DMPRoadmap on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of DMPRoadmap on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. DMPRoadmap is the open source platform behind DMPonline and DMPTool: researchers and institutions use it to write structured Data Management Plans by working through funder and institutional templates, share those plans with collaborators and administrators, export them, and keep them current across the life of a project. Administrators manage organisations, templates, guidance and users from the web interface.

The cloudimg image ships the free and open source, MIT licensed DMPRoadmap application (Ruby on Rails 7.1), built from source at the pinned upstream stable release and run behind nginx with a bundled same VM PostgreSQL database. The build loads the full upstream reference catalogue (organisations, funder templates, question formats, languages and regions) so the platform is ready to plan against from first launch, then removes every seeded demo account. Because the upstream project seeds four well known accounts (all with the password password123), nothing here ships with a known secret: those accounts are deleted from the image, and a per instance super administrator with a random password, together with per instance Rails, Devise and upload signing secrets and a per instance database password, are generated for each VM on first boot, before the app is reachable. The application and the database bind to loopback behind a single nginx front door. Backed by 24/7 cloudimg support.

DMPRoadmap is a trademark of its respective owner. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by it. It ships the free and open source MIT licensed self hosted software.

What is included:

• DMPRoadmap 5.0.2 (the MIT licensed Ruby on Rails Data Management Plan platform), built from source at the pinned upstream tag
• Ruby 3.1.4 compiled from source to match the upstream .ruby-version, with the app and its bundled gems under /opt/dmproadmap
• A bundled PostgreSQL 16 database on the same VM, bound to loopback, preloaded with the upstream reference catalogue (organisations, funder templates, question formats, languages, regions)
• puma bound to 127.0.0.1:3000 only, fronted by nginx on port 80 as the single public front door
• dmproadmap-firstboot.service, dmproadmap.service, postgresql and nginx.service as systemd units, enabled and active on boot
• Per instance Rails SECRET_KEY_BASE, Devise secret and pepper, an upload signing secret and the PostgreSQL role password, all generated per VM on first boot and never baked into the image
• A per instance super administrator account with a random password, created on first boot
• No default login: the upstream super_admin@example.com, funder_admin@example.com, org_admin@example.com and org_user@example.com demo accounts (all password123) are removed from the image
• wkhtmltopdf for exporting plans to PDF
• Ubuntu 24.04 LTS base with latest security patches applied at build time
• Azure Linux Agent for seamless cloud integration and SSH key injection
• 24/7 cloudimg support with guaranteed 24 hour response SLA

Prerequisites

• Active Azure subscription, SSH public key, VNet and subnet in target region
• Subscription to the DMPRoadmap listing on Azure Marketplace

Recommended virtual machine size: Standard_B2s (2 vCPU, 4 GB RAM) is a sensible starting point for a single organisation instance. For many concurrent users or a large template catalogue use Standard_B2ms or Standard_D2s_v5 or larger. NSG inbound: allow 22/tcp from your management network and 80/tcp for the web interface from the networks that use it.

Step 1: Deploy from the Azure Portal

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for DMPRoadmap by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create and Create.

Step 2: Deploy from the Azure CLI

RG="dmproadmap-prod"; LOCATION="eastus"; VM_NAME="dmproadmap-01"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/dmproadmap/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az network vnet create -g "$RG" --name dmp-vnet --address-prefix 10.100.0.0/16 --subnet-name dmp-subnet --subnet-prefix 10.100.1.0/24
az network nsg create -g "$RG" --name dmp-nsg
az network nsg rule create -g "$RG" --nsg-name dmp-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name dmp-nsg --name allow-http --priority 110 \
  --destination-port-ranges 80 --access Allow --protocol Tcp
az vm create -g "$RG" --name "$VM_NAME" --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name dmp-vnet --subnet dmp-subnet --nsg dmp-nsg --public-ip-sku Standard

Step 3: Connect to your VM

ssh azureuser@<vm-ip>

Step 4: Confirm the services are running

DMPRoadmap runs as a puma application under dmproadmap.service, backed by a bundled PostgreSQL database, fronted by nginx. Confirm the services are active and see the listeners:

sudo systemctl is-active postgresql nginx dmproadmap dmproadmap-firstboot
sudo ss -tlnp | grep -E ':80 |:3000 |:5432 '

You will see the services report active. nginx listens on :80 as the single public front door; the puma application is bound to 127.0.0.1:3000 and PostgreSQL to 127.0.0.1:5432 on the loopback interface only, and neither is exposed directly.

Step 5: Read the per instance credentials

A per instance super administrator account with a random password, together with per instance Rails and Devise signing secrets, were generated for this VM on the first boot, before the app was reachable, and the credentials written to a root only file. Read them:

sudo cat /root/dmproadmap-credentials.txt

The file (mode 0600 root:root) holds DMPROADMAP_ADMIN_EMAIL and DMPROADMAP_ADMIN_PASSWORD (the account you sign in with) and DMPROADMAP_URL. These do not ship in the image; every value is unique to this VM, so no two instances share a credential and there is no default login to change. The upstream super_admin@example.com / password123 demo accounts are never present.

