EGroupware Collaboration Suite on AWS User Guide

Overview

This image runs EGroupware, the open source, self hosted collaboration and groupware suite used by businesses, public sector bodies, schools and non profit organisations worldwide. From one web interface your team shares calendars with group scheduling and resource booking, keeps a common address book, tracks tasks and tickets in InfoLog, stores documents in a versioned file manager, and runs project management, time sheets, a wiki, bookmarks and news, with CalDAV and CardDAV synchronisation to phones, tablets and desktop clients.

EGroupware is a PHP application installed under /var/www/egroupware and served by the Apache web server with mod_php on port 80, at the vendor's default path /egroupware. Browsing to the instance address redirects there automatically. The application data lives in a MariaDB database whose data directory, /var/lib/mysql, is bind mounted onto a dedicated, independently resizable EBS data volume mounted at /data. EGroupware's own file store, holding uploaded and generated documents, is kept on that same data volume, so all of your collaboration data stays off the operating system disk.

The setup console is completed during the build and locked away from the web, so you land directly on a working sign in page. The administrator account, the database password and EGroupware's setup and configuration passwords are all generated on the first boot of every deployed instance, freshly on each instance, so two instances launched from the same Amazon Machine Image never share a credential. The credentials are written to /root/egroupware-credentials.txt with mode 0600 so that only the root user can read them.

This image installs EGroupware natively on Apache, PHP and MariaDB rather than in the upstream container topology, and cloudimg supports the appliance directly. EGroupware is licensed under the GNU General Public License version 2 or later.

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and port 80 for the web interface
• The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Step 1: Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for EGroupware. Select the cloudimg listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group that opens port 22 from your management network and port 80 for the web interface. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass, while the per instance administrator, database, setup and configuration passwords are generated.

Step 2: Launch the Instance from the AWS CLI

The following block launches an instance from the cloudimg EGroupware Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=egroupware}]'

Step 3: Connect to Your Instance

Connect over SSH using your key pair and the login user for your operating system variant.

ssh -i <key-name>.pem ubuntu@<public-ip>

Step 4: Retrieve the Administrator Password

The administrator password is unique to your instance and was generated on first boot. Read it as root:

sudo cat /root/egroupware-credentials.txt

The file lists the web interface URL, the administrator login name (admin) and the generated password, along with the MariaDB database name and its application password, and the setup and configuration credentials. Keep this file somewhere safe.

Step 5: Sign In to EGroupware

The web interface is served on port 80 by Apache at the vendor path /egroupware. In a browser, go to the instance address, which redirects to the sign in page:

http://<instance-public-ip>/

You can also go straight to http://<instance-public-ip>/egroupware/login.php. Sign in with the user name admin and the password from the credentials file.

EGroupware derives every link from the address you reach it on, so it answers correctly whether you browse by public IP, private IP or a custom domain name, and there is no baked in build time address to change.

Step 6: The Calendar

After signing in you land on the calendar, the heart of the suite. Switch between day, week, month and list views, and create appointments with participants, resources and reminders. Group scheduling shows the free and busy times of the people and resources you invite, and appointments synchronise to external clients over CalDAV.

Step 7: The Address Book

Open the Address Book to keep shared and personal contacts. Each contact holds organisation, role, phone, email and address details across the Organisation, Private and Details tabs, and contacts synchronise to phones and desktop clients over CardDAV.

Step 8: The Application Launcher

Select the grid icon at the top left to open the application launcher, which lists every EGroupware module: calendar, mail, address book, InfoLog tasks and tickets, the file manager, project manager, time sheet, wiki, bookmarks, news and administration. Open any module to start working in it; open modules appear as tabs across the top so you can switch between them.

The Mail module connects to your own external IMAP and SMTP server, which you configure under Admin or the mail account settings; a mail server is not bundled with the appliance. The calendar, address book, InfoLog, file manager and project manager all work with no mail server at all.

Step 9: Administration

Open Admin to manage the platform. From here you create user accounts and groups, set application permissions, define global categories, manage sessions and the access log, clear caches, and review PHP information and the changelog. The account list shows each user's login, name, email and primary group.

Create a user account for each of your colleagues, place them in groups, and grant each group access to the applications it needs, so your team signs in with their own credentials rather than the administrator account.

Step 10: Confirm EGroupware Is Running

Over SSH, confirm the web server and the database are active and that port 80 is listening:

sudo systemctl is-active apache2 mariadb
sudo ss -tlnp | grep ':80 '

You should see both services reported as active and Apache listening on port 80. The health endpoint returns 200:

curl -s -o /dev/null -w 'healthz: %{http_code}\n' http://127.0.0.1/healthz

The MariaDB database listens on the loopback interface only and is never exposed directly. The pre completed setup console at /egroupware/setup/ is denied over HTTP; confirm the lockdown returns a 403:

curl -s -o /dev/null -w 'setup console: %{http_code}\n' http://127.0.0.1/egroupware/setup/

Step 11: The Data Volume

The MariaDB database and EGroupware's file store live on a dedicated EBS volume mounted at /data, with the database bind mounted onto /var/lib/mysql and the file store bind mounted back into the application tree at /var/www/egroupware/files. This keeps your collaboration data off the operating system disk and lets you resize or snapshot it independently. Confirm the mount with:

df -h /data

To grow the data store, expand the EBS volume in the AWS console, then grow the filesystem on the instance with sudo resize2fs on the underlying device. The EGroupware application code under /var/www/egroupware lives on the root volume.

Step 12: Enable HTTPS

The web interface is served over plain HTTP on port 80 by Apache. For production use, place it behind TLS so that the administrator password and your collaboration data are encrypted in transit. Point a domain name at the instance, then obtain a certificate for that domain, for example with a managed certificate on an Application Load Balancer in front of the instance, or with a certificate tool installed on the instance, and configure Apache to listen on 443 with your certificate exactly as the bundled site does for port 80.

Because EGroupware derives its base URL from the request and its stored web server URL is relative, no configuration change is needed when you move to HTTPS: once a certificate is in front of the instance and you browse to the https:// address, EGroupware generates its links over HTTPS automatically. Restrict the security group so that ports 80 and 443 are reachable only from the networks that need to reach the web interface.

Step 13: Backup and Maintenance

Back up the application by snapshotting the /data EBS volume, which captures both the database and EGroupware's file store. You can also take a logical backup of the database over the loopback socket:

sudo mysqldump --protocol=socket egroupware > egroupware-backup.sql

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade and reboot when a new kernel is installed; Apache and MariaDB start automatically on boot.

The setup console is deliberately locked away over HTTP. To perform a major version upgrade you can re enable it temporarily with sudo a2disconf cloudimg-egroupware-lockdown && sudo systemctl reload apache2, and you should re enable the lockdown with a2enconf and reload immediately afterwards.

Support

This image is published and supported by cloudimg. Support covers deployment, user and group and permission setup, connecting your own mail server, LDAP or Active Directory, CalDAV and CardDAV client synchronisation, module configuration, version upgrades, performance tuning, the data volume, TLS and backups. Note that this image runs EGroupware natively on Apache, PHP and MariaDB rather than in the upstream container topology, so cloudimg supports this appliance directly. Contact cloudimg through the support channel listed on the AWS Marketplace listing.