Zammad

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_D4s_v5 (4 vCPU / 16 GiB RAM) is the recommended size. Zammad runs the Rails web, websocket and worker services alongside PostgreSQL, Redis and Elasticsearch, so do not go below 8 GiB of RAM.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, and 80/tcp for the web interface. Also allow 443/tcp once you add your own TLS certificate.

The appliance serves plain HTTP on port 80, so the UI works immediately. For production, add a domain and TLS (see Step 9, Harden for production).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Zammad by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size (Standard_D4s_v5). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:zammad-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name zammad \
  --image sac1647283583153:zammad-ubuntu-24-04:default:latest \
  --size Standard_D4s_v5 \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name zammad --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

On first boot, the image generates the per-VM application secret, sets the Zammad fqdn to the VM public IP, creates the administrator account, rebuilds the search index and starts the stack. Confirm that all services are active and bound to loopback:

PG=$(ls /etc/postgresql | sort -V | tail -1)
systemctl is-active postgresql@${PG}-main elasticsearch redis-server nginx zammad-web zammad-websocket zammad-worker

sudo ss -tlnp | grep -E ':80 |127.0.0.1:3000 |127.0.0.1:6042 |127.0.0.1:9200 |127.0.0.1:5432 |127.0.0.1:6379 '

Step 5 - Check health and search

The unauthenticated :80/healthz endpoint returns 200 for load-balancer probes. The Elasticsearch index powers Zammad's full-text ticket and knowledge-base search. The system_init_done setting confirms that the Getting Started wizard is closed:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/healthz

curl -s 'http://127.0.0.1:9200/_cat/indices?v' | grep zammad

Step 6 - Retrieve the per-VM admin credentials

First boot generates the administrator account and a strong password and writes them to a root-only file. The Rails application secret is unique to this VM and never leaves it:

sudo cat /root/zammad-credentials.txt

The file records the web URL and the admin email and password. The PostgreSQL cluster and the Elasticsearch index live on the dedicated data disk:

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/zammad-data

Step 7 - Sign in and work your ticket queue

Browse to http://<vm-public-ip>/ and sign in with the admin email and password from the credentials file. Zammad opens on your ticket overviews, the agent workspace where you triage incoming requests. Each overview (Open Tickets, Unassigned & Open, Escalated, and so on) is a live, filterable queue.

Open a ticket to see the full conversation: every article (email, note or chat message) and the customer and organisation. In the right-hand panel, you set the owner, state, priority and tags, add internal notes, and reply to the customer.

Step 8 - Administration settings

Open the admin area (the gear icon, or http://<vm-public-ip>/#manage) to configure the system. From the admin area, you manage users and agents, groups, roles and permissions, organisations, ticket overviews, SLAs, triggers and schedulers, macros, text modules, the knowledge base, and channels (email, chat and more).

Step 9 - Harden for production

The appliance boots ready to evaluate on a bare IP over plain HTTP. Before you go live, complete the following:

• Set your fully qualified domain name. Point a DNS record (for example helpdesk.example.com) at the VM public IP. Then set the name in Admin -> Settings -> System -> Base, or from the shell:

bash sudo zammad run rails r "Setting.set('fqdn','helpdesk.example.com')"

• Add TLS. Put a certificate in front of nginx (for example with certbot), open port 443, and set the Zammad http_type to https so that generated links and email use HTTPS.
• Configure an email channel. In Admin -> Channels -> Email, add the mailbox that Zammad polls for new tickets and the SMTP server that it sends replies and notifications through. This turns Zammad into a shared support inbox and delivers password-reset emails.
• Review agents, groups and roles. Create individual agent accounts (do not share the initial admin), assign them to groups, and define which groups each role can access.

Maintenance and production notes

• Data and search on the data disk. The PostgreSQL cluster and the Elasticsearch index live on the dedicated 20 GiB disk at /var/lib/zammad-data. For a busy helpdesk, attach a larger disk and monitor free space.
• Search index. If search results look stale, rebuild the index with sudo zammad run rake zammad:searchindex:rebuild.
• Backups. Back up the PostgreSQL database, which also holds ticket attachments, regularly. You can always rebuild the Elasticsearch index from the database.
• Updates. Apply OS security updates with sudo apt update && sudo apt upgrade. Zammad version upgrades follow the upstream release notes and are delivered through the Zammad package repository.
• Security. The appliance ships no default login. The administrator account and the application secret are generated uniquely per VM on first boot, and the Getting Started wizard is closed. Keep /root/zammad-credentials.txt protected and change the admin password after your first sign-in.

Zammad is free software licensed under the AGPL-3.0. SecureAnyCloud produces this image, which is not affiliated with, sponsored by or endorsed by Zammad GmbH or the Zammad Foundation. "Zammad" is a trademark of its respective owner.

Deploy on Azure

Launch Zammad on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com