phpMyFAQ 4 Knowledge Base on Ubuntu 24.04 on Azure User Guide

Overview

phpMyFAQ is an established open source FAQ and knowledge base platform used by support teams, companies and communities to publish question and answer content their users can actually find. Content is organised into nested categories and written in a WYSIWYG editor, then surfaced through full text search, tags, a glossary and related article suggestions. It adds multi language content, user and group permissions, news, file attachments, comments and open questions from visitors, PDF export, reporting on what people search for and read, and a REST API, all from one web interface. The cloudimg image ships phpMyFAQ 4 served by Apache and PHP 8.3 on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server so the appliance is complete and useful on its own. The setup wizard is pre completed and locked away, so the knowledge base is ready the moment the instance boots. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306) and keeps its data on a dedicated Azure data disk. A unique administrator password is generated on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• phpMyFAQ 4 served by Apache with PHP 8.3, managed by systemd
• A bundled MariaDB server holding the phpMyFAQ database, already installed and ready
• The setup wizard pre completed and locked away behind a denial, so no setup wizard is ever exposed
• A per VM administrator password generated on first boot and recorded in a root only file
• No shipped default login: the administrator password ships rotated to a discarded random and the real per VM password is set on first boot
• MariaDB bound to 127.0.0.1 only, never exposed to the network
• A dedicated Azure data disk carrying both the MariaDB database and phpMyFAQ's content tree
• Each instance points itself at its own address on first boot, so sign in and generated links work immediately
• Host only session cookies, so sign in works whether you browse by IP or by a DNS name
• apache2.service and mariadb.service as enabled systemd units
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point for a knowledge base serving a team or a modest public audience; move up to Standard_D2s_v3 for larger content sets, heavy search traffic or many concurrent readers. NSG inbound: allow 22/tcp from your management network, 80/tcp for the application and 443/tcp if you terminate TLS on the VM. The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

In the Azure portal choose Create a resource, search for phpMyFAQ 4 Knowledge Base on Ubuntu 24.04 LTS by cloudimg, and select Create. Pick your subscription, resource group and region, choose the Standard_B2s size, select SSH public key authentication with the username azureuser, and allow inbound 22, 80 and 443. The image attaches its own 20 GiB data disk for your knowledge base database and content, so you do not need to add one.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name phpmyfaq \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name phpmyfaq --port 80,443

Step 3 - Confirm the services are running

SSH to the VM as azureuser and confirm Apache, MariaDB and the first boot service are all active. Note that MariaDB is bound to 127.0.0.1:3306 only, while Apache serves on port 80.

systemctl is-active apache2 mariadb phpmyfaq-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/  */ /g'

Step 4 - Retrieve the per VM administrator password

The first boot service generates an administrator password unique to your VM and writes it to a root only file. Read it over SSH:

sudo cat /root/phpmyfaq-credentials.txt

PHPMYFAQ_URL is the address the VM resolved for itself on first boot: the public IP when the VM has one, otherwise its private address. phpMyFAQ builds its absolute links and its sign in form from that address, so browse the VM at the address shown in the file. If you put a DNS name or a TLS terminating proxy in front of the VM, set that address once under Configuration > Reference URL after you sign in.

Step 5 - Sign in

Browse to http://<vm-ip>/admin/ and sign in with the username admin and the password from the credentials file.

After signing in you land on the Dashboard, which shows visits, article, comment and open question counts, registered users, a visits graph and the most popular FAQs, with the administration sections down the left and a live session timer.

Step 6 - Create your categories

phpMyFAQ organises every article into a category, so create at least one before you write your first FAQ. Go to Content > Categories and choose Add new category: give it a name and a description, pick the language, and set which user groups may see it. Categories can be nested, so you can build a shallow tree for a small help centre or a deeper one for a large internal knowledge base.

Step 7 - Write and publish FAQs

Content > FAQ Administration is where your articles live. A fresh instance starts empty, as shown below. Choose Add new FAQ to write one: pick the category, give it a question and an answer in the WYSIWYG editor, add tags to help search, and save it. New articles can be held for review before they go live, and Sticky FAQs pins the important ones to the top. Attachments, comments and visitor submitted open questions are all managed from the same Content area.

Step 8 - The public knowledge base

Browsing http://<vm-ip>/ shows the knowledge base your readers see: a prominent search box with advanced search, the category listing, sticky and most popular FAQs, and a footer with the FAQ overview, sitemap and glossary. This is the page to hand to your users. Language switching, the glossary, RSS feeds and PDF export of any article are all available here without signing in, and visitors can ask a question that arrives in your open questions queue.

Step 9 - No known or default credentials

This image ships with no usable login. The administrator password baked at build time is rotated to a random value that is discarded and never recorded, and the first boot service sets a fresh password unique to your VM before phpMyFAQ serves a single request. The admin account is the only account that can sign in, and the check below confirms that the per VM password authenticates through phpMyFAQ's own authentication path while a blank password and common weak guesses are all rejected.

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(login,'  (the only account that can sign in)') FROM phpmyfaq.faquser WHERE user_id <> -1"

sudo bash /usr/local/sbin/phpmyfaq-cred-roundtrip.sh

The query above excludes phpMyFAQ's built in anonymous record. That row is not a login: it is the internal placeholder phpMyFAQ uses to represent visitors who are not signed in, it is created with an empty password and a protected status, and it cannot authenticate.

Change the administrator password to one of your own at User > Change password once you have signed in for the first time.

Step 10 - Verify the stack and where your data lives

Confirm the installed release, the health endpoint and the data disk layout. Both the MariaDB database and phpMyFAQ's content tree (your configuration, images and attachments) live on the dedicated data disk, bind mounted into place, so your data is kept off the operating system disk.

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT('phpMyFAQ ',config_value) FROM phpmyfaq.faqconfig WHERE config_name='main.currentVersion'"

curl -sI http://127.0.0.1/healthz | sed -n 1p

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data; findmnt -no SOURCE,TARGET /var/lib/mysql; findmnt -no SOURCE,TARGET /var/www/phpmyfaq/content

Adding your own domain and TLS

Point a DNS A record at the VM's public IP, then issue a certificate with Certbot. Install it and request a certificate for your domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d faq.your-domain.example --agree-tos -m you@your-domain.example --redirect

Certbot configures Apache for HTTPS and installs a renewal timer. Afterwards sign in and set Configuration > Reference URL to https://faq.your-domain.example so phpMyFAQ's generated links, PDF exports and sign in form all use your domain rather than the instance IP.

Backing up

Everything worth keeping is on the data disk: the MariaDB database and the content tree. phpMyFAQ also has its own backup export under Backup, which writes a portable dump of your content. For a full machine level backup, take an Azure snapshot of the data disk, or dump the database and archive the content tree:

sudo mysqldump --protocol=socket -uroot --single-transaction phpmyfaq > /var/tmp/phpmyfaq-backup.sql
sudo tar -czf /var/tmp/phpmyfaq-content.tar.gz -C /data/phpmyfaq content

Store both off the VM. The simplest scheduled option is an Azure Backup policy on the VM plus its data disk.

Security notes

• The setup wizard is denied at the web server, so the installer can never be reached or re run against your instance.
• The bundled MariaDB listens on 127.0.0.1:3306 only. Keep port 3306 closed in your NSG; nothing outside the VM needs it.
• phpMyFAQ's configuration tree, which holds the database password, is denied at the web server and cannot be fetched over HTTP.
• The administrator and database passwords are unique to your VM, generated on first boot, and written only to /root/phpmyfaq-credentials.txt with 0600 root:root permissions.
• Session cookies are issued host only, so sign in behaves correctly whether you browse the instance by IP or through a DNS name.
• Serve the knowledge base over HTTPS before you publish it, and restrict 22/tcp to your management network.
• The base OS is fully patched at build time and unattended security upgrades remain enabled on your VM.

Trademark

phpMyFAQ is a trademark of its respective owner. cloudimg is not affiliated with, endorsed by, or sponsored by the phpMyFAQ project. This image packages the open source phpMyFAQ software, which is distributed under the Mozilla Public License 2.0, and all product and company names are the property of their respective holders.

Support

cloudimg provides 24/7 technical support for this image by email (support@cloudimg.co.uk) and live chat, covering deployment, configuration, upgrades, performance tuning and MariaDB administration. Critical issues receive a one hour average response time.