SecureAnyCloud
Deployment guide

TYPO3

Overview

TYPO3 is an enterprise, open-source content management system for large, multilingual, multisite websites. It offers granular editorial permissions, reusable content and long-term support, and agencies, universities and public sector organisations use it when they need governed content and predictable release cycles.

This SecureAnyCloud image installs TYPO3 v14 LTS with Composer from the official Packagist channel, alongside Apache 2.4, MySQL 8.0 and PHP 8.3. All packages come from the Ubuntu 24.04 noble universe, with no third-party APT repositories. The backend is served only over HTTPS, so it always runs in a secure context.

At first boot, the image rotates the MySQL root password, the typo3 database user password and the SecureAnyCloud backend administrator password. It writes them to a root-only credentials file. Nothing is baked into the image with a known or blank password.

What you get:

  • TYPO3 v14 LTS (typo3/cms-base-distribution) at /var/www/typo3, with document root /var/www/typo3/public
  • Apache 2.4.x with mod_ssl, mod_rewrite and mod_headers, and a vhost at /etc/apache2/sites-available/typo3.conf
  • A per-VM self-signed TLS certificate terminated by Apache on port 443, with an HTTP-to-HTTPS redirect on port 80
  • MySQL 8.0.x with a typo3 database and typo3 MySQL user (per-VM password)
  • PHP 8.3.x with the mysqli, gd, mbstring, xml, zip, intl and curl extensions
  • typo3-firstboot.service, which rotates all secrets and runs typo3 setup at first boot
  • The SecureAnyCloud backend administrator account (per-VM password, no default login)
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet.

Standard_B2s (2 vCPU, 4 GB RAM) is sufficient for evaluation and low- to medium-traffic sites. For production sites with heavy editorial use or many extensions, move to a D2s or D4s size.

1

Deploy the image

Launch a VM from the SecureAnyCloud TYPO3 offer in your target region. In the network security group, open port 443 (HTTPS) and port 22 (SSH) to your management address. Assign a public IP so you can reach the backend.

2

Connect over SSH

Connect to the VM as azureuser:

ssh azureuser@<vm-ip>
3

Confirm TYPO3 and the stack

Check the TYPO3 version, confirm that Apache and MySQL are active, and confirm that the HTTP, HTTPS and MySQL listeners are up.

cd /var/www/typo3 && sudo -u www-data php vendor/bin/typo3 --version systemctl is-active apache2 mysql
sudo ss -tlnp | grep -E ':(80|443|3306) ' php -v | head -1
4

Confirm the HTTPS backend

The TYPO3 backend is served over TLS on port 443, and port 80 issues a 301 redirect to HTTPS. The certificate is a per-VM self-signed certificate, so pass -k when you test locally.

curl -k -s -o /dev/null -w 'backend https /typo3/ -> HTTP %{http_code}\n' https://127.0.0.1/typo3/
curl -s -o /dev/null -w 'http / -> HTTP %{http_code} (redirect to https)\n' http://127.0.0.1/ echo | openssl s_client -connect 127.0.0.1:443 2>/dev/null | openssl x509 -noout -subject -dates
5

Retrieve your per-VM credentials

Every secret is generated on first boot and stored in a root-only file (mode 0600). Read the file to get the backend administrator password and the backend URL.

sudo cat /stage/scripts/typo3-credentials.log

Note the values of TYPO3_ADMIN_USER, TYPO3_ADMIN_PASSWORD and TYPO3_BACKEND_URL.

6

Verify the backend administrator

Confirm that the SecureAnyCloud backend administrator exists and that the typo3 database user can authenticate. The command reads the database password from the root-only credentials file.

DBPASS=$(sudo grep '^TYPO3_DB_PASSWORD=' /stage/scripts/typo3-credentials.log | cut -d= -f2-) sudo mysql -utypo3 -p"$DBPASS" typo3 -e "SELECT uid, username, admin FROM be_users WHERE deleted=0"
7

Sign in to the TYPO3 backend

Browse to https://<vm-ip>/typo3/. Your browser warns about the self-signed certificate. Accept the warning to continue, or install your own certificate (see HTTPS and certificates below).

Sign in with SecureAnyCloud and the TYPO3_ADMIN_PASSWORD from Step 5. The TYPO3 dashboard opens, with system information and quick links into the backend.

8

Manage content

Open Web > Page to work with the page tree. The image ships a root page and a Home page for you to build on.

Open Web > List to browse the records on a page, including pages and backend users.

HTTPS and certificates

At first boot, the image generates a per-VM self-signed certificate with the VM public IP as the common name. For a production site, replace it with a certificate from your own authority, for example a Let's Encrypt certificate for your domain. Update the paths in /etc/apache2/sites-available/typo3.conf. List the current certificate files with:

sudo ls -l /etc/ssl/typo3/

Point SSLCertificateFile and SSLCertificateKeyFile at your certificate and key. Then run sudo apachectl configtest && sudo systemctl reload apache2.

Security notes

  • No default login. The SecureAnyCloud backend administrator password, the typo3 database password and the MySQL root password are all generated uniquely per VM at first boot. No credential is shared between deployments.
  • Root-only secrets. /stage/scripts/typo3-credentials.log is mode 0600 and owned by root. After your first sign-in, rotate the backend administrator password in Admin Tools > Backend Users. You can then delete the file if you wish.
  • Trusted hosts. The image accepts any Host header, so it works on any IP address or hostname out of the box. For production, narrow SYS/trustedHostsPattern in /var/www/typo3/config/system/additional.php to your domain.

Staying current

TYPO3 v14 is a Long Term Support release. Apply security and maintenance updates within the LTS line by running Composer:

cd /var/www/typo3 && sudo -u www-data composer update "typo3/*" --with-dependencies --no-interaction

The underlying OS installs security updates automatically through unattended upgrades.

Support

This image is backed by 24/7 SecureAnyCloud support. TYPO3 is licensed under GPL-2.0-or-later.

Deploy on Azure

Launch TYPO3 v14 LTS on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure