Pydio Cells

Prerequisites

Before you deploy, you need:

• An active Azure subscription
• An SSH key pair
• A VNet and subnet in the target region
• A VM size of Standard_B2s (2 vCPU / 4 GiB RAM) as a sensible starting point. Size up for many concurrent users or large libraries.
• NSG inbound rules that allow 22/tcp from your management network and 80/tcp (plus 443/tcp once you terminate TLS on the VM), so your browser and sync clients can reach Pydio Cells

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, and search the Marketplace for Pydio Cells by SecureAnyCloud. Select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name pydio-cells \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 so that your browser and sync clients can reach Pydio Cells:

az vm open-port --resource-group <your-rg> --name pydio-cells --port 80

Step 3 - Confirm the services are running

Connect over SSH as azureuser. First boot generates this VM's secrets, creates the database and administrator, runs cells configure and warms up the login endpoint. It completes in a minute or two. After that, nginx binds port 80 and Pydio Cells is ready.

systemctl is-active mariadb cells nginx nftables

ss -tln | grep ':80'

/opt/pydio/cells version

The version banner reports Pydio Cells Home Edition, confirming this is the open source AGPL build.

If port 80 is not bound yet, first boot has not completed. This is deliberate and fails closed: Pydio Cells is never published before it has been provisioned and secured. Check progress with systemctl status pydio-cells-firstboot.service and journalctl -u pydio-cells-firstboot.service.

Step 4 - Review the host firewall

Pydio Cells is a cluster-aware server, so its main site and internal gRPC services bind to all interfaces by design. The image therefore ships a default-drop nftables firewall. The only network-reachable ports are 22 (SSH), 80 (nginx to Cells) and 443 (your TLS).

Loopback and established traffic are always allowed, so Cells' own internal communication and all outbound traffic are unaffected.

systemctl is-active nftables

sudo nft list chain inet filter input

Step 5 - Retrieve this VM's administrator credentials

Every VM creates its own administrator on first boot. It writes the login, the password and the sign-in address to a root-only credentials file:

sudo cat /root/pydio-cells-credentials.txt

You can prove from the command line that the generated password authenticates, without printing it. Pydio Cells' own web login endpoint accepts the login and password and returns a token. The correct password reaches an authenticated session, and a wrong one is rejected:

P=$(sudo grep '^pydio.admin.pass=' /root/pydio-cells-credentials.txt | cut -d= -f2-) printf 'login page: HTTP %s\n' "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/login)" printf 'correct password: HTTP %s\n' "$(curl -s -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -d "{\"AuthInfo\":{\"login\":\"admin\",\"password\":\"$P\",\"type\":\"credentials\"}}" http://127.0.0.1/a/frontend/session)" printf 'wrong password: HTTP %s\n' "$(curl -s -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -d '{"AuthInfo":{"login":"admin","password":"WRONG-password","type":"credentials"}}' http://127.0.0.1/a/frontend/session)"

You want to see a 200 for the login page, a 200 for the correct per-VM password and a 401 for a wrong one.

Step 6 - Sign in to Pydio Cells

Browse to http://<vm-public-ip>/. Pydio Cells opens on its sign-in screen. There is no setup wizard, because your administrator was already created on first boot. Enter the pydio.admin.login (admin) and pydio.admin.pass values from Step 5.

Change the password from your account settings after your first sign-in. User self-registration is disabled by default, so you add further users deliberately from the administration area.

Step 7 - Your workspace and files

After you sign in, you land on the Cells home, with your workspaces and recent activity. Pydio Cells organises files into Workspaces. Every account has a private Personal Files workspace and a shared Common Files workspace by default. You can also create Cells, which are shared spaces for collaborating with others.

Select All Files to open the file browser. Upload files and create folders from the web interface, browse and search them, add comments, and share per file or per folder. Every file stays on your own server, in the MariaDB-backed datasource on this VM.

Open a folder to work with its contents. The breadcrumb, activity feed, versioning and per-item sharing are all available from here.

Step 8 - Check persistence and hardening

The stack is enabled to return after a reboot, the credentials file is root-only, and no swap is baked into the OS disk (an Azure image requirement). Unattended security upgrades keep the base operating system patched.

ls -l /root/pydio-cells-credentials.txt

systemctl is-enabled mariadb nginx nftables pydio-cells-firstboot cells

swapon --show | wc -l

Step 9 - Set your external URL and enable HTTPS

Pydio Cells generates absolute links (for sharing and single sign-on) from an external URL. The image sets this to the address it detects on first boot. Before you share files externally, set it to the public host name or IP your users will actually use, and put HTTPS in front.

Point a DNS record at the VM, then install a certificate. The bundled nginx proxies to Cells on the loopback interface, so the nginx integration of certbot terminates TLS in front of it:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d cells.example.com

After you issue the certificate, set the external site URL to your https:// host name. Make sure 443/tcp is open in the NSG:

sudo -u pydio env CELLS_WORKING_DIR=/var/cells /opt/pydio/cells configure sites

Step 10 - Back up and maintain your VM

Everything that matters lives in the MariaDB cells database and the datasource files under /var/cells/data. A database dump plus that directory is a complete backup:

sudo mysqldump cells > pydio-cells-backup.sql
sudo tar czf pydio-cells-data-backup.tar.gz -C /var/cells data

Store the backups somewhere safe. Unattended security upgrades keep the operating system patched, and Azure Backup or managed disk snapshots give you whole-VM recovery.

Security notes

• No shared secret ships in the image. The image contains no database and no secrets. The MariaDB password and the administrator password are generated on the first boot of your VM.
• Only the open source edition is shipped. The installer runs with licenserequired:false and verifies that the binary reports the Home Edition. No Cells Enterprise component is ever pulled or activated.
• Nothing is published before it is secured. In the shipped image, nothing is bound to port 80. The public site is enabled only after first boot has provisioned Cells, so an unprovisioned instance is never exposed to the network.
• Fail closed. If first boot cannot complete, port 80 is never bound at all.
• A default-drop host firewall. nftables allows only 22, 80 and 443 inbound. Cells' internal services are never reachable from the network.
• Put Pydio Cells behind HTTPS before real traffic, set your external URL, and restrict 22/tcp to your management network.
• The database is not exposed. MariaDB is reachable only inside the VM. nginx on port 80 is the sole network-facing service.

Architecture summary

Component Detail

Application Pydio Cells 5.0.2 (AGPL-3.0, Home/Community edition), native Go binary at /opt/pydio/cells

Process management cells.service (systemd), running as the pydio user, working dir /var/cells

Web server nginx reverse proxy on :80 to the loopback bound Cells server (127.0.0.1:8080)

Database MariaDB, in-VM only, database cells

Firewall nftables default drop; only 22, 80, 443 reachable

Credentials /root/pydio-cells-credentials.txt, mode 0600, root only

First boot pydio-cells-firstboot.service, sentinel /var/lib/sac/data/pydio-cells-firstboot.done

Ports 22/tcp SSH, 80/tcp Cells interface, 443/tcp once TLS is configured

Base image Ubuntu 24.04 LTS, patched at build time, unattended security upgrades enabled

Support

SecureAnyCloud images come with 24/7 support. Email sales@secureanycloud.com with your Azure subscription ID and the VM name. For Pydio Cells itself, see the Pydio Cells project on GitHub and the Pydio documentation.

Deploy on Azure

Launch Pydio Cells on Ubuntu 24.04 LTS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com