Lutece 7.1 on Ubuntu 24.04 LTS on Azure User Guide

Overview

This guide covers deploying Lutece 7.1 on Ubuntu 24.04 LTS on Azure. Lutece is the open source web portal and application engine created and maintained by the City of Paris to build content driven websites and online public services. Editors manage pages, content and navigation from a back office administration console, while the portal renders the public site from a stable core and a large ecosystem of plugins.

The image assembles Lutece 7.1.9 (lutece-core-7.1.9) from the official Lutece Maven repository, with the webapp resources and every runtime dependency checksum pinned, and lays it down as a complete single VM appliance: Apache Tomcat 9 serving the application, MySQL 8.0 holding the content database, and nginx as the only public listener.

Nothing is bootstrapped at build time. The image contains no Lutece database, no application database account and no connection password. Lutece ships a well known default administrator, admin / adminadmin, plus three demo accounts; none of them survives into this image. On the first boot of every instance, lutece-firstboot.service creates the database from the shipped schema, deletes the demo accounts, rotates the administrator to a unique per instance password stored as a PBKDF2 hash, and writes the credentials to a root only file. Only then is Tomcat allowed to start.

What is included:

• Lutece 7.1.9 assembled from the official Lutece Maven repository, webapp resources and core jar SHA 256 verified

• Apache Tomcat 9 from the official Apache distribution, SHA 512 verified (Lutece 7.1 is a Servlet 4.0 application and requires Tomcat 9, not the jakarta namespace Tomcat 10)

• MySQL 8.0 from the Ubuntu archive, tuned for a 4 GB VM and bound to the loopback interface

• OpenJDK 17, with the JVM heap sized so Tomcat and MySQL both fit in 4 GB with no swap

• nginx reverse proxy serving the application on port 80, with no version disclosure and the configuration and WEB-INF files unreachable over HTTP

• lutece-firstboot.service provisioning a unique per instance database and administrator credential and rotating away the admin / adminadmin default

• Ubuntu 24.04 LTS base, fully patched, with unattended security upgrades enabled

• 24/7 cloudimg support with a 24 hour response SLA

Key facts:

Prerequisites

• An Azure subscription and the ability to launch a VM from a Marketplace image.
• An SSH key pair to administer the VM.
• Inbound TCP port 22 (SSH) and port 80 (HTTP) open to the addresses you will use.

Step 1: Deploy from the Azure Portal

1. Open the cloudimg Lutece 7.1 on Ubuntu 24.04 LTS offer in the Azure Marketplace and select Create.
2. Choose your subscription, resource group and region.
3. Set the VM size to Standard_B2s (or larger for heavier content loads).
4. Provide your SSH public key for the admin user.
5. Allow inbound SSH (22) and HTTP (80).
6. Review and create. The VM is ready to serve within a couple of minutes of first boot.

Step 2: Deploy from the Azure CLI

az group create --name lutece-rg --location eastus

az vm create \
  --resource-group lutece-rg \
  --name lutece-vm \
  --image <cloudimg-lutece-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

az vm open-port --resource-group lutece-rg --name lutece-vm --port 80 --priority 900

Step 3: Connect via SSH

ssh azureuser@<your-vm-ip>

Step 4: Verify the Services

First boot runs lutece-firstboot.service, which provisions the database and credentials before Tomcat and nginx start. Confirm everything is active:

systemctl is-active lutece-firstboot.service mysql.service tomcat.service nginx.service

Expected output:

active
active
active
active

The lutece-firstboot.service is a one shot unit that reports active once it has finished provisioning. Tomcat and nginx carry a ConditionPathExists gate on a bootstrap marker that the first boot service writes only after the per instance credential is in place, so the application is never reachable with the upstream default login.

Step 5: Retrieve the Per Instance Credentials

Every instance generates its own administrator password and database password on first boot and writes them, readable only by root, to /root/lutece-credentials.txt:

sudo cat /root/lutece-credentials.txt

# Lutece 7.1 - Per-VM Credentials
LUTECE_URL=http://<your-vm-ip>/
LUTECE_ADMIN_URL=http://<your-vm-ip>/jsp/admin/AdminLogin.jsp
LUTECE_ADMIN_USER=admin
LUTECE_ADMIN_PASSWORD=<unique-per-instance-password>
LUTECE_DB_NAME=lutece
LUTECE_DB_USER=lutece
LUTECE_DB_PASSWORD=<unique-per-instance-password>

The upstream admin / adminadmin default and the lutece, redac and valid demo accounts do not exist on your instance: first boot deletes the demo accounts and replaces the administrator password with the unique value above, stored as a PBKDF2 (HMAC SHA512) hash.

Step 6: Open the Front Portal

Browse to http://<your-vm-ip>/. The Lutece portal renders its home page from the core and its shipped theme.

Step 7: Sign in to the Administration Back Office

Browse to http://<your-vm-ip>/jsp/admin/AdminLogin.jsp and sign in with the admin username and the password from /root/lutece-credentials.txt.

After signing in you land on the site administration dashboard, from where you manage pages, users, roles, page templates and the system configuration. The dashboard shows a single administrator account, because the demo accounts have been removed.

Lutece protects the login form against brute force: after three failed attempts from an address it requires a captcha, so keep your per instance password to hand.

Step 8: Confirm the Database

Lutece stores its content and configuration in MySQL, which listens on the loopback interface only. Connect as the OS root user over the local socket:

sudo mysql lutece -e "SELECT COUNT(*) AS admin_accounts FROM core_admin_user;"

+----------------+
| admin_accounts |
+----------------+
|              1 |
+----------------+

Exactly one administrator account exists, and it carries your unique per instance credential. The MySQL root account uses the auth_socket plugin and has no password, so it is reachable only as the OS root user on the machine itself.

Step 9: Building Your Site

From the back office you can:

• Create and organise pages under Site, and edit their content and layout.
• Manage administrators, roles and workgroups so editorial teams share one authoritative site while each user sees only what they are entitled to.
• Install and configure plugins to add forms, document management, directories, search and other features from the Lutece ecosystem.
• Manage page templates and the overall site configuration under System.

Step 10: Managing the Services

# Status
systemctl status tomcat.service

# Restart the application
sudo systemctl restart tomcat.service

# Restart the reverse proxy
sudo systemctl restart nginx.service

# Application logs
sudo tail -f /opt/tomcat/webapps/ROOT/WEB-INF/logs/error.log

Step 11: Tuning the JVM Heap

The default JVM heap is sized for Standard_B2s (-Xmx1536m), leaving MySQL and the OS comfortable in 4 GB with no swap. For heavier content, a larger catalogue or many concurrent editors, move to a larger VM and raise the heap in /opt/tomcat/bin/setenv.sh:

sudo sed -i 's/-Xmx1536m/-Xmx3072m/' /opt/tomcat/bin/setenv.sh
sudo systemctl restart tomcat.service

Step 12: Backing Up

Back up the MySQL database and the per instance configuration:

DBPASS=$(sudo awk -F= '/^LUTECE_DB_PASSWORD=/{print $2}' /root/lutece-credentials.txt)
mysqldump -h 127.0.0.1 -u lutece -p"$DBPASS" lutece > lutece-backup-$(date +%F).sql
sudo cp /opt/tomcat/webapps/ROOT/WEB-INF/conf/db.properties db.properties.bak

Step 13: How the Security Model Works

• No default login. The upstream admin / adminadmin credential and the lutece, redac and valid demo accounts never exist on your instance. First boot deletes the demo accounts and rotates the administrator to a unique PBKDF2 hashed password. The string adminadmin is not present anywhere in the image except the front end weak password denylist, where it is used to reject that value as a password.
• No credential in the image. The captured image ships no database, no application database account and no connection password. Each is minted on first boot and written to a root only file.
• Loopback only data tier. MySQL and Tomcat both bind 127.0.0.1. nginx is the sole public listener on port 80. Tomcat's shutdown port is disabled and there is no manager or host manager application.
• Nothing sensitive is web reachable. nginx returns 404 for any /WEB-INF/ path and dotfiles, so db.properties and the configuration files cannot be fetched over HTTP, and neither the reverse proxy nor the servlet container discloses a version banner.
• Patched base. Ubuntu 24.04 LTS, fully patched at build time, with unattended security upgrades enabled for the running instance.

Step 14: Security Recommendations

• Put the site behind HTTPS with a TLS certificate (for example a load balancer or a reverse proxy in front) before serving real traffic.
• Restrict inbound access to the administration paths to trusted addresses.
• Rotate the administrator password after first login and add named administrator accounts for each editor rather than sharing one.
• Configure an outbound mail relay if you use Lutece features that send email.

Step 15: Troubleshooting

• The site does not answer yet. First boot provisioning runs before Tomcat starts. Check systemctl status lutece-firstboot.service; Tomcat starts once it completes.
• Locked out of the admin login. After repeated failed attempts Lutece requires a captcha for a short window. Wait, then sign in with the correct per instance password.
• Application errors. Check /opt/tomcat/webapps/ROOT/WEB-INF/logs/error.log and the Tomcat log at /opt/tomcat/logs/catalina.out.

Step 16: Support and Licensing

Lutece is distributed under the BSD 3-Clause License (Copyright (c) 2017, Mairie de Paris). Apache Tomcat is under the Apache License 2.0. The licence artifacts are shipped on the image under /usr/share/lutece/ and /usr/share/doc/apache-tomcat/.

This image is provided and supported by cloudimg with 24/7 support and a 24 hour response SLA. For assistance, contact cloudimg support through the marketplace listing.