Opensourcepos

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point for a single shop. Choose a larger size for heavier catalogues or busier tills.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, 80/tcp for the application, and 443/tcp if you terminate TLS on the VM. The bundled MariaDB is never exposed. It listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Open Source Point of Sale by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80) and HTTPS (443).

Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:opensourcepos-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name opensourcepos \
  --image sac1647283583153:opensourcepos-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name opensourcepos --port 80,443

Step 3 - Confirm the services are running

SSH in as azureuser. Confirm that nginx, PHP FPM and MariaDB are active and that the first-boot service is enabled. MariaDB listens only on 127.0.0.1:3306, while nginx serves OSPOS on port 80.

systemctl is-active nginx php8.3-fpm mariadb

systemctl is-enabled opensourcepos-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g' | sed -E 's/users:.*//'

Step 4 - Retrieve the per-VM administrator password

Every VM generates its own OSPOS administrator password on first boot. The password, the login user and the application URL are written to a root-only credentials file. Read it with sudo:

sudo cat /root/opensourcepos-credentials.txt

Sign in to OSPOS as user admin with the OSPOS_ADMIN_PASSWORD from this file. On the VM itself, run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in

Browse to http://<vm-public-ip>/. The OSPOS sign-in page opens. Enter username admin and the password from Step 4.

After you sign in, the OSPOS home page gives you one-click access to every module: Customers, Items, Item Kits, Suppliers, Reports, Receivings, Sales, Gift Cards, Messages, Expenses, Cashups and Office.

Step 6 - Add your items

Open Items to build your catalogue. Add items one at a time with New Item, or bulk-load them with CSV Import.

Each item carries a barcode, category, cost and retail price, quantity on hand and tax rates. You can generate barcodes for printing directly from the list.

Step 7 - Ring up a sale

Open Sales to reach the register. Scan or search for items, apply discounts and taxes, and take payment across one or more payment types with cash rounding. Then print or email the receipt.

Suspended sales, returns and gift cards are all handled from the same screen.

Step 8 - Run reports

Open Reports for the built-in reporting suite. It covers sales, inventory, taxes, payments, customers, suppliers and employees, with detailed and summary views and date-range filters. Every report can be exported.

Step 9 - No known or default credentials

Out of the box, OSPOS ships with a well-known default administrator (admin / pointofsale). The SecureAnyCloud image neutralizes it. The built-in administrator password ships rotated to a discarded random value, and every VM generates a unique random administrator password on first boot. No known, blank or default credential authenticates.

You can prove this with the built-in round-trip check. It confirms that the per-VM administrator signs in through the OSPOS login form, while a blank password, the default pointofsale password and other weak guesses are all rejected. The administrator is stored as an employee in the database:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(username,' (OSPOS admin, person_id ',person_id,')') FROM ospos.ospos_employees WHERE username='admin'"

sudo bash /usr/local/sbin/opensourcepos-cred-roundtrip.sh

Step 10 - Verify the version and where your data lives

Confirm the installed OSPOS version, the health endpoint and where your data lives. The MariaDB database lives at /var/lib/mysql. The OSPOS application, meaning the code plus its writable uploads, cache and logs, lives under /var/www/opensourcepos. Both are on the instance disk that rides with the VM:

grep -oE "application_version = '[^']+'" /var/www/opensourcepos/app/Config/App.php

curl -sI http://127.0.0.1/healthz | head -1

sudo du -sh /var/lib/mysql /var/www/opensourcepos

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. For production, point a DNS record at your VM, allow the hostname in OSPOS, and obtain a certificate with Let's Encrypt.

OSPOS validates the Host header, so add your domain to app.allowedHostnames in the environment file. Then restart PHP FPM and request the certificate:

sudo sed -i "s/^app.allowedHostnames = .*/app.allowedHostnames = '<your-domain>,<vm-public-ip>,localhost,127.0.0.1'/" /var/www/opensourcepos/.env
sudo systemctl restart php8.3-fpm
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

OSPOS derives its base URL from the request. Once you reach the VM on your domain over HTTPS, links render correctly with no further change.

Backing up

Your data is the OSPOS database plus any uploaded files. Dump the database and archive the writable directory:

sudo mysqldump --protocol=socket -uroot ospos > /tmp/ospos-backup.sql
sudo tar czf /tmp/ospos-writable-backup.tar.gz -C /var/www/opensourcepos writable

Copy both files off the VM on your usual schedule. To restore, load the SQL dump into the ospos database and unpack the archive back into /var/www/opensourcepos/writable.

Security notes

• Encrypt web traffic. OSPOS serves plain HTTP on port 80 out of the box. For anything beyond a trusted network, add your own domain and TLS as described above, or front the VM with Azure Application Gateway.
• Keep MariaDB private. The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through OSPOS or over SSH with sudo mariadb.
• Protect the administrator password. It is unique per VM, and no known, blank or default credential authenticates. Keep /root/opensourcepos-credentials.txt protected. To rotate the password, sign in and change it under the administrator's employee record, or set a new bcrypt hash directly from the VM:

sudo mariadb ospos -e "UPDATE ospos_employees SET password='$(php -r "echo password_hash('"'"'<new-password>'"'"', PASSWORD_DEFAULT);")', hash_version='2' WHERE username='admin'"

• Host header validation. OSPOS validates the HTTP Host header against app.allowedHostnames to prevent host header injection, so only the hostnames you list are accepted.
• Application files stay private. The CodeIgniter application code, its .env (which holds the database password and the encryption key) and the writable tree all sit outside the nginx document root (/var/www/opensourcepos/public), so they are never reachable from the web.
• Keep the VM patched. Apply operating system updates regularly with sudo apt update && sudo apt upgrade. Unattended security updates are enabled by default.
• Restrict inbound ports. Limit inbound 80/tcp and 443/tcp in your NSG to the networks that need access.

Trademark

Open Source Point of Sale is an open source project distributed under the MIT License. This image is an independent packaging of the open source OSPOS software by SecureAnyCloud and is not affiliated with, sponsored by, or endorsed by the Open Source Point of Sale project.

Support

This image is maintained by SecureAnyCloud with 24/7 support. If you need help deploying or operating Open Source Point of Sale on Azure, contact us at secureanycloud.com.

Deploy on Azure

Launch Open Source Point of Sale on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com