Matomo on Ubuntu 24.04 on Azure User Guide
Overview
Matomo is the leading open-source web analytics platform and a privacy-respecting alternative to Google Analytics. It gives you 100 percent data ownership, accurate visitor and behaviour reports, real-time analytics, goal and ecommerce tracking, heatmaps and session recordings, and full GDPR controls, all hosted on your own infrastructure. The cloudimg image installs Matomo 5.11.2 on a full LAMP stack from the Ubuntu 24.04 repositories (nginx, PHP 8.3-FPM and MariaDB), runs the entire headless install at build time so there is no web wizard, stores the MariaDB database and Matomo configuration on a dedicated Azure data disk, and rotates the database password, the application salt and the administrator account on the first boot of every VM. Backed by 24/7 cloudimg support.
What is included:
- Matomo 5.11.2 served on port 80 by nginx via the PHP 8.3-FPM FastCGI socket
- MariaDB on loopback with its data directory on a dedicated Azure data disk
- A dedicated Azure data disk at
/var/lib/matomofor the MariaDB database and Matomo configuration - Per-VM database credentials, application salt and a unique administrator account generated on first boot
nginx.service,php8.3-fpm.serviceandmariadb.serviceas systemd units, enabled and active- 24/7 cloudimg support
Prerequisites
An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting point. NSG inbound: allow 22/tcp from your management network and 80/tcp for the Matomo web interface (front with TLS for public exposure - see Enabling HTTPS).
Step 1 - Deploy from the Azure Marketplace
Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Matomo by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create -> Create.
Step 2 - Deploy from the Azure CLI
az vm create \
--resource-group <your-rg> \
--name matomo \
--image <marketplace-image-urn> \
--size Standard_B2ms \
--admin-username azureuser \
--ssh-key-values ~/.ssh/id_ed25519.pub \
--vnet-name <your-vnet> --subnet <your-subnet> \
--public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name matomo --port 80 --priority 1010
Step 3 - Connect to your VM
ssh azureuser@<vm-public-ip>
Step 4 - Confirm the LAMP stack is running
On first boot Matomo regenerates its database credentials and application salt, recreates a clean analytics database, creates the administrator account and starts the stack.
systemctl is-active nginx php8.3-fpm mariadb
All three report active.
You can confirm the component versions and that the Matomo tracker endpoint answers:
php -v | head -1
mariadb --version
curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/matomo.php
The tracker endpoint returns HTTP 200.
Step 5 - Retrieve the administrator password
The administrator account is unique to your VM and is generated on first boot. Read it as root:
sudo cat /root/matomo-credentials.txt
The file contains the login (admin), the email (admin@cloudimg.local) and a unique password. Change the email and password from the admin panel after your first sign-in.
Step 6 - Sign in to Matomo
Browse to http://<vm-public-ip>/ and sign in with admin and the password from the credentials file.
Step 7 - Add your first website
On first sign-in Matomo asks you to add the first website you want to track. Enter a name and the site URL, then save. Matomo then shows the JavaScript tracking code - paste it into the <head> of every page on your website, or install it through your tag manager / CMS plugin. Within minutes the reports begin to populate.
Step 8 - Explore the reporting dashboard
The dashboard gives you visits in real-time, visits over time and a customisable set of widgets.
The Visitors section breaks down visits, unique visitors, pageviews, locations, devices and software.
Step 9 - Administration settings
The Administration area (the gear icon) holds system settings, user management, geolocation, archiving and privacy controls.
Data on the dedicated data disk
The MariaDB data directory (/var/lib/matomo/mysql) and the Matomo configuration and cache (/var/lib/matomo/matomo-config, /var/lib/matomo/matomo-tmp) live on a dedicated Azure data disk mounted at /var/lib/matomo. This keeps all of your analytics data and configuration on a managed disk you can snapshot, resize and back up independently of the OS disk.
df -h /var/lib/matomo | tail -1
Enabling HTTPS
For production, put Matomo behind TLS. The simplest approach is a free Let's Encrypt certificate with Certbot once you have a DNS name pointing at the VM:
sudo snap install --classic certbot
sudo ln -sf /snap/bin/certbot /usr/bin/certbot
sudo certbot --nginx -d your-domain.example.com
Certbot edits the nginx site to serve HTTPS and sets up automatic renewal. After enabling TLS, add your HTTPS hostname to [General] trusted_hosts[] in /var/lib/matomo/matomo-config/config.ini.php and set force_ssl = 1, then sudo systemctl reload nginx.
Maintenance
Matomo periodically ships new releases. To upgrade, follow the official Matomo update procedure (replace the application files under /var/www/matomo, keeping config/ and tmp/ which are symlinked to the data disk, then run sudo -u www-data php /var/www/matomo/console core:update --yes). The OS continues to receive unattended security updates. The MariaDB database and Matomo configuration persist on the data disk across reboots and upgrades.
Support
This image is maintained by cloudimg with 24/7 support. Matomo is open-source software licensed under the GPL-3.0. "Matomo" is a trademark of InnoCraft Ltd; cloudimg is not affiliated with or endorsed by InnoCraft. For help with this image, contact support@cloudimg.co.uk.