Kanboard
Overview
Kanboard is an open-source, self-hosted kanban board for visual project management. It focuses on simplicity: a clean board of columns and cards that limits work in progress and makes the status of every task obvious at a glance.
This SecureAnyCloud image runs Kanboard 1.2.52 behind nginx, with PHP-FPM 8.3 and OPcache enabled. Kanboard stores its data in SQLite, so the appliance is fully self-contained. There is no separate database server to install, secure or back up.
The SQLite database, uploaded files, cache and logs live under /var/www/kanboard/data on a dedicated, independently resizable Azure data disk. You can grow your project store without touching the operating system disk.
There is no first-run setup wizard. The Kanboard admin password is generated on the first boot of every deployed VM, so the stock admin / admin password that ships with upstream Kanboard is never used. Two VMs deployed from the same image never share credentials. The initial administrator password is written to /root/kanboard-credentials.txt with mode 0600, so only the root user can read it.
What you get:
- Kanboard 1.2.52 at
/var/www/kanboard, served by nginx on port 80 - PHP 8.3 (php-fpm) with OPcache and every extension Kanboard requires
- Self-contained SQLite storage on a dedicated Azure data disk at
/var/www/kanboard/data - A per-VM administrator password generated at first boot and stored in a root-only file
- The bundled Kanboard console (
cli) and the JSON-RPC API at/jsonrpc.php - 24/7 SecureAnyCloud support
Prerequisites
You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.
Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size. Scale up for larger teams.
Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp from the networks your users reach Kanboard from. Also allow 443/tcp if you enable HTTPS.
Step 1 - Deploy from the Azure Marketplace
Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Kanboard by SecureAnyCloud, and select Create.
On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).
Review the dedicated data disk on the Disks tab, then select Review + create and Create. First-boot initialisation completes within about a minute of the VM reaching the Running state.
Step 2 - Deploy from the Azure CLI
Accept the Marketplace terms once per subscription, then create the VM and open port 80.
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:kanboard-ubuntu-24-04:default:latest
az vm create \
--resource-group <your-rg> \
--name kanboard \
--image sac1647283583153:kanboard-ubuntu-24-04:default:latest \
--size Standard_B2s \
--admin-username azureuser \
--ssh-key-values ~/.ssh/id_ed25519.pub \
--vnet-name <your-vnet> --subnet <your-subnet> \
--public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name kanboard --port 80 --priority 1010Step 3 - Connect and retrieve the initial credentials
Connect over SSH as the administrator account you chose at deployment:
ssh azureuser@<vm-public-ip>The administrator credentials generated on first boot are stored in a root-only file. Print the Kanboard administrator user name and password for this VM:
sudo cat /root/kanboard-credentials.txtThe file lists the application URL, the JSON-RPC API URL, the admin user name (admin) and the per-VM administrator password. Keep the password somewhere safe and treat the file as sensitive.
Step 4 - Verify the service is running
Confirm that the web server, the PHP-FPM pool and the first-boot service are all active:
systemctl is-active nginx php8.3-fpm kanboard-firstbootAll three report active. Confirm the installed Kanboard version with the bundled console:
cd /var/www/kanboard && sudo php cli versionThis prints 1.2.52. Next, confirm that the web application answers on the loopback interface. An unauthenticated request is redirected to the sign-in page, which is the expected behaviour.
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/This returns 302, the redirect to /login.
Step 5 - Confirm the data disk
The SQLite database, uploaded files and cache are kept on a dedicated Azure data disk mounted at /var/www/kanboard/data. Confirm that it is a separate filesystem:
findmnt -no SOURCE,FSTYPE /var/www/kanboard/dataThis shows the data device and ext4. Because the data tier is a distinct disk, you can grow it in the Azure portal or CLI and then expand the filesystem online, without resizing the operating system disk.
Step 6 - Sign in for the first time
Browse to http://<vm-public-ip>/. Sign in as the user admin with the per-VM password from /root/kanboard-credentials.txt.
After you sign in, the dashboard lists your projects, the tasks assigned to you and a project activity stream.
Change the administrator password to one of your own choosing after your first login. Open the user menu in the top right, choose My profile, then choose Change password.
Step 7 - Create a project and build a board
From the dashboard, choose New project, give the project a name and open it. Kanboard creates a board with the default columns Backlog, Ready, Work in progress and Done.
Select the blue + icon at the head of a column to add a task card. Give it a title, optionally assign a colour, an owner, a due date and a description, then save. Drag cards between columns as work progresses.
From the project Settings, you can rename, add or remove columns, set work-in-progress limits per column, add swimlanes, and define automated actions that fire when a card moves.
Step 8 - Use the JSON-RPC API
Kanboard exposes a JSON-RPC API at /jsonrpc.php for integration and automation. User-level calls authenticate with HTTP Basic, using the administrator user name and the per-VM password.
Run the following call on the VM. It returns the signed-in user's profile and confirms that the API is reachable.
PASS=$(sudo grep '^kanboard.admin.pass=' /root/kanboard-credentials.txt | cut -d= -f2-)
curl -s -u "admin:${PASS}" -H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","method":"getMe","id":1}' http://127.0.0.1/jsonrpc.phpThe response is a JSON document whose result object contains the admin user. The full API reference is in the Kanboard documentation. Common procedures include createProject, createTask, getAllTasks and getBoard.
Step 9 - Enable HTTPS (recommended)
The image serves Kanboard over plain HTTP on port 80, so it works immediately behind a load balancer or for evaluation. For production, terminate TLS. The simplest approach is a free certificate from Let's Encrypt, once a DNS name points at the VM's public IP.
Install Certbot and its nginx plugin, then request a certificate for your domain. This step needs your own domain name and prompts for an email address, so run the Certbot command yourself in an interactive shell rather than from a script.
- Install the client:
sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx - Request and install the certificate: run
sudo certbot --nginx -d your-domain.example.comand follow the prompts. Certbot edits the nginx server block to add the TLS listener and sets up automatic renewal.
After Certbot completes, allow 443/tcp in the VM's network security group. Then browse to https://your-domain.example.com/ and sign in over the encrypted connection.
Step 10 - Back up and maintain
All state lives on the data disk, so backing up Kanboard is straightforward. The recommended approach is an Azure snapshot of the data disk, which captures the SQLite database, uploaded files and configuration atomically. You can also copy the SQLite database file directly:
sudo cp /var/www/kanboard/data/db.sqlite /var/www/kanboard/data/db.sqlite.backupThe image ships fully security-patched at capture time, and unattended-upgrades stays enabled so security updates keep arriving on your VM. Apply updates on your own schedule with sudo apt-get update && sudo apt-get upgrade.
To upgrade Kanboard itself, follow the upstream upgrade notes for your target version. Always snapshot the data disk first.
Support
This image is published and supported by SecureAnyCloud. Support covers deployment, Kanboard configuration, plugin and API integration, upgrades, performance tuning and storage administration, by email and chat.
Kanboard is open-source software licensed under the MIT License. The application itself is developed by the Kanboard project. All product and company names are trademarks or registered trademarks of their respective holders. Their use does not imply any affiliation with or endorsement by them.
Deploy on Azure
Launch Kanboard on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.
View this image
Need Help?
Our support team is available 24/7.
sales@secureanycloud.com
Overview
Kanboard is an open-source, self-hosted kanban board for visual project management. It focuses on simplicity: a clean board of columns and cards that limits work in progress and makes the status of every task obvious at a glance.
This SecureAnyCloud image runs Kanboard behind nginx, with PHP-FPM 8.3 and OPcache enabled. Kanboard stores its data in SQLite, so the appliance is fully self-contained. There is no separate database server to install, secure or back up.
The SQLite database, uploaded files, cache and logs live under /var/www/kanboard/data on a dedicated, independently resizable EBS volume. You can grow your project store without touching the operating system disk.
There is no first-run setup wizard. The Kanboard admin password is generated on the first boot of every deployed instance, so the stock admin / admin password that ships with upstream Kanboard is never used. Two instances launched from the same Amazon Machine Image never share credentials. The initial administrator password is written to /root/kanboard-credentials.txt with mode 0600, so only the root user can read it.
What you get:
- Kanboard served by nginx, with PHP-FPM 8.3 and OPcache
- Self-contained SQLite storage on a dedicated EBS volume at /var/www/kanboard/data
- A per-instance administrator password generated at first boot and stored in a root-only file
Prerequisites
Before you deploy this image, you need:
- An Amazon Web Services account where you can launch EC2 instances
- IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
- An EC2 key pair in the target Region for SSH access to the instance
- A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users reach Kanboard from
- The AWS CLI (version 2) installed locally, if you plan to deploy from the command line
Launch the instance from the AWS Marketplace
Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Kanboard. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.
Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users reach Kanboard from. Leave the root and data volumes at their default sizes or larger.
Select Launch instance. First-boot initialisation takes approximately one minute after the instance state becomes Running and the status checks pass.
Launch the instance from the AWS CLI
The following command launches an instance from the SecureAnyCloud Kanboard Marketplace AMI into an existing subnet and security group.
Replace <ami-id> with the AMI ID shown on the Marketplace listing. Replace <key-name> with your EC2 key pair name and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.
aws ec2 run-instances \
--image-id <ami-id> \
--instance-type m5.large \
--key-name <key-name> \
--subnet-id <subnet-id> \
--security-group-ids <security-group-id> \
--block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":20,"VolumeType":"gp3"}}]' \
--tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=kanboard-01}]'On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.
Connect and retrieve the initial credentials
Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched.
The AMI variant Kanboard 1.2.52 on Ubuntu 24.04 uses the SSH login user ubuntu. Connect with ssh -i <path-to-key.pem> ubuntu@<instance-public-ip>.
The administrator credentials generated on first boot are stored in a root-only file. Print the Kanboard administrator user name and password for this instance:
sudo cat /root/kanboard-credentials.txtThe file lists the application URL, the JSON-RPC API URL, the admin user name (admin) and the per-instance administrator password. Keep the password somewhere safe and treat the file as sensitive.
Verify the service is running
Confirm that the web server, the PHP-FPM pool and the first-boot service are all active:
systemctl is-active nginx php8.3-fpm kanboard-firstbootAll three report active. Confirm the installed Kanboard version with the bundled console:
cd /var/www/kanboard && sudo php cli versionThis prints 1.2.52. Next, confirm that the web application answers on the loopback interface. An unauthenticated request is redirected to the sign-in page, which is the expected behaviour.
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/This returns 302, the redirect to /login.
Confirm the data volume
The SQLite database, uploaded files and cache are kept on a dedicated EBS volume mounted at /var/www/kanboard/data. Confirm that it is a separate filesystem:
findmnt -no SOURCE,FSTYPE /var/www/kanboard/dataThis shows the data device and ext4. Because the data tier is a distinct volume, you can grow it in the AWS console or CLI and then expand the filesystem online, without resizing the operating system disk.
Sign in for the first time
Browse to http://<instance-public-ip>/. Sign in as the user admin with the per-instance password from /root/kanboard-credentials.txt.
After you sign in, the dashboard lists your projects, the tasks assigned to you and a project activity stream.
Change the administrator password to one of your own choosing after your first login. Open the user menu in the top right, choose My profile, then choose Change password.
Create a project and build a board
From the dashboard, choose New project, give the project a name and open it. Kanboard creates a board with the default columns Backlog, Ready, Work in progress and Done.
Select the blue + icon at the head of a column to add a task card. Give it a title, optionally assign a colour, an owner, a due date and a description, then save. Drag cards between columns as work progresses.
From the project Settings, you can rename, add or remove columns, set work-in-progress limits per column, add swimlanes, and define automated actions that fire when a card moves.
Use the JSON-RPC API
Kanboard exposes a JSON-RPC API at /jsonrpc.php for integration and automation. User-level calls authenticate with HTTP Basic, using the administrator user name and the per-instance password.
Run the following call on the instance. It returns the signed-in user's profile and confirms that the API is reachable.
PASS=$(sudo grep '^kanboard.admin.pass=' /root/kanboard-credentials.txt | cut -d= -f2-)
curl -s -u "admin:${PASS}" -H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","method":"getMe","id":1}' http://127.0.0.1/jsonrpc.phpThe response is a JSON document whose result object contains the admin user. The full API reference is in the Kanboard documentation. Common procedures include createProject, createTask, getAllTasks and getBoard.
Enable HTTPS (recommended)
The image serves Kanboard over plain HTTP on port 80, so it works immediately behind a load balancer or for evaluation. For production, terminate TLS. The simplest approach is a free certificate from Let's Encrypt, once a DNS name points at the instance.
Install Certbot and its nginx plugin, then request a certificate for your domain. This step needs your own domain name and prompts for an email address, so run the Certbot command yourself in an interactive shell rather than from a script.
- Install the client:
sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx - Request and install the certificate: run
sudo certbot --nginx -d your-domain.example.comand follow the prompts. Certbot edits the nginx server block to add the TLS listener and sets up automatic renewal.
After Certbot completes, browse to https://your-domain.example.com/ and sign in over the encrypted connection.
Back up and maintain
All state lives on the data volume, so backing up Kanboard is straightforward. The recommended approach is an EBS snapshot of the data volume, which captures the SQLite database, uploaded files and configuration atomically. You can also copy the SQLite database file directly:
sudo cp /var/www/kanboard/data/db.sqlite /var/www/kanboard/data/db.sqlite.backupApply operating system security updates with sudo apt-get update && sudo apt-get upgrade.
To upgrade Kanboard itself, follow the upstream upgrade notes for your target version. Always snapshot the data volume first.
Support
This image is published and supported by SecureAnyCloud. Support covers deployment, Kanboard configuration, plugin and API integration, upgrades, performance tuning and storage administration, by email and chat.
Kanboard is open-source software licensed under the MIT License. The application itself is developed by the Kanboard project. All product and company names are trademarks or registered trademarks of their respective holders. Their use does not imply any affiliation with or endorsement by them.
Deploy on AWS
Launch Kanboard on AWS with 24/7 support from SecureAnyCloud.
View on Marketplace
Need Help?
Our support team is available 24/7.
sales@secureanycloud.com