Applications Azure

Flectra 3.0 on Ubuntu 24.04 on Azure User Guide

Last updated: 2026-08-09 | Product: Flectra 3.0 on Ubuntu 24.04 LTS on Azure

Overview

Flectra is a comprehensive open source ERP and CRM suite for growing businesses, developed as a community fork of Odoo and published under the LGPL-3.0 licence. It brings the full business suite together in one application: a CRM with a sales pipeline, sales quotations and orders, invoicing and full double entry accounting, inventory and warehouse management, purchasing, projects, a point of sale, human resources and an integrated website and eCommerce module. Unlike the community edition of the project it forked from, Flectra ships the complete suite with no core features held back behind a paid tier and no licence key to activate.

The cloudimg image installs Flectra 3.0 from its LGPL-3.0 source into a dedicated Python virtual environment, reverse proxied behind nginx with a PostgreSQL 16 database, then locks it down for a marketplace appliance. Flectra is bound to loopback 127.0.0.1:8069 (HTTP) and 127.0.0.1:8072 (live chat / websocket) and never exposed directly; nginx on port 80 is the only way in, plus an unauthenticated /healthz endpoint for load balancer probes. The image is secure by default: the Odoo family default admin/admin login and the database master password are never present in the image, and on the first boot of every VM a fresh PostgreSQL password, a fresh database master password and a unique random administrator password are generated and written to a root only file. Demonstration data is pre loaded so the CRM pipeline, sales orders and accounting are populated out of the box. Backed by 24/7 cloudimg support.

Flectra is not affiliated with or endorsed by Odoo S.A.

What is included:

Flectra 3.0 installed from source in a dedicated Python virtual environment and running as the flectra systemd service
The full Flectra web suite on :80, fronted by nginx, with Flectra bound to loopback only
A PostgreSQL 16 database on loopback holding the ERP, with a per VM database password generated on first boot
Pre loaded demonstration data (CRM opportunities, sales orders, products, customer invoices) so the suite is populated on first boot
No default account: admin/admin never ships, the administrator is created on first boot with a unique random password, and the database master password is generated per VM, never baked into the image
proxy_mode and a per VM base URL so sign in works on the public IP address or a custom domain
An unauthenticated /healthz endpoint for Azure Load Balancer health probes
postgresql.service, flectra.service and nginx.service as systemd units, enabled and active
24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point. NSG inbound: allow 22/tcp from your management network, 80/tcp for the web application, and 443/tcp if you add TLS. Flectra serves plain HTTP on port 80; for production use, terminate TLS in front of it with your own domain and restrict access to trusted IP ranges (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Flectra by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name flectra \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 to your network so you can reach the web interface:

az vm open-port --resource-group <your-rg> --name flectra --port 80

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active postgresql flectra nginx

All three report active. Flectra runs on the loopback addresses 127.0.0.1:8069 (HTTP) and 127.0.0.1:8072 (websocket); nginx fronts it on port 80 and PostgreSQL is bound to loopback. The application is never bound to a public interface, so nginx is the only way in.

ss -tln | grep -E '127.0.0.1:8069|:80 ' || true

The postgresql, flectra and nginx services reporting active, Flectra listening on loopback 127.0.0.1:8069, nginx on port 80, the login page returning 200 and no swap in the image

Step 5 - Retrieve your admin and master passwords

Flectra uses a web login. The username is admin and a unique password is generated on the first boot of your VM, along with a database master password that gates database management. Both are written to a root only file:

sudo cat /root/flectra-credentials.txt 2>/dev/null || echo '(generated on first boot; run this on your own VM)'

This file contains FLECTRA_ADMIN_USER, FLECTRA_ADMIN_PASSWORD, FLECTRA_MASTER_PASSWORD, FLECTRA_DB and the FLECTRA_URL to open in a browser. The file is mode 0600 root:root, and neither the default admin/admin login nor a default master password ever exists in the image, so no shared or default credential is present. Store the passwords somewhere safe and change the admin password after first sign in (see Maintenance).

The secure per VM Flectra configuration showing proxy_mode, list_db disabled and the admin_passwd and db_password masked because they are generated per VM on first boot

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires authentication, so it is safe for an Azure Load Balancer health probe.

Step 7 - Confirm the default login is rejected

The Odoo family default admin/admin is deliberately removed from this image. You can prove it: an authentication attempt with admin/admin is rejected (no user id returned), while the login page itself stays reachable so you can sign in with your per VM password:

echo "login page: $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/web/login)"
DEFAULT_UID=$(curl -s -m 20 -H 'Content-Type: application/json' -X POST \
  --data '{"jsonrpc":"2.0","params":{"db":"flectra","login":"admin","password":"admin"}}' \
  http://127.0.0.1/web/session/authenticate \
  | python3 -c 'import sys,json;r=(json.load(sys.stdin).get("result") or {});print(r.get("uid"))' 2>/dev/null || echo None)
echo "admin/admin -> uid ${DEFAULT_UID} (None or False means rejected)"

It prints login page: 200 and admin/admin -> uid None, confirming the default credential does not work. Sign in instead with admin and the FLECTRA_ADMIN_PASSWORD from Step 5.

The Flectra login round trip proof: the default admin/admin credential is rejected with no user id, and the per VM admin password authenticates and returns a valid user id

Step 8 - Confirm the installed version and demo data

Flectra 3.0 runs on Python in a dedicated virtual environment. Confirm the runtime and that the demonstration data loaded:

/opt/flectra/venv/bin/python --version
sudo -u postgres psql -d flectra -tAc "select 'CRM leads: '||count(*) from crm_lead"
sudo -u postgres psql -d flectra -tAc "select 'Sales orders: '||count(*) from sale_order"
sudo -u postgres psql -d flectra -tAc "select 'Customer invoices: '||count(*) from account_move where move_type='out_invoice'"

It reports Python 3.12 and populated CRM, Sales and Accounting data, so the suite is non empty on first boot.

The pinned Flectra 3.0 source commit, the Python runtime, the wkhtmltopdf PDF engine and the counts of pre loaded demo CRM leads, sales orders, customer invoices and products

Step 9 - Sign in to Flectra

Browse to http://<vm-public-ip>/. Flectra shows its sign in page. Enter admin and the FLECTRA_ADMIN_PASSWORD from Step 5, then select Log in.

The Flectra sign in page served over nginx

Step 10 - Explore the CRM pipeline

Open the CRM app. The pipeline is pre loaded with demonstration opportunities across the New, Qualified, Proposition and Won stages, each with an expected revenue, tags, priority and next activity, so you can see how the sales pipeline looks and works before adding your own leads.

The Flectra CRM pipeline populated with demonstration opportunities across the New, Qualified, Proposition and Won stages with expected revenue and activities

Step 11 - Review sales orders

Open the Sales app. The demonstration data includes sales orders with customers, salespeople, amounts and invoicing status, so quotations, orders and the order to invoice flow are ready to explore.

The Flectra Sales app showing a list of demonstration sales orders with customers, salespeople, totals and invoice status

Step 12 - Review accounting and invoices

Open the Accounting app. Flectra ships full double entry accounting in the community edition, and the demonstration data includes posted customer invoices with amounts, due dates and payment status. This is where you manage invoicing, bills, payments and the chart of accounts.

The Flectra Accounting app showing demonstration customer invoices with amounts, due dates, payment status and posted state

Step 13 - Build your business

The image ships demonstration data so the suite is not empty. When you are ready, use the Apps menu to install additional modules (Inventory, Purchase, Project, Website, Point of Sale, HR), and use each app to configure your own company, products, customers and chart of accounts. To start from clean data, create a new database from the database manager using your FLECTRA_MASTER_PASSWORD, or remove the demonstration records from within each app. See the Flectra documentation for configuring the suite for your business.

Maintenance

Passwords: the administrator password and the database master password are generated on first boot and stored in /root/flectra-credentials.txt (mode 0600 root:root). Change the admin password from within Flectra under the user preferences, and the master password by editing admin_passwd in /etc/flectra/flectra.conf followed by sudo systemctl restart flectra.
Restrict access: Flectra serves plain HTTP on port 80. For production, restrict access to trusted IP ranges in your Network Security Group, and front it with TLS (for example certbot with your own domain) terminating on :443. proxy_mode is already enabled so Flectra honours the X-Forwarded-* headers from nginx.
Loopback binding: Flectra is bound to 127.0.0.1:8069 and 127.0.0.1:8072 in /etc/flectra/flectra.conf, so nginx is the only path in. Keep it that way - do not change http_interface to a public interface.
Database: the ERP lives in the flectra PostgreSQL database on loopback. Back it up with sudo -u postgres pg_dump flectra > flectra.sql, together with the filestore under /var/lib/flectra. The database password is generated on first boot and held in /etc/flectra/flectra.conf (mode 0640 root:flectra).
Configuration: application settings are read from /etc/flectra/flectra.conf; restart with sudo systemctl restart flectra after edits. workers is set to a conservative value that fits a Standard_B2s; raise it on a larger VM for more concurrency.
Upgrades: Flectra is installed from its 3.0 source branch under /opt/flectra/src. To take the latest 3.0 fixes, update the checkout and restart the service.
Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.