webtrees on Ubuntu 24.04 on Azure User Guide

Overview

webtrees is a mature open source online collaborative genealogy application. It gives you and your family interactive family trees, pedigree and descendancy charts, individual and family records, reports, media galleries, and per user accounts, all through a clean web interface. The cloudimg image installs webtrees 2.2 on nginx, php-fpm 8.3, and MySQL 8.0, all from the Ubuntu 24.04 noble universe with no third party APT repositories. The database schema is built and the first administrator is created for you, the MySQL root, application database, and administrator passwords are all rotated per instance at first boot, and a small demo family tree is imported so the pedigree charts are populated the moment you sign in.

What is included:

• webtrees 2.2.6 from the official release at /var/www/webtrees (front controller index.php)
• nginx serving on port 80, with the writable data/ folder never exposed to the web
• php-fpm 8.3 with the mysqli, mbstring, xml, intl, gd, curl, and zip extensions
• MySQL 8.0.x with a webtrees database and wtuser application user (per VM password)
• Database backed authentication, with a single admin account created at first boot
• A demo family tree imported from GEDCOM, so the tree and pedigree views are populated
• Public self registration disabled by default
• webtrees-firstboot.service building the schema, rotating passwords, creating the administrator, and importing the demo tree
• A host only session cookie, so signing in works over a bare IP address (RFC 6265 safe)
• nginx, php-fpm, and MySQL enabled and auto starting on boot
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key, and a VNet with a subnet. Standard_B2s (2 vCPU, 4 GB RAM) is a comfortable starting point for most family trees; move up to a D2s or D4s size for very large trees or many concurrent users. Open inbound ports 80 and 443 (and 22 to your management network) on the network security group. MySQL listens only on loopback and is never exposed.

Step 1: Deploy and connect

Launch the image from the Azure Marketplace, then connect over SSH as azureuser:

ssh azureuser@<vm-ip>

The first boot service builds the database schema, generates the per VM credentials, and imports the demo family tree within a few seconds of the instance starting.

Step 2: Verify the services

Confirm nginx, php-fpm, and MySQL are active and listening. MySQL is bound to loopback only:

sudo systemctl is-active nginx.service php8.3-fpm.service mysql.service
sudo ss -ltn | grep -E ':80|:3306'

Step 3: Check the versions

The webtrees release is the VERSION constant in the application file:

grep -o "VERSION = '[^']*'" /var/www/webtrees/app/Webtrees.php
php -v | head -1
mysql --version
nginx -v

Step 4: Inspect the database

The schema is built and a single administrator account exists, stored with a bcrypt password hash, so there is no default or shared login. Read the application database password from the root only credentials file, then inspect the administrator account and the imported genealogy records:

DB_PASS=$(sudo grep '^WEBTREES_DB_PASSWORD=' /stage/scripts/webtrees-credentials.log | cut -d= -f2-)
sudo mysql -uwtuser -p"$DB_PASS" webtrees -e "SELECT u.user_name, LEFT(u.password,7) AS password_hash, s.setting_value AS canadmin FROM wt_user u JOIN wt_user_setting s ON s.user_id=u.user_id AND s.setting_name='canadmin' WHERE u.user_id>0"
sudo mysql -uwtuser -p"$DB_PASS" webtrees -e "SELECT (SELECT COUNT(*) FROM wt_individuals) AS individuals, (SELECT COUNT(*) FROM wt_families) AS families"

Step 5: Read the administrator password

The per VM credentials are written to a root only file. Read it to pick up the WEBTREES_ADMIN_USER and WEBTREES_ADMIN_PASSWORD for signing in:

sudo cat /stage/scripts/webtrees-credentials.log

Keep this file secure. Change the administrator password from within webtrees once you have signed in for the first time.

Step 6: Sign in

Confirm webtrees is serving the demo tree locally, then browse to http://<vm-ip>/ in your browser. The home page redirects to the demo family tree; choose Sign in and enter admin with the password from Step 5:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/tree/demo

Step 7: Explore an individual record

Every person has a record page listing their facts and events, with a Family navigator that walks parents, spouses, and children. The demo tree spans three generations of a fictional family so you can explore the relationships straight away.

Step 8: View a family and its tree

A family page shows a couple, their marriage, and their children, with the surrounding family tree drawn as connected boxes. Follow the links to move up and down the generations, or use the Charts menu for pedigree, descendancy, fan, and hourglass views.

Step 9: The control panel

Sign in as the administrator to reach the control panel, where you manage family trees, import and export GEDCOM files, configure privacy and modules, and manage user accounts. The panel shows your trees with their individual and family counts.

Step 10: Import your own family tree

To replace the demo tree with your own research, open the control panel, create a new family tree, then import your GEDCOM file from your computer or the server. You can keep the demo tree for reference or delete it from the control panel once your own tree is in place.

Step 11: Components

Step 12: Security and next steps

• Change the administrator password from within webtrees after your first sign in, under My pages, then Account.
• Enable HTTPS by installing certbot and requesting a certificate: sudo apt-get install -y certbot python3-certbot-nginx then sudo certbot --nginx. webtrees uses a secure session cookie automatically once it is served over HTTPS.
• Set your site address in the control panel under Website preferences once you point a domain at the instance, so links in emails and feeds use it.
• Review privacy for living people in the control panel before you make a real tree public; the demo tree is fictional and visitor viewable.
• Restrict the network security group so that ports 80 and 443 are open only to your users or load balancer, and port 22 only to your management network.
• Patch the OS regularly with sudo apt-get update then sudo apt-get upgrade.

Licensing

webtrees is distributed under the GPL-3.0 licence and is free to use commercially. cloudimg packages and supports the image; support is available 24/7 at support@cloudimg.co.uk. All product and company names are trademarks or registered trademarks of their respective holders and their use does not imply affiliation or endorsement.