Deployment guide

OpenProject

Overview

OpenProject is an open source project management and team collaboration platform that covers the full delivery lifecycle. It includes work packages (tasks, features and bugs), Gantt timelines, agile boards for Scrum and Kanban, a project wiki, time and cost tracking, budgets and team status reporting.

The SecureAnyCloud image installs OpenProject 16 from the official all-in-one packager.io package and pairs it with PostgreSQL 16 and memcached. nginx fronts it on port 80, and the database and file attachments live on a dedicated Azure data disk. The image rotates the database password, the Rails secret and the administrator account on the first boot of every VM, and it is backed by 24/7 SecureAnyCloud support.

What you get:

OpenProject 16 served on port 80 by nginx, which reverse-proxies the bundled Puma application server on loopback
PostgreSQL 16 and memcached on loopback, with the database data directory on a dedicated Azure data disk
A dedicated Azure data disk at /var/lib/openproject for the PostgreSQL database and the OpenProject file attachments
A per-VM database password, a fresh Rails secret and a unique administrator account, all generated on first boot
openproject.service (the Rails web and worker processes) and nginx.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B4ms (4 vCPU / 16 GiB RAM) is a good starting point, because OpenProject runs a Rails application, background workers and PostgreSQL together.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the OpenProject web interface. For public exposure, front the site with TLS as described in Step 12.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for OpenProject by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:openproject-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name openproject \
  --image sac1647283583153:openproject-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name openproject --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm OpenProject is running

On first boot, OpenProject rotates its database password and Rails secret, resets the administrator account to a fresh per-VM password, sets the host name to your VM's public IP and starts the stack. The Rails application takes a short while to warm up on the very first boot. The health check below waits for it.

Check that both services are active:

systemctl is-active openproject nginx

Both report active.

Then confirm that the OpenProject health endpoint answers through nginx on port 80:

for i in $(seq 1 30); do code=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/health_checks/default) [ "$code" = "200" ] && break sleep 5 done curl -s -o /dev/null -w 'health: HTTP %{http_code}\n' http://127.0.0.1/health_checks/default

The health endpoint returns HTTP 200.

Step 5 - Retrieve the administrator password

First boot generates an administrator account that is unique to your VM. Read the credentials file as root:

sudo cat /root/openproject-credentials.txt

The file contains the login (admin), the email (admin@sac.local) and a unique password. After your first sign-in, change the email and password in the account settings.

Step 6 - Verify the administrator can authenticate

Confirm that the per-VM administrator credentials authenticate by performing a real sign-in against the login form. The command below fetches the CSRF token, then posts the login. Take the password from the credentials file shown above:

JAR=$(mktemp)
TOKEN=$(curl -s -c "$JAR" http://127.0.0.1/login | grep -oE 'name="authenticity_token"[^>]*value="[^"]+"' | head -1 | sed -E 's/.*value="([^"]+)".*/\1/')
curl -s -b "$JAR" -c "$JAR" -o /dev/null -w 'login: HTTP %{http_code}\n' \
  -X POST http://127.0.0.1/login \
  --data-urlencode "authenticity_token=$TOKEN" \
  --data-urlencode "username=admin" \
  --data-urlencode "password=<OPENPROJECT_ADMIN_PASSWORD>" \
  -H 'Referer: http://127.0.0.1/login' rm -f "$JAR"

A correct password returns HTTP 302, a redirect into the application. A wrong password re-renders the form as HTTP 422.

To use the REST API at /api/v3 instead, create a personal API token in the web UI under My account, Access tokens, API. Then authenticate with HTTP basic auth as apikey:<your-token>.

Step 7 - Sign in to OpenProject

Browse to http://<vm-public-ip>/login. Sign in with admin and the password from the credentials file.

Step 8 - Work packages

OpenProject organizes work as work packages: tasks, features, bugs, milestones and more. Open a project and choose Work packages to see the list. From there you can filter and group it and create new items.

Each work package has a type, status, assignee, dates, priority and a full activity history.

Step 9 - Gantt timeline

Switch the work packages view to Gantt mode. On the timeline you can see and adjust the project schedule, set dependencies between work packages, and track milestones.

Step 10 - Work package detail

Open any work package to see and edit its full detail. The detail view shows status, assignee, dates, estimates and progress, priority, relations, watchers, and a complete activity log with inline comments.

Step 11 - The dedicated data disk

The PostgreSQL database and the OpenProject file attachments live on a dedicated Azure data disk mounted at /var/lib/openproject, separate from the OS disk. This keeps your project data independent of the OS image and lets you resize the disk as your installation grows. Confirm the mount:

df -h /var/lib/openproject findmnt /var/lib/openproject

Step 12 - Enabling HTTPS

For any public deployment, front OpenProject with TLS. Point a DNS A record at your VM's public IP, then install a certificate with Certbot and the nginx plugin. Run these steps on your VM, and replace the example domain and email with your own values:

Install Certbot: sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
Obtain and install a certificate for your-domain.example.com by running Certbot with the nginx plugin. Supply your contact email when prompted.
After issuance, tell OpenProject it is served over HTTPS by setting OPENPROJECT_HTTPS="true" and the host name to your domain. Runsudo openproject config:set OPENPROJECT_HTTPS="true", then sudo openproject config:set SERVER_PROTOCOL_FORCE_HTTPS="true".
Restart with sudo systemctl restart openproject so that generated links use https://.

Certbot installs a renewal timer automatically, so certificates renew without further action.

Step 13 - Maintenance

Updates: The OS continues to receive unattended security updates. Upgrade OpenProject itself with sudo apt-get update && sudo apt-get install --only-upgrade openproject, followed by sudo openproject configure.
Backups: OpenProject ships a backup helper, sudo openproject run backup, which dumps the PostgreSQL database and the attachments. Both live on the data disk under /var/lib/openproject.
Logs: Read application logs with sudo openproject logs. nginx logs are under /var/log/nginx/.

Support

This image is maintained by SecureAnyCloud with 24/7 support. For help with the image, contact sales@secureanycloud.com.

OpenProject is a trademark of its respective owners. SecureAnyCloud is not affiliated with or endorsed by the OpenProject project.

Deploy on Azure

Launch OpenProject on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

OpenProject is an open source application for classic, agile and hybrid project management and team collaboration. It brings together work package tracking, Gantt chart planning, agile boards for Scrum and Kanban, time and cost reporting, team wikis, meetings, documents and budgets in a single self-hosted web application.

This SecureAnyCloud image installs OpenProject from the official vendor package and runs it as a managed appliance. The appliance runs the Puma application server and a GoodJob background worker, backed by a PostgreSQL 16 database and a memcached cache. nginx terminates port 80 and reverse-proxies the application, which listens only on the loopback interface. A single systemd service, openproject.service, supervises the application processes and starts them on boot.

What you get:

The PostgreSQL database at /var/lib/postgresql, on a dedicated, independently resizable EBS data volume. Your projects and work packages stay off the operating system disk and survive instance replacement.
A unique administrator password for every instance, created by a one-shot first-boot service and written to /root/openproject-aws-credentials.txt with mode 0600, so that only the root user can read it.

A fresh OpenProject install ships a built-in administrator account with a well-known default password. To secure every deployed instance, the first-boot service generates a unique administrator password, applies it to the administrator account and clears the forced password-change prompt. Two instances launched from the same Amazon Machine Image never share an administrator password.

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and port 80 for the web interface
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for OpenProject. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. OpenProject runs PostgreSQL, memcached, the Puma application server and a GoodJob worker together, so it benefits from the memory. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that opens port 22 from your management network and port 80 for the web interface. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization generates the administrator password and starts the appliance. It takes a couple of minutes after the instance state becomes Running and the status checks pass.

Launch the instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud OpenProject Marketplace AMI into an existing subnet and security group. Replace the values in angle brackets:

<ami-id>: the AMI ID shown on the Marketplace listing
<key-name>: your EC2 key pair name
<subnet-id>: your subnet ID
<security-group-id>: a security group that opens ports 22 and 80 as described above

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=openproject}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can find both in the EC2 console or with aws ec2 describe-instances.

Connect to your instance

Connect over SSH with your key pair and the login user for your operating system variant.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i <key-name>.pem ubuntu@<public-ip>

Retrieve the administrator password

The administrator password is unique to your instance and was generated on first boot. Read it as root:

sudo cat /root/openproject-aws-credentials.txt

The file lists the OpenProject URL, the administrator user (admin) and the generated password. Keep this password somewhere safe.

Sign in to the web interface

nginx serves the OpenProject web interface on port 80 and reverse-proxies the application. In a browser, go to:

http://<instance-public-ip>/

Sign in as admin with the password from the credentials file. You land on your account home. Open the bundled demo project to explore the project overview, which gathers the project description, status, members, news and the project life cycle.

Work is tracked as work packages. Open Work packages in a project to see the configurable table of tasks, milestones and phases with their type, status, assignee and priority. You can filter, group and save views, and create new work packages from the same screen.

Use the Administration area, reached from the account menu at the top right, to manage users, groups, roles and permissions, work package types and workflows, authentication, email and the rest of the system settings.

Confirm OpenProject is running

Over SSH, confirm that the appliance service is active and that nginx is listening on port 80:

sudo systemctl is-active openproject.service
sudo ss -tlnp | grep ':80 '

The service reports active, and a listener appears on port 80. The appliance also runs PostgreSQL, memcached, Puma and a GoodJob worker on the loopback interface. List the OpenProject units with:

systemctl list-units 'openproject*' --type=service --no-pager

Check the OpenProject version

Confirm the installed OpenProject version with the bundled command-line tool:

sudo openproject run bundle exec rake version

The database and the data volume

OpenProject stores all of your projects, work packages, users and wiki content in its bundled PostgreSQL database. The database cluster lives on a dedicated EBS volume mounted at /var/lib/postgresql. This keeps it off the operating system disk and lets you resize or snapshot it independently. Confirm the mount:

df -h /var/lib/postgresql

To grow the database storage, expand the EBS volume in the AWS console. Then grow the filesystem on the instance by running sudo resize2fs on the underlying device.

Uploaded attachments are stored under /var/db/openproject/files.

Use the REST API

OpenProject exposes a REST API on the same port 80, under /api/v3. Create a per-user API key in the web interface under My account, then Access tokens. Use it with HTTP Basic authentication: send the user name apikey and your token as the password.

For example, from outside the instance, list your work packages with curl -u apikey:<your-token> http://<instance-public-ip>/api/v3/work_packages.

To confirm at any time that the application and its database are healthy, call the built-in health check endpoint. It returns a plain-text report:

curl -s http://127.0.0.1/health_check

A healthy instance reports PASSED for the database schema check and the application status.

Add a custom domain and enable HTTPS

The appliance accepts requests on any host name, so it works immediately on the instance's public IP. nginx terminates HTTP on port 80 and reverse-proxies the application. Its site file is /etc/nginx/sites-available/openproject.

The simplest way to serve OpenProject on your own domain over HTTPS is to place the instance behind an AWS Application Load Balancer. Use an AWS Certificate Manager certificate that terminates TLS and forwards to port 80. Point a DNS record at the load balancer, and restrict the security group so port 80 is reachable only from the load balancer.

To terminate TLS on the instance instead, edit /etc/nginx/sites-available/openproject and add a listen 443 ssl; server block with your certificate and key, for example from Certbot. Set server_name to your domain, and reload nginx with sudo nginx -t && sudo systemctl reload nginx. Restrict the security group so ports 80 and 443 are reachable only from the networks that use the application.

Backup and maintenance

Back up OpenProject by snapshotting the /var/lib/postgresql EBS volume, which captures the entire database, together with the attachments under /var/db/openproject/files. The bundled tooling also provides sudo openproject run backup for a consistent application-level backup.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed. The OpenProject appliance starts automatically on boot.

Support

This image is published and supported by SecureAnyCloud. Support covers deployment, project and workflow configuration, user and role management, the REST API, SMTP and email notifications, backups, database tuning, custom domains, TLS and scaling. Contact SecureAnyCloud through the support channel on the AWS Marketplace listing.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch OpenProject on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS