NADA

Launch the image from the Azure Marketplace, then connect over SSH as azureuser:

ssh azureuser@<vm-ip>

On the very first boot, the web server intentionally waits while nada-firstboot.service provisions the catalog database, applies the upstream migrations and generates the per-VM credentials. The site comes up automatically a few seconds later.

Confirm that Apache and MySQL are active and listening. MySQL is bound to loopback only:

sudo systemctl is-active apache2.service mysql.service
sudo ss -ltn | grep -E ':80 |:3306 '

Expected output:

active active LISTEN 0 151 127.0.0.1:3306 0.0.0.0:* LISTEN 0 511 *:80 *:*

Query the public version API, which reports the installed NADA release:

curl -s http://127.0.0.1/index.php/api/version php -v | head -1 mysql --version apache2 -v | head -1

Expected output:

{"version":"5.6"} PHP 8.3.6 (cli) (built: Jul 16 2026 18:30:41) (NTS) mysql Ver 8.0.46-0ubuntu0.24.04.3 for Linux on x86_64 ((Ubuntu)) Server version: Apache/2.4.58 (Ubuntu)

The schema and upstream migrations are applied, and a single administrator exists with a bcrypt password hash, so there is no default or shared login. Read the application database password from the root-only credentials file, then inspect the tables and the administrator:

DB_PASS=$(sudo grep '^NADA_DB_PASSWORD=' /root/nada-credentials.txt | cut -d= -f2-) sudo mysql -unada -p"$DB_PASS" nada -e "SELECT COUNT(*) AS nada_tables FROM information_schema.tables WHERE table_schema='nada'"
sudo mysql -unada -p"$DB_PASS" nada -e "SELECT u.username, u.active, LEFT(u.password,4) AS hash, r.name AS role FROM users u JOIN user_roles ur ON ur.user_id=u.id JOIN roles r ON r.id=ur.role_id"

Expected output:

+-------------+ | nada_tables | +-------------+ | 90 | +-------------+ +----------+--------+------+-------+ | username | active | hash | role | +----------+--------+------+-------+ | admin | 1 | $2a$ | admin | +----------+--------+------+-------+

The per-VM credentials are written to a root-only file. Read it to get the administrator email and password for signing in, and the admin API key for scripted publishing:

sudo cat /root/nada-credentials.txt

Keep this file secure. After your first sign-in, change the administrator password from the Users area.

Browse to http://<vm-ip>/, click Login, and sign in with the NADA_ADMIN_EMAIL and NADA_ADMIN_PASSWORD from Step 5. NADA asks for the email first, then the password.

To confirm that the catalog is serving locally, run:

curl -sL -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/

Expected output:

HTTP 200

After you sign in, open Site administration, or browse to http://<vm-ip>/index.php/admin, to reach the NADA 5.6 Vue dashboard. It summarizes the catalog, collections, licensed requests and users. It also links to every management area: studies, citations, users and roles, menus, reports, and site settings.

Every catalog operation is also available through the REST API. The image pre-provisions a personal admin API key (the NADA_API_KEY value in the credentials file), so tools such as PyNADA and NADAR work immediately. Create a survey study from the command line:

API_KEY=$(sudo grep '^NADA_API_KEY=' /root/nada-credentials.txt | cut -d= -f2-)
curl -s -X POST -H "X-API-KEY: $API_KEY" -H 'Content-Type: application/json' \
  -d '{"repositoryid":"central","published":1,"overwrite":"yes","study_desc":{"title_statement":{"idno":"DEMO-HBS-2026","title":"Household Budget Survey 2026"},"study_info":{"abstract":"Household budget survey measuring income, expenditure, and living conditions.","nation":[{"name":"Example Country","abbreviation":"EXC"}]},"authoring_entity":[{"name":"National Statistics Office"}]}}' \
  http://127.0.0.1/index.php/api/datasets/create/survey/DEMO-HBS-2026

The response reports "status":"success" with the new dataset. Confirm that the study is findable through the public search API:

curl -s "http://127.0.0.1/index.php/api/catalog/search?keywords=household"

The result includes "idno":"DEMO-HBS-2026" with its title and metadata. In the browser, the study now appears in the catalog with its DDI metadata rendered, searchable by keyword, country and year.

Each study renders its full DDI documentation: identification, producers and sponsors, data collection, and downloadable DDI/XML and JSON metadata. Use the study page tabs to attach microdata files, external resources and an access policy. The policy can be direct download, licensed access with an application workflow, or an enclave-only listing.

Use this table to locate the main files and services.

Component Path

NADA install (document root) /var/www/html/nada/

NADA configuration /var/www/html/nada/application/config/

Database settings /var/www/html/nada/application/config/database.php

Catalog data files /var/www/html/nada/datafiles/

Application logs /var/www/html/nada/logs/

Apache vhost /etc/apache2/sites-available/nada.conf

Apache logs /var/log/apache2/nada-{access,error}.log

MySQL data /var/lib/mysql/

First-boot script /usr/local/sbin/nada-firstboot.sh

Credentials /root/nada-credentials.txt (mode 0600 root:root)

• Change the administrator password from the Users area after your first sign-in, and add accounts for your catalog curators with the roles they need.
• Rotate the API key from the admin interface if you prefer one you generated yourself. You can revoke the pre-provisioned key there at any time.
• Enable HTTPS by installing certbot and requesting a certificate: run sudo apt-get install -y certbot python3-certbot-apache, then sudo certbot --apache.
• Restrict the network security group so that ports 80 and 443 are open only to your users, and port 22 only to your management network.
• Move the datafiles directory outside the web root for defense in depth, following the upstream security guidance. Take regular backups of the nada database and /var/www/html/nada/datafiles.
• Configure email (SMTP or the SendGrid driver) in application/config/email.php and auth.local.php so that registration and access request notifications can be sent.
• Patch the OS regularly with sudo apt-get update and sudo apt-get upgrade.