Lakasir

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size for a single till. Scale up for more concurrent cashiers or a larger catalogue.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network. Allow 443/tcp (HTTPS) and 80/tcp (which redirects to HTTPS) from your shop network.

Step 1 - Deploy from the Azure Marketplace

In the Azure Marketplace, find Lakasir POS on Ubuntu 24.04 LTS by SecureAnyCloud. Choose Get It Now, then Create.

Pick your resource group, region and VM size (Standard_B2s or larger), and provide your SSH public key. In the networking step, allow inbound 443/tcp and 80/tcp. Then review and create the VM.

Step 2 - Deploy with the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:lakasir-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name lakasir \
  --image sac1647283583153:lakasir-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name lakasir --port 443 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH as azureuser:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

The three services that back Lakasir should all report active. The sign-in page answers HTTP 200 over HTTPS, and the plain HTTP port redirects to HTTPS. Check all three:

systemctl is-active nginx php8.4-fpm mariadb curl -ks -o /dev/null -w 'member login -> %{http_code}\n' https://127.0.0.1/member/login curl -s -o /dev/null -w 'http redirect -> %{http_code}\n' http://127.0.0.1/

The output shows three lines of active, then member login -> 200 and http redirect -> 301.

Step 5 - Retrieve your administrator credentials

On the first boot of every VM, a one-shot service (lakasir-firstboot.service) generates credentials that are unique to that VM: a fresh Laravel application key, a fresh MariaDB password, and a fresh administrator email and password. It also generates a per-VM self-signed TLS certificate and sets the VM's own address as the application URL.

No shared or default credentials ship in the image. Lakasir's upstream database seeder creates a well-known superadmin@admin.com account with the password password. This image never runs that seeder, so the account does not exist at any point. Read the credentials file with sudo:

sudo cat /root/lakasir-credentials.txt

The file (mode 0600, root only) contains the administrator email (lakasir.admin.user), the administrator password (lakasir.admin.pass), the panel URL, and the database credentials. Lakasir signs in by email at /member/login.

To confirm the file's permissions, list the keys it holds and verify that no upstream default account ships, without printing any secret, run:

sudo stat -c '%a %U:%G %n' /root/lakasir-credentials.txt
sudo grep -o '^lakasir\.[a-z.]*=' /root/lakasir-credentials.txt
sudo mariadb -N -B lakasir -e "SELECT COUNT(*) FROM users WHERE email IN ('superadmin@admin.com','admin@example.com');"

The output shows 600 root:root, the seven credential keys, and a final 0 confirming that no upstream default account exists.

You can also verify the credential round trip from the VM's own shell. This command reads the per-VM administrator credentials and confirms that the rotated password verifies against the bcrypt hash stored on the users row. This is exactly what Lakasir's authentication guard checks:

ADMIN_USER=$(sudo grep '^lakasir.admin.user=' /root/lakasir-credentials.txt | cut -d= -f2-)
ADMIN_PASS=$(sudo grep '^lakasir.admin.pass=' /root/lakasir-credentials.txt | cut -d= -f2-)
HASH=$(sudo mariadb -N -B lakasir -e "SELECT password FROM users WHERE email='$ADMIN_USER';") HH="$HASH" PP="$ADMIN_PASS" php -r 'echo password_verify(getenv("PP"),getenv("HH")) ? "admin password verifies -> OK\n" : "verify failed\n";'

The output shows admin password verifies -> OK.

Step 6 - Sign in to the POS

Browse to https://<vm-public-ip>/member and sign in with the administrator email and password from the credentials file.

The image ships a per-VM self-signed certificate, so your browser shows a one-time certificate warning on the first visit. Click through it, or install your own domain certificate into /etc/nginx/ssl/.

After you sign in, the dashboard shows today's revenue, sales and discount totals, expiring stock and the best-selling products. A new instance shows zeros, because the image ships with no demo inventory or sales history.

Step 7 - Add a category and your first product

Lakasir requires every product to belong to a category, so create the category first. In the left-hand navigation, choose Category, then New Category. Give it a name such as Beverages, and save.

Now choose Product, then New Product. Fill in the name, the category you just created, the stock quantity, the unit (for example pcs), the initial and selling prices, and the product Type. You can leave the SKU blank, and Lakasir generates one. Save, and the product appears in the catalogue.

Step 8 - Take your first sale

Choose POS in the navigation to open the cashier screen. Your products appear as tiles that you can filter by category and search by name or SKU. The orange button on the right of the screen opens the barcode scanner for a USB or camera scanner.

Tap the + on a product tile, set the quantity, and choose Add to Cart. The tile is marked as Added, and the cart bar along the bottom of the screen shows the running item count and total.

Tap the cart bar to review the sale. The cart shows each line with quantity controls, then the subtotal, any discount, the member (if you attach one), the tax and the payable total. Choose Continue Payment to go to the payment step. Pick a payment method, for example the Cash method that ships with the image, and complete the sale.

Completed sales appear under Selling History and feed the dashboard and the reports under Report.

Step 9 - Confirm the version and the stack

Check the Laravel, Lakasir, PHP and MariaDB versions:

sudo -u www-data php /var/www/lakasir/artisan --version cat /var/www/lakasir/version.txt php -v | head -1 mariadb --version

The output shows Laravel Framework 11.51.0, the Lakasir release 1.1.11, PHP 8.4 and the MariaDB version. You can also confirm that the permission catalogue was generated and that a payment method is ready to take a sale:

sudo mariadb -N -B lakasir -e "SELECT CONCAT('roles=',(SELECT COUNT(*) FROM roles),' permissions=',(SELECT COUNT(*) FROM permissions),' payment_methods=',(SELECT COUNT(*) FROM payment_methods));"

The output is a line that reports the role, permission and payment method counts, for example roles=1 permissions=155 payment_methods=1.

First-boot service and security model

The one-shot lakasir-firstboot.service runs After=mariadb.service and Before=nginx.service, so the per-VM credentials and TLS certificate are in place before the first page is served. It writes the credentials file at mode 0600 (root only) and leaves a sentinel file so that it runs exactly once. Check the unit, the certificate and the enabled services:

systemctl status lakasir-firstboot.service --no-pager | head -5 sudo openssl x509 -noout -subject -dates -in /etc/nginx/ssl/lakasir.crt
systemctl is-enabled nginx php8.4-fpm mariadb lakasir-firstboot

The unit reports active (exited) with status=0/SUCCESS, the certificate subject is your VM's own address, and all four units report enabled.

Server components

Installed components, versions and purposes:

Lakasir 1.1.11: point of sale application (Laravel 11 + FilamentPHP 3)

PHP 8.4: application runtime, php8.4-fpm with OPcache

nginx 1.24: HTTPS front end on :443, with :80 redirecting to HTTPS

MariaDB 10.11: application database

Filesystem layout

Paths and their purposes:

/var/www/lakasir: application tree (code, .env, storage, docroot at public/)

/var/www/lakasir/public: nginx document root

/var/lib/mysql: MariaDB data directory

/etc/nginx/ssl: per-VM self-signed TLS certificate and key

/root/lakasir-credentials.txt: per-VM credentials, mode 0600, root only

/usr/local/sbin/lakasir-firstboot.sh: first-boot credential and certificate rotation

/var/lib/sac: first-boot sentinel directory

Administration from the CLI

Run admin tasks with Laravel's artisan as the www-data user. For example, list the available commands:

sudo -u www-data php /var/www/lakasir/artisan list | head -20

Common operations include php artisan cache:clear, php artisan optimize (caches config and routes for production), php artisan optimize:clear (clears those caches) and php artisan app:create-user (adds another standalone user account).

Enabling HTTPS with your own domain

The image already serves HTTPS with a per-VM self-signed certificate. For production, point a real domain at the VM's public IP and open 443/tcp in the NSG. Then replace the self-signed certificate with a trusted one from Let's Encrypt, substituting your own domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.com

After the certificate is issued, set the new address as the application URL in /var/www/lakasir/.env (APP_URL=https://your-domain.com), then run sudo -u www-data php /var/www/lakasir/artisan optimize:clear. The image's trusted host list already accepts your VM's own addresses and its Azure-assigned cloudapp.azure.com name, and it picks up your own domain from APP_URL.

Backup and maintenance

The database lives at /var/lib/mysql. The application tree, including code, docroot and uploaded product images, lives at /var/www/lakasir. For a point-in-time backup, snapshot the OS disk in Azure, or dump the database. The database password is in the credentials file:

sudo mariadb-dump lakasir > lakasir-backup.sql

Keep the OS patched with sudo apt update && sudo apt upgrade. Unattended security upgrades are enabled by default. Restart the whole stack with sudo systemctl restart nginx php8.4-fpm mariadb.

Troubleshooting

The browser shows a certificate warning. The image ships a per-VM self-signed certificate. Click through the warning, or install a domain certificate as described above.

member login -> 400 from a new hostname. The host is not in Laravel's trusted host list. Set APP_URL in /var/www/lakasir/.env to the address you are using, then run sudo -u www-data php /var/www/lakasir/artisan optimize:clear

Sign-in is rejected. You may have read the credentials file before first boot completed. Check systemctl status lakasir-firstboot.service, then read /root/lakasir-credentials.txt again.

The POS shows no products. A new instance ships with no inventory. Create a category, then a product, as described in Step 7.

A page returns HTTP 500. This is an application error. Check sudo tail -50 /var/www/lakasir/storage/logs/laravel.log and sudo journalctl -u php8.4-fpm -n 50

Security recommendations

• Restrict 22/tcp in the NSG to your management network. Expose 443/tcp only to the networks that need the till.
• Replace the per-VM self-signed certificate with a certificate for your own domain before you take real payments.
• After you sign in, rotate the administrator password from User in the panel. Create a separate non-owner account for each cashier under User and Role.
• Keep the OS patched. Unattended security upgrades are enabled by default.
• Back up /var/lib/mysql and /var/www/lakasir regularly, and keep the credentials file safe.

Support

SecureAnyCloud images come with 24/7 support. Contact us by email and chat for help with Lakasir deployment, upgrades, product and inventory setup, payment methods, barcode scanning and thermal printer configuration, roles and permissions, reporting, API integration, performance tuning and database administration.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Lakasir POS on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com