Moodle 4.3.12

Sign in to the Azure Portal at https://portal.azure.com, search the Marketplace for Moodle 4.3 LMS on Ubuntu 22.04 by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription and resource group and give the virtual machine a name. Choose a region that is in the gallery replication list for this offer, select the image version, and pick a size of Standard_D2s_v3 or larger.

On the Disks tab, choose Standard SSD (locally redundant storage) to balance cost and performance. The Moodle workload is PHP and PostgreSQL heavy, so a hot managed disk is not required for a small deployment.

On the Networking tab, select your virtual network and subnet and attach a Standard SKU public IP. Open ports 22 (from your management CIDR only), 80 and 443 on the network security group. Skip 443 for the initial deployment if you do not have a TLS certificate yet and plan to use Let's Encrypt in step 10.

Review and create the virtual machine. First boot takes approximately one minute after the provisioning state becomes Succeeded.

The block below creates a resource group, a virtual network with a single subnet and a network security group that opens 22 to your management network and 80 and 443 to the Internet. It then creates a virtual machine from the latest image version of the SecureAnyCloud Moodle 4.3 Azure Compute Gallery image.

Replace <your-mgmt-cidr> with the CIDR block of the network you will SSH from (for example 203.0.113.0/24). Replace <sub-id> with your Azure subscription GUID.

LOCATION=eastus RG=moodle-4-3-rg VM_NAME=moodle-lms-01 ADMIN_USER=moodleadmin SSH_KEY=~/.ssh/id_rsa.pub MGMT_CIDR=<your-mgmt-cidr> SUB_ID=<sub-id> IMAGE_ID="sac1647283583153:moodle-4-3-12-ubuntu-22-04:standard:latest" az group create --name $RG --location $LOCATION az network vnet create \
  --resource-group $RG \
  --name moodle-vnet \
  --address-prefix 10.40.0.0/16 \
  --subnet-name moodle-subnet \
  --subnet-prefix 10.40.1.0/24 az network nsg create --resource-group $RG --name moodle-nsg az network nsg rule create \
  --resource-group $RG --nsg-name moodle-nsg \
  --name AllowSSH --priority 1000 --access Allow \
  --protocol Tcp --direction Inbound \
  --source-address-prefixes $MGMT_CIDR \
  --destination-port-ranges 22 az network nsg rule create \
  --resource-group $RG --nsg-name moodle-nsg \
  --name AllowHTTP --priority 1010 --access Allow \
  --protocol Tcp --direction Inbound \
  --source-address-prefixes '*' \
  --destination-port-ranges 80 az network nsg rule create \
  --resource-group $RG --nsg-name moodle-nsg \
  --name AllowHTTPS --priority 1020 --access Allow \
  --protocol Tcp --direction Inbound \
  --source-address-prefixes '*' \
  --destination-port-ranges 443
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:moodle-4-3-12-ubuntu-22-04:standard:latest
az vm create \
  --resource-group $RG \
  --name $VM_NAME \
  --image $IMAGE_ID \
  --size Standard_D2s_v3 \
  --admin-username $ADMIN_USER \
  --ssh-key-values $SSH_KEY \
  --vnet-name moodle-vnet \
  --subnet moodle-subnet \
  --nsg moodle-nsg \
  --public-ip-sku Standard \
  --os-disk-size-gb 64

On success, the command prints a JSON document. Note the publicIpAddress value, which you will use in steps 3 and 4.

SSH into the virtual machine with the administrator username you chose above and the public IP address from step 2. The first boot service runs before the SSH daemon is ready, so the credentials file is always in place when you log in for the first time.

ssh moodleadmin@<public-ip>
sudo cat /root/moodle-credentials.txt

The plain text file contains the Moodle URL, the administrator username (admin), the administrator password, and the PostgreSQL role, database name and password. Copy these values somewhere secure, such as a password manager or encrypted vault. Do not commit them to source control.

The moodle.url line in the file holds the virtual machine's private IP address, which works from inside your virtual network. From the internet, browse to the public IP address (or your DNS name) instead. Moodle answers on whichever address you use.

To regenerate the credentials later, change the administrator password through the Moodle web interface (step 6). For PostgreSQL, run ALTER ROLE moodle WITH PASSWORD '<new>' as the postgres operating system user, then make a matching edit to $CFG->dbpass in /var/www/moodle/config.php.

Open a web browser and go to http://<public-ip>/login/index.php. The site front page at http://<public-ip>/ is public by default and has a Log in link in the top right. The dashboard and Site administration always send visitors who are not signed in to the login form.

Enter the administrator username admin and the administrator password from /root/moodle-credentials.txt, then select Log in. After your first successful sign in, Moodle records your session and takes you to the administrator dashboard.

The dashboard at /my/ is the starting point for managing your Moodle site. The top navigation bar gives you Dashboard for a personalized view and Site administration for global settings. The Course overview block prompts you to create your first course, and the Timeline block shows upcoming activities.

Notifications and messages are in the top right. The user menu lets you sign out or open your profile and preferences.

To confirm the Moodle release from the shell without opening a browser, run:

sudo -u www-data php /var/www/moodle/admin/cli/cfg.php --name=release

The image ships with Moodle 4.3.12. The command prints the release followed by its build date, 4.3.12 (Build: 20250414).

For a production deployment, rotate the administrator password that was generated on first boot. Select the user menu in the top right of the dashboard (the AU avatar), choose Preferences, then User account > Change password. Enter the current password from /root/moodle-credentials.txt, pick a new one that satisfies the Moodle password policy, and select Save changes.

You can do the same from the command line with Moodle's CLI tool:

sudo -u www-data php /var/www/moodle/admin/cli/reset_password.php \
  --username=admin \
  --password='<new-password>' \
  --ignore-password-policy

Select Site administration in the top navigation bar, then Plugins, to review the components installed on your site. The Plugins overview page lists the activity modules, authentication plugins, enrolment plugins, blocks, filters, themes and local plugins that ship with Moodle 4.3.

Use the Settings link next to each module to tailor its behavior. For example, disable BigBlueButton if you do not run a conference server, or enable the LTI plugin if you are integrating with a third-party tool provider.

Other frequently used pages under Site administration include:

• Users > Authentication for manual accounts, email signup, LDAP and SAML2
• Courses > Course categories for the top-level structure
• Server > System paths, if you need to point Moodle at a custom ImageMagick binary or similar

Select Site administration > Courses > Manage courses and categories, choose a category (Moodle ships with a default Category 1), then select Create new course.

The form groups the required fields under General. Enter a course full name and a short name, which appears in breadcrumbs and headers, and confirm the course category. Use Save and display to create the course and open it, or Save and return to continue administering categories.

From the course page, you can add sections, activities (quizzes, assignments, forums, SCORM packages, H5P, Big Blue Button sessions) and resources (files, pages, URLs, books). Use Enrolled users under the course Participants menu to add teachers and students, or set up self enrolment through Course administration > Enrolment methods.

By default, Moodle tries to send mail through the local sendmail binary. For reliable delivery on a cloud virtual machine, configure an external SMTP provider such as SendGrid, Mailgun, Amazon SES or Microsoft 365.

Select Site administration > Server > Email > Outgoing mail configuration. Enter smtp.example.com:587 in the SMTP hosts field, set SMTP security to TLS and set SMTP authentication type to LOGIN. Enter the SMTP username and password issued by your provider.

Set the No-reply address to an address your provider lets you send from, for example no-reply@example.com. Save, then use Site administration > Server > Test outgoing mail configuration to send a test message to your own inbox.

For any production Moodle deployment, serve the site over HTTPS so that session cookies and authentication tokens cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

These steps assume that a DNS A record points your fully qualified domain name (for example moodle.example.com) at the virtual machine's public IP address, and that port 443 is open on the network security group.

The image's nginx site answers any host name (server_name _;), but certbot's nginx installer needs a server block that names your domain. Set the name first:

sudo sed -i --follow-symlinks 's/server_name _;/server_name <your-domain>;/' /etc/nginx/sites-enabled/moodle
sudo nginx -t && sudo systemctl reload nginx

Then request and install the certificate:

sudo snap install --classic certbot
sudo ln -sf /snap/bin/certbot /usr/local/bin/certbot
sudo certbot --nginx -d <your-domain> \
  --non-interactive --agree-tos -m <your-email> \
  --redirect

After certbot finishes, run sudo -u www-data php /var/www/moodle/admin/cli/purge_caches.php so that Moodle rebuilds its theme cache under the new base URL. The dynamic wwwroot detection picks up the https:// scheme from the browser's request automatically.

Moodle has two data sources, and you must back them up together. They are the PostgreSQL database and the moodledata directory at /var/moodledata, which holds course files, user files, session data and caches.

sudo -u postgres pg_dump -Fc moodle > <backup-dir>/moodle-db-$(date +%F).dump
sudo tar --acls --xattrs -czf <backup-dir>/moodle-data-$(date +%F).tgz -C /var moodledata

The output redirect runs as your own user, so choose a <backup-dir> you can write to, for example your home directory. Ship both backups to Azure Blob Storage, an off-site S3 bucket or another object store of your choice.

The Moodle cron timer installed with the image also triggers scheduled course backups if you enable them under Site administration > Courses > Backups > Automated backup setup.

For kernel and package updates, Ubuntu's unattended-upgrades is enabled by default, so security patches apply automatically. To install non-security upgrades, run:

sudo apt-get update && sudo apt-get -y upgrade

Moodle 4.3.12 is the last 4.3 release, so there are no further 4.3 patch releases to install. To keep receiving Moodle security fixes, upgrade the source tree in place to Moodle 4.5, the long-term-support branch MOODLE_405_STABLE.

The image's source tree is a git checkout of the 4.3.12 release commit (not on a branch), so check out the new branch rather than pulling. Take both backups above first, and check that your additional plugins support Moodle 4.5.

sudo -u www-data php /var/www/moodle/admin/cli/maintenance.php --enable cd /var/www/moodle
sudo git config core.fileMode false
sudo git fetch origin MOODLE_405_STABLE
sudo git checkout -B MOODLE_405_STABLE FETCH_HEAD
sudo -u www-data php /var/www/moodle/admin/cli/upgrade.php --non-interactive sudo -u www-data php /var/www/moodle/admin/cli/maintenance.php --disable

On a fresh virtual machine from this image, these commands upgrade the site from 4.3.12 to the current 4.5 release. To apply later 4.5 patch releases, run sudo git pull origin MOODLE_405_STABLE, then the same maintenance and upgrade commands.

For larger deployments, with hundreds of concurrent users or more, decouple Moodle from the single-virtual-machine pattern:

• Move PostgreSQL to Azure Database for PostgreSQL Flexible Server and update $CFG->dbhost and $CFG->dbpass in /var/www/moodle/config.php.
• Put the Moodle web tier behind Azure Application Gateway or Azure Front Door. Scale horizontally with an Azure Virtual Machine Scale Set, with /var/moodledata on Azure Files shared storage.
• Offload session storage to Azure Cache for Redis through Moodle's session_handler_class setting.
• Push static assets to Azure Blob Storage through the Moodle tool_objectfs plugin.

The official Moodle admin docs at https://docs.moodle.org/ document each of these under "Performance recommendations" and "Multi site Moodle".