How are you hosting Flarum in production? (Traffic, backups & reliability)

matt-gama

Hello everyone,

I would like to ask you about hosting, scalability, and backup strategies for running Flarum in production.

Recently, I had a serious issue: I was hosting my forum on a cloud VPS provider, and suddenly my instance was powered off. When I turned it back on, all data was gone, as if the VPS had been completely wiped. I contacted support, but they couldn’t clearly explain what happened, and unfortunately, I lost the entire forum.

Because of this, I would really like to understand:

How are you hosting your Flarum forums in production?
What kind of infrastructure do you use to handle higher traffic?
How do you handle automatic and reliable backups (database + files)?
Do you use VPS snapshots, external storage, S3, object storage, etc?

I want to build a more secure and resilient setup, so any real-world experience or recommendations would be very appreciated.

Thank you in advance! 🙏

Capybara

A VPS with automatic backup support. I manage my sites through ispmanager. I’m not using S3, as I haven’t really had a need for it

matt-gama

Capybara Thanks for your reply!

Could you please share which cloud provider you are using (AWS, Azure, Google Cloud, Hetzner, DigitalOcean, etc.)?

Also, what is the VPS configuration you’re running (CPU, RAM, storage)? It would really help me to have a better reference for sizing and reliability.

Capybara

matt-gama REG.RU is my local VPS provider. 4 CPU cores, 4 GB of RAM, and 50 GB of SSD storage

matt-gama

Capybara Thanks for the details!

Do you also use automatic snapshots or offsite backups, or are the backups stored on the same VPS? After my data loss incident, I’m trying to make sure I have redundancy outside the main server to avoid a single point of failure.

Really appreciate you sharing your setup

Capybara

matt-gama To be honest, I don’t fully know how my backups work. The provider handles it — they probably create a VPS snapshot once a day and store it for a month

KBExit

Since I host several flarum sites for customers, my configuration is "overkill."
I handle traffic with a reverse proxy: Traefik
On top of that, I assist clients with the Initial Cloudflare configuration for many reasons.
All my clients have unlimited object storage through my R2 buckets independent to each client.
All of these are powered by AMD Epyc CPU clusters each at 8 CPU / 32 GB RAM for client sites and another pool for MySQL Databases.
Additionally, I have each client configured with Laravel Horizon + REDIS each for snappier performance with their sites.
All backups are automated via Cron and I have them scattered to random intervals that way server resources are not all pulled at the same time, which can put major strain on everything. All these backups go to a dedicated R2 Bucket as well.

There may be a lot I am missing, but BACKUPS are extremely important!

navindra

You can read a bit about how I host PianoTell here.

I rely a lot on free services from CloudFlare, Google, Docker, GitHub, so I may not quite qualify for your definition of production.

luceos

I think there's a few key points that make sense sharing. Here are some of my learnings throughout the years from hosting large scale communities (thousands concurrent users):

Every hosting provider can make mistakes. Never trust any hosting provider to guarantee your data can be restored, your vm can be repaired. Don't expect willingness to help you out, unless there's a proven track record of them doing so. And even if they're willing to help, read the first part of this entry.
Always rely on a set up that guarantees your data is kept secured. Don't store them on one machine. Use a bucket/cdn that is reliable to store your (file) assets and backups.
Using a CDN/bucket negates the need to backup assets, so make sure you backup the database regularly and remotely. Do at least a periodic check that new backups are created, because the backup process can also be faulty, and you will only notice when you actually need them.
A bare metal server can buckle under the pressure of scale. You can optimize a lot of things, but eventually somewhere, something will show a limitation. That's why we operate on a scalable hosting environment using Kubernetes, it scales down with low traffic, and it scales up within a minute to face thousands.
For small communities a small, shared hosting plan is always enough, for growing communities I recommend a (managed) virtual machine/virtual private server. Bare metal (eg hetzner) is a great options to face growth too. But always make sure disks aren't getting completely full, make sure the server is secured and patched.
Once your community is growing, make sure to get the queue up and running. It really helps a ton. The queue requires a daemon to run in the background. Not all hosting providers allow this, so make sure to ask in advance.
One of the easiest ways to host my own virtual machines without a lot of fuss, is using Laravel's Forge: https://forge.laravel.com

andrewjs18

navindra what about further separating out php and nginx into their own containers for security reasons?

andrewjs18

luceos good advice but you don't think you should back up assets, even if they're pushed off onto a CDN/bucket too?

