Applications Azure

Group-Office Groupware and CRM on Ubuntu 24.04 on Azure User Guide

Last updated: 2026-07-20 | Product: Group-Office Groupware and CRM on Ubuntu 24.04 LTS on Azure

Overview

Group-Office is a mature open source groupware and CRM suite used by businesses, agencies and public sector teams to run shared email, calendars, contacts, documents and projects on infrastructure they control. It brings together webmail, shared and personal address books, a group calendar with resource booking and free or busy scheduling, a versioned file store, task and note management, a project and time tracking module, and a built in CRM for companies, contacts and support tickets, all behind one sign in with fine grained per group permissions. Calendars and contacts synchronise to phones, tablets and desktop clients over CalDAV and CardDAV, and email is handled by connecting Group-Office to the IMAP and SMTP servers you already run.

The cloudimg image ships Group-Office 26 served by Apache and PHP 8.3 on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server so the appliance is complete and useful on its own. The installer is pre completed and the installer web path is locked away, so the suite is ready the moment the instance boots. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306) and keeps its data on a dedicated Azure data disk. A unique administrator password is generated on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

Group-Office 26 Community edition served by Apache with PHP 8.3, managed by systemd
A bundled MariaDB server holding the Group-Office database, already installed and ready
The installer pre completed and the installer web path locked away behind a denial, so no installer is ever exposed
A per VM administrator password generated on first boot and recorded in a root only file
No shipped default login: every password ships rotated to a discarded random and the real per VM values are set on first boot
The Group-Office database and file store kept on a dedicated Azure data disk you can snapshot independently

Group-Office Community edition is free and open source software licensed under the GNU Affero General Public License version 3.

Prerequisites

An Azure subscription and either the Azure portal or the Azure CLI (az)
An SSH key pair to administer the VM
A network security group that allows inbound TCP 80 (and 443 if you add TLS) from the clients that need the web interface, plus TCP 22 from your admin location

Step 1 - Deploy from the Azure Marketplace

Find the cloudimg Group-Office Groupware and CRM on Ubuntu 24.04 LTS offering in the Azure Marketplace, choose the recommended Standard_B2s size (or larger for more users), attach it to your virtual network, and allow inbound TCP 80 and 22. Group-Office runs comfortably on Standard_B2s for a small team; scale up as the number of users grows.

Step 2 - Deploy from the Azure CLI

The commands below create a resource group, the VM from the cloudimg image, and an inbound rule for HTTP. Replace the image URN or plan details with the ones shown on the Marketplace listing page.

az group create --name group-office-rg --location uksouth

az vm create \
  --resource-group group-office-rg \
  --name group-office \
  --image <marketplace-image-urn-from-listing> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

az vm open-port --resource-group group-office-rg --name group-office --port 80 --priority 900

# When the VM is running, note its public IP address:
az vm show -d --resource-group group-office-rg --name group-office --query publicIps -o tsv

Step 3 - Confirm the services are running

SSH in as azureuser and confirm the web server, database and first boot job are healthy. Group-Office is served by Apache with PHP, backed by a local MariaDB, and a one shot first boot service generates the per VM secrets.

systemctl is-active apache2 mariadb group-office-firstboot.service

Expected output (the first boot service reports active once it has completed on the first boot of the VM):

active
active
active

You can also confirm the health endpoint, that the site redirects into the app, and that the installer is denied:

curl -s -o /dev/null -w 'healthz: %{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'app: %{http_code}\n' -L http://127.0.0.1/groupoffice/
curl -s -o /dev/null -w 'installer: %{http_code}\n' http://127.0.0.1/groupoffice/install/install.php

healthz: 200
app: 200
installer: 403

The apache2 and mariadb services reporting active with the Group-Office first boot job completed, the healthz endpoint returning 200, the application returning 200 and the pre completed installer path returning 403 forbidden

Step 4 - Retrieve the per VM administrator password

Every VM generates its own administrator and database passwords on first boot and writes them to a root only file. Read it over SSH:

sudo cat /root/group-office-credentials.txt

You will see the administrator user (admin), the generated administrator password, and the loopback MariaDB connection details. These values are unique to your VM.

The per VM Group-Office credentials file showing the admin login user, the generated administrator password, and the loopback MariaDB database, user and password, all unique to this VM

Step 5 - Sign in

Browse to your VM. Group-Office is served at the /groupoffice path, and the site root redirects there automatically:

http://<your-vm-public-ip>/groupoffice/

Sign in with admin and the password from the credentials file. The image is address agnostic, so it works whether you reach it by public IP, private IP, a DNS name, or behind a TLS terminating proxy.

The Group-Office sign in page showing the username and password fields and the login button over the Group-Office branding

After signing in you land on the Group-Office desktop, with the module launcher giving access to email, the calendar, contacts, notes, tasks, files and the CRM.

The Group-Office main screen signed in as the administrator, showing the module launcher and the account menu after a successful login

Step 6 - Contacts and the CRM

Open Contacts (the address book) from the module launcher. Group-Office ships with a Shared and a Users address book. Create a contact and it is stored in the local database on the data disk; the same contacts power the CRM, CardDAV synchronisation and the email client's autocomplete.

The Group-Office address book showing an address book with a contact created through the interface, the contact detail panel, and the list columns for name, organisation and email

Group-Office also provides a built in CRM under the CRM module, where companies, contacts and support tickets are linked together, so a small team can run sales and support alongside the rest of the suite.

Step 7 - The calendar

Open Calendar from the module launcher. The group calendar supports personal and shared calendars, resource booking, recurring events and free or busy scheduling, and synchronises to phones, tablets and desktop clients over CalDAV.

Step 8 - Connect your own mail server

The email module is a webmail client, not a mail server. Under Email, add an account pointing at the IMAP and SMTP servers you already run. Group-Office then reads and sends mail through your existing infrastructure while keeping addresses, calendars and files in one place. The rest of the suite (calendar, contacts, files, notes, tasks and CRM) works fully with no mail server configured.

Step 9 - No known or default credentials

This image ships with no usable default login. During the build every password is rotated to a discarded random value, and the real per VM administrator and database passwords are generated on the first boot of each VM and written to the root only credentials file. You can confirm the security posture on the VM: the per VM administrator authenticates through Group-Office's own JMAP authentication endpoint, and blank or weak guesses are rejected.

sudo bash /usr/local/sbin/group-office-cred-roundtrip.sh

OK per-VM admin authenticates via JMAP; weak guesses rejected; contact create+read round-tripped

The check also creates and reads back a contact through Group-Office's own API, proving the groupware is fully functional end to end.

The Group-Office credential round trip confirming the per VM administrator authenticates via Group-Office's own JMAP auth path, that blank and weak guesses are rejected, and that a contact create and read back round trips successfully

Step 10 - Verify the stack and where your data lives

Group-Office's application code lives under /usr/share/groupoffice and is shipped stock and unmodified from the vendor's own package. All configuration is kept externally in /etc/groupoffice/config.php. The database and the file store live on a dedicated ext4 data disk mounted at /data: the MariaDB datadir at /var/lib/mysql is bind mounted onto /data/mysql, and Group-Office's file_storage_path is on /data/groupoffice/data.

findmnt /data
findmnt /var/lib/mysql
grep file_storage_path /etc/groupoffice/config.php

The installed Group-Office release, the ext4 data disk mounted at /data, the MariaDB datadir bind mounted onto the data disk, and the Group-Office file storage path pointing at the data disk

Because the database and files live on the data disk, you can snapshot, resize or detach it independently of the operating system disk.

Adding your own domain and TLS

For production, put Group-Office behind HTTPS. Point a DNS name at the VM, allow inbound TCP 443, and install a certificate. The quickest route is Certbot with the Apache plugin:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d your-domain.example.com

Group-Office uses relative URLs, so it works behind a TLS terminating reverse proxy or the Certbot Apache configuration with no application changes.

Upgrading

Group-Office is installed from the vendor's own APT repository. To upgrade the database schema after a package update, use Group-Office's own command line tool (the web installer stays denied):

sudo apt-get update && sudo apt-get install --only-upgrade groupoffice
sudo -u www-data php /usr/share/groupoffice/cli.php core/System/upgrade

Backing up

Back up the MariaDB database and the file store, both of which live on the data disk:

sudo mariadb-dump --protocol=socket -uroot groupoffice | gzip > groupoffice-$(date +%F).sql.gz
sudo tar czf groupoffice-files-$(date +%F).tar.gz -C /data/groupoffice data

An Azure managed disk snapshot of the data disk captures both together.

Security notes

The bundled MariaDB listens only on 127.0.0.1:3306 and is never exposed to the network.
The Group-Office web installer is denied over HTTP; upgrades are performed on the command line.
Every credential is unique per VM and generated on first boot; nothing ships with a shared or default password.
Keep the OS patched with sudo apt-get update && sudo apt-get upgrade; unattended security updates are enabled by default.
Restrict inbound access with your network security group and put the site behind HTTPS before exposing it to the internet.

Corresponding source (AGPL)

Group-Office Community edition is licensed under the GNU Affero General Public License version 3. In line with section 13 of that licence, the complete corresponding source for the version shipped in this image (Group-Office 26.0.40) is published by the upstream project at:

https://github.com/Intermesh/groupoffice/releases/tag/v26.0.40

The application under /usr/share/groupoffice is the stock vendor package and is not modified by cloudimg; only external configuration is added.

Trademark

Group-Office is a product of Intermesh BV. This image packages the open source Community edition and is not affiliated with or endorsed by Intermesh BV. All trademarks are the property of their respective owners. cloudimg provides the packaging, hardening and support for this image.

Support

cloudimg provides 24/7 support for this image by email at support@cloudimg.co.uk and via live chat. We help with deployment, initial configuration, connecting your own mail server, LDAP or Active Directory, CalDAV and CardDAV client synchronisation, upgrades, TLS setup, data disk management and backups.