Bagisto

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting point. Choose a larger size for bigger catalogs or heavier traffic.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network. Also allow 443/tcp (HTTPS) and 80/tcp (which redirects to HTTPS) from your customers.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Bagisto by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443).

Review the two dedicated data disks on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:bagisto-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name bagisto \
  --image sac1647283583153:bagisto-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name bagisto --port 443 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

The three services that back Bagisto should all report active. The storefront answers HTTP 200 over HTTPS, and the plain HTTP port redirects to it:

systemctl is-active nginx php8.3-fpm mariadb curl -ks -o /dev/null -w 'storefront https -> %{http_code}\n' https://127.0.0.1/ curl -s -o /dev/null -w 'http redirect -> %{http_code}\n' http://127.0.0.1/

Expected output: three lines of active, then storefront https -> 200 and http redirect -> 301.

Step 5 - Retrieve your administrator credentials

On the first boot of every VM, a one-shot service (bagisto-firstboot.service) generates credentials that are unique to that VM: a fresh Laravel application key, a fresh MariaDB password, and a fresh administrator email and password. It also generates a per-VM self-signed TLS certificate and sets the VM's own address as the application URL.

No shared or default credentials ship in the image. The well-known Bagisto default admin@example.com / admin123 is disabled at build time and does not authenticate. Read the credentials file with sudo:

sudo cat /root/bagisto-credentials.txt

The file (mode 0600, root only) contains the administrator email (bagisto.admin.user), the administrator password (bagisto.admin.pass), the storefront and admin URLs, and the database credentials. Bagisto signs in by email.

You can prove the login round-trip from the VM's own shell. The following command reads the per-VM credentials, fetches a CSRF token and posts a real admin sign-in. A successful Bagisto admin login answers HTTP 302 to /admin/dashboard. The command also confirms that the stock admin123 is rejected:

ADMIN_USER=$(sudo grep '^bagisto.admin.user=' /root/bagisto-credentials.txt | cut -d= -f2-)
ADMIN_PASS=$(sudo grep '^bagisto.admin.pass=' /root/bagisto-credentials.txt | cut -d= -f2-)
CJ=$(mktemp)
TOK=$(curl -ks -c "$CJ" https://127.0.0.1/admin/login | grep -oE 'name="_token" value="[^"]+"' | head -1 | sed 's/.*value="//;s/"//')
curl -ks -o /dev/null -w 'admin login -> %{redirect_url}\n' -b "$CJ" -c "$CJ" \
  -d "_token=$TOK" --data-urlencode "email=$ADMIN_USER" --data-urlencode "password=$ADMIN_PASS" \
  https://127.0.0.1/admin/login rm -f "$CJ"

Step 6 - Sign in to the admin panel

Browse to https://<vm-public-ip>/admin and sign in with the administrator email and password from the credentials file.

The image ships a per-VM self-signed certificate, so your browser shows a one-time certificate warning on the first visit. Accept the warning, or install your own domain certificate into /etc/nginx/ssl/.

After you sign in, the dashboard summarizes sales, orders, customers and top-selling products for your store.

Step 7 - Manage your catalog

From the admin panel's Catalog menu, manage Products, Categories, Attributes and Attribute Families. The store ships with a clean catalog, ready for your own products.

Choose Catalog > Products > Create Product, pick a type (simple, configurable, virtual, downloadable, bundle, grouped or booking), and fill in the attributes, price, inventory and images. Use Categories to build your storefront navigation and Attributes to model your product data.

Step 8 - Confirm the version and the data tiers

sudo -u www-data php /var/www/bagisto/artisan bagisto:version df -h /var/lib/mysql /var/www

Expected output: v2.4.8, then the two dedicated data disks. The database tier (/var/lib/mysql) and the application tier (/var/www, which holds code, docroot and uploaded media) each live on their own dedicated Azure data disk. You can grow storage for either tier without disturbing the OS disk.

First-boot service and security model

A one-shot bagisto-firstboot.service runs After=mariadb.service and Before=nginx.service, so the per-VM credentials and TLS certificate are in place before the first page is served. It writes the credentials file at mode 0600 (root only) and drops a sentinel file so that it runs exactly once.

systemctl status bagisto-firstboot.service --no-pager | head -6 sudo stat -c '%a %U:%G %n' /root/bagisto-credentials.txt

Administration from the CLI

Run admin tasks with Laravel's artisan as the www-data user. For example, list the available commands:

sudo -u www-data php /var/www/bagisto/artisan list | head -30

Common operations include php artisan cache:clear, php artisan optimize (caches config and routes for production) and php artisan queue:work (if you move email and indexing to a queue).

Enabling HTTPS with your own domain

The image already serves HTTPS with a per-VM self-signed certificate. For production, point a real domain at the VM's public IP and open 443/tcp in the NSG. Then replace the self-signed certificate with a trusted one from Let's Encrypt, substituting your own domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.com

After the certificate is issued, set the new address as the application URL in /var/www/bagisto/.env (APP_URL=https://your-domain.com). Then run sudo -u www-data php /var/www/bagisto/artisan optimize:clear.

Backup and maintenance

The database lives on the data disk at /var/lib/mysql, and the application tree and uploaded media live on the data disk at /var/www. Snapshot both disks in Azure for a point-in-time backup, or dump the database with the following command. The database password is in the credentials file:

sudo mariadb-dump bagisto > bagisto-backup.sql

Keep the OS patched with sudo apt update && sudo apt upgrade (unattended security upgrades are enabled by default). To restart the whole stack, run sudo systemctl restart nginx php8.3-fpm mariadb.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email and chat for help with Bagisto deployment, upgrades, catalog and theme configuration, payment and shipping methods, multi-channel and multi-currency setup, REST and GraphQL API integration, performance tuning and database administration.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Bagisto on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com