phpMyFAQ Knowledge Base on AWS User Guide

Overview

phpMyFAQ is an established open source FAQ and knowledge base platform used by support teams, companies and communities to publish question and answer content their users can actually find. Content is organised into nested categories and written in a WYSIWYG editor, then surfaced through full text search, tags, a glossary and related article suggestions. It adds multi language content, user and group permissions, news, file attachments, comments and open questions from visitors, PDF export, reporting on what people search for and read, and a REST API, all from one web interface. The cloudimg image ships phpMyFAQ 4 served by Apache and PHP 8.3 on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server so the appliance is complete and useful on its own. The setup wizard is pre completed and locked away, so the knowledge base is ready the moment the instance boots. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306) and keeps its data on a dedicated EBS data volume. A unique administrator password is generated on the first boot of every instance. Backed by 24/7 cloudimg support.

What is included:

• phpMyFAQ 4 served by Apache with PHP 8.3, managed by systemd
• A bundled MariaDB server holding the phpMyFAQ database, already installed and ready
• The setup wizard pre completed and locked away behind a denial, so no setup wizard is ever exposed
• A per instance administrator password generated on first boot and recorded in a root only file
• No shipped default login: the administrator password ships rotated to a discarded random and the real per instance password is set on first boot
• MariaDB bound to 127.0.0.1 only, never exposed to the network
• A dedicated EBS data volume carrying both the MariaDB database and phpMyFAQ's content tree
• Each instance points itself at its own address on first boot, so sign in and generated links work immediately
• Host only session cookies, so sign in works whether you browse by IP or by a DNS name
• apache2.service and mariadb.service as enabled systemd units
• An unauthenticated /healthz endpoint for load balancer health probes
• 24/7 cloudimg support

Prerequisites

An AWS account, an EC2 key pair in the target region, and a VPC plus subnet. m5.large (2 vCPU / 8 GiB RAM) is a sensible starting point for a knowledge base serving a team or a modest public audience; move up to a larger instance type for large content sets, heavy search traffic or many concurrent readers. Security group inbound: allow 22/tcp from your management network and 80/tcp for the application (add 443/tcp if you terminate TLS on the instance). The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Connecting to your instance

Connect over SSH on port 22 using your EC2 key pair. The login user depends on the OS variant you launched:

ssh -i /path/to/your-key.pem ubuntu@<instance-public-ip>

Step 1 - Deploy from the AWS Marketplace

In the AWS Marketplace find phpMyFAQ Knowledge Base | Support by cloudimg and choose Continue to Subscribe, then Continue to Configuration and Continue to Launch. Pick your region, the m5.large instance type, your VPC and subnet, and a security group that allows inbound 22 and 80. Select your EC2 key pair and launch. The image attaches its own 20 GiB EBS data volume for your knowledge base database and content, so you do not need to add one.

Step 2 - Deploy from the AWS CLI

aws ec2 run-instances \
  --image-id <ami-id-from-listing> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <sg-with-22-and-80> \
  --subnet-id <your-subnet> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=phpmyfaq}]'

The security group must allow inbound 80/tcp for the application and 22/tcp for SSH from your management network.

Step 3 - Confirm the services are running

SSH to the instance as ubuntu and confirm Apache, MariaDB and the first boot service are all active. Note that MariaDB is bound to 127.0.0.1:3306 only, while Apache serves on port 80.

systemctl is-active apache2 mariadb phpmyfaq-firstboot

ss -tlnH 'sport = :80' 'sport = :3306' | awk '{print $4}'

Step 4 - Retrieve the per instance administrator password

The first boot service generates an administrator password unique to your instance and writes it to a root only file. Read it over SSH:

sudo cat /root/phpmyfaq-credentials.txt

PHPMYFAQ_URL is the address the instance resolved for itself on first boot: the public IP when the instance has one, otherwise its private address. phpMyFAQ builds its absolute links and its sign in form from that address, so browse the instance at the address shown in the file. If you put a DNS name or a TLS terminating proxy in front of the instance, set that address once under Configuration > Reference URL after you sign in.

Step 5 - Sign in

Browse to http://<instance-public-ip>/admin/ and sign in with the username admin and the password from the credentials file. After signing in you land on the Dashboard, which shows visits, article, comment and open question counts, registered users, a visits graph and the most popular FAQs, with the administration sections down the left and a live session timer.

Step 6 - Create your categories

phpMyFAQ organises every article into a category, so create at least one before you write your first FAQ. Go to Content > Categories and choose Add new top-level category: give it a name and a description, pick the language, and set which user groups may see it. Categories can be nested, so you can build a shallow tree for a small help centre or a deeper one for a large internal knowledge base.

Step 7 - Write and publish FAQs

Content > Add new FAQ is where you write an article: pick the category, give it a question and an answer in the WYSIWYG editor, add tags to help search, and save it. New articles can be held for review before they go live, and Sticky FAQs pins the important ones to the top. Attachments, comments and visitor submitted open questions are all managed from the same Content area. Each category lists its published articles with a preview, ready for your readers.

Step 8 - The public knowledge base

Browsing http://<instance-public-ip>/ shows the knowledge base your readers see: a prominent search box with advanced search, the category listing, sticky and most popular FAQs, and a footer with the FAQ overview, sitemap and glossary. This is the page to hand to your users. Language switching, the glossary, RSS feeds and PDF export of any article are all available here without signing in, and visitors can ask a question that arrives in your open questions queue.

Opening an article shows the full answer with its reading time, an ID, the author and dates, and controls to bookmark it, export a PDF, share it or rate it.

Step 9 - No known or default credentials

This image ships with no usable login. The administrator password baked at build time is rotated to a random value that is discarded and never recorded, and the first boot service sets a fresh password unique to your instance before phpMyFAQ serves a single request. The admin account is the only account that can sign in, and the check below confirms that the per instance password authenticates through phpMyFAQ's own authentication path while a blank password and common weak guesses are all rejected.

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(login,'  (the only account that can sign in)') FROM phpmyfaq.faquser WHERE user_id <> -1"

sudo bash /usr/local/sbin/phpmyfaq-cred-roundtrip.sh

The query above excludes phpMyFAQ's built in anonymous record. That row is not a login: it is the internal placeholder phpMyFAQ uses to represent visitors who are not signed in, it is created with an empty password and a protected status, and it cannot authenticate. Change the administrator password to one of your own at User > Change password once you have signed in for the first time.

Step 10 - Verify the stack and where your data lives

Confirm the installed release, the health endpoint and the data volume layout. Both the MariaDB database and phpMyFAQ's content tree (your configuration, images and attachments) live on the dedicated EBS data volume, bind mounted into place, so your data is kept off the operating system disk.

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT('phpMyFAQ ',config_value) FROM phpmyfaq.faqconfig WHERE config_name='main.currentVersion'"

curl -sI http://127.0.0.1/healthz | sed -n 1p

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data; findmnt -no SOURCE,TARGET /var/lib/mysql; findmnt -no SOURCE,TARGET /var/www/phpmyfaq/content

Adding your own domain and TLS

Point a DNS A record at the instance's public IP, then issue a certificate with Certbot. Install it and request a certificate for your domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d faq.your-domain.example --agree-tos -m you@your-domain.example --redirect

Certbot configures Apache for HTTPS and installs a renewal timer. Afterwards sign in and set Configuration > Reference URL to https://faq.your-domain.example so phpMyFAQ's generated links, PDF exports and sign in form all use your domain rather than the instance IP.

Backing up

Everything worth keeping is on the data volume: the MariaDB database and the content tree. phpMyFAQ also has its own backup export under Backup, which writes a portable dump of your content. For a full machine level backup, take an EBS snapshot of the data volume, or dump the database and archive the content tree:

sudo mysqldump --protocol=socket -uroot --single-transaction phpmyfaq > /var/tmp/phpmyfaq-backup.sql
sudo tar -czf /var/tmp/phpmyfaq-content.tar.gz -C /data/phpmyfaq content

Store both off the instance. The simplest scheduled option is an Amazon Data Lifecycle Manager policy that snapshots the data volume on a schedule.

Security notes

• The setup wizard is denied at the web server, so the installer can never be reached or re run against your instance.
• The bundled MariaDB listens on 127.0.0.1:3306 only. Keep port 3306 closed in your security group; nothing outside the instance needs it.
• phpMyFAQ's configuration tree, which holds the database password, is denied at the web server and cannot be fetched over HTTP.
• The administrator and database passwords are unique to your instance, generated on first boot, and written only to /root/phpmyfaq-credentials.txt with 0600 root:root permissions.
• Session cookies are issued host only, so sign in behaves correctly whether you browse the instance by IP or through a DNS name.
• Serve the knowledge base over HTTPS before you publish it, and restrict 22/tcp to your management network.
• The base OS is fully patched at build time and unattended security upgrades remain enabled on your instance.

Trademark

phpMyFAQ is a trademark of its respective owner. cloudimg is not affiliated with, endorsed by, or sponsored by the phpMyFAQ project. This image packages the open source phpMyFAQ software, which is distributed under the Mozilla Public License 2.0, and all product and company names are the property of their respective holders.

Support

cloudimg provides 24/7 technical support for this image by email (support@cloudimg.co.uk) and live chat, covering deployment, configuration, upgrades, performance tuning and MariaDB administration. Critical issues receive a one hour average response time.