Deploying Self-Hosted Bitrix24 on AWS, Azure or a Private Cloud

Why run Bitrix24 (Alaio) self-hosted on public cloud?

Organizations choose IaaS for Bitrix24 on-premise for three core reasons: resource elasticity, provider-guaranteed availability SLAs, and the elimination of hardware capex - while retaining full data control for LGPD and GDPR compliance without sacrificing cloud flexibility.

Many organizations prefer the IaaS model over owning physical servers for three practical reasons: resource elasticity, provider availability SLAs, and the elimination of hardware capex. Running Bitrix24 on-premise on a VM in AWS or Azure gives you complete control over your data - an increasingly common requirement for LGPD, GDPR, and internal security policies - without giving up cloud flexibility.

For a detailed analysis of when the self-hosted model makes more financial sense than the cloud version, see our 3-year TCO comparison between self-hosted and cloud.

VM hardware requirements

Bitrix24 is I/O and memory intensive: portals with up to 50 users require 4 vCPUs, 8 GB RAM, and 100 GB SSD, while portals with 500-1,000 users need 32 vCPUs, 64 GB RAM, and 1 TB+ of storage - a real-world portal with 200 users operated on 16 vCPUs and 47 GB of RAM.

Bitrix24 is demanding in terms of disk I/O and memory consumption, particularly on portals with many concurrent users. Based on real deployment projects, we use the following benchmarks as a starting point:

Active users	vCPUs	RAM	Disk (SSD)
Up to 50	4	8 GB	100 GB
50-150	8	16 GB	200 GB
150-500	16	32 GB	500 GB
500-1 000	32	64 GB	1 TB+

Note: In a real-world project audited by the ACP team, a portal with approximately 200 users operated on 16 vCPUs and 47 GB of RAM - a configuration rated "excellent" by Bitrix24's internal diagnostic tool, with a database of approximately 28 GB.

For a complete sizing guide, see Self-Hosted Bitrix24: Hardware Sizing Guide.

Recommended instance types by provider

• AWS: m6i or c6i family (compute-optimized) for heavy-load portals; EBS gp3 storage
• Azure: D or E series (Dsv5 / Esv5); Premium SSD LRS disks
• Private cloud / bare-metal: KVM or VMware with thin-provisioning; dedicated volumes for /home/bitrix

Software stack and supported versions

The Bitrix24 self-hosted environment requires specific versions: CentOS Stream 9, Nginx 1.26.x, Apache 2.4.62, PHP 8.2.x, and Percona MySQL 8.0.x - outdated versions such as CentOS 7 and PHP 8.1.x are the most common source of vulnerabilities and instability found during audits.

Bitrix24 self-hosted requires a specific web environment. Using outdated versions is the most common cause of vulnerabilities and instability. The table below compares versions found during audits with those currently recommended:

Component	Outdated version (found in audit)	Recommended version
Operating system	CentOS Linux 7	CentOS Stream 9
Nginx (proxy)	1.20.x	1.26.x
Apache (dynamic)	2.4.6	2.4.62
PHP	8.1.x	8.2.x
Percona MySQL	5.7.x	8.0.x

Practical recommendation: always use the official Bitrix environment installation script (bitrix-env-9.sh) on a freshly provisioned VM. It automatically installs and configures all dependencies at the correct versions, including PHP-FPM, Nginx, Apache, Percona, and Push & Pull.

Step-by-step deployment workflow

Deploying Bitrix24 self-hosted on IaaS follows 11 sequential steps - from VM provisioning to client handover - covering environment installation via the official script, database setup, DNS, SSL, SMTP, Push & Pull, security hardening, and automated backup configuration.

The process described below reflects the deployment roadmap we apply in IaaS infrastructure deployment and migration projects.

flowchart TD
    A[Provisionar VM no provedor IaaS] --> B[Instalar ambiente Bitrix via bitrix-env script]
    B --> C[Registrar chave de licença]
    C --> D[Configurar banco de dados MySQL/Percona]
    D --> E[Configurar DNS e certificado SSL Let's Encrypt]
    E --> F[Configurar SMTP para notificações do sistema]
    F --> G[Ativar Push & Pull para chats em tempo real]
    G --> H[Criar usuário admin e importar estrutura organizacional]
    H --> I[Hardening de segurança]
    I --> J[Configurar backups automáticos]
    J --> K[Testes e entrega ao cliente]

The full sequence runs from VM provisioning through environment installation, database setup, SSL, SMTP, Push & Pull, security hardening, and backup configuration, ending with portal handover to the end client.

Breakdown of critical steps

1. Environment installation Run the official script as root. It configures the operating system, installs the complete stack, and prepares Bitrix24 for production. Avoid installing dependencies manually - doing so breaks the system compliance check.

2. Database Create the database with charset utf8mb4 and collation utf8mb4_unicode_ci. Tune the MySQL/Percona parameters: disable query_cache and local_infile, and increase innodb_log_file_size. These adjustments eliminate warnings in Bitrix24's internal diagnostic tool.

3. DNS and SSL Configure a corporate subdomain (e.g., crm.yourcompany.com) with an A record pointing to the VM's IP address. The Let's Encrypt certificate is installed automatically by the Bitrix environment. Afterwards, configure HTTP → HTTPS redirection and add the HSTS header.

4. SMTP Configure msmtp with your corporate mail server credentials (port 587 with STARTTLS or port 465 with TLS). System notifications, user invitations, and CRM alerts all depend on a working SMTP configuration.

5. Push & Pull Required for real-time chats, notifications, and document collaboration. Must be explicitly activated after installation - it is not enabled by default.

Post-installation security: essential checklist

Audits of Bitrix24 self-hosted portals consistently reveal 10 critical misconfiguration points, including display_errors enabled in PHP, no 2FA, missing HSTS, unrestricted administrative access by IP, and the security scanner reporting critical vulnerabilities - all of which can be resolved before going live.

Based on security audits conducted on self-hosted portals, these are the critical points that are most frequently misconfigured:

• Disable display_errors and display_startup_errors in php.ini - prevents exposure of file paths, SQL queries, and internal configuration
• Update all platform modules via the administration panel
• Enable two-factor authentication (2FA) for all users via Bitrix24 OTP
• Add the HSTS header in Nginx/Apache and verify HTTP → HTTPS redirection
• Restrict access to the administration panel by IP - users outside authorized IPs will be blocked
• Enable protection against use in iframes
• Enable the native Bitrix24 web antivirus (note: may slightly reduce performance)
• Create and maintain an IP blacklist in the firewall to block attack sources and injection attempts
• Raise the proactive protection level - the security scanner should not report any critical vulnerabilities
• Fix errors in the database structure - the diagnostic tool should return 0 errors

For the complete 25-point checklist, see Self-Hosted Bitrix24 Security Hardening.

High availability and backup in IaaS environments

In IaaS environments, the HA strategy for Bitrix24 self-hosted combines daily volume snapshots, database dumps with a minimum 7-day retention, MySQL/Percona master-replica replication across separate availability zones, and a load balancer for automatic failover - with mandatory monitoring of the platform's cron jobs.

Providers such as AWS and Azure simplify HA configuration by offering automatic volume snapshots, managed load balancers, and availability zones. For Bitrix24 self-hosted, the main strategies are:

Backup:

• Daily snapshots of the EBS volume (AWS) or Managed Disk (Azure)
• Native Bitrix24 backup stored on the server itself - configure it to also write to a second external bucket or storage location
• Database dumps with a minimum retention of 7 days

High availability:

• MySQL/Percona master-replica replication between two VMs in separate availability zones
• Load balancer in front of the web node for automatic failover
• Monitoring of Bitrix cron jobs (cron_events.php) - silent failures at this point cause issues with automations and email delivery

See the detailed guide at Self-Hosted Bitrix24 High Availability and the full backup strategy at On-Premise Bitrix24: Backup & Disaster Recovery.

Migrating from cloud to self-hosted on IaaS

Migrating from Bitrix24 Cloud to self-hosted on IaaS follows 6 steps - provisioning, data export, import, DNS redirection, a testing period with key users, and decommissioning the old portal - with a typical timeline of 2 to 5 business days depending on data volume and integrations.

If you are starting from an existing Bitrix24 Cloud portal, the migration process follows well-defined steps:

1. Provision and configure the new IaaS server (as described in previous sections)
2. Export data from the cloud portal: CRM, tasks, organizational structure, disk
3. Import into the self-hosted portal and validate data integrity
4. Redirect DNS to the new IP address
5. Testing period with key users (typically 1-2 business days)
6. Decommission the old portal after validation

Based on our experience, the typical timeline for a cloud to self-hosted IaaS migration - including security configuration and testing - is 2 to 5 business days, depending on data volume and integration complexity.

Read the full migration plan at Migrating from Bitrix24 Cloud to Self-Hosted.

Cost considerations for IaaS

The total cost of Bitrix24 self-hosted on public cloud combines the license (one-time purchase plus a reduced annual renewal), VM and storage (recurring provider costs), and professional deployment - which ranges from USD 800 to USD 3,500 depending on complexity and number of users.

The total cost of a Bitrix24 self-hosted deployment on public cloud consists of three components:

Component	Notes
Self-hosted license	One-time acquisition cost + reduced annual renewal
VM + storage	Recurring monthly cost billed by the IaaS provider
Deployment and configuration	One-time service fee charged by the partner

Based on typical projects, the cost of professional deployment and configuration of a self-hosted portal - including environment installation, security hardening, backup configuration, and training - ranges from USD 800 to USD 3,500, depending on complexity and number of users. Exact figures depend on region and agreed scope.

For a detailed breakdown of implementation costs, see Bitrix24 Implementation Cost & Timeline.

---

Working with a partner for self-hosting. Want the control of Bitrix24 self-hosted without managing the server yourself? ACP Group deploys and operates it for you - see Bitrix24 self-hosted gerenciado, planos de suporte e manutencao, or request a orcamento chave na mao.