Krayin CRM

Sign in to the Azure portal, choose Create a resource, search the Marketplace for Krayin CRM by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size (Standard_B2s or larger). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443). Then choose Review + create and Create.

SecureAnyCloud images carry a Marketplace purchase plan. Accept its terms once per subscription, then create the VM and open HTTPS:

az vm image terms accept --publisher sac --offer krayin-ubuntu-24-04 --plan default
az vm create \
  --resource-group my-rg \
  --name my-krayin \
  --image sac1647283583153:krayin-ubuntu-24-04:default:latest \
  --plan-name default --plan-product krayin-ubuntu-24-04 --plan-publisher sac \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group my-rg --name my-krayin --port 443 --priority 1001

ssh azureuser@<vm-public-ip>

First boot takes two to three minutes. It generates the administrator password, Laravel application key, database password and HTTPS certificate of this VM, and only then starts the web server. If the site does not answer immediately, first boot has not finished yet.

This order is deliberate. Apache and PHP-FPM are held closed until first boot has succeeded, so a failed first boot leaves the VM unreachable rather than serving a half-configured CRM.

sudo systemctl is-active mysql php8.3-fpm apache2 krayin-firstboot

All four report active. Now check what is listening and that the application answers:

sudo ss -lnt | grep -E ':(22|80|443|3306) ' | sort

MySQL appears only on 127.0.0.1:3306. It is never a network service on this appliance. Ports 22, 80 and 443 are the only ones reachable from outside.

curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/admin/login

A 200 response confirms that Apache and PHP-FPM are serving the sign-in page. Check the installed release:

grep "const KRAYIN_VERSION" /var/www/krayin/packages/Webkul/Core/src/Core.php

Every secret on this VM was generated on its own first boot and written to a file that only root can read:

sudo cat /root/krayin-credentials.txt

The file looks like this. The real values are unique to your VM:

# sac :: Krayin CRM appliance credentials
# Generated on this VM's first boot. This file is readable only by root. # Sign in at https://<this-vm-address>/admin/login and change the password afterwards. krayin.admin.user=admin@sac.local krayin.admin.pass=<unique to this VM> krayin.db.name=krayin krayin.db.user=krayin krayin.db.pass=<unique to this VM> KRAYIN_APP_URL=https://<this-vm-address>

Confirm that only root can read the file and that the Laravel application key is the key of this VM:

sudo stat -c '%a %U:%G %n' /root/krayin-credentials.txt /var/www/krayin/.env
sudo grep -c '^APP_KEY=base64:' /var/www/krayin/.env

Browse to https://<vm-public-ip>/admin/login. Your browser warns about the self-signed certificate until you install your own (Step 11). Accept the warning to continue. Sign in with the address and password from the credentials file.

Change the administrator password after you sign in. Choose Settings, then Users. The address admin@sac.local is a local address. Edit the same user to set your own email address so that password reset works.

Krayin organizes sales work as leads moving through pipeline stages. Choose Leads in the sidebar, then Create Lead. Give the lead a title and an estimated value, and pick a Source and Type.

Under Name, choose Click to Add to attach a contact person. If you type a name that does not exist yet, Krayin offers Add as New. If the lead has no line items, remove the empty row on the Products tab before you save, because a blank product row fails validation.

Saved leads appear in the pipeline immediately, and the dashboard totals update. Open the lead to see its full record and an automatic changelog of every field that changed.

You can confirm from the shell that the data you entered persisted to the database:

sudo mysql --defaults-file=/etc/mysql/debian.cnf -D krayin -e "SELECT id, title, lead_value, created_at FROM leads ORDER BY id DESC LIMIT 5;"

The upstream seeder of Krayin creates an administrator whose address and password are published in the source of the project. This image replaces both halves before the application is ever reachable, so that account does not exist here:

sudo mysql --defaults-file=/etc/mysql/debian.cnf -D krayin -e "SELECT id, name, email FROM users;"

Only your own administrator is listed. The web installer is refused outright, and so is the environment file:

for p in /admin/login /install /install/api/run-seeder /.env; do printf '%-26s %s\n' "$p" "$(curl -sk -o /dev/null -w '%{http_code}' https://127.0.0.1$p)"; done

/admin/login answers 200. Every installer endpoint and /.env answers 403.

A note on status codes. Krayin renders its own "404 Page Not Found" view with HTTP 200 instead of 404. For a path that is not routed, a 200 therefore does not mean the file was served, so check the body, not the status. If you put this VM behind uptime monitoring, alert on page content rather than on the status code alone.

Laravel builds absolute URLs, including password reset links and the storage disk URL, from APP_URL. On this image, krayin-baseurl.service rewrites APP_URL and the Apache ServerName from the own address of the VM on every boot. It also reissues the certificate for that address and rebuilds the configuration cache of Laravel. An Azure public IP that changes across a stop and start is therefore picked up automatically:

grep '^ServerName' /etc/apache2/conf-available/krayin-servername.conf
sudo grep '^APP_URL' /var/www/krayin/.env

openssl x509 -in /etc/ssl/krayin/krayin.crt -noout -subject -ext subjectAltName

curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' http://127.0.0.1/

Port 80 answers 301 to the HTTPS URL and serves nothing else.

