Moodle 5.2.4

Subscribe to the Hardened Moodle & E-Learning Platforms AMIs listing, choose Moodle 5.2.4 on Ubuntu 24.04 as the software version, and launch.

The recommended instance type is m5.large (2 vCPU, 8 GiB) for a pilot or a few hundred users. Choose a larger instance for heavier use.

In the security group, open TCP 22 (SSH, your own address only), TCP 80 and TCP 443. Do not open 5432, because PostgreSQL has no network listener.

The root volume is 12 GiB. Course files grow in /var/www/moodledata, so give the instance a bigger root volume at launch if you expect many uploads.

aws ec2 run-instances \
  --image-id <ami-id-from-the-listing> \
  --instance-type m5.large \
  --key-name <your-key> \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --associate-public-ip-address \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=40,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=moodle}]'

First boot creates the database, installs the site and provisions the per-instance credentials. Wait about three minutes before the site answers.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i /path/to/your-key.pem ubuntu@<instance-address>

The login banner shows the site address and the location of the credentials file.

First boot writes the per-instance administrator password to a root-only file. Read it with:

sudo cat /root/moodle-credentials.txt

The file gives the site address, the administrator user admin and its per-instance password (shown here as <redacted>):

moodle.url=https://ec2-100-59-14-14.compute-1.amazonaws.com/ moodle.admin.user=admin moodle.admin.pass=<redacted>

There is no database password. Moodle reaches PostgreSQL as the system user www-data through the local socket.

Browse to the moodle.url address. The certificate is self-signed for this instance, so your browser shows a warning the first time. Accept it, or install your own certificate (Step 7). Sign in as admin with the password from the credentials file.

After you sign in, you land on the dashboard:

Change the administrator password straight away. Open your user menu, then choose Preferences > Change password. Set the administrator's real email address under Edit profile.

sudo moodle-set-hostname --show systemctl is-active nginx php8.3-fpm postgresql@16-main moodle-cron.timer curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/login/index.php
sudo -u www-data php /var/www/moodle/admin/cli/cfg.php --name=release

Expected output on a healthy instance:

https://ec2-100-59-14-14.compute-1.amazonaws.com/ (automatic: EC2 instance address) active active active active 200 5.2.4 (Build: 20261005)

Moodle cron runs every minute from moodle-cron.timer as www-data. To check the timer, run:

systemctl list-timers moodle-cron.timer --no-pager

Point a DNS record at the instance. An Elastic IP keeps the address stable. Then pin Moodle to that name:

sudo moodle-set-hostname lms.example.com

This writes $CFG->wwwroot = 'https://lms.example.com' into /var/www/moodle/config.php, makes nginx answer that name, issues a new self-signed certificate for it and purges Moodle's caches. Run sudo moodle-set-hostname --auto to return to the EC2 address. Without a pinned name, the site follows a public address that changes after a stop and start on the next boot.

To use a certificate from a public authority, replace /etc/ssl/moodle/moodle.crt (full chain) and /etc/ssl/moodle/moodle.key (mode 0600, owner root), then reload nginx. For example, with Let's Encrypt:

sudo apt-get install -y certbot
sudo certbot certonly --webroot -w /var/www/moodle/public -d lms.example.com
sudo ln -sf /etc/letsencrypt/live/lms.example.com/fullchain.pem /etc/ssl/moodle/moodle.crt
sudo ln -sf /etc/letsencrypt/live/lms.example.com/privkey.pem /etc/ssl/moodle/moodle.key
sudo systemctl reload nginx

Go to Site administration > Courses > Manage courses and categories > Create new course. Give the course a full and a short name and save it. Then add activities with Edit mode switched on.

Everything else, including users, authentication, plugins, appearance, the site name and the front page, is under Site administration:

Set the outgoing mail server under Site administration > Server > Email > Outgoing mail configuration, so that notifications and password-reset emails are delivered. Amazon SES works well.

These features are deliberately off on a new site. Turn on only what you need:

• Self-registration: open Site administration > Plugins > Authentication > Manage authentication. Under Self registration, choose Email-based self-registration. This needs working outgoing email.
• Guest access: open Site administration > Plugins > Authentication > Manage authentication. Set Guest login button to Show.
• The Moodle mobile app: open Site administration > General > Mobile app > Mobile settings and enable web services for mobile devices.
• Web services for integrations: open Site administration > General > Advanced features and enable web services. Then follow Site administration > Server > Web services > Overview.

Moodle's state is the PostgreSQL database plus /var/www/moodledata and config.php. To take a consistent backup, run:

sudo install -d -m 0700 /root/moodle-backup
sudo -u postgres pg_dump --format=custom moodle | sudo tee /root/moodle-backup/moodle-db.dump >/dev/null
sudo tar -C /var/www -czf /root/moodle-backup/moodledata.tar.gz moodledata
sudo cp /var/www/moodle/config.php /root/moodle-backup/
sudo ls -lh /root/moodle-backup/

Copy the backup off the instance, for example to Amazon S3, or use EBS snapshots of the volume.

To restore onto a fresh instance of this image, put the site in maintenance mode, then load the dump and the data directory:

sudo -u www-data php /var/www/moodle/admin/cli/maintenance.php --enable sudo systemctl stop moodle-cron.timer php8.3-fpm
sudo -u postgres dropdb moodle
sudo -u postgres createdb --owner=www-data --encoding=UTF8 --template=template0 moodle
sudo cat /path/to/moodle-db.dump | sudo -u postgres pg_restore --no-owner --role=www-data -d moodle
sudo tar -C /var/www -xzf /path/to/moodledata.tar.gz
sudo systemctl start php8.3-fpm moodle-cron.timer
sudo -u www-data php /var/www/moodle/admin/cli/maintenance.php --disable

You can also back up individual courses with Moodle course backups, under Course administration > Backup.

Ubuntu security updates install automatically (unattended-upgrades).

To update Moodle itself, replace the code with a newer release and run sudo -u www-data php /var/www/moodle/admin/cli/upgrade.php. Take a backup first and follow Moodle's upgrade notes for the target release.

To reset a forgotten administrator password from the shell, run sudo -u www-data php /var/www/moodle/admin/cli/reset_password.php and answer its prompts. Never put a password on a command line.