SecureAnyCloud
Deployment guide

webtrees

Overview

webtrees is a mature, open source, online collaborative genealogy application. It gives you and your family interactive family trees, pedigree and descendancy charts, individual and family records, reports, media galleries and per-user accounts through a clean web interface.

This SecureAnyCloud image installs webtrees 2.2 on nginx, php-fpm 8.3 and MySQL 8.0, all from the Ubuntu 24.04 noble universe with no third-party APT repositories. The database schema is built and the first administrator is created for you. A small demo family tree is imported, so the pedigree charts are populated the moment you sign in.

What you get:

  • webtrees 2.2.6 from the official release at /var/www/webtrees (front controller index.php)
  • nginx serving on port 80, with the writable data/ folder never exposed to the web
  • php-fpm 8.3 with the mysqli, mbstring, xml, intl, gd, curl and zip extensions
  • MySQL 8.0.x with a webtrees database and wtuser application user (per-VM password)
  • MySQL root, application database and administrator passwords rotated per instance at first boot
  • Database-backed authentication, with a single admin account created at first boot
  • A demo family tree imported from GEDCOM, so the tree and pedigree views are populated
  • Public self-registration disabled by default
  • webtrees-firstboot.service building the schema, rotating passwords, creating the administrator and importing the demo tree
  • A host-only session cookie, so signing in works over a bare IP address (RFC 6265 safe)
  • nginx, php-fpm and MySQL enabled and starting automatically on boot
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key, and a VNet with a subnet.

Standard_B2s (2 vCPU, 4 GB RAM) is a comfortable starting size for most family trees. Move up to a D2s or D4s size for very large trees or many concurrent users.

On the network security group, open inbound ports 80 and 443, and open 22 to your management network only. MySQL listens only on loopback and is never exposed.

1

Deploy and connect

Launch the image from the Azure Marketplace, then connect over SSH as azureuser:

ssh azureuser@<vm-ip>

Within a few seconds of the instance starting, the first-boot service builds the database schema, generates the per-VM credentials and imports the demo family tree.

2

Verify the services

Confirm that nginx, php-fpm and MySQL are active and listening. MySQL is bound to loopback only:

sudo systemctl is-active nginx.service php8.3-fpm.service mysql.service
sudo ss -ltn | grep -E ':80|:3306'
3

Check the versions

The webtrees release is the VERSION constant in the application file. Check it, along with the PHP, MySQL and nginx versions:

grep -o "VERSION = '[^']*'" /var/www/webtrees/app/Webtrees.php php -v | head -1 mysql --version nginx -v
4

Inspect the database

The schema is built and a single administrator account exists, stored with a bcrypt password hash, so there is no default or shared login. Read the application database password from the root-only credentials file. Then inspect the administrator account and the imported genealogy records:

DB_PASS=$(sudo grep '^WEBTREES_DB_PASSWORD=' /stage/scripts/webtrees-credentials.log | cut -d= -f2-) sudo mysql -uwtuser -p"$DB_PASS" webtrees -e "SELECT u.user_name, LEFT(u.password,7) AS password_hash, s.setting_value AS canadmin FROM wt_user u JOIN wt_user_setting s ON s.user_id=u.user_id AND s.setting_name='canadmin' WHERE u.user_id>0"
sudo mysql -uwtuser -p"$DB_PASS" webtrees -e "SELECT (SELECT COUNT(*) FROM wt_individuals) AS individuals, (SELECT COUNT(*) FROM wt_families) AS families"
5

Read the administrator password

The per-VM credentials are written to a root-only file. Read the file to get the WEBTREES_ADMIN_USER and WEBTREES_ADMIN_PASSWORD values for signing in:

sudo cat /stage/scripts/webtrees-credentials.log

Keep this file secure. After your first sign-in, change the administrator password from within webtrees.

6

Sign in

Confirm that webtrees is serving the demo tree locally:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/tree/demo

Then browse to http://<vm-ip>/. The home page redirects to the demo family tree. Choose Sign in and enter admin with the password from Step 5.

7

Explore an individual record

Click any person to open their record page. It lists their facts and events, with a Family navigator that walks through parents, spouses and children. The demo tree spans three generations of a fictional family, so you can explore the relationships straight away.

8

View a family and its tree

A family page shows a couple, their marriage and their children, with the surrounding family tree drawn as connected boxes. Follow the links to move up and down the generations. Or open the Charts menu for pedigree, descendancy, fan and hourglass views.

9

The control panel

Sign in as the administrator to reach the control panel. There you manage family trees, import and export GEDCOM files, configure privacy and modules, and manage user accounts. The panel lists your trees with their individual and family counts.

10

Import your own family tree

To replace the demo tree with your own research, open the control panel and create a new family tree. Then import your GEDCOM file from your computer or the server. Once your own tree is in place, you can keep the demo tree for reference or delete it from the control panel.

11

Components

These are the key components and their paths:

  • webtrees install: /var/www/webtrees/
  • Front controller: /var/www/webtrees/index.php
  • webtrees config: /var/www/webtrees/data/config.ini.php
  • Data folder (never served to the web): /var/www/webtrees/data/
  • nginx vhost: /etc/nginx/sites-available/webtrees.conf
  • nginx logs: /var/log/nginx/{access,error}.log
  • MySQL data: /var/lib/mysql/
  • First-boot script: /usr/local/sbin/webtrees-firstboot.sh
  • Credentials: /stage/scripts/webtrees-credentials.log (mode 0600 root:root)
12

Security and next steps

  • Change the administrator password after your first sign in. In webtrees, open My pages, then Account.
  • Enable HTTPS by installing certbot and requesting a certificate: run sudo apt-get install -y certbot python3-certbot-nginx, then sudo certbot --nginx. webtrees uses a secure session cookie automatically once it is served over HTTPS.
  • Set your site address in the control panel under Website preferences once you point a domain at the instance, so links in emails and feeds use it.
  • Review privacy for living people in the control panel before you make a real tree public. The demo tree is fictional and visible to visitors.
  • Restrict the network security group. Open ports 80 and 443 only to your users or load balancer, and port 22 only to your management network.
  • Patch the OS regularly: run sudo apt-get update, then sudo apt-get upgrade.

Licensing

webtrees is distributed under the GPL-3.0 license and is free to use commercially. SecureAnyCloud packages and supports the image, with 24/7 support at sales@secureanycloud.com.

All product and company names are trademarks or registered trademarks of their respective holders. Their use does not imply affiliation or endorsement.

Deploy on Azure

Launch webtrees on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure