Flarum

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point. Choose a larger size for bigger or busier communities.

In the NSG, allow inbound 22/tcp from your management network and 80/tcp for the forum. Flarum serves plain HTTP on port 80, so for production terminate TLS in front of it with your own domain. The bundled MariaDB listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Flarum by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:flarum-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name flarum \
  --image sac1647283583153:flarum-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the forum:

az vm open-port --resource-group <your-rg> --name flarum --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that nginx, PHP FPM and MariaDB are all active. MariaDB listens only on 127.0.0.1:3306, while nginx serves the forum on port 80.

systemctl is-active nginx php8.3-fpm mariadb flarum-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

Each VM generates its own Flarum administrator password on first boot. The password, the login user and the URL are written to a root-only credentials file. Read it with sudo:

sudo cat /root/flarum-credentials.txt

Sign in to the forum as user admin with the FLARUM_ADMIN_PASSWORD from this file. On the VM itself, run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in to the forum

Browse to http://<vm-public-ip>/. The forum front page opens, and it already has a welcome discussion.

Click Log In in the top right and sign in with username admin and the password from Step 4.

Step 6 - Open the administration dashboard

Signed in as admin, open the Administration area from the user menu, or browse to /admin.

The dashboard summarises your forum at a glance, including the Flarum, PHP and database versions. The left menu gives you Basics, Email, Permissions, Appearance and Users, plus the full list of bundled extensions.

Step 7 - Start and read discussions

From the front page, click Start a Discussion to post, or open a discussion to read and reply. Members can mention each other with @, react with likes, and follow discussions.

The welcome discussion below shows the thread view with the original post and the reply box.

Step 8 - Manage permissions and extensions

Open Permissions in the Administration menu to configure exactly who can see and do what. Permissions are set per group (Admins, Mods and your own groups) across reading, creating, participating and moderating.

The bundled extensions (Tags, Likes, Mentions, Flags, Approval, Sticky, Lock, Subscriptions and more) are listed in the same panel, where you can toggle and configure them. You can add more from the Flarum community.

Step 9 - No known or default credentials

Flarum ships no default login. This image goes further: the administrator account is created with a unique per-VM secret on first boot, and no known or blank password authenticates.

You can prove this with the built-in round-trip check. It confirms that the per-VM administrator signs in through Flarum's API while a blank password and common weak guesses are all rejected:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(username,' (admin account)') FROM flarum.users WHERE username='admin'"

sudo bash /usr/local/sbin/flarum-cred-roundtrip.sh

Step 10 - Verify the stack and where your data lives

The MariaDB database lives on the data disk mounted at /data and bind-mounted onto /var/lib/mysql. Flarum's writable storage and uploads live on the same disk. All of your community's content is therefore kept separate from the operating system disk and travels with the VM.

Confirm the Flarum version, the health endpoint, the dedicated data disk and the installed schema:

sudo -u www-data php /var/www/flarum/flarum --version

curl -sI http://127.0.0.1/healthz | head -1

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data;
findmnt -no SOURCE,TARGET /var/lib/mysql

Adding your own domain and TLS

The appliance serves plain HTTP on port 80, and Flarum bakes its base URL into the pages it serves, so for production you should set your own address. Front Flarum with your domain and a TLS certificate. Then update the url value in /var/www/flarum/config.php to your public address and clear the cache:

sudo -u www-data php /var/www/flarum/flarum cache:clear

You can terminate TLS with Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer that holds a certificate for your domain.

Security notes

• Encrypt web traffic. Flarum serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS-terminating reverse proxy or Azure Application Gateway with a certificate for your domain.
• Keep MariaDB private. The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through Flarum or over SSH.
• Protect the administrator password. The password is unique per VM, and no known or blank credential authenticates. Keep /root/flarum-credentials.txt protected, and change the password from within Flarum if you share access.
• Restrict inbound access. Limit inbound 80/tcp in your NSG to the networks that need the forum.

Support

SecureAnyCloud maintains this image and provides 24/7 support. For help deploying or operating Flarum on Azure, contact us at secureanycloud.com.

Deploy on Azure

Launch Flarum on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com