Ghostfolio on Ubuntu 24.04 on Azure User Guide

Overview

Ghostfolio is an open source wealth management and personal finance dashboard. It brings your accounts together in one place to track portfolios, holdings, performance over time, asset allocation and dividends across multiple accounts and currencies, all through a modern web interface. The cloudimg image runs Ghostfolio the officially supported way, as the upstream container alongside a bundled PostgreSQL and Redis, orchestrated by Docker Compose under systemd and fronted by nginx. Every image is pinned by digest and captured into the VM, so your instance starts in seconds. A unique application salt, session signing key, database password and cache password are generated for each VM on first boot, before the port is reachable, a unique owner administrator is pre seeded so nobody can claim the admin role before you sign in, and public sign up is blocked at the reverse proxy. Backed by 24/7 cloudimg support.

Ghostfolio is a trademark of its respective owner. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by Ghostfolio. It ships the free and open source AGPL 3.0 self hosted core, unmodified.

What is included:

• Ghostfolio v3.29.0 (the AGPL 3.0 self hosted open source core), pinned by image digest
• A bundled PostgreSQL database and a bundled Redis, both pinned by image digest and reachable only inside a private Docker network (never published to a host port)
• Docker Engine (Docker CE) with Ghostfolio published to the loopback interface only, fronted by nginx on port 80
• ghostfolio.service, ghostfolio-firstboot.service and nginx.service as systemd units, enabled and active on boot
• A unique application salt, session signing key, database password, cache password and a pre seeded owner administrator generated per VM on first boot, never baked into the image
• Public sign up disabled at the reverse proxy, so no one can self register on your instance
• A clean, empty database on first boot: no default account, no shipped secret, no prior data
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; increase the size for larger portfolios and heavier market data gathering. NSG inbound: allow 22/tcp from your management network and 80/tcp (and 443/tcp once you add TLS) for the web interface. Ghostfolio serves plain HTTP on port 80; for production, put it behind TLS with your own domain (see the final section).

Step 1 - Deploy from the Azure Marketplace

1. In the Azure portal, choose Create a resource and search the Marketplace for the cloudimg Ghostfolio offer.
2. Select the plan, then Create.
3. On the Basics tab pick your subscription, resource group and region, name the VM, and select Standard_B2s (or larger).
4. Choose SSH public key authentication with admin username azureuser and provide your public key.
5. On the Networking tab, allow inbound 22/tcp from your management network and 80/tcp for the web interface.
6. Review and create. When the VM is running, note its public IP address.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group my-ghostfolio-rg \
  --name ghostfolio \
  --image cloudimg:ghostfolio:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the ports the web interface needs (SSH is opened by default):

az vm open-port --resource-group my-ghostfolio-rg --name ghostfolio --port 80 --priority 900

Step 3 - Connect to your VM

Replace <vm-ip> with your VM's public IP address:

ssh azureuser@<vm-ip>

Step 4 - Confirm the services are running

Ghostfolio, its bundled PostgreSQL and Redis, and nginx all come up automatically on first boot. Confirm they are active:

sudo systemctl is-active docker ghostfolio nginx

Expected output:

active
active
active

The stack runs as three containers on a private Docker network. PostgreSQL and Redis are never published to a host port; only Ghostfolio is published, and only to the loopback interface, with nginx in front on port 80.

Step 5 - Secure by default: the admin is pre seeded and sign up is disabled

In self hosted Ghostfolio the very first account created becomes the administrator. On a public server that is a risk: whoever registers first would own your instance. The cloudimg image closes this two ways. On first boot, before the port is reachable, a unique owner administrator is created and its Security Token is stored for you, so the administrator role is already claimed. Public sign up is then blocked at the reverse proxy, so no attacker can self register at all. The session signing key is unique per VM, so sessions cannot be forged.

You can see the whole posture at a glance. Public sign up is refused, a blank or wrong token is rejected, and only the per VM admin Security Token is accepted:

Read your unique credentials (they are written to a root only file):

sudo cat /root/ghostfolio-credentials.txt

The file holds the application URL and the per VM admin Security Token. Keep it safe.

Step 6 - Sign in to Ghostfolio

Open http://<vm-ip>/ in your browser. You are met with the Ghostfolio landing page. Self hosted Ghostfolio signs in with a Security Token rather than an email and password.

Choose Sign in, paste the GHOSTFOLIO_ADMIN_SECURITY_TOKEN value from the credentials file, tick Stay signed in if you wish, and confirm. You land on the portfolio overview, which shows your total value and performance over time.

Step 7 - Explore your portfolio

The overview is your home base: total portfolio value, performance over your chosen time range, and quick links to holdings, summary, the watchlist and markets. Open Holdings to see every position with its value, allocation, change and performance.

The Portfolio section breaks your wealth down further. Allocations shows how your net worth is split by platform, currency and asset class, with a per holding breakdown underneath.

Step 8 - Add your activities

Ghostfolio builds your portfolio from activities (buys, sells, dividends, fees and cash transactions). Add them from Portfolio, Activities while signed in, or import a CSV. As you add positions, Ghostfolio gathers market data in the background so your holdings, performance and allocation update automatically.

Step 9 - Check the stack health from the command line

Ghostfolio exposes an unauthenticated liveness endpoint that reports whether the application, database and cache are ready. It is handy for monitoring:

curl -s http://127.0.0.1/api/v1/health

Expected output (a healthy stack):

{"status":"OK"}

Step 10 - Adding more people (optional)

This appliance ships with public sign up disabled, so only you can reach the application. If you want to add more people, re enable sign up by removing the location = /api/v1/user block in /etc/nginx/sites-available/ghostfolio, then reload nginx:

sudo nginx -t && sudo systemctl reload nginx

Each new account is a normal, non administrator user with its own isolated portfolio. Only the first account, pre seeded for you on first boot, is the administrator. Re disable sign up by restoring the block and reloading nginx once everyone has an account.

Step 11 - Production: your own domain with TLS

Ghostfolio serves plain HTTP on port 80. For production, point a DNS record at the VM and put Ghostfolio behind TLS so links and sessions use an https origin. A common approach is to add a certificate to nginx with Certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d finance.example.com

Then restart the stack with sudo systemctl restart ghostfolio and restrict the network security group to the sources that need access. See the Ghostfolio documentation for the full production checklist.

Support

Every cloudimg image includes 24/7 support. If you have any questions about deploying or operating Ghostfolio on Azure, contact the cloudimg team through the Azure Marketplace listing or at www.cloudimg.co.uk.