Tryton ERP on Ubuntu 24.04 on Azure User Guide

Overview

Tryton is a mature open source enterprise resource planning (ERP) platform, governed by the Tryton Foundation and released under the GPL. It is built from independent modules that you activate as your business needs them: parties and contacts, products, double entry accounting with invoicing, sales, purchasing, inventory and warehouses, manufacturing and projects with timesheets, all sharing one PostgreSQL database and one web client. Releases follow a six-month cycle, and every x.0 series is a long term support release.

The cloudimg image delivers Tryton 8.0 LTS (trytond 8.0.10 with the sao 8.0.11 web client) on Ubuntu 24.04, served over HTTPS, with a fresh database and every secret generated on the first boot of your VM. Backed by 24/7 cloudimg support.

What is included:

• trytond 8.0 in a dedicated Python virtual environment, run by gunicorn as the unprivileged tryton user and bound to 127.0.0.1:8000 only
• The sao web client, served by nginx over HTTPS on port 443 with a certificate generated for your VM; port 80 only redirects to HTTPS (plus a plain /healthz for load balancer probes)
• These modules activated and ready on first sign-in: party, company, product, account, account_invoice, stock, sale, purchase, production, project, timesheet (and their dependencies)
• These modules installed and ready to activate when you need them: account_statement, account_payment, account_asset, analytic_account, sale_price_list, product_price_list, purchase_request, stock_supply, project_invoice, production_routing, production_work
• trytond-cron running Tryton's scheduled actions
• PostgreSQL 16 on the loopback address only
• No default login: the admin password, the database password and the TLS key are generated on your VM's first boot and written to a root only file
• postgresql, tryton, tryton-cron and nginx systemd services, enabled and active

Tryton is a registered trademark of the Tryton Foundation. cloudimg is not affiliated with or endorsed by the Tryton Foundation; this image packages the unmodified open source software.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU, 4 GiB RAM) runs Tryton comfortably for a small team; choose a larger size for many concurrent users or large data volumes. Network security group inbound rules: 22/tcp from your management network, 443/tcp for the web client, and optionally 80/tcp, which only redirects to HTTPS.

Step 1: Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Tryton ERP by cloudimg and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTPS (443). Then select Review + create and Create.

Step 2: Deploy from the Azure CLI

az vm create \
  --resource-group my-resource-group \
  --name tryton \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open HTTPS (and, if you want the redirect, HTTP) to your users:

az vm open-port --resource-group my-resource-group --name tryton --port 443 --priority 900
az vm open-port --resource-group my-resource-group --name tryton --port 80 --priority 910

Step 3: Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4: Confirm the Tryton stack is running

First boot creates your database, activates the modules and generates this VM's secrets before anything is served, so allow about three minutes after the VM is created. When the four services are active, Tryton is ready:

systemctl is-active postgresql tryton tryton-cron nginx

active
active
active
active

Check the Tryton server and web client releases:

/opt/tryton/venv/bin/python -c 'import trytond; print("trytond", trytond.__version__)'
grep -o '"version": "[^"]*"' /opt/tryton/sao/package.json

trytond 8.0.10
"version": "8.0.11"

Step 5: Check what the network can reach

Only SSH and the two web ports listen on the VM's network interfaces. The Tryton server and PostgreSQL are bound to the loopback address, and systemd's DNS stub resolver is local only:

sudo ss -H -lnt | awk '{print $4}' | sort -u

0.0.0.0:22
0.0.0.0:443
0.0.0.0:80
127.0.0.1:5432
127.0.0.1:8000
127.0.0.53%lo:53
127.0.0.54:53
[::]:22
[::]:443
[::]:80

Port 80 serves nothing but a permanent redirect to HTTPS:

curl -s -o /dev/null -w '%{http_code} -> %{redirect_url}\n' http://127.0.0.1/

301 -> https://127.0.0.1/

Step 6: Retrieve the first-boot credentials

Every secret on this VM was generated on its first boot and written to a file only root can read. Nothing here is shared with any other deployment. Show the file without its two passwords:

sudo stat -c '%a %U:%G %n' /root/tryton-credentials.txt
sudo grep -v 'PASSWORD=' /root/tryton-credentials.txt

600 root:root /root/tryton-credentials.txt
# Tryton on Ubuntu 24.04 by cloudimg - generated on first boot, unique to THIS VM.
# Keep this file safe. Change the admin password after your first sign in.

TRYTON_URL=https://<vm-public-ip>/#tryton
TRYTON_DATABASE=tryton
TRYTON_ADMIN_USER=admin
TRYTON_POSTGRES_ROLE=tryton
#
# Open TRYTON_URL in a browser (the #tryton suffix selects the database) and sign
# in as "admin". A self-signed certificate covering <vm-public-ip> and <vm-private-ip> is used
# until you install your own.

Then read the admin password itself:

sudo grep '^TRYTON_ADMIN_PASSWORD=' /root/tryton-credentials.txt | cut -d= -f2-

The file also holds TRYTON_POSTGRES_PASSWORD, the password of the tryton PostgreSQL role that the Tryton server connects with. Tryton creates no default login of its own; the admin account's password is set by trytond-admin on your VM's first boot, and no database exists in the image at all.

Step 7: Sign in

Browse to the TRYTON_URL from Step 6, for example https://<vm-public-ip>/#tryton. Your browser warns about the self-signed certificate; accept it to continue, or install your own certificate first (Step 13). In the Login dialog the database is tryton and the user name is admin; select Login, then enter the admin password from Step 6 and select OK.

You can prove the whole path from the VM itself. The image includes a self-test that signs in through nginx exactly as the web client does, confirms that the published default password admin and a blank password are refused, that database listing and management are closed, that only the expected ports are reachable, and that a client cannot forge its address:

sudo /usr/local/sbin/tryton-selftest.sh

[ports] off-box TCP exactly [22 80 443]; trytond 127.0.0.1:8000; off-box UDP [68]
[ports] TRYTON_PORTS_OK
[login] modules active: 18 (account account_invoice company party product production project purchase sale stock timesheet)
[login] TRYTON_ROUNDTRIP_OK
[xff] refused login recorded from 127.0.0.1 (forged 203.0.113.77 ignored)
[xff] TRYTON_XFF_OK
[http] port 80 redirects to HTTPS
TRYTON_SELFTEST_OK

Change the admin password after your first sign-in: open the user menu at the top right (Administrator), choose Preferences, and set a new password on the form. Tryton refuses passwords shorter than eight characters or equal to the user's login, name or email address.

Step 8: Set up your company

The first time admin signs in, Tryton opens its Module Configuration wizard. Select OK and it walks you through each activated module's setup in turn:

1. Configure Languages: tick any extra languages your users work in and select Load (English is already loaded), then Next.
2. Configure Users: create an account for each person, with their login, password and access groups (select Add for each, then End).
3. Configure Company: create your company's party (name and address) and choose its currency.
4. Create Chart of Accounts from Template: pick a chart of accounts for your company. The Minimal Account Chart is always available; country charts can be installed as extra modules.

Once the wizard is finished, open Financial, Configuration, Fiscal Years and create the current fiscal year with its periods and invoice sequences. The main menu on the left then gives you Parties, Products, Financial, Inventory & Stock, Purchases, Sales, Timesheet, Productions and Projects.

Step 9: Record a sale and invoice it

Create your products under Products (a product needs a unit, a sale price and an account category that carries the revenue and expense accounts), and your customers under Parties. Then open Sales, create a sale, choose the customer, and add lines with the product and quantity. Tryton computes the line amounts and the untaxed and total amounts as you type.

Select Quote and then Confirm. Tryton processes the confirmed sale: it creates the customer shipment in your warehouse and, with the default invoice method, the customer invoice. Open the invoice from the sale (or from Financial, Invoices), set the invoice date and select Post. The posted invoice carries its number, its accounting move and the amount due.

Every document type has a list view with search, filters and saved bookmarks; here are the sales, a processed order and a quotation still waiting for the customer:

Step 10: Activate more modules

Eleven more Tryton modules are installed in the image and can be activated at any time, for example bank statements (account_statement), payments (account_payment), fixed assets (account_asset), analytic accounting (analytic_account), price lists (sale_price_list, product_price_list), purchase requests and stock supply, project invoicing, and manufacturing routings and work centres (production_routing, production_work). List the installed modules that are not active yet:

sudo -u postgres psql -d tryton -tAc "SELECT name FROM ir_module WHERE state='not activated' ORDER BY name"

Activate a module with trytond-admin, which also activates anything it depends on, then restart the Tryton services so they load it:

sudo /usr/local/sbin/tryton-run trytond-admin -c /etc/tryton/trytond.conf -d tryton -u account_statement --activate-dependencies </dev/null
sudo systemctl restart tryton tryton-cron

Sign out and back in to the web client to see the new menus. More than two hundred further modules (country charts of accounts and tax rules, e-commerce, CRM, subscriptions, and more) are published on PyPI as trytond_<module>; install one into the virtual environment with a version from the same 8.0 series, then activate it the same way:

sudo /opt/tryton/venv/bin/pip install 'trytond_account_be>=8.0,<8.1'
sudo /usr/local/sbin/tryton-run trytond-admin -c /etc/tryton/trytond.conf -d tryton -u account_be --activate-dependencies
sudo systemctl restart tryton tryton-cron

Step 11: Outbound email

Tryton sends email for password resets, notifications and documents. Point it at your SMTP relay by adding an [email] section to /etc/tryton/trytond.conf, then restart:

[email]
uri = smtp+tls://relay-user:relay-password@smtp.example.com:587
from = Tryton <erp@example.com>

sudo systemctl restart tryton tryton-cron

Test the relay with sudo /usr/local/sbin/tryton-run trytond-admin -c /etc/tryton/trytond.conf -d tryton --test-email you@example.com.

Step 12: Security model

The Tryton server listens on loopback only and trusts exactly one proxy: nginx, which overwrites the client address it passes on, so Tryton's per-address login rate limiting always sees the real caller. The database listing is switched off, and Tryton 8.0 has no remote call that creates, drops, dumps or restores a database, so database management is only possible from a shell on the VM:

sudo grep -E '^(list|listen|num_proxies) ' /etc/tryton/trytond.conf
curl -sk -o /dev/null -w 'database list: HTTP %{http_code}\n' -H 'Content-Type: application/json' \
  -d '{"id":0,"method":"common.db.list","params":[]}' https://127.0.0.1/rpc/

list = False
listen = 127.0.0.1:8000
num_proxies = 1
database list: HTTP 403

Tryton delays and then blocks repeated failed sign-ins for the same login and from the same network. For production use, also restrict port 443 in your network security group to the networks your users connect from, and keep port 22 limited to your management network.

Step 13: Use a domain name and your own certificate

Point a DNS record such as erp.example.com at the VM's public IP, open port 80 in the network security group, and replace the self-signed certificate with a Let's Encrypt one. nginx reads the certificate from /etc/ssl/tryton/tryton.crt and the key from /etc/ssl/tryton/tryton.key:

sudo apt-get install -y certbot
sudo certbot certonly --standalone -d erp.example.com -m you@example.com --agree-tos -n \
  --pre-hook 'systemctl stop nginx' --post-hook 'systemctl start nginx'
sudo ln -sf /etc/letsencrypt/live/erp.example.com/fullchain.pem /etc/ssl/tryton/tryton.crt
sudo ln -sf /etc/letsencrypt/live/erp.example.com/privkey.pem /etc/ssl/tryton/tryton.key
sudo systemctl reload nginx

certbot renews automatically and its hooks stop and start nginx around each renewal. Users then browse to https://erp.example.com/#tryton.

Step 14: Back up your ERP

A complete backup is the PostgreSQL database plus Tryton's file store (attachments and stored reports). Take both together, for example from a nightly cron job, and copy them off the VM:

sudo -u postgres pg_dump -Fc tryton > /var/tmp/tryton-$(date +%F).dump
sudo tar -C /var/lib/tryton -czf /var/tmp/tryton-filestore-$(date +%F).tar.gz filestore

To restore onto a new VM from this image, stop the Tryton services, recreate the database from the dump, and unpack the file store:

sudo systemctl stop tryton tryton-cron
sudo -u postgres dropdb tryton
sudo -u postgres createdb -O tryton -E UTF8 -T template0 tryton
sudo -u postgres pg_restore -d tryton --no-owner --role=tryton /var/tmp/tryton-2026-09-19.dump
sudo tar -C /var/lib/tryton -xzf /var/tmp/tryton-filestore-2026-09-19.tar.gz
sudo systemctl start tryton tryton-cron

Azure Backup snapshots of the whole VM are a good complement to these application level backups.

Step 15: Memory, logs and maintenance

The whole stack uses about 1 GiB of memory on a Standard_B2s. Tryton's server, scheduler and first-boot logs are in the systemd journal:

free -m | head -2
sudo journalctl -u tryton -u tryton-cron -n 20 --no-pager

Ubuntu security updates install automatically through unattended-upgrades. Tryton publishes bug fix releases for the 8.0 series regularly; to apply them, update the packages within the series, update the database and restart:

sudo /opt/tryton/venv/bin/pip freeze | grep -oE '^(trytond|trytond_[a-z_]+|proteus)' | sed 's/$/~=8.0.0/' > /var/tmp/tryton-8.0.txt
sudo /opt/tryton/venv/bin/pip install --upgrade -r /var/tmp/tryton-8.0.txt
sudo /usr/local/sbin/tryton-run trytond-admin -c /etc/tryton/trytond.conf -d tryton --all
sudo systemctl restart tryton tryton-cron

Take a backup (Step 14) before every upgrade. Moving to a new Tryton series (for example 8.0 to 8.2 or 9.0) needs the migration steps in the Tryton documentation; test it on a copy of your database first.

Support

cloudimg provides 24/7 support for this image. Contact us through cloudimg.co.uk with your VM's region and the output of sudo /usr/local/sbin/tryton-selftest.sh. For Tryton itself, the Tryton documentation and the Tryton forum are the primary resources.