kivitendo

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Choose a larger size for bigger or busier instances.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for kivitendo. kivitendo serves plain HTTP on port 80, so for production terminate TLS in front of it with your own domain. The bundled PostgreSQL listens on 127.0.0.1 only, so port 5432 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for kivitendo by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:kivitendo-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name kivitendo \
  --image sac1647283583153:kivitendo-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for kivitendo:

az vm open-port --resource-group <your-rg> --name kivitendo --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that PostgreSQL, Apache and the task server are all active. PostgreSQL listens only on 127.0.0.1:5432, while Apache serves kivitendo on port 80.

systemctl is-active postgresql apache2 kivitendo-task-server

ss -tln | grep -E ':80 |:5432 '

Step 4 - Retrieve the per-VM credentials

Each VM generates its own kivitendo login and administration passwords on first boot. It writes them, along with the login user and the URLs, to a root-only credentials file. Read it with sudo:

sudo cat /root/kivitendo-credentials.txt

Sign in to kivitendo as the user kivitendo with the KIVITENDO_USER_PASSWORD from this file. The separate KIVITENDO_ADMIN_PASSWORD protects the administration area, where you manage clients, users and the database.

On the VM itself, run sudo -u postgres psql kivitendo to reach the company dataset directly over the local socket.

Step 5 - Sign in to kivitendo

Browse to http://<vm-public-ip>/. The kivitendo login screen opens. Sign in with the username kivitendo, the password from Step 4 and the preselected client.

Step 6 - The kivitendo main menu

After you sign in, kivitendo opens its main menu. Across the top are Master Data, Sales, Purchases, Warehouse, General Ledger and the System and Reports areas. Together they cover the whole order-to-cash and accounting workflow.

From Master Data you add and search customers, vendors and articles. From Sales and Purchases you raise quotations, orders and invoices.

Step 7 - Work with customers and articles

Open Master Data, then Add Customer. Enter a name and any billing, contact and tax details, then save. kivitendo assigns a customer number automatically.

Open Reports, then Customers to list your customers. Manage articles the same way under Add Part and Add Service. These master data records are the foundation for quotations, orders and invoices.

Step 8 - The administration area

Open the administration area at http://<vm-public-ip>/controller.pl?action=Admin/login and sign in with the KIVITENDO_ADMIN_PASSWORD from Step 4.

Here you manage clients (company datasets), users and their passwords, and user groups and their rights. You can also create further datasets. Use this area to tailor kivitendo's access model to your team.

Step 9 - No known or default credentials

Upstream kivitendo ships with a well-known default administration password, admin123. The SecureAnyCloud image removes it. The administration password, the login user password and the database secret all get unique per-VM values on first boot, and no known or blank credential authenticates.

You can prove this with the built-in round-trip check. It confirms that the per-VM login user signs in through kivitendo's web login, while a blank password, the admin123 default and common weak guesses are all rejected:

sudo -u postgres psql -d kivitendo_auth -tAc "SELECT login FROM auth.\"user\""

sudo bash /usr/local/sbin/kivitendo-cred-roundtrip.sh

Step 10 - Verify the stack and where your data lives

Confirm the kivitendo version and the databases. The bundled PostgreSQL holds two databases, so all of your ERP data stays on the VM:

• kivitendo_auth is the authentication database, with users, groups and the client registry.
• kivitendo is the company dataset, with your customers, vendors, articles and the general ledger.

cat /var/www/kivitendo-erp/VERSION

sudo -u postgres psql -tAc "SELECT datname FROM pg_database WHERE datname LIKE 'kivitendo%'"

sudo -u postgres psql -d kivitendo -tAc "SELECT 'customers = '||count(*) FROM customer UNION ALL SELECT 'accounts = '||count(*) FROM chart"

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. For production, put kivitendo behind your own domain and a TLS certificate. Terminate TLS with Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer with a certificate for your domain, and point it at the VM's port 80.

Security notes

• Encrypt web traffic. kivitendo serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS-terminating reverse proxy or Azure Application Gateway with a certificate for your domain.
• Keep PostgreSQL private. It listens on 127.0.0.1 only and is never reachable from the network. Administer it through kivitendo, or over SSH with sudo -u postgres psql kivitendo.
• Protect the credentials. The login password, the administration password and the database secret are unique per VM, and no known or blank credential authenticates. Keep /root/kivitendo-credentials.txt protected, and change the passwords from within kivitendo if you share access.
• Restrict the network. Limit inbound 80/tcp in your NSG to the networks that need kivitendo.

Support

SecureAnyCloud maintains this image and provides 24/7 support. For help deploying or operating kivitendo on Azure, contact us through secureanycloud.com.

Deploy on Azure

Launch kivitendo ERP on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com