Mautic - Hardened Self-Hosted Marketing Automation

What is Mautic

Mautic is the leading open-source marketing automation platform - a Symfony 7 PHP application served by Nginx with PHP-FPM and MariaDB. The bundled feature set covers email campaigns and broadcasts, drip workflows and trigger-based automation, lead segmentation and scoring, landing pages and signup forms, multi-channel campaigns, A/B testing, contact lifecycle reporting, REST API, and a webhook engine. Mautic connects to any standard SMTP relay for outbound delivery and persists contacts, segments, campaigns, templates, and tracking data in MariaDB.

Why self-host Mautic

Self-hosting keeps your contact database, campaign tracking, and engagement data inside your own subscription - no per-contact fees, no third-party data residency questions, and no vendor lock-in. Ideal for B2B teams, agencies, and GDPR-sensitive organisations that need an auditable on-premises marketing platform. GPL-3.0 license, governed by the Mautic community under the Open Source Collective.

What this VM image adds

Security hardening:

• Per-instance MariaDB password rotated at first boot - never the same on two deployments, stored in /root/mautic-credentials.txt
• Customer-driven admin via the upstream Mautic installer wizard - no admin account baked into the image, you create the first user during the wizard
• MariaDB bound to 127.0.0.1 only - no exposed database port, Mautic database user limited to localhost
• PHP-FPM auto-tuned at first boot - max_children, start_servers, and OPcache memory sized from instance RAM
• Mautic 7 standard cron schedule pre-installed - segments, campaigns, broadcasts, imports, IP lookup refresh, scheduled reports, all gated until the installer wizard has completed
• Trivy CVE scan - every image is scanned for vulnerabilities before release
• UFW firewall - only ports 80, 443, and 22 open
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control on system services

OS hardening (CIS Level 1):

• CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark applied via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access, MaxAuthTries 4
• Kernel hardening - SYN cookies, ASLR, rp_filter, TCP BBR
• /tmp as tmpfs - nosuid, nodev, noexec
• Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json with SHA-256 hashes
• CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html, 0 FAIL rules on the tailored profile
• Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md with documented exceptions
• Credentials file - /root/mautic-credentials.txt with the public IP, the web UI URL, and the per-instance MariaDB password (admin account is created by you in the installer wizard, never written to disk by us)

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 or larger recommended)
2. Open NSG: TCP 80 and 443 from your IP only until the installer wizard is complete, then widen to your audience - SSH 22 from your management IPs
3. SSH: ssh -i key.pem <username>@<PUBLIC_IP> (username set during VM creation, default: azureuser)
4. Read credentials: sudo cat /root/mautic-credentials.txt - contains the MariaDB password to paste into the installer
5. Open http://<PUBLIC_IP>/ - the Mautic installer wizard starts automatically (auto-refresh splash page while first-boot tuning finishes, 30-60 sec)
6. Database step: copy the MariaDB credentials from the credentials file. Admin user step: enter YOUR real email and a strong password - the first admin you create becomes the workspace owner
7. Issue an HTTPS certificate for production: sudo apt install certbot python3-certbot-nginx && sudo certbot --nginx -d your.domain.com

The Mautic installer is a one-time wizard - once /var/www/mautic/config/local.php is written, the /installer route 404s. Restrict NSG access to ports 80 and 443 to your own IP until the wizard is complete to prevent strangers from claiming admin.