Engelsystem on Ubuntu 24.04 on Azure User Guide

Overview

Engelsystem is the open-source event volunteer and shift management system used by the Chaos Communication Congress and many other large events to coordinate their helpers, or "angels": shift planning, angel/volunteer signup, roles (angel types), a worklog, vouchers and news, all from a web console. The cloudimg image deploys the official upstream Engelsystem 3.7.0 release on a full LAMP stack from the Ubuntu 24.04 repositories (nginx, PHP 8.3-FPM and MariaDB), runs the database migrations at build time so there is no setup wizard to complete, seeds a small demo event so the shift plan is populated the moment you sign in, stores the MariaDB database on a dedicated Azure data disk, and rotates the database password and the administrator account on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• Engelsystem 3.7.0 served on port 80 by nginx via the PHP 8.3-FPM FastCGI socket
• The official upstream release, with Composer dependencies and the webpack-built frontend assets already in place (no build toolchain required)
• A seeded demo event (locations, angel types and shifts) so the shift plan is populated on first boot
• MariaDB on loopback with its data directory on a dedicated Azure data disk at /var/lib/engelsystem
• A per-VM database password and a unique administrator account generated on first boot - the upstream default admin/asdfasdf is never shipped
• nginx.service, php8.3-fpm.service and mariadb.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. NSG inbound: allow 22/tcp from your management network and 80/tcp for the Engelsystem web interface (front with TLS for public exposure - see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Engelsystem by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create -> Create.

Step 2 - Deploy with the Azure CLI

az vm create \
  --resource-group <your-rg> --name engelsystem \
  --image <cloudimg-engelsystem-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name engelsystem --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the LAMP stack is running

On first boot Engelsystem rotates its database password, resets the administrator account to a fresh per-VM password, and starts the stack.

systemctl is-active nginx php8.3-fpm mariadb

All three report active.

You can confirm the component versions and that the app answers on port 80:

cat /var/www/engelsystem/storage/app/VERSION
php -v | head -1
mariadb --version
curl -s -o /dev/null -w 'login page HTTP %{http_code}\n' http://127.0.0.1/login

The sign-in page returns HTTP 200. A request to / while signed out redirects to /login, and MariaDB listens on loopback only.

The document root is public/ only - the application code and config/config.php (which holds the database password) sit outside it and are never served over HTTP.

Step 5 - Retrieve the administrator password

The administrator account is unique to your VM and is generated on first boot. Read it as root:

sudo cat /root/engelsystem-credentials.txt

The file contains the login (admin), the sign-in URL and a unique password, plus the database name, user and password. The upstream default password asdfasdf is not present on any cloudimg VM - it is replaced during the build and again on first boot, and is rejected at the real login form.

Step 6 - Sign in

Browse to http://<vm-public-ip>/login and sign in with admin and the password from the credentials file.

Step 7 - The dashboard

After signing in you land on the dashboard. The image seeds a welcome message so there is real content to see immediately; from the menu (top right) you reach the shift plan, angel types, users, and the admin settings.

Step 8 - The shift plan

The shift plan is the heart of Engelsystem. The image seeds a small demo event - three locations (Main Hall, Infodesk, Kitchen), three angel types and a handful of shifts - so the plan is populated the first time you open it rather than showing an empty grid. Filter by location, angel type and occupancy, and sign up for shifts.

Step 9 - Angel types and roles

Open Angel types to manage the volunteer roles for your event. Each angel type controls whether angels may self-sign-up, whether it is restricted, and any requirements (for example a driving licence or a food-hygiene certificate).

To set up your own event, edit or delete the seeded locations, angel types and shifts, define your schedule, and post your own news. The demo content is there only to get you started.

Step 10 - The dedicated data disk

The MariaDB database - every user, shift, role and worklog entry - lives on a dedicated Azure data disk mounted at /var/lib/engelsystem, separate from the OS disk. This keeps your event data independent of the OS image and lets you resize the disk as your event grows.

df -h /var/lib/engelsystem
findmnt /var/lib/engelsystem

The per-VM first-boot service and the disk-backed database are shown below.

Step 11 - Enabling HTTPS

For any public deployment, front Engelsystem with TLS. Point a DNS A record at your VM's public IP, then install a certificate with Certbot and the nginx plugin. Run the following as prose-driven steps on your VM (replace the placeholders with your real values; do not paste them verbatim):

• Install Certbot: sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
• Obtain and install a certificate for your domain, supplying your contact email when prompted, by running certbot with the nginx plugin for your-domain.example.com.
• Engelsystem derives its base URL from the request, so it automatically serves generated links over https:// once TLS is terminated in front of it. No configuration change is required.

Certbot installs a renewal timer automatically; certificates renew without further action.

Step 12 - Maintenance

• Updates: the OS continues to receive unattended security updates. Engelsystem itself is upgraded by deploying a newer release and running php /var/www/engelsystem/bin/migrate to apply any new database migrations.
• Backups: back up the MariaDB engelsystem database (for example with mysqldump), which holds all of your event data.
• Logs: web server logs are under /var/log/nginx/; PHP-FPM logs are under /var/log/php8.3-fpm.log.

Support

This image is maintained by cloudimg and backed by 24/7 support. If you need help deploying or operating Engelsystem on Azure, contact the cloudimg team through the cloudimg website.