OpenCATS

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Choose a larger size for bigger or busier teams.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the console. Add 443/tcp once you enable TLS. OpenCATS serves plain HTTP on port 80 out of the box, so for production terminate TLS in front of it with your own domain. The bundled MariaDB listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for OpenCATS by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy with the Azure CLI (alternative)

If you prefer the command line, create the VM from the SecureAnyCloud OpenCATS image with your resource group, image URN, size and SSH key. Open ports 22 and 80 on the network security group, then browse to the public IP.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:opencats-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-rg \
  --name opencats \
  --image sac1647283583153:opencats-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group my-rg --name opencats --port 80 --priority 900

Step 3 - Confirm the services and retrieve the admin password

SSH in as azureuser. Confirm that all three services and the first-boot unit are active. nginx listens on port 80, and MariaDB is bound to the loopback interface only.

systemctl is-active nginx php8.3-fpm mariadb opencats-firstboot ss -tlnp | grep -E ':80 |:3306 '

On the first boot of every VM, the image generates a unique administrator password. It records the password and the sign-in URL in a root-only file. Read the file with sudo:

sudo cat /root/opencats-credentials.txt

Step 4 - Sign in to OpenCATS

Browse to http://<your-vm-ip>/. OpenCATS shows its own sign-in page. Sign in with the user admin and the password from the credentials file.

After you sign in, the dashboard shows your recent calls, upcoming calls and events, recent hires, a hiring overview graph and the important candidates list. The top navigation links to Dashboard, Activities, Job Orders, Candidates, Companies, Contacts, Lists, Calendar, Reports and Settings.

Step 5 - Manage candidates, companies and job orders

Open the Candidates tab to see your candidate list with name, city, state, key skills, owner and dates. You can sort and filter the list, and quick search covers the whole system.

Choose Add Candidate to enter a candidate by hand. Alternatively, paste or upload a resume, and OpenCATS extracts the text with the preinstalled pdftotext, antiword, unrtf and html2text tools. Create companies and job orders the same way, then build recruiting pipelines and log activity against each candidate.

Security model - no default credentials

OpenCATS normally ships with a well-known default administrator account. This image removes that risk. On every first boot, the single admin account (user_id 1) is rotated to a unique per-VM secret and stored as a modern password hash. The well-known default passwords (cats and cats123) and other common guesses no longer authenticate.

The web installer and maintenance scripts are removed after installation, so they cannot be re-run over HTTP. Each build verifies, before the image is captured, that the per-VM admin authenticates through the real OpenCATS login form while the defaults and weak guesses are rejected.

bash /usr/local/sbin/opencats-cred-roundtrip.sh

Where your data lives

The MariaDB database and the uploaded OpenCATS resumes both live on a dedicated Azure data disk, not on the OS disk. MariaDB's data directory is bind-mounted from the data disk onto /var/lib/mysql. The OpenCATS attachments and upload directories are symlinked onto the same disk.

As a result, your candidates, companies, job orders and resumes survive a VM resize or an OS disk swap, and they stay on managed, snapshot-friendly storage.

curl -sI http://127.0.0.1/healthz | head -1 findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data findmnt -no SOURCE,TARGET /var/lib/mysql

Production - add your own domain and TLS

OpenCATS serves plain HTTP on port 80 out of the box, so you can sign in immediately. For day-to-day recruiting, serve the console over HTTPS behind your own domain.

Point a DNS record at the VM and open 443/tcp on the NSG. Then terminate TLS in front of nginx with a certificate from your own certificate authority (for example Let's Encrypt). Keep MariaDB on the loopback interface, take regular snapshots of the data disk, and restrict SSH to your management network.

Support

SecureAnyCloud builds and maintains this image and provides 24/7 support. OpenCATS is licensed under the GPL 3.0. SecureAnyCloud is not affiliated with or endorsed by the OpenCATS project.

Deploy on Azure

Launch OpenCATS on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com