Open Food Network on Ubuntu 24.04 on Azure User Guide

Overview

Open Food Network (OFN) is an open-source marketplace and logistics platform for short, local food supply chains. Producers, food hubs, co-ops and buying groups list their products, set their own prices, delivery windows and pickup points, and open order cycles that let shoppers browse and buy from one or many nearby suppliers in a single order. It is a Ruby on Rails application served by Puma, with Sidekiq background workers, PostgreSQL for storage and Redis for caching and job queues, fronted by nginx. The cloudimg image installs OFN the official "install from source" way (Ruby 3.4.8 via rbenv, Node.js 24, Yarn, PostgreSQL 16 and Redis), ships a migrated database seeded with a demo enterprise and producer catalogue so the storefront renders immediately, and generates every secret plus the admin account uniquely on the first boot of each VM. Backed by 24/7 cloudimg support.

What is included:

• Open Food Network installed from source (AGPL-3.0), built on Ruby 3.4.8, Node.js 24 and Yarn 1.22, Rails 7.2
• Two systemd services running as the unprivileged ofn user, loopback only: open-food-network-puma (Puma) and open-food-network-sidekiq (background workers)
• PostgreSQL 16 and Redis bound to loopback (Redis: cache on db0, Sidekiq jobs on db1)
• nginx fronting the app with an unauthenticated :80/healthz, and the full storefront plus /admin on :443 behind a per-VM HTTP Basic-Auth layer
• A migrated, seeded database with a demo enterprise/producer catalogue so the marketplace renders out of the box
• All per-VM secrets generated on first boot: SECRET_KEY_BASE, SECRET_TOKEN, the ActiveRecord-encryption keys, the PostgreSQL password and the nginx Basic-Auth password - none are baked into the image
• A per-VM admin account created on first boot and recorded in a root-only credentials file, plus a per-VM self-signed TLS certificate
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_D2s_v3 (2 vCPU / 8 GiB RAM) is the recommended size - OFN runs Puma and Sidekiq alongside PostgreSQL and Redis, so do not go below 8 GiB of RAM. NSG inbound: allow 22/tcp from your management network, and 80/tcp + 443/tcp for the web interface. The appliance serves HTTPS on port 443 with a per-VM self-signed certificate so the interface works immediately; for production you install your own certificate and domain (see "Set your own domain, TLS and SMTP").

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Open Food Network by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size (Standard_D2s_v3); under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22), HTTP (80) and HTTPS (443). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name open-food-network \
  --image <marketplace-image-urn> \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name open-food-network --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name open-food-network --port 443 --priority 1011

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

On first boot the image generates the per-VM secrets, writes the real environment file and a per-VM self-signed TLS certificate, creates the admin account and releases the application services. Confirm PostgreSQL, Redis, nginx, Puma and Sidekiq are all active and bound to loopback:

systemctl is-active postgresql redis-server nginx open-food-network-puma open-food-network-sidekiq
sudo ss -tlnp | grep -E ':5432|:6379|:3000|:80 |:443 '

The database (PostgreSQL) and Redis listen only on 127.0.0.1, Puma listens on 127.0.0.1:3000, and nginx serves :80 and :443.

Step 5 - Retrieve your per-VM credentials

Every credential is unique to this VM and written to a root-only file on first boot. It holds the HTTP Basic-Auth username and password that protect the whole site, and the admin account for the storefront and admin back office:

sudo cat /root/open-food-network-credentials.txt

You will see the Basic-Auth username/password, the admin e-mail (<OFN_ADMIN_EMAIL>) and the admin password (<OFN_ADMIN_PASSWORD>). Keep this file safe; the passwords are not recoverable if lost, but you can rotate them yourself later.

Step 6 - Verify TLS and the Basic-Auth layer

The whole site sits behind an HTTP Basic-Auth layer on :443, except an unauthenticated /healthz used for health checks. Port 80 redirects to HTTPS. Confirm the status codes:

curl -s -o /dev/null -w 'port 80  -> HTTP %{http_code}\n' http://127.0.0.1/
curl -sk -o /dev/null -w 'healthz  -> HTTP %{http_code}\n' https://127.0.0.1/healthz
curl -sk -o /dev/null -w 'no auth  -> HTTP %{http_code}\n' https://127.0.0.1/

Port 80 returns 301 (redirect to HTTPS), /healthz returns 200, and the storefront returns 401 until you supply the Basic-Auth credentials from Step 5.

Step 7 - Open the storefront

Browse to https://<vm-public-ip>/ and enter the Basic-Auth username and password when prompted. The storefront opens on the marketplace landing page, where shoppers browse shops, producers and the map of local suppliers. The image ships a demo catalogue so the marketplace renders immediately.

Step 8 - Sign in to the admin back office

Click Login (top right) and sign in with the admin e-mail and password from Step 5. The admin dashboard is where you manage products, order cycles, enterprises, orders, reports and users. A wrong or guessed password is always rejected - only the per-VM admin password logs in:

The login goes through the nginx Basic-Auth layer and then the application's own Devise session login. You can prove the round-trip from the VM:

Step 9 - Set your own domain, TLS and SMTP

The appliance boots with a per-VM self-signed certificate and the VM public IP as a working evaluation placeholder. Before onboarding real enterprises you should point a real domain at the VM, install a real TLS certificate, and configure SMTP so signup and order e-mails are delivered. The application configuration lives in the environment file:

sudo -u ofn sed -n '1,40p' /home/ofn/openfoodnetwork/.env

Edit MAIL_HOST, MAIL_PORT, SMTP_USERNAME, SMTP_PASSWORD and MAIL_DOMAIN for your mail provider, replace the certificate at /etc/ssl/open-food-network/ (or terminate TLS at a load balancer), then restart the application:

sudo systemctl restart open-food-network-puma open-food-network-sidekiq nginx

Step 10 - Maintenance

The baked software versions and the redacted per-VM credential note:

• Rotate credentials: to re-generate every per-VM secret and the admin password, remove the first-boot marker and re-run first boot: sudo rm -f /var/lib/cloudimg/open-food-network-firstboot.done && sudo systemctl restart open-food-network-firstboot.
• Background jobs: Sidekiq processes e-mails and long-running tasks; check it with systemctl status open-food-network-sidekiq.
• Logs: journalctl -u open-food-network-puma and journalctl -u open-food-network-sidekiq.
• OS updates: the image ships with unattended-upgrades enabled for security patches.
• Backups: back up the PostgreSQL database open_food_network_prod and any uploaded media before upgrades.

Open Food Network is licensed under AGPL-3.0. This image is not affiliated with or endorsed by the Open Food Network Foundation. For help deploying or operating the image, cloudimg support is available 24/7.