Evolution CMS

Search for Evolution CMS in the Marketplace, select the SecureAnyCloud publisher, and choose Create. Choose Standard_B2s or larger.

Configure the Network Security Group to allow TCP 80 for the website from the internet, or from your own networks while you set it up. Allow TCP 22 for administration from your administrative networks only. The database and the PHP runtime stay on loopback and are never exposed.

RG="content-prod"; LOCATION="eastus"; VM_NAME="evolution-cms" IMAGE_URN="sac1647283583153:evolution-cms:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:evolution-cms:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 80 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

On first boot, the image generates this VM's database password and administrator password. It creates the database schema and the single administrator account, opens the bootstrap gate and starts the web server. It then verifies that the new credentials work and that the common defaults are rejected, deletes the install directory, and writes /root/evolution-cms-credentials.txt. This completes within a minute or two.

SSH in as azureuser and read the details:

sudo cat /root/evolution-cms-credentials.txt

The file is mode 0600 and owned by root, so only a privileged user can read it. It contains the site URL, the administrator username and password, and the database name, user and password.

Confirm that the install wizard and the database configuration file are both unreachable, as they are on every fresh instance:

for p in /install /install/index.php /install/cli-install.php \
  /core/config/database/connections/default.php; do curl -s -o /dev/null -w "%{http_code} $p\n" "http://127.0.0.1$p" done

Then confirm the credentials file, every enabled unit and the absence of swap on the OS disk:

sudo stat -c '%a %U:%G %n' /root/evolution-cms-credentials.txt systemctl is-enabled mariadb.service php8.3-fpm.service nginx.service evolution-cms-firstboot.service swapon --show

All three services should report active. The ss output confirms that the site is on port 80 and that MariaDB is bound to loopback only. The response headers carry no server version banner.

systemctl is-active mariadb.service php8.3-fpm.service nginx.service php -r 'echo "PHP ".PHP_VERSION."\n";' mysql --version nginx -v ss -tlnp | grep -E ':(80|3306) ' | sed 's/users:.*//' | sort curl -sI http://127.0.0.1/ | head -4

Expected output:

active active active PHP 8.3.6 mysql Ver 15.1 Distrib 10.11.14-MariaDB, for debian-linux-gnu (x86_64) using EditLine wrapper nginx version: nginx/1.24.0 (Ubuntu) LISTEN 0 511 [::]:80 [::]:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 80 127.0.0.1:3306 0.0.0.0:* HTTP/1.1 200 OK Server: nginx Date: ... Content-Type: text/html; charset=UTF-8

Browse to http://<your-vm-public-ip>/manager/. The Evolution CMS Manager login page opens.

Sign in with the username admin and the password from the credentials file. On a new install, the Manager first shows a System configuration review screen. This is expected on first login only. Review or accept the defaults, then choose Save + Continue editing to proceed into the Manager.

You can prove the same sign-in from the command line. These commands use the per-instance password from the credentials file to complete a real login through the real Manager form, then check that common default passwords are refused:

sudo /usr/local/sbin/evolution-cms-login-check.sh admin '<EVOLUTION_ADMIN_PASSWORD>' && echo "per-VM password: ACCEPTED (correct)"
sudo /usr/local/sbin/evolution-cms-login-check.sh admin 'admin' || echo "admin/admin: REJECTED (correct)"
sudo /usr/local/sbin/evolution-cms-login-check.sh admin '' || echo "blank password: REJECTED (correct)"

Expected output:

per-VM password: ACCEPTED (correct) admin/admin: REJECTED (correct) blank password: REJECTED (correct)

You can also run the full credential round trip that SecureAnyCloud itself uses as a build gate. It never prints a credential value. It reports only pass or fail against the real login form:

sudo /usr/local/sbin/evolution-cms-cred-roundtrip.sh

After the first-login settings review, the Manager shows the resource tree down the left and the details of the selected resource on the right. The seeded Evolution CMS Install Success resource ships with every fresh install.

After you sign in, set your own password first. Choose admin at the top right of the Manager, choose My Settings, and use the password fields to set a new password.

Evolution CMS stores passwords using a salted, iterated hash (the same phpass lineage WordPress uses), so the new password is never recoverable from the database. After you change the password, the copy in /root/evolution-cms-credentials.txt is stale. Keep the file for the database password, or remove the administrator password line from it.

In the Manager's left-hand resource tree, choose the New document icon in the toolbar, or right-click the site root and choose Create Resource here. The New Resource form opens. Give the resource a Title, and write the page body into the Resource content field.

The pagetitle field is metadata used for the browser title and the Manager's own listings. A fresh page has no template assigned, which matches the seeded homepage. In that case the page renders the raw Resource content field with no wrapper at all. If you want the title to appear on the page itself, include it in the content, for example as an <h1> heading, exactly as in a normal HTML page.

Choose Save + Continue editing, then open the public site at the resource's URL. Use the Preview button on the Manager's toolbar, or browse to http://<your-vm-public-ip>/index.php?id=<resource-id>. The content you wrote in the Manager is now live on the public site. This is the core of what Evolution CMS does: it turns what you write in the dashboard into a published page.

Confirm from the command line that a published resource is public, with no session or cookie involved:

curl -s -o /dev/null -w 'home page: HTTP %{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'healthz: HTTP %{http_code}\n' http://127.0.0.1/healthz

A freshly deployed instance answers 200 for both. The home page is the seeded resource, and /healthz is an unauthenticated liveness probe that nginx serves directly. It is suitable for an Azure Load Balancer health check.

A note on URLs. This image ships with Evolution CMS's friendly (alias-path) URLs turned off, so you reach every resource by its numeric ID (?id=N) rather than by an alias path. This is a deliberate, fully supported upstream configuration. Friendly URLs depend on a file-based alias cache that reflects a newly created resource only after the next cache rebuild. ?id=N links resolve directly and reliably regardless of the cache's state, which is the right trade-off for a freshly provisioned appliance. Evolution CMS's own link generator uses the same ?id=N form throughout the Manager and any auto-generated navigation.

A production site normally starts from a Template rather than leaving each resource blank. To create one, open Elements > Manage Templates in the Manager. A template is HTML with tags such as [*pagetitle*] for the resource's title and [*content*] for its body, plus any Template Variables (custom fields) you define under Elements > Template Variables.

When a template exists, assign it to a resource from the Settings tab of that resource's edit form. The page then renders through the template instead of as raw content.

Chunks (reusable HTML snippets, Elements → Manage Chunks) and Snippets (small PHP scripts that output content, Elements → Manage Snippets) let you build a header, footer, navigation menu or any other reusable piece once. You then reference it from every template with a tag such as {{header}} or [[MySnippet]].

Users > Manage Users lists every Manager account and lets you create more, which is useful once you have more than one editor. Users > Manage Roles defines what each role can do inside the Manager, so you can give a content editor access to resources without exposing system settings or user management.

The built-in file manager lets you browse, upload and organise files under assets/. Open it from the folder icon in the toolbar or from Elements → Manage Files. This is the tree that the image already allows the web server to serve as static content. Anything you upload there is immediately reachable at its own URL, and PHP execution is refused as defence in depth.

Evolution CMS's own assets/backup/ tooling, reachable from the Manager, can export the database. You can also take a full backup from the command line at any time:

CREDS=/root/evolution-cms-credentials.txt
DB_PASS=$(sudo sed -n 's/^evolution.db.password=//p' "$CREDS")
sudo mysqldump -u evolution -p"$DB_PASS" evolution_cms > "evolution-cms-backup-$(date +%Y%m%d).sql"

Store the resulting file outside the VM, for example in Azure Blob Storage or copied off with scp, so that the database backup survives even if you lose the VM.

Point an A record for your domain at the VM's public IP address. Evolution CMS resolves the site's own address dynamically from the incoming request, so the application needs no configuration change for the domain to start working once DNS propagates.

For TLS, the simplest option on a single VM is a reverse proxy in front of nginx, for example Caddy or an additional nginx server block with Certbot. The proxy terminates HTTPS on 443 and forwards to the existing site on 127.0.0.1:80. If you use Let's Encrypt, keep port 80 open for the ACME HTTP-01 challenge.

The base image ships with unattended-upgrades enabled for OS-level security patches. You can update Evolution CMS itself from the Manager (Dashboard > check for updates, where available) or by following the release notes at github.com/evolution-cms/evolution. Always take a database and filesystem backup first, as upstream's release notes recommend.