What is EspoCRM

EspoCRM is a self-hosted Customer Relationship Management platform implemented in PHP 8, served by Nginx with PHP-FPM, and persisting every record in MySQL 8.0. It covers the full revenue pipeline - leads, accounts, contacts, opportunities, calendar, tasks, email campaigns, document templates, document storage, reports, and dashboards - with role-based access control, multi-currency support, custom entities and fields, formula scripting, workflow automation, IMAP-aware email-to-record assignment, and a built-in portal feature for granting read-only views to external clients. EspoCRM connects to any standard SMTP relay (Amazon SES, SendGrid, Postmark, Mailgun, or self-hosted Postfix), reads inbound mail over IMAP, supports single sign-on via Google, Microsoft, OpenID Connect and LDAP, and exposes a full REST API for integrations. This image ships the AGPL-3.0 community edition; the image itself is the complete product and runs entirely on the EC2 instance you launch - no external account, subscription, license key, or activation handshake is required. All data stays inside your own AWS account.

What the Lynxroute image adds

Security hardening:

Per-instance EspoCRM admin password generated on first launch and written to /root/espocrm-credentials.txt (mode 0600) - never baked into the image
EspoCRM install wizard disabled after the initial setup completes (the install/ directory is locked to mode 0000) - no further setup exposure
MySQL 8.0 listens on 127.0.0.1 only; the database user password is generated per instance
PHP-FPM workers and MySQL InnoDB buffer pool auto-sized to the instance RAM at launch
Composer vendor dependencies (phpoffice/phpspreadsheet, phpseclib/phpseclib) bumped to the CVE-fixed upstream releases at build time
Self-signed TLS certificate generated during the image build - HTTPS on TCP 443 from launch, HTTP on TCP 80 redirects to HTTPS
UFW firewall pre-configured - only TCP 22, 80, 443 are exposed
fail2ban with default SSH jail; AppArmor with default Ubuntu profiles
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/espocrm-credentials.txt.

Azure CLI

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer esprocrm --plan payg-gen2
az vm create -g my-rg -n espocrm --size Standard_D2s_v3 \
  --image lynxroute:esprocrm:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

EspoCRM 10.0.11

Azure · 2026-10-24

EspoCRM updated 10.0.9 -> 10.0.11 on PHP 8.3 + MySQL 8.0 + Nginx, patch releases on the 10.0 line. AGPL-3.0 unchanged
Fixes an error message when a status field is changed to a value whose Kanban column is hidden
Security: PHP 8.3 updated to 8.3.6-0ubuntu0.24.04.13 (USN-8948-1), fixing the PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619
Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com
Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	AGPL-3.0
Upstream	EspoCRM Inc.
Machine-readable	product.json · catalog.json