HotCRP

• Open the SecureAnyCloud HotCRP Conference Management on Ubuntu 24.04 LTS offer in the Azure Marketplace and choose Create.
• Pick a resource group and region. Keep the recommended Standard_B2s size (2 vCPU / 4 GB is comfortable for a conference), and provide your SSH public key for the azureuser account.
• On the Networking tab, allow inbound 80 (the web application) and 22 (SSH). HotCRP serves everything over port 80. To add TLS, put it behind an Azure Application Gateway or a reverse proxy.
• Create the VM and note its public IP address.

RG="hotcrp-prod"; LOCATION="eastus"; VM_NAME="hotcrp" IMAGE_URN="sac1647283583153:hotcrp-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:hotcrp-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 80 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

On first boot, the image mints the per-instance database and administrator passwords, creates the conference database, loads the schema, writes the configuration and seeds the administrator account. It then opens the bootstrap gate and starts nginx and php-fpm. It verifies that the new credentials work and the common defaults are rejected, and writes /root/hotcrp-credentials.txt. This completes within a minute or two.

SSH in as azureuser and read the details:

sudo cat /root/hotcrp-credentials.txt

The file is mode 0600 and owned by root, so only a privileged user can read it. It contains the site URL, the administrator email (admin@hotcrp.local), the administrator password and the database credentials.

All four services should report active. The ss output confirms that the web application is on port 80 while MariaDB and Postfix are bound to loopback only.

systemctl is-active mariadb.service php8.3-fpm.service nginx.service postfix.service sed -n 's/.*HOTCRP_VERSION *= *"\([^"]*\)".*/HotCRP \1/p' /var/www/hotcrp/src/init.php | head -1 php -r 'echo "PHP ".PHP_VERSION."\n";' ss -tulnp | grep -E ':(80|25|3306) ' | sed 's/users:.*//' | sort

Browse to http://<your-vm-ip>/. The HotCRP sign-in page appears. Sign in with the administrator email admin@hotcrp.local and the password from the credentials file.

After you sign in, you land on the conference home with the administration console. Search, the paper list, settings, users and the assignment tools are all one click away.

Open the account menu (top right), choose Profile, and set a new password under the Password section. From then on, use your own password. The generated password in the credentials file is only for your first sign-in.

Open Settings and set your conference's short and long name, the submission and review deadlines, the review form fields and rounds, and whether reviewing is anonymous, double-blind or open. HotCRP walks you through each stage with its own inline help: submissions, reviewing, discussion and decisions.

This is what HotCRP exists to do. Authors submit papers from the same site. Each submission gets an entry that you can search, tag, assign reviewers to, and decide on. The Search page lists every submission with its status and review count.

Open a paper to see its metadata, the submitted document, the reviewing controls (Write review, Assign reviews), conflict and discussion tools, and the decision field. The whole review surface is on one page.

Everything the panel shows is read straight from the conference database. A submission an author makes or a review your committee writes is therefore reflected immediately:

The image ships no shared credential. The credentials file is root-only, the configuration is not world-readable, and the real sign-in form accepts only the per-VM administrator password. Run the following checks:

ls -l /root/hotcrp-credentials.txt stat -c 'credentials mode %a owner %U:%G' /root/hotcrp-credentials.txt stat -c 'options.php mode %a owner %U:%G' /var/www/hotcrp/conf/options.php
# the per-VM administrator password signs in through the real form:
sudo /usr/local/sbin/hotcrp-login-check.sh admin@hotcrp.local '<HOTCRP_ADMIN_PASSWORD>' \
  && echo "per-VM administrator: SIGNED IN" \
  || echo "per-VM administrator: run this on your VM (the password is substituted from the credentials file)"
# every guessable default is rejected: for p in admin password hotcrp 123456 ""; do if
sudo /usr/local/sbin/hotcrp-login-check.sh admin@hotcrp.local "$p"; then echo " '$p' ACCEPTED (unexpected)" else echo " '$p' rejected (correct)" fi done
# the database DSN is never web-served:
curl -s -o /dev/null -w ' GET /conf/options.php -> HTTP %{http_code} (404 = not served)\n' http://127.0.0.1/conf/options.php

From Users, add program committee members and chairs, set their roles, and send them account links. Authors create their own accounts when they submit, so you invite only the program committee members here.

HotCRP's automatic and manual assignment tools then let you match reviewers to submissions, honoring conflicts and reviewer preferences.

The key security property of this image is that the web tier cannot serve until provisioning is complete. Each web unit carries a ConditionPathExists drop-in on the bootstrap-ready marker. First boot writes that marker only after the administrator has been seeded. There is therefore never a moment when an empty site is reachable and the first visitor could become administrator.

grep -E 'ConditionPathExists|After=' /etc/systemd/system/nginx.service.d/sac-bootstrap-gate.conf for u in php8.3-fpm nginx; do printf '%-12s %s\n' "$u" "$(grep -h ConditionPathExists /etc/systemd/system/$u.service.d/sac-bootstrap-gate.conf)" done ls -l /var/lib/sac/data/ systemctl is-enabled php8.3-fpm.service nginx.service

HotCRP sends account, submission and review notifications by email. The image ships a local Postfix that accepts mail on loopback, so nothing is lost. To deliver mail to the outside world, point Postfix at your own SMTP smarthost. Set a relayhost and reload Postfix:

sudo postconf -e 'relayhost = [<smtp-host>]:587'
sudo systemctl reload postfix

If your relay requires authentication, configure smtp_sasl_auth_enable and a sasl_passwd map in the usual Postfix way. Then run sudo postmap /etc/postfix/sasl_passwd.

HotCRP's own From: address is set from the conference contact email in Settings.

The whole conference lives in the MariaDB hotcrp database: accounts, submissions, reviews, settings and the uploaded documents. Documents are also cached under /var/lib/hotcrp/docs. Back up the database with a routine dump:

sudo mysqldump --single-transaction hotcrp | gzip > "hotcrp-$(date +%F).sql.gz"

To restore into a fresh instance, pipe the decompressed dump back into mysql hotcrp.

• Put HotCRP behind TLS. The image serves plain HTTP on port 80. Terminate HTTPS at an Azure Application Gateway, a load balancer, or a reverse proxy in front of the VM, and restrict port 80 to that front end.
• Restrict SSH to your administration network with an NSG rule.
• Rotate the administrator password (Step 6) and keep the credentials file (/root/hotcrp-credentials.txt) readable only by root.
• Keep the OS patched. Unattended security upgrades are enabled. Reboot periodically to pick up new kernels.
• Back up regularly (Step 13), especially before opening submissions and before the decision deadline.

HotCRP is distributed under the MIT license. This SecureAnyCloud image bundles HotCRP 3.4 with nginx, PHP, MariaDB and Postfix from Ubuntu 24.04, configured and hardened as described above.

SecureAnyCloud provides 24/7 support for this image by email at sales@secureanycloud.com. We help with conference setup, submission and review deadlines, program committee and reviewer management, review form design, outgoing mail and SMTP relay configuration, database administration, backup and restore, performance tuning and HotCRP version upgrades.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch HotCRP 3.4 Conference Management on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com