Deployment guide

Snipe-IT

Overview

Snipe-IT is a popular free, open source IT asset management system. Track hardware assets, software licenses, accessories, consumables and components. Check items in and out to users and locations, print QR and barcode labels, run audits and reports, and drive it all through a full REST API.

The SecureAnyCloud image delivers Snipe-IT fully installed and configured on Ubuntu 24.04. It is a Laravel application on PHP 8.3 with OPcache, served by nginx over HTTPS with php-fpm and backed by MariaDB. The database schema is already migrated and the pre-flight setup wizard is already complete, so you land directly on the sign-in page with nothing to configure.

Snipe-IT is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). SecureAnyCloud is not affiliated with, endorsed by or sponsored by Grokability, Inc. or the Snipe-IT project. "Snipe-IT" is a trademark of its respective owner. This image repackages the upstream open source release with SecureAnyCloud's provisioning and support.

What you get:

Snipe-IT 8.6.1 (AGPL-3.0), served from /var/www/snipe-it/public
nginx (TLS on :443, with :80 redirected to HTTPS and a plain /healthz liveness endpoint), PHP 8.3 (php8.3-fpm with OPcache) and MariaDB, all from Ubuntu 24.04 main/universe
A per-VM self-signed TLS certificate generated on first boot, so the interface loads over a secure context
A per-VM administrator password, MariaDB password and Laravel APP_KEY, all generated at first boot and written to a root-only file, so no default or shared login ships in the image
The Laravel scheduler running every minute via a systemd timer
nginx.service, php8.3-fpm.service and mariadb.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

Before you deploy, make sure you have an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region. Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting point. Scale up for larger inventories or heavier traffic.

In the network security group, allow inbound 22/tcp from your management network. Allow 443/tcp (HTTPS) and 80/tcp (which redirects to HTTPS) from your users.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource and search the Marketplace for Snipe-IT by SecureAnyCloud. Select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443). Then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:snipe-it-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name snipe-it \
  --image sac1647283583153:snipe-it-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open HTTPS (and HTTP, which redirects) to reach the web interface:

az vm open-port --resource-group <your-rg> --name snipe-it --port 443 --priority 900
az vm open-port --resource-group <your-rg> --name snipe-it --port 80 --priority 910

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that the three services behind Snipe-IT all report active. The plain HTTP port answers a lightweight /healthz liveness check and redirects everything else to HTTPS. The interface answers over TLS.

systemctl is-active nginx php8.3-fpm mariadb curl -s -o /dev/null -w 'healthz -> %{http_code}\n' http://127.0.0.1/healthz curl -s -o /dev/null -w 'http redirect -> %{http_code}\n' http://127.0.0.1/ curl -ks -o /dev/null -w 'https app -> %{http_code}\n' https://127.0.0.1/

Expect three lines of active, then healthz -> 200, http redirect -> 301 and https app -> 302. Snipe-IT redirects an unauthenticated request to the login page.

Step 5 - Retrieve your administrator password

On the first boot of every VM, a one-shot service (snipe-it-firstboot.service) generates credentials that are unique to that VM. These are a fresh Laravel application key, a fresh MariaDB password and a fresh administrator password. The service also generates a per-VM self-signed TLS certificate and sets the VM's own address as the application URL. No shared or default credentials ship in the image.

sudo cat /root/snipe-it-credentials.txt

The file (mode 0600, root only) contains the administrator username (snipeit.admin.user, which is admin), the administrator password (snipeit.admin.pass), the sign-in URL and the database credentials. Snipe-IT signs in by username.

Prove the login round trip from the VM's own shell. The command reads the per-VM credentials, fetches a CSRF token and posts a real sign-in. A successful Snipe-IT login answers HTTP 302 into the dashboard. A wrong password is rejected back to the login page.

