AureusERP 1.8.0

Launch from the AWS Marketplace page and choose the AureusERP 1.8.0 on Ubuntu 24.04 version. Alternatively, launch with the AWS CLI, using the AMI ID shown on the listing's launch page:

aws ec2 run-instances --image-id ami-xxxxxxxxxxxxxxxxx --instance-type m5.large \
  --key-name my-key --security-group-ids sg-xxxxxxxx --subnet-id subnet-xxxxxxxx \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=aureuserp}]'

First boot takes about a minute after the instance starts. It initializes MySQL, creates the database, runs AureusERP's installer (migrations, roles and permissions), and creates the administrator and the certificate. The web interface stays offline until first boot finishes.

ssh -i my-key.pem ubuntu@<public-ip>

systemctl is-active mysql.service nginx.service php8.3-fpm.service aureuserp-queue.service aureuserp-schedule.timer
sudo ss -ltnp | awk 'NR==1 || /:(22|80|443|3306|33060) /'
sudo ss -lxp | grep aureuserp-fpm

active active active active active State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=900,fd=3),("systemd",pid=1,fd=186)) LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=71795,fd=5),("nginx",pid=71794,fd=5),("nginx",pid=69153,fd=5)) LISTEN 0 511 0.0.0.0:443 0.0.0.0:* users:(("nginx",pid=71795,fd=7),("nginx",pid=71794,fd=7),("nginx",pid=69153,fd=7)) LISTEN 0 4096 [::]:22 [::]:* users:(("sshd",pid=900,fd=4),("systemd",pid=1,fd=187)) LISTEN 0 511 [::]:80 [::]:* users:(("nginx",pid=71795,fd=6),("nginx",pid=71794,fd=6),("nginx",pid=69153,fd=6)) LISTEN 0 511 [::]:443 [::]:* users:(("nginx",pid=71795,fd=8),("nginx",pid=71794,fd=8),("nginx",pid=69153,fd=8)) u_str LISTEN 0 4096 /run/php/aureuserp-fpm.sock 172620 * 0 users:(("php-fpm8.3",pid=69144,fd=10),("php-fpm8.3",pid=69143,fd=10),("php-fpm8.3",pid=69138,fd=8))

Only SSH, HTTP and HTTPS listen on the network. MySQL (3306, and its X protocol on 33060) does not listen at all, and PHP listens only on its Unix socket.

First boot writes everything you need to sign in to a root-only file:

sudo cat /root/aureuserp-credentials.txt

# AureusERP 1.8.0 - generated on first boot by aureuserp-firstboot.service
# These credentials are unique to this instance; none was baked into the image. Keep this file secret. AUREUSERP_URL=https://ec2-13-221-246-25.compute-1.amazonaws.com/admin/login AUREUSERP_ADMIN_EMAIL=admin@example.com AUREUSERP_ADMIN_PASSWORD=<24 random letters and digits> AUREUSERP_TLS_SHA256=04:2A:90:34:74:96:7C:90:E4:AA:40:A2:04:97:94:65:E9:6E:60:3F:69:99:6C:13:35:BB:FC:53:D0:AA:12:D5 ...

• AUREUSERP_URL is your AureusERP sign-in page.
• AUREUSERP_TLS_SHA256 is the fingerprint of the instance's own certificate. Your browser warns that the certificate is not trusted. Compare the fingerprint it shows with this one before you continue. When you can, replace the certificate with one from a certificate authority for your own name (Step 10).
• AUREUSERP_ADMIN_EMAIL / AUREUSERP_ADMIN_PASSWORD sign in to AureusERP as its administrator.

The image includes an end-to-end self-test. Run it on the instance. Over HTTPS, it checks that port 80 redirects and that the health check answers. It checks that the front controller path, the image proxy, the mobile-shell endpoints, the configuration file, the data and the sources are refused. It also checks that the administrator signs in through AureusERP's own login form, and that a wrong password and common default passwords are refused:

sudo aureuserp-cred-roundtrip

AUREUSERP_ROUNDTRIP_OK https 301 + no index.php/image proxy/mobile endpoints/env/data/sources + healthz + administrator sign-in (Filament's own Livewire login form, CSRF token) + wrong and default passwords refused

Open AUREUSERP_URL in your browser and check the certificate fingerprint. Then sign in with AUREUSERP_ADMIN_EMAIL and AUREUSERP_ADMIN_PASSWORD.

Change the email address and name on your profile: select the A avatar at the top right, then Profile. To change the password, run one of the following commands on the instance. The first generates a new random password. The second reads your own password (20 to 72 letters and digits) from the terminal, never from the command line. Either way, every session is signed out and the new password is written to /root/aureuserp-credentials.txt:

sudo aureuserp-set-password

# Type <new-password> at the prompt; nothing is echoed. read -rs -p 'New AureusERP password: ' P; echo printf '%s\n' "$P" | sudo aureuserp-set-password --stdin; unset P

After you store the password somewhere safe, you can delete the AUREUSERP_ADMIN_PASSWORD line from /root/aureuserp-credentials.txt.

A fresh AureusERP has no business modules installed. On first sign-in it opens Plugins, the module manager. Apps lists the business modules, and Installed and Not Installed filter them. Each card shows the module's dependencies, which are installed with it. Open a module's menu (the three dots) and choose Install.

You can also install a module from the command line. This command runs AureusERP's own installer as the aureuserp user, with the same metadata block as the web tier:

sudo aureuserp-artisan purchases:install --no-interaction

The module names are those on the Plugins page in lower case, for example sales, purchases, inventories, accounting, invoices, crm, employees, projects and manufacturing.

After a module is installed, it appears in the menu (the grid icon at the top left). With Sales installed, which brings Invoices with it, the dashboard summarizes invoices and vendor bills. Sales provides quotations, orders, products and customers.

Add users and decide what they can do under Settings (users, roles and permissions). Each module's settings are under its own Settings or Configurations menu.

AureusERP runs background jobs (emails, imports, notifications) in a queue, and it runs periodic tasks from Laravel's scheduler. On this image, the queue worker is the aureuserp-queue service, and the scheduler is a systemd timer that runs every minute. Both run as the unprivileged aureuserp user:

systemctl show -p ActiveState -p SubState -p User aureuserp-queue.service
systemctl list-timers aureuserp-schedule.timer --no-pager

User=aureuserp ActiveState=active SubState=running NEXT LEFT LAST PASSED UNIT ACTIVATES Sun 2026-11-08 02:53:00 UTC 47s Sun 2026-11-08 02:52:01 UTC 10s ago aureuserp-schedule.timer aureuserp-schedule.service 1 timers listed. Pass --all to see loaded but inactive timers, too.

aureuserp-artisan runs AureusERP's own artisan commands as the aureuserp user with the same metadata block as the web tier:

sudo aureuserp-artisan --version sudo aureuserp-artisan about --only=environment

Laravel Framework 13.36.0 Environment ................................................................ Application Name ................................................. AureusERP Laravel Version .................................................... 13.36.0 PHP Version .......................................................... 8.3.6 Composer Version ......................................................... - Environment ..................................................... production Debug Mode ............................................................. OFF URL .............................. ec2-13-221-246-25.compute-1.amazonaws.com Maintenance Mode ....................................................... OFF Timezone ............................................................... UTC Locale .................................................................. en

Point a DNS name at the instance. An Elastic IP is recommended. Then run:

sudo aureuserp-set-hostname <your-domain>

This command creates a new self-signed certificate for the name and pins nginx to it (other names are dropped). It also sets AureusERP's APP_URL (used in links in its emails) and updates the URL and fingerprint in /root/aureuserp-credentials.txt.

To use a certificate from a certificate authority, replace /etc/nginx/ssl/aureuserp.crt and aureuserp.key (keep the key 0600 root), then run sudo systemctl reload nginx.

To send email (password resets, notifications), set the MAIL_* values in /etc/aureuserp/env (see Laravel's mail documentation). Then run sudo systemctl restart php8.3-fpm aureuserp-queue.

Limit who can reach the web interface in the instance's security group. For example, to allow HTTPS only from your office network, run:

aws ec2 authorize-security-group-ingress --group-id sg-xxxxxxxx --protocol tcp --port 443 --cidr <your-mgmt-cidr>
aws ec2 revoke-security-group-ingress --group-id sg-xxxxxxxx --protocol tcp --port 443 --cidr 0.0.0.0/0

AureusERP locks a client address out of sign-in for a minute after five failed attempts. Separately, nginx rate-limits requests for the sign-in pages per client address.

U=$(sudo sed -n 's/^AUREUSERP_URL=//p' /root/aureuserp-credentials.txt); U=${U%/admin/login} C=/etc/nginx/ssl/aureuserp.crt for p in admin/login healthz; do curl -s --cacert "$C" -o /dev/null -w "GET /$p: %{http_code}\n" "${U}/$p" done for p in index.php index.php/admin/login .env storage/logs/laravel.log composer.json artisan _native/api/events; do curl -s --cacert "$C" -o /dev/null -w "GET /$p: %{http_code}\n" "${U}/$p" done curl -s --cacert "$C" -o /dev/null -w 'GET /cache/logo.png (same site): %{http_code}\n' -H 'Sec-Fetch-Site: same-origin' "${U}/cache/logo.png" curl -s --cacert "$C" -o /dev/null -w 'GET /cache/logo.png from another site: %{http_code}\n' -H 'Sec-Fetch-Site: cross-site' "${U}/cache/logo.png" curl -s --cacert "$C" -o /dev/null -w 'GET /cache/anything-else.png: %{http_code}\n' -H 'Sec-Fetch-Site: same-origin' "${U}/cache/anything-else.png" curl -s -o /dev/null -w 'GET http://: %{http_code}\n' "${U/https:/http:}/admin/login" curl -sk -o /dev/null -w 'GET with an unknown Host: %{http_code}\n' -H 'Host: not-this-server.example' https://127.0.0.1/ || true for i in $(seq 1 12); do curl -s --cacert "$C" -o /dev/null -w '%{http_code} ' "${U}/admin/login"; done; echo systemctl show -p IPAddressDeny nginx.service php8.3-fpm.service mysql.service aureuserp-queue.service
sudo mysql -e "SELECT @@version, @@bind_address, @@skip_networking, @@local_infile" curl -s http://127.0.0.1/healthz

