ExpressionEngine

Find the ExpressionEngine on Ubuntu 24.04 LTS by SecureAnyCloud offer in the Azure Marketplace and select Create.

Choose a resource group and region. Size the VM: a 2 vCPU / 4 GB size such as Standard_B2s is a fine starting point. Provide your SSH public key for the azureuser account.

On the Networking tab, allow inbound 80 (and 22 for SSH). Then select Review + create.

Run the same deployment from the command line. Replace the image URN, resource group and location as appropriate:

az group create --name expressionengine-rg --location eastus
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:expressionengine-ubuntu-24-04:default:latest
az vm create \
  --resource-group expressionengine-rg \
  --name expressionengine-vm \
  --image sac1647283583153:expressionengine-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group expressionengine-rg --name expressionengine-vm --port 80

Note the public IP address that az vm create prints. You use it to reach the site.

On first boot, the image generates this VM's encryption keys, database password and administrator password. It runs ExpressionEngine's installer to create the schema and the single Super Admin account, then removes the installer. It opens the bootstrap gate and starts the web server. Finally, it verifies that the new credentials work and the common defaults are rejected, and writes /root/expressionengine-credentials.txt.

This completes within a minute or two. SSH in as azureuser and read the details:

sudo cat /root/expressionengine-credentials.txt

The file is mode 0600 and owned by root, so only a privileged user can read it. It contains the site URL, the control panel URL, the administrator username, email address and password, and the database name, user and password.

All three services should report active. The ss command confirms that the site is on port 80 and MariaDB is bound to loopback only. The response headers carry no server version banner.

systemctl is-active mariadb.service php8.3-fpm.service nginx.service php -r 'echo "PHP ".PHP_VERSION."\n";' mysql --version nginx -v ss -tlnp | grep -E ':(80|3306) ' | sed 's/users:.*//' | sort curl -sI http://127.0.0.1/ | head -4

Browse to http://<your-vm-public-ip>/admin.php. The ExpressionEngine control panel sign-in form opens.

Sign in with the username admin and the password from the credentials file. The control panel dashboard opens. It shows the ExpressionEngine version, welcome cards and the comments widget. The navigation down the left lists Entries, Files, Categories, Members, Roles, Channels, Fields, Templates, Tools, Add-Ons and Settings.

You can prove the same sign-in from the command line. The commands below use the per-instance password from the credentials file to complete a real login through the control panel form. They then check that common default passwords are refused:

sudo /usr/local/sbin/expressionengine-login-check.sh admin '<EE_ADMIN_PASSWORD>' && echo "per-VM password: ACCEPTED (correct)"
sudo /usr/local/sbin/expressionengine-login-check.sh admin 'admin' || echo "admin/admin: REJECTED (correct)"
sudo /usr/local/sbin/expressionengine-login-check.sh admin '' || echo "blank password: REJECTED (correct)"

Set your own password as soon as you sign in. Click your avatar in the top right of the control panel and open your profile. Use the password field to set a new password.

ExpressionEngine stores passwords hashed, so the new password is never recoverable from the database. After you change it, the copy in /root/expressionengine-credentials.txt is stale. Keep the file for the database password, or remove the administrator password line from it.

ExpressionEngine organises content into channels. A channel is a content type, for example News, Pages or Products, and each has its own set of custom fields. The seeded demo site ships three channels (About, Blog and Contact) and a set of entries, so you have a working example to learn from.

Open Entries in the control panel to see and manage every piece of content. From here you can filter by channel, category, status, date or author, edit an entry, or select New to publish another.

To build your own content model, open Developer and then Channels to create a channel. Open Developer and then Fields to add the custom fields it should carry. Then use Entries and New to publish into it.

Write the templates that present your channels on the public site under Developer and then Templates.

Browse to http://<your-vm-public-ip>/ to see the public site rendered from the seeded demo channels and templates. It shows a home page with navigation and a list of recent blog posts, each linking to its own page.

This is the core of what ExpressionEngine does: content you manage in the control panel is rendered to visitors by your templates.

To confirm from the command line that the public site is serving content with no session or cookie involved, run:

curl -s -o /dev/null -w 'public home page: HTTP %{http_code}\n' http://127.0.0.1/ LINKS="$(curl -s http://127.0.0.1/ | grep -ciE 'blog|about|contact' || true)" echo "navigation and content references on the public home page: ${LINKS}"

Open Members to manage accounts and Roles to control what they can do. The role system is granular. You decide which members can access the control panel, publish or edit entries in each channel, manage templates, or administer the site.

Create a role such as Editor with permission to publish in your content channels and nothing else. Then assign members to it, so a content team can work without super admin access.

A fresh instance sends mail through the local system by default. To use your own SMTP server for member registration, password reset and notifications, open Settings and then Outgoing Email in the control panel.

Enter your SMTP host, port, protocol, username and password. Then send the test message from that page.

This step explains what the image does so you can verify it yourself.

The bootstrap gate. nginx and php8.3-fpm each carry a ConditionPathExists drop-in pointing at a marker. First boot writes the marker only after every credential exists and the installer has been removed. Until then, systemd skips the units, so nothing serves an unprovisioned instance. The units are still enabled, so a reboot brings the site straight back.

grep -H ConditionPathExists /etc/systemd/system/nginx.service.d/sac-bootstrap-gate.conf /etc/systemd/system/php8.3-fpm.service.d/sac-bootstrap-gate.conf systemctl is-enabled mariadb.service php8.3-fpm.service nginx.service expressionengine-firstboot.service ls -l /var/lib/sac/data/

The web root and the installer. Only index.php and admin.php may execute PHP, and the whole /system/ tree is refused. The web installer has been removed from the tree and is unreachable:

for p in /system/user/config/config.php /system/ee/installer/ /images/uploads/x.php; do printf '%-34s HTTP %s\n' "$p" "$(curl -s -o /dev/null -w '%{http_code}' -m 10 http://127.0.0.1$p)" done curl -sL -o /dev/null -w 'admin.php (control panel) HTTP %{http_code}\n' http://127.0.0.1/admin.php curl -s -o /dev/null -w '/ (the site) HTTP %{http_code}\n' http://127.0.0.1/

Each protected path returns 403 or 404. The control panel and the site return 200.

Point an A record for your domain at the VM's public IP. Then set the control panel and site URLs to your domain under Settings and then URL and Path Settings. Install a certificate with Let's Encrypt:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d www.your-domain.com

certbot obtains a certificate, rewrites the nginx site to serve HTTPS, and installs a renewal timer. Open 443 in your Azure network security group so that visitors can reach the site.

A complete backup is the MariaDB database plus the ExpressionEngine tree, which holds your templates, uploaded files and configuration. Read the database name from the credentials file:

DB=$(sudo sed -n 's/^expressionengine.db.name=//p' /root/expressionengine-credentials.txt)
sudo mysqldump --single-transaction "$DB" | gzip > ~/expressionengine-db-$(date +%F).sql.gz
sudo tar czf ~/expressionengine-files-$(date +%F).tar.gz -C /var/www expressionengine ls -lh ~/expressionengine-db-*.sql.gz ~/expressionengine-files-*.tar.gz

Copy both files off the VM, for example to Azure Blob Storage, and keep them somewhere safe.

The operating system keeps itself patched through unattended security upgrades. For ExpressionEngine itself, watch the ExpressionEngine releases and follow the upstream upgrade instructions when a new version ships.

Always back up (Step 13) before upgrading.