Tryton ERP

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Tryton ERP by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443).

Then select Review + create and Create.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:tryton-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-resource-group \
  --name tryton \
  --image sac1647283583153:tryton-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open HTTPS (and, if you want the redirect, HTTP) to your users:

az vm open-port --resource-group my-resource-group --name tryton --port 443 --priority 900
az vm open-port --resource-group my-resource-group --name tryton --port 80 --priority 910

ssh azureuser@<vm-public-ip>

First boot creates your database, activates the modules and generates this VM's secrets before anything is served. Allow about three minutes after the VM is created. When the four services are active, Tryton is ready:

systemctl is-active postgresql tryton tryton-cron nginx

active active active active

Check the Tryton server and web client releases:

/opt/tryton/venv/bin/python -c 'import trytond; print("trytond", trytond.__version__)' grep -o '"version": "[^"]*"' /opt/tryton/sao/package.json

trytond 8.0.10 "version": "8.0.11"

Only SSH and the two web ports listen on the VM's network interfaces. The Tryton server and PostgreSQL are bound to the loopback address, and systemd's DNS stub resolver is local only:

sudo ss -H -lnt | awk '{print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:5432 127.0.0.1:8000 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

Port 80 serves nothing but a permanent redirect to HTTPS:

curl -s -o /dev/null -w '%{http_code} -> %{redirect_url}\n' http://127.0.0.1/

301 -> https://127.0.0.1/

Every secret on this VM was generated on its first boot and written to a file only root can read. Nothing here is shared with any other deployment. Show the file without its two passwords:

sudo stat -c '%a %U:%G %n' /root/tryton-credentials.txt
sudo grep -v 'PASSWORD=' /root/tryton-credentials.txt

600 root:root /root/tryton-credentials.txt
# Tryton on Ubuntu 24.04 by sac - generated on first boot, unique to THIS VM.
# Keep this file safe. Change the admin password after your first sign in. TRYTON_URL=https://<vm-public-ip>/#tryton TRYTON_DATABASE=tryton TRYTON_ADMIN_USER=admin TRYTON_POSTGRES_ROLE=tryton
#
# Open TRYTON_URL in a browser (the #tryton suffix selects the database) and sign
# in as "admin". A self-signed certificate covering <vm-public-ip> and <vm-private-ip> is used
# until you install your own.

Then read the admin password itself:

sudo grep '^TRYTON_ADMIN_PASSWORD=' /root/tryton-credentials.txt | cut -d= -f2-

The file also holds TRYTON_POSTGRES_PASSWORD, the password of the tryton PostgreSQL role that the Tryton server connects with. Tryton creates no default login of its own. The admin account's password is set by trytond-admin on your VM's first boot, and no database exists in the image at all.

Browse to the TRYTON_URL from Step 6, for example https://<vm-public-ip>/#tryton. Your browser warns about the self-signed certificate. Accept it to continue, or install your own certificate first (Step 13).

In the Login dialog, the database is tryton and the user name is admin. Select Login, enter the admin password from Step 6, and select OK.

You can prove the whole path from the VM itself. The image includes a self-test that signs in through nginx exactly as the web client does. It confirms that the published default password admin and a blank password are refused, that database listing and management are closed, that only the expected ports are reachable, and that a client cannot forge its address:

sudo /usr/local/sbin/tryton-selftest.sh

[ports] off-box TCP exactly [22 80 443]; trytond 127.0.0.1:8000; off-box UDP [68] [ports] TRYTON_PORTS_OK [login] modules active: 18 (account account_invoice company party product production project purchase sale stock timesheet) [login] TRYTON_ROUNDTRIP_OK [xff] refused login recorded from 127.0.0.1 (forged 203.0.113.77 ignored) [xff] TRYTON_XFF_OK [http] port 80 redirects to HTTPS TRYTON_SELFTEST_OK

Change the admin password after your first sign-in. Open the user menu at the top right (Administrator), choose Preferences, and set a new password on the form. Tryton refuses passwords shorter than eight characters or equal to the user's login, name or email address.

The first time admin signs in, Tryton opens its Module Configuration wizard. Select OK to start. The wizard walks you through each activated module's setup in turn:

• Configure Languages: tick any extra languages your users work in and select Load (English is already loaded), then Next.
• Configure Users: create an account for each person, with their login, password and access groups (select Add for each, then End).
• Configure Company: create your company's party (name and address) and choose its currency.
• Create Chart of Accounts from Template: pick a chart of accounts for your company. The Minimal Account Chart is always available; country charts can be installed as extra modules.

Once the wizard is finished, open Financial, Configuration, Fiscal Years and create the current fiscal year with its periods and invoice sequences. The main menu on the left then gives you Parties, Products, Financial, Inventory & Stock, Purchases, Sales, Timesheet, Productions and Projects.

Create your products under Products. A product needs a unit, a sale price and an account category that carries the revenue and expense accounts. Create your customers under Parties.

Then open Sales, create a sale, choose the customer, and add lines with the product and quantity. Tryton computes the line amounts and the untaxed and total amounts as you type.

Select Quote and then Confirm. Tryton processes the confirmed sale. It creates the customer shipment in your warehouse and, with the default invoice method, the customer invoice.

Open the invoice from the sale (or from Financial, Invoices), set the invoice date and select Post. The posted invoice carries its number, its accounting move and the amount due.

Every document type has a list view with search, filters and saved bookmarks. The list below shows the sales: a processed order and a quotation still waiting for the customer.

Eleven more Tryton modules are installed in the image and can be activated at any time, for example bank statements (account_statement), payments (account_payment), fixed assets (account_asset), analytic accounting (analytic_account), price lists (sale_price_list, product_price_list), purchase requests and stock supply, project invoicing, and manufacturing routings and work centres (production_routing, production_work).

List the installed modules that are not active yet:

sudo -u postgres psql -d tryton -tAc "SELECT name FROM ir_module WHERE state='not activated' ORDER BY name"

Activate a module with trytond-admin, which also activates anything it depends on, then restart the Tryton services so they load it:

sudo /usr/local/sbin/tryton-run trytond-admin -c /etc/tryton/trytond.conf -d tryton -u account_statement --activate-dependencies </dev/null
sudo systemctl restart tryton tryton-cron

Sign out and back in to the web client to see the new menus.

More than two hundred further modules (country charts of accounts and tax rules, e-commerce, CRM, subscriptions, and more) are published on PyPI as trytond_<module>. Install one into the virtual environment with a version from the same 8.0 series, then activate it the same way:

sudo /opt/tryton/venv/bin/pip install 'trytond_account_be>=8.0,<8.1'
sudo /usr/local/sbin/tryton-run trytond-admin -c /etc/tryton/trytond.conf -d tryton -u account_be --activate-dependencies sudo systemctl restart tryton tryton-cron

Tryton sends email for password resets, notifications and documents. Point it at your SMTP relay by adding an [email] section to /etc/tryton/trytond.conf, then restart:

[email] uri = smtp+tls://relay-user:relay-password@smtp.example.com:587 from = Tryton <erp@example.com>

sudo systemctl restart tryton tryton-cron

Test the relay with sudo /usr/local/sbin/tryton-run trytond-admin -c /etc/tryton/trytond.conf -d tryton --test-email you@example.com.

The Tryton server listens on loopback only and trusts exactly one proxy: nginx. nginx overwrites the client address it passes on, so Tryton's per-address login rate limiting always sees the real caller.

The database listing is switched off. Tryton 8.0 has no remote call that creates, drops, dumps or restores a database, so database management is only possible from a shell on the VM:

sudo grep -E '^(list|listen|num_proxies) ' /etc/tryton/trytond.conf curl -sk -o /dev/null -w 'database list: HTTP %{http_code}\n' -H 'Content-Type: application/json' \
  -d '{"id":0,"method":"common.db.list","params":[]}' https://127.0.0.1/rpc/

list = False listen = 127.0.0.1:8000 num_proxies = 1 database list: HTTP 403

Tryton delays and then blocks repeated failed sign-ins for the same login and from the same network. For production, also restrict port 443 in your network security group to the networks your users connect from, and keep port 22 limited to your management network.

Point a DNS record such as erp.example.com at the VM's public IP, open port 80 in the network security group, and replace the self-signed certificate with a Let's Encrypt one. nginx reads the certificate from /etc/ssl/tryton/tryton.crt and the key from /etc/ssl/tryton/tryton.key:

sudo apt-get install -y certbot
sudo certbot certonly --standalone -d erp.example.com -m you@example.com --agree-tos -n \
  --pre-hook 'systemctl stop nginx' --post-hook 'systemctl start nginx'
sudo ln -sf /etc/letsencrypt/live/erp.example.com/fullchain.pem /etc/ssl/tryton/tryton.crt
sudo ln -sf /etc/letsencrypt/live/erp.example.com/privkey.pem /etc/ssl/tryton/tryton.key
sudo systemctl reload nginx

certbot renews the certificate automatically, and its hooks stop and start nginx around each renewal. Users then browse to https://erp.example.com/#tryton.

A complete backup is the PostgreSQL database plus Tryton's file store (attachments and stored reports). Take both together, for example from a nightly cron job, and copy them off the VM:

sudo -u postgres pg_dump -Fc tryton > /var/tmp/tryton-$(date +%F).dump
sudo tar -C /var/lib/tryton -czf /var/tmp/tryton-filestore-$(date +%F).tar.gz filestore

To restore onto a new VM from this image, stop the Tryton services, recreate the database from the dump, and unpack the file store:

sudo systemctl stop tryton tryton-cron
sudo -u postgres dropdb tryton
sudo -u postgres createdb -O tryton -E UTF8 -T template0 tryton
sudo -u postgres pg_restore -d tryton --no-owner --role=tryton /var/tmp/tryton-2026-09-19.dump
sudo tar -C /var/lib/tryton -xzf /var/tmp/tryton-filestore-2026-09-19.tar.gz
sudo systemctl start tryton tryton-cron

Azure Backup snapshots of the whole VM complement these application-level backups.

The whole stack uses about 1 GiB of memory on a Standard_B2s. Tryton's server, scheduler and first-boot logs are in the systemd journal:

free -m | head -2 sudo journalctl -u tryton -u tryton-cron -n 20 --no-pager

Ubuntu security updates install automatically through unattended-upgrades. Tryton publishes bug-fix releases for the 8.0 series regularly. To apply them, update the packages within the series, update the database and restart:

sudo /opt/tryton/venv/bin/pip freeze | grep -oE '^(trytond|trytond_[a-z_]+|proteus)' | sed 's/$/~=8.0.0/' > /var/tmp/tryton-8.0.txt
sudo /opt/tryton/venv/bin/pip install --upgrade -r /var/tmp/tryton-8.0.txt
sudo /usr/local/sbin/tryton-run trytond-admin -c /etc/tryton/trytond.conf -d tryton --all sudo systemctl restart tryton tryton-cron

Take a backup (Step 14) before every upgrade. Moving to a new Tryton series (for example 8.0 to 8.2 or 9.0) needs the migration steps in the Tryton documentation. Test the migration on a copy of your database first.