SecureAnyCloud
Deployment guide

DomainMOD

Videos

Overview: DomainMOD on Ubuntu 24.04 on Azure: overview (watch on YouTube)

Launch and log in: DomainMOD on Ubuntu 24.04 on Azure: launch and log in (watch on YouTube)

Deep Dive: DomainMOD on Ubuntu 24.04 on Azure: deep dive (watch on YouTube)

Overview

DomainMOD is an open source manager for domains and other internet assets. It records every domain you own with its registrar, expiry date, renewal fee, owner, category and stakeholder, and it also tracks SSL and TLS certificates, hosting accounts, IP addresses and DNS providers. Its domain queue can pull live data from registrar APIs including Cloudflare, Porkbun, NameBright and Internet.bs.

DomainMOD adds expiration email alerts, renewal cost reporting across multiple currencies with automatic conversion rate updates, a data warehouse and a task scheduler.

This SecureAnyCloud image ships DomainMOD 4.23 served by Apache and PHP 8.3 on a hardened Ubuntu 24.04 LTS base, patched at build time. A bundled local MariaDB server makes the appliance complete on its own. The installation wizard is already completed and then deleted, so the application is ready when the instance boots and no installer is left in the web root.

What you get:

  • DomainMOD 4.23.0, the latest stable release, installed from the official upstream source and verified by checksum at build time
  • Apache 2.4 with PHP 8.3 and OPcache, plus every PHP extension DomainMOD requires
  • MariaDB bound to 127.0.0.1:3306, with its data directory on a dedicated 20 GiB data disk
  • A first-boot service that generates a unique administrator password and a unique database password for every VM, so no administrator password exists in the image
  • The task scheduler running as a managed systemd timer every ten minutes, rather than as an internet-reachable web endpoint
  • An unauthenticated /healthz endpoint for Azure Load Balancer health probes
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size for most domain portfolios. Move up to Standard_D2s_v3 if you run large registrar API syncs or build the data warehouse often.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, 80/tcp for the application and 443/tcp if you terminate TLS on the VM. The bundled MariaDB listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, choose Create a resource, search for DomainMOD 4.23 Domain and SSL Asset Manager on Ubuntu 24.04 LTS by SecureAnyCloud, and select Create.

Pick your subscription, resource group and region, and choose the Standard_B2s size. Select SSH public key authentication with the username azureuser, and allow inbound ports 22, 80 and 443.

The image attaches its own 20 GiB data disk for your asset database, so you do not need to add one.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:domainmod-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name domainmod \
  --image sac1647283583153:domainmod-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name domainmod --port 80,443

Step 3 - Confirm the services are running

SSH to the VM as azureuser. Confirm that Apache, MariaDB and the first-boot service are active and that the task scheduler timer is enabled. MariaDB is bound to 127.0.0.1:3306 only, while Apache serves on port 80.

systemctl is-active apache2 mariadb domainmod-firstboot;
systemctl is-enabled domainmod-scheduler.timer
ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

The first-boot service generates an administrator password unique to your VM and writes it to a root-only file. Read it over SSH:

sudo cat /root/domainmod-credentials.txt

DOMAINMOD_URL is the VM's own address as seen from inside the VM. Azure does not expose the public IP to the instance, so this is usually the private address.

You can browse the public IP shown in the Azure portal instead. DomainMOD stores no base URL and builds every in-application link relative to the address you reach it on, so both work identically.

Step 5 - Sign in

Browse to http://<vm-ip>/. Sign in with the username admin and the password from the credentials file.

Step 6 - Choose your own password

The password generated on first boot is a bootstrap credential, so DomainMOD prompts you to replace it the first time you sign in. Enter and confirm a new password, then select Change Password. This is DomainMOD's own behavior, driven by the new-password flag that the first-boot service sets for you.

You then land on the Dashboard, which shows your system totals for domains and SSL certificates. The navigation down the left lists Domains, SSL Certificates, Assets, Segments, Bulk Updater, Reporting, Data Warehouse, Settings, Maintenance and Administration.

Step 7 - Add your first registrar

DomainMOD organizes domains under the registrar they are registered with, so create a registrar and a registrar account first. Open Domains. DomainMOD tells you that you need at least one domain registrar and one domain registrar account before you can add domains.

Select Click here to add a Domain Registrar, choose your registrar and save it. Then add a registrar account under that registrar.

Once an account exists, you can add domains one at a time or import them in bulk with the CSV importer linked from the same page. For supported registrars, you can instead save your API credentials against the account and let the Domain Queue pull your domain list and expiry dates directly from the registrar.

Step 8 - Track domains, certificates and the rest of your estate

With a registrar account in place, Domains records each domain with its registrar, expiry date, renewal fee, owner, category, stakeholder, DNS provider, IP address and hosting account. SSL Certificates does the same for your certificates, with their own providers, accounts, types and expiry dates.

Assets holds the supporting records those entries point at. Segments lets you slice the estate by the fields that matter to you. Bulk Updater applies a change across many records at once.

Reporting turns the fee data into renewal cost reports across multiple currencies, using conversion rates that the scheduler refreshes for you.

To receive expiration alerts by email, enter your SMTP server details under Settings, then enable the Send Expiration Email job. Set your installation URL in the same Settings area. DomainMOD uses it to build the links in those emails, including the password reset link, so point it at your real hostname once DNS is in front of theVM.

Step 9 - The task scheduler

DomainMOD's scheduler runs the domain queue processing, the expiration emails, the currency conversion rate updates, the system cleanup, the version check and the data warehouse build.

Upstream expects you to configure a cron job that calls its cron.php over HTTP. This image uses a systemd timer instead. It runs the same jobs on upstream's documented ten-minute cadence and keeps the entrypoint off the network, so no anonymous visitor can trigger your registrar API jobs.

Confirm the timer is scheduled:

systemctl list-timers domainmod-scheduler.timer --all --no-legend

To enable, disable or schedule individual jobs, open Maintenance > Task Scheduler inside DomainMOD.

Step 10 - No known or default credentials

DomainMOD's own installer creates its admin user with the password hardcoded to the literal string admin, and its install wizard offers no way to choose a different one. Shipping that would put a published, guessable credential on a public port of every instance. This image never does.

The admin password is generated uniquely on the first boot of your VM, and nothing usable exists in the image before that. The build replaces the hardcoded credential immediately after the installer runs, and the captured image carries only a random hash that was discarded at build time.

You can confirm on your own VM that admin is the only account, that the hardcoded credential is gone, and that a blank or weak password is rejected:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(username,' (the only account that can sign in)') FROM domainmod.users";
sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT('upstream hardcoded admin/admin hashes present: ', COUNT(*)) FROM domainmod.users WHERE password = CONCAT('*', UPPER(SHA1(UNHEX(SHA1('admin')))))"
sudo bash /usr/local/sbin/domainmod-cred-roundtrip.sh

The image also closes the gaps upstream leaves open on a public host:

  • The installation wizard is deleted from the web root after the build completes, so you do not have to remember to remove it.
  • The configuration file that holds the database password, the class library and the vendored dependencies are all denied from the web, because upstream ships no .htaccess of its own.
  • The scheduler entrypoint is not reachable from the web.
  • No record of the build is carried into your VM. DomainMOD's installer logs the installing client's IP address and browser for its upstream analytics, and this image removes that record so nothing about the build is transmitted from your VM.

Step 11 - Verify the stack and where your data lives

Confirm the installed release, the health endpoint and the data disk. The entire asset inventory lives in MariaDB. Its data directory is bind-mounted onto the dedicated ext4 data disk at /data, so your records stay off the OS disk.

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT('DomainMOD ',db_version) FROM domainmod.settings"
curl -sI http://127.0.0.1/healthz | sed -n '1p'
findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data;
findmnt -no SOURCE,TARGET /var/lib/mysql

Adding your own domain and TLS

DomainMOD answers on whatever address you reach it on, so pointing a DNS name at the VM needs no application change. To terminate TLS on the VM, install Certbot and let it configure Apache:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d domainmod.your-domain.com --redirect --agree-tos -m you@your-domain.com

Certbot rewrites the SecureAnyCloud Apache site for HTTPS and installs a renewal timer. DomainMOD detects the HTTPS request and generates its links accordingly.

Once TLS is in place, set your installation URL under Settings so the links in expiration and password reset emails use your real hostname. Consider restricting ports 80 and 443 in the NSG to the networks that need them. Upstream's own security guidance is to keep a DomainMOD installation off the open internet where you can, because it can hold registrar API credentials.

Backing up

Your entire estate lives in the MariaDB database on the data disk. Take a logical dump over the local socket:

sudo mariadb-dump --protocol=socket -uroot --single-transaction --routines domainmod > /root/domainmod-backup.sql

Copy the dump off the VM. For a point-in-time copy of the whole volume, snapshot the data disk from the Azure portal or CLI. To restore, load the dump back with sudo mariadb --protocol=socket -uroot domainmod < /root/domainmod-backup.sql.

Security notes

  • No default credentials. The administrator password is unique to your VM, generated on first boot, written to /root/domainmod-credentials.txt with 0600 root:root permissions, and replaced by one you choose at first sign in. Upstream's hardcoded admin password does not exist on the shipped image.
  • The database is not reachable from the network. MariaDB listens on 127.0.0.1:3306 only. The application connects over the loopback socket with its own per-VM password, held in a configuration file that is denied from the web and readable only by the web user.
  • The installer is gone, not hidden. The install wizard directory is deleted from the web root after the build, and the path is denied by Apache as well.
  • The scheduler is not a public endpoint. cron.php is denied from the web and driven by a systemd timer instead.
  • Protect registrar API credentials. DomainMOD can store registrar API keys so the domain queue can sync your portfolio. Upstream recommends storing them only while you need them. Put TLS in front of the VM and restrict inbound access before you save any.
  • Keep it patched. The image is patched at build time and leaves Ubuntu's unattended upgrades enabled, so security updates continue to apply on your VM.

Trademark

DomainMOD is open source software released under the GNU General Public License version 3 or later, created by Greg Chetcuti. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Support

SecureAnyCloud provides 24/7 technical support for this image by email (sales@secureanycloud.com) and live chat, with a one-hour average response time for critical issues.

We help with deployment and initial configuration, registrar API and domain queue setup, expiration alert and email configuration, currency and conversion rate options, version upgrades, backup and restore, MariaDB administration, and troubleshooting.

Deploy on Azure

Launch DomainMOD 4.23 Domain and SSL Asset Manager on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure