Deployment guide

AureusERP

Overview

AureusERP is a free and open source Enterprise Resource Planning (ERP) platform for small and medium enterprises and larger organisations. It is built on the Laravel framework and the FilamentPHP admin panel, and it brings accounting, invoicing, inventory, purchases, sales, human resources, recruitment, CRM and project management together in one place. A modular plugin system lets you enable only the features your business needs.

This SecureAnyCloud image delivers AureusERP fully installed and configured on Ubuntu 24.04. It is a Laravel application on PHP 8.3 with OPcache, served by nginx over HTTPS with php-fpm and backed by MariaDB. Database migrations, the Filament Shield roles and permissions, the seeded reference data and the compiled front-end assets are already in place, so you land directly on the admin sign-in with no setup wizard to complete.

What you get:

AureusERP 1.4.0 (MIT licensed), a Laravel 13 and FilamentPHP 5 ERP, served from /var/www/aureuserp/public
nginx (TLS on :443, with :80 redirected to HTTPS), PHP 8.3 (php8.3-fpm with OPcache) and MariaDB, all from Ubuntu 24.04 main/universe
A self-signed TLS certificate for each VM, generated on first boot, so the admin panel loads over a secure context
The Filament admin panel at /admin, with roles and permissions generated and reference data (currencies, countries, unit of measure) seeded
An administrator email and password, a MariaDB password and a Laravel APP_KEY unique to each VM, all generated at first boot and written to a root-only file. The install-time default admin@example.com does not ship with a usable password.
nginx.service, php8.3-fpm.service and mariadb.service as enabled, active systemd units
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting size. Scale up for more concurrent users or heavier modules.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network. Also allow 443/tcp (HTTPS) and 80/tcp (which redirects to HTTPS) from your users.

Step 1 - Deploy from the Azure Marketplace

In the Azure Marketplace, find AureusERP on Ubuntu 24.04 LTS by SecureAnyCloud. Choose Get It Now, then Create.

Select your resource group, region and VM size (Standard_B2ms or larger), and provide your SSH public key. In the networking step, allow inbound 443/tcp and 80/tcp. Then review and create the VM.

Step 2 - Deploy with the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:aureuserp-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name aureuserp \
  --image sac1647283583153:aureuserp-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name aureuserp --port 443 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Run the following checks. The three services that back AureusERP should all report active. The admin sign-in page should answer HTTP 200 over HTTPS, and the plain HTTP port should redirect to HTTPS:

systemctl is-active nginx php8.3-fpm mariadb curl -ks -o /dev/null -w 'admin login -> %{http_code}\n' https://127.0.0.1/admin/login curl -s -o /dev/null -w 'http redirect -> %{http_code}\n' http://127.0.0.1/

The expected output is three lines of active, followed by admin login -> 200 and http redirect -> 301.

Step 5 - Retrieve your administrator credentials

On the first boot of every VM, a one-shot service (aureuserp-firstboot.service) generates credentials that are unique to that VM. These are a fresh Laravel application key, a fresh MariaDB password, and a fresh administrator email and password. The service also generates a self-signed TLS certificate for the VM and sets the VM's own address as the application URL.

No shared or default credentials ship in the image. The install-time admin@example.com account has its password neutralised at build time and does not authenticate. Display the generated credentials with sudo:

sudo cat /root/aureuserp-credentials.txt

The file (mode 0600, root only) contains the administrator email (aureuserp.admin.user), the administrator password (aureuserp.admin.pass), the admin URL, and the database credentials. AureusERP signs in by email at /admin/login.

You can verify the credentials from the VM's own shell. The following command reads the administrator credentials for the VM and confirms that the rotated password matches the stored bcrypt hash on the users row, which is exactly what Filament's authentication guard checks:

ADMIN_USER=$(sudo grep '^aureuserp.admin.user=' /root/aureuserp-credentials.txt | cut -d= -f2-)
ADMIN_PASS=$(sudo grep '^aureuserp.admin.pass=' /root/aureuserp-credentials.txt | cut -d= -f2-)
HASH=$(sudo mariadb -N -B aureuserp -e "SELECT password FROM users WHERE email='$ADMIN_USER';") HH="$HASH" PP="$ADMIN_PASS" php -r 'echo password_verify(getenv("PP"),getenv("HH")) ? "admin password verifies -> OK\n" : "verify failed\n";'

Step 6 - Sign in to the admin panel

Browse to https://<vm-public-ip>/admin and sign in with the administrator email and password from the credentials file.

The image ships a self-signed certificate for each VM, so your browser shows a one-time certificate warning on your first visit. Accept the warning to continue, or install your own domain certificate into /etc/nginx/ssl/.

After you sign in, the admin home presents AureusERP's modular Apps, including Accounting, Contacts, Employees, Inventories, Invoices, Projects, Sales and more. You can install and manage them from the built-in Plugin manager.

Step 7 - Manage companies, users and reference data

Open the Settings area to manage Companies, Teams, Users, Roles and Custom Fields. The image seeds a default company so you can start immediately.

Choose Companies to edit the default company or add your own. Choose Users and Roles to invite colleagues and control access with Filament Shield role-based permissions.

Reference data such as currencies and countries is seeded so the ERP is ready to transact. For example, the Currencies list is populated with the world's currencies out of the box.

Step 8 - Confirm the version and the stack

sudo -u www-data php /var/www/aureuserp/artisan --version php -v | head -1 mariadb --version

The expected output is Laravel Framework 13.8.0, PHP 8.3 and the MariaDB version. AureusERP runs as a Laravel 13 and FilamentPHP 5 application on PHP 8.3 with OPcache, served by nginx over HTTPS with php-fpm and backed by MariaDB. You can also confirm the seeded reference data:

sudo mariadb -N -B aureuserp -e "SELECT CONCAT('currencies=',(SELECT COUNT(*) FROM currencies),' countries=',(SELECT COUNT(*) FROM countries),' permissions=',(SELECT COUNT(*) FROM permissions));"

The expected output is a line that reports the seeded currency, country and permission counts (for example currencies=169 countries=250 permissions=187).

First-boot service and security model

The one-shot aureuserp-firstboot.service runs After=mariadb.service and Before=nginx.service. The credentials and TLS certificate for the VM are therefore in place before the first page is served. The service writes the credentials file at mode 0600 (root only) and drops a sentinel file so that it runs exactly once.

systemctl status aureuserp-firstboot.service --no-pager | head -6 sudo stat -c '%a %U:%G %n' /root/aureuserp-credentials.txt

Administration from the CLI

Run administrative tasks with Laravel's artisan as the www-data user. For example, list the available commands:

sudo -u www-data php /var/www/aureuserp/artisan list | head -30

Common operations include php artisan cache:clear and php artisan optimize, which caches config and routes for production. Run php artisan optimize:clear to clear those caches. If you move email and background jobs to a queue, run php artisan queue:work.

Enabling HTTPS with your own domain

The image already serves HTTPS with a self-signed certificate for the VM. For production, point a real domain at the VM's public IP and open 443/tcp in the NSG. Then replace the self-signed certificate with a trusted one from Let's Encrypt, substituting your own domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.com

After the certificate is issued, set the new address as the application URL in /var/www/aureuserp/.env (APP_URL=https://your-domain.com). Then clear the caches with sudo -u www-data php /var/www/aureuserp/artisan optimize:clear.

Backup and maintenance

The database lives at /var/lib/mysql. The application tree, which holds the code, docroot and uploaded media, lives at /var/www/aureuserp.

For a point-in-time backup, snapshot the OS disk in Azure. Alternatively, dump the database as follows. The database password is in the credentials file:

sudo mariadb-dump aureuserp > aureuserp-backup.sql

Keep the OS patched with sudo apt update && sudo apt upgrade. Unattended security upgrades are enabled by default. To restart the stack, run sudo systemctl restart nginx php8.3-fpm mariadb.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email or chat for help with AureusERP deployment, upgrades, plugin and module installation, roles and permissions, company and multi-company setup, accounting, inventory and CRM configuration, API integration, performance tuning and database administration.

All product and company names are trademarks or registered trademarks of their respective holders. Their use does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch AureusERP on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This SecureAnyCloud Amazon Machine Image (AMI) delivers AureusERP fully installed and configured. It is a Laravel application on PHP 8.3 with OPcache, served by nginx over HTTPS with php-fpm and backed by MariaDB. The database schema migrations, the Filament Shield roles and permissions, the seeded reference data and the compiled front-end assets are already in place, so you land directly on the admin sign-in with no setup wizard to complete.

What you get:

The MariaDB datadir and the application code, each on its own dedicated, independently resizable EBS volume, so you can grow the database or application storage without touching the operating system disk
An application encryption key, a database password, and an administrator email and password, all generated on the first boot of every deployed instance and written to /root/aureuserp-credentials.txt with mode 0600
No shared credentials between instances launched from the same AMI, and no default administrator login
24/7 SecureAnyCloud support

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users will reach AureusERP from
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for AureusERP. Select the SecureAnyCloud listing, choose Select, and then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and create or select a security group. The group must allow inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users will use. Leave the root and data volumes at their default sizes or larger.

Select Launch instance. First-boot initialisation takes approximately one minute after the instance state becomes Running and the status checks pass. During that time, the instance generates its unique secrets and TLS certificate.

Launch the Instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud AureusERP Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80 and 443 as described in Prerequisites.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=aureuserp}]'

Connect and Retrieve Initial Credentials

Connect to the instance over SSH with your EC2 key pair. The login user depends on the operating system variant you launched:

Operating system variant SSH login user

Ubuntu 24.04 ubuntu

Replace <key> with the path to your private key and <vm-ip> with the instance's public IP address or DNS name.

ssh -i <key> ubuntu@<vm-ip>

The administrator email and password, the database credentials and the panel URL are generated on first boot and written to a root-only file. Retrieve them as follows:

sudo cat /root/aureuserp-credentials.txt

The file lists the AureusERP admin URL, the administrator sign-in email (aureuserp.admin.user) and password (aureuserp.admin.pass), and the MariaDB database name, user and password. Store these in a safe place and treat the file as sensitive.

You can confirm at any time that the application stack is running and healthy:

for svc in nginx php8.3-fpm mariadb; do echo "$svc: $(systemctl is-active $svc)"; done

curl -k -s -o /dev/null -w 'admin login page: HTTP %{http_code}\n' https://127.0.0.1/admin/login

MariaDB listens only on the loopback interface, so the database is never exposed to the network. Verify this with:

sudo ss -tlnp | grep ':3306'

Sign In to AureusERP

Each instance ships with its own self-signed TLS certificate, so the admin panel is served over HTTPS from the moment it boots. In your browser, go to:

https://<vm-ip>/admin

Because the certificate is self-signed, your browser shows a one-time security warning on your first visit. Accept the warning to continue. Step 7 explains how to install a trusted domain certificate.

Sign in with the administrator email and password from /root/aureuserp-credentials.txt. Plain HTTP on port 80 automatically redirects to HTTPS.

After you sign in, you land on the AureusERP admin panel. AureusERP is organised as installable plugins, so you can browse the available apps and enable only the modules your business needs. These include Accounting, Invoices, Inventories, Purchases, Sales, Contacts, Employees, Projects, Manufacturing and more.

Configure Your Company and Reference Data

Open the Settings area to manage companies, teams, users, roles and the seeded reference data. Use the Companies list to set up the organisation or organisations that AureusERP runs for, including the base currency, contact details and branding.

Select New Company to open the company form. There you record the company name, registration and tax identifiers, address, contact information and logo. The same create-and-edit pattern applies across every AureusERP module.

AureusERP ships with a full set of seeded reference data. For example, the Currencies list includes every ISO currency with its symbol, ISO code, decimal places and rounding, ready to activate for multi-currency accounting and sales.

Enable Modules (Plugins)

Open the Plugins area to review the available apps and their dependencies, and install the ones you need.

Each module is a self-contained plugin. Modules include Accounting, Invoices, Inventories, Purchases, Sales, Employees, Projects and others. Once enabled, a module adds its own resources and navigation to the admin panel, so the platform grows with your business rather than presenting every feature at once.

Enable HTTPS with a Trusted Certificate

The image serves the admin panel over HTTPS with a self-signed certificate out of the box. For production use behind a domain name, replace it with a trusted certificate from a certificate authority such as Let's Encrypt.

Point a DNS record at the instance, then install certbot and issue a certificate. Replace <your-domain> with your domain name and <your-email> with your contact email.

sudo snap install --classic certbot
sudo ln -sf /snap/bin/certbot /usr/local/bin/certbot
sudo certbot --nginx -d <your-domain> -m <your-email> --agree-tos --no-eff-email

Certbot obtains the certificate, configures nginx to use it and sets up automatic renewal. After the certificate is issued, update the APP_URL value in /var/www/aureuserp/.env to https://<your-domain>. Then clear the cache with sudo -u www-data php /var/www/aureuserp/artisan optimize:clear so that the panel's asset and session URLs match your domain.

Back Up and Maintain Your Instance

AureusERP stores its data in MariaDB (on the dedicated database volume) and its application files under /var/www/aureuserp (on the dedicated application volume). Back up the database regularly with a logical dump. Replace <backup-dir> with a directory of your choice:

sudo mariadb-dump --single-transaction aureuserp > <backup-dir>/aureuserp-$(date +%F).sql

For a complete point-in-time backup, you can also take EBS snapshots of both data volumes from the EC2 console or the AWS CLI. Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed.

The application's administrative command-line interface is available with sudo -u www-data php /var/www/aureuserp/artisan <command>.

Architecture Summary

Component Detail

Application AureusERP 1.4.0 (Laravel 13 + FilamentPHP 5)

Runtime PHP 8.3 (php8.3-fpm) with OPcache

Web server nginx 1.24 serving the Laravel public root over TLS on port 443, port 80 redirects to HTTPS

Database MariaDB 10.11, bound to loopback only, on a dedicated EBS volume at /var/lib/mysql

Application storage Code, configuration, storage and compiled assets on a dedicated EBS volume under /var/www

Admin panel FilamentPHP 5 at /admin, sign-in by email

First boot Generates a unique application key, database password, administrator email and password, and a self-signed TLS certificate; writes credentials to /root/aureuserp-credentials.txt (0600)

Recommended instance type m5.large or larger

Support

SecureAnyCloud provides 24/7 technical support for this AureusERP AMI by email and live chat. We can help with deployment and initial configuration, retrieving first-boot administrator credentials, enabling and configuring ERP modules and plugins, application and dependency upgrades, database and storage administration, TLS certificate setup for a trusted domain, performance tuning, and troubleshooting.

Deploy on AWS

Launch AureusERP on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS