Engelsystem

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size.

In the network security group (NSG), allow inbound 22/tcp from your management network and 80/tcp for the Engelsystem web interface. For public exposure, put TLS in front of it (see Step 11 - Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Engelsystem by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy with the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:engelsystem-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> --name engelsystem \
  --image sac1647283583153:engelsystem-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name engelsystem --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the LAMP stack is running

On first boot, Engelsystem rotates its database password, resets the administrator account to a fresh per-VM password, and starts the stack. Confirm that all three services are running:

systemctl is-active nginx php8.3-fpm mariadb

All three report active.

Next, check the component versions and confirm that the app answers on port 80:

cat /var/www/engelsystem/storage/app/VERSION php -v | head -1 mariadb --version curl -s -o /dev/null -w 'login page HTTP %{http_code}\n' http://127.0.0.1/login

The sign-in page returns HTTP 200. A request to / while signed out redirects to /login, and MariaDB listens on loopback only.

The document root is public/ only. The application code and config/config.php, which holds the database password, sit outside it and are never served over HTTP.

Step 5 - Retrieve the administrator password

Your VM generates its own administrator account on first boot. Read the credentials file as root:

sudo cat /root/engelsystem-credentials.txt

The file contains the login (admin), the sign-in URL and a unique password, plus the database name, user and password. The upstream default password asdfasdf is not present on any SecureAnyCloud VM. It is replaced during the build and again on first boot, and the login form rejects it.

Step 6 - Sign in

Browse to http://<vm-public-ip>/login and sign in with admin and the password from the credentials file.

Step 7 - The dashboard

After you sign in, you land on the dashboard. The image seeds a welcome message, so there is content to see immediately.

Use the menu at the top right to reach the shift plan, angel types, users and the admin settings.

Step 8 - The shift plan

The shift plan is the heart of Engelsystem. The image seeds a small demo event with three locations (Main Hall, Infodesk, Kitchen), three angel types and a handful of shifts, so the plan is populated the first time you open it instead of showing an empty grid.

Filter the plan by location, angel type and occupancy, and sign up for shifts.

Step 9 - Angel types and roles

Open Angel types to manage the volunteer roles for your event. Each angel type controls whether angels may sign themselves up, whether the type is restricted, and any requirements, such as a driving licence or a food-hygiene certificate.

To set up your own event, edit or delete the seeded locations, angel types and shifts, define your schedule, and post your own news. The demo content is there only to get you started.

Step 10 - The dedicated data disk

The MariaDB database holds every user, shift, role and worklog entry. It lives on a dedicated Azure data disk mounted at /var/lib/engelsystem, separate from the OS disk. Your event data stays independent of the OS image, and you can resize the disk as your event grows.

df -h /var/lib/engelsystem findmnt /var/lib/engelsystem

The per-VM first-boot service and the disk-backed database are shown below.

Step 11 - Enabling HTTPS

For any public deployment, put TLS in front of Engelsystem. Point a DNS A record at your VM's public IP, then install a certificate with Certbot and its nginx plugin. On your VM, follow these steps and substitute your own domain and email address:

• Install Certbot: sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
• Run certbot with the nginx plugin for your-domain.example.com to obtain and install a certificate for your domain. Supply your contact email when prompted.
• Engelsystem derives its base URL from the request, so it serves generated links over https:// as soon as TLS is terminated in front of it. No configuration change is required.

Certbot installs a renewal timer automatically, so certificates renew without further action.

Step 12 - Maintenance

• Updates: the OS continues to receive unattended security updates. To upgrade Engelsystem itself, deploy a newer release and run php /var/www/engelsystem/bin/migrate to apply any new database migrations.
• Backups: back up the MariaDB engelsystem database, which holds all of your event data. For example, use mysqldump.
• Logs: web server logs are under /var/log/nginx/. PHP-FPM logs are under /var/log/php8.3-fpm.log.

Support

SecureAnyCloud maintains this image and backs it with 24/7 support. For help deploying or operating Engelsystem on Azure, contact the SecureAnyCloud team through the SecureAnyCloud website.

Deploy on Azure

Launch Engelsystem on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com