USER=$(sudo grep '^snipeit.admin.user=' /root/snipe-it-credentials.txt | cut -d= -f2-)
PASS=$(sudo grep '^snipeit.admin.pass=' /root/snipe-it-credentials.txt | cut -d= -f2-)
CJ=$(mktemp)
TOK=$(curl -ks -c "$CJ" https://127.0.0.1/login | grep -oE 'name="_token" value="[^"]+"' | head -1 | sed 's/.*value="//;s/"//')
curl -ks -o /dev/null -w 'good login -> %{http_code}\n' -b "$CJ" -c "$CJ" \
  -d "_token=$TOK" --data-urlencode "username=$USER" --data-urlencode "password=$PASS" https://127.0.0.1/login
BAD=$(mktemp)
BTOK=$(curl -ks -c "$BAD" https://127.0.0.1/login | grep -oE 'name="_token" value="[^"]+"' | head -1 | sed 's/.*value="//;s/"//')
curl -ks -o /dev/null -w 'wrong pass -> %{redirect_url}\n' -b "$BAD" -c "$BAD" \
  -d "_token=$BTOK" --data-urlencode "username=$USER" --data-urlencode "password=wrong-99" https://127.0.0.1/login rm -f "$CJ" "$BAD"

Expect good login -> 302 (into the app) and wrong pass -> https://127.0.0.1/login (bounced back and rejected).

Step 6 - Sign in

Browse to https://<vm-public-ip>/ and sign in with the username admin and the password from the credentials file. The image ships a per-VM self-signed certificate, so your browser shows a one-time certificate warning on the first visit. Click through it, or install your own domain certificate into /etc/nginx/ssl/snipe-it.crt and /etc/nginx/ssl/snipe-it.key.

After you sign in, you land on the dashboard. It summarizes your asset, license, accessory, consumable, component and people counts, recent activity and an assets-by-status breakdown.

Step 7 - Manage your assets

The image ships with an empty inventory, ready for your own data. Snipe-IT models your estate as Categories > Manufacturers > Asset Models > Assets. Create a category (for example Laptops), a manufacturer and an asset model, then add assets against that model.

From the Assets list, you can search, filter, bulk-edit, and check items in and out to users and locations. The toolbar exports to CSV, prints labels and opens the column picker.

Choose Create New, then Asset, to add hardware. Snipe-IT generates the next asset tag automatically. Pick a model and a status, and optionally check the asset out to a user. Add the serial, purchase details and a location, then select Save.

Step 8 - Confirm the version and the stack

grep app_version /var/www/snipe-it/config/version.php php -v | head -1 df -h /

Expect 'app_version' => 'v8.6.1', PHP 8.3, and the OS disk that holds the application tree (/var/www/snipe-it) and the MariaDB datadir (/var/lib/mysql). Resize the OS disk from the Azure portal if you need more room for uploads or the database.

First-boot service and security model

A one-shot snipe-it-firstboot.service runs After=mariadb.service and Before=nginx.service. The per-VM credentials and TLS certificate are therefore in place before the first page is served.

The service rotates the MariaDB password and edits .env in lock-step, so the application never loses its database connection. It regenerates the Laravel APP_KEY and sets a per-VM administrator password. It then writes the credentials file at mode 0600 (root only) and drops a sentinel so it runs exactly once.

systemctl status snipe-it-firstboot.service --no-pager | head -6 sudo stat -c '%a %U:%G %n' /root/snipe-it-credentials.txt

Administration from the CLI

Run admin tasks with Laravel's artisan as the www-data user. For example, list the available commands or clear the caches:

sudo -u www-data php /var/www/snipe-it/artisan list | head -20 sudo -u www-data php /var/www/snipe-it/artisan config:clear

The Laravel scheduler runs background jobs such as expiring-license and audit reminders. It runs every minute through the snipe-it-scheduler.timer systemd timer, so there is no crontab entry to add.

Enabling HTTPS with your own domain

The image serves HTTPS with a per-VM self-signed certificate out of the box. For a browser-trusted certificate, point a DNS record at the VM. Then install a certificate from your CA (for example Let's Encrypt) over the shipped self-signed pair:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot updates the nginx site to serve your domain certificate. Set APP_URL=https://your-domain.example.com in /var/www/snipe-it/.env, then run sudo -u www-data php /var/www/snipe-it/artisan config:cache so generated links use your domain.

Backup and maintenance

Snipe-IT's data lives in the MariaDB database and in the uploaded files under /var/www/snipe-it/public/uploads and /var/www/snipe-it/storage. Back up the database with mysqldump. Snapshot the OS disk from the Azure portal for a full point-in-time copy.

sudo mariadb-dump --single-transaction snipeit | gzip > /var/backups/snipeit-$(date +%F).sql.gz

Keep the OS current with sudo apt-get update && sudo apt-get upgrade. The image ships with unattended security updates enabled. Review Snipe-IT's own upgrade notes before you move between major versions.

Support

This image is backed by 24/7 SecureAnyCloud support for deployment, upgrades, LDAP and SAML single sign-on, REST API integration, email and label configuration, performance tuning and database administration. Email sales@secureanycloud.com or use the live chat in the support portal. Critical issues receive a one-hour average response.

Deploy on Azure

Launch Snipe-IT on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs Snipe-IT, a Laravel application, behind nginx with PHP-FPM 8.3 and OPcache enabled. MariaDB provides the database on the same instance, bound to the loopback interface only. The database is already migrated and the Snipe-IT pre-flight setup is already complete, so your first request lands directly on the sign-in page.

What you get:

A Laravel task scheduler that runs every minute through a systemd timer, the configuration Snipe-IT recommends for production, so scheduled notifications, audits and report generation run automatically
A Snipe-IT administrator password, a MariaDB password and a fresh Laravel application key, all generated on the first boot of every deployed instance. Two instances launched from the same Amazon Machine Image never share secrets
The administrator and database passwords written to /root/snipe-it-credentials.txt with mode 0600, so only the root user can read them
The Snipe-IT application code, the nginx document root (public/) and user uploads under /var/www/snipe-it, on a dedicated EBS volume separate from the operating system disk
The MariaDB data directory on its own EBS volume at /var/lib/mysql, so each tier can be resized independently of the others

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users reach Snipe-IT on
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Snipe-IT. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. The Snipe-IT workload is PHP and MariaDB heavy, and asset imports and report generation benefit from memory. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization takes a few seconds after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud Snipe-IT Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=snipe-it-01}]'

On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and Retrieve Initial Credentials

Connect over SSH with the key pair you selected and the public IP address from step 2. For the Snipe-IT 8.6 on Ubuntu 24.04 AMI variant, the SSH login user is ubuntu.

The first-boot service runs before the SSH daemon becomes ready, so the credentials file is always in place when you log in for the first time.

ssh <login-user>@<public-ip>
sudo cat /root/snipe-it-credentials.txt

The plain text file contains the Snipe-IT URL, the administrator username admin, the administrator password, and the MariaDB database name, user and password. Copy these values somewhere secure, such as a password manager or encrypted vault. Do not commit them to source control.

From the same SSH session, confirm the deployment is healthy. The health endpoint is open and returns JSON. It checks both the database connection and that the application can write to its log directory.

curl -fsS http://127.0.0.1/health

{"status":"ok"}

A "status":"ok" response confirms that the full stack (nginx, PHP and MariaDB) is serving Snipe-IT.

First Login to the Snipe-IT Web Interface

Open a web browser and go to http://<public-ip>/. Snipe-IT presents its sign-in page. Enter the administrator username admin and the administrator password from /root/snipe-it-credentials.txt, then select Login.

After you sign in, you land on the Dashboard. It summarizes the counts of assets, licenses, accessories, consumables, components and people, with quick links to create each. On a fresh instance the counts are zero. The next steps populate them.

Change the Administrator Password and Set an Email

Rotate the administrator password that was generated on first boot, and set a real email address so notifications and password recovery reach you. Select SecureAnyCloud Admin at the top right and choose Edit Profile. Update the password and email fields, then save.

Set the Application URL and Branding

Open the gear icon at the top right to reach Admin Settings, then General Settings. Set the Site Name and upload your organization's logo. Confirm that the application URL matches the address your users reach Snipe-IT on. It is set to the instance's own address on first boot.

If you put Snipe-IT behind a custom domain name or a load balancer, update the application URL here and in /var/www/snipe-it/.env (APP_URL).

Create Companies, Locations, Categories and Models

Snipe-IT organizes assets through a small hierarchy that you set up once. From the top navigation and the gear menu, create these items in this order:

Companies (optional): use these if you track assets for multiple companies
Locations: buildings, offices or sites where assets live
Categories: broad groupings such as Laptops, Monitors and Phones
Manufacturers: Apple, Dell, Lenovo and so on
Models: a specific make and model within a category and manufacturer

Models are the templates that new assets are created from. Define the models your organization owns before you add individual assets.

Add and Check Out Assets

Choose Create New, then Asset, or open Assets and select the + button. Pick the model and set a status. Enter the serial and purchase details. Optionally, check the asset out to a user or location on creation.

The Assets view lists every asset with its tag, model, category, status and current assignment. Per-row actions let you check an asset in or out, clone, edit or delete it. This list, with search, bulk edit, label printing and CSV import and export, is the day-to-day heart of Snipe-IT.

Import Existing Inventory

To migrate an existing inventory, open Import from the gear menu and upload a CSV of your assets, users, licenses or accessories. Snipe-IT maps the columns to fields and creates the records in bulk, so you do not have to enter a large estate by hand.

Configure Outbound Email

Email drives Snipe-IT's checkout confirmations, acceptance requests, audit reminders and password resets. Set your SMTP details under Admin Settings, then Mail Settings. Alternatively, edit the MAIL_* keys in /var/www/snipe-it/.env directly. After you change .env, clear and rebuild the configuration cache:

cd /var/www/snipe-it && sudo -u www-data php artisan config:clear && sudo -u www-data php artisan config:cache

Send a test message from the Mail Settings screen to confirm delivery.

LDAP, SAML and the REST API

Snipe-IT supports directory integration and single sign-on. Configure LDAP under Admin Settings, LDAP, to authenticate and import users from Active Directory or any LDAP server. The php-ldap extension is already installed. Configure SAML under Admin Settings, SAML, for single sign-on with identity providers such as Okta, Azure AD or Google Workspace.

Every action in Snipe-IT is available through its REST API. Generate a personal API token from Edit Profile, API. Then call the API with a bearer token, for example curl -H "Authorization: Bearer <token>" http://<public-ip>/api/v1/hardware. Use the API to integrate Snipe-IT with onboarding, monitoring and procurement systems.

Enable HTTPS with Let's Encrypt

Terminate TLS so that traffic to Snipe-IT is encrypted. Point a DNS name at the instance and open port 443. Then install Certbot and obtain a certificate for the nginx site:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot edits the nginx site to serve HTTPS and installs a renewal timer. After you enable TLS, set the application URL to the https:// address under General Settings. Set APP_URL in /var/www/snipe-it/.env to match, then rebuild the config cache as in step 10. To redirect all traffic to HTTPS, consider setting APP_FORCE_TLS=true in .env.

Backups and Maintenance

Snipe-IT includes a built-in backup that captures the database and uploaded files into a single archive. Generate one from Admin Settings, Backups, or from the command line:

cd /var/www/snipe-it && sudo -u www-data php artisan snipeit:backup

Back up /var/lib/mysql (the database tier) and /var/www/snipe-it (the application tier, including public/uploads and storage) with EBS snapshots on a schedule. Keep a copy of /var/www/snipe-it/.env, which holds the application key and database password.

To upgrade Snipe-IT, take a snapshot first, then follow the upstream upgrade steps for the new release. SecureAnyCloud support can assist with major-version upgrades.

Scaling Beyond a Single Instance

This image runs nginx, PHP, MariaDB and the scheduler on one instance, which suits most asset-management workloads. To scale, take these steps:

Move the database tier to Amazon RDS for MySQL, and point the DB_* keys in .env at the RDS endpoint.
Put uploads on shared or S3-backed storage so multiple application instances stay consistent.
Run two or more application instances behind an Application Load Balancer.

SecureAnyCloud support can help design and implement a highly available topology.

Screenshots

Support

This image is published by SecureAnyCloud with 24/7 technical support by email and chat. Support covers Snipe-IT deployment, upgrades, performance tuning, LDAP and SAML single sign-on, email and label configuration, REST API integration, CSV import, backup strategy and database administration. Contact details and your support entitlement are on the AWS Marketplace listing and at https://secureanycloud.com.

Deploy on AWS

Launch Snipe-IT on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS