ChiefOnboarding on Ubuntu 24.04 on Azure User Guide

Overview

ChiefOnboarding is a self-hosted employee onboarding and preboarding platform. You build reusable onboarding sequences out of to-do items, resources, introductions, appointments and preboarding pages, assign them to new hires, and the platform walks each person through their tasks on a schedule - from the moment they accept an offer through their first weeks on the job - from a clean web dashboard or the optional Slack bot. The cloudimg image installs the official ChiefOnboarding self-host Docker stack, pinned to v2.4.1: a Django application server (run under supervisord as Gunicorn plus a django-q2 task scheduler) and a PostgreSQL 16 database. Every secret - the PostgreSQL password and the Django SECRET_KEY - is generated uniquely on the first boot of every VM, and the sole administrator account is created on first boot with a random password recorded in a root-only file. There is no default login. Backed by 24/7 cloudimg support.

What is included:

• The official ChiefOnboarding v2.4.1 self-host stack running under Docker (the web application server and a PostgreSQL 16 db), pinned so it never silently upgrades
• The web UI published on port 80 over plain HTTP
• A per-VM administrator account created on first boot - a unique password recorded in a root-only file - so every VM is secured independently, with the first-run setup wizard closed afterwards so no one can claim your instance by reaching it first
• ALLOWED_HOSTS, BASE_URL and CSRF_TRUSTED_ORIGINS resolved to your VM's reachable address at first boot, so sign-in and CSRF work out of the box
• The whole stack managed as one chiefonboarding.service systemd unit, plus docker.service, both enabled
• PostgreSQL bound to the internal Docker network only - just 22/tcp (SSH) and 80/tcp (web UI) are exposed
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting size for the two-container stack. NSG inbound: allow 22/tcp from your management network, and 80/tcp from the clients that will use ChiefOnboarding. The app serves plain HTTP; for production, put it behind your own domain and TLS.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for ChiefOnboarding by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22), then add 80 after deployment. Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name chiefonboarding \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name chiefonboarding --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the stack is running

ChiefOnboarding runs as a Docker Compose stack managed by a single systemd unit. On first boot the stack rotates every secret, re-points its URLs at your VM's address, recreates itself on a fresh database and creates the administrator account; the multi-container stack can take a minute or two to become fully healthy after the VM is created.

systemctl is-active chiefonboarding.service

It reports active. You can list the running containers with:

sudo docker compose -f /var/lib/chiefonboarding/docker-compose.yml ps

The whole stack is managed as one systemd unit - use sudo systemctl status chiefonboarding and sudo systemctl restart chiefonboarding to control every container together.

Step 5 - Retrieve your per-VM admin credentials

The administrator account is created uniquely on the first boot of your VM and its password is written to a root-only file. Confirm the file exists (it is 0600, root-only):

sudo ls -l /root/chiefonboarding-credentials.txt

Then read it to get your credentials:

sudo cat /root/chiefonboarding-credentials.txt

The file contains CHIEFONBOARDING_URL (the address to browse to), CHIEFONBOARDING_ADMIN_EMAIL and CHIEFONBOARDING_ADMIN_PASSWORD (for the web UI). Store them somewhere safe.

Step 6 - Confirm the endpoints are healthy

The web UI answers on port 80. There is also a lightweight /health endpoint that always returns ok:

curl -s -o /dev/null -w 'web UI -> HTTP %{http_code}\n' http://localhost/

It returns HTTP 200. The health endpoint returns ok:

curl -s http://localhost/health

You can confirm which ports are published - PostgreSQL is deliberately not among them, it stays on the internal Docker network:

sudo ss -tlnp | grep ':80 ' | awk '{print $1, $4}'

Step 7 - Confirm the pinned release

The images are pinned to ChiefOnboarding v2.4.1 and PostgreSQL 16 so the appliance never silently upgrades:

sudo docker compose -f /var/lib/chiefonboarding/docker-compose.yml images

Step 8 - Sign in to the web UI

Browse to http://<vm-public-ip>/ and sign in with the email and password from Step 5.

After signing in as an administrator, you land on the New hires dashboard, which lists everyone currently being onboarded, their start date, position and progress.

Step 9 - Build onboarding sequences and task templates

Under Sequences you build reusable onboarding sequences - the ordered set of to-do items, resources, introductions and messages a new hire receives on a schedule. The image ships with an example General sequence to show the structure.

Under Templates you manage the building blocks - To do items, resources, introductions, preboarding pages and badges - that sequences assign to new hires. Each item can be tagged and reused across sequences.

Building your first onboarding flow

In the web UI: under Templates create the To do items, Resources and Introductions a new hire needs; under Sequences create a sequence and add those items with the timing you want (for example "on day 1", "3 days before start"); then under People add a new hire, set their start date, and assign the sequence. ChiefOnboarding then walks that person through their tasks on the schedule you defined, either through their own web portal or - if you connect it - the Slack bot. Everything you create is stored in PostgreSQL on your own VM.

An optional Slack bot lets new hires complete to-do items and receive resources directly in Slack, and email or text-message notifications can be enabled from Settings. See the ChiefOnboarding documentation for the full configuration and integration reference.

Maintenance

• Admin credentials: the per-VM administrator account is in /root/chiefonboarding-credentials.txt; change the password from your profile settings in the web UI after first sign-in.
• Custom domain: the URLs are pinned to the VM's address at first boot. If you reach the VM via a DNS name or a different IP, add it to ALLOWED_HOSTS and update BASE_URL and CSRF_TRUSTED_ORIGINS in /var/lib/chiefonboarding/.env, then run sudo systemctl restart chiefonboarding.
• TLS / HTTPS: ChiefOnboarding serves plain HTTP on port 80. For production, put a TLS reverse proxy (Caddy, or nginx with certbot) in front of port 80 for your own domain and set HTTP_INSECURE=False in /var/lib/chiefonboarding/.env.
• Data: the PostgreSQL database lives in the pgdata Docker volume - snapshot the OS disk, or use pg_dump against the db container, for backups.
• Stack: manage the whole stack with sudo systemctl <status|restart|stop> chiefonboarding, or per-container with sudo docker compose -f /var/lib/chiefonboarding/docker-compose.yml <ps|logs|restart>.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.