Krayin CRM 2.2.8

Launch from the AWS Marketplace page and choose the Krayin CRM 2.2.8 on Ubuntu 24.04 version. Alternatively, launch with the AWS CLI, using the AMI ID shown on the launch page of the listing:

aws ec2 run-instances --image-id ami-xxxxxxxxxxxxxxxxx --instance-type m5.large \
  --key-name my-key --security-group-ids sg-xxxxxxxx --subnet-id subnet-xxxxxxxx \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=krayin-crm}]'

First boot takes about a minute once the instance is up. It initialises MySQL, creates the database, runs the Krayin migrations and seeders (pipelines, stages, attributes, roles, e-mail templates), and creates the administrator and the certificate. The web interface stays offline until first boot has finished.

ssh -i my-key.pem ubuntu@<public-ip>

systemctl is-active mysql.service nginx.service php8.3-fpm.service krayin-queue.service krayin-egress-guard.service
sudo ss -ltnp | awk 'NR==1 || /:(22|80|443|3306|33060) /'
sudo ss -lxp | grep krayin-fpm

active active active active active State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 511 0.0.0.0:443 0.0.0.0:* users:(("nginx",pid=72867,fd=7),("nginx",pid=72866,fd=7),("nginx",pid=69663,fd=7)) LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=72867,fd=5),("nginx",pid=72866,fd=5),("nginx",pid=69663,fd=5)) LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=898,fd=3),("systemd",pid=1,fd=88)) LISTEN 0 511 [::]:443 [::]:* users:(("nginx",pid=72867,fd=8),("nginx",pid=72866,fd=8),("nginx",pid=69663,fd=8)) LISTEN 0 511 [::]:80 [::]:* users:(("nginx",pid=72867,fd=6),("nginx",pid=72866,fd=6),("nginx",pid=69663,fd=6)) LISTEN 0 4096 [::]:22 [::]:* users:(("sshd",pid=898,fd=4),("systemd",pid=1,fd=89)) u_str LISTEN 0 4096 /run/php/krayin-fpm.sock 151018 * 0 users:(("php-fpm8.3",pid=69659,fd=10),("php-fpm8.3",pid=69658,fd=10),("php-fpm8.3",pid=69653,fd=8))

Only SSH, HTTP and HTTPS listen on the network. MySQL (3306, and its X protocol on 33060) does not listen at all, and PHP listens only on its Unix socket.

First boot writes everything you need to sign in to a root-only file:

sudo cat /root/krayin-credentials.txt

# Krayin CRM 2.2.8 - generated on first boot by krayin-firstboot.service
# These credentials are unique to this instance; none was baked into the image. Keep this file secret. KRAYIN_URL=https://ec2-3-82-139-119.compute-1.amazonaws.com/admin/login KRAYIN_ADMIN_EMAIL=admin@sac.local KRAYIN_ADMIN_PASSWORD=<24 random letters and digits> KRAYIN_TLS_SHA256=<the certificate's SHA-256 fingerprint> ...

• KRAYIN_URL is your Krayin sign-in page.
• KRAYIN_TLS_SHA256 is the fingerprint of the instance's own certificate. Your browser warns that the certificate is not trusted. Compare the fingerprint it shows with this one before you continue. When you can, replace the certificate with one from a certificate authority for your own name (Step 13).
• KRAYIN_ADMIN_EMAIL / KRAYIN_ADMIN_PASSWORD sign in to Krayin as its administrator.

The image includes an end-to-end test. Over HTTPS on the instance, it checks that:

• port 80 redirects
• the front controller path, the web installer, the configuration file, the data and the sources are refused
• the health check answers
• the administrator signs in through the Krayin sign-in form
• a wrong password and common default passwords are refused

Run the test:

sudo krayin-cred-roundtrip

KRAYIN_ROUNDTRIP_OK https 301 + no index.php/installer/env/data/sources + healthz + administrator sign-in (Krayin's own sign-in form, CSRF token) + wrong and default passwords refused

Open KRAYIN_URL in your browser, check the certificate fingerprint, and sign in with KRAYIN_ADMIN_EMAIL and KRAYIN_ADMIN_PASSWORD.

Change the administrator's name and e-mail address under Settings > Users, or under My Account from the avatar at the top right.

To change the password, run one of the following commands on the instance. The first generates a new random password. The second reads your own password (20 to 72 letters and digits) from the terminal, never from the command line. Either way, every session is signed out and the new password is written to /root/krayin-credentials.txt:

sudo krayin-set-password

# Type <new-password> at the prompt; nothing is echoed. read -rs -p 'New Krayin password: ' P; echo printf '%s\n' "$P" | sudo krayin-set-password --stdin; unset P

After you store the password somewhere safe, you can delete the KRAYIN_ADMIN_PASSWORD line from /root/krayin-credentials.txt.

After you sign in, you land on the Dashboard. It summarises won and lost revenue, leads, quotes, people and organisations for a date range.

Leads shows the Default Pipeline as a board with the stages New, Follow Up, Prospect, Negotiation, Won and Lost. Select Create Lead to add a lead with its contact person, value, source and products. Drag a card between stages as the lead progresses, or switch to the list view with the icon at the top right.

Contacts holds persons and organisations, Products holds your catalogue, Quotes holds quotations linked to leads, and Activities holds calls, meetings and notes.

Under Settings, you can add users, roles and groups, edit pipelines and stages, and define custom attributes, sources, types and tags. You can also create Web Forms (lead-capture forms for your website) and Webhooks. A new instance has no web forms or webhook URLs until you add them.

Krayin sends e-mail and runs other background work through a queue. On this image, the queue worker is the krayin-queue service, which runs as the unprivileged krayin user:

systemctl show -p User -p ActiveState -p SubState krayin-queue.service
sudo krayin-artisan schedule:list
systemctl show -p UnitFileState krayin-schedule.timer

User=krayin ActiveState=active SubState=running 0 0 * * * php artisan campaign:process ...... Next Due: 14 hours from now */5 * * * * php artisan inbound-emails:process Next Due: 52 seconds from now UnitFileState=disabled

The Krayin scheduler has two tasks. inbound-emails:process fetches mail from an IMAP account every five minutes, and campaign:process sends marketing campaigns once a day.

Both tasks need mail that you configure (Steps 10 and 11), so the scheduler timer is installed but switched off on a new instance. Switch it on after you set up mail:

sudo systemctl enable --now krayin-schedule.timer

krayin-artisan runs the Krayin artisan commands as the krayin user, with the same metadata block and egress backstop as the web tier:

sudo krayin-artisan --version sudo krayin-artisan about --only=environment

Laravel Framework 12.71.0 Environment ................................................................ Application Name ................................................ Krayin CRM Laravel Version .................................................... 12.71.0 PHP Version .......................................................... 8.3.6 Composer Version ......................................................... - Environment ..................................................... production Debug Mode ............................................................. OFF URL ............................... ec2-3-82-139-119.compute-1.amazonaws.com Maintenance Mode ....................................................... OFF Timezone ............................................................... UTC Locale .................................................................. en

Out of the box, Krayin writes outgoing mail (password resets, e-mail to leads, campaigns) to its log instead of sending it. To send through your mail server or a service such as Amazon SES, edit /etc/krayin/env as root and set the mail values:

MAIL_MAILER=smtp MAIL_HOST=email-smtp.us-east-1.amazonaws.com MAIL_PORT=587 MAIL_ENCRYPTION=tls MAIL_USERNAME=<your SMTP user name> MAIL_PASSWORD=<your SMTP password> MAIL_FROM_ADDRESS=crm@example.com MAIL_FROM_NAME="Krayin CRM"

Then clear Krayin's cached configuration and restart PHP and the queue worker:

sudo krayin-artisan config:clear
sudo systemctl restart php8.3-fpm krayin-queue

Only root and the krayin group can read the file. If your mail server has a private address inside your VPC, allow it first (Step 12).

Krayin can file incoming e-mail against leads and contacts in two ways.

• IMAP. Set MAIL_RECEIVER_DRIVER=webklex-imap in /etc/krayin/env, run sudo krayin-artisan config:clear, enter the mail account under Configuration > Email > IMAP Settings, then switch on the scheduler (Step 8), which fetches new mail every five minutes. sudo krayin-artisan inbound-emails:process fetches it once by hand.
• SendGrid Inbound Parse. Leave MAIL_RECEIVER_DRIVER=sendgrid, set MAIL_RECEIVER_INBOUND_TOKEN in /etc/krayin/env to a long random value (for example the output of openssl rand -hex 32), run sudo krayin-artisan config:clear and sudo systemctl restart php8.3-fpm, and point SendGrid's Inbound Parse webhook at https://<your-domain>/admin/mail/inbound-parse with the token in an X-Inbound-Token header. Until a token is set the webhook answers 503 Inbound parsing is not configured, so nobody can inject mail.

The egress backstop stops the krayin user (the web application, the queue worker, the scheduler and krayin-artisan) from connecting to any address in your VPC's own address ranges, which it reads from the instance metadata at every boot. Public addresses work as usual. The following commands show the ranges, and that Krayin is refused the metadata service while public sites are not refused:

sudo nft list set inet sac_krayin_egress vpc4 | grep elements
sudo -u krayin curl -s -m 5 -o /dev/null -w 'metadata: %{http_code}\n' http://169.254.169.254/latest/meta-data/ || true
sudo -u krayin curl -s -m 5 -o /dev/null -w 'public HTTPS: %{http_code}\n' https://secureanycloud.com/ || true

elements = { 172.31.0.0/16 } metadata: 000 public HTTPS: 200

If Krayin must reach a host inside the VPC (an SMTP relay, an IMAP server, a webhook receiver or a VPC interface endpoint on a private address), add its address or CIDR, one per line, to /etc/sac/krayin-egress-allow.conf and apply it. This restarts PHP and the queue worker with the new rules:

echo '172.31.10.25' | sudo tee -a /etc/sac/krayin-egress-allow.conf >/dev/null
sudo systemctl restart krayin-egress-guard
sudo nft list set inet sac_krayin_egress allow4 | grep elements

elements = { 172.31.10.25 }

Only the addresses you list are opened. The metadata service, link-local, reserved and multicast ranges and IPv6 stay refused whatever the file says.

Point a DNS name at the instance. An Elastic IP is recommended. Then run:

sudo krayin-set-hostname <your-domain>

This command creates a new self-signed certificate for the name and pins nginx to it, so other names are dropped. It also sets the Krayin APP_URL (used in links in its e-mails and web forms) and the cross-site guard, and updates the URL and fingerprint in /root/krayin-credentials.txt. To use a certificate from a certificate authority instead, replace /etc/nginx/ssl/krayin.crt and krayin.key (keep the key 0600 root) and run sudo systemctl reload nginx.

Limit who can reach the web interface in the security group of the instance. For example, to allow HTTPS only from your office network, run:

aws ec2 authorize-security-group-ingress --group-id sg-xxxxxxxx --protocol tcp --port 443 --cidr <your-mgmt-cidr>
aws ec2 revoke-security-group-ingress --group-id sg-xxxxxxxx --protocol tcp --port 443 --cidr 0.0.0.0/0

Krayin locks an e-mail address and client address out of sign-in after five failed attempts, and locks a client address after twenty. nginx separately rate-limits requests for the sign-in and password-reset pages per client address.

U=$(sudo sed -n 's/^KRAYIN_URL=//p' /root/krayin-credentials.txt); U=${U%/admin/login} C=/etc/nginx/ssl/krayin.crt for p in admin/login healthz up; do curl -s --cacert "$C" -o /dev/null -w "GET /$p: %{http_code}\n" "${U}/$p" done for p in index.php index.php/admin/login .env install _debugbar/open storage/logs/laravel.log; do curl -s --cacert "$C" -o /dev/null -w "GET /$p: %{http_code}\n" "${U}/$p" done curl -s --cacert "$C" -o /dev/null -w 'GET /admin/dashboard/export-pdf from another site: %{http_code}\n' -H 'Sec-Fetch-Site: cross-site' "${U}/admin/dashboard/export-pdf" curl -s -o /dev/null -w 'GET http://: %{http_code}\n' "${U/https:/http:}/admin/login" curl -sk -o /dev/null -w 'GET with an unknown Host: %{http_code}\n' -H 'Host: not-this-server.example' https://127.0.0.1/ || true for i in $(seq 1 12); do curl -s --cacert "$C" -o /dev/null -w '%{http_code} ' "${U}/admin/login"; done; echo systemctl show -p IPAddressDeny nginx.service php8.3-fpm.service mysql.service krayin-queue.service
sudo mysql -e "SELECT @@version, @@bind_address, @@skip_networking, @@local_infile" curl -s http://127.0.0.1/healthz

GET /admin/login: 200 GET /healthz: 200 GET /up: 200 GET /index.php: 404 GET /index.php/admin/login: 404 GET /.env: 404 GET /install: 404 GET /_debugbar/open: 404 GET /storage/logs/laravel.log: 404 GET /admin/dashboard/export-pdf from another site: 403 GET http://: 301 GET with an unknown Host: 000 200 200 200 200 200 200 200 200 200 200 429 429 IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32 IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32 IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32 IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32 @@version @@bind_address @@skip_networking @@local_infile 8.0.46-0ubuntu0.24.04.4 127.0.0.1 1 0 ok

• The front controller path (/index.php/...), the configuration file, the web installer, logs and the debug bar are refused. Krayin's code, configuration and data live outside the web root, so any other path that is not a Krayin page gets Krayin's own "404 Page Not Found" page. A link from another site cannot trigger the PDF export or a data import (403). Requests for any name other than the configured one are dropped (000: nginx closes the connection).
• The twelve quick requests for the sign-in page show the nginx per-address limit (429).
• IPAddressDeny is the metadata-service block on nginx, PHP, MySQL and the queue worker; the scheduler and the first-boot service have the same one.
• MySQL has networking switched off (skip_networking 1) and refuses LOAD DATA LOCAL.
• http://127.0.0.1/healthz returns ok for a monitoring agent on the instance.

Your data is the MySQL database plus uploaded files in /var/lib/krayin/storage/app and /var/lib/krayin-public. Keep /etc/krayin/env too: its APP_KEY decrypts the values Krayin stores encrypted, and a backup restored without it cannot read them. Copy them to root-only files, and keep copies off the instance, for example in an encrypted S3 bucket:

sudo sh -c 'umask 077; mysqldump --single-transaction --routines --triggers krayin | gzip > /var/backups/krayin-db-$(date +%F).sql.gz'
sudo sh -c 'umask 077; tar -C /var/lib -czf /var/backups/krayin-files-$(date +%F).tar.gz krayin/storage/app krayin-public'
sudo sh -c 'umask 077; cp /etc/krayin/env /var/backups/krayin-env-$(date +%F)'
sudo ls /var/backups/ | grep krayin

krayin-db-2026-11-08.sql.gz krayin-env-2026-11-08 krayin-files-2026-11-08.tar.gz

To restore into a new instance of the same version, stop nginx, PHP-FPM and krayin-queue (and krayin-schedule.timer if you switched it on), load the dump into the krayin database with gunzip -c <dump> | sudo mysql krayin, unpack the files archive into /var/lib, put your APP_KEY line into /etc/krayin/env, and start the services again.

EBS snapshots of the instance are a simple way to keep point-in-time copies of the whole server.

Ubuntu, PHP and MySQL security updates install automatically (unattended upgrades). New Krayin releases are published as new versions of this listing: launch the new version, stop its services, copy your database, uploads and the APP_KEY line of /etc/krayin/env across (keeping the new instance's own database password and APP_URL), then run sudo krayin-artisan migrate --force and start the services again.

ls /usr/share/doc/krayin/ sed -n '1,6p' /usr/share/doc/krayin/SOURCE.txt

LICENSE SOURCE.txt Krayin CRM 2.2.8 on Ubuntu 24.04 by sac - source and changes Upstream: the Krayin CRM 2.2.8 tag archive, https://github.com/krayin/laravel-crm/archive/refs/tags/v2.2.8.tar.gz (sha256 beb916c4a73ec7a7acc5f08e9192b0a0687ad28940e221a781484603d1de0fcc; GitHub tag v2.2.8, commit ed6deebfcb8c616eaf352c893a10a6d8e666fc6e). Licence: MIT (LICENSE, shipped here and in /var/www/krayin). No Krayin source file is modified.

Krayin CRM is licensed under the MIT License by Webkul, and every Krayin package on the image is part of the same open source repository; the image contains no paid or proprietary extension. SOURCE.txt names the exact upstream archive and the files that are not shipped (tests, sample configuration, agent and lint tooling, front-end build configuration, Apache and IIS files, and one library README that carries example keys).