Deployment guide

Live Helper Chat

Overview

Live Helper Chat is a mature, open source live chat and helpdesk platform. It adds a real-time chat widget to your website and gives your team a full operator console to answer it. Visitors start a conversation from an embeddable widget. Operators handle chats from a browser-based agent panel with canned responses, departments and transfers, chat history, visitor details, file sharing and offline messages.

A REST API, webhooks and a chat bot layer let you plug in your own automation or a third-party assistant. Everything is stored in a database on the instance itself, so your customer conversations stay under your control.

The SecureAnyCloud image ships Live Helper Chat 4.87v, served by nginx and PHP 8.3 FPM on a hardened Ubuntu 24.04 LTS base that is patched at build time. A bundled local MariaDB server makes the appliance complete and useful on its own. Live Helper Chat runs behind an nginx reverse proxy on port 80, and the bundled MariaDB listens only on the loopback interface (127.0.0.1:3306).

The first boot of every VM generates a unique operator password. The platform detects the request host automatically, so the operator panel and the visitor widget work at whatever public IP or domain you point at the VM.

What you get:

Live Helper Chat 4.87v served by nginx and PHP 8.3 FPM, managed by systemd
A bundled MariaDB server holding the Live Helper Chat database, already installed with the full, up-to-date schema
The operator panel served on :80 at /index.php/site_admin, and an embeddable visitor chat widget
A per-minute systemd timer running Live Helper Chat's own cron for offline message mail, online status timeouts and bot scheduling
A per-VM operator password generated on first boot and recorded in a root-only file
No shipped default login: the operator is created with a unique per-VM secret, and no known or blank credential authenticates
A hardened Ubuntu 24.04 LTS base, patched at build time, with unattended security upgrades enabled
24/7 SecureAnyCloud support

Before you begin

You need an Azure subscription, permission to create a virtual machine, and an SSH key pair so that you can retrieve the generated operator password.

Open inbound port 22 (SSH) and port 80 (HTTP) on the VM's network security group. For production, also open port 443 and put a TLS certificate in front of the platform (see Production hardening below).

Deploy from the Azure Marketplace

In the Azure portal, search the Marketplace for Live Helper Chat on Ubuntu 24.04 LTS by SecureAnyCloud and select Create.
Choose your subscription, resource group and region.
Pick a VM size. Standard_B2s (2 vCPU, 4 GiB) is a comfortable starting point for a small team. Scale up for higher chat volumes.
Under Administrator account, select SSH public key, set the username to azureuser, and paste your public key.
Under Inbound port rules, allow SSH (22) and HTTP (80).
Review and create the VM. When deployment finishes, note the VM's public IP address.

Deploy from the Azure CLI

Alternatively, create the VM from the command line. Replace the image URN, resource group and SSH key path with values that match your environment:

az vm image terms accept --urn sac1647283583153:live-helper-chat-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-resource-group \
  --name live-helper-chat \
  --image sac1647283583153:live-helper-chat-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard
az vm open-port --resource-group my-resource-group --name live-helper-chat --port 80 --priority 900

Retrieve your operator password

Live Helper Chat ships no default login. On the first boot of every VM, a one-shot service generates a unique operator password and writes it to a root-only file. SSH in as azureuser to read it:

ssh azureuser@<vm-public-ip>

Confirm that the platform services are running. nginx serves the platform on port 80, PHP 8.3 FPM runs the application, and MariaDB holds the data:

systemctl is-active nginx php8.3-fpm mariadb live-helper-chat-firstboot

The bundled MariaDB is bound to the loopback interface only, so it is never reachable from the network. Only nginx on port 80 is public. Check the listeners:

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g'

Now read the generated credentials. The file records the operator username, the per-VM password and the URLs:

sudo cat /root/live-helper-chat-credentials.txt

The password is unique to this VM. Keep it somewhere safe.

Sign in to the operator panel

Open the operator panel in your browser at http://<vm-public-ip>/index.php/site_admin. Sign in with the username admin and the password from the credentials file.

The operator dashboard

After you sign in, you land on the operator dashboard, the live console your team works from. It shows online operators, online visitors browsing your site in real time, department statistics, and panels for pending, active, group and bot chats. Incoming chats appear here for an operator to accept.

Managing chats

The Chats area lists your chat history. You can search by chat ID, visitor nickname, e-mail, phone, department, operator or user group. From here you review past conversations, reopen a chat, download transcripts and manage what your team has handled.

Embed the visitor chat widget on your site

To put the chat widget on your own website, open Settings > System configuration > Embed code in the operator panel. Choose your options and copy the generated JavaScript snippet into your site's pages.

Live Helper Chat detects the request host automatically. The widget talks back to whichever public IP or domain you use to reach the VM, so you need no base URL configuration to get started.

Configuration and administration

Use the System configuration area to administer the platform. It covers time zone and mail settings, e-mail templates, languages, GEO detection, synchronization and sound, operators and groups, roles and permissions, password requirements, audit logs, and the embed code and live help configuration for the visitor widget.

Verify the deployment

nginx serves an unauthenticated health endpoint on port 80 for load balancer probes:

curl -sI http://127.0.0.1/healthz | head -1

The operator panel responds on port 80 and redirects an unauthenticated request to the sign-in page:

curl -s -o /dev/null -w 'operator panel /index.php/site_admin -> HTTP %{http_code}\n' http://127.0.0.1/index.php/site_admin

The image ships a security round-trip check. It proves that the per-VM operator password authenticates, that a blank password and common weak guesses are rejected, and that the account is enabled:

sudo bash /usr/local/sbin/live-helper-chat-cred-roundtrip.sh

Run a quick platform summary to confirm that the schema is complete and the platform is serving:

curl -s -o /dev/null -w 'healthz -> HTTP %{http_code}\n' http://127.0.0.1/healthz
sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT((SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='livehelperchat'),' tables, ',(SELECT COUNT(*) FROM livehelperchat.lh_users),' operator(s), ',(SELECT COUNT(*) FROM livehelperchat.lh_departament),' department(s)')"

Where your data lives

Live Helper Chat's application code lives under /var/www/livehelperchat/lhc_web. The platform configuration is in settings/settings.ini.php, which is protected from the web and holds the loopback database password.

All of your chats, operators, departments, configuration and uploaded files are stored in the bundled MariaDB database livehelperchat and under lhc_web/var. Both are on the VM's OS disk and captured into the image. The database engine is bound to 127.0.0.1 only. For on-box database maintenance, sudo mariadb connects as the local root user over a Unix socket with no password.

Production hardening

Use your own domain and TLS. Point a DNS record at the VM's public IP, then front Live Helper Chat with HTTPS (for example an Azure Application Gateway, a load balancer or a TLS-terminating reverse proxy). Open port 443 on the network security group.
Restrict access. Keep SSH (22) limited to trusted IP ranges in the network security group.
Back up the database. Schedule regular dumps of the livehelperchat database, for example with mysqldump, and copy them off the VM.
Scale for volume. Increase the VM size. For very high chat volumes, review Live Helper Chat's optional Node.js realtime server in the project documentation.
Keep it patched. The base ships with unattended security upgrades enabled. Keep them on.

Support

SecureAnyCloud builds and maintains this image and provides 24/7 support. If you need help deploying or operating Live Helper Chat on Azure, contact SecureAnyCloud support through secureanycloud.com.

Deploy on Azure

Launch Live Helper Chat on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs Live Helper Chat behind nginx with PHP FPM 8.3 and OPcache enabled. It includes the pdo_mysql, mbstring, curl, gd, intl, xml, zip and bcmath extensions that Live Helper Chat needs. A bundled MariaDB provides the database on the same instance, bound to the loopback interface only. Live Helper Chat's own cron runs every minute through a systemd timer. It sends offline message mail, times out stale online sessions and runs scheduled bots.

The image ships with Live Helper Chat already installed and its database schema in place. The first request lands directly on the operator sign-in page, with no setup wizard to work through.

The first boot of every deployed instance generates a fresh operator password that is unique to that instance. It also re-mints the internal MariaDB maintenance credential for that instance. Two instances launched from the same Amazon Machine Image never share credentials. The operator password is written to /root/live-helper-chat-credentials.txt with mode 0600, so only the root user can read it.

Live Helper Chat detects the request host dynamically. The operator panel and the visitor chat widget work at whatever IP address or domain you reach the instance on, with no base URL to configure first. Realtime chat works out of the box using the built-in AJAX polling. The optional Node.js socket server for very high chat volumes is an opt-in upgrade described later in this guide.

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your operators and website visitors will reach Live Helper Chat on
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Live Helper Chat. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your operators and visitors use. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass.

Launch the instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud Live Helper Chat Marketplace AMI into an existing subnet and security group. Replace the values in angle brackets as follows:

Replace <ami-id> with the AMI ID shown on the Marketplace listing.
Replace <key-name> with your EC2 key pair name.
Replace <subnet-id> with your subnet ID.
Replace <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=live-helper-chat-01}]'

On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and retrieve the initial credentials

Connect over SSH with the key pair you selected and the public IP address from step 2. The SSH login user depends on the operating system of the AMI variant you launched. For Live Helper Chat 4.87v on Ubuntu 24.04, the login user is ubuntu.

Connect with ssh -i <path-to-key.pem> ubuntu@<instance-public-ip>, substituting your key path and the instance's public IP address.

First boot writes the per-instance operator password to a root-only file. Read it with:

sudo cat /root/live-helper-chat-credentials.txt

The file lists the operator panel URL, the operator username (admin) and the password. Store the operator password in your password manager, and treat this file as sensitive.

Verify that the stack is running

Three systemd units serve Live Helper Chat. Confirm that they are active:

systemctl is-active nginx php8.3-fpm mariadb

Each line returns active. Confirm that nginx is answering with its unauthenticated health endpoint, which returns ok:

curl -s http://127.0.0.1/healthz

The live PHP application serves the operator panel. Once the app is up, this command returns an HTTP status in the 200 or 302 range:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/index.php/site_admin

Live Helper Chat's cron sends offline message mail and times out stale sessions. It runs every minute through a systemd timer. Confirm that the timer is enabled. It starts automatically shortly after boot:

systemctl is-enabled live-helper-chat-cron.timer

Sign in to the operator panel

Browse to http://<instance-public-ip>/index.php/site_admin to reach the operator panel sign-in page. Sign in with the username admin and the password from /root/live-helper-chat-credentials.txt.

After you sign in, you land on the operator dashboard. It shows online operators, online visitors, and the group, pending, active and bot chat queues. The left navigation gives you Dashboard, Chats and Mails, Settings and Modules.

Change the operator password and set your details

The first-boot password is unique to your instance, but you should still set your own. In the operator panel, open your operator profile from the top right. Set your name and a personal email address, and change the password to one you control.

Live Helper Chat stores operator passwords as bcrypt hashes.

Add the visitor chat widget to your website

The visitor chat widget on your own website is the heart of Live Helper Chat. In the operator panel, open Settings, then the embed or instructions section, and copy the generated widget code.

Paste the code into the HTML of your site, just before the closing </body> tag, on every page where you want the chat button to appear. Visitors then see the chat widget and can start a conversation, which arrives in the operator panel.

Create departments, operators and canned messages

Under Settings, you can create departments to route chats to the right team. You can also add more operators and assign them to departments, and write canned messages for fast, consistent replies.

Manage operators under System configuration > Users, where you add accounts and set departments, permissions and languages.

Set the production site address

When you front the instance with your own domain, set the production site address in Settings > Configuration. This makes email links and invitations point at your domain.

The operator panel and the visitor widget follow the request host automatically, so this setting only affects generated links.

Add the optional high-scale realtime server

The image serves realtime chat with Live Helper Chat's built-in AJAX polling. Polling is reliable for typical chat volumes and needs no extra services.

For very high volumes (of the order of tens of thousands of chats a day), Live Helper Chat offers an optional Node.js socket server. Installing it is an opt-in upgrade. Follow the "Node.js helper" section of the Live Helper Chat documentation. The appliance does not need it to work.

Enable HTTPS with Let's Encrypt

For production use, point a domain name at the instance's public IP address and enable HTTPS. Install certbot and request a certificate:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot edits the nginx site to serve HTTPS and sets up automatic renewal. When it completes, browse to https://your-domain.example.com/index.php/site_admin to reach the operator panel over TLS.

Back up and maintain the instance

The Live Helper Chat database lives in MariaDB on the instance. Take regular logical backups with mysqldump:

sudo mysqldump --protocol=socket livehelperchat > /root/livehelperchat-backup.sql

For a full point-in-time backup, snapshot the instance's EBS volume from the AWS console or CLI.

Keep the operating system patched with sudo apt-get update && sudo apt-get upgrade. Manage the services with systemctl (nginx, php8.3-fpm, mariadb).

Storage layout

Live Helper Chat's application code and writable state live under /var/www/livehelperchat. The MariaDB data directory is at /var/lib/mysql. Both are on the instance's root EBS volume, which is captured into the image so that every instance boots a ready-to-use chat platform.

If you need more space, resize the root volume from the EC2 console, then grow the filesystem.

Screenshots

The operator sign-in page:

The operator dashboard:

The visitor chat widget:

Operator management:

Support

SecureAnyCloud images come with 24/7 technical support by email and chat. We help with Live Helper Chat deployment, upgrades, the visitor chat widget embed, departments and routing, canned messages and chat bots, the optional high-scale Node.js realtime server, email configuration and database administration.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Live Helper Chat on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS