G3W-SUITE

Prerequisites

• An Azure subscription
• An SSH key pair (ssh-keygen -t ed25519)
• A VM size of at least Standard_B2s (2 vCPU / 4 GiB). The whole stack, including a live QGIS map render, fits in this footprint

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for G3W-SUITE by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size (Standard_B2s or larger). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22). Add port 80 after deployment.

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:g3w-suite:default:latest
az vm create \
  --resource-group <your-rg> \
  --name g3w-suite \
  --image sac1647283583153:g3w-suite:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name g3w-suite --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the stack is running

G3W-SUITE runs as a Docker Compose stack managed by a single systemd unit. On first boot, the stack rotates every secret, sets its public hostname to your VM's address, recreates itself on a fresh database and seeds the admin account.

The multi-container stack brings up PostgreSQL, runs the database migrations and loads QGIS Server. It can take a minute or two to become fully healthy after the VM is created.

systemctl is-active g3w-suite.service

It reports active. You can list the running containers with:

sudo docker compose -f /var/lib/g3w-suite/docker-compose.yml ps

One systemd unit manages the whole stack. Use sudo systemctl status g3w-suite and sudo systemctl restart g3w-suite to control every container together.

Step 5 - Retrieve your per-VM admin credentials

Your VM generates a unique admin password on first boot and writes it to a root-only file. Confirm that the file exists. It is 0600 and root-only:

sudo ls -l /root/g3w-suite-credentials.txt

Then read it to get your credentials:

sudo cat /root/g3w-suite-credentials.txt

The file contains g3w.url (the address to browse to), g3w.admin.username (admin), g3w.admin.console (the Django admin URL) and G3W_ADMIN_PASSWORD (for the web console). Store them in a safe place.

Step 6 - Confirm the console is healthy

The g3w-admin console answers on port 80 (the login page returns HTTP 200):

curl -s -o /dev/null -w 'g3w-admin login -> HTTP %{http_code}\n' http://localhost/en/login/

Confirm which ports are published. Only SSH and the web console are published. PostgreSQL, Redis and QGIS Server stay on the private Docker network:

sudo ss -tlnH | awk '{print $4}' | grep -E ':(22|80)$' | sort -u

Sign-in is CSRF-protected. This check confirms that the per-VM administrator authenticates (HTTP 302) while the upstream default admin/admin is rejected:

B=http://127.0.0.1; L=$B/en/login/
P=$(sudo grep '^G3W_ADMIN_PASSWORD=' /root/g3w-suite-credentials.txt | cut -d= -f2-) login() {
J=$(mktemp); curl -s -c $J -b $J -o /dev/null "$L"; \
  T=$(curl -s -c $J -b $J "$L" | grep -oE 'name="csrfmiddlewaretoken" value="[^"]+"' | head -1 | sed -E 's/.*value="([^"]+)".*/\1/'); \
  C=$(curl -s -c $J -b $J -o /dev/null -w '%{http_code}' -H "Referer: $L" -H "Origin: $B" \
  --data-urlencode "username=admin" --data-urlencode "password=$1" --data-urlencode "csrfmiddlewaretoken=$T" "$L"); \
  rm -f $J; echo "$C"; } echo "default admin/admin -> HTTP $(login admin) (200 = rejected)" echo "per-VM admin -> HTTP $(login "$P") (302 = signed in)"

Step 7 - Confirm the pinned release

Every image is pinned by digest to the G3W-SUITE v3.11.0 stack so the appliance never silently upgrades:

sudo docker compose -f /var/lib/g3w-suite/docker-compose.yml config --images

Step 8 - Sign in to the web console

Browse to http://<vm-public-ip>/ and sign in with the username admin and the password from Step 5.

After you sign in, the dashboard shows the administration console. It lists your Cartographic Groups, Macro Cartographic Groups and Users, with a count of the map groups you have published.

Step 9 - Publish a QGIS project and view the web map

In QGIS Desktop, prepare a project (.qgs/.qgz). In the g3w-admin console, create a Cartographic Group by choosing a name and a map projection. Then add a QGIS Project to that group by uploading your .qgs file. G3W-SUITE reads the layers, styling and print layouts straight from the QGIS project.

Open the published project to explore it in the WebGIS viewer. In the browser, you can pan and zoom the map (rendered by the embedded QGIS Server), toggle layers in the tree, run searches, query features and print.

The full Django administration console (G3W-SUITE Raw Administration, linked from the dashboard) lets you manage every published project, group, user and permission. It shows each project with its active state and cartographic group.

Using a custom domain

The web map viewer builds its data URLs from the address that you use to reach the VM. If you put a DNS name or a reverse proxy in front of G3W-SUITE, set WEBGIS_PUBLIC_HOSTNAME in /var/lib/g3w-suite/.env to that address, then restart the stack:

sudo sed -i 's/^WEBGIS_PUBLIC_HOSTNAME=.*/WEBGIS_PUBLIC_HOSTNAME=maps.example.com/' /var/lib/g3w-suite/.env
sudo systemctl restart g3w-suite.service

Support

This image is maintained by SecureAnyCloud with 24/7 support. G3W-SUITE is published by Gis3W under the Mozilla Public License 2.0; SecureAnyCloud packages the official deployment stack and does not modify the upstream application.

Deploy on Azure

Launch G3W-SUITE on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com