Grocy on Ubuntu 24.04 on Azure User Guide

Overview

Grocy is a popular open source, self hosted groceries and household management solution, an ERP for your home. From an ordinary browser you track your food stock and best before dates, manage your shopping list, store recipes and meal plans, and schedule recurring chores, batteries and equipment, all through one clean web interface backed by a full REST API. The cloudimg image serves Grocy 4.5.0 on a PHP 8.3 and nginx stack over a hardened, fully patched Ubuntu 24.04 LTS base. Grocy stores everything in a self contained SQLite database, so there is no separate database server to run. A unique administrator password is generated on the first boot of every VM and written to a root only file, so no shared or default login ever ships in the image. Backed by 24/7 cloudimg support.

What is included:

• Grocy 4.5.0 served by nginx through the PHP 8.3 front controller, managed by systemd
• The Grocy web interface on :80 with authentication required and demo mode disabled
• A per VM administrator password generated on first boot and recorded in a root only file
• A self contained SQLite datastore, so there is no separate database server to provision
• A dedicated Azure data disk at /var/lib/grocy for the database, configuration and file storage
• nginx.service and php8.3-fpm.service as enabled systemd units
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for larger households and heavier concurrent use. NSG inbound: allow 22/tcp from your management network and 80/tcp for the web interface. Grocy serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Grocy by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name grocy \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the web interface:

az vm open-port --resource-group <your-rg> --name grocy --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm nginx and PHP-FPM are active, along with the one shot first boot service that rotates the administrator password. nginx serves Grocy on port 80.

systemctl is-active nginx php8.3-fpm grocy-firstboot

ss -tlnp | grep ':80 ' | sed 's/  */ /g'

Step 4 - Retrieve the per VM administrator password

Every VM generates its own administrator password on first boot and writes it, along with the login user and URL, to a root only credentials file. Read it with sudo:

sudo cat /root/grocy-credentials.txt

You sign in to Grocy with username admin and the grocy.admin.pass value from this file. You can prove the login works from the command line by establishing an authenticated session with those credentials:

PASS=$(sudo grep '^grocy.admin.pass=' /root/grocy-credentials.txt | cut -d= -f2-); CJ=$(mktemp); curl -s -c "$CJ" -o /dev/null http://127.0.0.1/login; curl -s -c "$CJ" -b "$CJ" -o /dev/null --data-urlencode "username=admin" --data-urlencode "password=$PASS" http://127.0.0.1/login; BODY=$(curl -s -L -b "$CJ" http://127.0.0.1/); rm -f "$CJ"; case "$BODY" in *[Ll]ogout*|*"tock overview"*) echo "login OK";; *) echo "login FAILED";; esac

Step 5 - Sign in to Grocy

Browse to http://<vm-public-ip>/. Grocy opens on its sign in screen. Enter username admin and the password from Step 4.

Step 6 - Track your food stock

After signing in you land on the stock overview. It lists every product you hold, the amount in stock and the next best before date, with colour coding that highlights items expiring soon so you can use them before they go to waste. Use the action buttons on each row to consume, open or add stock.

Step 7 - Manage your shopping list

Open Shopping list from the sidebar to see what needs buying, with quantities and a running total. Grocy can add items automatically when stock drops below the minimum you set for a product, or you can add items by hand with the Add item button.

Step 8 - Schedule chores

Open Chores overview to manage recurring household tasks. Each chore has its own schedule, and Grocy tracks when it was last done and when it is next due, highlighting anything overdue. Use the track button on a row to record that a chore has been completed.

Step 9 - Verify the stack

Confirm the Grocy version, that the services are enabled, and that the web interface answers on port 80:

python3 -c "import json;d=json.load(open('/var/www/grocy/version.json'));print('Grocy', d['Version'])"

systemctl is-enabled nginx php8.3-fpm

curl -s -o /dev/null -w 'grocy HTTP %{http_code}\n' http://127.0.0.1/

Step 10 - Where your data lives

The SQLite database (grocy.db), the configuration and your file storage all live on a dedicated Azure data disk mounted at /var/lib/grocy, separate from the OS disk. This disk is captured into the image and re provisioned on every VM. Confirm the mount and the filesystem:

df -h /var/lib/grocy | tail -1

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/grocy

Security notes

• Grocy serves plain HTTP on port 80. For production, put it behind your own TLS terminating reverse proxy or an Azure Application Gateway with a certificate for your domain, and restrict port 80 in the NSG to trusted networks.
• Authentication is required and demo mode is disabled, so no data is ever seeded and no shared login exists. The per VM administrator password lives in /root/grocy-credentials.txt, readable only by root. Sign in and change it from the user menu if you wish, and keep a copy somewhere safe.
• Grocy exposes a full REST API. Create scoped API keys from Manage API keys for integrations such as Barcode Buddy or Home Assistant rather than sharing your login.
• Keep the VM patched. The image ships fully patched with unattended security upgrades enabled.

Support

cloudimg images come with 24/7 support. If you have any questions about this Grocy image or need help with your deployment, contact us through the cloudimg website.