DMPRoadmap

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for DMPRoadmap by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then choose Review + create and Create.

RG="dmproadmap-prod"; LOCATION="eastus"; VM_NAME="dmproadmap-01" IMAGE_URN="sac1647283583153:dmproadmap:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name dmp-vnet --address-prefix 10.100.0.0/16 --subnet-name dmp-subnet --subnet-prefix 10.100.1.0/24 az network nsg create -g "$RG" --name dmp-nsg az network nsg rule create -g "$RG" --nsg-name dmp-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name dmp-nsg --name allow-http --priority 110 \
  --destination-port-ranges 80 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:dmproadmap:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name dmp-vnet --subnet dmp-subnet --nsg dmp-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

DMPRoadmap runs as a puma application under dmproadmap.service, backed by a bundled PostgreSQL database and fronted by nginx. Confirm that the services are active and check the listeners:

sudo systemctl is-active postgresql nginx dmproadmap dmproadmap-firstboot
sudo ss -tlnp | grep -E ':80 |:3000 |:5432 '

Each service reports active. nginx listens on :80 as the single public front door. The puma application is bound to 127.0.0.1:3000 and PostgreSQL to 127.0.0.1:5432, on the loopback interface only. Neither is exposed directly.

On the first boot, before the app was reachable, this VM generated a per-instance super administrator account with a random password, together with per-instance Rails and Devise signing secrets. The credentials are written to a root-only file. Read them:

sudo cat /root/dmproadmap-credentials.txt

The file (mode 0600 root:root) holds DMPROADMAP_ADMIN_EMAIL and DMPROADMAP_ADMIN_PASSWORD (the account you sign in with) and DMPROADMAP_URL.

These values do not ship in the image. Every value is unique to this VM, so no two instances share a credential and there is no default login to change. The upstream super_admin@example.com / password123 demo accounts are never present.

Confirm three things. The per-instance admin credential authenticates through the web tier. The well-known upstream default account does not authenticate. An unauthenticated request to a protected route is redirected to sign in. The image ships a bundled script that checks all three end to end:

sudo /opt/dmproadmap/dmproadmap-selftest.sh curl -s -o /dev/null -w 'anonymous GET /plans -> HTTP %{http_code}\n' http://localhost/plans

The self test reports round-trip OK. The per-instance super admin logs in through the web interface and reaches an authenticated page, while the upstream super_admin@example.com / password123 login is dead. The anonymous request to /plans returns 302 (redirected to sign in).

This is the security model. Content is gated behind login, and the only administrator is the per-instance account whose password lives in the root-only credentials file.

Browse to http://<vm-ip>/ to reach DMPRoadmap. On the Sign in panel enter the DMPROADMAP_ADMIN_EMAIL and DMPROADMAP_ADMIN_PASSWORD from Step 5.

After you sign in, you land on My Dashboard. It lists the plans you own or collaborate on and has a button to create a new plan. As the per-instance super administrator, you can also reach the administration areas from the top navigation.

Click Create plans in the top navigation. DMPRoadmap asks about your research project, then lets you pick the primary research organization and the primary funder so it can offer the best matching template. The organization and funder catalogues, and the funder templates behind them, are the reference data preloaded into the image, so you can create a real plan immediately.

Fill in the project name, and choose an organization and funder (or tick the "not listed" options). Click Create plan to open the plan editor and start answering the template questions.

DMPRoadmap is template-driven. As an administrator, open the Templates administration area to review, edit and publish the Data Management Plan templates your organization offers. Each template is built from phases, sections and questions. The image ships the upstream default template and funder templates, so the area is populated on first use.

The image records the exact upstream build and the reference data loaded into the database:

cat /opt/dmproadmap/VERSION
sudo -u postgres psql -tAd roadmap -c "SELECT 'orgs=' || count(*) FROM orgs"

VERSION reports the pinned DMPRoadmap tag, the source commit, and the Ruby and Rails versions the image was built with. The database ships with the upstream reference catalogue loaded and zero user accounts, so the only login is the per-instance administrator created on first boot.

• Application: DMPRoadmap 5.0.2 (Ruby on Rails 7.1, built from source at the pinned tag)
• Interpreter: Ruby 3.1.4 compiled from source, at /opt/ruby
• Web server: puma bound to 127.0.0.1:3000 (loopback only)
• Front door: nginx on :80, reverse proxying to puma
• Database: PostgreSQL 16 bound to 127.0.0.1:5432, database roadmap, preloaded reference catalogue
• PDF export: wkhtmltopdf at /usr/local/bin/wkhtmltopdf (wicked_pdf)
• Signing secrets: per-instance Rails, Devise and upload secrets, generated on first boot into /etc/dmproadmap/dmproadmap.env
• Admin account: per-instance random password, created on first boot into /root/dmproadmap-credentials.txt
• Operating system: Ubuntu 24.04 LTS (patched at build)
• License: MIT (DMPRoadmap)

sudo systemctl status dmproadmap --no-pager | head -12 sudo journalctl -u dmproadmap --no-pager | tail -40

Restart the application with sudo systemctl restart dmproadmap. Follow its logs live with sudo journalctl -u dmproadmap -f. The runtime configuration is in /etc/dmproadmap/dmproadmap.env. After you change the environment file, restart the service to apply it.

The image ships with email delivery, ORCID, Shibboleth and funder API integrations unconfigured. It serves over plain HTTP on port 80, which is convenient behind a load balancer or private network. For production, set up the following:

• Email: DMPRoadmap sends invitations, plan sharing and notifications by email. Add your SMTP settings to /etc/dmproadmap/dmproadmap.env and restart the service. Until email is configured, actions that would send mail are not delivered.
• HTTPS: front the VM with Azure Application Gateway, a load balancer with a managed certificate, or a CDN, and forward to nginx on port 80. Alternatively, add a TLS server block to /etc/nginx/sites-available/sac-dmproadmap that references your certificate and key, open 443/tcp on the NSG, and then run sudo systemctl reload nginx.
• Single sign-on: ORCID and Shibboleth institutional login are supported upstream. Add the relevant credentials to /etc/dmproadmap/dmproadmap.env and configure the identifier schemes in the administration area.
• DNS name: point a DNS name you control at the VM public IP, and set DMPROADMAP_HOST in the environment file so that links in emails use it.

• Restrict the NSG. Allow TCP 80 (and 22 for admin) only from the networks that use the app.
• Terminate TLS in front of the app (Step 14) so that the sign-in password travels encrypted.
• Rotate the initial admin password. Sign in and change it from your profile once you have deployed.
• Keep the application and database private to the loopback. puma is bound to 127.0.0.1:3000 and PostgreSQL to 127.0.0.1:5432, fronted by nginx. Keep it that way and never expose them directly.
• Keep the OS patched. Unattended security upgrades remain enabled on the running VM.

DMPRoadmap is distributed under the MIT License. This SecureAnyCloud image builds the unmodified official open-source release from source.

SecureAnyCloud provides the packaging, the bundled PostgreSQL database, the nginx front door, the per-instance secret and administrator generation, the removal of the upstream default demo accounts, the paired deploy guide, and 24/7 support with a guaranteed 24 hour response SLA.

DMPRoadmap is an independent open-source project, and this image is not affiliated with or endorsed by it.

Deploy on Azure

Launch DMPRoadmap on Ubuntu 24.04 LTS by SecureAnyCloud from the Azure Marketplace and follow this guide to a working Data Management Plan platform in minutes.

Deploy on Azure

Launch DMPRoadmap on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com