Deployment guide

Faveo Helpdesk

Overview

Faveo Helpdesk is a free, open source, self-hosted support ticketing and helpdesk system. It turns inbound email and web requests into tickets, routes them to departments and agents, and enforces SLA plans. Customers get a self-service portal and knowledge base, and your team works from a clean agent and admin console.

This SecureAnyCloud image delivers Faveo Helpdesk Community fully installed and configured on Ubuntu 24.04. It is a Laravel 9 application on PHP 8.2 with OPcache, served by nginx over HTTPS with php-fpm and backed by MariaDB. The setup wizard has already been run and locked, and the administrator account is already created, so you land directly on the sign-in page with nothing to configure.

Faveo Helpdesk Community is licensed under the Open Software License 3.0 (OSL-3.0), an OSI-approved open source licence. The complete, unmodified upstream source is shipped on the image under /var/www/faveo. The paid Pro and Cloud editions are separate commercial products and are not included.

SecureAnyCloud is not affiliated with, endorsed by, or sponsored by the Faveo project. "Faveo" is a trademark of its respective owner. This image repackages the upstream open source release with SecureAnyCloud's provisioning and support.

What you get:

Faveo Helpdesk Community 2.0.3 (OSL-3.0), served from /var/www/faveo/public
nginx (TLS on :443, with :80 redirected to HTTPS), PHP 8.2 (php8.2-fpm from the ondrej/php PPA with OPcache and the mysql, mbstring, imap, gd, intl and bcmath extensions) and MariaDB
A per-VM self-signed TLS certificate generated on first boot, so the console loads over a secure context (Faveo forces HTTPS for every link and asset)
A per-VM administrator password, MariaDB password and Laravel APP_KEY, all generated at first boot and written to a root-only file, so no default or shared login ships in the image
Two sample tickets and a demo requester, so the agent console and dashboard are not empty on first launch (delete them once you are set up)
The application tree and the MariaDB datadir on dedicated, independently resizable data disks
The Laravel scheduler, running every minute through a systemd timer for background jobs, email fetching and SLA escalations
nginx.service, php8.2-fpm.service and mariadb.service as enabled, active systemd units
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting size. Choose a larger size for bigger teams or heavier ticket volume.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network. Allow 443/tcp (HTTPS) and 80/tcp (which redirects to HTTPS) from your users.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Faveo Helpdesk by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443).

Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:faveo-helpdesk-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name faveo-helpdesk \
  --image sac1647283583153:faveo-helpdesk-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

To reach the web console, open HTTPS (and HTTP, which redirects):

az vm open-port --resource-group <your-rg> --name faveo-helpdesk --port 443 --priority 900
az vm open-port --resource-group <your-rg> --name faveo-helpdesk --port 80 --priority 910

Step 3 - Connect to your VM

Connect over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

The three services behind Faveo should all report active. MariaDB listens only on the loopback interface, plain HTTP redirects to HTTPS, and the sign-in page answers over TLS:

systemctl is-active nginx php8.2-fpm mariadb ss -tlnp | grep -E ':80 |:443 |:3306 ' curl -sk -o /dev/null -w 'https sign-in -> %{http_code}\n' https://127.0.0.1/auth/login

Expected output: three lines of active, :3306 bound to 127.0.0.1 only, and https sign-in -> 200 (the Faveo sign-in page over TLS).

Step 5 - Retrieve your administrator password

On the first boot of every VM, a one-shot service (faveo-helpdesk-firstboot.service) generates credentials that are unique to that VM. These are a fresh Laravel application key, a fresh MariaDB password, and a fresh administrator password.

The service also generates a per-VM self-signed TLS certificate and sets the VM's own address as the application URL. No shared or default credentials ship in the image. Read the credentials file with sudo:

sudo cat /root/faveo-helpdesk-credentials.txt

The file (mode 0600, root only) contains the administrator email (faveo.admin.user), the administrator password (faveo.admin.pass), the sign-in URL, and the database credentials. Faveo signs in by email address. After signing in, change the admin email and profile to your own from Users.

You can verify the login round trip from the VM's own shell. The commands read the per-VM credentials, fetch a CSRF token and post a real sign-in. A successful Faveo login answers HTTP 302 away from the login page, and the authenticated dashboard then answers 200. The commands also confirm that a wrong password is rejected:

USER=$(sudo grep '^faveo.admin.user=' /root/faveo-helpdesk-credentials.txt | cut -d= -f2-)
PASS=$(sudo grep '^faveo.admin.pass=' /root/faveo-helpdesk-credentials.txt | cut -d= -f2-)
CJ=$(mktemp)
TOK=$(curl -sk -c "$CJ" https://127.0.0.1/auth/login | grep -oE 'name="_token"[^>]*value="[^"]+"' | head -1 | sed 's/.*value="//;s/"//')
curl -sk -o /dev/null -w 'good login -> %{http_code}\n' -b "$CJ" -c "$CJ" \
  -d "_token=$TOK" --data-urlencode "email=$USER" --data-urlencode "password=$PASS" https://127.0.0.1/auth/login
curl -sk -o /dev/null -w 'dashboard -> %{http_code}\n' -b "$CJ" https://127.0.0.1/dashboard rm -f "$CJ"

Expected output: good login -> 302 (accepted, redirected to the dashboard) and dashboard -> 200 (the authenticated agent console).

Step 6 - Sign in

Browse to https://<vm-public-ip>/ and sign in with the email and password from the credentials file.

The image ships a per-VM self-signed certificate, so your browser shows a one-time certificate warning on first visit. Click through it, or install your own domain certificate into /etc/ssl/faveo/faveo.crt and /etc/ssl/faveo/faveo.key.

After signing in, you land on the Faveo dashboard. It summarises your inbox, unassigned, overdue and due-today ticket counts and a report of tickets created, reopened and closed.

Step 7 - Work with tickets

Open Tickets > Inbox to see the ticket queue. Every inbound email or web request becomes a ticket. You can assign a ticket to an agent, set its priority and department, reply, add internal notes, merge it, or close it. The image seeds two sample tickets so the queue is not empty. Delete them once you are comfortable with the workflow.

Open a ticket to see the full conversation, its SLA plan and due date, the requester and assignee, and the reply and internal-note actions. This is the core Faveo workflow: a shared, SLA-tracked queue where every request is triaged, answered and resolved.

To configure the helpdesk itself, open Admin Panel and set up your departments, help topics, SLA plans, agents, canned responses, email fetching and the knowledge base.

Step 8 - Confirm the version and the stack

Check the Faveo version, the PHP version and the data disks:

sudo mariadb -N -B faveo -e "SELECT version FROM settings_system LIMIT 1;" php -v | head -1 df -h /var/www /var/lib/mysql

Expected output: v2.0.3, PHP 8.2, and the two dedicated data disks that hold the application tree (/var/www) and the MariaDB datadir (/var/lib/mysql). Resize either disk from the Azure portal if you need more room for attachments or the database.

First-boot service and security model

A one-shot faveo-helpdesk-firstboot.service runs After=mariadb.service and Before=nginx.service php8.2-fpm.service. The per-VM credentials and TLS certificate are therefore in place before the first page is ever served.

The service rotates the MariaDB password, editing .env in lock-step so the application never loses its database connection. It regenerates the Laravel APP_KEY and sets a per-VM administrator password. It then writes the credentials file at mode 0600 (root only) and drops a sentinel so that it runs exactly once. Verify it with:

systemctl show -p ActiveState -p SubState --value faveo-helpdesk-firstboot.service
sudo stat -c '%a %U:%G %n' /root/faveo-helpdesk-credentials.txt

Expected output: active exited and 600 root:root /root/faveo-helpdesk-credentials.txt.

Administration from the CLI

Admin tasks use Laravel's artisan as the www-data user. For example, list the Faveo commands or clear the caches:

sudo -u www-data php /var/www/faveo/artisan list | grep -iE 'install|jwt'
sudo -u www-data php /var/www/faveo/artisan cache:clear

The Laravel scheduler runs background jobs such as fetching new email, sending notifications and running SLA escalations. It runs every minute through the faveo-helpdesk-scheduler.timer systemd timer, so there is no crontab entry to add.

Serving Faveo on your own domain

To serve Faveo on your own domain, point a DNS record at the VM. Then set the application URL in /var/www/faveo/.env and clear the caches. Faveo forces HTTPS, so keep the https:// scheme:

APP_URL=https://help.example.com

sudo -u www-data php /var/www/faveo/artisan config:clear
sudo -u www-data php /var/www/faveo/artisan cache:clear

For a browser-trusted certificate, install one from your CA (for example Let's Encrypt) over the shipped self-signed pair, or point nginx at your certificate files:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d help.example.com

Backup and maintenance

Faveo's data lives in the MariaDB database and the uploaded files under /var/www/faveo/storage. Back up the database with mariadb-dump, and snapshot the data disks from the Azure portal for a full point-in-time copy:

sudo mariadb-dump --single-transaction faveo | gzip > /var/backups/faveo-$(date +%F).sql.gz

Keep the OS current with sudo apt-get update && sudo apt-get upgrade. The image ships with unattended security updates enabled. Review Faveo's own release notes before moving between versions.

Support

This image is backed by 24/7 SecureAnyCloud support for deployment, upgrades, inbound and outbound email and IMAP fetching, SLA and department configuration, the knowledge base, plugins and database administration. Email sales@secureanycloud.com or use the live chat in the support portal. Critical issues receive a one-hour average response.

Deploy on Azure

Launch Faveo Helpdesk on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Faveo Helpdesk Community is a Laravel 9 helpdesk and support ticketing application. This image runs it behind nginx with PHP-FPM 8.2 and OPcache enabled. The mysql, mbstring, imap, gd, intl and bcmath PHP extensions that Faveo needs are installed.

MariaDB provides the database on the same instance, bound to the loopback interface only. A Laravel scheduler runs every minute through a systemd timer to process queued jobs, fetch email and run SLA escalations.

What you get:

A locked setup wizard. Faveo's web setup wizard has already been run and locked, so the first request lands directly on the sign-in page. Faveo's install middleware bypasses the wizard whenever the application's .env file is present, which it is in this image. The /step1../step5 setup routes therefore redirect to the sign-in page, and the wizard can never be re-run.
Unique secrets per instance. A fresh administrator password, a fresh MariaDB password and a fresh Laravel application key are generated on the first boot of every deployed instance. Two instances launched from the same Amazon Machine Image never share secrets. The administrator and database credentials are written to /root/faveo-helpdesk-credentials.txt with mode 0600, so only the root user can read them.
HTTPS on port 443. Faveo forces every generated URL to HTTPS, so the image serves the application on port 443 with a self-signed certificate that is regenerated uniquely on each instance's first boot. Port 80 redirects to 443. Your browser shows a warning on the first visit until you replace the certificate with one for your own domain (see Step 12).
Separate data volumes. The Faveo application code and Laravel storage (uploads, attachments, logs) live under /var/www/faveo on a dedicated EBS volume, separate from the operating system disk. The MariaDB data directory sits on its own EBS volume at /var/lib/mysql. You can resize each tier independently.

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound port 443 from the networks your agents and customers use to reach Faveo
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Launch the instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Faveo Helpdesk. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. The Faveo workload is PHP and MariaDB heavy, and report generation and email processing benefit from memory. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound port 443 from the networks your users use. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass.

Launch the instance from the AWS CLI

The following block launches an instance from the SecureAnyCloud Faveo Helpdesk Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=faveo-01}]'

The command prints a JSON document on success. Note the instance ID, then retrieve the instance's public address once it is running with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and retrieve the initial credentials

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched. For Faveo Helpdesk 2.0.3 on Ubuntu 24.04, the user is ubuntu.

Connect with ssh -i <path-to-key.pem> ubuntu@<instance-public-ip>, substituting your key path and the instance's public IP address.

The per-instance administrator and database credentials are written to a root-only file on first boot. Read it with:

sudo cat /root/faveo-helpdesk-credentials.txt

The file lists the application URL, the administrator sign-in email and password, and the MariaDB database name, user and password. Store the administrator password in your password manager, and treat this file as sensitive.

Verify that the stack is running

Faveo is served by three systemd units. Confirm that they are active:

systemctl is-active nginx php8.2-fpm mariadb

Each line returns active. Next, confirm that Faveo answers on HTTPS. The -k flag accepts the self-signed certificate:

curl -sk -o /dev/null -w 'sign-in page HTTP %{http_code}\n' https://127.0.0.1/auth/login

This returns HTTP 200. The Laravel scheduler processes queued jobs and fetches email. It runs every minute through a systemd timer. Check it with:

systemctl status faveo-helpdesk-scheduler.timer --no-pager

Sign in to the agent and admin console

Browse to https://<instance-public-ip>/. The image ships a self-signed certificate, so your browser warns you the first time. Accept the warning to proceed. You replace the certificate in Step 12. You land on the Faveo sign-in page.

Sign in with the administrator email and password from /root/faveo-helpdesk-credentials.txt. After signing in, you land on the Dashboard. It summarises inbox, unassigned, overdue and due-today ticket counts and shows a report chart.

The top navigation gives you Dashboard, Users, Tickets, Tools and Report. The Admin Panel link opens the configuration area. The same address serves the customer self-service portal for people who are not signed in as agents.

Change the administrator password and set your details

The first-boot password is unique to your instance, but you should still set your own. Open the user menu in the top right and open your Profile. Set your name and a personal email address, and change the password to one you control. Faveo stores agent passwords as bcrypt hashes.

Set the helpdesk name, URL and system email

Open Admin Panel > Settings. Set the helpdesk name and the system URL to the address your users will use (for example https://support.example.com/).

Under Admin Panel > Email > Email settings, configure the address that outbound notifications are sent from. System mail is what lets Faveo send and fetch ticket email, so configure it first on a new helpdesk.

Create departments, help topics, SLA plans and agents

Faveo routes tickets using departments and help topics. Set them up from the Admin Panel:

Departments (Admin Panel > Staff > Departments) group your agents and own ticket queues, for example Support, Billing or IT.
Help topics (Admin Panel > Manage > Help topics) are what a customer chooses when opening a ticket. Each maps to a department and SLA plan.
SLA plans (Admin Panel > Manage > SLA plans) set response and resolution targets. The image ships 6, 12 and 24 hour plans that you can adapt.
Agents (Admin Panel > Staff > Agents) are your staff. Add an agent and assign them to a department and a role, and they receive their own sign-in.

Create the departments your team is organised around, a help topic for each request type, and an agent record for each member of staff.

Work a ticket

From the Tickets tab, open any ticket to see the full conversation, the requester, the status, priority, department, SLA plan and due date.

Use Reply to respond to the customer and Internal notes for a note that only agents see. Use the action buttons to assign the ticket, change its status, generate a PDF or edit it. Agents can raise a ticket on a customer's behalf with Create ticket.

Configure inbound email (email fetching)

To turn inbound email into tickets, configure a mailbox under Admin Panel > Email > Emails. Faveo can fetch mail from an IMAP or POP mailbox on the schedule run by the scheduler timer. The php-imap extension that this image ships makes that work.

Enter the mailbox host, login and folder. Choose the department and help topic that new mail maps to, and enable fetching. The scheduler timer already running on this instance polls the mailbox each minute.

The customer self-service portal and knowledge base

Your customers use the portal at https://<instance-public-ip>/. There they can register, open a new ticket, check the status of an existing ticket, and browse the knowledge base.

Build out the knowledge base under Admin Panel > Manage. Published articles appear on the portal and deflect repetitive tickets.

Replace the self-signed certificate with Let's Encrypt

The image serves HTTPS with a self-signed certificate, so the site is encrypted out of the box. For production use, replace it with a trusted certificate for your own domain. Point a DNS name at the instance's public address, then install Certbot and obtain a certificate.

The commands below are illustrative. Replace support.your-domain.com with your domain and run them yourself, because they involve a domain you own and interactive prompts.

Install Certbot and the nginx plugin, then request a certificate. Certbot edits the nginx site in place and reloads nginx:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx

sudo certbot --nginx -d support.your-domain.com

After the trusted certificate is live, update the system URL under Admin Panel > Settings to the https:// address so that links and assets resolve to your domain.

Backups and maintenance

The Faveo database lives in MariaDB on the /var/lib/mysql volume. The application files and attachments live under /var/www/faveo. Back up both. A simple database dump is:

sudo mysqldump --single-transaction faveo | gzip > faveo-db-$(date +%F).sql.gz

Take EBS snapshots of the data volumes for point-in-time recovery, and snapshot before any Faveo version upgrade. Keep the operating system patched with sudo apt-get update && sudo apt-get -y upgrade.

Storage layout

The application and database tiers are on dedicated EBS volumes, each independently resizable:

df -h /var/lib/mysql /var/www

/var/lib/mysql holds the MariaDB data directory, and /var/www holds the Faveo code, Laravel storage and ticket attachments. To grow a tier, modify the EBS volume in the EC2 console and then extend the filesystem with sudo resize2fs <device>.

What the console includes

These are the main screens you work with:

Sign-in page. Served on first boot with a per-instance administrator password and the setup wizard already locked.
Agent and admin dashboard. Shows inbox, unassigned, overdue and due-today counts and a report chart.
Ticket list. Shows each ticket's subject, ID, requester, assignee and last activity.
Single ticket. Shows status, priority, department, SLA plan, due date and the reply and internal-notes actions.
Admin panel. Configures staff, departments, help topics, SLA plans, email and the knowledge base.

Support

This image is backed by 24/7 technical support from SecureAnyCloud, covering Faveo deployment, upgrades, inbound and outbound email and IMAP fetching, SLA and department configuration, the knowledge base, plugins and database administration. Contact support through the channel listed on the AWS Marketplace listing.

Deploy on AWS

Launch Faveo Helpdesk on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS