Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	5.14.2	$0.05/hr Recommended instance: t3.medium · 5-day free trial	2026-10-25	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	5.14.0	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-10-24	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	GPL-3.0
Upstream	Matomo (InnoCraft Ltd / Matomo community)
Machine-readable	product.json · catalog.json

What is Matomo

Matomo is the leading open-source web analytics platform and a privacy-friendly alternative to Google Analytics, used on over one million websites. It is a PHP application backed by a MySQL/MariaDB database and served by nginx with PHP-FPM. Matomo gives you visits and pageview reporting, visitor logs and profiles, real-time analytics, acquisition and campaign tracking, goals and e-commerce conversion, custom segments and dimensions, heatmaps and session-recording add-ons, a JavaScript tracker (matomo.js) and a server-side tracking API (matomo.php), an HTTP Reporting API, and a built-in Tag Manager. Because you self-host it, all visitor data stays inside your own AWS account, which makes GDPR, CCPA, and data-residency compliance straightforward. Matomo is GPL-3.0 licensed with no vendor lock-in; premium features are optional separate plugins and are not required to run it.

What the Lynxroute image adds

Security hardening:

Unique MariaDB password generated at first boot (no shipped default credential)
No analytics admin account is baked into the image - the first super user you create during the install wizard owns the instance
TLS enabled on port 443 with a self-signed certificate (replace with your own CA/Let's Encrypt certificate for production)
MariaDB and PHP-FPM bound to 127.0.0.1 only - never exposed to the network
Hourly report archiving runs as a scheduled background task; browser-triggered archiving is disabled for predictable performance
UFW firewall pre-configured (ports 22, 80, 443 only)
fail2ban, auditd, and AppArmor pre-configured
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH key-only access, kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/matomo-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-a3tcs7lr4rd36/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer matomo --plan payg-gen2
az vm create -g my-rg -n matomo --size Standard_D2s_v3 \
  --image lynxroute:matomo:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Matomo 5.14.2

AWS · 2026-10-25

Matomo updated 5.14.0 -> 5.14.2, a patch release with no database upgrade. GPL-3.0 unchanged
Security: keeps the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619) via Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 or newer (USN-8948-1)
HTTPS on by default: self-signed TLS on port 443; Certbot pre-installed - sudo certbot --nginx -d yourdomain.com
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build