InstantCMS on Ubuntu 24.04 on Azure User Guide

Overview

InstantCMS is a full open source content management system for building social networks, community portals and content driven websites. It provides user accounts, profiles and groups, multiple content types, blogs, articles and photo galleries, comments, private messaging, moderation and access control, configurable widgets and multi template theming, all managed through a complete administration backend. The cloudimg image delivers InstantCMS fully installed and configured on Ubuntu 24.04 — served by Apache over HTTPS with PHP 8.3 (mod_php and OPcache), backed by MySQL 8.0. The application is already installed and the database schema built, so the portal and admin answer the moment the instance boots, with no setup wizard to complete. Backed by 24/7 cloudimg support.

What is included:

• InstantCMS 2.18.2 (GPLv2 licensed), installed to /var/www/instantcms
• Apache 2.4 (TLS on :443, with :80 redirected to HTTPS) + PHP 8.3 (mod_php with OPcache) + MySQL 8.0, all from Ubuntu 24.04 main
• A per-VM self-signed TLS certificate generated on first boot, so the portal and admin load over a secure context
• A systemd timer (instantcms-cron.timer) that runs InstantCMS's scheduled jobs (cron.php) every minute
• Per-VM administrator password and MySQL password generated at first boot and written to a root-only file — the image ships no known credential and no pre-authenticated session
• apache2.service, mysql.service and instantcms-cron.timer as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point; scale up for more members, more content or heavier traffic. NSG inbound: allow 22/tcp from your management network and 443/tcp (HTTPS) plus 80/tcp (which redirects to HTTPS) from your members.

Step 1 — Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for InstantCMS by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTPS (443). Then Review + create and Create.

Step 2 — Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name instantcms \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name instantcms --port 443 --priority 1010

Step 3 — Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 — Confirm the services are running

The three services that back InstantCMS should all report active, and the portal answers over HTTPS while the plain HTTP port redirects to it. Because InstantCMS serves the site on the address configured at first boot, the local check below pins that address to the loopback interface:

systemctl is-active apache2 mysql instantcms-cron.timer
BASE=$(sudo grep '^instantcms.url=' /root/instantcms-credentials.txt | cut -d= -f2-)
HOST=$(printf '%s' "$BASE" | sed -E 's#https?://##; s#/.*##')
curl -ks -o /dev/null -w 'portal https -> %{http_code}\n' --resolve "$HOST:443:127.0.0.1" "https://$HOST/"
curl -s  -o /dev/null -w 'http redirect -> %{http_code}\n' http://127.0.0.1/

Expected: three lines of active, then portal https -> 200 and http redirect -> 301.

Step 5 — Retrieve your administrator credentials

On the first boot of every VM, a one-shot service (instantcms-firstboot.service) generates values that are unique to that VM: a fresh administrator password and a fresh MySQL password. It also generates a per-VM self-signed TLS certificate and sets the VM's own address as the portal base URL, and purges the installer's seeded session token so no pre-authenticated session ships. No shared or default credentials ship in the image.

sudo cat /root/instantcms-credentials.txt

The file (mode 0600, root only) contains the administrator login email (instantcms.admin.email, which is admin@example.com), the administrator password (instantcms.admin.pass), the login URL (instantcms.admin.login), the portal URL, and the database credentials.

The image is secure by default: a blank, guessed or default password is rejected, while the per-VM administrator from the credentials file authenticates successfully. You can prove both from the VM's own shell using the exact password check InstantCMS runs at login (password_verify against the stored bcrypt hash on the admin account):

P=$(sudo grep '^instantcms.admin.pass=' /root/instantcms-credentials.txt | cut -d= -f2-)
HASH=$(sudo mysql -N -B instantcms -e "SELECT password_hash FROM cms_users WHERE id=1;")
php -r 'printf("per-VM admin     -> %s\n", password_verify($argv[1],$argv[2])?"ACCEPTED":"REJECTED");
        printf("default password -> %s\n", password_verify("admin",   $argv[2])?"ACCEPTED":"REJECTED");
        printf("blank password   -> %s\n", password_verify("",        $argv[2])?"ACCEPTED":"REJECTED");' "$P" "$HASH"

Expected: per-VM admin -> ACCEPTED, default password -> REJECTED, blank password -> REJECTED.

Step 6 — Open the portal

Browse to https://<vm-public-ip>/ to see your community portal. Because the image ships a per-VM self-signed certificate, your browser shows a one-time certificate warning on first visit — click through it, or install your own domain certificate into /etc/apache2/ssl/. The portal ships with a clean, empty community ready for your own members and content.

Step 7 — Sign in to the admin panel

Sign in at the login URL from the credentials file (instantcms.admin.login), for example https://<vm-public-ip>/auth/login, using the administrator email (admin@example.com) and the password from the credentials file.

After signing in, open the control panel at https://<vm-public-ip>/admin, from which you manage users and groups, content types and content, comments and moderation, widgets and templates, components, and site configuration.

Step 8 — Confirm the version and the stack

awk -F' *= *' '/^(major|minor|build)/{v=v (v?".":"") $2} END{print "InstantCMS "v}' /var/www/instantcms/system/config/version.ini
php -r 'echo "PHP ".PHP_VERSION."\n";'
mysql --version
echo "first-boot service: $(systemctl is-active instantcms-firstboot.service)"

Expected: InstantCMS 2.18.2, PHP 8.3.x, MySQL 8.0.x, and the first-boot service active.

First-boot service and security model

A one-shot instantcms-firstboot.service runs After=mysql.service and Before=apache2.service, so the per-VM credentials and TLS certificate are in place before the first page is ever served. It rotates the MySQL password in lock-step with InstantCMS's stored database configuration (system/config/config.php), rotates the administrator password (a bcrypt hash on the admin account), sets the portal base URL from the VM's own address, purges any seeded session tokens, and writes the credentials file at mode 0600 (root only) before dropping a sentinel so it runs exactly once.

systemctl status instantcms-firstboot.service --no-pager | head -6
sudo stat -c '%a %U:%G %n' /root/instantcms-credentials.txt

Administration and scheduled jobs

InstantCMS scheduled tasks — feeds, notifications, cleanup — run through instantcms-cron.timer, which invokes php /var/www/instantcms/cron.php every minute, so leave that timer enabled. After a configuration change you can clear the file cache by removing the cache directory:

sudo -u www-data rm -rf /var/www/instantcms/cache/*

Enabling HTTPS with your own domain

The image already serves HTTPS with a per-VM self-signed certificate. For production, point a real domain at the VM's public IP, open 443/tcp in the NSG, then replace the self-signed certificate with a trusted one using Let's Encrypt (replace the domain):

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d your-domain.com

After the certificate is issued, set your domain as the portal base URL so InstantCMS generates correct absolute links, then clear the cache:

sudo php -r '$f="/var/www/instantcms/system/config/config.php";$c=include $f;$c["host"]="https://your-domain.com";$c["upload_host"]="https://your-domain.com/upload";file_put_contents($f,"<?php\n\nreturn ".var_export($c,true).";\n");'
sudo -u www-data rm -rf /var/www/instantcms/cache/*

Backup and maintenance

The database lives in MySQL and the application tree, including uploaded media, under /var/www/instantcms — snapshot the OS disk in Azure for a point-in-time backup, or dump the database with (the database password is in the credentials file):

sudo mysqldump instantcms > instantcms-backup.sql

Keep the OS patched with sudo apt update && sudo apt upgrade (unattended security upgrades are enabled by default). The stack restarts cleanly with sudo systemctl restart apache2 mysql instantcms-cron.timer.

Support

This image is backed by 24/7 cloudimg support. Contact us by email and chat for help with InstantCMS deployment, upgrades, template and theme development, component and widget installation, user and content management, moderation and access control, performance tuning and caching, and database administration.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.