InstantCMS

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. Scale up for more members, more content or heavier traffic.

For NSG inbound rules, allow 22/tcp from your management network. Allow 443/tcp (HTTPS) and 80/tcp (which redirects to HTTPS) from your members.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for InstantCMS by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443). Then choose Review + create, and then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:instantcms:default:latest
az vm create \
  --resource-group <your-rg> \
  --name instantcms \
  --image sac1647283583153:instantcms:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name instantcms --port 443 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

The three services that back InstantCMS should all report active. The portal answers over HTTPS, and the plain HTTP port redirects to it.

InstantCMS serves the site on the address configured at first boot. For that reason, the local check below pins that address to the loopback interface:

systemctl is-active apache2 mysql instantcms-cron.timer
BASE=$(sudo grep '^instantcms.url=' /root/instantcms-credentials.txt | cut -d= -f2-)
HOST=$(printf '%s' "$BASE" | sed -E 's#https?://##; s#/.*##')
curl -ks -o /dev/null -w 'portal https -> %{http_code}\n' --resolve "$HOST:443:127.0.0.1" "https://$HOST/"
curl -s -o /dev/null -w 'http redirect -> %{http_code}\n' http://127.0.0.1/

Expected: three lines of active, then portal https -> 200 and http redirect -> 301.

Step 5 - Retrieve your administrator credentials

On the first boot of every VM, a one-shot service (instantcms-firstboot.service) generates values that are unique to that VM: a fresh administrator password and a fresh MySQL password. It also generates a per-VM self-signed TLS certificate, sets the VM's own address as the portal base URL, and purges the installer's seeded session token so no pre-authenticated session ships.

No shared or default credentials ship in the image.

sudo cat /root/instantcms-credentials.txt

The file (mode 0600, root only) contains the administrator login email (instantcms.admin.email, which is admin@example.com), the administrator password (instantcms.admin.pass), the login URL (instantcms.admin.login), the portal URL, and the database credentials.

The image is secure by default. A blank, guessed or default password is rejected, while the per-VM administrator from the credentials file authenticates successfully.

You can verify both from the VM's own shell, using the exact password check that InstantCMS runs at login (password_verify against the stored bcrypt hash on the admin account):

P=$(sudo grep '^instantcms.admin.pass=' /root/instantcms-credentials.txt | cut -d= -f2-)
HASH=$(sudo mysql -N -B instantcms -e "SELECT password_hash FROM cms_users WHERE id=1;")
php -r 'printf("per-VM admin -> %s\n", password_verify($argv[1],$argv[2])?"ACCEPTED":"REJECTED"); printf("default password -> %s\n", password_verify("admin", $argv[2])?"ACCEPTED":"REJECTED"); printf("blank password -> %s\n", password_verify("", $argv[2])?"ACCEPTED":"REJECTED");' "$P" "$HASH"

Expected: per-VM admin -> ACCEPTED, default password -> REJECTED, blank password -> REJECTED.

Step 6 - Open the portal

Browse to https://<vm-public-ip>/ to see your community portal.

The image ships a per-VM self-signed certificate, so your browser shows a one-time certificate warning on first visit. Click through the warning, or install your own domain certificate into /etc/apache2/ssl/.

The portal ships with a clean, empty community, ready for your own members and content.

Step 7 - Sign in to the admin panel

Sign in at the login URL from the credentials file (instantcms.admin.login), for example https://<vm-public-ip>/auth/login, using the administrator email (admin@example.com) and the password from the credentials file.

After you sign in, open the control panel at https://<vm-public-ip>/admin. From there you manage users and groups, content types and content, comments and moderation, widgets and templates, components, and site configuration.

Step 8 - Confirm the version and the stack

awk -F' *= *' '/^(major|minor|build)/{v=v (v?".":"") $2} END{print "InstantCMS "v}' /var/www/instantcms/system/config/version.ini php -r 'echo "PHP ".PHP_VERSION."\n";' mysql --version echo "first-boot service: $(systemctl is-active instantcms-firstboot.service)"

Expected: InstantCMS 2.18.2, PHP 8.3.x, MySQL 8.0.x, and the first-boot service active.

First-boot service and security model

A one-shot instantcms-firstboot.service runs After=mysql.service and Before=apache2.service, so the per-VM credentials and TLS certificate are in place before the first page is ever served.

The service rotates the MySQL password in lock-step with InstantCMS's stored database configuration (system/config/config.php) and rotates the administrator password (a bcrypt hash on the admin account). It sets the portal base URL from the VM's own address and purges any seeded session tokens. It then writes the credentials file at mode 0600 (root only) before dropping a sentinel so that it runs exactly once.

systemctl status instantcms-firstboot.service --no-pager | head -6 sudo stat -c '%a %U:%G %n' /root/instantcms-credentials.txt

Administration and scheduled jobs

InstantCMS scheduled tasks (feeds, notifications and cleanup) run through instantcms-cron.timer. The timer invokes php /var/www/instantcms/cron.php every minute, so leave it enabled.

After a configuration change, you can clear the file cache by removing the cache directory:

sudo -u www-data rm -rf /var/www/instantcms/cache/*

Enabling HTTPS with your own domain

The image already serves HTTPS with a per-VM self-signed certificate. For production, point a real domain at the VM's public IP and open 443/tcp in the NSG. Then replace the self-signed certificate with a trusted one from Let's Encrypt. Replace the domain in the command:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d your-domain.com

After the certificate is issued, set your domain as the portal base URL so that InstantCMS generates correct absolute links, and then clear the cache:

sudo php -r '$f="/var/www/instantcms/system/config/config.php";$c=include $f;$c["host"]="https://your-domain.com";$c["upload_host"]="https://your-domain.com/upload";file_put_contents($f,"<?php\n\nreturn ".var_export($c,true).";\n");'
sudo -u www-data rm -rf /var/www/instantcms/cache/*

Backup and maintenance

The database lives in MySQL and the application tree, including uploaded media, under /var/www/instantcms. Snapshot the OS disk in Azure for a point-in-time backup, or dump the database as follows. The database password is in the credentials file:

sudo mysqldump instantcms > instantcms-backup.sql

Keep the OS patched with sudo apt update && sudo apt upgrade. Unattended security upgrades are enabled by default.

The stack restarts cleanly with sudo systemctl restart apache2 mysql instantcms-cron.timer.

Support

SecureAnyCloud backs this image with 24/7 support. Contact us by email and chat for help with InstantCMS deployment, upgrades, template and theme development, component and widget installation, user and content management, moderation and access control, performance tuning and caching, and database administration.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch InstantCMS on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com