Step 6: Verify the security model

Confirm that the per instance admin credential authenticates through the web tier, that the well known upstream default account does not authenticate, and that an unauthenticated request to a protected route is redirected to sign in. The image ships a bundled proof script that the build and smoke tests run to prove this end to end:

sudo /opt/dmproadmap/dmproadmap-selftest.sh
curl -s -o /dev/null -w 'anonymous GET /plans -> HTTP %{http_code}\n' http://localhost/plans

The self test reports round-trip OK: the per instance super admin logs in through the web interface and reaches an authenticated page, while the upstream super_admin@example.com / password123 login is dead. The anonymous request to /plans returns 302 (redirected to sign in). This is the security model: content is gated behind login, and the only administrator is the per instance account whose password lives in the root only credentials file.

Step 7: Open the web interface and sign in

Browse to http://<vm-ip>/ to reach DMPRoadmap. On the Sign in panel enter the DMPROADMAP_ADMIN_EMAIL and DMPROADMAP_ADMIN_PASSWORD from Step 5.

Step 8: Your dashboard

After signing in you land on My Dashboard, which lists the plans you own or collaborate on and offers a button to create a new plan. As the per instance super administrator you also have access to the administration areas from the top navigation.

Step 9: Create a Data Management Plan

Click Create plans in the top navigation. DMPRoadmap asks about your research project, then lets you pick the primary research organisation and the primary funder so it can offer the best matching template. The organisation and funder catalogues, and the funder templates behind them, are the reference data preloaded into the image, so you can create a real plan immediately. Fill in the project name, choose an organisation and funder (or tick the "not listed" options), and click Create plan to open the plan editor and start answering the template questions.

Step 10: Manage templates and guidance

DMPRoadmap is template driven. As an administrator, open the Templates administration area to review, edit and publish the Data Management Plan templates your organisation offers, each built from phases, sections and questions. The image ships the upstream default template and funder templates so the area is populated on first use.

Step 11: Version and preloaded data

The image records the exact upstream build and the reference data loaded into the database:

cat /opt/dmproadmap/VERSION
sudo -u postgres psql -tAd roadmap -c "SELECT 'orgs=' || count(*) FROM orgs"

VERSION reports the pinned DMPRoadmap tag, the source commit and the Ruby and Rails versions the image was built with. The database ships with the upstream reference catalogue loaded and zero user accounts, so the only login is the per instance administrator created on first boot.

Step 12: Server components

Step 13: Managing the service

sudo systemctl status dmproadmap --no-pager | head -12
sudo journalctl -u dmproadmap --no-pager | tail -40

Restart the application with sudo systemctl restart dmproadmap, follow its logs live with sudo journalctl -u dmproadmap -f, and view the runtime configuration in /etc/dmproadmap/dmproadmap.env. After changing the environment file, restart the service to apply it.

Step 14: Configure email, single sign on and HTTPS (production)

The image ships with email delivery, ORCID, Shibboleth and funder API integrations unconfigured (placeholders only), and serves over plain HTTP on port 80, which is convenient behind a load balancer or private network. For production:

• Email: DMPRoadmap sends invitations, plan sharing and notifications by email. Add your SMTP settings to /etc/dmproadmap/dmproadmap.env and restart the service. Until email is configured, actions that would send mail are simply not delivered.
• HTTPS: front the VM with Azure Application Gateway, a load balancer with a managed certificate, or a CDN, and forward to nginx on port 80; or add a TLS server block to /etc/nginx/sites-available/cloudimg-dmproadmap referencing your certificate and key, open 443/tcp on the NSG, then sudo systemctl reload nginx.
• Single sign on: ORCID and Shibboleth institutional login are supported upstream; add the relevant credentials to /etc/dmproadmap/dmproadmap.env and configure the identifier schemes in the administration area.
• Point a DNS name you control at the VM public IP and set DMPROADMAP_HOST in the environment file so links in emails use it.

Step 15: Security recommendations

• Restrict the NSG. Allow TCP 80 (and 22 for admin) only from the networks that use the app.
• Terminate TLS in front of the app (Step 14) so the sign in password travels encrypted.
• Rotate the initial admin password. Sign in and change it from your profile once you have deployed.
• Keep the application and database private to the loopback. puma is bound to 127.0.0.1:3000 and PostgreSQL to 127.0.0.1:5432, fronted by nginx; keep it that way and never expose them directly.
• Keep the OS patched. Unattended security upgrades remain enabled on the running VM.

Step 16: Support and Licensing

DMPRoadmap is distributed under the MIT License. This cloudimg image builds the unmodified official open source release from source; cloudimg provides the packaging, the bundled PostgreSQL database, the nginx front door, the per instance secret and administrator generation, the removal of the upstream default demo accounts, the paired deploy guide, and 24/7 support with a guaranteed 24 hour response SLA. DMPRoadmap is an independent open source project and this image is not affiliated with or endorsed by it.

Deploy on Azure

Launch DMPRoadmap on Ubuntu 24.04 LTS by cloudimg from the Azure Marketplace and follow this guide to a working Data Management Plan platform in minutes.