mosparo on Ubuntu 24.04 LTS

mosparo is an open source, self hosted spam protection service for web forms, and a privacy friendly alternative to hosted captcha services. Rather than asking a visitor to solve a puzzle or identify traffic lights, it analyses the content that was actually submitted against configurable rules and spam signals, so a genuine visitor usually sees nothing more than a small confirmation box. Because you host it, form submissions are never sent to a third party and no tracking or fingerprinting script is placed on your visitors. This image is built and maintained by cloudimg on a hardened, fully patched Ubuntu 24.04 LTS base, running mosparo 1.5.4 as a Symfony application behind nginx with PHP 8.3 FPM and a local MariaDB database, so the appliance is complete on its own.

Security is built in, and it goes further than shipping no default password. mosparo has no command line installer, so this image deliberately ships uninstalled, with no configuration file and an empty database. On the first boot of every VM a one shot service completes mosparo's own setup against freshly generated values: a unique database password, a unique encryption key, a unique application secret and a unique administrator password, written to a root only file. Two VMs therefore never share any secret.

Until that finishes, nginx serves mosparo on the loopback interface only and nothing is published on port 80, so an instance is never reachable from the network in an unconfigured state where a passer by could claim the setup wizard. The design is fail closed: if first boot cannot complete, port 80 is never bound at all rather than exposing an open installer.

In use, you create a project for each form you want to protect, embed a small frontend script in the form, and verify each submission from your backend using the project's private key. Field rules, submission rules and shared rule packages let you tune detection, a rule tester shows exactly how a value would be judged, and every checked submission is retained for review. Official API clients are available for PHP, Python and JavaScript, alongside integrations for common content management systems and form builders. An hourly timer runs mosparo's retention cleanup, and MariaDB binds to loopback only.

mosparo is free software licensed under the MIT License. This image is provided by cloudimg and is not affiliated with or endorsed by the mosparo project. Backed by 24/7 cloudimg support.