SecureAnyCloud
Deployment guide

Mautic

Overview

Mautic is the leading open source marketing automation platform. Marketing teams use it to capture and nurture leads, score contacts, build visual multi-step campaigns, send email journeys and newsletters, and publish landing pages and forms.

The SecureAnyCloud image delivers Mautic 7.1.2 fully installed and configured on Ubuntu 24.04 LTS. It is a Symfony application on PHP 8.3 with OPcache, served by nginx with php-fpm and backed by a local MariaDB database.

The schema is migrated at build time, and the marketing cron jobs run as systemd timers. A complete marketing automation service is therefore running within minutes of launch, with no setup wizard to complete.

What you get:

  • Mautic 7.1.2 (GPL-3.0 licensed), served from /var/www/mautic
  • nginx, PHP 8.3 (php8.3-fpm with OPcache) and MariaDB 10.11, all from Ubuntu 24.04 main/universe
  • A dedicated Azure data disk at /var/lib/mysql (database tier) and a second at /var/www/mautic (application code, config, runtime cache and media uploads). Each is independently resizable, separate from the OS disk and re-provisioned with every VM
  • A per-VM administrator password, MariaDB password and application secret, all generated at first boot and written to a root-only file. No shared or default login ships in the image
  • Mautic's background jobs (segment updates, campaign rebuild and trigger, email send, broadcasts) wired as systemd timers, gated so that no job fires before first-boot credential rotation completes
  • nginx.service, php8.3-fpm.service and mariadb.service as systemd units, enabled and active
  • 24/7 SecureAnyCloud support

Prerequisites

Before you deploy this image, you need:

  • An active Azure subscription
  • An SSH key pair
  • A VNet and subnet in the target region
  • An NSG that allows inbound 22/tcp from your management network and 80/tcp (HTTP) from your users, plus 443/tcp if you enable HTTPS with your own domain

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point for evaluation. Scale up for larger contact lists and heavier sending volume.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, and search the Marketplace for Mautic by SecureAnyCloud. Select Create.

  • On Basics, pick your subscription, resource group, region and size.
  • Under Administrator account, choose SSH public key and paste your key.
  • Under Inbound port rules, allow SSH (22) and HTTP (80).
  • On the Disks tab, review the two dedicated data disks.

Then choose Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription. You must do this before your first CLI deploy. Then create the VM and open port 80:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:mautic-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name mautic \
  --image sac1647283583153:mautic-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name mautic --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH as the administrator user you created:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

The three services that back Mautic should all report active, and the sign-in page should answer HTTP 200:

systemctl is-active nginx php8.3-fpm mariadb curl -s -o /dev/null -w 'Mautic login page -> HTTP %{http_code}\n' http://127.0.0.1/s/login
sudo ss -tlnp | grep -E ':80 |:3306 ' | awk '{print $1, $4}'

The output shows three lines of active, then Mautic login page -> HTTP 200, then nginx listening on :80 and MariaDB on 127.0.0.1:3306.

Step 5 - Retrieve your administrator credentials

On the first boot of every VM, a one-shot service (mautic-firstboot.service) generates credentials that are unique to that VM. These are a fresh application secret, a fresh MariaDB password and a fresh administrator password. The service also points Mautic's site URL at the VM's own address. No shared or default credentials ship in the image.

sudo cat /root/mautic-credentials.txt

The file (mode 0600, root only) contains the administrator username (mautic.admin.user, which is admin), the administrator password (mautic.admin.pass) and the site URL (mautic.url).

You can prove the login round-trip from the VM's own shell. The following commands read the per-VM credentials, fetch a CSRF token and post a real sign-in against Mautic's login endpoint. A successful sign-in answers HTTP 200 on the authenticated dashboard.

ADMIN_USER=$(sudo grep '^mautic.admin.user=' /root/mautic-credentials.txt | cut -d= -f2-)
ADMIN_PASS=$(sudo grep '^mautic.admin.pass=' /root/mautic-credentials.txt | cut -d= -f2-)
CJ=$(mktemp)
TOKEN=$(curl -s -c "$CJ" http://127.0.0.1/s/login | grep -m1 -oE 'name="_csrf_token"[^>]*value="[^"]+"' | sed -E 's/.*value="([^"]+)".*/\1/')
curl -s -o /dev/null -w 'admin login -> HTTP %{http_code}\n' -b "$CJ" -c "$CJ" -L \
  --data-urlencode "_csrf_token=$TOKEN" --data-urlencode "_username=$ADMIN_USER" --data-urlencode "_password=$ADMIN_PASS" \
  http://127.0.0.1/s/login_check rm -f "$CJ"

Step 6 - Sign in to Mautic

Browse to http://<vm-public-ip>/ and sign in with the administrator username and password from the credentials file.

After you sign in, you land on the dashboard. It summarises engagement, page hits and recent activity across your marketing.

Step 7 - Manage contacts and campaigns

From the top navigation, open Contacts, where you score, segment and manage captured leads. Each contact carries a lifecycle stage, a points score and a full engagement timeline.

Under Campaigns, you build visual multi-step journeys. The drag-and-drop campaign canvas chains decisions, actions and conditions, so contacts flow through nurture sequences, email journeys and re-engagement automatically.

To start sending email, open Settings > Configuration > Email Settings and connect your SMTP provider (Amazon SES, Mailgun, SendGrid or any SMTP host).

Step 8 - Confirm the version and the data tiers

Run the following commands to check the Mautic version and the two data disks:

grep -o '"version": "[0-9.]*"' /var/www/mautic/app/release_metadata.json | head -1 df -h /var/lib/mysql /var/www/mautic

The output shows "version": "7.1.2", then the two dedicated data disks. The database tier (/var/lib/mysql) and the application tier (/var/www/mautic, which holds code, config, runtime cache and media uploads) each live on their own dedicated Azure data disk. You can therefore grow storage for either tier without disturbing the OS disk.

First-boot service and security model

A one-shot mautic-firstboot.service runs After=mariadb.service. The per-VM credentials and rotated secrets are therefore in place before Mautic serves its first authenticated request.

The service rewrites config/local.php with a fresh application secret and database password, in lock-step with the MariaDB user. It rotates the administrator password and writes the credentials file at mode 0600 (root only). It then drops a sentinel so that it runs exactly once.

systemctl status mautic-firstboot.service --no-pager | head -6 sudo stat -c '%a %U:%G %n' /root/mautic-credentials.txt

Administration from the CLI

Mautic ships a Symfony console at /var/www/mautic/bin/console, which you run as the www-data web user. List the available commands, or check the scheduled marketing timers:

sudo -u www-data php /var/www/mautic/bin/console --version systemctl list-unit-files 'mautic-*.timer' --no-pager

Common operations include mautic:segments:update, mautic:campaigns:trigger and mautic:emails:send. These already run automatically as systemd timers, so campaigns fire reliably from the first minute with no manual cron configuration.

Enabling HTTPS with your own domain

The image serves Mautic over HTTP on port 80. For production, point a real domain at the VM's public IP and open 443/tcp in the NSG. Then obtain a trusted certificate with Let's Encrypt, replacing the domain with your own:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.com

After the certificate is issued, update Mautic's site URL under Settings > Configuration to https://your-domain.com. Then clear the cache with sudo -u www-data php /var/www/mautic/bin/console cache:clear --env=prod.

Backup and maintenance

The database lives on the data disk at /var/lib/mysql. The application tree and uploaded media live on the data disk at /var/www/mautic. Snapshot both disks in Azure for a point-in-time backup, or dump the database with:

sudo mariadb-dump mautic > mautic-backup.sql

Keep the OS patched with sudo apt update && sudo apt upgrade. Unattended security upgrades are enabled by default. The stack restarts cleanly with sudo systemctl restart mariadb php8.3-fpm nginx.

Support

SecureAnyCloud backs this image with 24/7 support. Contact us by email or chat for help with Mautic deployment, upgrades, campaign and segment design, email deliverability and SMTP configuration, landing pages and forms, performance tuning and database administration.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Mautic on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure