PrestaShop - Hardened Open-Source eCommerce Platform

What is PrestaShop

PrestaShop is a leading open-source eCommerce platform for building and running online stores - a PHP 8 web application served by Nginx with PHP-FPM and backed by MySQL 8. The bundled feature set covers product catalog and category management, customer accounts, shopping cart and one-page checkout, order and invoice management, promotions and vouchers, multi-currency and multi-language storefronts, SEO-friendly URLs, a customizable responsive storefront theme, a REST/webservice API, and a full back office for merchandising, shipping, payment and tax configuration - extensible through a native module ecosystem. This image ships the open-source core only (OSL-3.0 core, AFL-3.0 modules and themes) with its bundled native modules and the default storefront theme; it includes nothing from the commercial PrestaShop Addons marketplace or PrestaShop Checkout. OSL-3.0 license - no per-store fees, no vendor lock-in.

Why self-host PrestaShop

Running PrestaShop on a VM you control keeps your catalog, orders and customer data inside your own Azure tenant rather than a hosted store builder. Self-hosting suits merchants under GDPR, PCI-DSS or ISO 27001, and any storefront where customer and order data must stay within your own perimeter with no per-store fees.

What this VM image adds

Security hardening:

• Store installed at first boot with generated admin credentials, saved to /root/prestashop-credentials.txt (mode 0600) - no shared admin is baked into the image
• Web installer removed and the admin (back office) folder randomized per instance after setup, so the management URL is not guessable
• MySQL 8 bound to loopback - the database listens on 127.0.0.1 only and is never exposed off-box
• nginx terminates TLS on port 443 and serves the storefront and back office; PHP-FPM runs over a local socket
• Self-signed TLS certificate generated at first boot and replaceable with your own CA-signed certificate (certbot is pre-installed - run sudo certbot --nginx once a domain points at the VM)
• UFW firewall - TCP 443 for the storefront, TCP 22 for SSH; all other inbound dropped
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control
• CVE scan - every image is scanned with Trivy before release

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access, PermitRootLogin no, LoginGraceTime 60
• Kernel hardening - SYN cookies, ASLR, rp_filter, IPv6 off
• /tmp as tmpfs - nosuid, nodev, noexec
• Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report at /etc/lynxroute/cis-report.html (OpenSCAP, Azure tailoring profile, 0 FAIL rules)
• Tailored CIS profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Operator credentials file at /root/prestashop-credentials.txt (mode 0600) with the admin email, password and the per-instance back-office URL

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 or larger recommended for the LAMP stack and catalog)
2. Open NSG: TCP 443 from your trusted sources, TCP 22 from your management IPs only
3. SSH: ssh -i key.pem azureuser@<PUBLIC_IP>, then sudo cat /root/prestashop-credentials.txt for the admin email, password and back-office URL
4. Wait 3-6 minutes on first launch for the store to finish installing, then open https://<PUBLIC_IP>/ and accept the self-signed certificate warning
5. Open the back office at the unique admin URL from the credentials file and log in; change the admin email and password after first login

A demo catalog is preloaded so the storefront renders immediately - remove it before going live. Restrict NSG port 443 to your own IP until you have changed the admin credentials. For production, point a domain at the VM and run sudo certbot --nginx -d your.domain.com (open port 80 first for the HTTP-01 challenge). "PrestaShop" is a registered trademark of PrestaShop SA. This is an independently hardened build packaging the OSL-3.0 open-source core, not affiliated with or endorsed by PrestaShop SA.