ZenTao Project Management on Ubuntu 24.04 on Azure User Guide

Overview

ZenTao is the open source application lifecycle management (ALM) platform for software teams. It brings project management, Scrum and Agile boards, product and requirement management, bug and issue tracking, test case management, releases and documents together in one web interface, as a self hosted alternative to hosted issue trackers. The cloudimg image ships ZenTao 21.7.1 served by Apache and PHP 8.3 on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server, so the appliance is complete and useful on its own. The installation wizard is pre completed and removed, so the platform is ready the moment the instance boots. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306) and keeps its data on a dedicated Azure data disk. A unique administrator password is generated on the first boot of every VM. ZenTao is redistributed under the GNU Affero General Public License v3.0 (AGPL-3.0). Backed by 24/7 cloudimg support.

What is included:

• ZenTao 21.7.1 served by Apache with PHP 8.3, managed by systemd
• A bundled MariaDB server holding the ZenTao database, already installed and ready
• The installation wizard pre completed and removed, so no setup wizard is ever exposed
• A per VM administrator password generated on first boot and recorded in a root only file
• No shipped default login: the administrator password ships rotated to a discarded random and the real per VM password is set on first boot
• MariaDB bound to 127.0.0.1 only, never exposed to the network
• A dedicated Azure data disk carrying both the MariaDB database and ZenTao's uploaded attachments
• Links generated from the request host, so the site answers correctly on the public IP, the private IP or any DNS name you point at it
• apache2.service and mariadb.service as enabled systemd units
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point for a small team; move up to Standard_D2s_v3 for larger teams or heavy usage. NSG inbound: allow 22/tcp from your management network, 80/tcp for the application and 443/tcp if you terminate TLS on the VM. The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

In the Azure portal choose Create a resource, search for ZenTao Project Management (ALM / Scrum) on Ubuntu 24.04 LTS by cloudimg, and select Create. Pick your subscription, resource group and region, choose the Standard_B2s size, select SSH public key authentication with the username azureuser, and allow inbound 22, 80 and 443. The image attaches its own 20 GiB data disk for your database and attachments, so you do not need to add one.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name zentao \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name zentao --port 80,443

Step 3 - Confirm the services are running

SSH to the VM as azureuser and confirm Apache and MariaDB are active, then check the installed ZenTao version.

systemctl is-active apache2 mariadb

grep config->version /var/www/zentao/config/config.php

Step 4 - Confirm the network posture and health endpoint

MariaDB is bound to 127.0.0.1:3306 only, while Apache serves ZenTao on port 80. The unauthenticated /healthz endpoint answers 200 for Azure Load Balancer probes, and the site root redirects an unauthenticated visitor to the sign in page.

ss -ltn 'sport = :3306 or sport = :80'

curl -s -o /dev/null -w 'healthz -> %{http_code}\n' http://127.0.0.1/healthz

Step 5 - Retrieve the per VM administrator password

The first boot service generates an administrator password unique to your VM and writes it to a root only file. Confirm the file exists (it is 0600 root), then read it over SSH:

ls -l /root/zentao-credentials.txt

sudo cat /root/zentao-credentials.txt

ZENTAO_URL is the VM's own address as seen from inside the VM. Azure does not expose the public IP to the instance, so this is usually the private address. Browsing the public IP shown in the Azure portal works identically, because ZenTao derives its links from the request host rather than baking one in at build time.

Step 6 - Sign in

Browse to http://<vm-ip>/ and sign in with the username admin and the password from the credentials file.

After signing in you land on the My dashboard, with the module sidebar down the left (Program, Product, Project, Execution, QA, DevOps, Kanban and Doc) and the top navigation for Dashboard, Calendar, Work, Review and Contacts. The installed edition and version (ALM 21.7.1) are shown at the bottom.

Step 7 - Create your first project

Open Project from the sidebar to reach the project list and Kanban. Use Create Project to start a Scrum, Kanban or waterfall project, then add products, requirements, tasks, bugs, test cases and releases from the corresponding modules. Everything is linked, so a requirement flows into tasks and test cases, and a bug can be tracked from report to resolution and release.

Step 8 - No known or default credentials

This image ships with no usable login. The administrator password baked at build time is rotated to a random value that is discarded and never recorded, and the first boot service sets a fresh password unique to your VM before ZenTao serves a single request. The admin super administrator is the only account that can sign in, and the check below confirms that the per VM password authenticates through the real ZenTao login form while a blank password and common weak guesses are all rejected.

sudo bash /usr/local/sbin/zentao-cred-roundtrip.sh

Change the administrator password to one of your own under My profile once you have signed in for the first time.

Step 9 - Verify the release and where your data lives

Confirm the installed release and the data disk layout. Both the MariaDB database and ZenTao's uploaded attachments live on the dedicated data disk, bind mounted into place, so your data is kept off the operating system disk.

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT('ZenTao ',value) FROM zentao.zt_config WHERE owner='system' AND module='common' AND section='global' AND \`key\`='version' LIMIT 1"

df -h /data && findmnt -no SOURCE,TARGET /var/lib/mysql

Step 10 - Enable HTTPS (optional)

ZenTao derives its links from the request, so putting a TLS terminating proxy in front of it, or a certificate on the VM, upgrades the site to https:// with no reconfiguration. To terminate TLS on the VM itself, point a DNS name at the public IP and use Certbot:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d your-domain.example.com

Certbot obtains a certificate, configures the Apache virtual host for port 443 and sets up automatic renewal. Once TLS is in front, browse to https://your-domain.example.com/.

Support

This product is backed by 24/7 cloudimg support. For deployment guidance, workflow and permission configuration, version upgrades, performance tuning or MariaDB database administration, contact support@cloudimg.co.uk.

About cloudimg

cloudimg publishes hardened, fully patched, ready to run open source images for Microsoft Azure and other clouds. Every image is built to a consistent security baseline, ships without default or shared credentials, keeps customer data on a dedicated data disk, and is paired with a step by step deploy guide. ZenTao is redistributed under the GNU Affero General Public License v3.0 (AGPL-3.0). All product and company names are trademarks or registered trademarks of their respective holders; use of them does not imply any affiliation with or endorsement by them.