i-doit

Prerequisites

You need an active Azure subscription, an SSH key pair, and a virtual network and subnet in the target region.

Standard_B2s (2 vCPU, 4 GiB RAM) runs the appliance comfortably. Step up to Standard_D2s_v3 (2 vCPU, 8 GiB) for larger CMDBs or heavier imports.

In the network security group (NSG), allow inbound 22/tcp from your management network, 80/tcp for the application, and 443/tcp if you terminate TLS on the VM.

The bundled MariaDB and memcached are never exposed. They listen on 127.0.0.1 only, so ports 3306 and 11211 stay off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, select Create a resource, and search the Marketplace for i-doit by SecureAnyCloud. Select Create.

On the Basics tab, choose your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80) and HTTPS (443).

On the Disks tab, review the dedicated data disk. Then select Review + create, and then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name i-doit \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name i-doit --port 80,443

Step 3 - Confirm that the services are running

Connect over SSH as azureuser. Confirm that Apache, PHP FPM, MariaDB and memcached are all active, and that the health endpoint answers. MariaDB and memcached listen only on 127.0.0.1, while Apache serves i-doit on port 80.

systemctl is-active apache2 php8.3-fpm mariadb memcached

curl -s -o /dev/null -w 'healthz: HTTP %{http_code}\n' http://127.0.0.1/healthz

You should see four active lines and healthz: HTTP 200.

Step 4 - Retrieve the administrator password

On the first boot of every VM, a one-shot service generates a fresh i-doit web administrator password, a fresh Admin Center password and a fresh database password. Each is unique to that instance. The service writes them to a root-only file. Read the file over SSH:

sudo cat /root/i-doit-credentials.txt

The file records the sign-in URL, the admin web login and its password, the separate Admin Center login, and the MariaDB credentials. It is mode 0600 and owned by root, so only an administrator on the box can read it.

Step 5 - Sign in to i-doit

Browse to http://<public-ip>/ and sign in as admin with the password from the credentials file. i-doit renders on whatever hostname or IP address you reach it on.

After you sign in, you land on the CMDB dashboard. The object type tree (Infrastructure, Software, Contact and more) is down the left, and your personal dashboard widgets are in the centre.

Step 6 - Document a configuration item

i-doit models everything as typed objects (configuration items) with categories and relationships. Open any object to see its structured detail. The General category holds the title, purpose, condition and CMDB status. Other categories hold location, contacts, IP addresses, contracts and more.

Pick an object type from the top navigation (for example Infrastructure > Server) to open its object browser. Then use the toolbar to create and edit configuration items of that type.

The relationships that you record between objects build up the connected model of your environment.

Step 7 - Review the security model

This image ships no shared or default credential:

• i-doit's documented default logins (such as admin / admin, reader, editor, author, archivar) are never created.
• The systemapi account is disabled.
• The per-VM admin password is set on first boot.
• MariaDB and memcached are bound to loopback only.
• config.inc.php, which holds the database password and encryption keys, is not served over the web.

You can verify the posture on the box:

ss -tlnp | grep -E ':3306|:11211' || echo '(loopback-only)'

sudo /usr/local/sbin/i-doit-cred-roundtrip.sh

The round trip proves that the per-VM admin account authenticates through the real web login form, and that blank and common weak credentials are all rejected.

Step 8 - Check where your data lives

Both i-doit databases, the system database idoit_system and the tenant data database idoit_data, and i-doit's file attachments live on a dedicated Azure data disk mounted at /data. The disk is separate from the operating system disk, so your CMDB data sits on its own volume that you can snapshot and grow independently.

sudo mariadb -N -e 'SHOW DATABASES;' | grep idoit

df -h /data | tail -1

Step 9 - Enable HTTPS (optional)

For production, terminate TLS in front of i-doit. Point a DNS name at the VM's public IP and make sure that port 443 is open. Then install a certificate with Certbot's Apache plugin:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d your-domain.example.com

Certbot obtains and installs the certificate and sets up automatic renewal. After you enable HTTPS, browse to https://your-domain.example.com/.

Step 10 - Scheduled maintenance

i-doit's housekeeping jobs (search index refresh, logbook archiving, auth cleanup and notifications) run daily through the i-doit-cron.timer systemd timer. They run as the www-data user and authenticate from a root-only console configuration file. Check the timer:

systemctl list-timers i-doit-cron.timer --all

Troubleshooting

• The sign-in page shows an error or does not load. Confirm that the services are active with the Step 3 commands. Check the Apache log with sudo tail -n 50 /var/log/apache2/i-doit-error.log.
• You do not know the admin password. Read it again with sudo cat /root/i-doit-credentials.txt.
• First boot did not run. It is gated by a sentinel file at /var/lib/sac/data/i-doit-firstboot.done. Inspect sudo journalctl -u i-doit-firstboot.service.
• Database connection errors. MariaDB listens on 127.0.0.1:3306. For maintenance on the box, run sudo mariadb as root over the local socket.

Support

This image is published by SecureAnyCloud, an independent image builder that is not affiliated with or endorsed by i-doit GmbH.

SecureAnyCloud provides 24/7 support by email (sales@secureanycloud.com) and live chat. Support covers deployment, configuration, upgrades, performance tuning and MariaDB administration.

Deploy on Azure

Launch i-doit Open 38 CMDB on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com