Open Monograph Press (OMP) on Ubuntu 24.04 on Azure User Guide

Overview

Open Monograph Press (OMP) is the Public Knowledge Project's open source platform for the entire lifecycle of scholarly book and monograph publishing: manuscript submission, a two stage internal and external peer review workflow, copyediting and production, series and category organisation, and a reader facing catalogue and storefront for published titles, with support for multiple independent presses in a single installation, ONIX metadata and DOIs. The cloudimg image ships OMP served by Apache and PHP 8.3 on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server so the appliance is complete and useful on its own. The installer is pre completed and locked away, so the platform is ready the moment the instance boots. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306) and keeps its data on a dedicated Azure data disk. A unique administrator password is generated on the first boot of every VM, and the web application only begins serving once that per instance credential is in place. Backed by 24/7 cloudimg support.

What is included:

• Open Monograph Press served by Apache with PHP 8.3, managed by systemd
• A bundled MariaDB server holding the OMP database, already installed and ready
• The installer pre completed and locked away, so no setup wizard is ever exposed
• A per VM administrator password generated on first boot and recorded in a root only file
• No shipped default login: the administrator password ships rotated to a discarded random and the real per VM password is set on first boot, before the application serves a single request
• MariaDB bound to 127.0.0.1 only, never exposed to the network
• A dedicated Azure data disk carrying both the MariaDB database and OMP's uploaded manuscript files, which OMP keeps outside the web root
• A base URL derived from the request, so the site answers correctly on the public IP, the private IP or any DNS name you point at it
• apache2.service and mariadb.service as enabled systemd units
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point for a small press; move up to Standard_D2s_v3 for larger catalogues or heavy submission volume. NSG inbound: allow 22/tcp from your management network, 80/tcp for the application and 443/tcp if you terminate TLS on the VM. The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

In the Azure portal choose Create a resource, search for Open Monograph Press (OMP) on Ubuntu 24.04 LTS by cloudimg, and select Create. Pick your subscription, resource group and region, choose the Standard_B2s size, select SSH public key authentication with the username azureuser, and allow inbound 22, 80 and 443. The image attaches its own 20 GiB data disk for your database and manuscript files, so you do not need to add one.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name omp \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name omp --port 80,443

Step 3 - Confirm the services are running

SSH to the VM as azureuser and confirm Apache, MariaDB and the first boot service are all active. Note that MariaDB is bound to 127.0.0.1:3306 only, while Apache serves on port 80.

systemctl is-active apache2 mariadb omp-firstboot

Expected output:

active
active
active

Step 4 - Retrieve the per VM administrator password

On the first boot of every VM, a one shot service generates a fresh administrator password and a fresh database password unique to that instance and writes them to a root only file. Read it over SSH:

sudo cat /root/omp-credentials.txt

The file lists the administrator username (admin) and its generated password, the URL to browse to, and the loopback MariaDB details. Store the password somewhere safe.

The OMP_URL line is the VM's address as seen from inside the VM, which on Azure is usually the private address. Browsing the public IP shown in the Azure portal works identically, because the image derives OMP's base URL from the request rather than baking in a fixed address.

Step 5 - Sign in

Browse to http://<your-vm-public-ip>/ and choose Login. Sign in with the username admin and the password from the credentials file.

After signing in as the site administrator you land in the administration area, from which you manage the whole installation: the hosted presses, site wide settings, system information and more.

Step 6 - Create your first press

OMP hosts one or more independent presses in a single installation. From Administration, choose Hosted Presses, then Create Press. Give the press a name, an acronym, a contact name and email, a country and a short URL path (for example aap). Save, and the press is created with its own reader facing catalogue and its own editorial workspace.

Step 7 - Run the editorial workflow

Open your press's Editor Dashboard to run the scholarly book workflow end to end: incoming submissions, the internal and external review stages, copyediting, production, and scheduling for publication. Each stage is a filtered view of the submissions assigned to you and your team.

Once titles are published they appear in the press's public catalogue, the reader facing storefront where visitors browse and read your books by series and category.

Step 8 - No known or default credentials

This image ships with no usable login. OMP is fully installed at build time, then the shipped administrator password hash and the shipped database password are both rotated to discarded random values that no one holds. On the first boot of your VM, the first boot service sets a fresh per VM administrator password and a fresh per VM database password, and only then is Apache allowed to serve a request - so there is never a window in which a default or shared credential is reachable.

You can confirm the security posture on the VM:

sudo bash /usr/local/sbin/omp-cred-roundtrip.sh

Expected output:

OK per-VM administrator authenticates via the PKP web login form; blank + weak guesses rejected

Step 9 - Verify the stack and where your data lives

The OMP application code lives on the OS disk under /var/www/omp. Your data lives on the dedicated 20 GiB Azure data disk mounted at /data: the MariaDB datadir is bind mounted from /data/mysql onto /var/lib/mysql, and OMP's uploaded manuscript files (files_dir) live at /data/omp/files, outside the web root so they are never web reachable.

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/healthz
findmnt /var/lib/mysql

Adding your own domain and TLS

The image derives OMP's base URL from the request, so as soon as you point a DNS name at the VM and browse it over HTTPS, OMP generates correct absolute links automatically. To terminate TLS on the VM, install a certificate with Certbot:

sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d your-domain.example.com

When you adopt a fixed public domain, it is good practice to pin it in /var/www/omp/config.inc.php by setting base_url = "https://your-domain.example.com" and restricting allowed_hosts to that host, then reload Apache. If you enable OMP's scheduled tasks (review reminders and similar), set base_url to your real domain first, because the scheduler needs a concrete base URL.

Backing up

Your data is the MariaDB database and the files_dir tree. Back up the database with mysqldump and archive the files directory:

sudo mariadb-dump --single-transaction omp | gzip > /data/omp-db-backup.sql.gz
sudo tar czf /data/omp-files-backup.tar.gz -C /data/omp files

Copy both off the VM (for example to Azure Blob Storage) on a schedule.

Security notes

• The bundled MariaDB listens on 127.0.0.1 only; port 3306 is never exposed. Keep your NSG limited to 22, 80 and 443.
• The administrator password is unique per VM and written to a root only file; there is no shipped default or shared login.
• OMP keeps uploaded manuscripts in files_dir outside the web root, and the Apache vhost denies config.inc.php, dotfiles and the application's library and tools directories from the web.
• Keep the OS patched with sudo apt-get update && sudo apt-get upgrade; unattended security upgrades remain enabled on the image.

Trademark

Open Monograph Press and OMP are products of the Public Knowledge Project. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them. This image is provided by cloudimg and is not affiliated with or endorsed by the Public Knowledge Project.

Support

This image is backed by 24/7 cloudimg support at support@cloudimg.co.uk. We help with deployment, press and workflow configuration, upgrades, performance tuning and MariaDB database administration.