Deployment guide

Firefly III

Overview

Firefly III is a free, open source, self-hosted personal finance manager. It uses double-entry bookkeeping to give you a precise, honest picture of your money. Record expenses and income, organise them into budgets, categories and tags, set savings goals with piggy banks, and let automatic rules tidy everything up.

Firefly III connects to banks through Spectre and GoCardless, and it imports CSV, camt.xml and OFX files with the Firefly III Data Importer. It also exposes a documented REST API.

The SecureAnyCloud image delivers Firefly III fully installed and configured on Ubuntu 24.04 as a PHP 8.5 Laravel application. A complete personal finance service is running within minutes of launch, and all of your financial data stays private on infrastructure you control.

Firefly III is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). All product and company names are trademarks or registered trademarks of their respective holders. This image repackages the upstream open source release with SecureAnyCloud's provisioning and support.

What you get:

Firefly III 6.6.3 (AGPL-3.0), served from /var/www/firefly-iii.
PHP 8.5 (php8.5-fpm) from the ondrej/php PPA and nginx, with the web UI on port 80.
Self-contained SQLite storage, so there is no separate database server to run or secure.
The whole application, the configuration and the SQLite database on a dedicated, independently resizable data disk mounted at /var/www/firefly-iii.
A per-VM administrator password, a fresh application encryption key and a fresh cron token, all generated on first boot and written to a root-only file, so no default or shared login ships in the image.
nginx.service and php8.5-fpm.service as systemd units, enabled and active.
24/7 SecureAnyCloud support.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.
A VM size to start with. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. Scale up for larger households or heavy imports.
NSG inbound rules that allow 22/tcp from your management network and 80/tcp (HTTP) from your users. Add 443/tcp if you enable HTTPS.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, and search the Marketplace for Firefly III by SecureAnyCloud. Select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:firefly-iii-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name firefly-iii \
  --image sac1647283583153:firefly-iii-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open HTTP to reach the web UI:

az vm open-port --resource-group <your-rg> --name firefly-iii --port 80 --priority 900

Step 3 - Connect to your VM

Connect over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

The two services that back Firefly III should both report active. The sign-in page (GET /login) should answer HTTP 200 on port 80:

systemctl is-active nginx php8.5-fpm curl -s -o /dev/null -w 'GET /login -> %{http_code}\n' http://127.0.0.1/login

Expected output: two lines of active, then GET /login -> 200. Only nginx on port 80 is exposed. PHP runs behind it under php-fpm, and the SQLite database is a local file, so there is no database port to open.

Step 5 - Retrieve your administrator password

On the first boot of every VM, a one-shot service (firefly-iii-firstboot.service) generates credentials that are unique to that VM. These are a fresh administrator password, a fresh Laravel application encryption key and a fresh cron token. The service also pins the application to your VM's own address. No shared or default credentials ship in the image.

Read the credentials file:

sudo cat /root/firefly-iii-credentials.txt

The file (mode 0600, root only) contains the administrator email (firefly.admin.user, which is admin@example.com), the administrator password (firefly.admin.pass) and the sign-in URL.

You can prove the login round trip from the VM's own shell. Firefly III signs in through a form that carries a Laravel CSRF token. The script below reads the per-VM credentials, fetches the token and posts a real sign-in. A correct password answers HTTP 200 and reaches the dashboard:

EMAIL=$(sudo grep '^firefly.admin.user=' /root/firefly-iii-credentials.txt | cut -d= -f2-)
PASS=$(sudo grep '^firefly.admin.pass=' /root/firefly-iii-credentials.txt | cut -d= -f2-)
J=$(mktemp)
T=$(curl -s -c "$J" http://127.0.0.1/login | grep -oE 'name="_token"[^>]*value="[^"]+"' | head -1 | sed -E 's/.*value="([^"]+)".*/\1/')
echo -n 'sign-in HTTP status -> ' curl -s -o /dev/null -w '%{http_code}\n' -b "$J" -c "$J" -L \
  --data-urlencode "_token=$T" --data-urlencode "email=$EMAIL" --data-urlencode "password=$PASS" \
  http://127.0.0.1/login rm -f "$J"

Expected output: sign-in HTTP status -> 200. This confirms that the credentials in the file sign in.

Step 6 - Sign in and set up your first account

Browse to http://<vm-public-ip>/ and sign in with the administrator email and password from the credentials file.

On first sign-in, Firefly III asks for your bank's name and the balance of your main checking account, so it has something to start with. You can add more accounts later. You can also register your own first user instead, which becomes the owner of the installation.

The dashboard shows your net worth, an account balance chart and your accounts. Add your asset accounts (checking, savings, credit cards) with their opening balances from Accounts.

Step 7 - Create budgets and record transactions

Open Budgets to create budgets and give them a soft cap. You can then see how much you have left to spend in each category during the period.

Record income and expenses as transactions, and organise them into categories and tags. Set up bills and piggy bank savings goals, and let automatic rules categorise transactions for you.

To pull transactions in automatically, connect your banks through Spectre or GoCardless, or import CSV, camt.xml and OFX files, using the Firefly III Data Importer.

Step 8 - Confirm the version, the stack and the data disk

Check the PHP and nginx versions and the data disk mount:

php -v | head -1 nginx -v findmnt /var/www/firefly-iii

Expected output: PHP 8.5, nginx, and /var/www/firefly-iii mounted from the dedicated data disk (/dev/sdc). The entire Firefly III application, the configuration and the SQLite database live on that disk. The disk is independently resizable and survives instance replacement. Resize it from the Azure portal if you need more room.

First-boot service and security model

A one-shot firefly-iii-firstboot.service runs after the network is up. It does the following:

Regenerates a fresh Laravel APP_KEY and STATIC_CRON_TOKEN.
Pins the application URL to the VM's own address, resolved from the Azure instance metadata service.
Rotates the administrator password to a fresh per-VM value.
Runs the Firefly III database upgrade, so the app is immediately usable.
Writes the credentials file at mode 0600 (root only).
Drops a sentinel so that it runs exactly once.

The image ships with an empty database and no usable login. The per-VM administrator is created on first boot. Verify the service and the file permissions:

systemctl is-active firefly-iii-firstboot.service
sudo stat -c '%a %U:%G %n' /root/firefly-iii-credentials.txt

Expected output: active, then 600 root:root /root/firefly-iii-credentials.txt.

Enabling HTTPS with your own domain

The image serves the web UI over plain HTTP on port 80. For a browser-trusted certificate, point a DNS record at the VM and open port 443 in the NSG. Then install a certificate from your CA, for example Let's Encrypt:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot updates the nginx site to serve your domain certificate. Then set APP_URL=https://your-domain.example.com in /var/www/firefly-iii/.env. Run sudo -u www-data php /var/www/firefly-iii/artisan config:cache so that generated links use your domain.

Backup and maintenance

Firefly III stores everything, including the SQLite database, under /var/www/firefly-iii on the dedicated data disk, so a backup is a single directory. For a full point-in-time copy, snapshot the data disk and OS disk from the Azure portal. Alternatively, archive the tree:

sudo tar -C /var/www -czf /var/backups/firefly-iii-$(date +%F).tar.gz firefly-iii

Keep the OS current with sudo apt-get update && sudo apt-get upgrade. The image ships with unattended security updates enabled.

Review the Firefly III documentation before moving between major versions, and always back up before an upgrade.

Support

This image is backed by 24/7 SecureAnyCloud support. Support covers deployment and initial configuration, retrieving first-boot administrator credentials, and data import setup (Spectre, GoCardless, CSV, OFX). It also covers budgeting rules and automation, application upgrades and patch management, HTTPS and custom domain setup, performance tuning, and storage administration.

Email sales@secureanycloud.com or use the live chat in the support portal. Critical issues receive a one-hour average response.

Deploy on Azure

Launch Firefly III on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Firefly III is an open source, self-hosted personal finance manager. It uses double-entry bookkeeping to give you a precise, honest picture of your money: where it comes from, where it goes, and what is left. You record expenses and income, organise them into budgets, categories and tags, set savings goals with piggy banks, and let automatic rules tidy everything up. Your financial data stays private on infrastructure you control.

This image runs Firefly III, a Laravel application, behind nginx with PHP FPM 8.5 and OPcache enabled.

What you get:

Self-contained storage. Firefly III stores its data in SQLite, so there is no separate database server to install, secure or back up.
A dedicated data volume. The application code, configuration, SQLite database, uploads and storage live under /var/www/firefly-iii on a dedicated, independently resizable EBS volume. You can grow your finance store without touching the operating system disk.
Ready at first boot. The database schema is migrated and seeded in the image, so Firefly III is ready the moment the instance boots.
Unique credentials per instance. The application encryption key and the cron token are generated on the first boot of every deployed instance, and a fresh administrator password is set at the same time. Two instances launched from the same Amazon Machine Image never share credentials.

The initial administrator email and password are written to /root/firefly-iii-credentials.txt with mode 0600, so only the root user can read the file.

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances.
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products.
An EC2 key pair in the target Region for SSH access to the instance.
A VPC and subnet in the target Region. The security group must allow inbound port 22 from your management network, and inbound ports 80 and 443 from the networks your users will reach Firefly III from.
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line.

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Firefly III. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users will use. Leave the root and data volumes at their default sizes or larger.

Select Launch instance. First boot initialisation takes approximately one minute after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud Firefly III Marketplace AMI into an existing subnet and security group. Replace the values in angle brackets:

<ami-id>: the AMI ID shown on the Marketplace listing.
<key-name>: your EC2 key pair name.
<subnet-id>: your subnet ID.
<security-group-id>: a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":20,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=firefly-iii-01}]'

On success, the command prints a JSON document. Note the instance ID. When the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and Retrieve Initial Credentials

Connect over SSH with the key pair you selected and the public IP address from Step 2. For the Ubuntu 24.04 AMI, the SSH login user is ubuntu. Connect with ssh -i <path-to-key.pem> ubuntu@<instance-public-ip>.

Firefly III generates a unique administrator password on first boot. It writes the password, along with the administrator email, to a root-only file. Retrieve it with:

sudo cat /root/firefly-iii-credentials.txt

The file lists the administrator email (admin@example.com), the generated password, and the instance URL. This account is the owner of the Firefly III installation. Keep these credentials somewhere safe, and change the password after your first sign-in.

Confirm that the web server and PHP FPM are running, that the data volume is mounted, and that Firefly III answers on port 80:

systemctl is-active nginx php8.5-fpm

df -h /var/www/firefly-iii | tail -1

curl -s -o /dev/null -w 'Firefly III login HTTP %{http_code}\n' http://127.0.0.1/login

The first command should report each service as active. The second should show the dedicated data volume mounted at /var/www/firefly-iii. The third should return HTTP 200 for the login page.

Sign In to Firefly III

Open a web browser and browse to the instance address:

http://<instance-public-ip>/

The Firefly III sign-in page opens. Enter the administrator email and the password from /root/firefly-iii-credentials.txt, then select Sign in.

The first time you sign in, Firefly III shows a short welcome screen. It asks for the name of your bank and the balance of your main checking account. Enter those details, or accept the defaults, and select Submit to reach the dashboard.

Create Accounts, Budgets and Transactions

The dashboard summarises your net worth, your spending for the current period, and the balances of your asset accounts. From the left-hand menu, you can:

Open Accounts to manage your asset accounts (checking, savings, cash), expense accounts (the shops and services you pay), revenue accounts (your sources of income) and liabilities (loans, credit cards).
Open Budgets to set monthly spending limits per category and track how much you have left to spend.
Open Transactions to record withdrawals, deposits and transfers. Firefly III is double-entry, so every transaction moves money from one account to another. This keeps your net worth accurate.
Open Piggy banks to set savings goals and allocate money towards them.

To change the administrator password, select the email address at the top right of any page and choose Profile. Update the password under the Change your password section.

Enable Recurring Transactions (Cron)

Firefly III runs recurring transactions and other scheduled work through a command that a cron token triggers. A unique STATIC_CRON_TOKEN is generated on first boot and stored in the application environment file at /var/www/firefly-iii/.env. To run the scheduled tasks once per day, add a cron entry on the instance that calls the Firefly III cron endpoint with that token.

Retrieve the token value with:

sudo grep '^STATIC_CRON_TOKEN=' /var/www/firefly-iii/.env

Then add a daily cron entry, for example with sudo crontab -e. The entry requests http://localhost/cron/<token> once per day. Replace <token> with the value above.

Recurring transactions and bill reminders are not required for day-to-day use, so you can defer this step until you start using those features.

Enable HTTPS with Let's Encrypt

The image serves Firefly III over HTTP on port 80, so it works immediately on the instance's public address. For production use, put it behind HTTPS. The simplest approach is to point a DNS name at the instance and use Certbot.

Install Certbot and the nginx plugin. Replace your-domain.example.com below with the DNS name that resolves to the instance:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx

After the packages are installed, run sudo certbot --nginx -d your-domain.example.com and follow the prompts. Certbot obtains a certificate, updates the nginx configuration to serve Firefly III over HTTPS, and sets up automatic renewal.

When HTTPS is working, update APP_URL in /var/www/firefly-iii/.env to the https:// address. Then run sudo -u www-data php /var/www/firefly-iii/artisan config:cache so that Firefly III generates correct links.

Back Up and Maintain Your Instance

All of Firefly III's data is contained in the SQLite database and the application tree on the dedicated /var/www/firefly-iii volume. To back up your finances, snapshot the EBS data volume with the AWS Console or CLI. Alternatively, copy the SQLite database file at /var/www/firefly-iii/storage/database/database.sqlite to a safe location.

To take an EBS snapshot, find the volume ID attached to the instance and create a snapshot:

aws ec2 create-snapshot --volume-id <data-volume-id> --description "Firefly III data backup"

Apply operating system security updates regularly with sudo apt-get update && sudo apt-get upgrade. The data lives on its own volume, so you can resize it independently in the AWS Console if your finance store grows.

Architecture Summary

Application: Firefly III 6.6.3 (Laravel).
Web server: nginx serving the public/ document root on port 80.
Runtime: PHP FPM 8.5 with OPcache.
Database: SQLite at /var/www/firefly-iii/storage/database/database.sqlite.
Data volume: dedicated EBS volume mounted at /var/www/firefly-iii.
Credentials: generated on first boot and written to /root/firefly-iii-credentials.txt (mode 0600).
First user: the administrator is the owner of the installation.

Support

This image is published and supported by SecureAnyCloud. Support covers Firefly III deployment, upgrades, importing data, budgeting rules, performance tuning and storage administration, 24/7 by email and chat.

For help, contact SecureAnyCloud support through the channel listed on your AWS Marketplace subscription.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Firefly III on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS