Help Search

Migrate from install scripts to Ubuntu package

A Ubuntu package has been created to increase the ease of installing and upgrading passbolt.


For this tutorial, you will need:

  • A minimal Ubuntu 20.04 server.
  • Passbolt installed with the Ubuntu install script.

1. Take down your site

It is generally a good idea to stop running the site prior to the upgrade. This is to avoid having side effects such as active users corrupting the data in the middle of an upgrade.

sudo systemctl stop nginx

2. Backup your instance

First things first, as this is a sensitive operation a backup of the instance must be performed to prevent any data loss. You can follow our backup process.

3. Upgrade your system

Passbolt requires PHP 7.3 and supports PHP 7.4.

A full system upgrade to Ubuntu 20.04 is necessary before installing the passbolt Ubuntu package.

Here is the official Ubuntu guide to upgrade your system with a step by step tutorial.

4. Install the package

1. Install the server components

1.1. Package repository setup

For easier installation and update tasks Passbolt provides a package repository that you need to setup before you download Passbolt PRO and install it.

These steps assume you have already installed sudo and added your user to the sudo group.

Step 1. Update the apt indexes and install packages to allow apt to use https repositories:

sudo apt update
sudo apt install \
    apt-transport-https \
    ca-certificates \
    curl \
    gnupg-agent \

Step 2. Let’s Encrypt

Install certbot if you plan to manage your SSL certificates with Let’s Encrypt:

sudo apt install certbot python3-certbot-nginx

Step 3. Add Passbolt package official GnuPG key from

gpg --keyserver hkps:// --recv-keys 0xDE8B853FC155581D 

Or alternatively from hkps:// or hkps://

Step 4. Check that the GPG fingerprint matches 3D1A 0346 C8E1 802F 774A EF21 DE8B 853F C155 581D

gpg --list-key --with-fingerprint 0xDE8B853FC155581D

Must return:

pub   rsa2048 2020-05-18 [SC] [expires: 2022-05-18]
      3D1A 0346 C8E1 802F 774A  EF21 DE8B 853F C155 581D
uid           [ unknown] Passbolt SA package signing key <[email protected]>
sub   rsa2048 2020-05-18 [E] [expires: 2022-05-18]

Step 5. Create GPG package keyring

gpg --export 0xDE8B853FC155581D | sudo tee \
  /usr/share/keyrings/passbolt-repository.gpg >/dev/null

Step 6. Add passbolt repository:

cat << EOF | sudo tee /etc/apt/sources.list.d/passbolt.sources > /dev/null
Types: deb
Suites: focal
Components: stable
Signed-By: /usr/share/keyrings/passbolt-repository.gpg

Step 7. Update the apt indexes with the new passbolt apt repository:

sudo apt update

1.2. Install passbolt

By default, passbolt Ubuntu package will install Passbolt server component, mariadb-server, php-fpm and nginx as dependencies.

There are two main ways to install the passbolt Ubuntu package:

  • Interactive: the package will guide the user through a set of questions to setup mariadb and nginx. If you are going to use existing SSL certs for the web server, they need to be created and installed to the location of your choosing before beginning. The user will be asked for the path and name of the certificate and key.
  • Non-interactive: no questions will be asked. Useful for users with specific needs or users that want to automate the installation. Read this FAQ page to know more

Install passbolt package

Install the main passbolt server component:

sudo apt install passbolt-pro-server

It is recommended at this point to select:

  • No for mysql configuration as it is already configured
  • No to nginx configuration as we will do it at the end

5. Copy existing configuration to the new location

5.1. Copy the server keys

Copy the GPG server keys as following:

sudo cp -a /var/www/passbolt/config/gpg/serverkey.asc /etc/passbolt/gpg/
sudo cp -a /var/www/passbolt/config/gpg/serverkey_private.asc /etc/passbolt/gpg/
sudo chown -R root:www-data /etc/passbolt/gpg
sudo chmod g-w /etc/passbolt/gpg

5.2. Copy the passbolt configuration

Copy passbolt configuration as following:

sudo cp /var/www/passbolt/config/passbolt.php /etc/passbolt/passbolt.php
sudo chown root:www-data /etc/passbolt/passbolt.php
sudo chmod g-w /etc/passbolt/passbolt.php

If you are running mysql 8, please change the quoteIdentifiers setting of the passbolt.php as follow:

'quoteIdentifiers' => true

5.3. Copy the subscription key

Copy subscription key as following:

sudo cp /var/www/passbolt/config/license /etc/passbolt/subscription_key.txt
sudo chown root:www-data /etc/passbolt/subscription_key.txt
sudo chmod g-w /etc/passbolt/subscription_key.txt


Edit /etc/php/7.4/fpm/pool.d/www.conf and look for the line that looks like this:

listen =

Change it to look like this:

listen = /run/php/php7.4-fpm.sock

Due to a bug on the install scripts some installations might need to do an additional substitution on /etc/php/7.4/fpm/pool.d/www.conf:

Look for the line containing: = _WWW_GROUP_

And change it to look like: = www-data

7. Nginx

Now you can remove all the old nginx configuration files from /etc/nginx/conf.d/

sudo rm /etc/nginx/conf.d/passbolt.conf
sudo rm /etc/nginx/conf.d/passbolt_ssl.conf

Then you can reconfigure the Ubuntu package using:

sudo dpkg-reconfigure passbolt-pro-server

Answer the following way:

  • No to mariadb configuration
  • Yes to nginx configuration

You can then select the SSL method that suits best your needs.

8. Run the database migrations

Now it is time to run the migrations to upgrade the database schemas:

sudo -H -u www-data bash -c "/usr/share/php/passbolt/bin/cake passbolt migrate"

9. Cleanup

After you have checked you can access your new setup with the Ubuntu package make a backup of /var/www/passbolt and then you can delete it:

sudo rm -rf /var/www/passbolt

You may also want to check for the old CRON job that may need to be removed:

sudo crontab -u www-data -e

10. Take your site back up

Finally take passbolt back up:

sudo systemctl start nginx
sudo systemctl restart php7.4-fpm

Last updated

This article was last updated on February 3rd, 2021.

Are you experiencing issues with Passbolt Pro Edition?

Contact Pro support

or ask the community

Something is not accurate in this documentation? You can contribute by opening an issue or making pull requests!

View on github
🍪   Do you accept cookies for statistical purposes? (Read more) Accept No thanks!