KBExit

andrewjs18 that depends on the individual s3 or compatible provider. It's good to have redundancies for sure, but are you doing more than what is necessary? And in turn, paying for more stress and storage fees than necessary? Cloudflare R2 already has redundancies within their infrastructure and I'm sure AWS does as well.

navindra

andrewjs18 I started with nginx but that's not what I shipped with, if you read a bit more, I eventually adopted Caddy instead because it is so trivial to use.

What security concerns exactly would I be mitigating by having yet another container? That's not clear to me. Note that Caddy and PHP are not exposed to the world, CloudFlare is reverse proxying everything.

andrewjs18

KBExit this is an absolute prime example as to why you should control your own backups rather than allowing some cloud provider to handle your data & your backups: https://arstechnica.com/gadgets/2024/05/google-cloud-accidentally-nukes-customer-account-causes-two-weeks-of-downtime/

my preference is to keep my hosting and storage providers separate to put some level of redundancy in there. additionally, I also have a NAS in my house that I store backups on from my various hosted websites.

andrewjs18

navindra to be fair, I got tied up at work and did not finish reading your post in its entirety earlier.

I'm new to docker myself, but speaking to a friend of mine that is an engineer and who has been pushing me to use docker for years mentioned that while it's common for php and nginx to be in 1 container and the db to be in its own, he likes to separate them out into 3 containers for security reasons and to better maintain software versions.

navindra

andrewjs18 Yeah, I guess the philosophy of containers is 1 process per container. That seems like thorough overkill to me and I prefer to treat containers like lightweight VMs instead.

So I have 1 container to handle web, one to handle DB, and one that handles cloud backups. Every container has a well-defined task and it's more than enough from my perspective.

What would be the security reason for having separate containers for Caddy and PHP? If you compromise Caddy, wouldn't you get access to PHP either way, given that Caddy has to communicate with PHP? On the contrary, with separate containers you may have effectively increased your attack surface because now you have 2 containers that accept connections and can be compromised independently.

ikkeT

I run db dump nightly from hosting cron script. Then I pull that dump along with install dir nightly to my home NAS. It has snapshots, so I could also look back in time. I run very small inactive instance for which this is good enough. I don't have ssh at webhosting, thus two crons. Hosting also takes backups, but I do it myself regardless.

If someone is using such a simple hosting, and only has one cron-job available, here is my way of doing it all from one cron.sh:

BU=backup/bu.tgz
# umask 077

cd $HOME
if [ ! -d backup ]; then
  mkdir backup
  chmod 700 backup
else
  touch -d "1 day ago" backup/cmp-time
  if [ ! -f $BU ] || [ $BU -ot backup/cmp-time ]; then
    echo dump db
    mysqldump -h sql.your-database.de flarum > ~/db.sql
    chmod 600 ~/db.sql
    echo refresh backup
    date > backup-time.txt
    tar czf $BU --exclude './backup' . /usr/www/users/myuserdir
    date >> backup-time.txt
    chmod 600 $BU
    rm ~/db.sql
  fi
fi

cd $HOME/public_html/flarum && /usr/bin/php83 flarum schedule:run

KARAM_SIDHU

Capybara i love the way how you display the banners which appears extremely neat, clean and snappy. Would you mind to share the extension and css code that you've implemented?

Capybara

KARAM_SIDHU This is my extension — MagicSlider. There’s no custom CSS on top — everything is handled through the extension settings

KARAM_SIDHU

Tried it out - had been using it for the last 2 weeks, All Good 👏, Keep up the great work @Capybara