Deployment guide

ProjeQtOr

Overview

ProjeQtOr is a free and open source project and quality management platform. Project managers, IT departments, service organisations and quality teams use it to run their delivery work from one web interface. It brings together projects and their planning with a Gantt view, activities and tasks, tickets and issues, risks, requirements, tests, meetings, documents, timesheets and resource assignment, all gated by ProjeQtOr's own user and access control.

This SecureAnyCloud image ships ProjeQtOr 13.0.0 served by nginx and PHP 8.3 FPM on a hardened Ubuntu 24.04 LTS base, patched at build time. A bundled local MariaDB server makes the appliance complete and useful on its own. ProjeQtOr runs behind nginx on port 80. MariaDB listens only on the loopback interface (127.0.0.1:3306) and keeps its database, along with your uploaded and generated files, on a dedicated Azure data disk.

First boot generates a unique administrator password on every VM. The well-known ProjeQtOr default login is never left active.

What you get:

ProjeQtOr 13.0.0 served by nginx and PHP 8.3 FPM, managed by systemd
A bundled MariaDB server holding the ProjeQtOr database, already installed and ready
A ready-to-use web console served on :80, with the full versioned schema in place (347 tables) and no install wizard left exposed
A per-VM administrator password, generated on first boot and recorded in a root-only file
No default login: the well-known ProjeQtOr admin / admin credential is rotated to a unique per-VM secret, and no known, blank or weak credential authenticates
The database secret kept out of the web tree: parameters.php lives on the data disk outside the docroot, so it can never be served over HTTP
All required PHP extensions and ProjeQtOr's recommended PHP limits, preconfigured
nginx.service, php8.3-fpm.service and mariadb.service as enabled systemd units
MariaDB bound to 127.0.0.1 only, never exposed to the network
A dedicated Azure data disk carrying the MariaDB database, the ProjeQtOr file store and the database configuration
An unauthenticated /healthz endpoint for Azure Load Balancer health probes
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_D2s_v3 (2 vCPU / 8 GiB RAM) is a sensible starting point. Size up for larger or busier teams.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the console. Also allow 443/tcp once you add TLS.

ProjeQtOr serves plain HTTP on port 80 out of the box. For production, terminate TLS in front of it with your own domain. The bundled MariaDB is never exposed. It listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for ProjeQtOr by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy with the Azure CLI (alternative)

To use the command line instead, create the VM from the SecureAnyCloud ProjeQtOr image with your resource group, image URN, size and SSH key. Open ports 22 and 80 on the NSG, then browse to the public IP.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:projeqtor-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-rg \
  --name projeqtor \
  --image sac1647283583153:projeqtor-ubuntu-24-04:default:latest \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group my-rg --name projeqtor --port 80 --priority 900

Step 3 - Confirm the services and retrieve the admin password

Connect over SSH as azureuser. All three services and the first-boot unit should be active, with nginx listening on port 80 and MariaDB bound to the loopback interface only.

systemctl is-active nginx php8.3-fpm mariadb projeqtor-firstboot ss -tlnp | grep -E ':80 |:3306 '

On the first boot of every VM, ProjeQtOr generates a unique administrator password. It records the password, together with the sign-in URL, in a root-only file. Read the file with sudo:

sudo cat /root/projeqtor-credentials.txt

Step 4 - Sign in to ProjeQtOr

Browse to http://<your-vm-ip>/. ProjeQtOr presents its own sign-in page. Sign in with the user admin and the password from the credentials file.

After you sign in, the Start Guide home opens and walks you through your first configuration steps. The top navigation offers Projects, Activities, Milestones, Meetings, Planning, Resources and Reports. The left menu offers Planning, Ticketing, Agile scrum, Follow up, Steering and Financial.

Step 5 - Create your first project and task

Open the Projects screen from the top navigation and select the new item button to create a project. Give it a name (for example Website Redesign 2026) and save. The project appears in the list, and its full detail form opens, ready for type, planning, organisation and the rest.

Next, open the Activities screen and create a task against that project. Name it (for example Design homepage mockups), leave the activity type as Task and the project set to your new project, and save. The task is stored in MariaDB and reads straight back into the activity list and detail, linked to its project. This is ProjeQtOr at work, from planning down to individual work items.

From here, build out the plan and Gantt schedule, raise tickets and issues, log risks and requirements, record meetings and documents, and enter timesheets against each activity.

Security model - no default credentials

ProjeQtOr ships with a well-known default admin administrator account (admin / admin). This image removes that hazard. First boot rotates the single admin user (id 1) to a unique per-VM secret, stored as a salted SHA 256 hash. The default admin password, a blank password and common weak guesses no longer authenticate.

The database configuration file that holds the ProjeQtOr database secret is written outside the web tree on the data disk, so it can never be served over HTTP. The configuration wizard is never exposed.

Every build proves the following before the image is captured:

The per-VM admin authenticates through ProjeQtOr's own User::authenticate() code path, while the defaults and weak guesses are rejected.
An unauthenticated request to a privileged route is refused.
A real project and task persist through the application's own database layer.

bash /usr/local/sbin/projeqtor-cred-roundtrip.sh

Where your data lives

The MariaDB database, the ProjeQtOr file store (uploads, reports and cache) and the database configuration file all live on a dedicated Azure data disk, not on the OS disk. MariaDB's data directory is bind-mounted from the data disk onto /var/lib/mysql. The ProjeQtOr files directory is bind-mounted onto the same disk.

Your projects, tasks, tickets and uploaded documents therefore survive a VM resize or OS disk swap and stay on managed, snapshot-friendly storage.

curl -sI http://127.0.0.1/healthz | head -1 findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data findmnt -no SOURCE,TARGET /var/lib/mysql

Production - add your own domain and TLS

ProjeQtOr serves plain HTTP on port 80 out of the box so you can sign in immediately. Before you rely on it for day-to-day project management, put it behind your own domain and TLS so the console is served over HTTPS.

Point a DNS record at the VM, open 443/tcp on the NSG, and terminate TLS in front of nginx with a certificate from your own certificate authority (for example Let's Encrypt).

Keep MariaDB on the loopback interface, take regular snapshots of the data disk, and restrict SSH to your management network.

Support

SecureAnyCloud builds and maintains this image and provides 24/7 support. ProjeQtOr is licensed under the GNU Affero General Public License version 3. SecureAnyCloud is not affiliated with or endorsed by the ProjeQtOr project.

Deploy on Azure

Launch ProjeQtOr 13 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

ProjeQtOr (Quality based Project Organizer) is a full-featured open source project and quality management platform used by teams, IT departments and service organisations worldwide. It brings projects, planning and Gantt charts, activities and tasks, tickets and issues, risks, requirements, tests, meetings, documents, timesheets and resource assignment together in a single web application.

This SecureAnyCloud image runs ProjeQtOr behind nginx, with PHP FPM 8.3 (OPcache enabled) and a bundled MariaDB database engine. The install and configuration wizard is already complete, and ProjeQtOr's well-known default admin / admin login has been rotated away. You land directly on the sign-in page of a hardened application.

ProjeQtOr stores its data in the database and in a file store for uploads and reports. The MariaDB data directory and the file store live on a dedicated, independently resizable EBS data volume mounted at /data (bind-mounted onto /var/lib/mysql and /var/www/projeqtor/files). The volume is separate from the operating system disk, so you can grow your project store without touching the root volume.

The database secret is held in a parameters.php file kept outside the web document root at /data/projeqtor/config, so it is never reachable from the browser. MariaDB listens on loopback 127.0.0.1:3306 only and is never exposed to the network.

There is no first-run setup wizard to step through. The ProjeQtOr administrator password is generated on the first boot of every deployed instance, so no two instances launched from the same Amazon Machine Image share credentials. The initial administrator password is written to /root/projeqtor-credentials.txt with mode 0600, so only the root user can read it.

Connecting to your instance

Connect over SSH as the default login user for your operating system variant. ProjeQtOr itself is served on port 80, and you sign in as the admin user in the browser.

OS variant SSH login user Notes

Ubuntu 24.04 ubuntu nginx + php8.3-fpm + mariadb

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users will use
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Open the product page in AWS Marketplace and choose Continue to Subscribe, then Continue to Configuration.
Select the software version and your Region, then choose Continue to Launch.
Under Choose Action, select Launch through EC2.
Pick an instance type. The recommended type is m5.large. A t3.medium is sufficient for small teams.
Select your VPC, subnet and key pair.
Attach a security group that allows inbound TCP 22 from your management network and TCP 80 and 443 from your user networks.
Choose Launch.

Launch the Instance from the AWS CLI

You can also launch from the command line. Replace the AMI ID with the one shown on the Marketplace launch page for your Region, and set your key pair, security group and subnet.

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-keypair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=projeqtor}]'

Wait for the instance to reach the running state and pass its status checks. Then note its public IP address.

Connect and Retrieve the Initial Credentials

Connect to the instance over SSH as the login user for your OS variant (for the Ubuntu variant, ubuntu):

ssh -i my-keypair.pem ubuntu@<public-ip>

Retrieve the per-instance administrator password that first boot generated:

sudo cat /root/projeqtor-credentials.txt

The file lists the sign-in URL, the administrator username, the generated administrator password and the internal database credentials. These values are unique to this instance.

Verify the Service is Running

On the instance, confirm that nginx, PHP FPM and MariaDB are active and that ProjeQtOr is serving:

systemctl is-active nginx php8.3-fpm mariadb

Check that the unauthenticated health endpoint and the sign-in page respond:

curl -s http://127.0.0.1/healthz
curl -s -o /dev/null -w 'login page: HTTP %{http_code}\n' http://127.0.0.1/view/login.php

A 200 from the login page confirms the web stack is serving ProjeQtOr.

Confirm the Data Volume

The MariaDB data directory and the ProjeQtOr file store live on the dedicated EBS data volume mounted at /data, bind-mounted onto /var/lib/mysql and /var/www/projeqtor/files. Confirm that the mounts are present:

mountpoint /data findmnt /var/lib/mysql df -h /data

Because the database is on its own volume, you can grow it independently of the root disk, with a standard EBS volume resize and an ext4 grow.

First Login

Open http://<public-ip>/ in your browser. Sign in as the admin user with the password from /root/projeqtor-credentials.txt.

After you sign in, the ProjeQtOr Start Guide opens. It walks you through defining your first stakeholders, planning and follow-up.

The full navigation menu is on the left (Planning, Ticketing, Agile scrum, Follow up, Steering, Financial, Products, HR, Environment, Tools, Reports and Configuration). The project menu bar is across the top.

Create Your First Project

Choose Projects from the top menu bar, then select the Create a new item button to open a new project. Give it a name, choose a type and status, set planned start and end dates, and save. Once a project exists, add activities and tasks against it and plan them on the Gantt chart under Planning.

From the top menu bar, you can also raise Tickets (issues, bugs, change requests), schedule Meetings, record Milestones, assign Resources and open the Planning view for the interactive Gantt. Tickets, timesheets, risks, requirements and tests are all available from the left navigation menu.

Administration

ProjeQtOr's administration is under Configuration in the left menu. From there you manage global parameters, user parameters, modules, access rights, automation, and the lists of values and types that drive the application.

To add users, open Configuration and manage the resource and user records. Each user is granted a profile that determines their access rights.

To relay notification email through an external SMTP server, configure the mail settings under global parameters. Then reload PHP FPM so that the change is picked up:

sudo systemctl reload php8.3-fpm

Enable HTTPS (Recommended)

For production use, put ProjeQtOr behind TLS. Point a DNS record at the instance, then install a certificate with Certbot:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot obtains and installs the certificate and configures nginx to redirect HTTP to HTTPS. ProjeQtOr derives its base URL from the request, so it serves correctly on your domain as soon as the certificate is in place.

Backup and Maintenance

Back up the ProjeQtOr database regularly. Root can reach the bundled MariaDB over the local socket, so no password is needed:

sudo mariadb-dump --single-transaction projeqtor > projeqtor-backup.sql

Store the resulting dump off the instance (for example in Amazon S3), and back up the file store under /var/www/projeqtor/files as well. Because the data directory and file store are on a dedicated EBS volume, you can also take EBS snapshots for point-in-time recovery.

Keep the operating system patched with regular apt updates during a maintenance window.

Support

SecureAnyCloud provides 24/7 technical support for this ProjeQtOr image by email at sales@secureanycloud.com and by live chat. Our engineers assist with ProjeQtOr deployment and configuration, module and workflow setup, email notification configuration, user and profile management, version upgrades, performance tuning, MariaDB database administration and EBS data volume management.

Critical issues receive a one-hour average response time. For billing or refund requests, contact sales@secureanycloud.com with your instance ID and AWS account details.

Deploy on AWS

Launch ProjeQtOr on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS