Tackle the "Use Composer vs. simple ZIP/FTP setup" dilemma

wet

As Flarum is switching to a Composer-based architecure and ecosystem the question arises: Who owns composer.json: Flarum or its user?

A simple ZIP/FTP-based deployment on shared hosting may work like this:

User downloads a zipped package of the final Flarum 1.0, unzips it and uploads it to her web server.
She cannot access the command line and thus no composer binary, so the zipped package will need to contain all dependencies.
She adds some third-party extensions from the future Flarum marketplace, which is also composer-driven and thereby modifies composer.json.
Will she ever be able to download, unzip and deploy an update of Flarum without losing all her own entries in composer.json?

An advanced deployment may employ a professional server with access to a shell, git, and composer:

User clones Flarum's git repo and invokes composer install
She adds a few extensions from the marketplace and installs other third-party packages from packagist, and thereby modifies composer.json.
Will she ever be able to pull an update of Flarum without fearing merge conflicts between her own entries in composer.json and changes commited to Flarum's pristine copy of composer.json after her initial deployment?

jakweb

I will post my opinion here as well.

We develop software for over 12 Years and I can guarantee you anything else then runing an installation wizard on a browser is too much for 99.9% of the clients. We have build softwares like forums, live chat, content management system, helpdesk solutions and more using technology like websockets and server sent events but if it is not done with a simple browser/ftp installation your project will not have much success.

For me for example, I don't like to run a comand and don't know what will be installed and what not, I like to have control over the files I install and run on my web server. Before I upload anything to my server I check the files.

I love the forum how it is build and the features, I know you are still in Beta and you addressed the dilema of composer only therefore keep up the good work!

khaos-rage

jakweb

hcgtv

Have you seen the installation instructions for discourse? It's 'popular' and requires setting up docker to install.

I would rather the ease of composer over ftp. Cost isn't really an issue as vps boxes can be had for $5 or less a month.

If you want to know what is going to be installed with the composer command then just check packagist or the github repo or both

hcgtv

Beta 3 has taken the wind out of the sails of Flarum.

I agree with jakweb, your project will not have much success if it entails long installation instructions.

I was running Beta 2, quite liked it, but there is no way I'm running a command on my VPS not knowing what files it's going to download and from where.

I don't know the answer to your dilemma, but I want a zip to inspect and upload.

Flarum is good stuff, I'll check back when Beta 4 hits.

Franz

hcgtv I understand your sentiments, and I also don't like the higher barrier to entry.

hcgtv there is no way I'm running a command on my VPS not knowing what files it's going to download and from where.

I won't let that count, though. This is exactly the command we would run when generating the ZIP file for you to inspect.

We could offer a pre-packaged zip file for easy installation; however, people still won't be able to install new extensions without having Composer installed. That's the problem we face, which is why we required Composer right away from the get-go.

vargmal

Franz We could offer a pre-packaged zip file for easy installation; however, people still won't be able to install new extensions without having Composer installed.

why not both?

I installed beta 2 un my shared bluehost, I got the errors because I was using php5.4 contacted support and they changed it to php5.6 now beta2 is installed and it works great...

I havent contacted them yet... but maybe they will also install composer for me since I dont have ssh access..

hcgtv

Franz I hear you Franz, wish I had an answer for your extension problem.

Like me, I think many will just sit back now and wait for a stable build, and see what is required then.

But keep plugging away, we need good forum software.

astralnebula

For what it is worth: Composer is awesome. Took me a WHILE to understand it but now it is CRUCIAL (but not unavoidable).

There can be more than one composer.json *

One for core, one for extensions.

on the topic of curl | sh installs, and zips..

While I agree that curl | sh is no bueno, what about a simple curl | less | sh or some sort of "source review" before it hits the |sh and users would be able to see exactly line for line which code will be processing.

I see no reason why there wouldn't be .zip and .tar.gz releases, including the ./vendor dir , not requiring composer, but limited with extensibility.

dehbuff

final release will be installed without composer and ssh? many of us hope so 🙁

wet

If this is read by a developer, would you mind adding your thoughts to the core question I gave when opening this thread: Who owns composer.json in a composer-driven ecosystem, and how would your resolve conflicts?

Franz

wet In an architecture where updating Flarum's core should be a simple composer update after changing the version number of the flarum/core dependency, the skeleton should be as small as possible. Thus, it should not need to change between upgrades.

So, to answer in terms of the question: That would mean the user owns composer.json.

wet

Franz Hehe... You elegantly shuffled around the question how the low-cost shared hosting customer invokes these magic composer commands. She has an FTP client on her iDevice at best, downloads a ZIP from the official download location which she extracts and uploads to her webspace. She wants to keep all her composer-installed ecosystem extensions when she goes from 1.0 to 1.0.1. How?

I'm not worrying about the git-/ssh-aware crowd but I want to cater for the zip/ftp/setup users.

Franz

wet Ha, that's because I don't have an answer to that particular question yet. (Save for an external service that helps users with shared hosts.)

Toby

For the record, I'm planning to do a big brain-dump with all my thoughts on this issue sometime in the next day or two.

kevindierkx

In my opinion composer adds allot of flexibility. You can easily just clone the main repository modify it in every way you like, add lots of stuff to the composer.json and aslong as everything is compatible with the different versioned 'components' you can create an awesome customised build.
At that point archive it in a zip or something and upload it to your server.

So in a nutshell the end user is the 'owner'. (By the way, everything composer installs/downloads is placed in the vendors folder.)

I'm fairly new to Flarum and the first thing I would do is sandbox the index.php from my core files and making only the index.php available to my vhost config. Yes, I'm a completely different target audience but looking at the .htaccess file provided I would be forced to make some changes anyway. In most of our automation we don't use Apache but instead we use NGINX as our webserver. (NGINX doesn't support .htaccess files for those who are wondering what I'm talking about.)

Franz

kevindierkx By the way, everything composer installs/downloads is placed in the vendors folder.

Well, in fact, extensions are placed in the "extensions" folder instead. 🙂

jakweb

khaos-rage It is not an issue to get a VPS box, we are very familiar with command line, all our web servers are build from scratch, but I'm talking for the majority of people, this will not install flarum, because they will either have no access to ssh or if they have they usually get scared when they see the black window with only letters and no graphics. 😉