YesCart

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting point. YesCart runs the Tomcat JVM (storefront, manager and REST API) alongside MariaDB and benefits from memory headroom. Scale up for a larger catalog, more traffic or more concurrent staff.

In the network security group (NSG), allow inbound 22/tcp from your management network and 443/tcp from the networks that your shoppers and staff reach YesCart on.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for YesCart by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443). Then choose Review + create, followed by Create.

First-boot initialisation takes approximately one to three minutes after the VM starts. YesCart rotates its secrets, generates the per-VM TLS certificate, maps the storefront to the VM's address, starts Tomcat and brings the storefront and manager console online.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:yescart:default:latest
az vm create \
  --resource-group <your-rg> \
  --name yescart \
  --image sac1647283583153:yescart:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name yescart --port 443 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active mariadb yescart nginx yescart-firstboot curl -fsSk -o /dev/null -w 'yescart admin: %{http_code}\n' https://127.0.0.1/cp/

All four units report active, and the manager console endpoint returns 200. This confirms that the full stack (nginx, Tomcat and MariaDB) is serving. YesCart is a JVM application that deploys three web applications, so on the very first boot allow a short warm-up before the console responds.

Step 5 - Confirm the network bindings

The application and the database bind the loopback interface only, and nginx is the single public port. Confirm the bindings:

ss -tln | grep -E ':(443|8080|3306)'

Port 443 is nginx (public, TLS). Tomcat listens on 127.0.0.1:8080 and MariaDB on 127.0.0.1:3306, so neither the application server nor the database is directly reachable from the network.

Step 6 - Retrieve your administrator login

The administrator password and the database password are generated uniquely on the first boot of your VM and written to a root-only file. Display the file:

sudo cat /root/yescart-credentials.txt

The yescart.admin.login (which is admin@yes-cart.com) and yescart.admin.pass values are your sign-in to the manager console. The file also records the storefront and admin URLs and the per-VM database password. First boot rotates the shipped default administrator password so that it no longer works.

You can verify the security posture without exposing the password. The shipped default is rejected, while the per-VM password authenticates through the real YesCart manager login (an HTTP 200 with a JWT on success, 401 otherwise):

B=http://127.0.0.1:8080
U=$(sudo grep '^yescart.admin.login=' /root/yescart-credentials.txt | cut -d= -f2-)
P=$(sudo grep '^yescart.admin.pass=' /root/yescart-credentials.txt | cut -d= -f2-) login() { curl -s -o /dev/null -w '%{http_code}\n' -X POST -H 'Content-Type: application/json' \
  -d "{\"username\":\"$1\",\"password\":\"$2\"}" "$B/cp/service/authenticate"; } echo -n 'default admin@yes-cart.com/1234567 -> '; login 'admin@yes-cart.com' '1234567' echo -n 'per-VM administrator -> '; login "$U" "$P"

The first call returns 401 (the shipped default is dead), and the second returns 200 (the per-VM administrator authenticates).

Step 7 - Sign in to the manager console

Open a web browser and go to https://<vm-public-ip>/cp/. The certificate is self-signed and unique to your VM, so your browser warns you on the first visit. Accept the warning to continue, or install a CA-signed certificate (see Enabling a trusted certificate).

On the YesCart manager (JAM) sign-in page, enter admin@yes-cart.com and the password from /root/yescart-credentials.txt. The page is served over HTTPS.

After you sign in, the manager console opens with the full navigation: Organisation, Catalog, Price lists, Promotions, Customers, Fulfilment centres, Shipping and Shops. The console covers catalog, pricing, promotions and order management.

Step 8 - Manage the catalog

In the manager console, open Catalog to manage categories and products. Your VM ships with a clean store so that you can build your own catalog. Create a category, add products, assign them to categories, set prices in your fulfilment centre and publish them to a shop.

YesCart keeps products, SKUs, prices and inventory as first-class entities, so the same catalog can serve multiple shops and currencies. The catalog view shows the categories and products behind the storefront.

Step 9 - Visit the storefront

Open https://<vm-public-ip>/ in a browser to see the customer-facing storefront that your shoppers use. It is served over HTTPS.

First boot maps the default shop to your VM's address, so the storefront resolves on the VM's public IP out of the box. The storefront and the manager console share the same catalog and order data, so products and categories you publish in the console appear here.

Step 10 - Confirm the data tier

YesCart keeps all of its state in its MariaDB application databases: yesdemo for the store and yespaydemo for payments. Confirm that the schema is present:

sudo mysql -N -B -e "SELECT COUNT(*) AS store_tables FROM information_schema.tables WHERE table_schema='yesdemo';"

The database reports its full set of application tables.

Enabling a trusted certificate

The image serves HTTPS with a per-VM self-signed certificate out of the box. For production, replace it with a CA-signed certificate so that browsers trust it without a warning.

The image ships with nginx, which certbot can configure automatically. The following commands assume a DNS record that points your fully qualified domain name at the VM's public IP:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d shop.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

After certbot finishes, reload nginx with sudo systemctl reload nginx.

Add your domain to the shop's URLs in the manager console (Shops > your shop > URLs) so that the storefront resolves on it. Also change the administrator password from the manager console.

Backup and maintenance

YesCart keeps all of its state (catalog, prices, promotions, customers, orders and configuration) in its MariaDB application databases. Back them up regularly:

sudo mysqldump --databases yesdemo yespaydemo > /tmp/yescart-$(date +%F).sql

Ship the dump to Azure Blob Storage or another object store, or snapshot the disk in Azure for point-in-time backups.

Keep the OS patched with sudo apt update && sudo apt upgrade. Apache Tomcat serves YesCart from /opt/yescart. After configuration changes, restart the application with sudo systemctl restart yescart. Always back up first.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email and chat for help with deployment, catalog and pricing, promotions, order management, TLS certificates and database administration. Email sales@secureanycloud.com.

For general YesCart questions, consult the project at https://www.yes-cart.org/.

YesCart is a trademark of its respective holder. All product and company names are trademarks or registered trademarks of their respective holders. Their use does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch YesCart on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com