CMDBuild READY2USE on Ubuntu 24.04 on Azure User Guide

Overview

CMDBuild is an open source Configuration Management Database used by IT and facilities teams to manage the assets and services of an infrastructure. You model configuration items and the relationships between them, track hardware and software inventory, run IT service management and workflow processes, build dashboards and reports, and connect to other systems through a REST API. The cloudimg image ships the AGPL-3.0 CMDBuild READY2USE 2.4 distribution — the full, ready to use asset, service and process data model on top of the CMDBuild core — deployed on Apache Tomcat with the OpenJDK 17 JRE behind nginx as a reverse proxy. PostgreSQL with the PostGIS extension is the application database. Tomcat listens on 127.0.0.1:8080 and PostgreSQL on the loopback interface only; both are reached through nginx on port 80.

The image is secure by default. CMDBuild ships a well known default admin / admin login; the cloudimg image poisons that password so it is dead in the shipped image, and on the first boot of every VM a one shot service generates a unique administrator password and a unique database password, writes them to /root/cmdbuild-credentials.txt (mode 0600), and only then starts the public web interface. The READY2USE database ships with a representative demo data model so you can explore the asset classes, cards and dashboards immediately. Backed by 24/7 cloudimg support.

What is included:

• CMDBuild READY2USE 2.4 (core 4.0.4) deployed as an exploded webapp on Apache Tomcat 10 with the OpenJDK 17 JRE
• nginx reverse proxy on :80 in front of Tomcat (bound to loopback :8080)
• PostgreSQL 17 with the PostGIS extension as the application database, bound to loopback only
• A dedicated Azure data disk for the PostgreSQL datadir at /var/lib/postgresql, separate from the OS disk and re-provisioned with every VM
• Per-VM administrator password and PostgreSQL password generated at first boot, in a root-only file; the shipped default login is rotated so it never works
• cmdbuild-tomcat.service, postgresql.service and nginx.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting point — CMDBuild runs the Tomcat JVM alongside PostgreSQL and benefits from memory headroom; scale up for more users or larger data models. NSG inbound: allow 22/tcp from your management network and 80/tcp from the networks your users will reach CMDBuild on (front port 80 with TLS for public exposure — see Enabling HTTPS).

Step 1 — Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for CMDBuild by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create → Create.

First boot initialisation takes approximately one to three minutes after the VM starts — CMDBuild rotates its secrets, starts Tomcat and brings the web interface online on first boot.

Step 2 — Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name cmdbuild \
  --image <marketplace-image-urn> \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name cmdbuild --port 80 --priority 1010

Step 3 — Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 — Confirm the services are running

systemctl is-active postgresql cmdbuild-tomcat nginx cmdbuild-firstboot
curl -fsS -o /dev/null -w 'cmdbuild ui: %{http_code}\n' http://127.0.0.1/cmdbuild/ui/

All four units report active and the UI endpoint returns 200, confirming the full stack — nginx, Tomcat and PostgreSQL — is serving. CMDBuild is a JVM application: on the very first boot allow a short warm-up before the UI responds.

Step 5 — Confirm the network bindings

The application and the database bind the loopback interface only; nginx is the single public port. Confirm it:

ss -tln | grep -E ':(80|8080|5432)'

Port 80 is nginx (public), Tomcat listens on 127.0.0.1:8080 and PostgreSQL on 127.0.0.1:5432, so neither the application server nor the database is directly reachable from the network.

Step 6 — Retrieve your administrator login

The administrator password and the database password are generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/cmdbuild-credentials.txt

The cmdbuild.admin.login (which is admin) and cmdbuild.admin.pass values are your sign-in; the file also records the per-VM PostgreSQL passwords. The first boot also loads the READY2USE model and rotates the shipped default login so it no longer works. You can verify the security posture without exposing the password — the default admin / admin login is rejected while the per-VM password authenticates:

SESS=http://127.0.0.1/cmdbuild/services/rest/v3/sessions
PASS=$(sudo grep '^cmdbuild.admin.pass=' /root/cmdbuild-credentials.txt | cut -d= -f2-)
echo -n 'default admin/admin -> '; curl -s -o /dev/null -w '%{http_code}\n' -H 'Content-Type: application/json' --data '{"username":"admin","password":"admin","scope":"service"}' "$SESS"
echo -n 'per-VM admin       -> '; curl -s -o /dev/null -w '%{http_code}\n' -H 'Content-Type: application/json' --data "{\"username\":\"admin\",\"password\":\"$PASS\",\"scope\":\"service\"}" "$SESS"

The first call returns 401 (the shipped default is dead) and the second returns 200.

Step 7 — First sign-in

Open a web browser and navigate to http://<vm-public-ip>/. The bare root redirects to /cmdbuild/ui/, the CMDBuild READY2USE sign-in page. Enter admin and the password from /root/cmdbuild-credentials.txt.

The CMDBuild READY2USE sign-in page, served on first boot with the per-VM administrator password.

After signing in you reach the service desk dashboard, with the navigation menu on the left grouping the Registry, Asset Inventory, Service desk, Dashboards, Reports and the Service catalogue.

The CMDBuild service desk dashboard — ticket counters and the full READY2USE navigation.

Step 8 — Explore the asset inventory

Expand Asset Inventory in the left menu and open a class — for example Workplaces → Mobiles — to see the configuration items in a sortable, filterable grid. Each row is a configuration item with its code, assignee, serial number, product, lifecycle state, supplier and warranty. Use the search box and column filters to find items, or Add card to record a new one.

A populated asset inventory class in CMDBuild — configuration items with lifecycle state, assignee and supplier.

Step 9 — Open a configuration item

Double-click a row to open its card. The card records the item's attributes, its location and its relationships, with side tabs for the asset history, attachments, notes and related items, and a one-click Generate QR Code for physical tracking.

A configuration item card — attributes, location, relationships, asset history and QR code generation.

Step 10 — Confirm the data tier

The PostgreSQL datadir is on its own dedicated Azure data disk, separate from the OS disk and re-provisioned with every VM:

findmnt -no SOURCE,SIZE,FSTYPE,TARGET /var/lib/postgresql
sudo -u postgres psql -d cmdbuild -tAc "SELECT count(*) AS public_tables FROM pg_tables WHERE schemaname='public';"

The datadir mounts from the dedicated disk and the READY2USE model reports its full set of application tables.

Enabling HTTPS

For production, serve CMDBuild over HTTPS so session tokens and data cannot be intercepted. The image ships with nginx, which certbot can configure automatically. The following assumes a DNS record pointing your fully qualified domain name at the VM's public IP:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d cmdbuild.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

After certbot finishes, reload nginx with sudo systemctl reload nginx. Sign in and change the administrator password from the CMDBuild user menu.

Backup and maintenance

CMDBuild keeps all of its state — the data model, configuration items, tickets, users, dashboards and reports — in its PostgreSQL application database on the dedicated data disk at /var/lib/postgresql. Back it up regularly:

sudo -u postgres pg_dump cmdbuild > /tmp/cmdbuild-appdb-$(date +%F).sql

Ship the dump to Azure Blob Storage or another object store, or snapshot the data disk in Azure for point-in-time backups. Keep the OS patched with sudo apt update && sudo apt upgrade. CMDBuild is served by Apache Tomcat under /opt/cmdbuild-tomcat; restart the application with sudo systemctl restart cmdbuild-tomcat after configuration changes. Always back up first.

Support

This image is backed by 24/7 cloudimg support. Contact us by email and chat for help with deployment, data-model configuration, the REST API, workflow and process setup, TLS termination and database administration. Contact support@cloudimg.co.uk.

For general CMDBuild questions consult the documentation at https://www.cmdbuild.org/. CMDBuild is a trademark of Tecnoteca srl. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.