Apache OFBiz

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B4ms (4 vCPU / 16 GiB RAM) is a reasonable starting point for the OFBiz JVM, the embedded Derby database and the demo data. Size up for heavier workloads.

In the NSG, allow inbound 22/tcp from your management network and 80/tcp. nginx serves OFBiz on plain HTTP port 80. For production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, select Create a resource, and search the Marketplace for Apache OFBiz by SecureAnyCloud. Select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab. Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:apache-ofbiz-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name ofbiz \
  --image sac1647283583153:apache-ofbiz-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name ofbiz --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active ofbiz.service nginx.service

Both report active. OFBiz runs as the dedicated ofbiz user and listens on its loopback HTTPS connector 127.0.0.1:8443; nginx fronts it on port 80. The embedded Derby database, Lucene indexes, logs and all runtime data live on the dedicated Azure data disk mounted at /var/lib/ofbiz.

Step 5 - Retrieve your admin password

The OFBiz admin password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/ofbiz-credentials.txt

This file contains OFBIZ_ADMIN_USER (admin) and OFBIZ_ADMIN_PASSWORD, along with the OFBiz URL. Store the password in a safe place.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/health

It returns ok. This endpoint never requires authentication, so you can use it for an Azure Load Balancer health probe.

Step 7 - Sign in to the OFBiz web applications

Browse to http://<vm-public-ip>/webtools/control/main and sign in as admin with the password from Step 5. nginx serves the login form, and OFBiz treats the proxied request as secure, so the form submits without a redirect loop.

The Web Tools console is the administration hub. It provides entity engine tools, the service engine, import and export, cache and debug tools, and system configuration.

The Accounting application manages invoices, payments, billing accounts, financial accounts, agreements, fixed assets, budgets and the general ledger. The seeded demo dataset includes accounts-receivable and accounts-payable invoices, so you can explore the flows immediately.

The Party application is the OFBiz CRM for people, groups, customers, prospects and employees, with communications, classifications and contact management. Use Find Party to search the seeded demo parties or create new ones.

The other seeded applications are reachable under their own context paths: http://<vm-public-ip>/catalog (product catalog), http://<vm-public-ip>/ordermgr (order management), http://<vm-public-ip>/facility (inventory and warehouse) and more. Each application prompts for the same admin credentials.

Step 8 - Verify admin authentication from the command line

The OFBiz webtools login rejects a wrong password and accepts the per-VM admin password. Read the password from the credentials file first, then post the login form. The command embeds your unique password, so run it interactively instead of from a script. Substitute the value of OFBIZ_ADMIN_PASSWORD from Step 5 for <OFBIZ_ADMIN_PASSWORD>:

B=https://127.0.0.1:8443; CJ=$(mktemp); curl -ks -c $CJ "$B/webtools/control/login" -o /dev/null; curl -ks -b $CJ --data-urlencode 'USERNAME=admin' --data-urlencode 'PASSWORD=<OFBIZ_ADMIN_PASSWORD>' "$B/webtools/control/login" | grep -q Logout && echo LOGIN-OK

A successful login prints LOGIN-OK (the authenticated page contains a Logout link); a wrong password returns the login page again with no Logout link.

Step 9 - Confirm runtime data lives on the dedicated disk

The OFBiz runtime/ directory holds the embedded Derby database, the Lucene search indexes, the Tomcat work directories and the logs. It is stored on the dedicated Azure data disk, so it survives OS changes and can be resized independently:

findmnt /var/lib/ofbiz

A separate Azure data disk backs the mount. It is captured into the image and re-provisioned on every VM.

Maintenance

• Users and security: manage user logins, security groups and permissions under Party and the Security tools in Web Tools.
• Applications: the seeded demo data spans accounting, catalog, order, party, facility and manufacturing so each application is immediately explorable. Adapt or clear it for your own organisation.
• Storage: the Derby database, search indexes and logs live under /var/lib/ofbiz on the data disk. Back up that volume to protect your data and configuration.
• Logs: OFBiz logs are under /var/lib/ofbiz/runtime/logs on the data disk.
• Tuning: edit the JVM heap (-Xms / -Xmx) in the ofbiz.service unit (/etc/systemd/system/ofbiz.service), then sudo systemctl daemon-reload && sudo systemctl restart ofbiz.
• Database: the embedded Apache Derby database suits evaluation and small deployments. For production scale, migrate OFBiz to an external RDBMS (PostgreSQL) by editing framework/entity/config/entityengine.xml.
• TLS: nginx serves OFBiz on plain HTTP port 80. Front it with TLS (for example with certbot) and your own domain before you run it in production.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Apache OFBiz on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users will reach OFBiz on
• The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Architecture and File Locations

The request path is client -> nginx :80 -> OFBiz Tomcat (loopback HTTPS 8443) -> embedded Derby database. OFBiz binds its HTTP (8080) and HTTPS (8443) connectors to 127.0.0.1 only, and nginx is the single public entry point on port 80. OFBiz builds self-referential links, and the customer host is not known when the image is built. nginx therefore rewrites OFBiz's internal absolute URLs back to relative form, so the application works from any hostname, IP address or load balancer with no configuration.

Key locations:

• OFBiz installation (ofbiz.home): /opt/ofbiz
• Data tier (Derby database, indexes, runtime, logs): /var/lib/ofbiz (dedicated EBS volume)
• Runnable application jar: /opt/ofbiz/build/libs/ofbiz.jar
• systemd service: ofbiz.service
• Reverse proxy config: /etc/nginx/sites-available/sac-ofbiz
• Administrator credentials: /root/ofbiz-credentials.txt (mode 0600)
• First-boot service: apache-ofbiz-firstboot.service

The data tier lives on its own EBS volume so it is independently resizable and separate from the operating system disk:

df -h /var/lib/ofbiz

Adding TLS

The instance security group opens port 443. To serve OFBiz over HTTPS with your own certificate, obtain a certificate for your DNS name (for example with Certbot or from AWS Certificate Manager fronted by a load balancer) and add a TLS server block to nginx that proxies to the same OFBiz upstream as the port 80 block. Point your DNS record at the instance's public address, and your users can reach OFBiz securely over your own hostname.

Backups and Maintenance

All business data lives under /var/lib/ofbiz on the dedicated data volume. Take regular Amazon EBS snapshots of that volume to back up the database, indexes and runtime state. For a consistent snapshot, stop the service first with sudo systemctl stop ofbiz, take the snapshot, then start it again with sudo systemctl start ofbiz.

Keep the operating system patched with sudo apt-get update && sudo apt-get upgrade. The OFBiz service is managed by systemd: use sudo systemctl restart ofbiz to restart it and sudo journalctl -u ofbiz to read its logs. Application logs are also written under /var/lib/ofbiz/runtime/logs.

Support

This image is supported by SecureAnyCloud with 24/7 technical support by email and chat. We can help with deployment, configuration of the accounting, order, catalog and CRM applications, data model and integration questions, access control, storage sizing, and backup and upgrade planning.

Deploy on AWS

Launch Apache OFBiz on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com