Appliance category: 

Drupal 9

Content Management Framework

Drupal 9 is End of Life 1 November 2023 - as such, new Drupal projects should use Drupal 10.

Drupal is an open source content management platform licensed under the GPL. Equipped with a powerful blend of features, Drupal can support a variety of websites ranging from personal blogs, corporate brochures and large community-driven websites. This appliance includes Drupal v9.x.

This appliance includes all the standard features in TurnKey Core, and on top of that:

  • Drupal 9 configurations:
    • Installed (using composer) from upstream source code to /var/www/drupal9

      Security note: Updates to Drupal may require supervision so they ARE NOT configured to install automatically. See below for updating Drupal. And/or see Drupal 8 documentation

    • Includes drush and composer for command line administration and configuration.
    • Drupal security update alerts delivered to your inbox - requires Security Alerts ('secalerts') be enabled on firstboot with a valid email address.
    • Note - For trouble free commandline usage (i.e. Composer or Drush) PHP RAM limit may need to be bumped to 2048MB. For that to work, the system requires at least 2GB+ free memory (physical &/or virtual; i.e. swap - a temporary swap file is acceptable).
  • Bundled Drupal 9 modules and dependencies (installed to /var/www/drupal9/web/modules - new default for Drupal9):
    • Field group: Allows fields to be grouped together.
    • Google analytics: Adds Google Analytics js tracking code to all your site's pages.
    • Honeypot: A honeypot for deterring spam bots from completing forms on your site (additionally uses timestamp method).
    • Imce: Powerful image file uploader and browser, with support for on the fly resizing.
    • PathAuto: Auto-generate search engine friendly URLs (SEO).
    • Token: Provides a shared API for replacement of textual placeholders with actual data.
    Note: Only some modules are enabled by default. To enable/disable

    modules, navigate to Administer > Modules (or Some modules may require additional configuration and/or permissions settings.

  • SSL support out of the box.
  • Adminer administration frontend for MySQL (listening on port 12322 - uses SSL).
  • Postfix MTA (bound to localhost) to allow sending of email (e.g., password recovery).
  • Webmin modules for configuring Apache2, PHP, MySQL and Postfix.

Supervised Manual Drupal Update

It is possible to check for and install updates from the Drupal Admin UI:: Admin > Reports > Avaialble Updates

Updates for Drupal9 Core often need to be done via commandline. For full details, please consult the Drupal8 Upgrade docs, we recommend using Composer to update from the commandline:

cd /var/www/drupal9
# update composer - not strictly neccessary
composer self-update
composer update drupal/core webflo/drupal-core-require-dev --with-dependencies
drush updatedb -y
drush cr

Modules can be updated like this, e.g. ctools:

composer update drupal/ctools
drush updatedb -y
drush cr

We also recommend that you subscribe to the security newsletter (create a user account on and within your profile:: Edit > My newsletter tab).

Notes on documentation

The links here relevant to documentation all link to drupal 8 documentation, this is not an accident but rather due to the fact that as of writing there are no drupal 9 documentation specifically. This AFAIK is partially (or wholly perhaps) due to the fact that the changes between drupal 8 and 9 are rather small, and mostly not apparent on the surface. As such the documentation for drupal 8 should largely suffice.

Usage details & Logging in for Administration

No default passwords: For security reasons there are no default passwords. All passwords are set at system initialization time.

Ignore SSL browser warning: browsers don't like self-signed SSL certificates, but this is the only kind that can be generated automatically. If you have a domain configured, then via Confconsole Advanced menu, you can generate free Let's Encypt SSL/TLS certificates.

Web - point your browser at either:

  1. - not encrypted so no browser warning
  2. - encrypted with self-signed SSL certificate

Note: some appliances auto direct http to https.

Username for adminer:

Login as username adminer

Username for drupal 9:

Login as username admin

Username for database administration:

  1. Adminer; login as MySQL username adminer: - Adminer database management web app

  2. MySQL command line tool; log in as root (no password required):
    $ mysql --user root
    Welcome to the MySQL monitor.  Commands end with ; or \g.
    Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

Username for OS system administration:

Login as root except on AWS marketplace which uses username admin.

  1. Point your browser to:
  2. Login with SSH client:
    ssh root@

    Special case for AWS marketplace:

    ssh admin@

* Replace with a valid IP or hostname.