Flarum on Ubuntu 24.04 on Azure User Guide

Overview

Flarum is a delightfully simple, fast and free open source forum platform for building online communities. It pairs a modern single page interface with a lightweight PHP backend, so members can start discussions, reply, mention each other, react with likes, organise topics into tags, and moderate with a full permission system, all from one clean and responsive interface. The cloudimg image ships Flarum 1.8 served by nginx and PHP 8.3 FPM on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server so the appliance is complete and useful on its own. Flarum runs behind an nginx reverse proxy on port 80. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306) and keeps its data on a dedicated Azure data disk. A unique administrator password is generated on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• Flarum 1.8 served by nginx and PHP 8.3 FPM, managed by systemd
• A bundled MariaDB 10.11 server holding the Flarum database, already installed and ready
• The Flarum forum served on :80 from the hardened public/ web root, with a welcome discussion ready to go
• A per VM administrator password generated on first boot and recorded in a root only file
• No shipped default login: the admin is created with a unique per VM secret, and no known or blank credential authenticates
• MariaDB bound to 127.0.0.1 only, never exposed to the network
• A dedicated Azure data disk carrying both the MariaDB database and Flarum's writable storage and uploads
• nginx.service, php8.3-fpm.service and mariadb.service as enabled systemd units
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for larger or busier communities. NSG inbound: allow 22/tcp from your management network and 80/tcp for the forum. Flarum serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain. The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Flarum by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name flarum \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the forum:

az vm open-port --resource-group <your-rg> --name flarum --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm nginx, PHP FPM and MariaDB are all active. Note that MariaDB listens only on 127.0.0.1:3306 while nginx serves the forum on port 80.

systemctl is-active nginx php8.3-fpm mariadb flarum-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/  */ /g'

Step 4 - Retrieve the per VM administrator password

Every VM generates its own Flarum administrator password on first boot and writes it, along with the login user and URL, to a root only credentials file. Read it with sudo:

sudo cat /root/flarum-credentials.txt

You sign in to the forum as user admin with the FLARUM_ADMIN_PASSWORD from this file. On the box itself you can also run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in to the forum

Browse to http://<vm-public-ip>/. You land on the forum front page, which already has a welcome discussion. Click Log In in the top right and sign in with username admin and the password from Step 4.

Step 6 - The administration dashboard

Once signed in as the admin, open the Administration area from the user menu, or browse to /admin. The dashboard summarises your forum at a glance, including the Flarum, PHP and database versions, and the left menu gives you Basics, Email, Permissions, Appearance and Users, plus the full list of bundled extensions.

Step 7 - Start and read discussions

From the front page, click Start a Discussion to post, or open a discussion to read and reply. Members can mention each other with @, react with likes, and follow discussions. The welcome discussion below shows the thread view with the original post and the reply box.

Step 8 - Manage permissions and extensions

Open Permissions in the Administration menu to configure exactly who can see and do what, per group (Admins, Mods and your own groups) across reading, creating, participating and moderating. The bundled extensions (Tags, Likes, Mentions, Flags, Approval, Sticky, Lock, Subscriptions and more) are listed in the same panel and can be toggled and configured, and you can add more from the Flarum community.

Step 9 - No known or default credentials

Flarum ships no default login. The cloudimg image goes further: the administrator account is created with a unique per VM secret on first boot, and no known or blank password authenticates. You can prove this with the built in round-trip check, which confirms the per VM administrator signs in through Flarum's API while a blank password and common weak guesses are all rejected:

mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(username,'  (admin account)') FROM flarum.users WHERE username='admin'"

sudo bash /usr/local/sbin/flarum-cred-roundtrip.sh

Step 10 - Verify the stack and where your data lives

Confirm the Flarum version, the health endpoint, the dedicated data disk and the installed schema. The MariaDB database lives on the data disk mounted at /data (bind mounted onto /var/lib/mysql), and Flarum's writable storage and uploads live on the same disk, so all of your community's content is kept separate from the operating system disk and rides with the VM:

sudo -u www-data php /var/www/flarum/flarum --version

curl -sI http://127.0.0.1/healthz | head -1

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data; findmnt -no SOURCE,TARGET /var/lib/mysql

Adding your own domain and TLS

The appliance serves plain HTTP on port 80, and Flarum bakes its base URL into the pages it serves, so for production you should set your own address. Front Flarum with your domain and a TLS certificate, then update the url value in /var/www/flarum/config.php to your public address and clear the cache:

sudo -u www-data php /var/www/flarum/flarum cache:clear

You can terminate TLS with Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer with a certificate for your domain.

Security notes

• Flarum serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS terminating reverse proxy or Azure Application Gateway with a certificate for your domain.
• The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through Flarum or over SSH.
• The administrator password is unique per VM and no known or blank credential authenticates. Keep /root/flarum-credentials.txt protected and change the password from within Flarum if you share access.
• Restrict inbound 80/tcp in your NSG to the networks that need the forum.

Support

This image is maintained by cloudimg with 24/7 support. If you need help deploying or operating Flarum on Azure, contact us at cloudimg.co.uk.