GET /admin/login: 200 GET /healthz: 200 GET /index.php: 404 GET /index.php/admin/login: 404 GET /.env: 404 GET /storage/logs/laravel.log: 404 GET /composer.json: 404 GET /artisan: 404 GET /_native/api/events: 404 GET /cache/logo.png (same site): 200 GET /cache/logo.png from another site: 403 GET /cache/anything-else.png: 404 GET http://: 301 GET with an unknown Host: 000 200 200 200 200 200 200 200 200 200 200 429 429 IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32 IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32 IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32 IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32 @@version @@bind_address @@skip_networking @@local_infile 8.0.46-0ubuntu0.24.04.4 127.0.0.1 1 0 ok

In the output, check the following:

• The front controller path (/index.php/...), the configuration file, logs, sources, the debug bar and the mobile-shell endpoints are refused. AureusERP's image proxy (/cache/...) serves only its own logo, and only to pages on this server. Requests for any name other than the configured one are dropped (000: nginx closes the connection).
• The twelve rapid requests for the sign-in page show nginx's per-address limit (429).
• IPAddressDeny is the metadata-service block on nginx, PHP, MySQL and the queue worker. The scheduler and the first-boot service have the same block.
• MySQL has networking switched off (skip_networking 1) and refuses LOAD DATA LOCAL.
• http://127.0.0.1/healthz returns ok for a monitoring agent on the instance.

Your data is the MySQL database plus uploaded files in /var/lib/aureuserp/storage/app and /var/lib/aureuserp-public. Back up /etc/aureuserp/env too. Its APP_KEY decrypts the values that AureusERP stores encrypted, and a backup restored without it cannot read them. Copy the data to root-only files, and keep copies off the instance (for example in an encrypted S3 bucket):

sudo sh -c 'umask 077; mysqldump --single-transaction --routines --triggers aureuserp | gzip > /var/backups/aureuserp-db-$(date +%F).sql.gz'
sudo sh -c 'umask 077; tar -C /var/lib -czf /var/backups/aureuserp-files-$(date +%F).tar.gz aureuserp/storage/app aureuserp-public'
sudo sh -c 'umask 077; cp /etc/aureuserp/env /var/backups/aureuserp-env-$(date +%F)'
sudo ls /var/backups/ | grep aureuserp

aureuserp-db-2026-11-08.sql.gz aureuserp-env-2026-11-08 aureuserp-files-2026-11-08.tar.gz

To restore into a new instance of the same version, first stop nginx, PHP-FPM, aureuserp-queue and aureuserp-schedule.timer. Load the dump into the aureuserp database with gunzip -c <dump> | sudo mysql aureuserp, and unpack the files archive into /var/lib. Put your APP_KEY line into /etc/aureuserp/env, then start the services again.

EBS snapshots of the instance are a simple way to keep point-in-time copies of the whole server.

Ubuntu, PHP and MySQL security updates install automatically through unattended upgrades. New AureusERP releases are published as new versions of this listing.

To move to a new release, launch the new version and stop its services. Copy your database, your uploads and the APP_KEY line of /etc/aureuserp/env across, keeping the new instance's own database password and APP_URL. Then run sudo aureuserp-artisan migrate --force and start the services again.

ls /usr/share/doc/aureuserp/ sed -n '1,5p' /usr/share/doc/aureuserp/SOURCE.txt

LICENSE SOURCE.txt AureusERP 1.8.0 on Ubuntu 24.04 by sac - source and changes Upstream: the AureusERP 1.8.0 tag archive, https://github.com/aureuserp/aureuserp/archive/refs/tags/v1.8.0.tar.gz (sha256 31f3e77c69ede4f842aa01f6010149928fd119bb36be419abc312e510b92ffa9; GitHub tag v1.8.0, commit 9b076df06a902cce5a14866650547ed13ffa140a). Licence: MIT (LICENSE, shipped here and in /var/www/aureuserp). No AureusERP source file is modified.

AureusERP is licensed under the MIT License. Every module on the Plugins page is part of the same open source repository, and the image contains no paid or proprietary plugin. SOURCE.txt names the exact upstream archive, the files that are not shipped (tests, sample configuration, Docker and Apache files, front-end build configuration), and the PHP packages and browser libraries raised for security.