OpenMage

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. Scale up for more traffic, larger catalogs or heavier extensions.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network. Allow 443/tcp (HTTPS) and 80/tcp (which redirects to HTTPS) from your shoppers.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for OpenMage by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443).

Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:openmage:default:latest
az vm create \
  --resource-group <your-rg> \
  --name openmage \
  --image sac1647283583153:openmage:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name openmage --port 443 --priority 1010

Step 3 - Connect to your VM

Connect as azureuser, using the public IP address of your VM:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

The three services that back OpenMage should all report active. The storefront answers over HTTPS, and the plain HTTP port redirects to it.

OpenMage serves the store on the address configured at first boot. The local check below pins that address to the loopback interface:

systemctl is-active apache2 mysql openmage-cron.timer
BASE=$(sudo grep '^openmage.url=' /root/openmage-credentials.txt | cut -d= -f2-)
HOST=$(printf '%s' "$BASE" | sed -E 's#https?://##; s#/.*##')
curl -ks -o /dev/null -w 'storefront https -> %{http_code}\n' --resolve "$HOST:443:127.0.0.1" "https://$HOST/"
curl -s -o /dev/null -w 'http redirect -> %{http_code}\n' http://127.0.0.1/

You should see three lines of active, then storefront https -> 200 and http redirect -> 301.

Step 5 - Retrieve your administrator credentials

On the first boot of every VM, a one-shot service (openmage-firstboot.service) generates values that are unique to that VM: a fresh administrator password, a fresh MySQL password, a fresh encryption (crypt) key, and a randomised admin path. The randomised path means the admin panel is not at the well-known /admin.

The service also generates a per-VM self-signed TLS certificate and sets the VM's own address as the store base URL. No shared or default credentials ship in the image. Read the credentials file:

sudo cat /root/openmage-credentials.txt

The file (mode 0600, root only) contains these entries:

• The administrator username (openmage.admin.user, which is admin)
• The administrator password (openmage.admin.pass)
• The randomised admin path (openmage.admin.path)
• The full admin URL (openmage.admin.url)
• The storefront URL and the database credentials

The image is secure by default. A blank, guessed or default password is rejected, while the per-VM administrator from the credentials file authenticates successfully. You can confirm both from the VM's own shell, using the same OpenMage authentication check that the admin login runs:

P=$(sudo grep '^openmage.admin.pass=' /root/openmage-credentials.txt | cut -d= -f2-) sudo -u www-data env OM_PW="$P" php -r 'require "/var/www/openmage/app/Mage.php"; Mage::app(); printf("per-VM admin -> %s\n", Mage::getModel("admin/user")->authenticate("admin",getenv("OM_PW"))?"ACCEPTED":"REJECTED"); printf("default password -> %s\n", Mage::getModel("admin/user")->authenticate("admin","admin123")?"ACCEPTED":"REJECTED"); printf("blank password -> %s\n", Mage::getModel("admin/user")->authenticate("admin","")?"ACCEPTED":"REJECTED");'

The output shows per-VM admin -> ACCEPTED, default password -> REJECTED and blank password -> REJECTED.

Step 6 - Open the storefront

Browse to https://<vm-public-ip>/ to see your store.

The image ships a per-VM self-signed certificate, so your browser shows a one-time certificate warning on your first visit. Click through it, or install your own domain certificate into /etc/apache2/ssl/.

The default catalog is empty and ready for your own products, categories and CMS content.

Step 7 - Sign in to the admin panel

Open the randomised admin URL from the credentials file (openmage.admin.url). It looks like https://<vm-public-ip>/index.php/sac-admin-xxxxxx/. Sign in with the username admin and the password from the credentials file.

After you sign in, you land on the admin dashboard. From there you manage your catalog (products and categories), sales (orders, invoices, shipments), customers, promotions, CMS pages and store configuration.

Step 8 - Confirm the version and the stack

Run this check to print the OpenMage, PHP and MySQL versions and the first-boot service state:

sudo -u www-data php -r 'require "/var/www/openmage/app/Mage.php"; echo "OpenMage ".Mage::getOpenMageVersion()."\n";' php -r 'echo "PHP ".PHP_VERSION."\n";' mysql --version echo "first-boot service: $(systemctl is-active openmage-firstboot.service)"

The output shows OpenMage 20.18.0, PHP 8.3.x and MySQL 8.0.x, and the first-boot service is active.

First-boot service and security model

The one-shot openmage-firstboot.service runs After=mysql.service and Before=apache2.service. The per-VM credentials, keys and TLS certificate are therefore in place before the first page is ever served.

The service performs these actions:

• Rotates the MySQL password in lock-step with OpenMage's stored database configuration (app/etc/local.xml)
• Regenerates the encryption (crypt) key and randomises the admin path
• Rotates the administrator password and sets the store base URL from the VM's own address
• Writes the credentials file at mode 0600 (root only), then drops a sentinel so that it runs exactly once

systemctl status openmage-firstboot.service --no-pager | head -6 sudo stat -c '%a %U:%G %n' /root/openmage-credentials.txt

Administration from the CLI

OpenMage ships maintenance scripts under /var/www/openmage/shell. Run them as the www-data user. For example, to show the status of the catalog indexers:

sudo -u www-data php /var/www/openmage/shell/indexer.php --status

Scheduled jobs, such as index refresh, the newsletter queue and log cleanup, run through openmage-cron.timer. The timer invokes php /var/www/openmage/cron.php every minute, so leave it enabled.

After a configuration change, clear the cache by removing the cache directory:

sudo -u www-data rm -rf /var/www/openmage/var/cache/*

Enable HTTPS with your own domain

The image already serves HTTPS with a per-VM self-signed certificate. For production, point a real domain at the VM's public IP and open 443/tcp in the NSG. Then replace the self-signed certificate with a trusted one from Let's Encrypt, substituting your own domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d your-domain.com

Once the certificate is issued, set your domain as the store base URL so that OpenMage generates correct absolute links. Then clear the cache:

sudo mysql openmage -e "UPDATE core_config_data SET value='https://your-domain.com/' WHERE path IN ('web/unsecure/base_url','web/secure/base_url');"
sudo -u www-data rm -rf /var/www/openmage/var/cache/*

Backup and maintenance

The database lives in MySQL. The application tree, including uploaded media, is under /var/www/openmage. For a point-in-time backup, snapshot the OS disk in Azure, or dump the database as shown below. The database password is in the credentials file.

sudo mysqldump openmage > openmage-backup.sql

Keep the OS patched with sudo apt update && sudo apt upgrade. Unattended security upgrades are enabled by default. To restart the stack, run sudo systemctl restart apache2 mysql openmage-cron.timer.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email or chat for help with:

• OpenMage deployment and upgrades
• Theme and template development, and extension installation
• Catalog and order management, and payment and shipping configuration
• Performance tuning, indexing and caching, and database administration

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch OpenMage LTS on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com