Ibexa OSS

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size for evaluation and small sites. Step up to B2ms, B4ms or a D-series size for busier workloads.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the Ibexa web interface. Put TLS in front of the site before you expose it publicly. See Enabling HTTPS.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Ibexa OSS by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:ibexa-oss-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name ibexa-oss \
  --image sac1647283583153:ibexa-oss-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name ibexa-oss --port 80 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the stack is running

On first boot, Ibexa regenerates its database credentials and application secret, rotates the administrator password and starts the stack. Confirm that all three services are running:

systemctl is-active nginx php8.3-fpm mysql

Each service reports active.

Next, check the component versions and confirm that the site answers:

php -v | head -1 mysql --version curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/health curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/admin/login

The health endpoint and the back-office login page both return HTTP 200.

Step 5 - Retrieve the administrator password

The administrator password is unique to your VM and is generated on first boot. Read the credentials file as root:

sudo cat /root/ibexa-credentials.txt

The file lists the back-office URL, the site URL, the REST API URL, the login (admin), the email (admin@sac.local) and your unique password. After your first sign-in, change the email and password in the back-office.

Step 6 - Sign in to the back-office

Browse to http://<vm-public-ip>/admin. Sign in with the username admin and the password from the credentials file.

Step 7 - Explore the dashboard

After you sign in, you land on the back-office dashboard. The left-hand menu gives you Content structure, Media, Drafts and the Settings area (Sections, Content types and Object States). Together they cover everything you need to model and manage your content.

Step 8 - Manage your content

Ibexa content lives in a tree of typed content items. Open Content structure to browse the tree, create and edit items, add translations and manage sub-items.

Each item is an instance of a content type that you define under Settings > Content types, so your content model is entirely your own.

Step 9 - View the rendered site

The bundled standard design serves the public site at /. A freshly deployed VM already serves a rendered page, and content you publish appears there.

For decoupled front ends, consume the same content through the built-in REST API (/api/ibexa/v2) and the GraphQL endpoint.

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/

Data on the dedicated data disk

The MySQL data directory (/var/lib/ibexa/mysql) and Ibexa's uploaded media (/var/lib/ibexa/var, surfaced at /var/www/ibexa/public/var) live on a dedicated Azure data disk mounted at /var/lib/ibexa.

Your content, media and database therefore sit on a managed disk that you can snapshot, resize and back up independently of the OS disk. Confirm the mount:

df -h /var/lib/ibexa | tail -1

Enabling HTTPS

For production, put Ibexa behind TLS. The simplest approach is a free Let's Encrypt certificate from Certbot. First point a DNS name at the VM, then run:

sudo snap install --classic certbot
sudo ln -sf /snap/bin/certbot /usr/bin/certbot
sudo certbot --nginx -d your-domain.example.com

Certbot edits the nginx site to serve HTTPS and sets up automatic renewal. After you enable TLS, reload PHP-FPM and nginx with sudo systemctl reload php8.3-fpm nginx.

Maintenance

Ibexa periodically ships new releases in the 5.0 line. To upgrade, follow the official Ibexa upgrade guide. Adjust the constraints in /var/www/ibexa/composer.json, run sudo -u www-data composer update as appropriate, then run sudo -u www-data php /var/www/ibexa/bin/console ibexa:migrations:migrate and sudo -u www-data php /var/www/ibexa/bin/console cache:clear.

The OS continues to receive unattended security updates. The MySQL database and uploaded media persist on the data disk across reboots and upgrades.

Support

SecureAnyCloud maintains this image and provides 24/7 support. For help with it, contact sales@secureanycloud.com.

Ibexa OSS is open-source software licensed under GPL-2.0-only and developed by Ibexa AS. SecureAnyCloud is not affiliated with or endorsed by Ibexa AS. This image ships the open-source ibexa/oss edition, not the commercial Ibexa DXP.

Deploy on Azure

Launch Ibexa OSS 5 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com