pretix

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_D2s_v4 (2 vCPU / 8 GiB RAM) is a sensible starting point. Size up for heavier traffic or larger events.

In the network security group (NSG), allow inbound 22/tcp from your management network. Allow 80/tcp for the web application, and 443/tcp once you add TLS. pretix serves plain HTTP on port 80 out of the box, so terminate TLS in front of it with your own domain.

The bundled PostgreSQL and Redis are never exposed. They listen on 127.0.0.1 only, so ports 5432 and 6379 stay off the network, as does the gunicorn port 8345.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal and choose Create a resource. Search the Marketplace for pretix by SecureAnyCloud, then select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab. Then choose Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:pretix-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name pretix \
  --image sac1647283583153:pretix-ubuntu-24-04:default:latest \
  --size Standard_D2s_v4 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the web application.

az vm open-port --resource-group <your-rg> --name pretix --port 80

Step 3 - Confirm the services are running

Connect over SSH as azureuser. Confirm that PostgreSQL, Redis, the pretix web and worker services, and nginx are all active.

PostgreSQL listens only on 127.0.0.1:5432, Redis only on 127.0.0.1:6379 and gunicorn only on 127.0.0.1:8345. nginx serves the web application on port 80.

systemctl is-active postgresql@16-main redis-server pretix-web pretix-worker nginx

ss -tlnp | grep -E ':80 |:8345 |:5432 |:6379 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator login

Every VM generates its own pretix administrator password on first boot. It writes the password, the login e-mail and the URL to a root-only credentials file. Read the file with sudo:

sudo cat /root/pretix-credentials.txt

Sign in to the pretix control panel as admin@localhost with the PRETIX_ADMIN_PASSWORD from this file. The well-known default password admin has been rotated away and is rejected.

On the VM itself, you can also run sudo -u postgres psql -d pretix. This reaches the database directly over the local socket without a password.

Step 5 - Sign in to the organizer backend

Browse to http://<your-vm-public-ip>/control/. Sign in with the e-mail and password from Step 4.

After you sign in, the dashboard lists your upcoming events. The image ships with a ready-to-use demo organizer and a Demo Conference 2026 event, so you can explore straight away.

Step 6 - Manage products and quotas

Open the demo event, then choose Products to manage the ticket types on sale. Each product has a name and a default price. Quotas control how many are available.

The demo event ships with a Regular Ticket and a Student Ticket, backed by a quota of 100. Choose Create a new product to add more ticket types. Use the Quotas, Categories, Questions, Vouchers and Check-in sections to build out a full event.

Step 7 - Open the public ticket shop

Every live event has a public ticket shop where attendees choose products and check out. The demo event's shop is at http://<your-vm-public-ip>/demo/conf2026/.

Attendees pick quantities and add tickets to their cart. A real deployment then takes payment through a configured payment provider.

Step 8 - The rotated default credential and per-VM secrets

A fresh pretix installation seeds a well-known default administrator, admin@localhost / admin, and generates a Django secret. None of these ship in the SecureAnyCloud image. The administrator password, the PostgreSQL password and the Django secret are regenerated as unique per-VM values on first boot, and the well-known default login is rejected.

You can prove both facts on the VM with the bundled round-trip check. It signs in with the per-VM password and confirms that the default is refused.

sudo bash /usr/local/sbin/pretix-cred-roundtrip.sh

The check prints OK when the per-VM administrator authenticates (HTTP 302 to the control panel) and the default admin@localhost / admin is rejected.

Step 9 - Set your own domain

pretix builds absolute URLs from its configured base URL. The appliance boots with the URL set to the VM public IP, which works for evaluation. Set your own domain before you sell real tickets.

Edit the url in /etc/pretix/pretix.cfg. Add TLS by terminating HTTPS at nginx or an Azure Application Gateway with your certificate. Configure a real mail server in the [mail] section for order e-mails, and set up a payment provider. Then restart the services:

sudo sed -i 's#^url=.*#url=https://tickets.yourdomain.com#' /etc/pretix/pretix.cfg
sudo systemctl restart pretix-web pretix-worker nginx

Where your data lives

The pretix application code and virtual environment live on the OS disk under /var/pretix. The complete pretix datastore lives on a dedicated Azure data disk mounted at /var/lib/pretix-data. It holds two things:

• The PostgreSQL 16 cluster (organizers, events, products, orders and users) under /var/lib/pretix-data/postgresql
• The pretix data directory (uploaded media, generated tickets and the Django secret) under /var/lib/pretix-data/data

The data disk is captured into the image and re-provisioned with every VM. It is independently resizable, so your ticketing data stays separate from the operating system disk.

PostgreSQL and Redis are bound to loopback and are never exposed to the network. For maintenance on the VM, use sudo -u postgres psql -d pretix. For a large-scale deployment, move uploaded media to object storage and enlarge the data disk.

Production notes

For production, put your own domain and a TLS certificate in front of pretix by terminating HTTPS at nginx or an Azure Application Gateway. Configure a mail server and a payment provider. Restrict the NSG so only the ports you need are open.

Real payments require a configured payment provider. No payment method is enabled by default.

Take regular backups of the PostgreSQL database and the media directory. Keep the VM patched. The image ships with unattended security upgrades enabled.

Licensing and trademark

This image ships the open source pretix (Apache 2.0), not pretix Hosted or any Enterprise-only plugins. SecureAnyCloud is not affiliated with or endorsed by rami.io GmbH or the pretix project. pretix is a trademark of its respective owner.

Support

SecureAnyCloud provides 24/7 support for this image. Contact sales@secureanycloud.com for help with deployment, configuration or scaling.

Deploy on Azure

Launch pretix on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com