Qcadoo MES

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting size. Qcadoo MES runs the Tomcat JVM alongside PostgreSQL and benefits from memory headroom. Scale up for more users, larger orders or heavier reporting.

In the network security group, allow inbound 22/tcp from your management network and 443/tcp from the networks your users will reach Qcadoo on.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Qcadoo MES by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443). Then select Review + create, and Create.

First boot initialization takes approximately one to three minutes after the VM starts. Qcadoo rotates its secrets, generates the per-VM TLS certificate, starts Tomcat and brings the web interface online.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:qcadoo-mes:default:latest
az vm create \
  --resource-group <your-rg> \
  --name qcadoo-mes \
  --image sac1647283583153:qcadoo-mes:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name qcadoo-mes --port 443 --priority 1010

Step 3 - Connect to your VM

Connect over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check the four units and the login endpoint:

systemctl is-active postgresql qcadoo-mes nginx qcadoo-mes-firstboot curl -fsSk -o /dev/null -w 'qcadoo login: %{http_code}\n' https://127.0.0.1/login.html

All four units report active and the login endpoint returns 200. This confirms that the full stack (nginx, Tomcat and PostgreSQL) is serving.

Qcadoo MES is a JVM application, so allow a short warm-up on the very first boot before the login page responds.

Step 5 - Confirm the network bindings

The application and the database bind the loopback interface only. nginx is the single public port. Confirm it:

ss -tln | grep -E ':(443|8080|5432)'

Port 443 is nginx (public, TLS). Tomcat listens on 127.0.0.1:8080 and PostgreSQL on 127.0.0.1:5432, so neither the application server nor the database is directly reachable from the network.

Step 6 - Retrieve your administrator login

The passwords for both accounts and the database password are generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/qcadoo-mes-credentials.txt

The qcadoo.superadmin.login (which is superadmin) and qcadoo.superadmin.pass values are your first sign-in. The file also records the admin login and the per-VM PostgreSQL password. First boot rotates both shipped default logins so that they no longer work.

You can verify the security posture without exposing the password. The shipped defaults are rejected, while the per-VM password authenticates through the real Qcadoo login:

B=http://127.0.0.1:8080
U=$(sudo grep '^qcadoo.superadmin.login=' /root/qcadoo-mes-credentials.txt | cut -d= -f2-)
P=$(sudo grep '^qcadoo.superadmin.pass=' /root/qcadoo-mes-credentials.txt | cut -d= -f2-) login() { cj=$(mktemp); pg=$(curl -s -c "$cj" "$B/login.html"); \
  tok=$(printf '%s' "$pg" | grep -o 'name="_csrf" content="[^"]*"' | head -1 | sed 's/.*content="//;s/"$//'); \
  curl -s -b "$cj" -c "$cj" --data-urlencode "j_username=$1" --data-urlencode "j_password=$2" \
  --data-urlencode "_csrf=$tok" "$B/j_spring_security_check"; echo; rm -f "$cj"; } echo -n 'default superadmin/superadmin -> '; login superadmin superadmin echo -n 'per-VM superadmin -> '; login "$U" "$P"

The first call returns loginUnsuccessfull (the shipped default is dead) and the second returns loginSuccessfull.

Step 7 - First sign-in

Open a web browser and go to https://<vm-public-ip>/. The certificate is self-signed and unique to your VM, so your browser warns you on the first visit. Accept the warning to continue, or install a CA-signed certificate (see Enabling a trusted certificate).

At the Qcadoo MES sign-in page, enter superadmin and the password from /root/qcadoo-mes-credentials.txt.

After you sign in, open the main menu (the arrow next to the qcadoo logo) to reveal the full manufacturing navigation: Products, Technology, Warehouse, Supplies, Planning, Tracking, Sales, Maintenance and more.

Step 8 - Explore and create products

The image ships with a small demo dataset so that you can explore immediately. Open Products from the main menu to see a finished good (a dining table) and its components already loaded.

Select Add new to create your own product. Give it a number and a name, choose a unit (for example pcs), and select Save.

Products are the items you manufacture or consume. They are the foundation of technologies (bills of materials) and production orders.

Step 9 - Plan a production order

Open Planning, then Production orders. The image ships with a demo production order for the dining table, so you can see the planning view in action.

Select Add new to plan your own order. Give the order a number, pick the product to make and the quantity, set the planned dates, and select Save.

The production order is the central shop-floor document in Qcadoo MES. From it you plan work, issue materials and record output and time.

Step 10 - Confirm the data tier

Qcadoo MES keeps all of its state in its PostgreSQL application database. Confirm the schema is present:

sudo -u postgres psql -d mes -tAc "SELECT count(*) AS public_tables FROM pg_tables WHERE schemaname='public';"

The database reports its full set of application tables.

Enabling a trusted certificate

The image serves HTTPS with a per-VM self-signed certificate out of the box. For production, replace it with a CA-signed certificate so browsers trust it without a warning. The image ships with nginx, which certbot can configure automatically.

The following assumes a DNS record pointing your fully qualified domain name at the VM's public IP:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d qcadoo.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

After certbot finishes, reload nginx with sudo systemctl reload nginx. Sign in and change the administrator passwords from the Qcadoo user menu.

Backup and maintenance

Qcadoo MES keeps all of its state in its PostgreSQL application database: products, technologies, production orders, materials, users and configuration. Back it up regularly:

sudo -u postgres pg_dump mes > /tmp/qcadoo-mes-$(date +%F).sql

Ship the dump to Azure Blob Storage or another object store, or snapshot the disk in Azure for point-in-time backups.

Keep the OS patched with sudo apt update && sudo apt upgrade. Apache Tomcat serves Qcadoo MES from /opt/qcadoo-mes. After configuration changes, restart the application with sudo systemctl restart qcadoo-mes. Always back up first.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email and chat for help with deployment, technologies and bills of materials, production planning, materials and stock, TLS certificates and database administration.

Contact sales@secureanycloud.com.

For general Qcadoo questions, consult the project at https://qcadoo.com/. Qcadoo is a trademark of Qcadoo Limited. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Qcadoo MES on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com