SPIP

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point.

In the network security group (NSG), allow inbound 22/tcp from your management network and 80/tcp for the SPIP web interface. For public exposure, put TLS in front of the site (see Step 12, Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, choose Create a resource, search the Marketplace for SPIP by SecureAnyCloud, and select Create.

1. On Basics, pick your subscription, resource group, region and size.
2. Under Administrator account, choose SSH public key and paste your key.
3. Under Inbound port rules, allow SSH (22) and HTTP (80).
4. On the Disks tab, review the dedicated data disk.
5. Choose Review + create, then Create.

Step 2 - Deploy with the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:spip-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> --name spip \
  --image sac1647283583153:spip-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name spip --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the LAMP stack is running

On first boot, SPIP regenerates its crypto keys, rotates its database password, resets the administrator account to a fresh per-VM password, clears the cache and starts the stack. Check the services:

systemctl is-active nginx php8.3-fpm mariadb

All three services report active.

Check the component versions and confirm that the site answers on port 80:

php -v | head -1 mariadb --version curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/

The site home returns HTTP 200.

Step 5 - Retrieve the administrator password

The administrator account is unique to your VM and is generated on first boot. Read the credentials as root:

sudo cat /root/spip-credentials.txt

The file contains the login (admin), the private-area URL and a unique password, plus the database name, user and password. The values are unique to every VM, and no default login ships in the image.

Change the password from the private area after your first sign-in.

Step 6 - Browse to your site

Browse to http://<vm-public-ip>/. The image ships with a published sample article, so you see a complete, rendered editorial site immediately and can start writing instead of facing a blank page.

Step 7 - Read a published article

Click the article headline to open it. SPIP renders the article with its title, publication date and formatted body from the flexible template engine. This is the public face of your editorial content.

Step 8 - Sign in to the private area

Browse to http://<vm-public-ip>/ecrire/. SPIP sends you to its sign-in page. Enter admin and the password from the credentials file.

After you sign in, you land in the private editorial area (the espace prive), the control center for your site. From here you handle editing, publishing, templates, maintenance and configuration.

Step 9 - Publish content

SPIP organizes content as articles inside sections (rubriques). From the private area, choose Edit to create a section. Add an article inside it, write its title and body, and move it through the editorial workflow: draft, proposed, published.

Published articles appear on the public site immediately. SPIP also supports multiple languages, an author and role model, keywords, and documents attached to articles.

Step 10 - Security model

The setup wizard runs entirely at build time, and a visitor cannot reach it once the site is installed. The config/ directory holds the database credential and the per-VM crypto keys, and it is never served over HTTP. The private area is gated behind sign-in.

Check both protections:

curl -s -o /dev/null -w 'install wizard: HTTP %{http_code}\n' 'http://127.0.0.1/ecrire/?exec=install'
curl -s -o /dev/null -w 'config/connect.php: HTTP %{http_code}\n' http://127.0.0.1/config/connect.php

The install wizard and config/connect.php both return HTTP 403.

Step 11 - The dedicated data disk

The MariaDB database and SPIP's uploaded documents live on a dedicated Azure data disk mounted at /var/lib/spip, separate from the OS disk. Your content stays independent of the OS image, and you can resize the disk as your site grows.

df -h /var/lib/spip findmnt /var/lib/spip

Step 12 - Enabling HTTPS

For any public deployment, put TLS in front of SPIP. Point a DNS A record at your VM's public IP, then install a certificate with Certbot and the nginx plugin. Do the following on your VM, using your own domain and contact email:

• Install Certbot: sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
• Run certbot with the nginx plugin for your-domain.example.com to obtain and install a certificate. Supply your contact email when prompted.
• SPIP derives its links from the request host, so it serves over https:// automatically once TLS is terminated in front of it.

Certbot installs a renewal timer automatically, so certificates renew without further action.

Step 13 - Maintenance

• Updates. The OS continues to receive unattended security updates. Update SPIP itself from the private area under Maintenance, or with the upstream SPIP release.
• Backups. Back up the MariaDB spip database (for example with mysqldump) and the /var/lib/spip/IMG directory. Together they hold your content and uploaded documents.
• Logs. Web server logs are under /var/log/nginx/. PHP-FPM logs are in /var/log/php8.3-fpm.log.

Support

SecureAnyCloud maintains this image and provides 24/7 support. If you need help deploying or operating SPIP on Azure, contact the SecureAnyCloud team through the SecureAnyCloud website.

Deploy on Azure

Launch SPIP on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com