OpenEduCat

• Open the Azure Marketplace and search for OpenEduCat on Ubuntu 24.04 LTS by SecureAnyCloud.
• Click Create and select your subscription and resource group.
• Choose a region. The image is available globally.
• Select a VM size. Standard_B2s is recommended for a single school or small institution.
• Under Administrator account, select SSH public key and provide your public key.
• Under Inbound port rules, open port 22 (SSH). After deployment, add an NSG rule for port 8069, scoped to your trusted source IP range rather than 0.0.0.0/0.
• On the Disks tab, select Standard SSD or better for the OS disk.
• Review and create. The VM is ready within two to three minutes.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:openeducat:default:latest
az vm create \
  --subscription "<sub-id>" \
  --resource-group "<rg>" \
  --name openeducat-vm \
  --image sac1647283583153:openeducat:default:latest \
  --size Standard_B2s \
  --storage-sku StandardSSD_LRS \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --public-ip-sku Standard \
  --output table

When the VM is created, add an NSG rule that permits inbound TCP on port 8069 from your source IP:

az network nsg rule create \
  --resource-group "<rg>" \
  --nsg-name openeducat-vmNSG \
  --name allow-openeducat \
  --priority 310 \
  --protocol Tcp \
  --destination-port-ranges 8069 \
  --source-address-prefixes "<your-ip>/32" \
  --access Allow

Connect as the default user, azureuser. Replace the address with the public IP address of your virtual machine.

ssh azureuser@<vm-ip>

openeducat-firstboot.service runs automatically on first boot. It generates three secrets that are unique to your virtual machine: the Odoo master password, the Administrator web login password and the PostgreSQL database password.

No two virtual machines share any of these values, and none are baked into the image. Read them with:

sudo cat /root/openeducat-credentials.txt

The output looks like this. The values shown are illustrative, and yours will differ:

OPENEDUCAT_URL=http://<YOUR-IP>:8069 OPENEDUCAT_ADMIN_LOGIN=admin OPENEDUCAT_ADMIN_PASSWORD=<generated-per-vm> OPENEDUCAT_MASTER_PASSWORD=<generated-per-vm>

A machine-readable copy is at /stage/scripts/openeducat-credentials.log (mode 600, root only):

sudo cat /stage/scripts/openeducat-credentials.log

The default admin / admin login from a stock Odoo install is rejected on this image. Only the per-VM OPENEDUCAT_ADMIN_PASSWORD shown above authenticates.

Confirm that Odoo and PostgreSQL are running:

systemctl status odoo postgresql --no-pager -n 0

Check the Odoo version and the health endpoint:

odoo --version curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8069/web/health

A healthy service returns the HTTP status 200.

Confirm every OpenEduCat module installed successfully:

sudo -u postgres psql -d openeducat -tAc \
  "SELECT name,state FROM ir_module_module WHERE name LIKE 'openeducat%' ORDER BY name;"

• Open http://<your-vm-ip>:8069/web/login in a browser.
• Enter admin as the email and the OPENEDUCAT_ADMIN_PASSWORD value from Step 4.
• Click Log in.

You land on the Odoo backend. Click the grid icon in the top left to open the app switcher. It lists every OpenEduCat module, alongside the standard Odoo apps that OpenEduCat depends on.

OpenEduCat ships with no student, guardian, admission or fee data. This is deliberate: school records are sensitive, and they are yours to enter.

• Click Students in the app switcher, then click New to add a student. Fill in the first name, last name and email, then save.
• Click SIS > Configuration > Program Level and create at least one program level (for example, Undergraduate).
• Click SIS > Configuration > Programs and create a program. Select the program level you just created.
• Click SIS > Configuration > Courses and create one or more courses under that program. Give each course a short, unique code.
• Open a student record and use the Course Details tab to enrol the student in a course.

• Admissions: click Admissions in the app switcher to manage admission registers and student applicants through the admission workflow.
• Time Table and Class Attendances: schedule sessions and record attendance for each session.
• Assignments and Exams: create assignments with due dates, and configure exam sessions, marksheets and results.
• Library: catalogue media (books and other items), issue and return them to students and faculty, and print library cards.
• Parents: grant guardians portal access to their child's academic record.

Each app follows the same pattern as Students and Courses above. Use New to create a record, and use the Configuration menu within each app for the underlying master data: academic years, terms, departments, subjects, batches, classrooms and fee terms.

Components, with version and notes:

OpenEduCat 19.0.1.0 (pinned commit 8738c4a, 19.0 branch) github.com/openeducat/openeducat_erp, LGPL 3.0

Odoo Community 19.0-20260807 Installed from nightly.odoo.com/19.0/nightly/deb

PostgreSQL 16 localhost only (127.0.0.1:5432), password authentication

Python 3.12 Ubuntu 24.04 system Python

Node.js 18+ Used for Odoo asset compilation

wkhtmltopdf 0.12.6 Ubuntu 24.04 patched build for PDF reports

Ubuntu 24.04 LTS (Noble Numbat) Kernel 6.8

Azure Linux Agent 2.9+ waagent, cloud-init, disk and SSH key management

To check the Odoo version that is running, use:

odoo --version

Odoo Server 19.0-20260807

Key paths, with purpose:

/usr/bin/odoo Odoo server binary

/etc/odoo/odoo.conf Main configuration file (mode 640, root:odoo)

/var/lib/odoo Odoo data directory (filestore, sessions)

/opt/openeducat/addons-src OpenEduCat addon modules (pinned commit)

/var/log/odoo/odoo-server.log Odoo server log

/usr/lib/python3/dist-packages/odoo/addons/ Built-in Odoo modules

/stage/scripts/openeducat-credentials.log Machine-readable credentials (mode 600, root)

/root/openeducat-credentials.txt Human-readable credentials and first-use instructions

/usr/local/sbin/openeducat-firstboot.sh First-boot credential rotation script

/usr/local/sbin/openeducat-selftest.sh Functional self-test (creates, reads and deletes a course record)

/etc/systemd/system/openeducat-firstboot.service Systemd unit for first-boot initialisation

/var/lib/sac/data/openeducat-firstboot.done Sentinel file; its presence prevents the first-boot service from running again

/var/run/postgresql/ PostgreSQL runtime socket directory

Check the service status:

systemctl status odoo

Stop the service:

sudo systemctl stop odoo

Start the service:

sudo systemctl start odoo

Restart the service, for example after editing odoo.conf:

sudo systemctl restart odoo

Show the latest lines of the Odoo log:

sudo tail -n 50 /var/log/odoo/odoo-server.log

PostgreSQL dump (recommended)

PGPASSWORD=$(sudo grep '^pg_password=' /stage/scripts/openeducat-credentials.log | cut -d= -f2) \
  pg_dump -h 127.0.0.1 -U odoo -F c -f /home/azureuser/openeducat-backup-$(date +%Y%m%d).dump openeducat

Copy the dump to Azure Blob Storage or another durable destination.

Back up the Odoo filestore at /var/lib/odoo/.local/share/Odoo/filestore/openeducat/ alongside the database dump. It holds uploaded attachments such as student photos, library media covers and report attachments.

Automate with a cron job

# Example: nightly backup at 02:00, keep 7 days 0 2 * * * azureuser
PGPASSWORD=$(sudo grep '^pg_password=' /stage/scripts/openeducat-credentials.log | cut -d= -f2) pg_dump -h 127.0.0.1 -U odoo -F c -f /home/azureuser/openeducat-backup-$(date +\%Y\%m\%d).dump openeducat && find /home/azureuser -name 'openeducat-backup-*.dump' -mtime +7 -delete

Odoo on port 8069 serves plain HTTP. That is acceptable on a private network, but not for internet-facing deployments. Put nginx in front of it as a reverse proxy, with a TLS certificate from Let's Encrypt.

Install nginx and certbot:

sudo apt-get install -y nginx certbot python3-certbot-nginx

Create an nginx virtual host at /etc/nginx/sites-available/openeducat:

upstream openeducat { server 127.0.0.1:8069; } server { listen 80; server_name your-domain.example.com; location / { proxy_pass http://openeducat; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 720s; client_max_body_size 50m; } }

Enable the site and obtain a certificate:

sudo ln -s /etc/nginx/sites-available/openeducat /etc/nginx/sites-enabled/openeducat
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d your-domain.example.com

Once the proxy is enabled, set proxy_mode = True in /etc/odoo/odoo.conf and restart Odoo. This makes Odoo trust the X-Forwarded-For header:

sudo sed -i 's/proxy_mode = False/proxy_mode = True/' /etc/odoo/odoo.conf
sudo systemctl restart odoo

