Open Source Point of Sale on Ubuntu 24.04 on Azure User Guide

Overview

Open Source Point of Sale (OSPOS) is a mature, web based point of sale and inventory management system for small and medium retailers. It brings the register, inventory, customers, suppliers and employees together in one web interface: ring up sales with barcode support, taxes, discounts, cash rounding and multiple payment types, track stock with item kits, receivings and stock takes, and run built in reports across sales, inventory, taxes and payments. The cloudimg image ships OSPOS 3.4.1 (CodeIgniter 4) served by nginx and PHP 8.3 FPM on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server so the appliance is complete and useful on its own. The database schema is migrated and the install is pre completed, so the platform is ready the moment the instance boots. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306). A unique administrator password is generated on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• Open Source Point of Sale 3.4.1 served by nginx and PHP 8.3 FPM, managed by systemd
• A bundled MariaDB server holding the OSPOS database, already installed and migrated to 3.4.1
• The install pre completed, so no setup steps are required after boot
• A per VM administrator password generated on first boot and recorded in a root only file
• No shipped default login: the built in admin password ships rotated to a discarded random and the real per VM password is set on first boot
• MariaDB bound to 127.0.0.1 only, never exposed to the network
• nginx.service, php8.3-fpm.service and mariadb.service as enabled systemd units
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point for a single shop; step up to a larger size for heavier catalogues or busier tills. NSG inbound: allow 22/tcp from your management network, 80/tcp for the application and 443/tcp if you terminate TLS on the VM. The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Open Source Point of Sale by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22), HTTP (80) and HTTPS (443). Then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name opensourcepos \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name opensourcepos --port 80,443

Step 3 - Confirm the services are running

SSH in as azureuser and confirm nginx, PHP FPM and MariaDB are active, and that the first boot service is enabled. Note that MariaDB listens only on 127.0.0.1:3306 while nginx serves OSPOS on port 80.

systemctl is-active nginx php8.3-fpm mariadb

systemctl is-enabled opensourcepos-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/  */ /g' | sed -E 's/users:.*//'

Step 4 - Retrieve the per VM administrator password

Every VM generates its own OSPOS administrator password on first boot and writes it, along with the login user and the application URL, to a root only credentials file. Read it with sudo:

sudo cat /root/opensourcepos-credentials.txt

You sign in to OSPOS as user admin with the OSPOS_ADMIN_PASSWORD from this file. On the box itself you can also run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in

Browse to http://<vm-public-ip>/. You land on the OSPOS sign in page. Enter username admin and the password from Step 4.

After signing in you land on the OSPOS home page, which gives you one click access to every module: Customers, Items, Item Kits, Suppliers, Reports, Receivings, Sales, Gift Cards, Messages, Expenses, Cashups and Office.

Step 6 - Add your items

Open Items to build your catalogue. Add items individually with New Item, or bulk load them with CSV Import. Each item carries a barcode, category, cost and retail price, quantity on hand and tax rates, and you can generate barcodes for printing directly from the list.

Step 7 - Ring up a sale

Open Sales to reach the register. Scan or search for items, apply discounts and taxes, take payment across one or more payment types with cash rounding, and print or email the receipt. Suspended sales, returns and gift cards are all handled from the same screen.

Step 8 - Run reports

Open Reports for the built in reporting suite. Sales, inventory, taxes, payments, customers, suppliers and employees are all covered, with detailed and summary views and date range filters, and every report can be exported.

Step 9 - No known or default credentials

Out of the box OSPOS ships with a well known default administrator (admin / pointofsale). The cloudimg image neutralises that: the built in administrator password ships rotated to a discarded random value, and the real per VM administrator password is generated with a unique random secret on the first boot of every VM. No known, blank or default credential authenticates. You can prove this with the built in round trip check, which confirms the per VM administrator signs in through the OSPOS login form while a blank password and the default pointofsale and other weak guesses are all rejected. The administrator is stored as an employee in the database:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(username,'  (OSPOS admin, person_id ',person_id,')') FROM ospos.ospos_employees WHERE username='admin'"

sudo bash /usr/local/sbin/opensourcepos-cred-roundtrip.sh

Step 10 - Verify the version and where your data lives

Confirm the installed OSPOS version, the health endpoint and where your data lives. The MariaDB database lives at /var/lib/mysql and the OSPOS application (code plus its writable uploads, cache and logs) lives under /var/www/opensourcepos, both on the instance disk that rides with the VM:

grep -oE "application_version = '[^']+'" /var/www/opensourcepos/app/Config/App.php

curl -sI http://127.0.0.1/healthz | head -1

sudo du -sh /var/lib/mysql /var/www/opensourcepos

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. For production, point a DNS record at your VM, then whitelist the hostname so OSPOS accepts requests for it and obtain a certificate with Let's Encrypt. OSPOS validates the Host header, so add your domain to app.allowedHostnames in the environment file:

sudo sed -i "s/^app.allowedHostnames = .*/app.allowedHostnames = '<your-domain>,<vm-public-ip>,localhost,127.0.0.1'/" /var/www/opensourcepos/.env
sudo systemctl restart php8.3-fpm
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

OSPOS derives its base URL from the request, so once you reach the VM on your domain over HTTPS the links render correctly with no further change.

Backing up

Your data is the OSPOS database plus any uploaded files. Dump the database and archive the writable directory:

sudo mysqldump --protocol=socket -uroot ospos > /tmp/ospos-backup.sql
sudo tar czf /tmp/ospos-writable-backup.tar.gz -C /var/www/opensourcepos writable

Copy both files off the VM on your usual schedule. To restore, load the SQL dump into the ospos database and unpack the archive back to /var/www/opensourcepos/writable.

Security notes

• OSPOS serves plain HTTP on port 80 out of the box. For anything beyond a trusted network, add your own domain and TLS as above, or front the VM with Azure Application Gateway.
• The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through OSPOS or over SSH with sudo mariadb.
• The administrator password is unique per VM and no known, blank or default credential authenticates. Keep /root/opensourcepos-credentials.txt protected. To rotate the password, sign in and change it under the administrator's employee record, or from the box set a new bcrypt directly:

sudo mariadb ospos -e "UPDATE ospos_employees SET password='$(php -r "echo password_hash('"'"'<new-password>'"'"', PASSWORD_DEFAULT);")', hash_version='2' WHERE username='admin'"

• OSPOS validates the HTTP Host header against app.allowedHostnames to prevent host header injection, so only hostnames you list are accepted.
• The CodeIgniter application code, its .env (which holds the database password and the encryption key) and the writable tree all sit outside the nginx document root (/var/www/opensourcepos/public), so they are never web reachable.
• Apply operating system updates regularly with sudo apt update && sudo apt upgrade; unattended security updates are enabled by default.
• Restrict inbound 80/tcp and 443/tcp in your NSG to the networks that need access.

Trademark

Open Source Point of Sale is an open source project distributed under the MIT License. This image is an independent packaging of the open source OSPOS software by cloudimg and is not affiliated with, sponsored by, or endorsed by the Open Source Point of Sale project.

Support

This image is maintained by cloudimg with 24/7 support. If you need help deploying or operating Open Source Point of Sale on Azure, contact us at cloudimg.co.uk.