Moodle 5.2

Sign in to the Azure Portal at https://portal.azure.com. Search the Marketplace for Moodle 5.2 LMS on Ubuntu 24.04 by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription and resource group and give the virtual machine a name. Choose a region that is in the gallery replication list for this offer, select the image version, and pick a size of Standard_D2s_v3 or larger.

On the Disks tab, choose Standard SSD (locally redundant storage) to balance cost and performance. A small deployment does not need a hot managed disk.

On the Networking tab, select your virtual network and subnet and attach a Standard SKU public IP. Open ports 22 (from your management CIDR only), 80 and 443 on the network security group. You can skip port 443 for the initial deployment if you do not yet have a TLS certificate and plan to use Let's Encrypt in Step 10.

Review and create the virtual machine. First boot takes approximately one minute after the provisioning state becomes Succeeded.

The commands below create a resource group, a virtual network with a single subnet, and a network security group. The security group opens port 22 to your management network and ports 80 and 443 to the Internet. They then create a virtual machine from the latest version of the SecureAnyCloud Moodle 5.2 Azure Compute Gallery image.

Replace <your-mgmt-cidr> with the CIDR block of the network you will SSH from, for example 203.0.113.0/24. Replace <sub-id> with your Azure subscription GUID.

LOCATION=eastus RG=moodle-5-2-rg VM_NAME=moodle-lms-01 ADMIN_USER=moodleadmin SSH_KEY=~/.ssh/id_rsa.pub MGMT_CIDR=<your-mgmt-cidr> SUB_ID=<sub-id> IMAGE_ID="sac1647283583153:moodle-5-2-ubuntu-24-04:standard:latest" az group create --name $RG --location $LOCATION az network vnet create \
  --resource-group $RG \
  --name moodle-vnet \
  --address-prefix 10.40.0.0/16 \
  --subnet-name moodle-subnet \
  --subnet-prefix 10.40.1.0/24 az network nsg create --resource-group $RG --name moodle-nsg az network nsg rule create \
  --resource-group $RG --nsg-name moodle-nsg \
  --name AllowSSH --priority 1000 --access Allow \
  --protocol Tcp --direction Inbound \
  --source-address-prefixes $MGMT_CIDR \
  --destination-port-ranges 22 az network nsg rule create \
  --resource-group $RG --nsg-name moodle-nsg \
  --name AllowHTTP --priority 1010 --access Allow \
  --protocol Tcp --direction Inbound \
  --source-address-prefixes '*' \
  --destination-port-ranges 80 az network nsg rule create \
  --resource-group $RG --nsg-name moodle-nsg \
  --name AllowHTTPS --priority 1020 --access Allow \
  --protocol Tcp --direction Inbound \
  --source-address-prefixes '*' \
  --destination-port-ranges 443
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:moodle-5-2-ubuntu-24-04:standard:latest
az vm create \
  --resource-group $RG \
  --name $VM_NAME \
  --image $IMAGE_ID \
  --size Standard_D2s_v3 \
  --admin-username $ADMIN_USER \
  --ssh-key-values $SSH_KEY \
  --vnet-name moodle-vnet \
  --subnet moodle-subnet \
  --nsg moodle-nsg \
  --public-ip-sku Standard \
  --os-disk-size-gb 64

On success, the command prints a JSON document. Note the publicIpAddress value, which you use in Steps 3 and 4.

SSH into the virtual machine with the administrator username you chose and the public IP address from Step 2. The first boot service runs before the SSH daemon becomes ready, so the credentials file is always in place when you first log in.

ssh moodleadmin@<public-ip>
sudo cat /root/moodle-credentials.txt

The plain text file contains the Moodle URL, the admin administrator username (admin), the administrator password (32 characters plus a policy marker), and the PostgreSQL role, database name and password.

Copy these values somewhere secure, such as a password manager or encrypted vault. Do not commit them to source control.

To change the credentials later, use the Moodle web interface (Step 6). For PostgreSQL, run ALTER ROLE moodle WITH PASSWORD '<new>' as the postgres operating system user. Then make a matching edit to $CFG->dbpass in /var/www/moodle/config.php.

Open a web browser and go to the Moodle URL from the credentials file, for example http://<public-ip>/. When no session cookie is present, Moodle redirects the front page to the login form.

Enter the admin username (admin) and the administrator password from /root/moodle-credentials.txt, then select Log in. After the first successful sign-in, Moodle records your session and opens the administrator dashboard.

The dashboard at /my/ is the starting point for managing your Moodle site. The top navigation bar gives you Dashboard for a personalised view and Site administration for global settings.

The Course overview block prompts you to create your first course, and the Timeline block shows upcoming activities. Notifications and messages are in the top right. The user menu lets you sign out or open your profile and preferences.

For a production deployment, change the administrator password that was generated on first boot. Select the user menu in the top right of the dashboard (the AU avatar), choose Preferences, then User account > Change password.

Enter the current password from /root/moodle-credentials.txt, pick a new one that satisfies the Moodle password policy, and select Save changes.

You can also change the password from the command line with Moodle's CLI tool:

sudo -u www-data php /var/www/moodle/admin/cli/reset_password.php \
  --username=admin \
  --password='<new-password>' \
  --ignore-password-policy

Select Site administration in the top navigation bar, then Plugins, to review the components installed on your site. The Plugins overview page lists the activity modules, authentication plugins, enrolment plugins, blocks, filters, themes and local plugins that ship with Moodle 5.2.

Use the Settings link next to each module to tailor its behaviour. For example, disable BigBlueButton if you do not run a conference server, or enable the LTI plugin if you integrate with a third-party tool provider.

Other frequently used pages under Site administration include:

• Users > Authentication for manual accounts, email signup, LDAP and SAML2
• Courses > Course categories for the top-level structure
• Server > System paths if you need to point Moodle at a custom ImageMagick binary or similar

Select Site administration > Courses > Manage courses and categories. Choose a category (Moodle ships with a default Category 1), then select Create new course.

Under General, enter a course full name and a short name, which appears in breadcrumbs and headers. Confirm the course category. Select Save and display to create the course and open it, or Save and return to continue administering categories.

From the course page, you can add sections, activities (quizzes, assignments, forums, SCORM packages, H5P, BigBlueButton sessions) and resources (files, pages, URLs, books). Use Enrolled users under the course Participants menu to add teachers and students. To set up self-enrolment, go to Course administration > Enrolment methods.

By default, Moodle sends mail through the local sendmail binary. For reliable delivery on a cloud virtual machine, configure an external SMTP provider such as SendGrid, Mailgun, Amazon SES or Microsoft 365.

Select Site administration > Server > Email > Outgoing mail configuration. Set the SMTP hosts field to smtp.example.com:587, set SMTP security to TLS, and set SMTP authentication type to LOGIN. Enter the SMTP username and password issued by your provider.

Set the No-reply address to an address your provider lets you send from, for example no-reply@example.com. Save the settings. Then select Site administration > Server > Test outgoing mail configuration to send a test message to your own inbox.

For any production Moodle deployment, serve the site over HTTPS so that session cookies and authentication tokens cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

These commands assume a DNS A record points your fully qualified domain name (for example moodle.example.com) at the virtual machine's public IP address.

sudo snap install --classic certbot
sudo ln -sf /snap/bin/certbot /usr/local/bin/certbot
sudo certbot --nginx -d moodle.example.com \
  --non-interactive --agree-tos -m you@example.com \
  --redirect

When certbot finishes, edit /var/www/moodle/config.php and change $CFG->wwwroot from http://moodle.example.com to https://moodle.example.com.

Then run sudo -u www-data php /var/www/moodle/admin/cli/purge_caches.php so that Moodle rebuilds its theme cache under the new base URL.

Moodle has two data sources that you must back up together: the PostgreSQL database, and the moodledata directory at /var/moodledata. The moodledata directory holds course files, user files, session data and caches.

sudo -u postgres pg_dump -Fc moodle > /var/backups/moodle-db-$(date +%F).dump
sudo tar --acls --xattrs -czf /var/backups/moodle-data-$(date +%F).tgz -C /var moodledata

Copy both files to Azure Blob Storage, an off-site S3 bucket or another object store of your choice. The Moodle cron timer installed with the image also triggers scheduled course backups if you enable them under Site administration > Courses > Backups > Automated backup setup.

Ubuntu's unattended-upgrades is enabled by default, so security patches for the kernel and packages apply automatically. To install non-security upgrades, run:

sudo apt-get update && sudo apt-get -y upgrade

When Moodle publishes a minor release (for example 5.2.1), you can upgrade the source tree in place:

sudo -u www-data php /var/www/moodle/admin/cli/maintenance.php --enable cd /var/www/moodle
sudo git fetch origin MOODLE_502_STABLE
sudo git pull
sudo -u www-data php /var/www/moodle/admin/cli/upgrade.php --non-interactive sudo -u www-data php /var/www/moodle/admin/cli/maintenance.php --disable

For larger deployments, with hundreds of concurrent users and above, move Moodle off the single virtual machine pattern:

• Move PostgreSQL to Azure Database for PostgreSQL Flexible Server, and update $CFG->dbhost and $CFG->dbpass in /var/www/moodle/config.php
• Put the Moodle web tier behind Azure Application Gateway or Azure Front Door, and scale horizontally with an Azure Virtual Machine Scale Set. Keep /var/moodledata on Azure Files shared storage
• Offload session storage to Azure Cache for Redis through Moodle's session_handler_class setting
• Push static assets to Azure Blob Storage through the Moodle tool_objectfs plugin

The official Moodle admin documentation at https://docs.moodle.org/ covers each of these under "Performance recommendations" and "Multi site Moodle".

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Moodle LMS. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your learners use. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialisation takes approximately one minute after the instance state becomes Running and the status checks pass.

The command below launches an instance from the SecureAnyCloud Moodle Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing, and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":64,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=moodle-lms-01}]'

On success, the command prints a JSON document. Note the instance ID.

Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched:

• Moodle 5.2 on Ubuntu 24.04: login user ubuntu
• Moodle 5.2 on Rocky Linux 9: login user ec2-user

Later steps that manage Moodle files or install packages also differ between the two variants. Where a command shows <web-user> or uses a package manager, substitute the value for the variant you launched:

• Moodle 5.2 on Ubuntu 24.04: web service user (<web-user>) www-data, package manager apt-get
• Moodle 5.2 on Rocky Linux 9: web service user (<web-user>) apache, package manager dnf

The first boot service runs before the SSH daemon becomes ready, so the credentials file is always in place when you first log in.

ssh <login-user>@<public-ip>
sudo cat /root/moodle-credentials.txt

The plain text file contains the Moodle URL, the admin administrator username (admin), the administrator password, and the PostgreSQL role, database name and password.

Copy these values somewhere secure, such as a password manager or encrypted vault. Do not commit them to source control.

From the same SSH session, confirm that the deployment is healthy:

curl -fsS -o /dev/null -w 'login page HTTP %{http_code}\n' http://127.0.0.1/login/index.php

A login page HTTP 200 response confirms that the full stack (nginx, PHP and PostgreSQL) is serving Moodle.

Open a web browser and go to http://<public-ip>/. When no session cookie is present, Moodle redirects the front page to the login form.

Enter the admin username (admin) and the administrator password from /root/moodle-credentials.txt, then select Log in. After the first successful sign-in, Moodle records your session and opens the administrator dashboard.

The dashboard at /my/ is the starting point for managing your Moodle site. The top navigation bar gives you Dashboard for a personalised view and Site administration for global settings.

The Course overview block prompts you to create your first course, and the Timeline block shows upcoming activities. Notifications and messages are in the top right. The user menu lets you sign out or open your profile and preferences.

For a production deployment, change the administrator password that was generated on first boot. Select the user menu in the top right of the dashboard, choose Preferences, then User account > Change password.

Enter the current password from /root/moodle-credentials.txt, pick a new one that satisfies the Moodle password policy, and select Save changes.

You can also change the password from the command line with Moodle's CLI tool. Run it as the web service user for your variant: <web-user> is www-data on Ubuntu and apache on Rocky Linux (see Step 3).

sudo -u <web-user> php /var/www/moodle/admin/cli/reset_password.php \
  --username=admin \
  --password='<new-password>' \
  --ignore-password-policy

Select Site administration in the top navigation bar, then Plugins, to review the components installed on your site. The Plugins overview page lists the activity modules, authentication plugins, enrolment plugins, blocks, filters, themes and local plugins that ship with Moodle.

Use the Settings link next to each module to tailor its behaviour.

Other frequently used pages under Site administration include:

• Users > Authentication for manual accounts, email signup, LDAP and SAML2
• Courses > Course categories for the top-level structure
• Server > System paths

Select Site administration > Courses > Manage courses and categories. Choose a category (Moodle ships with a default Category 1), then select Create new course.

Enter a course full name and a short name, and confirm the course category. Select Save and display to create the course and open it.

From the course page, you can add sections, activities (quizzes, assignments, forums, SCORM packages, H5P) and resources (files, pages, URLs, books). Use Enrolled users under the course Participants menu to add teachers and students.

By default, Moodle sends mail through the local sendmail binary. For reliable delivery on a cloud instance, configure an external SMTP provider such as Amazon SES, SendGrid or Mailgun.

Select Site administration > Server > Email > Outgoing mail configuration. Set the SMTP hosts field to your provider's endpoint. For Amazon SES, use email-smtp.<region>.amazonaws.com:587. Set SMTP security to TLS, set SMTP authentication type to LOGIN, and enter the SMTP username and password issued by your provider.

Set the No-reply address to an address your provider lets you send from. Save the settings. Then select Site administration > Server > Test outgoing mail configuration to send a test message.

For any production Moodle deployment, serve the site over HTTPS so that session cookies and authentication tokens cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

These commands assume a DNS record points your fully qualified domain name at the instance's public IP address.

Install certbot for your variant. On Ubuntu 24.04, run:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx

On Rocky Linux 9, certbot ships in EPEL. Run:

sudo dnf install -y epel-release && sudo dnf install -y certbot python3-certbot-nginx

Then request and install the certificate. This command is identical on both variants:

sudo certbot --nginx -d moodle.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

When certbot finishes, run sudo -u <web-user> php /var/www/moodle/admin/cli/purge_caches.php, using the <web-user> value for your variant from Step 3. This makes Moodle rebuild its theme cache under the new HTTPS base URL.

Moodle has two data sources that you must back up together: the PostgreSQL database, and the moodledata directory at /var/www/moodledata. The moodledata directory holds course files, user files, session data and caches.

sudo -u postgres pg_dump -Fc moodle > /var/backups/moodle-db-$(date +%F).dump
sudo tar --acls --xattrs -czf /var/backups/moodle-data-$(date +%F).tgz -C /var/www moodledata

Copy both files to an Amazon S3 bucket or another object store. The Moodle cron timer installed with the image also triggers scheduled course backups if you enable them under Site administration > Courses > Backups.

The update mechanism for the kernel and packages depends on your variant:

• Ubuntu 24.04: unattended-upgrades is enabled by default, so security patches apply automatically. To install non-security upgrades, run sudo apt-get update && sudo apt-get -y upgrade.
• Rocky Linux 9: enable automatic security updates with sudo dnf install -y dnf-automatic && sudo systemctl enable --now dnf-automatic.timer. To install updates on demand, run sudo dnf -y upgrade.

For larger deployments, move Moodle off the single instance pattern:

• Move PostgreSQL to Amazon RDS for PostgreSQL, and update $CFG->dbhost and $CFG->dbpass in /var/www/moodle/config.php
• Put the Moodle web tier behind an Application Load Balancer, and scale horizontally with an Auto Scaling group. Keep /var/www/moodledata on Amazon EFS shared storage
• Offload session storage to Amazon ElastiCache for Redis through Moodle's session_handler_class setting
• Push static assets to Amazon S3 through the Moodle tool_objectfs plugin

The official Moodle admin documentation at https://docs.moodle.org/ covers each of these under "Performance recommendations".