Plausible Community Edition on Ubuntu 24.04 on Azure User Guide

Overview

Plausible is an open-source, privacy-friendly, lightweight web analytics platform - a simple and ethical alternative to Google Analytics that does not use cookies and is fully compliant with GDPR, CCPA and PECR. This image ships the self-hosted Community Edition (AGPL-3.0), deployed as the official Docker Compose stack: the Plausible app, a PostgreSQL database for dashboard and user metadata, and a ClickHouse database for the analytics events. The cloudimg image installs Plausible Community Edition v3.0.1, runs the stack under a systemd unit behind an nginx reverse proxy on port 80, persists all data on a dedicated Azure data disk, and seeds a unique admin account with a strong per-VM password on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• Plausible Community Edition v3.0.1 (AGPL-3.0), the self-hosted community build
• The official three-container stack via Docker Compose: the Plausible app, plausible_db (PostgreSQL 16) and plausible_events_db (ClickHouse)
• nginx on :80 as a reverse proxy to the Plausible app on loopback 127.0.0.1:8000
• PostgreSQL and ClickHouse kept on the private Docker network only - never exposed on the host or any external interface
• A per-VM admin account (admin@cloudimg.local) seeded on first boot with a strong unique password, recorded in a root-only file; open registration disabled
• A dedicated Azure data disk at /var/lib/plausible holding the Docker data-root, all database volumes and the analytics events
• plausible.service + nginx.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B4ms (4 vCPU / 16 GiB RAM) is the recommended size - ClickHouse is memory-hungry, so a smaller VM is not advised. NSG inbound: allow 22/tcp from your management network and 80/tcp for the Plausible dashboard. Plausible serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Plausible by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size (Standard_B4ms); under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name plausible \
  --image <marketplace-image-urn> \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name plausible --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

On first boot the VM generates per-VM secrets, brings up the Compose stack and seeds the admin account. Confirm both systemd units are active:

systemctl is-active plausible.service nginx.service

Both report active. The Plausible app, PostgreSQL and ClickHouse run as containers managed by plausible.service; the data disk is mounted at /var/lib/plausible.

Step 5 - Retrieve your admin password

The admin password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/plausible-credentials.txt

This file contains PLAUSIBLE_ADMIN_EMAIL (admin@cloudimg.local) and PLAUSIBLE_ADMIN_PASSWORD. Store the password somewhere safe. Open registration is disabled, so this seeded account is your way in.

Step 6 - Confirm the health endpoint

Plausible exposes an unauthenticated health endpoint that reports the status of the app, PostgreSQL and ClickHouse:

curl -s http://localhost:8000/api/health

It returns a JSON object with "postgres":"ok" and "clickhouse":"ok" once the whole stack is healthy. All three containers report healthy and the dashboard is reachable on :80.

Step 7 - Sign in to the dashboard

Browse to http://<vm-public-ip>/ and sign in as admin@cloudimg.local with the password from Step 5.

After signing in you land on My Sites. This is where every website you track is listed. Click + Add Website to register your first site - enter its domain and timezone, then add the provided snippet to your site.

Opening a site shows its analytics dashboard: unique visitors, total visits, pageviews, bounce rate, visit duration, top sources, top pages and more, all updating in real time.

The Settings area covers your account preferences, security (including two-factor authentication), API keys for the Stats API, and more.

Step 8 - Verify authentication from the command line

You can confirm the seeded admin credentials work end to end without the browser. Read the password with sudo grep '^PLAUSIBLE_ADMIN_PASSWORD=' /root/plausible-credentials.txt | cut -d= -f2-, fetch the login page to capture its CSRF token and a session cookie, then POST the login form. Because Plausible protects the login form with a CSRF token, the round-trip looks like this in a shell (the password is read from the credentials file into $PW, so no secret is typed on the command line): curl -s -c cj /login to get the _csrf_token, then curl -b cj --data-urlencode "_csrf_token=$C" --data-urlencode "email=admin@cloudimg.local" --data-urlencode "password=$PW" http://localhost:8000/login. A correct password returns HTTP 302 redirecting to /sites; a wrong password re-renders the login form (HTTP 200) and grants no session. The screenshot below shows the Docker data-root on the data disk, the backing databases isolated from all external interfaces, and both the correct and wrong password outcomes.

Step 9 - Confirm data lives on the dedicated disk

All Plausible state - the Docker data-root, the PostgreSQL database and the ClickHouse events (the bulk of the data) - is stored on the dedicated Azure data disk so it survives OS changes and can be resized independently:

findmnt /var/lib/plausible

The mount is backed by a separate Azure data disk captured into the image and re-provisioned on every VM. The pre-pulled container images and every database volume live under it.

Adding your analytics

Plausible is designed to be dropped onto any website in minutes. Add a website in the dashboard, copy the lightweight tracking snippet (under 1 KB) into your site's <head>, and visitors start appearing in real time. Plausible also offers a Stats API (create an API key under Settings) so you can pull metrics into your own dashboards, and it supports custom events and goals for conversion tracking. See the Plausible documentation for the tracking script, the Stats API and integration guides.

Maintenance

• Users: open registration is disabled. Invite additional team members from the dashboard, or manage the admin account under Settings.
• Backups: snapshot the /var/lib/plausible data disk, or use pg_dump against the plausible_db container for the metadata and ClickHouse backups for the events.
• Data: the PostgreSQL and ClickHouse volumes plus the Docker images live under /var/lib/plausible.
• TLS: Plausible serves plain HTTP on port 80; front it with TLS (e.g. certbot, or an Azure Application Gateway / Front Door) and your own domain before production use, and set BASE_URL accordingly.
• Upgrades: update the image tags in /opt/plausible/compose.yml and run sudo systemctl restart plausible.service to roll the stack forward.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.