Install with read-only file system

Crell

I'm trying to setup Flarum on a container-based PaaS host. By design, most of the file system is read-only as having the code directory writeable at runtime is a security risk. I can make the storage and public/assets directories writeable, but the installer insists that the Flarum root directory itself be writeable. That's 1) Not possible and 2) Honestly a really bad idea from a security perspective.

Is there some other way to get the installer to run? Can it be installed from the command line or manually? Or pre-populate the config file with DB credentials?

clarkwinkelmann

Crell there is a docker image around that you might be able to take inspiration from. However just a community project so we might not be able to help with that.

You can manually create the config.php file and import the initial database to work around the root folder needing to be writable. The whole reason the directory needs to be writable is to be able to create config.php at the end of the installation wizard. Best would be to install Flarum on another system, then copy the files and database.

To answer the other question, yes it's possible to install Flarum from the command line instead of the web UI (there's a command documented somewhere), but it has the exact same requirements as the web wizard as it will then create the config.php.

You'll also need to handle composer.json, composer.lock and the vendor folder the the extension and dependency management. Flarum does not require those to be writable, but if you plan to run Composer inside of that environment they'll probably need to be writable as well.

Crell

clarkwinkelmann There's a prior build step where the disk is writeable to run composer, so that's fine. I'll see if I can hack the config.php file, though how would I then handle the rest of the installer? I don't know what all it wants to do.

It would be much better for the config file to live in a dedicated directory to avoid this problem. Although even better if the DB creds could be provided via env vars, and the installer skips asking about them if they are already defined.

(Disclosure: I work for said PaaS host, and setting up different applications with our system is part of my job. I've therefore worked with a lot of installers, most of which are absolutely awful, and "env var with installer that skips asking" is by far the best strategy I've found for applications to use.)

luceos

Crell you can fork the skeleton flarum/flarum to achieve that. I'm using env variables inside the config.php if you add another package. I think I wrote it down somewhere here on discuss already 🤔