The image ships the log mail transport. Krayin writes the messages it would have sent to storage/logs/laravel.log instead of failing against a mail server that does not exist. To point Krayin at your own SMTP relay, edit /var/www/krayin/.env:

MAIL_MAILER=smtp MAIL_HOST=smtp.your-provider.example MAIL_PORT=587 MAIL_USERNAME=your-smtp-username MAIL_PASSWORD=<set-at-first-boot> MAIL_ENCRYPTION=tls MAIL_FROM_ADDRESS=crm@your-domain.example MAIL_FROM_NAME="Your Company CRM"

Laravel caches its configuration, so rebuild the cache after any .env change:

cd /var/www/krayin && sudo -u www-data php artisan config:cache

Point a DNS A record at the public IP of the VM, then pin the name so it survives reboots and IP changes:

echo "crm.your-domain.example" | sudo tee /etc/krayin/server-name
sudo /usr/local/sbin/krayin-baseurl.sh

This command writes ServerName, rewrites APP_URL to the new name and reissues a self-signed certificate for it. To replace the self-signed certificate with a trusted one, run:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d crm.your-domain.example

Certbot writes its own certificate paths into the Apache configuration. Keep /etc/krayin/server-name in place so that APP_URL continues to track the same name.

Krayin can turn incoming mail into leads and activities. The image ships a systemd timer, krayin-scheduler.timer, that runs the Laravel scheduler every minute. The scheduler drives the inbound-emails:process task of Krayin. Confirm that the timer is armed:

systemctl list-timers krayin-scheduler.timer --no-pager | head -3

To enable inbound capture, add your IMAP settings to /var/www/krayin/.env and rebuild the config cache as in Step 10:

IMAP_HOST=imap.your-provider.example IMAP_PORT=993 IMAP_ENCRYPTION=ssl IMAP_VALIDATE_CERT=true IMAP_USERNAME=crm@your-domain.example IMAP_PASSWORD=<set-at-first-boot>

The queue runs in sync mode, which is the upstream default, so bulk CSV and XLSX imports run inline in the web request. This is why the command-line PHP configuration leaves memory_limit uncapped while the web tier is capped at 512M. For very large imports, raise memory_limit in /etc/php/8.3/fpm/conf.d/99-krayin.ini and reload PHP-FPM.

• No default credential. The published administrator address and password of Krayin never survive the build. Your administrator password, Laravel application key and database password are generated on the first boot of this VM.
• The web installer is unreachable. Apache denies /install and every /install/api/ endpoint. This holds even if the application is made to believe it is not installed, which is the state an attacker would try to induce.
• The environment file is not exposed. The document root is the public/ directory of Krayin, so .env sits above it. Dotfiles are also denied by name as a second line of defense.
• Only the front controller executes. Every .php file under the document root except public/index.php is denied, so a stray or uploaded script cannot run.
• The code tree is read-only to the web server. Only storage/ and bootstrap/cache are writable by www-data.
• Debug mode is off and APP_ENV is production, so an error page never leaks a stack trace or configuration.
• Nothing but SSH and HTTPS is reachable. MySQL and PHP-FPM listen on localhost only, and the X Protocol plugin of MySQL is disabled.
• Sign-in is rate limited by Krayin itself. Five failed attempts per account per minute and twenty per address return HTTP 429.

To review what is listening and the effective SSH policy at any time, run:

sudo ss -lntu | awk '{print $1, $5}' | sort -u sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|clientaliveinterval) '

A complete backup is the database plus storage/ (uploaded files) and .env. The .env file holds the application key, and without the key, encrypted values cannot be read:

sudo mysqldump --defaults-file=/etc/mysql/debian.cnf --single-transaction --routines krayin \
  | gzip > /var/backups/krayin-$(date +%F).sql.gz
sudo tar czf /var/backups/krayin-files-$(date +%F).tar.gz \
  -C /var/www/krayin storage .env

To confirm that the dump path works without writing a file, export the schema only:

sudo mysqldump --defaults-file=/etc/mysql/debian.cnf --no-data krayin > /dev/null && echo "dump OK"

Store both archives off the VM. To restore, recreate the database, load the dump, restore storage/ and .env, and then rebuild the config cache.

unattended-upgrades applies Ubuntu security updates automatically. Confirm that it is enabled:

grep 'Unattended-Upgrade' /etc/apt/apt.conf.d/20auto-upgrades

You upgrade Krayin itself from the upstream release archive. First read the Krayin upgrade notes for your target version and take a backup as in Step 14. Then replace the application tree, run composer install --no-dev, run php artisan migrate --force, and rebuild the caches. composer install requires the php8.3-zip extension, which this image ships.

Step 12 describes the scheduled task of Krayin and the queue. If you enable a database-backed queue instead of sync, run a queue worker.