OpenOLAT

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for OpenOLAT by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size (Standard_B2ms or larger). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443).

Select Review + create, then Create.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:openolat-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name openolat \
  --image sac1647283583153:openolat-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 443 so learners can reach the platform:

az vm open-port --resource-group <your-rg> --name openolat --port 443 --priority 900

ssh azureuser@<vm-public-ip>

First boot generates this VM's secrets and only then starts the application and the web server. Wait two or three minutes after the VM is created before you connect. When the three units are active, the platform is ready:

systemctl is-active postgresql openolat nginx

active active active

Confirm that OpenOLAT answers over HTTPS on the VM itself, and check the release. The image ships a self-signed certificate, so -k is expected here until you install your own certificate in Step 11:

curl -sk https://127.0.0.1/dmz/ | grep -oE 'OpenOlat( | )[0-9.]+' | sed 's/ / /' | sort -u

OpenOlat 21.0.3

Only SSH and the two web ports listen on the VM's network interfaces. Tomcat and PostgreSQL are bound to the loopback address, and the systemd DNS stub resolver is local only:

sudo ss -H -lnt | awk '{print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:5432 127.0.0.1:8088 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

Port 80 serves only a permanent redirect to HTTPS:

curl -s -o /dev/null -w '%{http_code} -> %{redirect_url}\n' http://127.0.0.1/

301 -> https://127.0.0.1/

Every secret on this VM was generated on its first boot and written to a file that only root can read. No secret is shared with any other deployment:

sudo cat /root/openolat-credentials.txt

# OpenOLAT 21.0.3 on Ubuntu 24.04 by sac - per-VM credentials (generated at first boot)
# Sign in at the URL below as 'administrator'. Your browser will warn about the
# self-signed certificate until you install a certificate for your own domain. OPENOLAT_URL=https://<vm-public-ip>/ openolat.admin.user=administrator openolat.admin.pass=<unique to this VM> openolat.db.name=openolat openolat.db.user=openolat openolat.db.pass=<unique to this VM>

administrator is OpenOLAT's built-in system administrator account. OpenOLAT's published default password for that account never exists in this image. The build seeds the account with a random value instead, and replaces it again before capture with a value nobody records.

Your VM generates its own password on first boot, and the first-boot log records each step:

sudo tail -n 3 /var/log/sac/sac-firstboot.log

[...] openolat-firstboot: writing /root/openolat-credentials.txt [...] openolat-firstboot: secrets minted - releasing the web stack [...] openolat-firstboot: first boot complete - OpenOLAT is at https://<vm-public-ip>/

Browse to https://<vm-public-ip>/. Your browser warns about the self-signed certificate. Accept the warning to continue, or install your own certificate first (Step 11).

OpenOLAT signs you in in two stages. Enter the username administrator and select Login, then enter the password from Step 6. The first time you sign in, OpenOLAT asks you to accept its terms of use.

You can also verify the credential from the VM itself. The image includes a small checker that signs in through the real OpenOLAT login form. It reads the password from standard input, so the password never appears on a command line:

sudo sed -n 's/^openolat\.admin\.pass=//p' /root/openolat-credentials.txt | sudo /usr/local/sbin/openolat-login-check administrator

LOGIN_OK

OpenOLAT's published default password is rejected:

printf 'openolat' | sudo /usr/local/sbin/openolat-login-check administrator || true

LOGIN_REJECTED

Change the administrator password after your first sign-in. Open the menu under your initials at the top right and choose Password. OpenOLAT requires at least 12 characters, including a letter and a digit or symbol.

Choose Authoring in the top navigation, then Create and Course. Give the course a title, keep the default course design (With learning path) and select Create. OpenOLAT opens the new course's settings. The course appears in Authoring under My entries with the status Preparation.

Open Administration in the course toolbar and choose Course editor. Use Insert course elements to add content, for example a Page for the course introduction, a Forum for discussion and a Folder for course materials. Rename each element on its Title and description tab and select Save.

Close the editor by selecting the course title in the breadcrumb, then choose Publish automatically. The course now shows its elements in the learning path on the left.

When you are ready for learners, change the course Status from Preparation to Published. Then add participants under Administration, Members management.

Choose User management in the top navigation. You can create accounts one by one or import a list, and assign roles such as author, coach or learner administrator.

For a larger institution, OpenOLAT can also sign users in through LDAP, Shibboleth or OpenID Connect identity providers instead of local accounts. See the OpenOLAT administrator manual for each option.

OpenOLAT sends account, notification and password-reset mail. Outbound mail is switched off in this image until you configure a relay. Azure blocks outbound port 25 on most subscriptions, so use an authenticated provider on port 587.

Open More, Administration, Core functions, E-mail. Enter your provider's host, port, username and password, then send yourself a test message.

Point a DNS A record at the VM's public IP. Then tell OpenOLAT the name to use in the links it builds, such as those in notification mail.

Until you set a name, the image points OpenOLAT at the VM's current public IP on every boot. Once you set your own name, the image never overwrites it:

sudo sed -i 's/^server\.domainname=.*/server.domainname=lms.example.com/' /opt/openolat/lib/olat.local.properties
sudo systemctl restart openolat

When the name resolves publicly, obtain a certificate for it. The Certbot nginx plugin installs the certificate and renews it automatically:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d lms.example.com

• No default credentials. No default or shared credential ships in the image. The OpenOLAT administrator password, the database password, OpenOLAT's maintenance and session-administration URL tokens, its installation identifier and the HTTPS certificate are all generated on this VM's first boot.
• Never half-configured. The database role has no password at all in the captured image. Tomcat and nginx are both held back until first boot has generated this VM's secrets, so a VM is never reachable half-configured.
• Minimal network exposure. Only 22/tcp, 80/tcp and 443/tcp listen off the VM. 80/tcp issues a permanent redirect to HTTPS and serves nothing else. Tomcat is bound to 127.0.0.1:8088 with no shutdown port and no sample applications, and PostgreSQL is bound to 127.0.0.1.
• Features off by default. Self-registration, guest access and the REST API are off by default:

sudo grep -E '^(server\.domainname|registration\.enableSelfRegistration|login\.enableGuestLoginLinks|restapi\.enable|smtp\.host)=' /opt/openolat/lib/olat.local.properties

server.domainname=<vm-public-ip> smtp.host=disabled registration.enableSelfRegistration=false login.enableGuestLoginLinks=false restapi.enable=false

Turn on self-registration under More, Administration, Login, Self-registration, and guest access under Anonymous and external user. Do this only when you intend to accept public sign-ups or anonymous visitors.

Ubuntu's unattended security upgrades remain enabled. Every package in the stack comes from Ubuntu's main archive except Apache Tomcat, which is the upstream 10.1 release.

The Java heap follows the VM size, so to give OpenOLAT more memory you only need to resize the VM:

ps -o args= -u openolat | tr ' ' '\n' | grep -E '^-XX:(Max|Initial)RAMPercentage'

-XX:InitialRAMPercentage=12 -XX:MaxRAMPercentage=40

OpenOLAT's application log is /opt/openolat/logs/olat.log. It rolls over daily and keeps 30 days. Tomcat's own output goes to the systemd journal (journalctl -u openolat):

sudo tail -n 5 /opt/openolat/logs/olat.log

OpenOLAT keeps its state in two places: the PostgreSQL database and the file store at /var/lib/openolat/olatdata. Stop the application briefly so that the two backups are consistent:

sudo systemctl stop openolat
sudo -u postgres pg_dump -Fc openolat > ~/openolat-db-$(date +%F).dump
sudo tar czf ~/openolat-files-$(date +%F).tar.gz /var/lib/openolat/olatdata
sudo systemctl start openolat

Copy both backups off the VM. Take an Azure disk snapshot before any upgrade.

Ubuntu security updates, including OpenJDK, PostgreSQL and nginx, are applied automatically.

To move to a later OpenOLAT 21 patch release, back up first (Step 14). Then replace the web application with the new release and restart. OpenOLAT upgrades its own database schema on start. The release files are listed at openolat.com/releases. The example below uses openolat_2104.war, so substitute the file name of the release you are installing:

cd /tmp && curl -fsSLO https://www.openolat.com/releases/openolat_2104.war
sudo systemctl stop openolat
sudo mv /opt/openolat/webapp /opt/openolat/webapp.previous
sudo mkdir /opt/openolat/webapp && sudo unzip -q /tmp/openolat_2104.war -d /opt/openolat/webapp
sudo chown -R root:openolat /opt/openolat/webapp && sudo chmod -R g+rX,o+rX /opt/openolat/webapp
sudo systemctl start openolat

Watch sudo journalctl -u openolat -f until Tomcat reports that the server has started. Then sign in and check the release shown at the bottom right of every page.