site requests to the image proxy, and refuses the front controller path, configuration, logs and the source tree. Debug mode is off and the environment is production.
  • Metadata service blocked. nginx, PHP, MySQL, the queue worker, the scheduler and the first-boot service cannot reach the EC2 instance metadata service. The AMI requires IMDSv2.
  • Fully patched Ubuntu 24.04 LTS at build time, with unattended security upgrades switched on.

What is on the image: AureusERP 1.8.0 (MIT), PHP 8.3 FPM and CLI, MySQL 8.0, nginx, cloud-init and the AWS Systems Manager agent, all from Ubuntu 24.04 except AureusERP. Node.js was used only to build the front end and is not on the image. Four PHP packages come from Ubuntu's universe component: php8.3-fpm, php8.3-intl, php8.3-zip and php8.3-bcmath; they are listed in /var/lib/cloudimg/aureuserp-universe-packages.txt.

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large (2 vCPUs, 8 GiB). A t3.large is enough for a small team.

Prerequisites

  • An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet.
  • A security group that allows TCP 22 (SSH) from your own networks only, TCP 443 from wherever your users are, and TCP 80 (redirects to HTTPS). No other port is needed.
  • For production, a DNS name you control (for example erp.example.com) and, ideally, a certificate from a certificate authority. Until then the instance uses its EC2 public DNS name with its own self-signed certificate.

Connecting to your instance

Operating system SSH user
Ubuntu 24.04 ubuntu

Step 1: Launch the instance

Launch from the AWS Marketplace page (choose the AureusERP 1.8.0 on Ubuntu 24.04 version), or with the AWS CLI using the AMI ID shown on the listing's launch page:

aws ec2 run-instances --image-id ami-xxxxxxxxxxxxxxxxx --instance-type m5.large \
  --key-name my-key --security-group-ids sg-xxxxxxxx --subnet-id subnet-xxxxxxxx \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=aureuserp}]'

First boot takes about a minute once the instance is up: it initialises MySQL, creates the database, runs AureusERP's installer (migrations, roles and permissions), and creates the administrator and the certificate. The web interface stays offline until that has finished.

Step 2: Connect to your instance

ssh -i my-key.pem ubuntu@<public-ip>

Step 3: Check the services

systemctl is-active mysql.service nginx.service php8.3-fpm.service aureuserp-queue.service aureuserp-schedule.timer
sudo ss -ltnp | awk 'NR==1 || /:(22|80|443|3306|33060) /'
sudo ss -lxp | grep aureuserp-fpm

active
active
active
active
active
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0      4096         0.0.0.0:22        0.0.0.0:*    users:(("sshd",pid=900,fd=3),("systemd",pid=1,fd=186))
LISTEN 0      511          0.0.0.0:80        0.0.0.0:*    users:(("nginx",pid=71795,fd=5),("nginx",pid=71794,fd=5),("nginx",pid=69153,fd=5))
LISTEN 0      511          0.0.0.0:443       0.0.0.0:*    users:(("nginx",pid=71795,fd=7),("nginx",pid=71794,fd=7),("nginx",pid=69153,fd=7))
LISTEN 0      4096            [::]:22           [::]:*    users:(("sshd",pid=900,fd=4),("systemd",pid=1,fd=187))
LISTEN 0      511             [::]:80           [::]:*    users:(("nginx",pid=71795,fd=6),("nginx",pid=71794,fd=6),("nginx",pid=69153,fd=6))
LISTEN 0      511             [::]:443          [::]:*    users:(("nginx",pid=71795,fd=8),("nginx",pid=71794,fd=8),("nginx",pid=69153,fd=8))
u_str LISTEN 0      4096                       /run/php/aureuserp-fpm.sock 172620            * 0    users:(("php-fpm8.3",pid=69144,fd=10),("php-fpm8.3",pid=69143,fd=10),("php-fpm8.3",pid=69138,fd=8))

Only SSH, HTTP and HTTPS listen on the network. MySQL (3306, and its X protocol on 33060) does not listen at all; PHP listens only on its Unix socket.

Step 4: Get your address and the administrator password

First boot writes everything you need to sign in to a file only root can read:

sudo cat /root/aureuserp-credentials.txt

# AureusERP 1.8.0 - generated on first boot by aureuserp-firstboot.service
# These credentials are unique to this instance; none was baked into the image. Keep this file secret.

AUREUSERP_URL=https://ec2-13-221-246-25.compute-1.amazonaws.com/admin/login
AUREUSERP_ADMIN_EMAIL=admin@example.com
AUREUSERP_ADMIN_PASSWORD=<24 random letters and digits>
AUREUSERP_TLS_SHA256=04:2A:90:34:74:96:7C:90:E4:AA:40:A2:04:97:94:65:E9:6E:60:3F:69:99:6C:13:35:BB:FC:53:D0:AA:12:D5
...
  • AUREUSERP_URL is your AureusERP sign-in page.
  • AUREUSERP_TLS_SHA256 is the fingerprint of the instance's own certificate. Your browser will warn that the certificate is not trusted; compare the fingerprint it shows with this one before you continue. Replace it with a certificate from a certificate authority for your own name when you can (Step 10).
  • AUREUSERP_ADMIN_EMAIL / AUREUSERP_ADMIN_PASSWORD sign in to AureusERP as its administrator.

Step 5: Run the self-test

The image includes an end-to-end test. Over HTTPS on the instance it checks that port 80 redirects, that the front controller path, the image proxy, the mobile-shell endpoints, the configuration file, the data and the sources are refused, that the health check answers, that the administrator signs in through AureusERP's own login form, and that a wrong password and common default passwords are refused:

sudo aureuserp-cred-roundtrip

AUREUSERP_ROUNDTRIP_OK https 301 + no index.php/image proxy/mobile endpoints/env/data/sources + healthz + administrator sign-in (Filament's own Livewire login form, CSRF token) + wrong and default passwords refused

Step 6: Sign in to the web interface

Open AUREUSERP_URL in your browser, check the certificate fingerprint, and sign in with AUREUSERP_ADMIN_EMAIL and AUREUSERP_ADMIN_PASSWORD.

The AureusERP Sign in page with the e-mail address admin@example.com entered, an empty password field, a Forgot password link, a Remember me checkbox and a Sign in button

Change the e-mail address and name on your profile (the A avatar at the top right, then Profile). To change the password, run one of these on the instance. The first generates a new random password; the second reads yours (20 to 72 letters and digits) from the terminal, never from the command line. Either way every session is signed out and the new password is written to /root/aureuserp-credentials.txt:

sudo aureuserp-set-password

# Type <new-password> at the prompt; nothing is echoed.
read -rs -p 'New AureusERP password: ' P; echo
printf '%s\n' "$P" | sudo aureuserp-set-password --stdin; unset P

Once you have stored the password somewhere safe, you can delete the AUREUSERP_ADMIN_PASSWORD line from /root/aureuserp-credentials.txt.

Step 7: Install the modules you need

A fresh AureusERP has no business modules installed. On the first sign-in it opens Plugins, the module manager: Apps lists the business modules, Installed and Not Installed filter them, and each card shows the module's dependencies, which are installed with it. Open a module's menu (the three dots) and choose Install.

The AureusERP Plugins page with the tabs Apps 18, Extra 3, Installed 5 and Not Installed 16, and cards for Invoices and Sales (Installed) and Accounting, Barcode, Blogs, Contacts, Crm, Employees, Inventory, Maintenance, Manufacturing and Point-of-sale (Not Installed), each with its version and dependency count

You can also install a module from the command line. This runs AureusERP's own installer as the aureuserp user, with the same metadata block as the web tier:

sudo aureuserp-artisan purchases:install --no-interaction

The module names are those on the Plugins page in lower case, for example sales, purchases, inventories, accounting, invoices, crm, employees, projects and manufacturing.

Once a module is installed it appears in the menu (the grid icon at the top left). With Sales installed (which brings Invoices with it), the dashboard summarises invoices and vendor bills:

The AureusERP Dashboard with Invoice and Sales tabs, filters for date range, product, category, customer, vendor, salesperson and payment status, invoice and vendor bill totals, and Revenue Over Time and Invoices by Status charts

and Sales has quotations, orders, products and customers:

The AureusERP Sales Quotations list with Orders, To Invoice, Products, Configurations and Settings menus, the Default, My Quotations, Quotations, Sales Orders and Archived views, columns for number, creation date, customer, sales person, amount total and status, and a New Quotation button

Add users and decide what they can do under Settings (users, roles and permissions); each module's settings are under its own Settings or Configurations menu.

Step 8: The queue worker and the scheduler

AureusERP runs background jobs (e-mails, imports, notifications) in a queue and periodic tasks from Laravel's scheduler. On this image the queue worker is the aureuserp-queue service and the scheduler is a systemd timer that runs every minute; both run as the unprivileged aureuserp user:

systemctl show -p ActiveState -p SubState -p User aureuserp-queue.service
systemctl list-timers aureuserp-schedule.timer --no-pager

User=aureuserp
ActiveState=active
SubState=running
NEXT                        LEFT LAST                         PASSED UNIT                     ACTIVATES
Sun 2026-11-08 02:53:00 UTC  47s Sun 2026-11-08 02:52:01 UTC 10s ago aureuserp-schedule.timer aureuserp-schedule.service

1 timers listed.
Pass --all to see loaded but inactive timers, too.

Step 9: AureusERP's command line

aureuserp-artisan runs AureusERP's own artisan commands as the aureuserp user with the same metadata block as the web tier:

sudo aureuserp-artisan --version
sudo aureuserp-artisan about --only=environment

Laravel Framework 13.36.0

  Environment ................................................................
  Application Name ................................................. AureusERP
  Laravel Version .................................................... 13.36.0
  PHP Version .......................................................... 8.3.6
  Composer Version ......................................................... -
  Environment ..................................................... production
  Debug Mode ............................................................. OFF
  URL .............................. ec2-13-221-246-25.compute-1.amazonaws.com
  Maintenance Mode ....................................................... OFF
  Timezone ............................................................... UTC
  Locale .................................................................. en

Step 10: Use your own domain and certificate

Point a DNS name at the instance (an Elastic IP is a good idea), then:

sudo aureuserp-set-hostname <your-domain>

This creates a new self-signed certificate for the name, pins nginx to it (other names are dropped), sets AureusERP's APP_URL (used in links in its e-mails) and updates the URL and fingerprint in /root/aureuserp-credentials.txt. To use a certificate from a certificate authority, replace /etc/nginx/ssl/aureuserp.crt and aureuserp.key (keep the key 0600 root) and run sudo systemctl reload nginx.

To send e-mail (password resets, notifications), set the MAIL_* values in /etc/aureuserp/env (see Laravel's mail documentation) and run sudo systemctl restart php8.3-fpm aureuserp-queue.

Step 11: Restrict access to your networks

Limit who can reach the web interface in the instance's security group. For example, to allow HTTPS only from your office network:

aws ec2 authorize-security-group-ingress --group-id sg-xxxxxxxx --protocol tcp --port 443 --cidr <your-mgmt-cidr>
aws ec2 revoke-security-group-ingress --group-id sg-xxxxxxxx --protocol tcp --port 443 --cidr 0.0.0.0/0

AureusERP locks a client address out of sign-in for a minute after five failed attempts, and nginx separately rate limits requests for the sign-in pages per client address.

Step 12: Check the security posture

U=$(sudo sed -n 's/^AUREUSERP_URL=//p' /root/aureuserp-credentials.txt); U=${U%/admin/login}
C=/etc/nginx/ssl/aureuserp.crt
for p in admin/login healthz; do
  curl -s --cacert "$C" -o /dev/null -w "GET /$p: %{http_code}\n" "${U}/$p"
done
for p in index.php index.php/admin/login .env storage/logs/laravel.log composer.json artisan _native/api/events; do
  curl -s --cacert "$C" -o /dev/null -w "GET /$p: %{http_code}\n" "${U}/$p"
done
curl -s --cacert "$C" -o /dev/null -w 'GET /cache/logo.png (same site): %{http_code}\n' -H 'Sec-Fetch-Site: same-origin' "${U}/cache/logo.png"
curl -s --cacert "$C" -o /dev/null -w 'GET /cache/logo.png from another site: %{http_code}\n' -H 'Sec-Fetch-Site: cross-site' "${U}/cache/logo.png"
curl -s --cacert "$C" -o /dev/null -w 'GET /cache/anything-else.png: %{http_code}\n' -H 'Sec-Fetch-Site: same-origin' "${U}/cache/anything-else.png"
curl -s -o /dev/null -w 'GET http://: %{http_code}\n' "${U/https:/http:}/admin/login"
curl -sk -o /dev/null -w 'GET with an unknown Host: %{http_code}\n' -H 'Host: not-this-server.example' https://127.0.0.1/ || true
for i in $(seq 1 12); do curl -s --cacert "$C" -o /dev/null -w '%{http_code} ' "${U}/admin/login"; done; echo
systemctl show -p IPAddressDeny nginx.service php8.3-fpm.service mysql.service aureuserp-queue.service
sudo mysql -e "SELECT @@version, @@bind_address, @@skip_networking, @@local_infile"
curl -s http://127.0.0.1/healthz

GET /admin/login: 200
GET /healthz: 200
GET /index.php: 404
GET /index.php/admin/login: 404
GET /.env: 404
GET /storage/logs/laravel.log: 404
GET /composer.json: 404
GET /artisan: 404
GET /_native/api/events: 404
GET /cache/logo.png (same site): 200
GET /cache/logo.png from another site: 403
GET /cache/anything-else.png: 404
GET http://: 301
GET with an unknown Host: 000
200 200 200 200 200 200 200 200 200 200 429 429
IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32

IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32

IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32

IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32
@@version   @@bind_address  @@skip_networking   @@local_infile
8.0.46-0ubuntu0.24.04.4 127.0.0.1   1   0
ok
  • The front controller path (/index.php/...), the configuration file, logs, sources, the debug bar and the mobile-shell endpoints are refused. AureusERP's image proxy (/cache/...) serves only its own logo, and only to pages on this server. Requests for any name other than the configured one are dropped (000: nginx closes the connection).
  • The twelve quick requests for the sign-in page show nginx's per-address limit (429).
  • IPAddressDeny is the metadata-service block on nginx, PHP, MySQL and the queue worker; the scheduler and the first-boot service have the same one.
  • MySQL has networking switched off (skip_networking 1) and refuses LOAD DATA LOCAL.
  • http://127.0.0.1/healthz returns ok for a monitoring agent on the instance.

Step 13: Back up your data

Your data is the MySQL database plus uploaded files in /var/lib/aureuserp/storage/app and /var/lib/aureuserp-public. Keep /etc/aureuserp/env too: its APP_KEY decrypts the values AureusERP stores encrypted, and a backup restored without it cannot read them. Copy them to files only root can read, and keep copies off the instance (for example in an encrypted S3 bucket):

sudo sh -c 'umask 077; mysqldump --single-transaction --routines --triggers aureuserp | gzip > /var/backups/aureuserp-db-$(date +%F).sql.gz'
sudo sh -c 'umask 077; tar -C /var/lib -czf /var/backups/aureuserp-files-$(date +%F).tar.gz aureuserp/storage/app aureuserp-public'
sudo sh -c 'umask 077; cp /etc/aureuserp/env /var/backups/aureuserp-env-$(date +%F)'
sudo ls /var/backups/ | grep aureuserp

aureuserp-db-2026-11-08.sql.gz
aureuserp-env-2026-11-08
aureuserp-files-2026-11-08.tar.gz

To restore into a new instance of the same version, stop nginx, PHP-FPM, aureuserp-queue and aureuserp-schedule.timer, load the dump into the aureuserp database with gunzip -c <dump> | sudo mysql aureuserp, unpack the files archive into /var/lib, put your APP_KEY line into /etc/aureuserp/env, and start the services again.

EBS snapshots of the instance are a simple way to keep point-in-time copies of the whole server.

Step 14: Updates

Ubuntu, PHP and MySQL security updates install automatically (unattended upgrades). New AureusERP releases are published as new versions of this listing: launch the new version, stop its services, copy your database, uploads and the APP_KEY line of /etc/aureuserp/env across (keeping the new instance's own database password and APP_URL), then run sudo aureuserp-artisan migrate --force and start the services again.

Step 15: Licences and source

ls /usr/share/doc/aureuserp/
sed -n '1,5p' /usr/share/doc/aureuserp/SOURCE.txt

LICENSE
SOURCE.txt
AureusERP 1.8.0 on Ubuntu 24.04 by cloudimg - source and changes

Upstream: the AureusERP 1.8.0 tag archive, https://github.com/aureuserp/aureuserp/archive/refs/tags/v1.8.0.tar.gz
(sha256 31f3e77c69ede4f842aa01f6010149928fd119bb36be419abc312e510b92ffa9; GitHub tag v1.8.0, commit 9b076df06a902cce5a14866650547ed13ffa140a).
Licence: MIT (LICENSE, shipped here and in /var/www/aureuserp). No AureusERP source file is modified.

AureusERP is licensed under the MIT License, and every module on the Plugins page is part of the same open source repository; the image contains no paid or proprietary plugin. SOURCE.txt names the exact upstream archive, the files that are not shipped (tests, sample configuration, Docker and Apache files, front-end build configuration), and the PHP packages and browser libraries raised for security.

Security notes

  • Secrets. The administrator password is in /root/aureuserp-credentials.txt until you remove it; AureusERP stores only its bcrypt hash. APP_KEY and the MySQL password are in /etc/aureuserp/env, readable by root and the aureuserp group only (not by the web server). The TLS key is in /etc/nginx/ssl/aureuserp.key (root only). No secret is on any command line, in a systemd unit or in a log.
  • Client addresses. nginx gives AureusERP the address of the connection; forwarding headers sent by clients are replaced or removed. Behind a load balancer every request therefore comes from the load balancer's address.
  • PHP. The PHP pool runs as aureuserp and is confined to AureusERP's code, data and configuration directories. It can start programs only because the module manager installs a module by running AureusERP's own artisan command; every other way of starting a program is disabled.
  • Uploads. Files under /storage/ are served as downloads with a sandboxing Content-Security-Policy and are never executed.

Support

cloudimg provides support for this image by email at support@cloudimg.co.uk. AureusERP documentation is at docs.aureuserp.com.