Vtiger CRM

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point. Choose a larger size for bigger or busier teams.

Configure the NSG to allow inbound 22/tcp from your management network, and 80/tcp for the console (plus 443/tcp once you add TLS). Vtiger serves plain HTTP on port 80 out of the box, so for production, terminate TLS in front of it with your own domain. The bundled MariaDB listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Vtiger CRM by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy with the Azure CLI (alternative)

To deploy from the command line, create the VM from the SecureAnyCloud Vtiger CRM image with your resource group, image URN, size and SSH key. Open ports 22 and 80 on the network security group, then browse to the public IP address.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:vtiger-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-rg \
  --name vtiger \
  --image sac1647283583153:vtiger-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group my-rg --name vtiger --port 80 --priority 900

Step 3 - Confirm the services and retrieve the admin password

SSH in as azureuser. Confirm that all three services and the first-boot unit are active. nginx listens on port 80, and MariaDB is bound to the loopback interface only.

systemctl is-active nginx php8.3-fpm mariadb vtiger-firstboot ss -tlnp | grep -E ':80 |:3306 '

On the first boot of every VM, the image generates a unique administrator password and records it, together with the sign-in URL, in a root-only file. Read the file with sudo:

sudo cat /root/vtiger-credentials.txt

Step 4 - Sign in to Vtiger CRM

Browse to http://<your-vm-ip>/. On Vtiger's sign-in page, enter the user admin and the password from the credentials file.

The site URL follows the request host, so you can reach the console by the VM's public IP or by your own domain with no extra configuration.

Step 5 - Manage the sales pipeline

Open the Opportunities tab to see your sales pipeline, with each deal's name, sales stage, expected close date and amount. You can sort and filter the list. Choose Add Opportunity to create a deal, set its stage and value, and track it to close.

Step 6 - Manage leads, contacts and organizations

Open the Leads tab to work your inbound and prospected leads, with name, company, phone, email and lead source. Convert a qualified lead into a contact, organization and opportunity in one step.

Open the Contacts tab to manage the people you do business with, each linked to their organization, with email, phone and title. Alongside it you have Organizations, Documents, the calendar, quotes, invoices, the help desk, reports and workflows.

Security model - no default credentials

Vtiger's installer creates the administrator account (admin) at install time. This image removes any known credential. On every first boot, the single admin account is rotated to a unique per-VM secret, stored as a modern PHASH bcrypt hash. Common guesses (admin, admin123, vtiger, password, a blank password and others) do not authenticate.

Vtiger's own installed-state guard blocks the web installer from ever running again. nginx denies direct HTTP access to the configuration file and to the storage, user privileges, cache and other sensitive directories. The image build verifies, before the image is captured, that the per-VM admin authenticates through the real Vtiger login form while the default and weak guesses are rejected.

bash /usr/local/sbin/vtiger-cred-roundtrip.sh

Where your data lives

The MariaDB database, Vtiger's uploaded documents and its writable state all live on a dedicated Azure data disk, not on the OS disk. MariaDB's data directory is bind-mounted from the data disk onto /var/lib/mysql. Vtiger's storage, cache and user_privileges directories are bind-mounted from the same disk.

As a result, your leads, contacts, organizations, opportunities and documents survive a VM resize or OS disk swap and stay on managed, snapshot-friendly storage.

curl -sI http://127.0.0.1/healthz | head -1 findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data findmnt -no SOURCE,TARGET /var/lib/mysql

Production - add your own domain and TLS

Vtiger serves plain HTTP on port 80 out of the box, so you can sign in immediately. For day-to-day business use, serve the console over HTTPS on your own domain. Point a DNS record at the VM, open 443/tcp on the NSG, and terminate TLS in front of nginx with a certificate from your own certificate authority (for example Let's Encrypt).

Once you have a fixed domain, pin $site_URL in /var/www/vtigercrm/config.inc.php to that HTTPS domain. Keep MariaDB on the loopback interface, take regular snapshots of the data disk, and restrict SSH to your management network.

Support

SecureAnyCloud builds and maintains this image and provides 24/7 support. Vtiger CRM Open Source Edition is licensed under the vtiger Public License. SecureAnyCloud is not affiliated with or endorsed by Vtiger, and the in-product "Powered by vtiger" attribution is retained as the license requires.

Deploy on Azure

Launch Vtiger CRM on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com