kivitendo ERP on Ubuntu 24.04 on Azure User Guide

Overview

kivitendo is a mature, free and open source web based ERP system built around double entry accounting, and is the community continuation of the long established Lx Office and SQL Ledger projects. It brings customers and vendors, quotations, sales and purchase orders, delivery orders, invoices, articles, inventory, projects and the general ledger together in one browser interface, so a business can run its whole order to cash and accounting process from one place. The cloudimg image ships kivitendo served by Apache with mod_fcgid on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local PostgreSQL server, a ready to use authentication database and a company dataset, so the appliance is complete and useful on its first boot. kivitendo is served on port 80. The bundled PostgreSQL listens only on the loopback interface (127.0.0.1:5432). A unique login password, a unique administration password and a unique database secret are generated on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• kivitendo served by Apache 2 with mod_fcgid through its FastCGI dispatcher, managed by systemd
• A bundled PostgreSQL 16 server holding the kivitendo databases, already installed and initialised
• An authentication database and a fully migrated company dataset with a standard chart of accounts, created for you
• The kivitendo background task server running as a systemd service
• kivitendo served on :80, with the login screen reachable at /
• A per VM login user password and a per VM administration password generated on first boot and recorded in a root only file
• No shipped default login: kivitendo's default admin123 administration password is replaced by a unique per VM secret, and no known or blank credential authenticates
• A per VM PostgreSQL secret: the database password is also rotated on first boot, so nothing is baked into the image
• PostgreSQL bound to 127.0.0.1 only, never exposed to the network
• postgresql.service, apache2.service and kivitendo-task-server.service as enabled systemd units
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for larger or busier instances. NSG inbound: allow 22/tcp from your management network and 80/tcp for kivitendo. kivitendo serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain. The bundled PostgreSQL is never exposed: it listens on 127.0.0.1 only, so port 5432 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for kivitendo by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80), then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name kivitendo \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to kivitendo:

az vm open-port --resource-group <your-rg> --name kivitendo --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm PostgreSQL, Apache and the task server are all active. Note that PostgreSQL listens only on 127.0.0.1:5432 while Apache serves kivitendo on port 80.

systemctl is-active postgresql apache2 kivitendo-task-server

ss -tln | grep -E ':80 |:5432 '

Step 4 - Retrieve the per VM credentials

Every VM generates its own kivitendo login and administration passwords on first boot and writes them, along with the login user and the URLs, to a root only credentials file. Read it with sudo:

sudo cat /root/kivitendo-credentials.txt

You sign in to kivitendo as user kivitendo with the KIVITENDO_USER_PASSWORD from this file. The separate KIVITENDO_ADMIN_PASSWORD protects the administration area, where you manage clients, users and the database. On the box itself you can also run sudo -u postgres psql kivitendo to reach the company dataset directly over the local socket.

Step 5 - Sign in to kivitendo

Browse to http://<vm-public-ip>/. You land on the kivitendo login screen. Sign in with username kivitendo, the password from Step 4, and the preselected client.

Step 6 - The kivitendo main menu

Once signed in you land on the kivitendo main menu. Across the top you have Master Data, Sales, Purchases, Warehouse, General Ledger and the System and Reports areas, giving you the whole order to cash and accounting workflow. From Master Data you add and search customers, vendors and articles; from Sales and Purchases you raise quotations, orders and invoices.

Step 7 - Work with customers and articles

Open Master Data then Add Customer to create a customer record, giving it a name and any billing, contact and tax details, and save. kivitendo assigns a customer number automatically. Reports then Customers lists what you have, and the same pattern under Add Part and Add Service manages your articles. These master data records are the foundation for quotations, orders and invoices.

Step 8 - The administration area

Open the administration area at http://<vm-public-ip>/controller.pl?action=Admin/login and sign in with the KIVITENDO_ADMIN_PASSWORD from Step 4. From here you manage clients (company datasets), users and their passwords, user groups and their rights, and you can create further datasets. This is where you tailor kivitendo's access model to your team.

Step 9 - No known or default credentials

kivitendo ships with a well known default administration password of admin123. The cloudimg image removes it: the administration password, the login user password and the database secret are all given unique per VM values on first boot, and no known or blank credential authenticates. You can prove this with the built in round-trip check, which confirms the per VM login user signs in through kivitendo's web login while a blank password and the admin123 default and common weak guesses are all rejected:

sudo -u postgres psql -d kivitendo_auth -tAc "SELECT login FROM auth.\"user\""

sudo bash /usr/local/sbin/kivitendo-cred-roundtrip.sh

Step 10 - Verify the stack and where your data lives

Confirm the kivitendo version and the databases. The bundled PostgreSQL holds two databases, kivitendo_auth (the authentication database with users, groups and the client registry) and kivitendo (the company dataset with your customers, vendors, articles and the general ledger), so all of your ERP data is kept on the VM:

cat /var/www/kivitendo-erp/VERSION

sudo -u postgres psql -tAc "SELECT datname FROM pg_database WHERE datname LIKE 'kivitendo%'"

sudo -u postgres psql -d kivitendo -tAc "SELECT 'customers = '||count(*) FROM customer UNION ALL SELECT 'accounts = '||count(*) FROM chart"

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. For production you should front kivitendo with your own domain and a TLS certificate, terminating TLS with Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer with a certificate for your domain, and pointing it at the VM's port 80.

Security notes

• kivitendo serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS terminating reverse proxy or Azure Application Gateway with a certificate for your domain.
• The bundled PostgreSQL listens on 127.0.0.1 only and is never reachable from the network. Administer it through kivitendo or over SSH with sudo -u postgres psql kivitendo.
• The login password, the administration password and the database secret are unique per VM, and no known or blank credential authenticates. Keep /root/kivitendo-credentials.txt protected and change the passwords from within kivitendo if you share access.
• Restrict inbound 80/tcp in your NSG to the networks that need kivitendo.

Support

This image is maintained by cloudimg with 24/7 support. If you need help deploying or operating kivitendo on Azure, contact us at cloudimg.co.uk.