Paheko on Ubuntu 24.04 on Azure User Guide

Overview

Paheko is a popular free, open source management suite for associations, clubs and non profit organisations. From an ordinary browser you manage members and their subscriptions, keep double entry accounts compliant with a standard chart of accounts, store documents, run a wiki and a public website, and send mailings, all on infrastructure you control. The cloudimg image serves Paheko 1.3.21 behind nginx with PHP 8.3 FPM over a hardened, fully patched Ubuntu 24.04 LTS base. Paheko stores everything in an embedded SQLite database, so there is no separate database engine to run or maintain. On the first boot of every VM a fresh secret key and a unique administrator password are generated, your initial association and administrator account are created, and the password is written to a root only file, so no shared or default login ever ships in the image. Backed by 24/7 cloudimg support.

What is included:

• Paheko 1.3.21 served by nginx through the PHP 8.3 front controller, managed by systemd
• The Paheko web interface on :80 with an administrator account required to sign in
• A per VM secret key and administrator password generated on first boot and recorded in a root only file
• An embedded SQLite database kept outside the web served directory, so no database engine to run
• nginx.service and php8.3-fpm.service as enabled systemd units
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for larger associations and heavier concurrent use. NSG inbound: allow 22/tcp from your management network and 80/tcp (and 443/tcp if you terminate TLS on the VM) for the web interface. Paheko serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Paheko by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name paheko \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the web interface:

az vm open-port --resource-group <your-rg> --name paheko --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm nginx and PHP-FPM are active. nginx serves Paheko on port 80, and there is no database port to expose because Paheko uses an embedded SQLite file.

systemctl is-active nginx php8.3-fpm

ss -tlnp | grep ':80 ' | sed 's/  */ /g'

Step 4 - Retrieve the per VM administrator password

Every VM generates its own administrator password on first boot and writes it, along with the login e-mail and URL, to a root only credentials file. Read it with sudo:

sudo cat /root/paheko-credentials.txt

You sign in to Paheko with the paheko.admin.user e-mail (admin@paheko.local) and the paheko.admin.pass value from this file. You can prove the login works from the command line: the image ships a helper that establishes a real authenticated session with those credentials and confirms that the correct password reaches the dashboard while a wrong password is rejected.

sudo bash /usr/local/sbin/paheko-cred-roundtrip.sh

Step 5 - Sign in to Paheko

Browse to http://<vm-public-ip>/. Paheko opens on its sign in screen. Enter the administrator e-mail and the password from Step 4, then select Se connecter (Sign in).

Step 6 - The dashboard

After signing in you reach the Paheko home page, with the full navigation menu down the left: Membres (members), Comptabilité (accounting), Documents, Site web (public website), and Configuration. Your association is shown on the right, and you can edit the welcome text at any time.

Step 7 - Keep your accounts

Open Comptabilité to keep double entry accounts. On first use Paheko asks you to set the dates of your first accounting year (exercice), then gives you a standard chart of accounts, entry screens for recording transactions, and reports. From the accounting menu you can:

• Open Saisie to record transactions (income, expenditure, transfers and advanced entries).
• Open Comptes to review and manage the chart of accounts.
• Open Suivi des écritures to review posted entries.
• Open Exercices & rapports to close accounting years and produce the balance sheet, income statement and other reports.

To change the administrator password, open Mes infos personnelles from the menu and edit your account.

Step 8 - Manage members

Open Membres to manage the people in your association. You can add members, define membership categories and fees, record activities and subscriptions (Activités & cotisations), and send collective messages (Messages collectifs). Each member has a profile with their contact details, category and subscription history.

Step 9 - Verify the stack

Confirm the Paheko version, the PHP and nginx versions, and that the services are enabled:

cat /var/www/paheko/VERSION

systemctl is-enabled nginx php8.3-fpm paheko-firstboot

curl -s -o /dev/null -w 'Paheko login HTTP %{http_code}\n' http://127.0.0.1/admin/login.php

Step 10 - Where your data lives

Paheko keeps all of your association data in a single embedded SQLite database at /var/www/paheko/data/association.sqlite, together with uploaded files and generated content under /var/www/paheko/data. That directory sits outside the web served document root (/var/www/paheko/www), so it is never exposed to the internet. Confirm the database and its location:

sudo ls -l /var/www/paheko/data/association.sqlite

df -h /var/www/paheko | tail -1

To back up your Paheko instance, either snapshot the OS disk from the portal or the CLI, or copy the SQLite database and the data directory:

sudo tar czf /tmp/paheko-backup.tgz -C /var/www/paheko data

Paheko can also produce its own backups from the Configuration area in the web interface.

Step 11 - Enable HTTPS with Let's Encrypt

The image serves Paheko over HTTP on port 80 so it works immediately behind the VM's public address. For production you should put it behind HTTPS. Point a DNS name at the VM, open 443/tcp in the NSG, then install Certbot and request a certificate. Replace your-domain.example.com with the DNS name that resolves to the VM:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot obtains a certificate, updates the nginx configuration to serve Paheko over HTTPS, and sets up automatic renewal. Because Paheko answers on whatever host you reach it on, no application configuration change is needed after you add TLS.

Step 12 - Maintain your VM

Apply operating system security updates regularly; the image ships fully patched with unattended security upgrades enabled. Paheko itself can be upgraded from its own interface or by replacing the application tree with a newer release while keeping the data directory in place.

Security notes

• Paheko serves plain HTTP on port 80. For production, put it behind your own TLS terminating reverse proxy or an Azure Application Gateway with a certificate for your domain, and restrict port 80 in the NSG to trusted networks.
• The per VM administrator password lives in /root/paheko-credentials.txt, readable only by root, and a unique secret key is generated on first boot too, so no shared or default credential ships in the image. Sign in and change the administrator password from your personal information page, and keep a copy somewhere safe.
• The SQLite database and all uploaded content live under /var/www/paheko/data, outside the web served directory, and nginx denies direct access to it.
• Keep the VM patched. The image ships fully patched with unattended security upgrades enabled.

Architecture summary

Support

cloudimg images come with 24/7 support. If you have any questions about this Paheko image or need help with your deployment, contact us through the cloudimg website.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.