ProjeQtOr on Ubuntu 24.04 on Azure User Guide

Overview

ProjeQtOr is a free and open source project and quality management platform used by project managers, IT departments, service organisations and quality teams to run their delivery work from one web interface. It brings projects and their planning with a Gantt view, activities and tasks, tickets and issues, risks, requirements, tests, meetings, documents, timesheets and resource assignment together in a single application, gated by ProjeQtOr's own user and access control. The cloudimg image ships ProjeQtOr 13.0.0 served by nginx and PHP 8.3 FPM on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server so the appliance is complete and useful on its own. ProjeQtOr runs behind nginx on port 80. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306) and keeps its database, along with your uploaded and generated files, on a dedicated Azure data disk. A unique administrator password is generated on the first boot of every VM, and the well known ProjeQtOr default login is never left active. Backed by 24/7 cloudimg support.

What is included:

• ProjeQtOr 13.0.0 served by nginx and PHP 8.3 FPM, managed by systemd
• A bundled MariaDB server holding the ProjeQtOr database, already installed and ready
• A ready to use web console served on :80, with the full versioned schema in place (347 tables) and no install wizard left exposed
• A per VM administrator password generated on first boot and recorded in a root only file
• No default login: the well known ProjeQtOr admin / admin credential is rotated to a unique per VM secret, and no known, blank or weak credential authenticates
• The database secret kept out of the web tree: parameters.php lives on the data disk outside the docroot, so it can never be served over HTTP
• All required PHP extensions and ProjeQtOr's recommended PHP limits preconfigured
• nginx.service, php8.3-fpm.service and mariadb.service as enabled systemd units
• MariaDB bound to 127.0.0.1 only, never exposed to the network
• A dedicated Azure data disk carrying the MariaDB database, the ProjeQtOr file store and the database configuration
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_D2s_v3 (2 vCPU / 8 GiB RAM) is a sensible starting point; size up for larger or busier teams. NSG inbound: allow 22/tcp from your management network and 80/tcp (and 443/tcp once you add TLS) for the console. ProjeQtOr serves plain HTTP on port 80 out of the box; for production, terminate TLS in front of it with your own domain. The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for ProjeQtOr by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy with the Azure CLI (alternative)

Prefer the command line? Create the VM from the cloudimg ProjeQtOr image with your resource group, image URN, size and SSH key. Open ports 22 and 80 on the network security group, then browse to the public IP.

az vm create \
  --resource-group my-rg \
  --name projeqtor \
  --image <cloudimg-projeqtor-image-urn> \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

az vm open-port --resource-group my-rg --name projeqtor --port 80 --priority 900

Step 3 - Confirm the services and retrieve the admin password

SSH in as azureuser. All three services plus the first boot unit are active, with nginx listening on port 80 and MariaDB bound to the loopback interface only.

systemctl is-active nginx php8.3-fpm mariadb projeqtor-firstboot
ss -tlnp | grep -E ':80 |:3306 '

On the first boot of every VM, ProjeQtOr generates a unique administrator password and records it, together with the sign in URL, in a root only file. Read it with sudo:

sudo cat /root/projeqtor-credentials.txt

Step 4 - Sign in to ProjeQtOr

Browse to http://<your-vm-ip>/ and sign in with the user admin and the password from the credentials file. ProjeQtOr presents its own sign in page.

After signing in you land on the Start Guide home, which walks you through your first configuration steps, with the top navigation for Projects, Activities, Milestones, Meetings, Planning, Resources and Reports, and the left menu for Planning, Ticketing, Agile scrum, Follow up, Steering and Financial.

Step 5 - Create your first project and task

Open the Projects screen from the top navigation and select the new item button to create a project. Give it a name (for example Website Redesign 2026) and save; the project appears in the list and its full detail form opens, ready for type, planning, organisation and the rest.

Now open the Activities screen and create a task against that project. Name it (for example Design homepage mockups), leave the activity type as Task and the project set to your new project, and save. The task is stored in MariaDB and reads straight back into the activity list and detail, linked to its project - this is ProjeQtOr doing exactly what it exists to do, from planning down to individual work items.

From here you can build out the plan and Gantt schedule, raise tickets and issues, log risks and requirements, record meetings and documents, and enter timesheets against each activity.

Security model - no default credentials

ProjeQtOr ships with a well known default administrator account (admin / admin). This image removes that hazard. The single admin user (id 1) is rotated to a unique per VM secret on every first boot, stored as a salted SHA 256 hash, and the default admin password, a blank password and common weak guesses no longer authenticate. The database configuration file that holds the ProjeQtOr database secret is written outside the web tree on the data disk, so it can never be served over HTTP, and the configuration wizard is never exposed. Every build proves, before the image is captured, that the per VM admin authenticates through ProjeQtOr's own User::authenticate() code path while the defaults and weak guesses are rejected, that an unauthenticated request to a privileged route is refused, and that a real project and task persist through the application's own database layer.

bash /usr/local/sbin/projeqtor-cred-roundtrip.sh

Where your data lives

The MariaDB database, the ProjeQtOr file store (uploads, reports and cache) and the database configuration file all live on a dedicated Azure data disk, not on the OS disk. MariaDB's data directory is bind mounted from the data disk onto /var/lib/mysql, and the ProjeQtOr files directory is bind mounted onto the same disk, so your projects, tasks, tickets and uploaded documents survive a VM resize or OS disk swap and stay on managed, snapshot friendly storage.

curl -sI http://127.0.0.1/healthz | head -1
findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data
findmnt -no SOURCE,TARGET /var/lib/mysql

Production - add your own domain and TLS

ProjeQtOr serves plain HTTP on port 80 out of the box so you can sign in immediately. Before you rely on it for day to day project management, put it behind your own domain and TLS so the console is served over HTTPS: point a DNS record at the VM, open 443/tcp on the NSG, and terminate TLS with a certificate from your own certificate authority (for example Let's Encrypt) in front of nginx. Keep MariaDB on the loopback interface, take regular snapshots of the data disk, and restrict SSH to your management network.

Support

This image is built and maintained by cloudimg with 24/7 support. ProjeQtOr is licensed under the GNU Affero General Public License version 3. cloudimg is not affiliated with or endorsed by the ProjeQtOr project.