Apache Allura on Ubuntu 24.04 LTS by cloudimg

Apache Allura on Ubuntu 24.04 LTS by cloudimg

Apache Allura is the open-source project-hosting platform (a "forge") that powers SourceForge. It gives every project its own space with hosted git, Subversion and Mercurial repositories, a ticket tracker, a wiki, threaded discussion forums, blogs and file-release areas, all under one web application with its own membership and permission model. Administrators manage users, projects and neighbourhoods from the browser.

This cloudimg image ships the complete stack assembled and running: the Allura web application under gunicorn, its `taskd` background worker, Apache Solr for full-text search, a MongoDB-wire-protocol document store and a PostgreSQL database, all behind nginx on port 80. There is no source build, virtualenv or search schema to assemble by hand.

Apache-2.0 clean, with no SSPL anywhere

Allura requires a MongoDB-wire-protocol datastore. MongoDB Community Server and Percona Server for MongoDB are both SSPL v1, which is not OSI-approved, so neither ships in this image. The wire protocol is provided instead by FerretDB (Apache-2.0) over PostgreSQL with the DocumentDB extension (MIT). Search is Apache Solr (Apache-2.0). Allura's own vendored assets are MIT and SIL OFL 1.1. Net licence surface: Apache-2.0 / MIT / PostgreSQL Licence / SIL OFL 1.1.

Secure by Default

Upstream's bootstrap creates well-known demonstration accounts (`admin1`, `test-user`, `root`) with the published password `foo`. This image never uses that path, and those accounts do not exist. The captured image contains an initialised forge with zero users, zero projects and zero credentials.

On the first boot of every VM, a single administrator account is created with a randomly generated password, and every secret is minted fresh for that VM: the session signing key, the PostgreSQL role password and the field-level encryption key. No two VMs share a secret and no upstream default ever governs a running forge. Credentials are written to a root-only file at `/root/allura-credentials.txt` (mode 0600).

Solr, the document store and PostgreSQL are all bound to loopback and are never reachable from outside the VM; nginx on port 80 is the only public listener. The base OS is fully patched with unattended security upgrades enabled.

The appliance ships on plain HTTP for first contact. Place it behind TLS before exposing it to any untrusted network, and review the new-user registration policy before opening the forge up.

Every deployment is paired with a step-by-step deploy guide and backed by 24/7 cloudimg support.