{
 "slug": "moodle",
 "name": "Moodle",
 "tagline": "Learning management system for courses, assessments and online training",
 "category": "cms-ecommerce",
 "use_cases": [
  "lms",
  "e-learning",
  "course-management"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Moodle Pty Ltd",
  "url": "https://moodle.org",
  "license": "GPL-3.0",
  "license_url": "https://github.com/moodle/moodle/blob/main/COPYING.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "4.5.15",
   "last_build": "2026-10-23",
   "entity_id": "prod-xir5pejp4vjlc",
   "ami_alias": "/aws/service/marketplace/prod-xir5pejp4vjlc/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-d66vq3auns2pa",
   "recommended_instance_type": "t3.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "4.5.15",
   "last_build": "2026-10-26",
   "offer_id": "moodle",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:moodle:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.moodle?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/moodle/",
  "json": "https://lynxroute.com/products/moodle/product.json"
 },
 "release_notes": [
  {
   "version": "4.5.15",
   "title": "Moodle 4.5.15",
   "notes": "* Moodle updated 4.5.14 -> 4.5.15 on the 4.5 LTS line. GPL-3.0 unchanged\n* Security: MSA-26-0044 (missing access checks on H5P content files) and a router stack-trace path disclosure fix (MDL-89137)\n* Security: ships the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619; unauthenticated remote code execution in PHP) via Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1). Earlier images of this product carry the vulnerable PHP and should be replaced\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23",
    "azure": "2026-10-26"
   }
  },
  {
   "version": "4.5.14",
   "title": "Moodle 4.5.14",
   "notes": "* Moodle 4.5.14 security release on the 4.5 LTS branch, upgraded from 4.5.13; upstream publishes the advisory details about one week after release\n* Accessibility improvements: course index tree semantics and icons, keyboard operation of the date and time selector and the TinyMCE help dialogue inside modals, focusable skip-link targets, and correct modal heading structure\n* Form sections keep the correct expanded state after validation errors, and report builder supports visually hidden column headers\n* Nginx, PHP 8.3 and MySQL 8.0 stack with self-signed HTTPS on port 443 and Certbot pre-installed\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-15",
    "azure": "2026-09-18"
   }
  },
  {
   "version": "4.5.13",
   "title": "Moodle v4.5.13",
   "notes": "* Re-release of Moodle 4.5.13. The application version is unchanged; this build refreshes the underlying operating system image\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-03",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "4.5.10",
   "title": "Moodle 4.5.10 - Initial release (June 2026)",
   "notes": "* Moodle 4.5.10 LTS on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Per-instance Moodle administrator password generated on first launch\n* The site is installed automatically on first launch - no setup wizard exposed\n* The Moodle data directory is placed outside the web root with non-world-readable permissions\n* MySQL 8.0 listening on 127.0.0.1 only, with per-instance database password\n* PHP-FPM workers and MySQL InnoDB buffer pool auto-sized to instance RAM at launch\n* The scheduled-task runner executes every minute as a managed system service\n* The site address is reconciled automatically at boot (survives instance stop/start IP changes)\n* Self-signed TLS certificate generated during the AMI build; HTTP on TCP 80 redirects to HTTPS on TCP 443; Certbot pre-installed\n* UFW firewall pre-configured (TCP 22, 80, and 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-21"
   }
  }
 ],
 "release_history": [
  {
   "version": "4.5.15",
   "aws": "2026-10-23",
   "azure": "2026-10-26"
  },
  {
   "version": "4.5.14",
   "aws": "2026-09-15",
   "azure": "2026-09-18"
  },
  {
   "version": "4.5.13",
   "aws": "2026-09-03",
   "azure": "2026-08-19"
  },
  {
   "version": "4.5.12",
   "aws": "2026-07-09",
   "azure": "2026-06-29"
  },
  {
   "version": "4.5.10",
   "aws": "2026-06-21"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-xir5pejp4vjlc/latest \\\n  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer moodle --plan payg-gen2\naz vm create -g my-rg -n moodle --size Standard_D2s_v3 \\\n  --image lynxroute:moodle:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Moodle is the world's most widely deployed open-source learning management system (LMS), implemented in PHP 8.3 and served by Nginx with PHP-FPM over MySQL 8.0. This image is powered by Moodle™. It delivers the full teaching and training workflow - courses and categories, enrolment, activities and resources, quizzes with a large question-type bank, assignments and rubric grading, the gradebook, forums and messaging, SCORM and H5P content, completion tracking, badges and certificates, calendar, and reporting - with role-based access control, cohorts, groups, multi-language support, a REST/web-services API, and an extensive plugin and theme ecosystem. It connects to any standard SMTP relay (Amazon SES, SendGrid, Postmark, Mailgun, or self-hosted Postfix) for notifications and supports SSO via OAuth2, SAML, and LDAP. This image ships the GPL-3.0 community edition and runs entirely on the EC2 instance you launch - no external account, subscription, license key, or activation handshake is required. All data stays inside your own AWS account. Moodle™ is a registered trademark of Moodle Pty Ltd; this product is community-built and not affiliated with or endorsed by Moodle Pty Ltd.",
  "image_adds": "Security hardening:\n* Per-instance administrator password generated on first launch and written to /root/moodle-credentials.txt (mode 0600) - never baked into the image\n* The site is installed automatically on first launch via the Moodle command-line installer - no setup wizard is ever exposed on the public internet\n* The Moodle data directory (course files, user sessions, caches) is placed outside the web root on a dedicated path, with non-world-readable permissions, so content is never served as static files\n* MySQL 8.0 listens on 127.0.0.1 only; the database user password is generated per instance\n* PHP-FPM workers and MySQL InnoDB buffer pool auto-sized to the instance RAM at launch\n* The Moodle scheduled-task runner executes every minute as a managed system service - no manual cron setup\n* The site address is reconciled automatically at boot, so the LMS keeps serving after an instance stop/start changes the public IP\n* Self-signed TLS certificate generated during the image build - HTTPS on TCP 443 from launch, HTTP on TCP 80 redirects to HTTPS\n* Certbot and the Nginx plugin are pre-installed for one-command Let's Encrypt certificates\n* UFW firewall pre-configured - only TCP 22, 80, and 443 are exposed\n* fail2ban with default SSH jail; AppArmor with default Ubuntu profiles\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}