Liferay Portal Community Edition on Ubuntu 24.04 on Azure User Guide

Overview

Liferay Portal Community Edition is the free, open source edition of Liferay's enterprise portal and digital experience platform (DXP): build websites, intranets and web applications with content management, page building, user and role management, and a large administration Control Panel. Install the cloudimg image and you have your own private Liferay portal ready to serve sites and content, backed by a bundled local MariaDB database. The image installs Liferay Portal CE 7.4.3.132 GA132 from the official Tomcat bundle and runs it as the dedicated liferay system service under OpenJDK 21. The portal is served by Apache Tomcat bound to the loopback connector 127.0.0.1:8080 and fronted by nginx on port 80 alongside an unauthenticated health endpoint. The bundled MariaDB listens only on loopback 127.0.0.1:3306, and both the database and the Liferay data directory (the document library and search indexes) live on dedicated Azure data disks. A unique administrator password is generated on the first boot of every VM by rotating Liferay's well known default admin (test@liferay.com / test) to a per-VM secret, so no VM ever ships with a known credential. Backed by 24/7 cloudimg support.

cloudimg is not affiliated with or endorsed by Liferay, Inc. Liferay is a trademark of Liferay, Inc. This image packages the open source Liferay Portal Community Edition (LGPL-2.1).

What is included:

• Liferay Portal CE 7.4.3.132 GA132 installed from the official Liferay Tomcat 9.0.98 bundle and run as the liferay system service under OpenJDK 21
• A bundled local MariaDB database, initialised at build time so the portal boots ready to use, bound to loopback 127.0.0.1:3306
• Apache Tomcat bound to 127.0.0.1:8080, fronted by nginx on port 80
• Port 80 serving an unauthenticated /healthz endpoint for load balancer probes
• The MariaDB data directory and the Liferay data/ directory (document library and search indexes) each on a dedicated Azure data disk
• A unique administrator password rotated on first boot from Liferay's default test@liferay.com / test login, recorded in a root only file, with the default login proven rejected before the image is captured
• mariadb.service, liferay.service and nginx.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Liferay is a memory hungry Java application: Standard_D4s_v5 (4 vCPU / 16 GiB RAM) is the recommended size for comfortable production use; the smaller Standard_D2s_v4 (2 vCPU / 8 GiB) also runs the portal with a conservative heap. NSG inbound: allow 22/tcp from your management network and 80/tcp (and 443/tcp if you add TLS) for the portal. The bundled MariaDB port 3306 and the Tomcat port 8080 are bound to loopback only and are never exposed. The portal is served over plain HTTP by default, so for production put your own domain and a trusted certificate in front of it (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Liferay Portal Community Edition by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size (Standard_D4s_v5 recommended); under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the two dedicated data disks on the Disks tab, then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name liferay \
  --image <marketplace-image-urn> \
  --size Standard_D4s_v5 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to your network:

az vm open-port --resource-group <your-rg> --name liferay --port 80 --priority 900

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

The first boot runs a one time initialisation that starts the portal, generates the per-VM administrator password and completes in a few minutes. Liferay's first start is intentionally thorough (it starts the OSGi runtime and a bundled search engine), so allow a couple of minutes after the VM is created before the portal answers on port 80.

Step 4 - Confirm the services are running

sudo systemctl is-active mariadb.service liferay.service nginx.service
sudo ss -tlnp | grep -E ':80 |:8080|:3306'

All three services report active. Tomcat (8080) and MariaDB (3306) are bound to 127.0.0.1 only; nginx on port 80 is the single public entry point.

Step 5 - Retrieve your administrator password

The unique per-VM administrator credentials are written to a root only file on first boot. The bundled MariaDB data directory and the Liferay data directory each live on a dedicated data disk.

sudo findmnt /var/lib/mysql
sudo findmnt /var/lib/liferay
sudo cat /root/liferay-credentials.txt

Sign in with the email test@liferay.com and the generated password shown in the file.

Step 6 - Verify the security of the deployment

The image never ships with Liferay's well known default password. This check proves the per-VM administrator can sign in and reach the Control Panel, while the default test@liferay.com / test login is rejected, and that the unauthenticated health endpoint answers for load balancer probes.

sudo bash /usr/local/sbin/liferay-cred-roundtrip.sh
curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/healthz

Step 7 - Confirm where the data lives

Both the database and the Liferay data directory are on dedicated StandardSSD data disks captured into the image, so they are re-provisioned on every VM.

sudo lsblk -o NAME,SIZE,TYPE,MOUNTPOINT
df -h /var/lib/mysql /var/lib/liferay

Step 8 - Sign in to the portal

In a browser, open http://<vm-public-ip>/ and select Sign In, or go straight to http://<vm-public-ip>/c/portal/login. Enter the email test@liferay.com and the per-VM password from Step 5.

Step 9 - Manage roles from the Control Panel

Open the Control Panel from the applications menu. Under Roles you manage regular, site, organization, asset library and account roles for fine grained access control across the portal.

Step 10 - Manage users and organizations

Under Users and Organizations in the Control Panel you create and manage user accounts, screen names, organizations and user groups.

Step 11 - Create and manage web content

Under Content & Data -> Web Content you author and manage articles, along with the structures and templates that drive the content displayed on your sites and pages.

Step 12 - Add a domain and TLS for production

The portal is served over plain HTTP on port 80 by default. For production, point a DNS name at the VM, then either add a certificate to your own reverse proxy or load balancer in front of nginx, or install one directly with Certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d portal.example.com

In the Control Panel under Instance Settings -> Virtual Host, set the site's virtual host to your domain so Liferay generates links using it.

Maintenance

• Services: sudo systemctl restart liferay.service restarts the portal (allow a minute for the OSGi runtime to warm up); sudo systemctl restart mariadb.service restarts the database.
• Logs: the portal log is under /opt/liferay/tomcat/logs/catalina.out; first boot activity is in /var/log/liferay-firstboot.log.
• Database: the bundled MariaDB is reachable on the box with sudo mariadb (root over the local socket). It listens on loopback only and is never exposed.
• Backups: back up the liferay database (for example with mysqldump) and the Liferay data directory at /var/lib/liferay/data, which holds the document library and search indexes.
• Updates: the OS receives unattended security updates. Liferay itself can be upgraded by following Liferay's own upgrade documentation.

Support

This image is maintained by cloudimg with 24/7 support. For assistance, contact support@cloudimg.co.uk.

cloudimg is not affiliated with or endorsed by Liferay, Inc. Liferay is a trademark of Liferay, Inc. This image packages the open source Liferay Portal Community Edition (LGPL-2.1); it is not Liferay DXP or Liferay Enterprise.