Pydio Cells on Ubuntu 24.04 LTS on Azure

Overview

Pydio Cells is an open source, self hosted file sharing and document collaboration platform written in Go. It gives your team a modern web workspace for storing, organising, sharing and collaborating on files, with granular access control, versioning, activity feeds and comments, backed by a MySQL or MariaDB metadata store and a local filesystem datasource. It is an enterprise grade, data owning alternative to the large hosted file sync and content suites.

The cloudimg image runs the AGPL Community (Home) edition of Pydio Cells 5.0.2 as a native binary, with MariaDB for its metadata and nginx as the reverse proxy, on a hardened, fully patched Ubuntu 24.04 LTS base. Only the open source edition is shipped: the installer runs with licenserequired:false and asserts the binary self identifies as Home Edition, so no component of the separate, paid Cells Enterprise distribution is ever pulled or activated.

The image is deliberately shipped unprovisioned, with no database and no secrets. Pydio Cells creates its first administrator during its own configure step, so on the first boot of every VM a one shot service generates this VM's MariaDB password and a single administrator with a random password, runs cells configure, and only then publishes the app. Until that finishes, nothing is bound to port 80 — so no instance is ever reachable from the network in an unprovisioned state, and no secret is ever shared between customers. Backed by 24/7 cloudimg support.

What is included:

• Pydio Cells 5.0.2 (AGPL-3.0, Home/Community edition) as a native Go binary, managed by systemd
• The Cells web workspace on :80, reverse proxied by nginx to the loopback bound server
• A local MariaDB metadata store, reachable only inside the VM
• A per VM database password and administrator password generated on first boot and recorded in a root only file
• Nothing bound to port 80 until first boot has provisioned and secured the instance
• A default drop nftables firewall so only 22, 80 and 443 are reachable from the network
• mariadb.service, cells.service, nginx.service and nftables.service as enabled units so the stack returns after a reboot
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for many concurrent users or large libraries. NSG inbound: allow 22/tcp from your management network and 80/tcp (plus 443/tcp once you terminate TLS on the VM) so your browser and sync clients can reach Pydio Cells.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Pydio Cells by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create and Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name pydio-cells \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 so your browser and sync clients can reach Pydio Cells:

az vm open-port --resource-group <your-rg> --name pydio-cells --port 80

Step 3 - Confirm the services are running

SSH in as azureuser. First boot generates this VM's secrets, creates the database and administrator, runs cells configure and warms up the login endpoint; it completes in a minute or two, after which nginx binds port 80 and Pydio Cells is ready.

systemctl is-active mariadb cells nginx nftables

ss -tln | grep ':80'

/opt/pydio/cells version

The version banner reports Pydio Cells Home Edition, confirming this is the open source AGPL build.

If port 80 is not bound yet, first boot has not completed. That is deliberate and fail closed: Pydio Cells is never published before it has been provisioned and secured. Check with systemctl status pydio-cells-firstboot.service and journalctl -u pydio-cells-firstboot.service.

Step 4 - Review the host firewall

Pydio Cells is a cluster aware server: its main site and internal gRPC services bind to all interfaces by design. The image therefore ships a default drop nftables firewall so the only network reachable surface is 22 (SSH), 80 (nginx to Cells) and 443 (your TLS). Loopback and established traffic are always allowed, so Cells' own internal communication and all outbound traffic are unaffected.

systemctl is-active nftables

sudo nft list chain inet filter input

Step 5 - Retrieve this VM's administrator credentials

Every VM creates its own administrator on first boot and writes the login and password, with the sign in address, to a root only credentials file:

sudo cat /root/pydio-cells-credentials.txt

You can prove the generated password really authenticates, straight from the command line, without printing it. Pydio Cells' own web login endpoint accepts the login and password and returns a token, so the correct password reaches an authenticated session while a wrong one is rejected:

P=$(sudo grep '^pydio.admin.pass=' /root/pydio-cells-credentials.txt | cut -d= -f2-)
printf 'login page:       HTTP %s\n' "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/login)"
printf 'correct password: HTTP %s\n' "$(curl -s -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -d "{\"AuthInfo\":{\"login\":\"admin\",\"password\":\"$P\",\"type\":\"credentials\"}}" http://127.0.0.1/a/frontend/session)"
printf 'wrong password:   HTTP %s\n' "$(curl -s -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -d '{"AuthInfo":{"login":"admin","password":"WRONG-password","type":"credentials"}}' http://127.0.0.1/a/frontend/session)"

A 200 for the login page, a 200 for the correct per VM password and a 401 for a wrong one is exactly what you want to see.

Step 6 - Sign in to Pydio Cells

Browse to http://<vm-public-ip>/. Pydio Cells opens on its sign in screen — there is no setup wizard, because your administrator was already created on first boot. Enter the pydio.admin.login (admin) and pydio.admin.pass values from Step 5.

Change the password from your account settings after your first sign in. User self registration is disabled by default; you add further users deliberately from the administration area.

Step 7 - Your workspace and files

After signing in you land on the Cells home, with your workspaces and recent activity. Pydio Cells organises files into Workspaces — every account has a private Personal Files workspace and a shared Common Files workspace by default — and you can create Cells, shared spaces for collaborating with others.

Click All Files to open the file browser. Upload files and create folders from the web interface, browse and search them, add comments and share per file or per folder. Every file stays on your own server, in the MariaDB backed datasource on this VM.

Open a folder to work with its contents. The breadcrumb, activity feed, versioning and per item sharing are all available from here.

Step 8 - Check persistence and hardening

The stack is enabled to return after a reboot, the credentials file is root only, and no swap is baked into the OS disk (an Azure image requirement). Unattended security upgrades keep the base operating system patched.

ls -l /root/pydio-cells-credentials.txt

systemctl is-enabled mariadb nginx nftables pydio-cells-firstboot cells

swapon --show | wc -l

Step 9 - Set your external URL and enable HTTPS

Pydio Cells generates absolute links (for sharing and single sign on) from an external URL. The image sets this to the address it detects on first boot; before you share files externally, set it to the public host name or IP your users will actually use, and put HTTPS in front. Point a DNS record at the VM, then install a certificate — the bundled nginx proxies to Cells on the loopback interface, so certbot's nginx integration terminates TLS in front of it:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d cells.example.com

After issuing the certificate, set the external site URL to your https:// host name and make sure 443/tcp is open in the NSG:

sudo -u pydio env CELLS_WORKING_DIR=/var/cells /opt/pydio/cells configure sites

Step 10 - Back up and maintain your VM

Everything that matters lives in the MariaDB cells database and the datasource files under /var/cells/data, so a database dump plus that directory is a complete backup:

sudo mysqldump cells > pydio-cells-backup.sql
sudo tar czf pydio-cells-data-backup.tar.gz -C /var/cells data

Store the backups somewhere safe. Unattended security upgrades keep the operating system patched, and Azure Backup or managed disk snapshots give you whole VM recovery.

Security notes

• No shared secret ships in the image. The image contains no database and no secrets. The MariaDB password and the administrator password are generated on the first boot of your VM.
• Only the open source edition is shipped. The installer runs with licenserequired:false and verifies the binary reports the Home Edition; no Cells Enterprise component is ever pulled or activated.
• Nothing is published before it is secured. In the shipped image nothing is bound to port 80. The public site is enabled only after first boot has provisioned Cells, so an unprovisioned instance is never exposed to the network.
• Fail closed. If first boot cannot complete, port 80 is never bound at all.
• A default drop host firewall. nftables allows only 22, 80 and 443 inbound; Cells' internal services are never reachable from the network.
• Put Pydio Cells behind HTTPS before real traffic, set your external URL, and restrict 22/tcp to your management network.
• The database is not exposed. MariaDB is reachable only inside the VM; nginx on port 80 is the sole network facing service.

Architecture summary

Support

cloudimg images come with 24/7 support. Email support@cloudimg.co.uk with your Azure subscription ID and the VM name. For Pydio Cells itself, see the Pydio Cells project on GitHub and the Pydio documentation.