SPIP on Ubuntu 24.04 on Azure User Guide

Overview

SPIP (Système de Publication pour Internet) is a mature, widely used open-source content management system built for editorial and publishing websites: articles organised into sections, an editorial workflow from draft to published, and multilingual content, all administered from a private web area. The cloudimg image installs SPIP 4.4.16 on a full LAMP stack from the Ubuntu 24.04 repositories (nginx, PHP 8.3-FPM and MariaDB), drives the entire installation at build time so there is no web setup wizard for you to complete, ships a published sample article so a fresh VM renders real content immediately, stores the database and uploaded documents on a dedicated Azure data disk, and regenerates the crypto keys and rotates the database and administrator passwords on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• SPIP 4.4.16 served on port 80 by nginx via the PHP 8.3-FPM FastCGI socket
• A published sample article so the public site renders immediately
• MariaDB on loopback with its data directory on a dedicated Azure data disk
• A dedicated Azure data disk at /var/lib/spip for the MariaDB database and uploaded documents
• Per-VM crypto keys, a per-VM database password and a unique administrator account, all generated on first boot
• nginx.service, php8.3-fpm.service and mariadb.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. NSG inbound: allow 22/tcp from your management network and 80/tcp for the SPIP web interface (front with TLS for public exposure - see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for SPIP by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create -> Create.

Step 2 - Deploy with the Azure CLI

az vm create \
  --resource-group <your-rg> --name spip \
  --image <cloudimg-spip-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name spip --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the LAMP stack is running

On first boot SPIP regenerates its crypto keys, rotates its database password, resets the administrator account to a fresh per-VM password, clears the cache and starts the stack.

systemctl is-active nginx php8.3-fpm mariadb

All three report active.

You can confirm the component versions and that the site answers on port 80:

php -v | head -1
mariadb --version
curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/

The site home returns HTTP 200.

Step 5 - Retrieve the administrator password

The administrator account is unique to your VM and is generated on first boot. Read it as root:

sudo cat /root/spip-credentials.txt

The file contains the login (admin), the private-area URL and a unique password, plus the database name, user and password. The values are unique to every VM; no default login ships in the image. Change the password from the private area after your first sign-in.

Step 6 - Browse to your site

Browse to http://<vm-public-ip>/. The image ships with a published sample article, so you see a complete, rendered editorial site immediately and can start writing rather than facing a blank page.

Step 7 - Read a published article

Click the article headline to open it. SPIP renders the article with its title, publication date and formatted body from the flexible template engine - this is the public face of your editorial content.

Step 8 - Sign in to the private area

Browse to http://<vm-public-ip>/ecrire/. SPIP sends you to its sign-in page; enter admin and the password from the credentials file.

After signing in you land in the private editorial area (the espace privé), the control centre for your site - editing, publishing, templates, maintenance and configuration.

Step 9 - Publish content

SPIP organises content as articles inside sections (rubriques). From the private area choose Edit to create a section, then add an article inside it, write its title and body, and move it through the editorial workflow (draft -> proposed -> published). Published articles appear on the public site immediately. SPIP also supports multiple languages, an author/role model, keywords and documents attached to articles.

Step 10 - Security model

The setup wizard is driven entirely at build time and cannot be reached by a visitor once the site is installed, and the config/ directory - which holds the database credential and the per-VM crypto keys - is never served over HTTP. The private area is gated behind sign-in.

curl -s -o /dev/null -w 'install wizard: HTTP %{http_code}\n' 'http://127.0.0.1/ecrire/?exec=install'
curl -s -o /dev/null -w 'config/connect.php: HTTP %{http_code}\n' http://127.0.0.1/config/connect.php

Both the install wizard and config/connect.php return HTTP 403.

Step 11 - The dedicated data disk

The MariaDB database and SPIP's uploaded documents live on a dedicated Azure data disk mounted at /var/lib/spip, separate from the OS disk. This keeps your content independent of the OS image and lets you resize the disk as your site grows.

df -h /var/lib/spip
findmnt /var/lib/spip

Step 12 - Enabling HTTPS

For any public deployment, front SPIP with TLS. Point a DNS A record at your VM's public IP, then install a certificate with Certbot and the nginx plugin. Run the following as prose-driven steps on your VM (replace the placeholders with your real values; do not paste them verbatim):

• Install Certbot: sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
• Obtain and install a certificate for your domain, supplying your contact email when prompted, by running certbot with the nginx plugin for your-domain.example.com.
• SPIP derives its links from the request host, so it automatically serves over https:// once TLS is terminated in front of it.

Certbot installs a renewal timer automatically; certificates renew without further action.

Step 13 - Maintenance

• Updates: the OS continues to receive unattended security updates. SPIP itself can be updated from the private area under Maintenance, or with the upstream SPIP release.
• Backups: back up the MariaDB spip database (for example with mysqldump) and the /var/lib/spip/IMG directory, which together hold your content and uploaded documents.
• Logs: web server logs are under /var/log/nginx/; PHP-FPM logs are under /var/log/php8.3-fpm.log.

Support

This image is maintained by cloudimg and backed by 24/7 support. If you need help deploying or operating SPIP on Azure, contact the cloudimg team through the cloudimg website.