LibreBooking

Prerequisites

• An active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.
• Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. Scale up for busier deployments.
• NSG inbound rules: allow 22/tcp from your management network and 80/tcp (HTTP) from your users.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, choose Create a resource, search the Marketplace for LibreBooking by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:librebooking-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name librebooking \
  --image sac1647283583153:librebooking-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open HTTP to reach the booking calendar and the admin backend:

az vm open-port --resource-group <your-rg> --name librebooking --port 80 --priority 900

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

The three services that back LibreBooking should all report active. The bare root (GET /) redirects to the app under /Web/, and the login page answers HTTP 200 on port 80:

systemctl is-active mariadb php8.3-fpm nginx curl -s -o /dev/null -w 'GET / -> %{http_code} (redirect to /Web/)\n' http://127.0.0.1/ curl -s -o /dev/null -w 'GET /Web/ -> %{http_code} (login page)\n' http://127.0.0.1/Web/

Expected output: three lines of active, then GET / -> 302 and GET /Web/ -> 200. Only nginx on port 80 is exposed. php-fpm runs behind it, and MariaDB listens on loopback (127.0.0.1) only.

Step 5 - Retrieve your administrator password

On the first boot of every VM, a one-shot service (librebooking-firstboot.service) generates credentials that are unique to that VM: a fresh MariaDB password, a fresh administrator (admin) password and a fresh install password. The service installs the application schema, creates the admin account and pins the application to the own address of your VM. No shared or default credentials ship in the image.

sudo cat /root/librebooking-credentials.txt

The file (mode 0600, root only) contains the following values:

• The administrator login (lb.admin.login, which is admin)
• The administrator password (lb.admin.pass)
• The install password (lb.install.password, which protects /Web/install)
• The booking and API URLs

Step 6 - Exercise the RESTful Web Services API

LibreBooking exposes a full REST API at /Web/Services/index.php/, enabled by default in this image. The following commands read the per-VM administrator password from the credentials file, authenticate to obtain a session token, and list the bookable resources:

API=http://127.0.0.1/Web/Services/index.php
PW=$(sudo grep -m1 '^lb.admin.pass=' /root/librebooking-credentials.txt | cut -d= -f2-)
AUTH=$(curl -s -X POST "$API/Authentication/Authenticate" -H 'Content-Type: application/json' \
  -d "{\"username\":\"admin\",\"password\":\"$PW\"}")
TOKEN=$(echo "$AUTH" | jq -r .sessionToken)
USERID=$(echo "$AUTH" | jq -r .userId)
echo "authenticated: userId=$USERID" curl -s -H "X-Booked-SessionToken: $TOKEN" -H "X-Booked-UserId: $USERID" "$API/Resources/" \
  | jq -c '.resources[] | {resourceId, name}'

Expected output: authenticated: userId=1, then one JSON line per bookable resource (the two sample Conference Rooms). Authentication returns a sessionToken. Pass it in the X-Booked-SessionToken and X-Booked-UserId headers on every subsequent call.

SecureAnyCloud also ships a one-shot end-to-end check. It authenticates, creates a reservation, reads it back, deletes it, and confirms that an unauthenticated create is rejected with HTTP 401:

sudo /usr/local/sbin/librebooking-roundtrip.sh

Expected output: ROUNDTRIP_OK ref=... resource=1. This proves that the create and read-back reservation round trip works end to end and that unauthenticated writes are refused.

Step 7 - Sign in to the web interface

Browse to http://<vm-public-ip>/. It redirects to /Web/. Sign in with the login admin and the password from the credentials file.

After you sign in, you land on the dashboard. It shows your announcements and your upcoming and past reservations.

Step 8 - Book a resource and manage your resources

Open Schedule to see the booking calendar, a weekly grid of reservable time slots across your resources. Click a slot to create a reservation, and choose the resource, date, time, participants and any accessories. Reservations you make appear on the calendar and on your dashboard.

Two sample resources (Conference Room 1 and Conference Room 2) ship on the default schedule, so the calendar is usable immediately. Manage them from Application Management > Resources. There you can add resources, set schedules and capacities, require approval, apply quotas, and grant permissions to groups and users.

Step 9 - Confirm the version and the security model

echo -n 'PHP : '; php -r 'echo PHP_VERSION, "\n";'
echo -n 'schema : dbversion ';
sudo mysql -N -e 'SELECT version_number FROM librebooking.dbversion ORDER BY CAST(version_number AS DECIMAL(4,1)) DESC LIMIT 1'
sudo mysql -N -e "SELECT CONCAT('admin account: ', username, ' (', IF(password='70f3e748c6801656e4aae9dca6ee98ab137d952c','UPSTREAM DEFAULT - would be a problem','per-VM rotated - good'), ')') FROM librebooking.users;"

Expected output: PHP 8.3.x, the schema version, and admin account: admin (per-VM rotated - good).

A fresh LibreBooking install normally ships a well-known default administrator (admin / password). This image never ships that account. The account is created fresh on first boot with a password unique to your VM, and the upstream default password hash is absent.

Step 10 - Add a custom domain and enable HTTPS

Point a DNS A record at the public IP of your VM. LibreBooking auto-detects its public URL from the request, so when you serve it over your domain, the login and API links follow. To enable HTTPS, install a certificate with Certbot and add an nginx TLS server block:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot obtains and installs the certificate and reloads nginx. To pin a fixed public URL, set $conf['settings']['script.url'] in /var/www/librebooking/config/config.php to https://your-domain.example.com/Web.

Step 11 - Maintenance

• Application logs: LibreBooking writes to /var/log/librebooking/. nginx and php-fpm log under /var/log/nginx/ and /var/log/php8.3-fpm.log.
• Database backups: back up the librebooking MariaDB database with sudo mysqldump --single-transaction librebooking > librebooking-$(date +%F).sql.
• OS updates: unattended-upgrades is enabled, so security updates are applied automatically. Apply all updates with sudo apt-get update && sudo apt-get -y dist-upgrade.
• Config: application settings live in /var/www/librebooking/config/config.php. Self-registration is disabled and the API is enabled by default.

Security model

• No default credentials. The admin account and the MariaDB user are created on first boot with passwords unique to each VM, written to /root/librebooking-credentials.txt (mode 0600, root only). The upstream default admin / password login never ships.
• Loopback database. MariaDB binds to 127.0.0.1 only. Nothing but nginx on port 80 is exposed publicly.
• Self-registration disabled and install protected. Open self-registration is turned off, and /Web/install is protected by a per-VM install password.
• Rotate the administrator password from My Account after your first sign-in, and restrict 22/tcp to your management network.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us for help with deployment, resources and schedules, groups, roles and quotas, approval workflows, email and ICS notifications, the RESTful API, user management, database tuning, TLS and scaling.

Deploy on Azure

Launch LibreBooking on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Connecting to your instance

Connect over SSH as the default login user for the operating-system variant that you launched. For LibreBooking on Ubuntu 24.04, the SSH login user is ubuntu.

ssh ubuntu@<instance-public-ip>

Prerequisites

• An active AWS account, an EC2 key pair, and a VPC with a public subnet in the target region.
• m5.large (2 vCPU / 8 GiB RAM) is a good starting point. Scale up for busier deployments.
• Security group inbound rules: allow 22/tcp from your management network and 80/tcp (HTTP) from your users.

Step 1 - Subscribe on AWS Marketplace

Open the AWS Marketplace page of the product, choose Continue to Subscribe, accept the terms, and then choose Continue to Configuration. Select the fulfillment option (the LibreBooking AMI) and your Region, and then choose Continue to Launch.

Step 2 - Launch the instance

Choose Launch through EC2, or use Launch an instance from AMI in the EC2 console. Pick an instance type (m5.large or larger), your key pair, and a security group that allows SSH (22) from your management network and HTTP (80) from your users.

The image declares a dedicated data volume for the MariaDB database in addition to the OS root volume. Keep both volumes when you launch. Then choose Launch.

Step 3 - Connect to your instance

ssh ubuntu@<instance-public-ip>

Step 4 - Confirm the services are running

The three services that back LibreBooking should all report active. The bare root (GET /) redirects to the app under /Web/, and the login page answers HTTP 200 on port 80:

systemctl is-active mariadb php8.3-fpm nginx curl -s -o /dev/null -w 'GET / -> %{http_code} (redirect to /Web/)\n' http://127.0.0.1/ curl -s -o /dev/null -w 'GET /Web/ -> %{http_code} (login page)\n' http://127.0.0.1/Web/

Expected output: three lines of active, then GET / -> 302 and GET /Web/ -> 200. Only nginx on port 80 is exposed. php-fpm runs behind it, and MariaDB listens on loopback (127.0.0.1) only.

Step 5 - Confirm the database is on its own data volume

The MariaDB data directory lives on a dedicated EBS volume that is independently resizable and separate from the OS disk. You can grow or snapshot your reservation database on its own:

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/mysql

Expected output: /var/lib/mysql is its own ext4 filesystem on a separate device from the OS root.

Step 6 - Retrieve your administrator password

On the first boot of every instance, a one-shot service (librebooking-firstboot.service) generates credentials that are unique to that instance: a fresh MariaDB password, a fresh administrator (admin) password and a fresh install password. The service installs the application schema, creates the admin account and pins the application to the own public address of your instance. No shared or default credentials ship in the image.

sudo cat /root/librebooking-credentials.txt

The file (mode 0600, root only) contains the following values:

• The administrator login (lb.admin.login, which is admin)
• The administrator password (lb.admin.pass)
• The install password (lb.install.password, which protects /Web/install)
• The booking and API URLs

Step 7 - Exercise the RESTful Web Services API

LibreBooking exposes a full REST API at /Web/Services/index.php/, enabled by default in this image. The following commands read the per-instance administrator password from the credentials file, authenticate to obtain a session token, and list the bookable resources:

API=http://127.0.0.1/Web/Services/index.php
PW=$(sudo grep -m1 '^lb.admin.pass=' /root/librebooking-credentials.txt | cut -d= -f2-)
AUTH=$(curl -s -X POST "$API/Authentication/Authenticate" -H 'Content-Type: application/json' \
  -d "{\"username\":\"admin\",\"password\":\"$PW\"}")
TOKEN=$(echo "$AUTH" | jq -r .sessionToken)
USERID=$(echo "$AUTH" | jq -r .userId)
echo "authenticated: userId=$USERID" curl -s -H "X-Booked-SessionToken: $TOKEN" -H "X-Booked-UserId: $USERID" "$API/Resources/" \
  | jq -c '.resources[] | {resourceId, name}'

Expected output: authenticated: userId=1, then one JSON line per bookable resource (the two sample Conference Rooms). Authentication returns a sessionToken. Pass it in the X-Booked-SessionToken and X-Booked-UserId headers on every subsequent call.

SecureAnyCloud also ships a one-shot end-to-end check. It authenticates, creates a reservation, reads it back, deletes it, and confirms that an unauthenticated create is rejected with HTTP 401:

sudo /usr/local/sbin/librebooking-roundtrip.sh

Expected output: ROUNDTRIP_OK ref=... resource=1. This proves that the create and read-back reservation round trip works end to end and that unauthenticated writes are refused.

Step 8 - Sign in to the web interface

Browse to http://<instance-public-ip>/. It redirects to /Web/. Sign in with the login admin and the password from the credentials file.

After you sign in, you land on the dashboard. It shows your announcements and your upcoming and past reservations.

Step 9 - Book a resource and manage your resources

Open Schedule to see the booking calendar, a weekly grid of reservable time slots across your resources. Click a slot to create a reservation, and choose the resource, date, time, participants and any accessories. Reservations you make appear on the calendar and on your dashboard.

Two sample resources (Conference Room 1 and Conference Room 2) ship on the default schedule, so you can begin immediately. Manage them from Application Management > Resources. There you can add resources, set schedules and capacities, require approval, apply quotas, and grant permissions to groups and users.

Step 10 - Confirm the version and the security model

echo -n 'PHP : '; php -r 'echo PHP_VERSION, "\n";'
echo -n 'schema : dbversion ';
sudo mysql -N -e 'SELECT version_number FROM librebooking.dbversion ORDER BY CAST(version_number AS DECIMAL(4,1)) DESC LIMIT 1'
sudo mysql -N -e "SELECT CONCAT('admin account: ', username, ' (', IF(password='70f3e748c6801656e4aae9dca6ee98ab137d952c','UPSTREAM DEFAULT - would be a problem','per-instance rotated - good'), ')') FROM librebooking.users;"

Expected output: PHP 8.3.x, the schema version, and admin account: admin (per-instance rotated - good).

A fresh LibreBooking install normally ships a well-known default administrator (admin / password). This image never ships that account. The account is created fresh on first boot with a password unique to your instance, and the upstream default password hash is absent.

Step 11 - Add a custom domain and enable HTTPS

Point a DNS A record at the public IP or Elastic IP of your instance. LibreBooking auto-detects its public URL from the request, so when you serve it over your domain, the login and API links follow. To enable HTTPS, install a certificate with Certbot and add an nginx TLS server block:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot obtains and installs the certificate and reloads nginx. To pin a fixed public URL, set $conf['settings']['script.url'] in /var/www/librebooking/config/config.php to https://your-domain.example.com/Web.

Step 12 - Maintenance

• Application logs: LibreBooking writes to /var/log/librebooking/. nginx and php-fpm log under /var/log/nginx/ and /var/log/php8.3-fpm.log.
• Database backups: back up the librebooking MariaDB database with sudo mysqldump --single-transaction librebooking > librebooking-$(date +%F).sql, or snapshot the dedicated data volume with EBS snapshots or AWS Backup.
• OS updates: unattended-upgrades is enabled, so security updates are applied automatically. Apply all updates with sudo apt-get update && sudo apt-get -y dist-upgrade.
• Config: application settings live in /var/www/librebooking/config/config.php. Self-registration is disabled and the API is enabled by default.

Security model

• No default credentials. The admin account and the MariaDB user are created on first boot with passwords unique to each instance, written to /root/librebooking-credentials.txt (mode 0600, root only). The upstream default admin / password login never ships.
• Loopback database on a dedicated volume. MariaDB binds to 127.0.0.1 only, and its data directory lives on a dedicated EBS volume. Nothing but nginx on port 80 is exposed publicly.
• Self-registration disabled and install protected. Open self-registration is turned off, and /Web/install is protected by a per-instance install password.
• Rotate the administrator password from My Account after your first sign-in, and restrict 22/tcp to your management network.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us for help with deployment, resources and schedules, groups, roles and quotas, approval workflows, email and ICS notifications, the RESTful API, user management, database tuning, TLS and scaling.

Deploy on AWS

Launch LibreBooking on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com