Mapbender

Search the Azure Marketplace for Mapbender Web GIS on Ubuntu 24.04 LTS by SecureAnyCloud and select Create.

Choose your subscription and resource group, a region, and the recommended size Standard_B2s (2 vCPU, 4 GB).

Set the administrator username to azureuser and provide your SSH public key.

On the Networking tab, allow inbound port 80 (HTTP) and port 22 (SSH).

Review and create the VM. When the VM is running, note its public IP address.

RG="webgis-prod"; LOCATION="eastus"; VM_NAME="mapbender" IMAGE_URN="sac1647283583153:mapbender-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:mapbender-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 80 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

On first boot, the image generates this VM's application secret, database password, JWT passphrase and keypair. It builds the database schema and the demo map applications, and rotates the root super administrator to a unique password. It then opens the bootstrap gate and starts the web server. Finally, it verifies that the new credentials work and root/root is rejected, and writes /root/mapbender-credentials.txt. This completes within a minute or two.

SSH in as azureuser and read the details:

sudo cat /root/mapbender-credentials.txt

The file is mode 0600 and owned by root, so only a privileged user can read it. It contains the portal URL, the super administrator username (root), email address and password, and the database name, user and password.

All three services should report active. The ss command confirms that the portal is on port 80 while PostgreSQL is bound to loopback only. The response headers carry no server version banner.

systemctl is-active postgresql.service php8.3-fpm.service nginx.service php -r 'echo "PHP ".PHP_VERSION."\n";'
sudo -u postgres psql -tAc "SELECT 'PostgreSQL '||current_setting('server_version')"
sudo -u postgres psql -d mapbender -tAc "SELECT 'PostGIS '||extversion FROM pg_extension WHERE extname='postgis'" nginx -v ss -tlnp | grep -E ':(80|5432) ' | sed 's/users:.*//' | sort curl -sI http://127.0.0.1/user/login | head -4

Browse to http://<your-server-ip>/user/login. Sign in with the username root and the password from your credentials file.

After you sign in, open the user menu (top right, Logged in as: root). Go to Security, then Users, then root, and set your own password. You can also do it from the command line at any time:

cd /var/www/mapbender/application
sudo -u www-data php bin/console fom:user:resetroot --username=root --password='<new-password>' --email=you@example.com --silent

The image ships three ready-made demo applications. Open Mapbender Demo from the backend, or browse directly to http://<your-server-ip>/application/mapbender_user_yml.

An OpenLayers map renders immediately with an OpenStreetMap base map, a layer tree, and elements for feature info, legend, search, print, measure and more. This proves the whole stack is working end to end.

The backend is served at / once you are signed in as an administrator. The Applications page lists every map application, with actions to view, edit, copy and export it. A New Application button lets you build your own.

Go to Sources, select Add source, and paste the GetCapabilities URL of a WMS or WFS service that you control. Mapbender loads its capabilities and adds it to the repository, ready to drop into any application.

The bundled applications already reference example WMS sources, so you can see how a registered source is used. When an upstream service changes, use the reload action on the source's card to refresh its capabilities.

From Applications, select New Application. Give it a title and URL slug and pick a template. Then add a layerset built from your registered sources, and drop in the elements you want (layer tree, feature info, search, print).

Publish the application. It is then reachable at http://<your-server-ip>/application/<your-slug>.

A fresh appliance sends mail to a null transport. To enable password reset and notifications, point Mapbender at your SMTP server. Add a MAILER_DSN line to .env.local and clear the cache:

cd /var/www/mapbender/application
sudo sed -i 's#^MAILER_DSN=.*#MAILER_DSN=smtp://user:pass@<your-smtp-host>:587#' .env.local
sudo -u www-data php bin/console cache:clear

Point an A record at your VM's public IP address. Mapbender builds absolute URLs from the request Host header, so no configuration change is needed for the new hostname. Then install a certificate with Certbot:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d maps.example.com --redirect --agree-tos -m you@example.com

Certbot edits the nginx site in place and reloads it. Renewal is handled automatically by the packaged timer.

nginx and php8.3-fpm are each gated on the bootstrap marker /var/lib/sac/data/mapbender-bootstrap-ready. First boot creates the marker only after the application secret, database password, JWT material and the rotated root account all exist. Until then, systemd skips those units, so the transient root/root default is never reachable. Both units are still enabled, so the portal returns after a reboot.

grep -H ConditionPathExists /etc/systemd/system/{nginx,php8.3-fpm}.service.d/sac-bootstrap-gate.conf ls -l /var/lib/sac/data/ systemctl is-enabled postgresql.service php8.3-fpm.service nginx.service mapbender-firstboot.service

The web root is the Symfony public/ directory and nothing above it. The .env.local file (the application secret, database password and JWT passphrase) and the JWT private key live above the web root. Nothing above public/ is reachable over HTTP, and only the front controller executes PHP.

grep -E '^\s+root ' /etc/nginx/sites-available/mapbender for p in /.env.local /config/jwt/private.pem /vendor/autoload.php /bin/console; do printf '%-28s HTTP %s\n' "$p" "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1$p)" done

The per-instance secret is unique to this VM, and the real login form rejects root/root and every other common guess. Exactly one super administrator account exists on a fresh instance.

Everything Mapbender stores lives in the mapbender PostgreSQL database. That includes applications, sources, layers, users and access control. Take a consistent dump at any time:

sudo -u postgres pg_dump -Fc mapbender > mapbender-$(date +%F).dump

Restore into an empty database with pg_restore. Keep the dump somewhere off the VM, for example in Azure Blob Storage.

The OS receives unattended security updates automatically.

To move to a newer Mapbender release, update the Composer requirement in /var/www/mapbender/application and run composer update. Then run php bin/console cache:clear and php bin/console doctrine:migrations:migrate as www-data. Always take a pg_dump backup first and test on a copy.