Applications Azure

OpenEduCat on Ubuntu 24.04 on Azure User Guide

| Product: OpenEduCat on Ubuntu 24.04 on Azure

Overview

This guide covers the deployment and configuration of OpenEduCat on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. OpenEduCat is an open source student information and school management application built on the Odoo 19 Community framework. It covers the full academic lifecycle: admissions and student applicants, student and guardian records, academic structure (programs, courses, batches and subjects), attendance, assignments, exams and results, a parent portal, and a library module. OpenEduCat is licensed under the GNU Lesser General Public License version 3 (LGPL 3.0).

Unlike a bare Odoo image, this appliance ships with the database already created and the OpenEduCat application already installed, so you sign in and start working immediately, with no manual bench setup, module installation or database creation required. No student, guardian, admission or fee data is seeded in the image, because school records are yours to enter.

What is included:

  • OpenEduCat installed on Odoo 19.0 Community Edition, installed from the official Odoo nightly APT repository
  • The full OpenEduCat application suite: Core, Admission, Assignment, Attendance, Activity, Classroom, Exam, Facility, Fees, Library, Parent portal and Timetable
  • PostgreSQL 16 database backend, pre configured and bound to localhost only, with password authentication
  • A single pre created Odoo database named openeducat with the OpenEduCat application already installed
  • wkhtmltopdf for PDF report generation
  • Node.js for Odoo asset compilation
  • Ubuntu 24.04 LTS (Noble Numbat) with the latest security patches applied at build time
  • Azure Linux Agent (waagent) for cloud init, SSH key provisioning and disk management
  • openeducat-firstboot.service, a systemd unit that rotates three separate secrets on every first boot: the Odoo master password, the Administrator web login password and the PostgreSQL database password

Prerequisites

  • An active Azure subscription with permission to create virtual machines
  • An SSH key pair (Ed25519 or RSA 4096 recommended)
  • A network security group (NSG) rule allowing inbound TCP on port 8069 from your trusted IP range
  • A terminal with the Azure CLI installed (for CLI deploy steps)

Recommended VM size: Standard_B2s (2 vCPU, 4 GiB RAM). This appliance was measured at well under 1 GiB of memory system wide with the database and all modules loaded, so Standard_B2s comfortably runs OpenEduCat for a single school or small institution. Use a larger size such as Standard_B4ms for a larger student body or heavier concurrent usage.

Step 1: Deploy the Virtual Machine from the Azure Portal

  1. Navigate to the Azure Marketplace and search for OpenEduCat on Ubuntu 24.04 LTS by cloudimg.
  2. Click Create and select your subscription and resource group.
  3. Choose a region. The image is available globally.
  4. Select a VM size. Standard_B2s is recommended for a single school or small institution.
  5. Under Administrator account, select SSH public key and provide your public key.
  6. Under Inbound port rules, open port 22 (SSH). Add an NSG rule for port 8069 after deployment, scoped to your trusted source IP range rather than 0.0.0.0/0.
  7. On the Disks tab, select Standard SSD or better for the OS disk.
  8. Review and create. The VM will be ready within two to three minutes.

Step 2: Deploy the Virtual Machine from the Azure CLI

Replace <sub-id>, <rg>, and <version> with your subscription ID, resource group name, and the gallery image version.

az vm create \
  --subscription "<sub-id>" \
  --resource-group "<rg>" \
  --name openeducat-vm \
  --image cloudimgGallery/images/openeducat/versions/<version> \
  --size Standard_B2s \
  --storage-sku StandardSSD_LRS \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --public-ip-sku Standard \
  --output table

After the VM is created, add an NSG rule to permit inbound TCP on port 8069 from your source IP:

az network nsg rule create \
  --resource-group "<rg>" \
  --nsg-name openeducat-vmNSG \
  --name allow-openeducat \
  --priority 310 \
  --protocol Tcp \
  --destination-port-ranges 8069 \
  --source-address-prefixes "<your-ip>/32" \
  --access Allow

Step 3: Connect via SSH

ssh azureuser@<vm-ip>

Substitute the public IP address assigned to your virtual machine. The default user is azureuser.

Step 4: Retrieve Your Per VM Credentials

openeducat-firstboot.service runs automatically on first boot and generates three separate secrets unique to your virtual machine: the Odoo master password, the Administrator web login password, and the PostgreSQL database password. No two virtual machines share any of these values, and none are baked into the image. Retrieve them with:

sudo cat /root/openeducat-credentials.txt

Example output (values shown are illustrative, yours will differ):

OPENEDUCAT_URL=http://<YOUR-IP>:8069
OPENEDUCAT_ADMIN_LOGIN=admin
OPENEDUCAT_ADMIN_PASSWORD=<generated-per-vm>
OPENEDUCAT_MASTER_PASSWORD=<generated-per-vm>

The machine readable form is at /stage/scripts/openeducat-credentials.log (mode 600, root only):

sudo cat /stage/scripts/openeducat-credentials.log

The default admin / admin login from a stock Odoo install is rejected on this image. Only the per VM OPENEDUCAT_ADMIN_PASSWORD above authenticates.

Step 5: Verify the OpenEduCat Service

Confirm that Odoo and PostgreSQL are running and that port 8069 is listening:

systemctl status odoo postgresql --no-pager -n 0

Terminal showing odoo.service and postgresql.service both active (running), with port 8069 bound to 0.0.0.0 and PostgreSQL bound to localhost only

Check the Odoo version and the health endpoint:

odoo --version
curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8069/web/health

Terminal showing Odoo Server 19.0, a 200 response from the health endpoint, and odoo.conf with the master password and database password rotated away from any placeholder, dbfilter locked to the single openeducat database, and list_db disabled

Expected health check output: 200

Confirm every OpenEduCat module installed successfully:

sudo -u postgres psql -d openeducat -tAc \
  "SELECT name,state FROM ir_module_module WHERE name LIKE 'openeducat%' ORDER BY name;"

Terminal listing all thirteen OpenEduCat modules — activity, admission, assignment, attendance, classroom, core, erp, exam, facility, fees, library, parent and timetable — each showing state installed

Step 6: Sign In

  1. Open http://<your-vm-ip>:8069/web/login in a browser.

OpenEduCat sign in page, an Odoo website themed login form asking for email and password

  1. Enter admin as the email and the OPENEDUCAT_ADMIN_PASSWORD value retrieved in Step 4.
  2. Click Log in.

You land on the Odoo backend. Click the grid icon in the top left to open the app switcher, which lists every OpenEduCat module alongside the standard Odoo apps that OpenEduCat depends on.

The Odoo home menu listing the installed OpenEduCat apps: SIS, Students, Admissions, Time Table, Class Attendances, Assignments, Exams and Library, alongside Contacts, Website and Human Resources

Step 7: Add Your First Students and Courses

OpenEduCat ships with no student, guardian, admission or fee data. This is deliberate: school records are sensitive, and they are yours to enter.

  1. Click Students in the app switcher, then click New to add a student. Fill in the first name, last name and email, then save.

Students app kanban view showing enrolled students with name and email

  1. Click SIS > Configuration > Program Level and create at least one program level (for example, Undergraduate).
  2. Click SIS > Configuration > Programs and create a program, selecting the program level you just created.
  3. Click SIS > Configuration > Courses and create one or more courses under that program, giving each a short unique code.

Courses list view showing course name, code and evaluation type

  1. Open a student record and use the Course Details tab to enrol the student in a course.

Step 8: Admissions, Attendance, Exams and the Library

  • Admissions — click Admissions in the app switcher to manage admission registers and student applicants through the admission workflow.
  • Time Table and Class Attendances — schedule sessions and record attendance per session.
  • Assignments and Exams — create assignments with due dates, and configure exam sessions, marksheets and results.
  • Library — catalogue media (books and other items), issue and return them to students and faculty, and print library cards.
  • Parents — grant guardians portal access to their child's academic record.

Each of these apps follows the same pattern as Students and Courses above: use New to create a record, and the Configuration menu within each app for the underlying master data (academic years, terms, departments, subjects, batches, classrooms and fee terms).