OpenEduCat does not respond on port 8069

Check whether the service is running:

systemctl is-active odoo

If it is inactive, look for startup errors in the log:

sudo tail -50 /var/log/odoo/odoo-server.log

Check whether PostgreSQL is running and accepting connections:

systemctl is-active postgresql
sudo -u postgres psql -c "SELECT version();"

Sign-in fails, or the credentials file does not show generated values

Check that the admin password in odoo.conf is a generated value and not a default:

sudo grep admin_passwd /etc/odoo/odoo.conf

Check whether the first-boot sentinel file exists:

ls -la /var/lib/sac/data/openeducat-firstboot.done

If the file is absent, the first-boot service did not complete. Check its journal:

sudo journalctl -u openeducat-firstboot --no-pager

To run it again, remove the sentinel file and start the service manually:

sudo rm -f /var/lib/sac/data/openeducat-firstboot.done
sudo systemctl start openeducat-firstboot
sudo cat /root/openeducat-credentials.txt

Port 8069 is not reachable from the browser

In the Azure Portal, check that the NSG rule permits inbound TCP on port 8069 from your source IP.

Confirm that OpenEduCat itself is working, not just Odoo

Run the built-in self-test. It creates a real course record, reads it back and deletes it:

sudo /usr/local/sbin/openeducat-selftest.sh

The output ends with OPENEDUCAT_SELFTEST_OK when the test passes.

Database access is already locked down

This image sets dbfilter = ^openeducat$ and list_db = False in /etc/odoo/odoo.conf, so the multi-database selector and /web/database/manager are not exposed. There is exactly one database, and you cannot create or drop databases from the web interface.

Three separate secrets, all rotated per VM

Unlike a bare Odoo image that rotates only the master password, this image rotates the Odoo master password, the Administrator web login password and the PostgreSQL database password on every first boot. To rotate any of them again later, use these commands:

# Odoo master password
NEW_PW=$(openssl rand -hex 16)
sudo sed -i "s|^admin_passwd = .*|admin_passwd = ${NEW_PW}|" /etc/odoo/odoo.conf
sudo systemctl restart odoo
# PostgreSQL database password (update odoo.conf's db_password to match) NEW_PG_PW=$(openssl rand -hex 16)
sudo -u postgres psql -c "ALTER ROLE odoo WITH PASSWORD '${NEW_PG_PW}';"
sudo sed -i "s|^db_password = .*|db_password = ${NEW_PG_PW}|" /etc/odoo/odoo.conf
sudo systemctl restart odoo

To rotate the Administrator web login password, use Settings > Users and Companies > Users in the web interface, or the Reset Password link on the sign-in page.

Restrict NSG rules

Limit inbound access to port 8069 to your office or VPN IP ranges rather than the public internet. PostgreSQL on port 5432 is bound to localhost and is not exposed through the NSG.

Keep packages up to date

Apply security patches regularly:

sudo apt-get update && sudo apt-get upgrade -y odoo
sudo systemctl restart odoo

OpenEduCat is licensed under the GNU Lesser General Public License version 3 (LGPL 3.0). Odoo Community Edition is licensed under the Apache License 2.0. The full LGPL 3.0 licence text is available at www.gnu.org/licenses/lgpl-3.0.html.

You are responsible for your own regulatory and data protection posture for the student data you enter. OpenEduCat and Odoo are trademarks of their respective holders. This image is not affiliated with, endorsed by, or sponsored by OpenEduCat Inc. or Odoo S.A.

SecureAnyCloud provides 24/7/365 expert technical support, with a guaranteed 24 hour response for all requests and a one hour average response time for critical issues. Contact sales@secureanycloud.com.

For the full user guide, visit secureanycloud.com/guides/openeducat-on-ubuntu-24-04-azure. For the complete product catalogue, visit secureanycloud.com/products.

Deploy on Azure

The SecureAnyCloud OpenEduCat image is available on the Azure Marketplace. Search for OpenEduCat on Ubuntu 24.04 LTS by SecureAnyCloud, or open it directly from the Azure Portal.

Need Help?

• Email: sales@secureanycloud.com
• Website: secureanycloud.com
• Azure Marketplace: search SecureAnyCloud to view our full catalogue of production-ready images

Deploy on Azure

Launch OpenEduCat on Ubuntu 24.04 on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com