Flarum encountered a boot error.

KBExit

boohoo your Flarum is exposing the /public directory which is exposing vulnerable files. You need this remedied asap.

boohoo

I did chmod 755 public/. How do I know if that helped? I altered config.php to 'url' => 'https://brainchildforum.com' from 'url' => 'https://brainchildforum.com/public' and got the error message "The page you requested could not be found. Return to Brainchild Forum" so I changed it back, but I don't know why this site doesn't have a "public" extension in the url if it default adds it when installing flarum.

KBExit

I can't see your reply @boohoo

clarkwinkelmann

KBExit the message was awaiting moderation because of the links it contains.

boohoo there are 2 options to deal with the "public" path.

Either set the webroot to the public path in your Apache/nginx configuration, as instructed during the installation steps https://docs.flarum.org/install/#installing-using-the-command-line-interface It's best to do it before running the installation wizard, but if you do it now there's just the extra step of editing config.php to change the URL after Apache/nginx has been modified. That's what I call the "Laravel-style" installation.

Or if you want to remove the public folder completely to install "Wordpress-style", the instructions are here https://docs.flarum.org/install/#customizing-paths

KBExit

boohoo alternative to what @clarkwinkelmann mentioned, and I've done it in the past when I first started Flarum.

Change it back to without /public in your Flarum Configurations and point your ROOT Directory to /public.
This should be a simple remedy.

Did you install Flarum via Softaculous?

boohoo

KBExit

Yes. Also, looking at Customizing Paths in FLARUM docs, I have public_html, and this site is off of another site who has the hosting plan. My flarum website is off a cryptic folder of public_html that shows up as my fun url.

However, if you wish to host Flarum in a subdirectory (like yoursite.com/forum), or if your host doesn't give you control over your webroot (you're stuck with something like public_html or htdocs), you can set up Flarum without the public directory.

I guess I can't eliminate /public, or am I missing the point?

Simply move all the files inside the public directory (including .htaccess) into the directory you want to serve Flarum from. Then edit .htaccess and uncomment lines 9-15 in order to protect sensitive resources. For Nginx, uncomment lines 8-11 of .nginx.conf.

Does that make the website folder really messy - disorganized? Also, I would be saving over .htaccess but I will see if it is the same.

KBExit

boohoo that's your first problem right there. I have told the team over at Softaculous several times that their method of installing Flarum is dangerous. They said they would remedy it, but it's clear that they haven't done so at all.
I advise you to install Flarum via the documentation or find a managed host.
It's critical that you do not expose the /public directory at all and I am concerned if you keep using Softaculous, future updates will cause more issues down the line for you.

boohoo

KBExit

This is all above my experience. What do you mean expose the /public directory? I assigned the chmod for it, and I'm trying to remove /public from my url. It seems that it just installed flarum into a folder off my public_html (main url). Do you mean the folders and files are incorrect?

I think the boot problem was I saved over my mySQL password and changed it back, and I needed to update something else with my password. I don't get exactly what exposing /public files is. I also just assigned a ****load of FontAwesome icons to categories, and I don't want to go back unless necessary.

KBExit

boohoo

Insecure public folder

It appears you didn't complete the path customization to use Flarum without a public folder. This leaves all Flarum sensitive files unprotected. Update your webserver root to point to the public folder or complete the instructions to remove the public folder and use the suggested rewrite rules to restrict access to the files instead.

Vendor folder

Your vendor folder is currently being served by your webserver. This could expose untrusted scripts to the world and compromise your security.

Storage folder

Your storage folder is currently being served by your webserver. This could expose private data (including access tokens) and compromise your security.

Composer files

Your Composer files are currently being served by your webserver. This could expose advanced information about your server configuration and installed packages.

Before we move any further. Please confirm: Are you using Softaculous to manage your Flarum Installation?

boohoo

KBExit

Yes, I used it to install and didn't touch Softaculous again because I think that's all it did.

KBExit

boohoo take a backup of the following files:
composer.json
config.php
extend.php
and your assets folder.
Create a backup of your MySQL Database via SQL Dump.
Download these files.

Delete your Softaculous Installation entirely.

SSH Using Terminal and go to your root directory, run the Flarum Installation Command.
composer create-project flarum/flarum:^1.8.0 .
Change the document root from public_html to public_html/public
Go to your website, complete the Installation Wizard.
Upload and override those files in the Flarum Directory, upload your SQL Dump to your database to recover your website details, and run composer update in your Flarum Directory.

It is critical we detach Softaculous Entirely so it doesn't brick your website with future updates.
It is also critical that we fix the exposure of /public directory so your vulnerable files are not accessible to the browser.

If you don't want to take my word for it: https://lab.migratetoflarum.com/scans/06d008ec-0fea-494f-a0dd-92a2b725310b

boohoo

I took it down, but why can't I use one of the path customization options? Some of these things take a lot of time. I'm working on it tomorrow.

I think I can copy it in cpanel, trash it in Softaculous, and move it back to where it was and do the url configuration stuff.

KBExit

boohoo you can customize your path but you didn't have it set properly.
Easiest way to install Flarum is the way I described. You deviate from what I suggested, you can break your install or be back to square one to where you had files exposed that shouldn't be.

Just move your document root to what I suggested and be done with it after you detach Softaculous. It doesn't take that much time.

Tip-toeing and avoiding Composer/SSH is only going to cause you more headaches down the road.

boohoo

When you say all of that, do you basically mean follow the flarum instructions that use composer and copy over the files you mentioned? Does this deviate from the flarum instruction list?

GreXXL

boohoo what you actually just need to do is point your document root to your /public directory instead of /public_html or wherever it's pointed now and you will have a much better installation.

KBExit

boohoo follow the install instructions from Flarum, but prior to doing so, point document root to /public.
After you have everything set up, upload your backups and run composer update and your site will have your old content and you'll have a secure install.

boohoo

GreXXL @KBExit

So both of you contradict each other. I can easily scrap my Softaculous record of Flarum installation and copy everything back over to where it was and put the database back and fix the document root (maybe). Or should I rebuild everything?

I have no public folder because I removed flarum. Do I make a folder public_html/public? My file structure is I have everything in my main site in public_html, like index.html. Then I have some website folders there and one is brainchildforum. Do I have to contact my web admin to point the document root to public_html/public? I have some other files from my main website that I don't want to change anything for. Doesn't making a public_html/public folder that I put my files from brainchildforum in not work because the public folder is not within the branchildforum website folder?

Are you saying I have extra file space in public_html that no one can see and store everything that's on the web in public_html/public, but then I lose the chain public_html/website666....which is my url chain

I'm just a newb that barely figured out ssh.

Or I could do the thing where I put all my public files out of the public folder and into the website folder.

KBExit

I suggested my approach to detach from Softaculous entirely because they do an improper install of Flarum and I know the software handles updates as well. I don't want you to have issues down the road.
Best approach is to do a proper clean install with the method I've suggested. @GreXXL is suggesting to just move Document Root to /public, but I don't know if he ran Flarum Softaculous before. I am relaying my experiences from using the software when I started out using Flarum.

boohoo

KBExit Okay. I am doing that. I am just wondering whether SQL Dump of the current database is free from installation problems. SQL Dump is a really big pain for me, and I want to know that it's a perfect idea...

KBExit

boohoo dumping the SQL is just downloading what's in your tables currently. It's how you should perform backups. If you haven't been doing it before, I strongly advise you to do it from here on out.
Along with proper security updates, SSH Hardening, audits, etc. If you have issues with these, I strongly advise going for a managed hosting solution so you can just worry about the content and community at hand. There's a lot of moving parts when managing communities, especially when users are trusting you to handle their data safely.