Lunar

Prerequisites

Before you deploy, you need an active Azure subscription, an SSH key pair, and a virtual network with a subnet in the target region.

Standard_B2ms (2 vCPU, 8 GiB RAM) is a good starting point. Scale up for larger catalogs or heavier traffic.

Configure the network security group (NSG) inbound rules as follows:

• Allow 22/tcp from your management network.
• Allow 443/tcp (HTTPS) from your customers.
• Allow 80/tcp from your customers. It redirects to HTTPS.

Step 1 - Deploy from the Azure Marketplace

Find Lunar on Ubuntu 24.04 LTS by SecureAnyCloud in the Azure Marketplace. Choose Get It Now, then Create.

Pick your resource group, region and VM size (Standard_B2ms or larger). Provide your SSH public key. In the networking step, allow inbound 443/tcp and 80/tcp. Then review and create the VM.

Step 2 - Or deploy with the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:lunar-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name lunar \
  --image sac1647283583153:lunar-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name lunar --port 443 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

The three services that back Lunar should all report active. The storefront answers HTTP 200 over HTTPS, and the admin sign-in page loads. The plain HTTP port redirects to HTTPS.

Run:

systemctl is-active nginx php8.3-fpm mariadb curl -ks -o /dev/null -w 'storefront https -> %{http_code}\n' https://127.0.0.1/ curl -ks -o /dev/null -w 'admin login -> %{http_code}\n' https://127.0.0.1/lunar/login curl -s -o /dev/null -w 'http redirect -> %{http_code}\n' http://127.0.0.1/

The expected output is three lines of active, then storefront https -> 200, admin login -> 200 and http redirect -> 301.

Step 5 - Retrieve your administrator credentials

On the first boot of every VM, a one-shot service (lunar-firstboot.service) generates credentials that are unique to that VM. These are a fresh Laravel application key, a fresh MariaDB password, and a fresh administrator email and password. The service also generates a per-VM self-signed TLS certificate and sets the VM's own address as the application URL.

No shared or default credentials ship in the image. The well-known Lunar starter default admin@lunarphp.io / password is neutralised at build time and does not authenticate.

Read the credentials file:

sudo cat /root/lunar-credentials.txt

The file (mode 0600, root only) contains the administrator email (lunar.admin.user), the administrator password (lunar.admin.pass), the storefront and admin URLs, and the database credentials. Lunar signs in by email at /lunar/login.

You can verify the credentials from the VM's own shell. The following command reads the per-VM administrator credentials. It confirms that the rotated password verifies against the stored bcrypt hash on the lunar_staff row, and that the account carries admin rights:

ADMIN_USER=$(sudo grep '^lunar.admin.user=' /root/lunar-credentials.txt | cut -d= -f2-)
ADMIN_PASS=$(sudo grep '^lunar.admin.pass=' /root/lunar-credentials.txt | cut -d= -f2-)
HASH=$(sudo mariadb -N -B lunar -e "SELECT password FROM lunar_staff WHERE email='$ADMIN_USER';") HH="$HASH" PP="$ADMIN_PASS" php -r 'echo password_verify(getenv("PP"),getenv("HH")) ? "admin password verifies -> OK\n" : "verify failed\n";'

Step 6 - Sign in to the admin panel

Browse to https://<vm-public-ip>/lunar. Sign in with the administrator email and password from the credentials file.

The image ships a per-VM self-signed certificate, so your browser shows a one-time certificate warning on your first visit. Accept it, or install your own domain certificate into /etc/nginx/ssl/.

After you sign in, you land on the dashboard. It summarises orders, sales and reporting for your store.

Step 7 - Manage your catalog

Use the admin panel's Catalog menu to manage Products, Product Types, Brands and Collection Groups. The store ships with a demo catalog, so you can explore a populated storefront immediately.

Choose Catalog > Products to see the seeded products. Choose New Product to add your own, and set the product type, attributes, pricing, inventory and images.

Use Collection Groups to build your storefront navigation. Use Sales > Orders, Customers and Discounts to run the store.

Step 8 - Confirm the version and the stack

cd /var/www/lunar && composer show lunarphp/lunar | grep versions
sudo -u www-data php /var/www/lunar/artisan --version php -v | head -1

The output shows lunarphp/lunar 1.3.0, the Laravel framework version, and PHP 8.3. Lunar runs as a Laravel application on PHP 8.3 with OPcache, served by nginx over HTTPS with php-fpm and backed by MariaDB.

First-boot service and security model

A one-shot lunar-firstboot.service runs After=mariadb.service and Before=nginx.service. The per-VM credentials and TLS certificate are therefore in place before the first page is served.

The service writes the credentials file at mode 0600 (root only) and drops a sentinel so that it runs exactly once.

systemctl status lunar-firstboot.service --no-pager | head -6 sudo stat -c '%a %U:%G %n' /root/lunar-credentials.txt

Administration from the CLI

Run admin tasks with Laravel's artisan as the www-data user. For example, list the available commands:

sudo -u www-data php /var/www/lunar/artisan list | head -30

Common operations include:

• php artisan cache:clear
• php artisan optimize caches config and routes for production
• php artisan lunar:search:index rebuilds the storefront search index
• php artisan queue:work runs the queue worker, if you move email and indexing to a queue

Enabling HTTPS with your own domain

The image already serves HTTPS with a per-VM self-signed certificate. For production, point a real domain at the VM's public IP and open 443/tcp in the NSG. Then replace the self-signed certificate with a trusted one from Let's Encrypt, substituting your own domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.com

After the certificate is issued, set the new address as the application URL in /var/www/lunar/.env (APP_URL=https://your-domain.com). Then run sudo -u www-data php /var/www/lunar/artisan optimize:clear.

Backup and maintenance

The database lives at /var/lib/mysql. The application tree (code, docroot and uploaded media) lives at /var/www/lunar.

Snapshot the OS disk in Azure for a point-in-time backup. Alternatively, dump the database. The database password is in the credentials file:

sudo mariadb-dump lunar > lunar-backup.sql

Keep the OS patched with sudo apt update && sudo apt upgrade. Unattended security upgrades are enabled by default.

The stack restarts cleanly with sudo systemctl restart nginx php8.3-fpm mariadb.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email and chat for help with:

• Lunar deployment and upgrades
• Catalog and storefront configuration
• Payment and shipping methods
• Tax and pricing setup
• API integration
• Performance tuning and database administration

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Lunar on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com