SecureAnyCloud
Deployment guide

Dolibarr

Videos

Overview: Dolibarr 23 ERP CRM on Azure: overview (watch on YouTube)

Launch and log in: Dolibarr 23 ERP CRM on Azure: launch and log in (watch on YouTube)

Deep Dive: Dolibarr 23 ERP CRM on Azure: deep dive (watch on YouTube)

Overview

Dolibarr is an open-source ERP and CRM platform for small and medium businesses, freelancers and non-profit organizations. One web interface covers third-party management, commercial proposals, sales and purchase orders, customer and supplier invoices, a product and service catalog, stock and warehouse management, projects and time tracking, an agenda and a modular accounting suite. A large module ecosystem adds payments, email and external integrations.

This SecureAnyCloud image serves Dolibarr 23 with nginx and PHP 8.3 FPM on a hardened Ubuntu 24.04 LTS base, patched at build time. A bundled local MariaDB server makes the appliance complete on its own. The install wizard is pre-completed and locked, so the platform is ready the moment the instance boots.

What you get:

  • Dolibarr 23 served by nginx and PHP 8.3 FPM, managed by systemd
  • A bundled MariaDB server holding the Dolibarr database, already installed and ready
  • The install wizard pre-completed and locked, so no setup wizard is ever exposed
  • A per-VM administrator password generated on first boot and recorded in a root-only file
  • No shipped default login: the administrator password ships rotated to a discarded random value, and the real per-VM password is set on first boot
  • MariaDB bound to 127.0.0.1 only, never exposed to the network (it listens on the loopback interface at 127.0.0.1:3306)
  • A dedicated Azure data disk carrying both the MariaDB database and Dolibarr's uploaded and generated documents
  • A systemd timer running Dolibarr's scheduled jobs every five minutes
  • nginx.service, php8.3-fpm.service and mariadb.service as enabled systemd units
  • An unauthenticated /healthz endpoint for Azure Load Balancer health probes
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_D2s_v3 (2 vCPU / 8 GiB RAM) is a sensible starting size for typical production use. A smaller size such as Standard_B2s works for a small team.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the application. Add 443/tcp if you terminate TLS on the VM. The bundled MariaDB listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Dolibarr by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80) and HTTPS (443).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:dolibarr-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name dolibarr \
  --image sac1647283583153:dolibarr-ubuntu-24-04:default:latest \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name dolibarr --port 80,443

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that nginx, PHP FPM, MariaDB and the first-boot service are all active. MariaDB listens only on 127.0.0.1:3306, while nginx serves Dolibarr on port 80.

systemctl is-active nginx php8.3-fpm mariadb dolibarr-firstboot
ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

Each VM generates its own Dolibarr administrator password on first boot. It writes the password, the login user and the application URL to a root-only credentials file. Read it with sudo:

sudo cat /root/dolibarr-credentials.txt

Sign in to Dolibarr as user admin with the DOLIBARR_ADMIN_PASSWORD from this file.

With a Standard SKU public IP (the Azure default), the file's DOLIBARR_URL can show the VM's private address, for example http://10.0.0.4/. From your browser, use the VM's public IP or DNS name as in Step 5.

On the VM itself, run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in

Browse to http://<vm-public-ip>/. The Dolibarr sign-in page opens. Enter username admin and the password from Step 4.

After you sign in, the Dolibarr home dashboard summarizes your proposals, orders, invoices and agenda at a glance.

Step 6 - Set up your company and enable modules

Open Home, then Setup, then Company or Organization to set your company identity, currency and accounting preferences.

Next, open Home, then Setup, then Modules to enable the modules you need. The image already enables the core ERP and CRM modules (Third Parties, Products, Proposals, Orders, Invoices, Projects and Agenda). Enable more as your business grows, such as stock, accounting, expense reports or the REST API.

Step 7 - Manage third parties

Open Third parties in the top menu to create your customers, prospects and suppliers. Each third party holds contacts, addresses, bank details and the full history of proposals, orders and invoices raised against it.

Step 8 - Raise proposals, orders and invoices

Dolibarr models the full sales cycle. Create a commercial proposal for a third party and convert an accepted proposal into a sales order. Then generate a customer invoice from the order and record the payment against it.

Open Billing | Payment, then Customer invoices, to see and manage every invoice.

Step 9 - No known or default credentials

The image ships with the Dolibarr administrator password rotated to a discarded random value. Each VM generates its real administrator password, a unique random secret, on first boot. No known or blank credential authenticates.

The built-in round-trip check proves this. It confirms that the per-VM administrator signs in through Dolibarr's own login form, while a blank password and common weak guesses are all rejected. The admin account is the only Dolibarr super admin:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(login,' (Dolibarr super admin)') FROM dolibarr.llx_user WHERE admin=1"
sudo bash /usr/local/sbin/dolibarr-cred-roundtrip.sh

Step 10 - Verify the stack and where your data lives

Confirm the installed Dolibarr release, the health endpoint and the dedicated data disk.

The MariaDB database lives on the data disk mounted at /data, which is bind-mounted onto /var/lib/mysql. Dolibarr's uploaded and generated documents live on the same disk at /data/dolibarr/documents. All of your business data is therefore kept separate from the operating system disk and travels with the VM:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT('Dolibarr ',value) FROM dolibarr.llx_const WHERE name='MAIN_VERSION_LAST_INSTALL'"
curl -sI http://127.0.0.1/healthz | head -1
findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data;
findmnt -no SOURCE,TARGET /var/lib/mysql

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. For production, point a DNS record at your VM and obtain a certificate from Let's Encrypt:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

Dolibarr derives its base URL from the request Host header. Once you reach the VM on your domain over HTTPS, links render correctly with no further change.

To force HTTPS, set $dolibarr_main_force_https='1'; in /var/www/dolibarr/htdocs/conf/conf.php.

Scheduled jobs

A systemd timer runs Dolibarr's scheduled jobs (recurring invoices, email reminders and more) automatically every five minutes. Check the timer and its schedule:

systemctl status dolibarr-cron.timer --no-pager | head -5

Backing up

Your business data is the Dolibarr database plus the uploaded and generated documents. Dump the database and archive the documents directory:

sudo mysqldump --protocol=socket -uroot dolibarr > /tmp/dolibarr-backup.sql
sudo tar czf /tmp/dolibarr-documents-backup.tar.gz -C /data/dolibarr documents

Copy both files off the VM on your usual schedule. To restore, load the SQL dump into the dolibarr database and unpack the archive back to /data/dolibarr/documents.

Security notes

  • Encrypt web traffic. Dolibarr serves plain HTTP on port 80 out of the box. For anything beyond a trusted network, add your own domain and TLS as above, or front the VM with Azure Application Gateway.
  • Keep MariaDB private. The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through Dolibarr or over SSH with sudo mariadb.
  • Protect the administrator password. The password is unique per VM, and no known or blank credential authenticates. Keep /root/dolibarr-credentials.txt protected. To rotate the password, sign in and change it under Users and Groups, or set a new one directly on the VM:
sudo mariadb dolibarr -e "UPDATE llx_user SET pass_crypted=MD5('<new-password>'), pass=NULL WHERE login='admin'"
  • Configuration and uploads stay private. nginx denies the /conf and /documents trees and dotfiles, so configuration and uploaded files are never reachable from the web.
  • Keep the VM patched. Apply operating system updates regularly with sudo apt update && sudo apt upgrade. Unattended security updates are enabled by default.
  • Restrict network access. Limit inbound 80/tcp and 443/tcp in your NSG to the networks that need access.

Trademark

Dolibarr is an open-source project distributed under the GNU General Public License version 3. This image is an independent packaging of the open-source Dolibarr software by SecureAnyCloud. It is not affiliated with, sponsored by or endorsed by the Dolibarr project or the Dolibarr Foundation.

Support

SecureAnyCloud maintains this image and provides 24/7 support. If you need help deploying or operating Dolibarr on Azure, contact us at secureanycloud.com.

Deploy on Azure

Launch Dolibarr 23 ERP CRM on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure