Group-Office

Videos

Overview: Group-Office on Ubuntu 24.04 on Azure: overview (watch on YouTube)

Launch and log in: Group-Office on Ubuntu 24.04 on Azure: launch and log in (watch on YouTube)

Deep Dive: Group-Office on Ubuntu 24.04 on Azure: deep dive (watch on YouTube)

Prerequisites

Before you start, have the following ready:

• An Azure subscription, and either the Azure portal or the Azure CLI (az)
• An SSH key pair to administer the VM
• A network security group that allows inbound TCP 80 (and 443 if you add TLS) from the clients that need the web interface, plus TCP 22 from your admin location

Step 1 - Deploy from the Azure Marketplace

Find the SecureAnyCloud Group-Office Groupware and CRM on Ubuntu 24.04 LTS offering in the Azure Marketplace. Choose the recommended Standard_B2s size, or a larger one for more users. Attach the VM to your virtual network and allow inbound TCP 80 and 22.

Group-Office runs comfortably on Standard_B2s for a small team. Scale up as the number of users grows.

Step 2 - Deploy from the Azure CLI

Run the commands below to create a resource group, the VM from the SecureAnyCloud image, and an inbound rule for HTTP. Replace the image URN or plan details with the ones shown on the Marketplace listing page.

az group create --name group-office-rg --location uksouth
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:group-office-ubuntu-24-04:default:latest
az vm create \
  --resource-group group-office-rg \
  --name group-office \
  --image sac1647283583153:group-office-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group group-office-rg --name group-office --port 80 --priority 900
# When the VM is running, note its public IP address:
az vm show -d --resource-group group-office-rg --name group-office --query publicIps -o tsv

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that the web server, database and first-boot job are healthy. Group-Office is served by Apache with PHP and backed by a local MariaDB. A one-shot first-boot service generates the per-VM secrets.

systemctl is-active apache2 mariadb group-office-firstboot.service

Expect output like the following. The first-boot service reports active once it has completed on the first boot of the VM:

active active active

Next, confirm the health endpoint, check that the site redirects into the app, and verify that the installer is denied:

curl -s -o /dev/null -w 'healthz: %{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'app: %{http_code}\n' -L http://127.0.0.1/groupoffice/
curl -s -o /dev/null -w 'installer: %{http_code}\n' http://127.0.0.1/groupoffice/install/install.php

healthz: 200 app: 200 installer: 403

Step 4 - Retrieve the per-VM administrator password

Every VM generates its own administrator and database passwords on first boot and writes them to a root-only file. Read the file over SSH:

sudo cat /root/group-office-credentials.txt

The file shows the administrator user (admin), the generated administrator password, and the loopback MariaDB connection details. These values are unique to your VM.

Step 5 - Sign in

Browse to your VM. Group-Office is served at the /groupoffice path, and the site root redirects there automatically:

http://<your-vm-public-ip>/groupoffice/

Sign in with admin and the password from the credentials file. The image is address-agnostic, so it works whether you reach it by public IP, private IP, a DNS name, or behind a TLS-terminating proxy.

After you sign in, you land on the Group-Office desktop. The module launcher gives access to email, the calendar, contacts, notes, tasks, files and the CRM.

Step 6 - Contacts and the CRM

Open Contacts (the address book) from the module launcher. Group-Office ships with a Shared and a Users address book. Create a contact, and it is stored in the local database on the data disk. The same contacts power the CRM, CardDAV synchronization and the email client's autocomplete.

Group-Office also provides a built-in CRM under the CRM module. Companies, contacts and support tickets are linked together there, so a small team can run sales and support alongside the rest of the suite.

Step 7 - The calendar

Open Calendar from the module launcher. The group calendar supports personal and shared calendars, resource booking, recurring events and free or busy scheduling. It synchronizes to phones, tablets and desktop clients over CalDAV.

Step 8 - Connect your own mail server

The email module is a webmail client, not a mail server. Under Email, add an account that points at the IMAP and SMTP servers you already run.

Group-Office then reads and sends mail through your existing infrastructure, while keeping addresses, calendars and files in one place. The rest of the suite (calendar, contacts, files, notes, tasks and CRM) works fully with no mail server configured.

Step 9 - No known or default credentials

This image ships with no usable default login. During the build, every password is rotated to a discarded random value. The real per-VM administrator and database passwords are generated on the first boot of each VM and written to the root-only credentials file.

You can confirm the security posture on the VM. The per-VM administrator authenticates through Group-Office's own JMAP authentication endpoint, and blank or weak guesses are rejected.

sudo bash /usr/local/sbin/group-office-cred-roundtrip.sh

OK per-VM admin authenticates via JMAP; weak guesses rejected; contact create+read round-tripped

The check also creates and reads back a contact through Group-Office's own API. This proves that the groupware works end to end.

Step 10 - Verify the stack and where your data lives

Group-Office's application code lives under /usr/share/groupoffice. It is shipped stock and unmodified from the vendor's own package. All configuration is kept externally in /etc/groupoffice/config.php.

The database and the file store live on a dedicated ext4 data disk mounted at /data. The MariaDB datadir at /var/lib/mysql is bind-mounted onto /data/mysql, and Group-Office's file_storage_path is on /data/groupoffice/data.

findmnt /data
findmnt /var/lib/mysql grep file_storage_path /etc/groupoffice/config.php

Because the database and files live on the data disk, you can snapshot, resize or detach that disk independently of the operating system disk.

Adding your own domain and TLS

Put Group-Office behind HTTPS. Point a DNS name at the VM, allow inbound TCP 443, and install a certificate. The quickest route is Certbot with the Apache plugin:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d your-domain.example.com

Group-Office uses relative URLs, so it works behind a TLS-terminating reverse proxy or the Certbot Apache configuration with no application changes.

Upgrading

Group-Office is installed from the vendor's own APT repository. After a package update, upgrade the database schema with Group-Office's own command-line tool. The web installer stays denied:

sudo apt-get update && sudo apt-get install --only-upgrade groupoffice
sudo -u www-data php /usr/share/groupoffice/cli.php core/System/upgrade

Backing up

Back up the MariaDB database and the file store. Both live on the data disk:

sudo mariadb-dump --protocol=socket -uroot groupoffice | gzip > groupoffice-$(date +%F).sql.gz
sudo tar czf groupoffice-files-$(date +%F).tar.gz -C /data/groupoffice data

An Azure managed disk snapshot of the data disk captures both together.

Security notes

• The bundled MariaDB listens only on 127.0.0.1:3306 and is never exposed to the network.
• The Group-Office web installer is denied over HTTP. Run upgrades on the command line.
• Every credential is unique per VM and generated on first boot. Nothing ships with a shared or default password.
• Keep the OS patched with sudo apt-get update && sudo apt-get upgrade. Unattended security updates are enabled by default.
• Restrict inbound access with your network security group and put the site behind HTTPS before exposing it to the internet.

Corresponding source (AGPL)

Group-Office Community edition is licensed under the GNU Affero General Public License version 3. In line with section 13 of that license, the complete corresponding source for the version shipped in this image (Group-Office 26.0.40) is published by the upstream project at:

• https://github.com/Intermesh/groupoffice/releases/tag/v26.0.40

The application under /usr/share/groupoffice is the stock vendor package and is not modified by SecureAnyCloud; only external configuration is added.

Trademark

Group-Office is a product of Intermesh BV. This image packages the open source Community edition and is not affiliated with or endorsed by Intermesh BV. All trademarks are the property of their respective owners. SecureAnyCloud provides the packaging, hardening and support for this image.

Support

SecureAnyCloud provides 24/7 support for this image by email at sales@secureanycloud.com and via live chat. We help with deployment, initial configuration, connecting your own mail server, LDAP or Active Directory, CalDAV and CardDAV client synchronization, upgrades, TLS setup, data disk management and backups.

Deploy on Azure

Launch Group-Office Groupware and CRM on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com