YesCart on Ubuntu 24.04 on Azure User Guide

Overview

YesCart is an open source e-commerce platform for building and running online stores. It pairs a customer facing storefront with a manager console (JAM) for catalog, pricing, promotions, inventory and order management, and exposes a REST API for headless and integration use. YesCart supports multiple shops, currencies and languages from a single deployment. The cloudimg image ships YesCart 4.0.0 GA built from source and deployed on Apache Tomcat 9 with the Eclipse Temurin 8 (OpenJDK 8) runtime behind nginx, which terminates TLS. MariaDB is the application database. Tomcat listens on 127.0.0.1:8080 and MariaDB on the loopback interface only; both are reached through nginx on port 443 (HTTPS).

The image is secure by default. YesCart seeds a single well known administrator — admin@yes-cart.com / 1234567; the cloudimg image poisons that password so it is dead in the shipped image, and on the first boot of every VM a one shot service generates a unique administrator password and a unique database password, regenerates a per-VM TLS certificate, maps the storefront to the VM's address, writes the login to /root/yescart-credentials.txt (mode 0600), and only then starts the public web interface. Backed by 24/7 cloudimg support.

What is included:

• YesCart 4.0.0 GA (storefront, manager console and REST API) built from source and deployed on Apache Tomcat 9 with the Eclipse Temurin 8 (OpenJDK 8) runtime
• nginx terminating TLS on :443 in front of Tomcat (bound to loopback :8080); :80 redirects to HTTPS
• MariaDB as the application database, bound to loopback only
• A per-VM administrator password and a per-VM database password generated at first boot, in a root-only file; the shipped default administrator is rotated so it never works
• A per-VM self-signed TLS certificate generated on first boot
• yescart.service, mariadb.service and nginx.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting point — YesCart runs the Tomcat JVM (storefront, manager and REST API) alongside MariaDB and benefits from memory headroom; scale up for more catalog, traffic or concurrent staff. NSG inbound: allow 22/tcp from your management network and 443/tcp from the networks your shoppers and staff will reach YesCart on.

Step 1 — Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for YesCart by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTPS (443). Then Review + create → Create.

First boot initialisation takes approximately one to three minutes after the VM starts — YesCart rotates its secrets, generates the per-VM TLS certificate, maps the storefront to the VM's address, starts Tomcat and brings the storefront and manager console online.

Step 2 — Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name yescart \
  --image <marketplace-image-urn> \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name yescart --port 443 --priority 1010

Step 3 — Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 — Confirm the services are running

systemctl is-active mariadb yescart nginx yescart-firstboot
curl -fsSk -o /dev/null -w 'yescart admin: %{http_code}\n' https://127.0.0.1/cp/

All four units report active and the manager console endpoint returns 200, confirming the full stack — nginx, Tomcat and MariaDB — is serving. YesCart is a JVM application deploying three web applications; on the very first boot allow a short warm-up before the console responds.

Step 5 — Confirm the network bindings

The application and the database bind the loopback interface only; nginx is the single public port. Confirm it:

ss -tln | grep -E ':(443|8080|3306)'

Port 443 is nginx (public, TLS); Tomcat listens on 127.0.0.1:8080 and MariaDB on 127.0.0.1:3306, so neither the application server nor the database is directly reachable from the network.

Step 6 — Retrieve your administrator login

The administrator password and the database password are generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/yescart-credentials.txt

The yescart.admin.login (which is admin@yes-cart.com) and yescart.admin.pass values are your sign-in to the manager console; the file also records the storefront and admin URLs and the per-VM database password. First boot rotates the shipped default administrator password so it no longer works.

You can verify the security posture without exposing the password — the shipped default is rejected while the per-VM password authenticates through the real YesCart manager login (an HTTP 200 with a JWT on success, 401 otherwise):

B=http://127.0.0.1:8080
U=$(sudo grep '^yescart.admin.login=' /root/yescart-credentials.txt | cut -d= -f2-)
P=$(sudo grep '^yescart.admin.pass=' /root/yescart-credentials.txt | cut -d= -f2-)
login() { curl -s -o /dev/null -w '%{http_code}\n' -X POST -H 'Content-Type: application/json' \
  -d "{\"username\":\"$1\",\"password\":\"$2\"}" "$B/cp/service/authenticate"; }
echo -n 'default admin@yes-cart.com/1234567 -> '; login 'admin@yes-cart.com' '1234567'
echo -n 'per-VM administrator               -> '; login "$U" "$P"

The first call returns 401 (the shipped default is dead) and the second returns 200 (the per-VM administrator authenticates).

Step 7 — Sign in to the manager console

Open a web browser and navigate to https://<vm-public-ip>/cp/. The certificate is self-signed and unique to your VM, so your browser will warn on the first visit — accept the warning to continue (or install a CA-signed certificate, see Enabling a trusted certificate). At the YesCart manager sign-in page enter admin@yes-cart.com and the password from /root/yescart-credentials.txt.

The YesCart manager (JAM) sign-in page, served over HTTPS with the per-VM administrator password.

After signing in, the manager console opens with the full navigation — Organisation, Catalog, Price lists, Promotions, Customers, Fulfilment centres, Shipping and Shops.

The YesCart manager console — the breadth of catalog, pricing, promotions and order management.

Step 8 — Manage the catalog

From the manager console open Catalog to manage categories and products. Your VM ships with a clean store so you can build your own catalog: create a category, then add products, assign them to categories, set prices in your fulfilment centre and publish them to a shop. YesCart keeps products, SKUs, prices and inventory as first-class entities so the same catalog can serve multiple shops and currencies.

The YesCart catalog view — categories and products behind the storefront.

Step 9 — Visit the storefront

Open https://<vm-public-ip>/ in a browser to see the customer facing storefront your shoppers use. First boot maps the default shop to your VM's address, so the storefront resolves on the VM's public IP out of the box. The storefront and the manager console share the same catalog and order data, so products and categories you publish in the console appear here.

The YesCart storefront — the customer facing shop served over HTTPS.

Step 10 — Confirm the data tier

YesCart keeps all of its state in its MariaDB application databases (yesdemo for the store, yespaydemo for payments). Confirm the schema is present:

sudo mysql -N -B -e "SELECT COUNT(*) AS store_tables FROM information_schema.tables WHERE table_schema='yesdemo';"

The database reports its full set of application tables.

Enabling a trusted certificate

The image serves HTTPS with a per-VM self-signed certificate out of the box. For production, replace it with a CA-signed certificate so browsers trust it without a warning. The image ships with nginx, which certbot can configure automatically. The following assumes a DNS record pointing your fully qualified domain name at the VM's public IP:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d shop.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

After certbot finishes, reload nginx with sudo systemctl reload nginx. Add your domain to the shop's URLs in the manager console (Shops → your shop → URLs) so the storefront resolves on it, and change the administrator password from the manager console.

Backup and maintenance

YesCart keeps all of its state — catalog, prices, promotions, customers, orders and configuration — in its MariaDB application databases. Back them up regularly:

sudo mysqldump --databases yesdemo yespaydemo > /tmp/yescart-$(date +%F).sql

Ship the dump to Azure Blob Storage or another object store, or snapshot the disk in Azure for point-in-time backups. Keep the OS patched with sudo apt update && sudo apt upgrade. YesCart is served by Apache Tomcat under /opt/yescart; restart the application with sudo systemctl restart yescart after configuration changes. Always back up first.

Support

This image is backed by 24/7 cloudimg support. Contact us by email and chat for help with deployment, catalog and pricing, promotions, order management, TLS certificates and database administration. Contact support@cloudimg.co.uk.

For general YesCart questions consult the project at https://www.yes-cart.org/. YesCart is a trademark of its respective holder. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.