raphael done, I've disabled reactions for you.
tom23 does your forum work now?
Hello everyone! Once again, I am writing a rather longer message to communicate the current state of FreeFlarum with you.
As you might already know, FreeFlarum has been experiencing several outages over the past few days. First of all, I sincerely thank everyone for reporting this to me, either in this discussion or through e-mail - similarly, thank you for being patient while I work on improving things for everyone.
Initially, these outages came as no huge surprise to me, given that the amount of online forums is now at its historical peak - 4 891 forums are online! Before this milestone, I believed that the limit sit at around 3 000 online forums, as this was the limit around which things started to break. This proves that the upgrades that I rolled out last September were efficient, as it allowed for approximately 1 900 more forums to be hosted on the same hardware, without any additional expenses.
However, even these improvements won't be sufficient permanently. Disk usage sits at around 95 % right now - despite me cleaning up some inactive forums, some of them later asked to be reactivated. Obviously, there's nothing wrong with that - I just mean that this proves that as time moves on, more forums are being registered, and the number of active forums grows with that as well.
But now for the more unfortunate news. It has recently come to my attention that FreeFlarum was caught in a DDoS attack, which rapidly contributed to these downtimes. This was possible because FreeFlarum did not proxy forums through Cloudflare, otherwise linking forums through custom domain wouldn't be possible per their "CNAME Cross-User Banned" policy. I have now mitigated this by enabling Cloudflare at least for all forums hosted under the .flarum.cloud domain (which is the vast majority), as this domain is not required to be CNAMEd to during the domain linking process. I also tried my luck by enabling it for .freeflarum.com to see if it somehow functions with FreeFlarum's CNAME setup, but it didn't (hence some forums were not available for some time).
As I have never witnessed a DDoS attack of similar scale at FreeFlarum before, the existing configuration to mitigate such issues was sadly not tested enough, nor was it efficient. It seems odd to me what ambitions do such people have when it comes to these attacks, and what do they have from it? Anyways, just to clarify: no data was stolen or otherwise transferred from the server during the attack - it was just a matter of someone utilizing an online DDoS service to flood the FreeFlarum server with hundreds of spam requests to bring the RAM usage to critical point. And at that point, the webserver was killed by being out-of-memory - hence the downtime (which lasted until the webserver was restarted). I will not get way too technical about this. But at least it wasn't all for nothing. This attack showed me where FreeFlarum's security lacks attention, and how should I improve it in the next upgrade.
Speaking of upgrades, as I might've mentioned before, I am currently in the process of updating the FreeFlarum codebase, and I will migrate it to a server with better hardware and more disk space soon. While such move will also introduce higher monthly charges to keep the server running, I believe that this will be for the greater good and to make the service more available for everyone. And at this point, I would like to thank all donors for donating to FreeFlarum - it means a lot to me, and I couldn't be more grateful to you - you all are the reason that this service exists in the first place.
I will now share some of the upcoming changes that I've been thinking about, namely:
- removing unused/underused features (such as database templates during forum creation);
- updating the database model (so that I can keep track of historical records for donations and forum removals - currently, the data is shown in the present, as-is)
- switching to other donation service (Open Collective? Patreon?)
- making the documentation clearer (finally finally?)
- synchronizing the multitenant GitHub repository - move extension requests here, for automated and transparent extension inclusion
- better status page
- more quality of life improvements under the hood...
Overall, this update is less complex than the last year's one, so it should go a lot smoother, I hope. Unfortunately, due to me working on the project in my spare time, I am unable to give you an exact date of the release, and with that also any specific downtime date (there will surely be some outage), however I will obviously make sure to inform you all of it here as soon as possible, after I finish what needs to be done.
Lastly, as always, if you notice anything out of the ordinary, then please let me know - either via info@freeflarum.com or directly in this thread. If it's something that is related to your forum, then please share your forum URL too. But generic suggestions and feedback is very appreciated too :)
