Deployment guide

Monica

Overview

Monica is a free, open source, self-hosted personal relationship manager: a private CRM for your personal life rather than a business sales tool. Record how and when you interacted with the people who matter to you, set reminders for birthdays and important dates, and log gifts, notes, debts, tasks, activities and journal entries. Monica syncs contacts and important dates with your phone over CardDAV and CalDAV, and it exposes a documented REST API.

This SecureAnyCloud image delivers Monica fully installed and configured on Ubuntu 24.04, as a PHP 8.3 Laravel application backed by MariaDB. A complete personal CRM is running within minutes of launch, and your data stays private on infrastructure you control. Monica is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0), and this image repackages the upstream open source release with SecureAnyCloud's provisioning and support.

What you get:

Monica 4.1.2 (AGPL-3.0), served from /var/www/monica
PHP 8.3 (php8.3-fpm) with OPcache and nginx, with the web UI on port 80
MariaDB as the database backend, listening on localhost only
The MariaDB datadir on a dedicated, independently resizable data disk mounted at /var/lib/mysql, and the Monica application tree on a second dedicated data disk mounted at /var/www
The Laravel task scheduler, running every minute through a systemd timer to send reminders
A per-VM administrator password, a fresh Laravel application key and a fresh MariaDB password, all generated on first boot and written to a root-only file, so no default or shared login ships in the image
Signups disabled, so the per-instance administrator is the only account
24/7 SecureAnyCloud support

All product and company names are trademarks or registered trademarks of their respective holders.

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size. Scale up for larger contact lists or heavier use.

On the network security group (NSG), allow inbound 22/tcp from your management network and 80/tcp (HTTP) from your users. Add 443/tcp if you enable HTTPS.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Monica by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:monica-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name monica \
  --image sac1647283583153:monica-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 to reach the web UI:

az vm open-port --resource-group <your-rg> --name monica --port 80 --priority 900

Step 3 - Connect to your VM

Connect to the VM over SSH as the azureuser account:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that the three services behind Monica report active, and that the sign-in page (GET /login) answers HTTP 200 on port 80:

systemctl is-active nginx php8.3-fpm mariadb curl -s -o /dev/null -w 'GET /login -> %{http_code}\n' http://127.0.0.1/login

Expected output: three lines of active, then GET /login -> 200. Only nginx on port 80 is exposed. PHP runs behind it under php-fpm, and MariaDB listens on localhost only, so there is no database port to open.

Step 5 - Retrieve your administrator password

On the first boot of every VM, a one-shot service (monica-firstboot.service) generates credentials that are unique to that VM: a fresh administrator password, a fresh MariaDB password and a fresh Laravel application key. It also pins the application to your VM's own address. No shared or default credentials ship in the image.

Read the credentials file:

sudo cat /root/monica-credentials.txt

The file (mode 0600, root only) contains the administrator email (monica.admin.user), the administrator password (monica.admin.pass) and the sign-in URL (monica.url).

You can test the sign-in from the VM's own shell. Monica signs in through a form that carries a Laravel CSRF token. The following commands read the per-VM credentials, fetch the token and post a real sign-in. A correct password answers HTTP 302, which redirects to the dashboard:

EMAIL=$(sudo grep '^monica.admin.user=' /root/monica-credentials.txt | cut -d= -f2-)
PASS=$(sudo grep '^monica.admin.pass=' /root/monica-credentials.txt | cut -d= -f2-)
J=$(mktemp)
TOKEN=$(curl -s -c "$J" http://127.0.0.1/login | grep -m1 -oE 'name="_token"[^>]*value="[^"]+"' | sed 's/.*value="//;s/".*//')
echo -n 'sign-in HTTP status -> ' curl -s -o /dev/null -w '%{http_code}\n' -b "$J" -c "$J" \
  --data-urlencode "_token=$TOKEN" --data-urlencode "email=$EMAIL" --data-urlencode "password=$PASS" \
  http://127.0.0.1/login rm -f "$J"

Expected output: sign-in HTTP status -> 302. This confirms that the credentials in the file sign in successfully.

Step 6 - Sign in

Browse to http://<vm-public-ip>/. Sign in with the administrator email and password from the credentials file. Monica opens on your dashboard, the home of your personal relationship manager.

Step 7 - Add contacts, reminders and notes

Open Contacts and choose to add a person. Record their name and details. On their profile, log how you know them, set reminders for birthdays and important dates, and note gifts, activities, tasks and debts.

Each person you add appears in your contacts list with a searchable profile. The profile keeps everything you have recorded about your relationship with them in one place.

Step 8 - Confirm the version, the stack and the data disks

Run these commands to check the Monica version, the PHP version and the data disk mounts:

cat /var/www/monica/config/.version php -v | head -1 findmnt -no TARGET,SOURCE,FSTYPE /var/lib/mysql findmnt -no TARGET,SOURCE,FSTYPE /var/www

Expected output: Monica v4.1.2, PHP 8.3, and both /var/lib/mysql and /var/www mounted from their own dedicated data disks. The MariaDB datadir and the Monica application tree each live on their own disk, independently resizable and separate from the operating system disk. Resize them from the Azure portal if you need more room.

First-boot service and security model

A one-shot monica-firstboot.service runs after the network is up. It performs these tasks:

Rotates the MariaDB password and regenerates a fresh Laravel APP_KEY
Pins the application URL to the VM's own address, resolved from the Azure instance metadata service
Migrates and seeds the schema
Creates the per-instance administrator account with a fresh password
Writes the credentials file at mode 0600 (root only)
Drops a sentinel so that it runs exactly once

The image ships with an empty database and no usable login. Signups are disabled, so the per-instance administrator created on first boot is the only account.

Verify the service and the credentials file permissions:

systemctl is-active monica-firstboot.service
sudo stat -c '%a %U:%G %n' /root/monica-credentials.txt

Expected output: active, then 600 root:root /root/monica-credentials.txt.

Enable HTTPS with your own domain

The image serves the web UI over plain HTTP on port 80. For a browser-trusted certificate, point a DNS record at the VM and open port 443 in the NSG. Then install a certificate from your CA, for example Let's Encrypt:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot updates the nginx site to serve your domain certificate. Then set APP_URL=https://your-domain.example.com and APP_FORCE_HTTPS=true in /var/www/monica/.env. Run sudo -u www-data php /var/www/monica/artisan config:cache so that Monica generates its links over HTTPS.

Sync contacts over CardDAV and CalDAV

Monica ships with CardDAV and CalDAV support, so you can sync contacts and important dates with your phone or desktop. Point your device's CardDAV/CalDAV client at http://<vm-public-ip>/dav/. Use HTTPS once you have enabled it. Sign in with your administrator email and an application-specific token that you generate under Settings.

Back up and maintain Monica

Monica keeps your relationship data in MariaDB under /var/lib/mysql. Its application files and uploads live under /var/www/monica, each on its own dedicated data disk. For a full point-in-time copy, snapshot the data disks and the OS disk from the Azure portal. Alternatively, dump the database and archive the uploads:

sudo mysqldump monica | gzip > /var/backups/monica-db-$(date +%F).sql.gz
sudo tar -C /var/www -czf /var/backups/monica-app-$(date +%F).tar.gz monica

Keep the OS current with sudo apt-get update && sudo apt-get upgrade. The image ships with unattended security updates enabled. Review the Monica documentation before moving between major versions, and always back up before an upgrade.

Support

This image is backed by 24/7 SecureAnyCloud support. Support covers deployment and initial configuration, retrieving first-boot administrator credentials, email relay and SMTP configuration, CardDAV and CalDAV sync setup, two-factor authentication, application upgrades and patch management, HTTPS and custom domain setup, performance tuning, and MariaDB administration.

Email sales@secureanycloud.com or use the live chat in the support portal. Critical issues receive a one-hour average response.

Deploy on Azure

Launch Monica on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Monica is a self-hosted personal relationship manager: a CRM for your personal life, distinct from a business sales CRM. Record the people who matter to you, log how and when you interacted with them, set reminders for birthdays and important dates, and keep notes, gifts, debts, tasks, activities, journal entries and the relationships between contacts.

This SecureAnyCloud image runs Monica, a Laravel application, behind nginx with PHP FPM 8.3 and OPcache enabled. MariaDB provides the database on the same instance, bound to the loopback interface only.

What you get:

The Laravel task scheduler, running every minute through a systemd timer (the configuration Monica recommends for production), so reminders and scheduled jobs run automatically
The database schema and reference data ready, with signups disabled, so the per-instance administrator account created on first boot is the only account
A Monica administrator password, a MariaDB password and a fresh Laravel application key, generated on the first boot of every deployed instance. Two instances launched from the same Amazon Machine Image never share secrets
A database created empty at image build, so no personal data ships in the image
The administrator login written to /root/monica-credentials.txt with mode 0600, so that only the root user can read it
The Monica application code, the nginx document root (public/) and user uploads under /var/www/monica, on a dedicated EBS volume separate from the operating system disk
The MariaDB data directory on its own EBS volume at /var/lib/mysql. Each tier can be resized independently of the others

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users will reach Monica on
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Monica. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger, because the Monica workload is PHP and MariaDB heavy. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization takes a few seconds after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

Run the following command to launch an instance from the SecureAnyCloud Monica Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=monica-01}]'

On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and Retrieve Initial Credentials

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched:

AMI variant SSH login user

Monica 4.1 on Ubuntu 24.04 ubuntu

Once connected, read the per-instance administrator login and database credentials that first boot generated. They are stored in a root-only file:

sudo cat /root/monica-credentials.txt

The file lists the application URL, the administrator email (admin@localhost) and password, and the MariaDB database name, user and password. These values are unique to this instance.

Verify the Service is Running

Monica is served on port 80. Confirm that the web server, PHP FPM and the database are all active:

systemctl is-active nginx php8.3-fpm mariadb

Confirm that the sign-in page is served locally:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/login

Check the installed Monica version:

cat /var/www/monica/config/.version

First Login to the Monica Web Interface

Open http://<public-ip>/ in your browser. The Monica sign-in page appears. Sign in with the administrator email admin@localhost and the password from /root/monica-credentials.txt. First boot sets the instance's own public address as the application URL, so every link and asset resolves correctly.

After you sign in, you land on your account dashboard, the home of your personal relationship manager.

Change the Administrator Email and Password

The administrator account ships with the email admin@localhost. Open the settings menu (the gear icon, top right), choose Settings, then open your profile. Set a real email address and a password of your own. In the same settings area, you can also set your name, timezone, locale and currency.

Add Your First Contacts

From the dashboard or the Contacts menu, select Add a new person. Enter a first name, which is the only required field. Optionally add a last name, nickname, email and gender, then choose Add. You land on the contact's profile, where you can record:

Relationships: partners, family members and other connections between your contacts
Important dates: birthdays and anniversaries, which can generate reminders
Notes: free-form notes about the person
Activities: things you did together
Reminders: one-off or recurring nudges
Gifts, tasks, debts and how you stay in touch

Use the Journal

Open Journal to record entries about your day and link them to the contacts involved. It is a private diary that ties into your relationships, so you can look back on what happened and with whom.

Configure Outbound Email

To let Monica send reminder emails, edit /var/www/monica/.env. Set the MAIL_MAILER, MAIL_HOST, MAIL_PORT, MAIL_USERNAME, MAIL_PASSWORD, MAIL_ENCRYPTION and MAIL_FROM_ADDRESS values for your SMTP provider. After you edit the file, rebuild the configuration cache:

cd /var/www/monica && sudo -u www-data php artisan config:clear && sudo -u www-data php artisan config:cache

CardDAV and CalDAV Sync

Monica ships with CardDAV (contacts) and CalDAV (calendar) support enabled. Point your phone or desktop client at http://<public-ip>/dav/ and authenticate with your Monica login. Your contacts and important dates then sync with your address book and calendar. Enable HTTPS (the next step) before you sync real data.

Two-Factor Authentication

Two-factor authentication is available on this instance. Open Settings, then Security, to enable a TOTP authenticator app and register WebAuthn security keys to protect your account.

Enable HTTPS

Put Monica behind TLS. Install a certificate with Let's Encrypt and the nginx plugin, replacing the domain with your own:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Once Monica is reachable over HTTPS, set APP_URL to your https:// address and turn on forced HTTPS, so every generated link and asset uses the secure scheme. Edit /var/www/monica/.env, set APP_FORCE_HTTPS=true and update APP_URL. Then rebuild the configuration cache with the artisan config:clear and artisan config:cache commands shown in Step 9.

Backups and Maintenance

Back up the MariaDB monica database and the /var/www/monica/storage directory regularly. Take a database dump with mysqldump:

sudo mysqldump monica | gzip > /var/tmp/monica-db-backup.sql.gz

Keep the operating system patched with sudo apt-get update && sudo apt-get upgrade.

The Laravel scheduler that drives reminders runs automatically every minute through the monica-scheduler.timer systemd timer. Inspect it with systemctl list-timers monica-scheduler.timer.

Scaling and Operations

For a larger deployment, move the MariaDB tier to Amazon RDS for MySQL. Point the DB_* values in /var/www/monica/.env at the managed endpoint, which leaves the application instance stateless apart from /var/www/monica/storage.

Place the application behind an Application Load Balancer with an ACM certificate for TLS termination. Set APP_FORCE_HTTPS=true so that Monica generates secure URLs behind the load balancer.

Screenshots

Support

This Amazon Machine Image is published by SecureAnyCloud with 24/7 technical support by email and chat. Support covers Monica deployment, upgrades, performance tuning, email configuration, CardDAV and CalDAV sync, two-factor authentication, and database administration.

Monica itself is open source software licensed under the AGPL-3.0. SecureAnyCloud charges for the support service, not for the software.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Monica on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS