Galette

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size for a small to medium association. Choose a larger size for a large membership.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the application. Also allow 443/tcp if you terminate TLS on the VM. The bundled MariaDB listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Galette by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80) and HTTPS (443).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:galette-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name galette \
  --image sac1647283583153:galette-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name galette --port 80,443

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that nginx, PHP FPM, MariaDB and the first-boot service are all active. MariaDB listens only on 127.0.0.1:3306, while nginx serves Galette on port 80.

systemctl is-active nginx php8.3-fpm mariadb galette-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM superadmin password

Each VM generates its own Galette superadmin password on first boot. The password, the login user and the application URL are written to a root-only credentials file. Read it with sudo:

sudo cat /root/galette-credentials.txt

Sign in to Galette as user admin with the GALETTE_ADMIN_PASSWORD from this file. On the VM itself, run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in to Galette

Browse to http://<vm-public-ip>/. Galette opens on its sign-in page.

Enter username admin and the password from Step 4. After you sign in, the dashboard gives you quick access to members, contributions, mailings and management from a single view.

Step 6 - Configure your association and preferences

Open Configuration, then Settings. Set your association identity, currency, membership defaults and email preferences, and create your first staff member.

The image already completes the base install, so you can start entering members straight away.

Step 7 - Manage members

Open Members in the left menu to add and manage your members. Each member record holds contact details, membership status, groups, and contributions and dues history. Galette can also generate a PDF membership card from a member record.

Step 8 - Record contributions and dues

Galette tracks membership fees and donations. Open Contributions to record a fee or a donation against a member and set the contribution period.

Galette keeps each member's status as up to date or overdue. You can also send membership reminders and generate receipts.

Step 9 - No known or default credentials

The image ships with the Galette superadmin password rotated to a discarded random value. The real per-VM superadmin password is generated as a unique random secret on the first boot of every VM. No known or blank credential authenticates.

You can prove this with the built-in round-trip check. It confirms that the per-VM superadmin signs in through Galette's own login form, while a blank password and common weak guesses are all rejected. The admin superadmin is stored in Galette's preferences, not as a member:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(val_pref,' (Galette superadmin)') FROM galette.galette_preferences WHERE nom_pref='pref_admin_login'"

sudo bash /usr/local/sbin/galette-cred-roundtrip.sh

Step 10 - Verify the stack and where your data lives

Confirm the installed Galette schema version, the health endpoint and where your data lives. The MariaDB database lives at /var/lib/mysql. Galette's uploaded and generated files (member photos, attachments, exports and imports) live under /var/www/galette/galette/data. Both sit on the instance disk that goes with the VM:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT('Galette schema ',version) FROM galette.galette_database"

curl -sI http://127.0.0.1/healthz | head -1

du -sh /var/lib/mysql /var/www/galette/galette/data 2>/dev/null

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. For production, point a DNS record at your VM and obtain a certificate from Let's Encrypt:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

Galette derives its base URL from the request. Once you reach the VM on your domain over HTTPS, links render correctly with no further change.

Backing up

Your data is the Galette database plus the uploaded and generated files. Dump the database, then archive the data directory:

sudo mysqldump --protocol=socket -uroot galette > /tmp/galette-backup.sql
sudo tar czf /tmp/galette-data-backup.tar.gz -C /var/www/galette/galette data

Copy both files off the VM on your usual schedule. To restore, load the SQL dump into the galette database, then unpack the archive back to /var/www/galette/galette/data.

Security notes

• Encrypt web traffic. Galette serves plain HTTP on port 80 out of the box. Beyond a trusted network, add your own domain and TLS as described above, or front the VM with Azure Application Gateway.
• Keep MariaDB private. It listens on 127.0.0.1 only and is never reachable from the network. Administer it through Galette, or over SSH with sudo mariadb.
• Protect the superadmin password. It is unique per VM, and no known or blank credential authenticates. Keep /root/galette-credentials.txt protected. To rotate the password, sign in and change it, or set a new bcrypt hash directly from the VM:

sudo mariadb galette -e "UPDATE galette_preferences SET val_pref='$(php -r "echo password_hash('"'"'<new-password>'"'"', PASSWORD_BCRYPT);")' WHERE nom_pref='pref_admin_pass'"

• Nothing sensitive is web-reachable. The web installer and the compatibility test scripts are removed from the document root. Galette's config and data trees live outside the web root.
• Keep the VM patched. Apply operating system updates regularly with sudo apt update && sudo apt upgrade. Unattended security updates are enabled by default.
• Restrict inbound access. Limit 80/tcp and 443/tcp in your NSG to the networks that need access.

Trademark

Galette is an open source project distributed under the GNU General Public License version 3 or later. This image is an independent packaging of the open source Galette software by SecureAnyCloud. It is not affiliated with, sponsored by, or endorsed by the Galette project.

Support

SecureAnyCloud maintains this image and provides 24/7 support. For help deploying or operating Galette on Azure, contact us through the SecureAnyCloud website.

Deploy on Azure

Launch Galette Membership Management on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com