Deployment guide

Saleor

Overview

Saleor is a high-performance, GraphQL-first open source e-commerce platform built on Python and Django, with a modern React admin Dashboard. It powers headless storefronts for brands that need a flexible, API-driven commerce backend.

The SecureAnyCloud image delivers Saleor 3.23 fully installed and wired together as a Docker Compose stack, so a production-grade commerce API and admin Dashboard are running within minutes of launch. An nginx reverse proxy publishes the Dashboard and the GraphQL API on port 80 same-origin, the data tier lives on a dedicated Azure data disk, and a unique administrator account is generated on the first boot of every VM. The image is backed by 24/7 SecureAnyCloud support.

What you get:

Saleor 3.23 (BSD-3-Clause) as a Docker Compose stack: the GraphQL API, the React admin Dashboard, PostgreSQL 15, a Valkey (Redis-compatible) cache and Celery broker, a Celery worker and a local mail capture service
Docker Engine and the Docker Compose plugin from the official Docker repository
nginx on port 80 reverse-proxying /graphql/ (and /media/, /thumbnail/, /digital-download/, /.well-known/) to the API and serving the Dashboard SPA same-origin
A dedicated Azure data disk at /var/lib/saleor for the PostgreSQL database, the Valkey state and your media uploads
A per-VM Django secret key, JWT signing key and unique administrator account, generated on first boot
saleor.service, nginx.service and docker.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B4ms (4 vCPU / 16 GiB RAM) is a good starting point. Use Standard_D8s_v5 or larger for production catalogs.

Configure the NSG inbound rules to allow 22/tcp from your management network and 80/tcp for the Saleor Dashboard and GraphQL API. For public exposure, front the VM with TLS (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, select Create a resource, search the Marketplace for Saleor by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:saleor-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name saleor \
  --image sac1647283583153:saleor-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name saleor --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the Saleor stack is running

On first boot, Saleor generates a fresh Django secret key and JWT signing key, runs the database migrations against a clean database, creates a unique per-VM administrator account and brings the Docker Compose stack up. Confirm that the systemd units are active:

systemctl is-active saleor nginx docker

All three report active.

The Saleor stack runs as a set of Docker Compose containers. List the containers and confirm that the GraphQL API answers on port 80:

sudo docker ps --format '{{.Names}}\t{{.Status}}' curl -s -o /dev/null -w 'GraphQL HTTP %{http_code}\n' \
  -H 'Content-Type: application/json' \
  --data '{"query":"{ shop { name } }"}' http://127.0.0.1/graphql/

The api, dashboard, db, cache, worker and mailpit containers show Up, and the GraphQL query returns HTTP 200.

Step 5 - Retrieve the administrator password

The administrator account is unique to your VM and is generated on first boot. Read the credentials file as root:

sudo cat /root/saleor-credentials.txt

The file contains the admin email (admin@sac.local), a unique password, and the Dashboard and GraphQL URLs for this VM. Change the email and password from the Dashboard after your first sign-in.

Step 6 - Sign in to the Dashboard

Browse to http://<vm-public-ip>/. The Saleor Dashboard sign-in screen appears. Sign in with admin@sac.local and the password from the credentials file.

After you sign in, the Dashboard home shows the sales and orders overview and the navigation for your catalog, orders, customers, discounts, configuration and more.

Step 7 - Manage your catalogue

Open Catalog -> Products to manage products, variants, collections and channels. From here you can create products, set pricing per channel, manage stock and organize your catalog.

Step 8 - Manage orders

Open Orders to see customer orders with their payment and fulfillment status, totals and channel. From here you can fulfill orders, capture payments, issue refunds and manage drafts.

Step 9 - Use the GraphQL API

Saleor exposes every capability through a single GraphQL API at the /graphql/ path on port 80. To obtain an access token, POST a tokenCreate mutation with your admin email and password. Run the following on your VM, substituting the password from the credentials file:

EMAIL=admin@sac.local
PASS=$(sudo grep '^saleor.admin.pass=' /root/saleor-credentials.txt | cut -d= -f2-)
curl -s -H 'Content-Type: application/json' \
  --data "{\"query\":\"mutation{tokenCreate(email:\\\"$EMAIL\\\",password:\\\"$PASS\\\"){token errors{message}}}\"}" \
  http://127.0.0.1/graphql/

The response contains a JWT token. Use it as a Bearer token in the Authorization header for authenticated API requests. The GraphiQL playground is also available in a browser at http://<vm-public-ip>/graphql/.

Step 10 - The dedicated data disk

The PostgreSQL database, the Valkey state and your Saleor media uploads live on a dedicated Azure data disk mounted at /var/lib/saleor, separate from the OS disk. This keeps your catalog, orders, customers and media independent of the OS image and lets you resize the disk as your store grows.

df -h /var/lib/saleor findmnt /var/lib/saleor

Step 11 - Enabling HTTPS

For any public deployment, front Saleor with TLS. Point a DNS A record at your VM's public IP, then install a certificate with Certbot and the nginx plugin. Complete the following on your VM, replacing the example domain with your own value:

Install Certbot: sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
Obtain and install a certificate for your domain by running Certbot with the nginx plugin for your-domain.example.com. Supply your contact email when prompted.
After issuance, your Dashboard and GraphQL API are served over https://. Saleor accepts any host (ALLOWED_HOSTS=*), so no rebuild is needed.

Certbot installs a renewal timer automatically, so certificates renew without further action.

Step 12 - Maintenance

Updates: The OS continues to receive unattended security updates. The Saleor stack is pinned to the 3.23 image tags in /opt/saleor/docker-compose.yml. To move to a newer Saleor release, update the image tags and run sudo /opt/saleor/saleor-compose.sh pull && sudo systemctl restart saleor.
Backups: Back up the PostgreSQL database under /var/lib/saleor/db and the media under /var/lib/saleor/media. Together they hold all of your catalog, orders and uploads.
Logs: View container logs with sudo /opt/saleor/saleor-compose.sh logs <service> (for example api, worker or dashboard). nginx logs are under /var/log/nginx/.

Support

SecureAnyCloud maintains this image and provides 24/7 support. Saleor is a trademark of its respective owners. SecureAnyCloud is not affiliated with or endorsed by the Saleor project. For help with the image, contact sales@secureanycloud.com.

Deploy on Azure

Launch Saleor on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs Saleor, the GraphQL-first open source e-commerce platform. Built on Python and Django with a modern React admin Dashboard, Saleor exposes every commerce capability through a single, strongly typed GraphQL API. These capabilities include products, variants, collections, channels, pricing, carts, checkout, orders, fulfillment, payments, gift cards, discounts, customers and permissions. Saleor powers headless storefronts, mobile apps and integrations against one consistent schema.

Saleor 3.23 is deployed from the official saleor-platform Docker Compose stack, pinned to the 3.23 image tags. The stack comprises the Saleor GraphQL API, the Saleor Dashboard admin single-page application, a PostgreSQL 15 database, a Valkey (Redis-compatible) cache and Celery broker, a Celery worker for background jobs and a local mail capture service for transactional email. Docker Engine and the Docker Compose plugin are installed from the official Docker package repository, and the stack runs as a saleor.service systemd unit that brings it up on boot.

An nginx reverse proxy on port 80 is the single public entry point. It proxies the GraphQL API paths (/graphql/, /media/ and related) to the API container and serves everything else, including the Dashboard, from the Dashboard container. The Dashboard is configured to talk to the API on the same origin, so it works from any browser that reaches the instance, with no per-host rebuild.

The PostgreSQL database, the Valkey state and your media uploads live on a dedicated, independently resizable EBS data volume mounted at /var/lib/saleor, so your catalog, orders, customers and media survive instance replacement.

On the first boot of every deployed instance, a one-shot service runs the database migrations against a clean database, generates a fresh Django secret key and JWT signing key, generates an administrator password and creates the first Dashboard administrator. No demo data and no shared or default credentials ship in the image. The administrator password is written to /root/saleor-credentials.txt with mode 0600, so that only the root user can read it.

Prerequisites

Before you deploy this image you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and port 80 for the Dashboard and API
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Saleor. Select the SecureAnyCloud listing and choose Select, then choose Continue on the subscription summary.

Pick an instance type of t3.large or larger. Saleor runs several containers, including PostgreSQL and a Celery worker, so it needs the memory. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and either create or select a security group that opens port 22 from your management network and port 80 for the Dashboard and API. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization runs the database migrations and creates the administrator. On a fresh instance, this takes a minute or two after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud Saleor Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described earlier.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=saleor}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can find both in the EC2 console or with aws ec2 describe-instances.

Connect to Your Instance

Connect over SSH with your key pair and the login user for your operating system variant.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i <key-name>.pem ubuntu@<public-ip>

Retrieve the Admin Password

The Dashboard administrator password is unique to your instance and is generated on first boot. Read the credentials file as root:

sudo cat /root/saleor-credentials.txt

The file lists the Dashboard URL, the GraphQL endpoint, the administrator email (admin@sac.local) and the generated password. Store this password somewhere safe.

Sign In to the Dashboard

The Saleor Dashboard is served on port 80 by nginx. In a browser, go to:

http://<instance-public-ip>/

The Saleor sign-in page appears. Sign in with the email admin@sac.local and the password from the credentials file. The Dashboard home then loads, with the catalog, fulfillment, customers, discounts and configuration navigation on the left and your store overview in the center.

Open Catalog, then Products, to manage your products, variants, collections and channels. This is where you build and curate the catalog that your storefronts read over the GraphQL API.

Open Orders to review and manage customer orders, with their payment and fulfillment status, totals and channel.

Confirm Saleor Is Running

Over SSH, confirm that the systemd unit, Docker and nginx are active and that the Compose stack containers are up:

sudo systemctl is-active saleor nginx docker

sudo /opt/saleor/saleor-compose.sh ps --format '{{.Service}} {{.Status}}'

The services report active, and the api, dashboard, db, cache and worker containers are all running.

Use the GraphQL API

Saleor exposes every capability through the GraphQL API at the /graphql/ path on port 80. A simple public query returns the shop name and confirms that the API is reachable:

curl -s http://127.0.0.1/graphql/ \
  -H 'Content-Type: application/json' \
  --data '{"query":"{ shop { name } }"}'

To make authenticated calls, obtain an access token with the tokenCreate mutation. The following command reads the administrator email and password from the credentials file and requests a token over loopback:

SALEOR_EMAIL=$(sudo grep '^saleor.admin.email=' /root/saleor-credentials.txt | cut -d= -f2-)
SALEOR_PASS=$(sudo grep '^saleor.admin.pass=' /root/saleor-credentials.txt | cut -d= -f2-)
curl -s http://127.0.0.1/graphql/ \
  -H 'Content-Type: application/json' \
  --data "{\"query\":\"mutation{tokenCreate(email:\\\"$SALEOR_EMAIL\\\",password:\\\"$SALEOR_PASS\\\"){token errors{message}}}\"}"

A successful request returns a JSON object that contains a token (a signed JWT). Pass it as a bearer token on subsequent authenticated calls, for example to read the current user:

SALEOR_EMAIL=$(sudo grep '^saleor.admin.email=' /root/saleor-credentials.txt | cut -d= -f2-)
SALEOR_PASS=$(sudo grep '^saleor.admin.pass=' /root/saleor-credentials.txt | cut -d= -f2-)
SALEOR_TOKEN=$(curl -s http://127.0.0.1/graphql/ -H 'Content-Type: application/json' \
  --data "{\"query\":\"mutation{tokenCreate(email:\\\"$SALEOR_EMAIL\\\",password:\\\"$SALEOR_PASS\\\"){token}}\"}" \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"]["tokenCreate"]["token"])') curl -s http://127.0.0.1/graphql/ \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $SALEOR_TOKEN" \
  --data '{"query":"{ me { email isStaff } }"}'

From outside the instance, replace 127.0.0.1 with the instance public IP. See the Saleor documentation for the full GraphQL schema.

The Data Volume

The Saleor data tier lives on a dedicated EBS volume mounted at /var/lib/saleor. The volume holds the PostgreSQL database (under db), the Valkey state (under cache) and your media uploads (under media). This keeps them off the operating system disk and lets you resize or snapshot them independently. Confirm the mount with:

df -h /var/lib/saleor

To grow the data tier, expand the EBS volume in the AWS console, then grow the filesystem on the instance with sudo resize2fs on the underlying device. Because this volume holds your catalog, orders, customers and media, a snapshot of it captures the complete state of your Saleor deployment.

Enable HTTPS

nginx serves the Dashboard and the GraphQL API over plain HTTP on port 80. For production use, place them behind TLS.

Obtain a certificate for your domain, for example with a managed certificate on an Application Load Balancer in front of the instance, or with Certbot installed on the instance. Then configure nginx to listen on 443 with your certificate and proxy to the API and Dashboard containers exactly as the bundled site does for port 80.

Restrict the security group so that ports 80 and 443 are reachable only from the networks that need the store and the API.

Backup and Maintenance

To back up your deployment, snapshot the /var/lib/saleor EBS volume, which captures the PostgreSQL database, the cache state and all media.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed. The Saleor stack, Docker and nginx all start automatically on boot.

To pull a newer Saleor image version, update the image tags in /opt/saleor/docker-compose.yml, then run sudo /opt/saleor/saleor-compose.sh pull followed by sudo /opt/saleor/saleor-compose.sh up -d, and apply any new migrations.

Support

SecureAnyCloud publishes and supports this image. Support covers deployment, channels and catalog configuration, the GraphQL API, webhooks and the App framework, payments and fulfillment, PostgreSQL and media storage, TLS and runtime tuning. Contact SecureAnyCloud through the support channel listed on the AWS Marketplace listing.

Saleor is a trademark of its respective owner. All other product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Saleor on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS