SecureAnyCloud
Deployment guide

Django Oscar

Overview

Django Oscar is a mature open source e-commerce framework for Django. It provides a full storefront and a staff dashboard covering catalogue and product management, ranges and promotional offers, baskets and checkout, orders, vouchers, customer accounts and reporting. It is designed to be extended and customised for domain-specific online retail.

The SecureAnyCloud image ships Oscar's own canonical starter store as a Django application in a dedicated Python virtual environment, served by gunicorn behind nginx, with a PostgreSQL database. It is locked down for a marketplace appliance: gunicorn is bound to loopback 127.0.0.1:8002, and nginx on port 80 is the only way in. The sample store's default account is never created.

What you get:

  • Django Oscar 4.1 installed in a dedicated Python virtual environment and running as the django-oscar gunicorn systemd service
  • The full Oscar storefront and staff dashboard on :80, fronted by nginx with gunicorn bound to loopback only
  • A PostgreSQL 16 database on loopback holding the store, with a per-VM database password generated on first boot
  • A pre-loaded sample catalogue of demonstration products, images, ranges and offers, so the store is populated on first boot
  • No default account. The administrator is created on first boot with a unique random password written to a root-only file, and a per-VM Django secret key is generated, never baked into the image
  • Host settings configured so that sign-in works on the public IP address or a custom domain, with no baked-in hostname
  • An unauthenticated /healthz endpoint for Azure Load Balancer health probes
  • postgresql.service, django-oscar.service (gunicorn) and nginx.service as systemd units, enabled and active
  • 24/7 SecureAnyCloud support

Prerequisites

  • An active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.
  • Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting size.
  • NSG inbound rules: allow 22/tcp from your management network, 80/tcp for the web application, and 443/tcp if you add TLS.
  • Django Oscar serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain and restrict access to trusted IP ranges (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, select Create a resource, search the Marketplace for Django Oscar by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Then select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:django-oscar-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name django-oscar \
  --image sac1647283583153:django-oscar-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 to your network so that you can reach the storefront:

az vm open-port --resource-group <your-rg> --name django-oscar --port 80

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active postgresql django-oscar nginx

All three report active. Django Oscar runs under gunicorn on the loopback address 127.0.0.1:8002, nginx fronts it on port 80, and PostgreSQL is bound to loopback.

The application is never bound to a public interface, so nginx is the only way in.

Step 5 - Retrieve your admin password

Django Oscar uses a Django login. The username is admin and a unique password is generated on the first boot of your VM and written to a root-only file:

sudo cat /root/django-oscar-credentials.txt

This file contains OSCAR_ADMIN_USER, OSCAR_ADMIN_PASSWORD and the OSCAR_URL to open in a browser.

The file is mode 0600 root:root. No default account is ever created in the image, so no shared or default credential exists. Store the password somewhere safe and change it after your first sign-in (see Maintenance).

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires authentication, so it is safe to use as an Azure Load Balancer health probe.

Step 7 - Confirm authentication is required

The storefront is public so shoppers can browse, but the staff dashboard and the Django admin require signing in. An unauthenticated request to the admin returns HTTP 302 and redirects to the sign-in page. The storefront and health endpoint stay open:

echo "storefront: $(curl -s -o /dev/null -w '%{http_code}' -L http://127.0.0.1/)"
echo "health : $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/healthz)"
echo "admin : $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/admin/)"

It prints storefront : 200, health : 200 and admin : 302. The storefront and health endpoint are open, while the dashboard and admin require the per-VM admin password.

Step 8 - Confirm the installed version and sample catalogue

Django Oscar runs on Django in a dedicated virtual environment. Confirm the framework and Oscar versions, and confirm that the sample catalogue loaded:

/opt/django-oscar/venv/bin/python -c "import django, oscar; print('Django', django.get_version()); print('Django Oscar', oscar.get_version())"
sudo /usr/local/sbin/oscar-manage shell -c "from oscar.core.loading import get_model; print('products:', get_model('catalogue','Product').objects.count()); print('categories:', get_model('catalogue','Category').objects.count())"

It reports Django 5.2, Django Oscar 4.1, and a populated catalogue of demonstration products across several categories, so the storefront and dashboard are not empty on first boot.

Step 9 - Browse the storefront

Browse to http://<vm-public-ip>/. Django Oscar shows its storefront, branded as the SecureAnyCloud Store, with the pre-loaded sample catalogue. You can browse products by category, search, and open product detail pages, all without signing in.

Step 10 - View a product

Select any product to open its detail page. The sample catalogue ships products with titles, prices and stock levels, an add-to-basket button, and wish list and review options. You can see how a live product page looks and behaves.

Step 11 - Sign in to the dashboard

Browse to http://<vm-public-ip>/dashboard/ and sign in with admin and the password from Step 5. The Oscar staff dashboard opens with store statistics and the full set of management tools: Catalogue, Fulfilment (orders), Customers, Offers, Content pages and Reports.

This is where you manage the store day to day.

Step 12 - Explore the Django admin

Oscar also exposes the standard Django admin at http://<vm-public-ip>/admin/, signed in with the same admin account. The admin lists every Oscar model, from catalogue products and categories to baskets, orders and countries, for low-level data inspection and edits.

Step 13 - Add your own products and build your store

The image ships a sample catalogue so the store is not empty. When you are ready to build your own store, use the dashboard Catalogue menu to add product classes, categories and products. Set stock and pricing under Partners, and configure shipping, offers and vouchers.

To start from a clean catalogue, remove the sample products from Catalogue, then Products, in the dashboard.

Oscar is a framework designed to be forked and extended in your own Django project. See the Oscar documentation for building custom apps on top of this install.

Maintenance

  • Password: The administrator password is generated on first boot and stored in /root/django-oscar-credentials.txt (mode 0600 root:root). Change it from the command line with sudo /usr/local/sbin/oscar-manage changepassword admin, or change it in the Django admin under the admin user.
  • Add staff users: Create additional dashboard users with sudo /usr/local/sbin/oscar-manage createsuperuser, or from the dashboard Customers menu.
  • Restrict access: Django Oscar serves plain HTTP on port 80. For production, restrict access to trusted IP ranges in your Network Security Group, and front it with TLS (for example certbot with your own domain) terminating on :443. If you use a custom hostname for the dashboard sign-in, add your domain to CSRF_TRUSTED_ORIGINS in /opt/django-oscar/oscar.env and run sudo systemctl restart django-oscar.
  • Loopback binding: gunicorn is bound to 127.0.0.1:8002 in /etc/systemd/system/django-oscar.service, so nginx is the only path in. Keep it that way, and do not change the bind address to a public interface.
  • Database: The store lives in the oscar PostgreSQL database on loopback. Back it up with sudo -u postgres pg_dump oscar > oscar.sql. The database password is generated on first boot and held in /opt/django-oscar/oscar.env (mode 0640 root:oscar).
  • Configuration: Application settings are read from /opt/django-oscar/oscar.env. After edits, restart with sudo systemctl restart django-oscar. Custom Django settings can be added to /opt/django-oscar/src/sandbox/settings_local.py.
  • Upgrades: Django Oscar is installed from a pinned release into its virtual environment. To upgrade, update the package with /opt/django-oscar/venv/bin/pip, run sudo /usr/local/sbin/oscar-manage migrate and sudo /usr/local/sbin/oscar-manage collectstatic --noinput, then sudo systemctl restart django-oscar.
  • Security patches: Unattended upgrades remain enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Django Oscar on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure