Paheko

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Choose a larger size for bigger associations and heavier concurrent use.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. Also allow 443/tcp if you terminate TLS on the VM. Paheko serves plain HTTP on port 80, so for production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Paheko by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name paheko \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the web interface:

az vm open-port --resource-group <your-rg> --name paheko --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that nginx and PHP-FPM are active. nginx serves Paheko on port 80. There is no database port to expose, because Paheko uses an embedded SQLite file.

systemctl is-active nginx php8.3-fpm

ss -tlnp | grep ':80 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

Each VM generates its own administrator password on first boot. The password, the login e-mail and the URL are written to a root-only credentials file. Read it with sudo:

sudo cat /root/paheko-credentials.txt

Sign in to Paheko with the paheko.admin.user e-mail (admin@paheko.local) and the paheko.admin.pass value from this file.

To check the login from the command line, run the helper that ships with the image. It opens a real authenticated session with those credentials, then confirms that the correct password reaches the dashboard and a wrong password is rejected.

sudo bash /usr/local/sbin/paheko-cred-roundtrip.sh

Step 5 - Sign in to Paheko

Browse to http://<vm-public-ip>/. Paheko opens on its sign-in screen.

Enter the administrator e-mail and the password from Step 4, then select Se connecter (Sign in).

Step 6 - Explore the dashboard

After you sign in, you reach the Paheko home page. The navigation menu runs down the left: Membres (members), Comptabilité (accounting), Documents, Site web (public website) and Configuration.

Your association is shown on the right. You can edit the welcome text at any time.

Step 7 - Keep your accounts

Open Comptabilité to keep double-entry accounts. On first use, Paheko asks you to set the dates of your first accounting year (exercice). It then provides a standard chart of accounts, entry screens for recording transactions, and reports.

From the accounting menu you can:

• Open Saisie to record transactions (income, expenditure, transfers and advanced entries).
• Open Comptes to review and manage the chart of accounts.
• Open Suivi des écritures to review posted entries.
• Open Exercices & rapports to close accounting years and produce the balance sheet, income statement and other reports.

To change the administrator password, open Mes infos personnelles from the menu and edit your account.

Step 8 - Manage members

Open Membres to manage the people in your association. You can add members, define membership categories and fees, record activities and subscriptions (Activités & cotisations), and send collective messages (Messages collectifs).

Each member has a profile with contact details, category and subscription history.

Step 9 - Verify the stack

Confirm the Paheko version and that the services are enabled. The last command checks that the login page responds:

cat /var/www/paheko/VERSION

systemctl is-enabled nginx php8.3-fpm paheko-firstboot

curl -s -o /dev/null -w 'Paheko login HTTP %{http_code}\n' http://127.0.0.1/admin/login.php

Step 10 - Where your data lives

Paheko keeps all of your association data in a single embedded SQLite database at /var/www/paheko/data/association.sqlite. Uploaded files and generated content live alongside it under /var/www/paheko/data.

That directory sits outside the web-served document root (/var/www/paheko/www), so it is never exposed to the internet. Confirm the database and its location:

sudo ls -l /var/www/paheko/data/association.sqlite

df -h /var/www/paheko | tail -1

To back up your Paheko instance, snapshot the OS disk from the portal or the CLI. Alternatively, archive the data directory, which holds the SQLite database and all uploaded content:

sudo tar czf /tmp/paheko-backup.tgz -C /var/www/paheko data

Paheko can also create its own backups from the Configuration area of the web interface.

Step 11 - Enable HTTPS with Let's Encrypt

The image serves Paheko over HTTP on port 80, so it works immediately at the VM's public address. For production, put it behind HTTPS.

Point a DNS name at the VM and open 443/tcp in the NSG. Then install Certbot and request a certificate. Replace your-domain.example.com with the DNS name that resolves to the VM:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot obtains a certificate, updates the nginx configuration to serve Paheko over HTTPS and sets up automatic renewal. Paheko answers on whatever host you reach it on, so no application configuration change is needed after you add TLS.

Step 12 - Maintain your VM

Apply operating system security updates regularly. The image is patched at build time and ships with unattended security upgrades enabled.

You can upgrade Paheko from its own interface. Alternatively, replace the application tree with a newer release and keep the data directory in place.

Security notes

• Encrypt web traffic. Paheko serves plain HTTP on port 80. For production, put it behind your own TLS-terminating reverse proxy or an Azure Application Gateway with a certificate for your domain, and restrict port 80 in the NSG to trusted networks.
• Protect the administrator password. The per-VM password lives in /root/paheko-credentials.txt, readable only by root. A unique secret key is also generated on first boot, so no shared or default credential ships in the image. Change the administrator password from your personal information page, and keep a copy somewhere safe.
• Keep your data out of the web root. The SQLite database and all uploaded content live under /var/www/paheko/data, outside the web-served directory, and nginx denies direct access to it.
• Keep the VM patched. The image is patched at build time and ships with unattended security upgrades enabled.

Architecture summary

Application: Paheko 1.3.21

Web server: nginx, serving the www/ document root on port 80

Runtime: PHP 8.3 FPM

Database: embedded SQLite at /var/www/paheko/data/association.sqlite (no separate engine)

Data: SQLite database and uploads under /var/www/paheko/data, outside the document root

Credentials: generated on first boot and written to /root/paheko-credentials.txt (mode 0600)

First user: the administrator (admin@paheko.local), who administers the installation

Support

SecureAnyCloud images come with 24/7 support. For questions about this Paheko image or help with your deployment, contact us through the SecureAnyCloud website.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Paheko on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com