Applications Azure

REDAXO CMS on Ubuntu 24.04 on Azure User Guide

| Product: REDAXO CMS on Ubuntu 24.04 LTS on Azure

Overview

REDAXO is an open source PHP content management system developed since 2004 by Yakamara Media. It is deliberately unopinionated: rather than forcing a fixed page model on you, it gives you modules and templates you define yourself, so the editing interface matches the site you are actually building. Editors get a clean backend with a structured page tree, a media pool and reusable content blocks, while developers get plain PHP templates, a documented API, a command line console and an addon system. The cloudimg image ships REDAXO 5.21.2 served by Apache with PHP 8.3 on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB 10.11 server, so the appliance is complete and useful on its own. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306) and keeps its data on a dedicated Azure data disk. A unique administrator password and database password are generated on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

  • REDAXO 5.21.2 with its complete standard addon set, served by Apache with PHP 8.3
  • A bundled MariaDB 10.11 server holding the REDAXO content database, already installed
  • PHP 8.3 with OPcache and every extension REDAXO requires, plus curl, gd and zip for the media pool
  • Secure by default: the published image carries no configuration file, no database and no user account
  • A per VM administrator password and database password generated on first boot and recorded in a root only file
  • A fail closed first boot: the web server refuses every request (HTTP 503) until per VM setup has completed, so no setup wizard is ever exposed to a stranger
  • MariaDB bound to 127.0.0.1 only, never exposed to the network
  • A dedicated Azure data disk carrying both the MariaDB database and the REDAXO application tree
  • A base URL derived at first boot, so the site answers on the public IP, the private IP or any DNS name you point at it
  • apache2.service and mariadb.service as enabled systemd units
  • 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point for a small to medium site; move up to Standard_D2s_v3 for busier editorial sites or heavy media use. NSG inbound: allow 22/tcp from your management network, 80/tcp for the application and 443/tcp if you terminate TLS on the VM. The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

In the Azure portal choose Create a resource, search for REDAXO CMS on Ubuntu 24.04 LTS by cloudimg, and select Create. Pick your subscription, resource group and region, choose the Standard_B2s size, select SSH public key authentication with the username azureuser, and allow inbound 22, 80 and 443. The image attaches its own 30 GiB data disk for your content database and application tree, so you do not need to add one.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name redaxo-01 \
  --image <cloudimg-redaxo-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the web ports on the VM's network security group:

az vm open-port --resource-group <your-rg> --name redaxo-01 --port 80 --priority 900
az vm open-port --resource-group <your-rg> --name redaxo-01 --port 443 --priority 910

First boot generates the per VM credentials and completes the REDAXO setup automatically; give it a minute after the VM reports running before you browse to it.

Step 3 - Confirm the services are running

SSH to the VM as azureuser and confirm Apache, MariaDB and the first boot unit are all active:

systemctl is-active apache2 mariadb redaxo-firstboot

MariaDB is bound to 127.0.0.1:3306 only, while Apache serves on port 80 for everyone:

ss -tlnH | grep -E ':80 |:3306 ' | awk '{print $1, $4}'

The apache2, mariadb and redaxo-firstboot services all reporting active, with Apache listening on port 80 and MariaDB bound to loopback 127.0.0.1:3306

Step 4 - Retrieve the per VM administrator password

The administrator user name, administrator password and database password are generated for this VM alone on first boot and written to a root only file. Read it over SSH:

sudo cat /root/redaxo-credentials.txt

The file holds REDAXO_ADMIN_USERNAME, REDAXO_ADMIN_PASSWORD, REDAXO_BACKEND_URL and the loopback database details. REDAXO_URL is the VM's own address as seen from inside the VM; because Azure does not expose the public IP to the instance this is usually the private address, but browsing the public IP shown in the portal works identically, since REDAXO's server URL is set from the resolved address at first boot.

The per VM REDAXO credentials file, showing the admin login user, the generated password masked, the application URL and the loopback MariaDB details

Step 5 - Sign in to the backend

Browse to http://<your-vm-ip>/redaxo/ and sign in with the REDAXO_ADMIN_USERNAME and REDAXO_ADMIN_PASSWORD from the credentials file. Change the password from your profile page after the first sign in.

The REDAXO backend sign-in page showing the username and password fields and the Login button

Once signed in you land in the backend, with the main menu on the left (Structure, Mediapool, Templates, Modules, User, AddOns, Installer, System) and the seeded starter article ready to edit or replace.

The signed-in REDAXO backend showing the main menu and the seeded Home starter article using the cloudimg Starter template, marked online

Step 6 - Build your content

Open Structure to manage the page tree. The image seeds one online article, Home, using a cloudimg Starter template, so the front end answers immediately rather than showing an installer. Edit or delete it whenever you are ready to build your own site.

The REDAXO Structure page listing the seeded Home article with its template, created date, priority and online status, and the buttons to add categories and articles

Define your own content model with Templates (plain PHP templates) and Modules (reusable content blocks), upload assets in Media Pool, and add further addons from the REDAXO repository through the Installer.

Step 7 - The bundled addon set

The image ships REDAXO's complete standard addon set: structure and page tree, media pool and media manager, metadata fields, user and role administration, backup and export, the cronjob scheduler, the addon installer and the backend theme. The AddOns page lists what is installed.

The REDAXO AddOns page listing the installed core addon set, including structure, media pool, media manager, metainfo, users, backup, cronjob and the installer

Step 8 - No known or default credentials

This image is secure by default. The published image contains no configuration file, no database and no user account, so nothing is shared between deployments. On first boot a one shot service generates a fresh database password and a fresh administrator password, creates the database and a least privilege database user, runs the REDAXO console setup and closes the setup routine permanently. Until first boot completes the web server answers every request with HTTP 503, so the setup wizard can never be reached by an anonymous visitor.

Exactly one backend administrator exists:

sudo mariadb -N -B -e "SELECT login FROM redaxo.rex_user WHERE admin=1"

The bundled round trip check confirms the per VM administrator password really signs in through the REDAXO login form, while a wrong password is rejected:

sudo /usr/local/sbin/redaxo-login-check.sh

The cloudimg account as the only REDAXO administrator, and the versions with the backend and front end answering HTTP 200

Step 9 - Verify the stack and where your data lives

Confirm the REDAXO, PHP and MariaDB versions:

sudo -u www-data php /var/www/redaxo/redaxo/bin/console -V; php -v | head -1; mariadb --version

Both the MariaDB data directory and the REDAXO application tree live on a dedicated ext4 Azure data disk, mounted at /data and bind mounted onto their canonical paths, so your content and media grow and snapshot independently of the operating system disk:

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/mysql; findmnt -no SOURCE,TARGET,FSTYPE /var/www/redaxo

The REDAXO, PHP and MariaDB versions with the ext4 data disk mounted at /data and bind mounted onto both the MariaDB datadir and the REDAXO application tree

Adding your own domain and TLS

Point a DNS A record at the VM's public IP, then set REDAXO's server URL to your domain from the command line:

sudo -u www-data php /var/www/redaxo/redaxo/bin/console config:set server https://your-domain/

For TLS you can put an Azure Application Gateway or Load Balancer with a certificate in front of the VM, or terminate directly on the VM with Let's Encrypt:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d your-domain

Backing up

The content database is the REDAXO redaxo schema in MariaDB; the media pool and generated assets live under /var/www/redaxo on the data disk. Back up both together. A quick database dump:

sudo mariadb-dump redaxo | gzip > redaxo-db-$(date +%F).sql.gz

REDAXO's own Backup addon (under AddOns) can also export and import the database and files from the backend.

Security notes

  • MariaDB is bound to 127.0.0.1 only. To reach it from your workstation, use an SSH tunnel: ssh -L 3306:127.0.0.1:3306 azureuser@<your-vm-ip>.
  • The administrator and database passwords are unique per VM and are never recoverable from the published image.
  • Keep the OS patched: unattended security upgrades are enabled by default.
  • Restrict inbound SSH (22/tcp) to trusted addresses in your network security group.

Trademark

REDAXO is open source software published under the MIT licence by Yakamara Media GmbH & Co. KG. See www.redaxo.org. This image is built and supported by cloudimg and is not affiliated with or endorsed by the REDAXO project. All product and company names are trademarks or registered trademarks of their respective holders.

Support

Every cloudimg subscription includes 24/7 support by email (support@cloudimg.co.uk) and live chat, covering deployment, upgrades, addons, templates and modules, performance tuning, TLS and MariaDB administration.