SecureAnyCloud
Deployment guide

Grocy

Overview

Grocy is a popular open-source, self-hosted groceries and household management solution, an ERP for your home. From an ordinary browser, you track your food stock and best-before dates, manage your shopping list, store recipes and meal plans, and schedule recurring chores, batteries and equipment. Everything runs through one clean web interface backed by a full REST API.

This SecureAnyCloud image serves Grocy 4.5.0 on a PHP 8.3 and nginx stack over a hardened Ubuntu 24.04 LTS base, patched at build time. Grocy keeps all data in a self-contained SQLite database, so there is no separate database server to run.

What you get:

  • Grocy 4.5.0 served by nginx through the PHP 8.3 front controller, managed by systemd
  • The Grocy web interface on :80, with authentication required and demo mode disabled
  • A per-VM administrator password generated on first boot and recorded in a root-only file, so no shared or default login ever ships in the image
  • A self-contained SQLite datastore, so there is no separate database server to provision
  • A dedicated Azure data disk at /var/lib/grocy for the database, configuration and file storage
  • nginx.service and php8.3-fpm.service as enabled systemd units
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Size up for larger households and heavier concurrent use.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. Grocy serves plain HTTP on port 80, so for production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Grocy by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:grocy-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name grocy \
  --image sac1647283583153:grocy-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the web interface:

az vm open-port --resource-group <your-rg> --name grocy --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that nginx and PHP-FPM are active. Also confirm the one-shot first-boot service that rotates the administrator password. nginx serves Grocy on port 80.

systemctl is-active nginx php8.3-fpm grocy-firstboot
ss -tlnp | grep ':80 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

Every VM generates its own administrator password on first boot. It writes the password, together with the login user and URL, to a root-only credentials file. Read the file with sudo:

sudo cat /root/grocy-credentials.txt

Sign in to Grocy with the username admin and the grocy.admin.pass value from this file.

To prove the login works from the command line, establish an authenticated session with those credentials:

PASS=$(sudo grep '^grocy.admin.pass=' /root/grocy-credentials.txt | cut -d= -f2-);
CJ=$(mktemp); curl -s -c "$CJ" -o /dev/null http://127.0.0.1/login; curl -s -c "$CJ" -b "$CJ" -o /dev/null --data-urlencode "username=admin" --data-urlencode "password=$PASS" http://127.0.0.1/login;
BODY=$(curl -s -L -b "$CJ" http://127.0.0.1/); rm -f "$CJ"; case "$BODY" in *[Ll]ogout*|*"tock overview"*) echo "login OK";; *) echo "login FAILED";; esac

Step 5 - Sign in to Grocy

Browse to http://<vm-public-ip>/. Grocy opens on its sign-in screen. Enter the username admin and the password from Step 4.

Step 6 - Track your food stock

After you sign in, you land on the stock overview. It lists every product you hold, the amount in stock and the next best-before date. Colour coding highlights items that expire soon, so you can use them before they go to waste.

Use the action buttons on each row to consume, open or add stock.

Step 7 - Manage your shopping list

Open Shopping list from the sidebar to see what needs buying, with quantities and a running total.

Grocy can add items automatically when stock drops below the minimum you set for a product. You can also add items by hand with the Add item button.

Step 8 - Schedule chores

Open Chores overview to manage recurring household tasks. Each chore has its own schedule. Grocy tracks when each chore was last done and when it is next due, and it highlights anything overdue.

Use the track button on a row to record that a chore has been completed.

Step 9 - Verify the stack

Confirm the Grocy version, check that the services are enabled, and confirm that the web interface answers on port 80:

python3 -c "import json;d=json.load(open('/var/www/grocy/version.json'));print('Grocy', d['Version'])"
systemctl is-enabled nginx php8.3-fpm
curl -s -o /dev/null -w 'grocy HTTP %{http_code}\n' http://127.0.0.1/

Step 10 - Where your data lives

The SQLite database (grocy.db), the configuration and your file storage all live on a dedicated Azure data disk mounted at /var/lib/grocy, separate from the OS disk.

This disk is captured into the image and re-provisioned on every VM. Confirm the mount and the filesystem:

df -h /var/lib/grocy | tail -1
findmnt -no SOURCE,TARGET,FSTYPE /var/lib/grocy

Security notes

  • Encrypt web traffic. Grocy serves plain HTTP on port 80. For production, put it behind your own TLS-terminating reverse proxy or an Azure Application Gateway with a certificate for your domain, and restrict port 80 in the NSG to trusted networks.
  • Protect the administrator password. Authentication is required and demo mode is disabled, so no data is ever seeded and no shared login exists. The per-VM administrator password lives in /root/grocy-credentials.txt, readable only by root. You can sign in and change it from the user menu. Keep a copy somewhere safe.
  • Scope your API access. Grocy exposes a full REST API. For integrations such as Barcode Buddy or Home Assistant, create scoped API keys from Manage API keys instead of sharing your login.
  • Keep the VM patched. The image is patched at build time and ships with unattended security upgrades enabled.

Support

SecureAnyCloud images come with 24/7 support. For questions about this Grocy image or help with your deployment, contact us through the SecureAnyCloud website.

Deploy on Azure

Launch Grocy on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure