Open Web Analytics on Ubuntu 24.04 on Azure User Guide

Overview

Open Web Analytics (OWA) is an open source web analytics framework and a privacy respecting, self hosted alternative to Matomo and Google Analytics. It measures visits, page views, unique visitors, referrers and search terms, campaigns, and click and DOM heatmaps, and offers a JavaScript or PHP tracker you drop into any website or application, all reported from one web dashboard where you keep full ownership of the data. The cloudimg image ships Open Web Analytics served by Apache and PHP 8.3 on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server so the appliance is complete and useful on its own. The install is completed headlessly at build time and the install wizard is locked away, so the dashboard is ready the moment the instance boots. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306). A unique administrator password, database password and application secrets are generated on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• Open Web Analytics served by Apache with PHP 8.3, managed by systemd
• A bundled MariaDB server holding the analytics database, already installed and ready
• The install completed and the wizard locked away, so no setup wizard is ever exposed
• A ready to use default site so the dashboard works the moment you sign in
• A per VM administrator password, database password and application secrets generated on first boot and recorded in a root only file
• No shipped default login: the administrator password ships rotated to a discarded random and the real per VM password is set on first boot
• A clean, empty analytics dataset, so your reports start fresh
• MariaDB bound to 127.0.0.1 only, never exposed to the network
• A public URL derived from the request, so the tracking snippet and links work on the public IP, the private IP or any DNS name you point at it
• apache2.service and mariadb.service as enabled systemd units
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; move up to Standard_D2s_v3 for high traffic sites. NSG inbound: allow 22/tcp from your management network, 80/tcp for the application and 443/tcp if you terminate TLS on the VM. The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

In the Azure portal choose Create a resource, search for Open Web Analytics on Ubuntu 24.04 LTS by cloudimg, and select Create. Pick your subscription, resource group and region, choose the Standard_B2s size, select SSH public key authentication with the username azureuser, and allow inbound 22, 80 and 443.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name open-web-analytics \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name open-web-analytics --port 80,443

Step 3 - Confirm the services are running

SSH to the VM as azureuser and confirm Apache, MariaDB and the first boot service are all active. Note that MariaDB is bound to 127.0.0.1:3306 only, while Apache serves on port 80.

systemctl is-active apache2 mariadb open-web-analytics-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/  */ /g'

Step 4 - Retrieve the per VM administrator password

The first boot service generates an administrator password unique to your VM and writes it to a root only file. Read it over SSH:

sudo cat /root/open-web-analytics-credentials.txt

OPEN_WEB_ANALYTICS_URL is the VM's own address as seen from inside the VM. Azure does not expose the public IP to the instance, so this is usually the private address. Browsing the public IP shown in the Azure portal works identically, because this image derives OWA's public URL from the request rather than baking one in at build time.

Step 5 - Sign in

Browse to http://<vm-ip>/ and sign in with the username admin and the password from the credentials file.

After signing in you land on the analytics Dashboard, which shows the site metrics chart together with visits, unique visitors, page views, average visit duration, bounce rate and pages per visit, plus the top content, visitor types and traffic sources for the selected period.

Step 6 - Explore your reports

Use the sidebar to move between the report families: Content (top pages, entry and exit pages, page types), Visitors (loyalty, recency, geolocation, browsers and operating systems), Traffic (referring sites, search engines, keywords and campaigns) and Action Tracking. Each report has its own date range picker and a live view toggle. The Top Pages report below breaks every tracked URL down by page views, visits and unique page views.

Step 7 - Track your own website

The image ships a ready to use default site so the dashboard works immediately. To track your own website, open Settings and either edit the default site's domain or add a new site, then open its Tracking Tag page. Copy the generated JavaScript snippet into the HTML of your pages (just before the closing </body> tag) and OWA starts recording visits straight away. A PHP tracker and REST tracking API are available too for server side tracking.

Step 8 - No known or default credentials

This image ships with no usable login. The administrator password created at build time is rotated to a random value that is discarded and never recorded, and the first boot service sets a fresh password unique to your VM, regenerates the application secrets, and rotates the database password before OWA serves a single request. The admin account is the only account that can sign in, and the check below confirms that the per VM password authenticates through the real OWA login form while a blank password and common weak guesses are all rejected.

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(user_id,'  (the only account that can sign in)') FROM owa.owa_user"

sudo bash /usr/local/sbin/open-web-analytics-cred-roundtrip.sh

Change the administrator password to one of your own under the OWA user settings once you have signed in for the first time.

Step 9 - Verify the stack

Confirm the installed release, the health endpoint and that the analytics engine is recording:

php -r "require '/var/www/owa/owa_env.php'; echo 'Open Web Analytics '.OWA_VERSION;"

curl -sI http://127.0.0.1/healthz | head -1

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT((SELECT COUNT(*) FROM owa.owa_session),' visits, ',(SELECT COUNT(*) FROM owa.owa_request),' page views across ',(SELECT COUNT(*) FROM owa.owa_document),' pages') AS tracked"

Adding your own domain and TLS

Open Web Analytics derives its public URL from the request, so pointing a DNS name at the VM is all that is needed for the tracking snippet and links to use that name. No configuration change is required. To terminate TLS on the VM itself, install a certificate with Certbot:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d analytics.your-domain.com

Certbot configures the Apache virtual host and renews automatically. OWA switches its generated snippet and links to https:// on its own once requests arrive over TLS.

If you prefer to pin one fixed public URL instead of following the request, replace the cloudimg host-derived block in /var/www/owa/owa-config.php with a single line, for example define('OWA_PUBLIC_URL', 'https://analytics.your-domain.com/');.

Backing up

Everything that matters lives in the MariaDB database. Dump it, and snapshot the OS disk from the Azure portal for a complete point in time backup:

sudo mariadb-dump --protocol=socket -uroot --single-transaction --routines owa > /var/tmp/owa-backup.sql

Security notes

• The administrator password is unique to every VM, generated on first boot into a 0600 root:root file, alongside a rotated database password and freshly generated application secrets. No default or shared login ships in the image.
• The image ships a clean, empty analytics dataset: the demo traffic used to validate the build is removed before capture.
• The install and CLI entrypoints are denied from the web (/install.php and /cli.php return 403), and owa-config.php is never web readable.
• MariaDB listens on 127.0.0.1:3306 only and is never reachable from the network. On box maintenance uses sudo mariadb as root@localhost over the unix socket, with no password.
• The session cookie is host only, so it is scoped to exactly the address you browse to.
• The OS is fully patched at build time and unattended security upgrades stay enabled on your VM.
• Restrict 22/tcp to your management network, and put the site behind TLS before collecting production traffic.

Trademark

Open Web Analytics is a trademark of its respective owner. cloudimg is not affiliated with or endorsed by the Open Web Analytics project. All product and company names are trademarks or registered trademarks of their respective holders.

Support

cloudimg provides 24/7 technical support for this image by email (support@cloudimg.co.uk) and live chat, with a one hour average response time for critical issues.