Step 9: Server Components

Component Version Notes
OpenEduCat 19.0.1.0 (pinned commit 8738c4a, 19.0 branch) github.com/openeducat/openeducat_erp, LGPL 3.0
Odoo Community 19.0-20260807 Installed from nightly.odoo.com/19.0/nightly/deb
PostgreSQL 16 localhost only (127.0.0.1:5432), password authentication
Python 3.12 Ubuntu 24.04 system Python
Node.js 18+ Required for Odoo asset compilation
wkhtmltopdf 0.12.6 Ubuntu 24.04 patched build for PDF reports
Ubuntu 24.04 LTS (Noble Numbat) Kernel 6.8
Azure Linux Agent 2.9+ waagent, cloud init, disk, SSH key management

Check the currently running Odoo version:

odoo --version

Odoo Server 19.0-20260807

Step 10: Filesystem Layout

Path Purpose
/usr/bin/odoo Odoo server binary
/etc/odoo/odoo.conf Main configuration file (mode 640, root:odoo)
/var/lib/odoo Odoo data directory (filestore, sessions)
/opt/openeducat/addons-src OpenEduCat addon modules (pinned commit)
/var/log/odoo/odoo-server.log Odoo server log
/usr/lib/python3/dist-packages/odoo/addons/ Built in Odoo modules
/stage/scripts/openeducat-credentials.log Machine readable credentials (mode 600, root)
/root/openeducat-credentials.txt Human readable credentials and first use instructions
/usr/local/sbin/openeducat-firstboot.sh First boot credential rotation script
/usr/local/sbin/openeducat-selftest.sh Functional self test (creates, reads and deletes a course record)
/etc/systemd/system/openeducat-firstboot.service Systemd unit for first boot initialisation
/var/lib/cloudimg/openeducat-firstboot.done Sentinel file; presence prevents firstboot re running
/var/run/postgresql/ PostgreSQL runtime socket directory

Step 11: Managing the OpenEduCat Service

Check service status:

systemctl status odoo

Stop the service:

sudo systemctl stop odoo

Start the service:

sudo systemctl start odoo

Restart the service (for example, after editing odoo.conf):

sudo systemctl restart odoo

Tail the Odoo log in real time:

sudo tail -n 50 /var/log/odoo/odoo-server.log

Step 12: Backups

PostgreSQL dump (recommended)

PGPASSWORD=$(sudo grep '^pg_password=' /stage/scripts/openeducat-credentials.log | cut -d= -f2) \
  pg_dump -h 127.0.0.1 -U odoo -F c -f /home/azureuser/openeducat-backup-$(date +%Y%m%d).dump openeducat

Transfer the dump to Azure Blob Storage or another durable destination. The Odoo filestore at /var/lib/odoo/.local/share/Odoo/filestore/openeducat/ must be backed up alongside the database dump to preserve uploaded attachments (student photos, library media covers and report attachments).

Automate with a cron job

# Example: nightly backup at 02:00, keep 7 days
0 2 * * * azureuser PGPASSWORD=$(sudo grep '^pg_password=' /stage/scripts/openeducat-credentials.log | cut -d= -f2) pg_dump -h 127.0.0.1 -U odoo -F c -f /home/azureuser/openeducat-backup-$(date +\%Y\%m\%d).dump openeducat && find /home/azureuser -name 'openeducat-backup-*.dump' -mtime +7 -delete

Step 13: HTTPS with a Reverse Proxy

Running Odoo directly on port 8069 over plain HTTP is acceptable for internal use but should not be used for internet facing deployments. Use nginx as a reverse proxy with a TLS certificate from Let's Encrypt.

Install nginx and certbot:

sudo apt-get install -y nginx certbot python3-certbot-nginx

Create an nginx virtual host at /etc/nginx/sites-available/openeducat:

upstream openeducat {
    server 127.0.0.1:8069;
}
server {
    listen 80;
    server_name your-domain.example.com;

    location / {
        proxy_pass http://openeducat;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 720s;
        client_max_body_size 50m;
    }
}

Enable the site and obtain a certificate:

sudo ln -s /etc/nginx/sites-available/openeducat /etc/nginx/sites-enabled/openeducat
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d your-domain.example.com

After enabling the proxy, set proxy_mode = True in /etc/odoo/odoo.conf and restart Odoo so it trusts the X-Forwarded-For header:

sudo sed -i 's/proxy_mode = False/proxy_mode = True/' /etc/odoo/odoo.conf
sudo systemctl restart odoo

Step 14: Troubleshooting

OpenEduCat does not respond on port 8069

Check whether the service is running:

systemctl is-active odoo

If inactive, check the log for startup errors:

sudo tail -50 /var/log/odoo/odoo-server.log

Check whether PostgreSQL is running and accepting connections:

systemctl is-active postgresql
sudo -u postgres psql -c "SELECT version();"

Sign in fails, or the credentials file still shows a placeholder

Verify the admin password in odoo.conf is not a placeholder:

sudo grep admin_passwd /etc/odoo/odoo.conf

Check whether the firstboot sentinel file exists:

ls -la /var/lib/cloudimg/openeducat-firstboot.done

If the file is absent, the firstboot service did not complete. Check its journal:

sudo journalctl -u openeducat-firstboot --no-pager

To force it to run again, remove the sentinel and start the service manually:

sudo rm -f /var/lib/cloudimg/openeducat-firstboot.done
sudo systemctl start openeducat-firstboot
sudo cat /root/openeducat-credentials.txt

Port 8069 is not reachable from the browser

Verify the NSG rule on the Azure portal permits inbound TCP on port 8069 from your source IP.

Confirm OpenEduCat itself is functioning, not just Odoo

Run the built in self test, which creates a real course record, reads it back, and deletes it:

sudo /usr/local/sbin/openeducat-selftest.sh

Expected output ends with OPENEDUCAT_SELFTEST_OK.

Step 15: Security Recommendations

Database access is already locked down

This image sets dbfilter = ^openeducat$ and list_db = False in /etc/odoo/odoo.conf, so the multi database selector and /web/database/manager are not exposed. There is exactly one database, and it is not possible to create or drop databases from the web interface.

Three separate secrets, all rotated per VM

Unlike a bare Odoo image that only rotates the master password, this image rotates the Odoo master password, the Administrator web login password, and the PostgreSQL database password on every first boot. If you want to rotate any of them manually at a later time:

# Odoo master password
NEW_PW=$(openssl rand -hex 16)
sudo sed -i "s|^admin_passwd = .*|admin_passwd = ${NEW_PW}|" /etc/odoo/odoo.conf
sudo systemctl restart odoo

# PostgreSQL database password (update odoo.conf's db_password to match)
NEW_PG_PW=$(openssl rand -hex 16)
sudo -u postgres psql -c "ALTER ROLE odoo WITH PASSWORD '${NEW_PG_PW}';"
sudo sed -i "s|^db_password = .*|db_password = ${NEW_PG_PW}|" /etc/odoo/odoo.conf
sudo systemctl restart odoo

To rotate the Administrator web login password, use Settings > Users and Companies > Users in the web interface, or the Reset Password link on the sign in page.

Restrict NSG rules

Limit inbound access to port 8069 to your specific office or VPN IP ranges rather than the public internet. PostgreSQL on port 5432 is bound to localhost and not exposed through the NSG.

Keep packages up to date

Apply security patches regularly:

sudo apt-get update && sudo apt-get upgrade -y odoo
sudo systemctl restart odoo

Step 16: Support and Licensing

OpenEduCat is licensed under the GNU Lesser General Public License version 3 (LGPL 3.0). Odoo Community Edition is licensed under the Apache License 2.0. The LGPL 3.0 full licence text is available at www.gnu.org/licenses/lgpl-3.0.html.

You are responsible for your own regulatory and data protection posture for the student data you enter. OpenEduCat and Odoo are trademarks of their respective holders. This image is not affiliated with, endorsed by, or sponsored by OpenEduCat Inc. or Odoo S.A.

cloudimg provides 24/7/365 expert technical support with a guaranteed 24 hour response for all requests and a one hour average response time for critical issues. Contact support@cloudimg.co.uk.

For the full user guide visit www.cloudimg.co.uk/guides/openeducat-on-ubuntu-24-04-azure and for our complete product catalogue visit www.cloudimg.co.uk/products.

Deploy on Azure

The cloudimg OpenEduCat image is available on the Azure Marketplace. Search for OpenEduCat on Ubuntu 24.04 LTS by cloudimg or navigate directly from the Azure Portal.

Need Help?