Deployment guide

CMDBuild

Overview

CMDBuild is an open source Configuration Management Database (CMDB) for IT and facilities teams. You model configuration items and the relationships between them, track hardware and software inventory, run IT service management and workflow processes, build dashboards and reports, and integrate with other systems through a REST API.

This SecureAnyCloud image runs the AGPL-3.0 CMDBuild READY2USE 2.4 distribution: a complete asset, service and process data model on top of the CMDBuild core. The READY2USE database includes a representative demo data model, so you can explore asset classes, cards and dashboards immediately.

The image is secure by default. The well-known default admin / admin login is disabled in the shipped image. On the first boot of every VM, a one-shot service generates a unique administrator password and a unique database password, writes them to /root/cmdbuild-credentials.txt (mode 0600), and only then starts the public web interface.

What you get:

CMDBuild READY2USE 2.4 (core 4.0.4), deployed as an exploded webapp on Apache Tomcat 10 with the OpenJDK 17 JRE
nginx reverse proxy on :80 in front of Tomcat (bound to loopback :8080)
PostgreSQL 17 with the PostGIS extension as the application database, bound to loopback only
A dedicated Azure data disk for the PostgreSQL datadir at /var/lib/postgresql, separate from the OS disk and re-provisioned with every VM
A per-VM administrator password and PostgreSQL password, generated on first boot and stored in a root-only file; the shipped default login is rotated so it never works
cmdbuild-tomcat.service, postgresql.service and nginx.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting size. CMDBuild runs the Tomcat JVM alongside PostgreSQL and benefits from memory headroom. Scale up for more users or larger data models.

In the network security group (NSG), allow inbound 22/tcp from your management network. Allow 80/tcp from the networks your users will connect from. For public exposure, put TLS in front of port 80 (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for CMDBuild by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

First-boot initialisation takes approximately one to three minutes after the VM starts. During that time CMDBuild rotates its secrets, starts Tomcat and brings the web interface online.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:cmdbuild-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name cmdbuild \
  --image sac1647283583153:cmdbuild-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name cmdbuild --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active postgresql cmdbuild-tomcat nginx cmdbuild-firstboot curl -fsS -o /dev/null -w 'cmdbuild ui: %{http_code}\n' http://127.0.0.1/cmdbuild/ui/

All four units report active and the UI endpoint returns 200. This confirms that the full stack (nginx, Tomcat and PostgreSQL) is serving.

CMDBuild is a JVM application, so allow a short warm-up on the very first boot before the UI responds.

Step 5 - Confirm the network bindings

The application and the database bind to the loopback interface only. nginx is the single public port. Confirm the bindings:

ss -tln | grep -E ':(80|8080|5432)'

Port 80 is nginx (public). Tomcat listens on 127.0.0.1:8080 and PostgreSQL on 127.0.0.1:5432, so neither the application server nor the database is directly reachable from the network.

Step 6 - Retrieve your administrator login

Your VM generates a unique administrator password and database password on first boot and writes them to a root-only file. Read the file with sudo:

sudo cat /root/cmdbuild-credentials.txt

The cmdbuild.admin.login value (which is admin) and the cmdbuild.admin.pass value are your sign-in. The file also records the per-VM PostgreSQL passwords.

First boot also loads the READY2USE model and rotates the shipped default login so it no longer works. To verify this without exposing the password, run the following check. The default admin / admin login is rejected, while the per-VM password authenticates:

SESS=http://127.0.0.1/cmdbuild/services/rest/v3/sessions
PASS=$(sudo grep '^cmdbuild.admin.pass=' /root/cmdbuild-credentials.txt | cut -d= -f2-)
echo -n 'default admin/admin -> '; curl -s -o /dev/null -w '%{http_code}\n' -H 'Content-Type: application/json' --data '{"username":"admin","password":"admin","scope":"service"}' "$SESS"
echo -n 'per-VM admin -> '; curl -s -o /dev/null -w '%{http_code}\n' -H 'Content-Type: application/json' --data "{\"username\":\"admin\",\"password\":\"$PASS\",\"scope\":\"service\"}" "$SESS"

The first call returns 401 because the shipped default no longer works. The second call returns 200.

Step 7 - Sign in for the first time

Browse to http://<vm-public-ip>/. The bare root redirects to /cmdbuild/ui/, the CMDBuild READY2USE sign-in page. Enter admin and the password from /root/cmdbuild-credentials.txt.

The sign-in page is served on first boot with the per-VM administrator password.

After you sign in, you reach the service desk dashboard. The navigation menu on the left groups the Registry, Asset Inventory, Service desk, Dashboards, Reports and the Service catalogue.

The dashboard shows ticket counters and the full READY2USE navigation.

Step 8 - Explore the asset inventory

Expand Asset Inventory in the left menu and open a class, for example Workplaces and then Mobiles. The configuration items appear in a sortable, filterable grid.

Each row is a configuration item with its code, assignee, serial number, product, lifecycle state, supplier and warranty. Use the search box and column filters to find items, or select Add card to record a new one.

A populated asset inventory class shows configuration items with lifecycle state, assignee and supplier.

Step 9 - Open a configuration item

Double-click a row to open its card. The card records the item's attributes, location and relationships. Side tabs hold the asset history, attachments, notes and related items.

Select Generate QR Code to create a label for physical tracking.

Step 10 - Confirm the data tier

The PostgreSQL datadir lives on its own dedicated Azure data disk, separate from the OS disk and re-provisioned with every VM. Confirm the mount:

findmnt -no SOURCE,SIZE,FSTYPE,TARGET /var/lib/postgresql
sudo -u postgres psql -d cmdbuild -tAc "SELECT count(*) AS public_tables FROM pg_tables WHERE schemaname='public';"

The datadir mounts from the dedicated disk, and the READY2USE model reports its full set of application tables.

Enabling HTTPS

For production, serve CMDBuild over HTTPS so session tokens and data cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

The following commands assume a DNS record that points your fully qualified domain name at the VM's public IP:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d cmdbuild.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

When certbot finishes, reload nginx with sudo systemctl reload nginx. Then sign in and change the administrator password from the CMDBuild user menu.

Backup and maintenance

CMDBuild keeps all of its state in its PostgreSQL application database on the dedicated data disk at /var/lib/postgresql. That includes the data model, configuration items, tickets, users, dashboards and reports. Back it up regularly:

sudo -u postgres pg_dump cmdbuild > /tmp/cmdbuild-appdb-$(date +%F).sql

Ship the dump to Azure Blob Storage or another object store, or snapshot the data disk in Azure for point-in-time backups.

Keep the OS patched with sudo apt update && sudo apt upgrade. CMDBuild is served by Apache Tomcat under /opt/cmdbuild-tomcat. After configuration changes, restart the application with sudo systemctl restart cmdbuild-tomcat. Always back up first.

Support

SecureAnyCloud provides 24/7 support for this image. Contact us by email or chat for help with deployment, data-model configuration, the REST API, workflow and process setup, TLS termination and database administration. Write to sales@secureanycloud.com.

For general CMDBuild questions, see the documentation at https://www.cmdbuild.org/. CMDBuild is a trademark of Tecnoteca srl. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch CMDBuild READY2USE on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

CMDBuild READY2USE is an open source Configuration Management Database (CMDB) and IT asset and service management platform from Tecnoteca. IT and facilities teams use it to model configuration items and their relationships, track hardware and software inventory, run IT service management and workflow processes, build reports and dashboards, and integrate with other systems through a REST API.

This SecureAnyCloud image ships the GNU AGPL-3.0 CMDBuild READY2USE distribution unmodified. READY2USE is Tecnoteca's free, full-featured data model on top of the open source CMDBuild core, not a limited edition, so a complete asset and service management platform is running within minutes of launch.

What you get:

CMDBuild running as a Java web application on Apache Tomcat 10 with the OpenJDK 17 JRE, bound to loopback 127.0.0.1:8080
nginx as a reverse proxy on port 80, serving the application under the /cmdbuild context path with its web interface at /cmdbuild/ui/; the bare root redirects there
A PostgreSQL 17 database with the PostGIS extension, listening on loopback only and stored on a dedicated data volume, holding every configuration item, relationship, process and report
Tomcat, PostgreSQL and nginx managed by systemd, started on boot and restarted on failure
A unique PostgreSQL role password and a unique password for the admin administrator login, generated per instance on first boot by a one-shot service before the public web interface starts
The shipped default admin login rotated, so the well-known admin/admin login never works on a deployed instance
The administrator password written to /root/cmdbuild-credentials.txt with mode 0600, readable only by root

Two instances launched from the same Amazon Machine Image never share credentials.

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and port 80 for the CMDBuild web interface
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for CMDBuild.

Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. CMDBuild is a Java and Tomcat application that runs alongside PostgreSQL, so 8 GiB of memory is a sensible minimum. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that opens port 22 from your management network and port 80 for the web interface. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes a minute or two after the instance state becomes Running and the status checks pass. During that time the per-instance database and administrator passwords are generated, the default login is rotated and the application starts.

Launch the Instance from the AWS CLI

Run the following command to launch an instance from the SecureAnyCloud CMDBuild Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22 and 80.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=cmdbuild}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can read it from the EC2 console or with aws ec2 describe-instances.

Connect to Your Instance

Connect over SSH with your key pair and the login user for your operating system variant.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i /path/to/your-key.pem ubuntu@<public-ip>

Retrieve Your Administrator Password

On first boot, the instance generated a unique administrator password and wrote it, together with the database credentials, to a root-only file. Read the file with sudo:

sudo cat /root/cmdbuild-credentials.txt

The file lists the sign-in URL, the administrator login and password, and the PostgreSQL database name, user and password:

cmdbuild.url=http://<instance-public-ip>/cmdbuild/ui/ cmdbuild.admin.login=admin cmdbuild.admin.pass=<generated-password> cmdbuild.db.name=cmdbuild cmdbuild.db.user=cmdbuild cmdbuild.db.pass=<generated-password>

The administrator login name is admin, but the password is the generated value from this file, not the upstream default. The shipped admin/admin login is rotated on first boot and does not work.

Sign In to CMDBuild

Browse to http://<instance-public-ip>/. The bare root redirects to the CMDBuild sign-in page under the /cmdbuild/ui/ path. Sign in with the login admin and the password from /root/cmdbuild-credentials.txt.

You land on the service desk dashboard, with the Tickets Summary. The navigation on the left leads to the Registry, Asset Inventory and Service desk.

Next, change the administrator password to one of your own from the user menu. Create additional user accounts so each team member signs in with their own login.

Explore the Asset Inventory

The READY2USE data model gives you a ready-made configuration management database. Expand Asset Inventory in the left navigation and open a configuration item class, such as Computer, to see its cards. Each class has its own attributes, columns and lifecycle state.

Select Add card to create a configuration item. Open any card to record its attributes, relationships, history and attachments. CMDBuild can also generate a QR code for a card, so you can label and track a physical asset.

Model Relationships, Processes and Reports

With your configuration items in place, build out the rest of the CMDB:

Relationships: link configuration items to each other, for example a server to the applications it hosts, or an asset to its assigned employee and location. Together they form the relationship graph that a CMDB exists to capture.
Service desk and processes: the READY2USE model includes IT service management workflows such as incident, request, change and problem management under the Service desk menu. Start a process from its class and follow it through its workflow steps.
Dashboards and reports: open the dashboards and PDF reports included in the model to follow inventory, coverage and service performance.

Use the REST API

CMDBuild exposes a REST API on the same port 80, under the /cmdbuild/services/rest/v3/ path, for integration with other tools.

To authenticate, create a session with the administrator credentials (or a dedicated API user) and the service scope. The call returns a session token, which you send in the CMDBuild-Authorization header:

TOKEN=$(curl -s -H 'Content-Type: application/json' \
  --data '{"username":"admin","password":"<your-password>","scope":"service"}' \
  'http://<public-ip>/cmdbuild/services/rest/v3/sessions?returnId=true' \
  | sed -n 's/.*"_id":"\([^"]*\)".*/\1/p')
curl -s -H "CMDBuild-Authorization: $TOKEN" \
  http://<public-ip>/cmdbuild/services/rest/v3/classes

For automated access, create a dedicated API user instead of using the administrator account.

Architecture and Security

The image is secure by default:

CMDBuild binds to loopback only. nginx on port 80 is the sole public listener and reverse-proxies to the application:

ss -tln | grep -E ':80|:8080|:5432'

LISTEN 127.0.0.1:5432 (PostgreSQL, loopback only) LISTEN 0.0.0.0:80 (nginx reverse proxy) LISTEN 127.0.0.1:8080 (Tomcat / CMDBuild, loopback only)

Authentication is enforced. The REST session endpoint returns 401 for an unknown credential, and the bare root returns a 302 redirect into the /cmdbuild/ui/ interface.
The shipped default admin/admin login is rotated on first boot and does not work. Only the generated per-instance password authenticates.
The administrator password is stored in /root/cmdbuild-credentials.txt with mode 0600, readable only by root.

Confirm the service state and health on the instance:

systemctl is-active cmdbuild-tomcat.service postgresql.service nginx.service

curl -o /dev/null -w '%{http_code}\n' http://127.0.0.1/cmdbuild/ui/

Enable HTTPS with a Custom Domain

For production use, put your instance behind a domain name and enable TLS. Point a DNS A record at the instance's public IP. Then either terminate TLS at an AWS Application Load Balancer in front of the instance, or install a certificate directly on the instance with Certbot and the nginx plugin:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot obtains a certificate and updates the nginx site to serve CMDBuild over HTTPS on port 443, with automatic renewal.

Backup and Maintenance

Database: the application data lives in the PostgreSQL cmdbuild database. Back it up with pg_dump:

sudo -u postgres pg_dump cmdbuild | gzip > cmdbuild-$(date +%F).sql.gz

Configuration: the Tomcat and CMDBuild configuration lives under /opt/cmdbuild-tomcat/conf, including conf/cmdbuild/database.conf. Include it in your backups.
Snapshots: take periodic EBS snapshots of the root and data volumes for point-in-time recovery.
Updates: apply operating system security updates with sudo apt-get update && sudo apt-get upgrade. For CMDBuild version upgrades, contact SecureAnyCloud support for a guided procedure that preserves your database.

Support

SecureAnyCloud provides 24/7 technical support for this image by email and live chat at sales@secureanycloud.com. Our engineers help with deployment, data-model configuration, the REST API, workflow and process setup, user management, database tuning, TLS and scaling. Critical issues receive a one-hour average response.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch CMDBuild on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS