Open Food Network

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_D2s_v3 (2 vCPU / 8 GiB RAM) is the recommended size. OFN runs Puma and Sidekiq alongside PostgreSQL and Redis, so do not go below 8 GiB of RAM.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, and 80/tcp and 443/tcp for the web interface. The appliance serves HTTPS on port 443 with a per-VM self-signed certificate, so the interface works immediately. For production, install your own certificate and domain (see Step 9).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Open Food Network by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size (Standard_D2s_v3). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80) and HTTPS (443).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:open-food-network-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name open-food-network \
  --image sac1647283583153:open-food-network-ubuntu-24-04:default:latest \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name open-food-network --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name open-food-network --port 443 --priority 1011

Step 3 - Connect to your VM

Connect to the VM over SSH, using its public IP address:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

On first boot, the image generates the per-VM secrets and writes the environment file and a per-VM self-signed TLS certificate. It then creates the admin account and releases the application services.

Confirm that PostgreSQL, Redis, nginx, Puma and Sidekiq are all active and bound to loopback:

systemctl is-active postgresql redis-server nginx open-food-network-puma open-food-network-sidekiq
sudo ss -tlnp | grep -E ':5432|:6379|:3000|:80 |:443 '

PostgreSQL and Redis listen only on 127.0.0.1. Puma listens on 127.0.0.1:3000, and nginx serves :80 and :443.

Step 5 - Retrieve your per-VM credentials

Every credential is unique to this VM and written to a root-only file on first boot. The file holds the HTTP Basic-Auth username and password that protect the whole site, and the admin account for the storefront and admin back office. Print it as an administrator:

sudo cat /root/open-food-network-credentials.txt

The file shows the Basic-Auth username and password, the admin e-mail (<OFN_ADMIN_EMAIL>) and the admin password (<OFN_ADMIN_PASSWORD>). Keep this file safe. The passwords are not recoverable if lost, but you can rotate them yourself later.

Step 6 - Verify TLS and the Basic-Auth layer

The whole site sits behind an HTTP Basic-Auth layer on :443, except an unauthenticated /healthz used for health checks. Port 80 redirects to HTTPS. Confirm the status codes with these requests:

curl -s -o /dev/null -w 'port 80 -> HTTP %{http_code}\n' http://127.0.0.1/
curl -sk -o /dev/null -w 'healthz -> HTTP %{http_code}\n' https://127.0.0.1/healthz
curl -sk -o /dev/null -w 'no auth -> HTTP %{http_code}\n' https://127.0.0.1/

Port 80 returns 301 (redirect to HTTPS) and /healthz returns 200. The storefront returns 401 until you supply the Basic-Auth credentials from Step 5.

Step 7 - Open the storefront

Browse to https://<vm-public-ip>/ and enter the Basic-Auth username and password when prompted.

The storefront opens on the marketplace landing page, where shoppers browse shops, producers and the map of local suppliers. The image ships a demo catalogue, so the marketplace renders immediately.

Step 8 - Sign in to the admin back office

Click Login (top right) and sign in with the admin e-mail and password from Step 5. Only the per-VM admin password logs in. Any other password is rejected.

The admin dashboard is where you manage products, order cycles, enterprises, orders, reports and users. The login goes through the nginx Basic-Auth layer and then the application's own Devise session login.

Step 9 - Set your own domain, TLS and SMTP

The appliance boots with a per-VM self-signed certificate and uses the VM public IP as its address, which is enough for evaluation. Before you onboard real enterprises, point a domain at the VM and install a TLS certificate for it. Also configure SMTP so that signup and order e-mails are delivered.

The application configuration lives in the environment file:

sudo -u ofn sed -n '1,40p' /home/ofn/openfoodnetwork/.env

Edit MAIL_HOST, MAIL_PORT, SMTP_USERNAME, SMTP_PASSWORD and MAIL_DOMAIN for your mail provider. Replace the certificate at /etc/ssl/open-food-network/, or terminate TLS at a load balancer. Then restart the application:

sudo systemctl restart open-food-network-puma open-food-network-sidekiq nginx

Step 10 - Maintenance

Use these routine tasks to keep the appliance healthy:

• Rotate credentials: to regenerate every per-VM secret and the admin password, remove the first-boot marker and re-run first boot: sudo rm -f /var/lib/sac/data/open-food-network-firstboot.done && sudo systemctl restart open-food-network-firstboot.
• Background jobs: Sidekiq processes e-mails and long-running tasks. Check it with systemctl status open-food-network-sidekiq.
• Logs: read them with journalctl -u open-food-network-puma and journalctl -u open-food-network-sidekiq.
• OS updates: the image ships with unattended-upgrades enabled for security patches.
• Backups: back up the PostgreSQL database open_food_network_prod and any uploaded media before upgrades.

Open Food Network is licensed under AGPL-3.0. This image is not affiliated with or endorsed by the Open Food Network Foundation. For help deploying or operating the image, SecureAnyCloud support is available 24/7.

Deploy on Azure

Launch Open Food Network on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com