SecureAnyCloud
Deployment guide

phpMyFAQ

Overview

phpMyFAQ is an established open-source FAQ and knowledge base platform. Support teams, companies and communities use it to publish question-and-answer content that their users can find. Content is organised into nested categories and written in a WYSIWYG editor, then surfaced through full-text search, tags, a glossary and related-article suggestions.

phpMyFAQ also provides multi-language content, user and group permissions, news, file attachments, comments, open questions from visitors, PDF export, reporting on what people search for and read, and a REST API, all from one web interface.

The SecureAnyCloud image ships phpMyFAQ 4 served by Apache and PHP 8.3 on a hardened Ubuntu 24.04 LTS base, patched at build time. A bundled local MariaDB server makes the appliance complete and useful on its own. The setup wizard is pre-completed and locked away, so the knowledge base is ready the moment the instance boots.

The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306) and keeps its data on a dedicated Azure data disk. A unique administrator password is generated on the first boot of every VM.

What you get:

  • phpMyFAQ 4 served by Apache with PHP 8.3, managed by systemd
  • A bundled MariaDB server holding the phpMyFAQ database, already installed and ready
  • The setup wizard pre-completed and denied at the web server, so it is never exposed
  • A per-VM administrator password, generated on first boot and recorded in a root-only file
  • No shipped default login: the administrator password ships rotated to a discarded random value, and the real per-VM password is set on first boot
  • MariaDB bound to 127.0.0.1 only (port 3306), never exposed to the network
  • A dedicated Azure data disk carrying both the MariaDB database and phpMyFAQ's content tree
  • Each instance points itself at its own address on first boot, so sign-in and generated links work immediately
  • Host-only session cookies, so sign-in works whether you browse by IP address or by DNS name
  • apache2.service and mariadb.service as enabled systemd units
  • An unauthenticated /healthz endpoint for Azure Load Balancer health probes
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point for a knowledge base that serves a team or a modest public audience. Move up to Standard_D2s_v3 for larger content sets, heavy search traffic or many concurrent readers.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, 80/tcp for the application, and 443/tcp if you terminate TLS on the VM. The bundled MariaDB is never exposed. It listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

In the Azure portal, choose Create a resource, search for phpMyFAQ 4 Knowledge Base on Ubuntu 24.04 LTS by SecureAnyCloud, and select Create.

Pick your subscription, resource group and region, and choose the Standard_B2s size. Select SSH public key authentication with the username azureuser, and allow inbound 22, 80 and 443.

The image attaches its own 20 GiB data disk for your knowledge base database and content, so you do not need to add one.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:phpmyfaq-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name phpmyfaq \
  --image sac1647283583153:phpmyfaq-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name phpmyfaq --port 80,443

Step 3 - Confirm the services are running

SSH to the VM as azureuser and confirm that Apache, MariaDB and the first-boot service are all active. MariaDB is bound to 127.0.0.1:3306 only, while Apache serves on port 80.

systemctl is-active apache2 mariadb phpmyfaq-firstboot
ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

The first-boot service generates an administrator password that is unique to your VM and writes it to a root-only file. Read it over SSH:

sudo cat /root/phpmyfaq-credentials.txt

PHPMYFAQ_URL is the address that the VM resolved for itself on first boot. It is the public IP when the VM has one, otherwise its private address. phpMyFAQ builds its absolute links and its sign-in form from that address, so browse the VM at the address shown in the file.

If you put a DNS name or a TLS-terminating proxy in front of the VM, set that address once under Configuration > Reference URL after you sign in.

Step 5 - Sign in

Browse to http://<vm-ip>/admin/ and sign in with the username admin and the password from the credentials file.

You land on the Dashboard. It shows visit, article, comment and open-question counts, registered users, a visits graph and the most popular FAQs. The administration sections are down the left, with a live session timer.

Step 6 - Create your categories

phpMyFAQ organises every article into a category, so create at least one before you write your first FAQ.

Go to Content > Categories and choose Add new category. Give it a name and a description, pick the language, and set which user groups may see it.

Categories can be nested. Build a shallow tree for a small help centre, or a deeper one for a large internal knowledge base.

Step 7 - Write and publish FAQs

Content > FAQ Administration is where your articles live. A fresh instance starts empty.

Choose Add new FAQ to write an article. Pick the category, enter a question and an answer in the WYSIWYG editor, add tags to help search, and save it.

New articles can be held for review before they go live, and Sticky FAQs pins the important ones to the top. Attachments, comments and open questions submitted by visitors are all managed from the same Content area.

Step 8 - The public knowledge base

Browsing http://<vm-ip>/ shows the knowledge base your readers see. It has a prominent search box with advanced search, the category listing, sticky and most popular FAQs, and a footer with the FAQ overview, sitemap and glossary. This is the page to share with your users.

Language switching, the glossary, RSS feeds and PDF export of any article are all available here without signing in. Visitors can also ask a question, which arrives in your open-questions queue.

Step 9 - No known or default credentials

This image ships with no usable login. The password of the admin account baked in at build time is rotated to a random value that is discarded and never recorded. The first-boot service then sets a fresh password that is unique to your VM, before phpMyFAQ serves a single request.

The admin account is the only account that can sign in. The check below confirms that the per-VM password authenticates through phpMyFAQ's own authentication path, while a blank password and common weak guesses are all rejected.

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(login,' (the only account that can sign in)') FROM phpmyfaq.faquser WHERE user_id <> -1"
sudo bash /usr/local/sbin/phpmyfaq-cred-roundtrip.sh

The query above excludes phpMyFAQ's built-in anonymous record. That row is not a login. It is the internal placeholder that phpMyFAQ uses to represent visitors who are not signed in, it is created with an empty password and a protected status, and it cannot authenticate.

After you sign in for the first time, change the administrator password to one of your own at User > Change password.

Step 10 - Verify the stack and where your data lives

Confirm the installed release, the health endpoint and the data disk layout. The MariaDB database and phpMyFAQ's content tree (your configuration, images and attachments) both live on the dedicated data disk. The disk is bind-mounted into place, which keeps your data off the operating system disk.

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT('phpMyFAQ ',config_value) FROM phpmyfaq.faqconfig WHERE config_name='main.currentVersion'"
curl -sI http://127.0.0.1/healthz | sed -n 1p
findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data;
findmnt -no SOURCE,TARGET /var/lib/mysql;
findmnt -no SOURCE,TARGET /var/www/phpmyfaq/content

Adding your own domain and TLS

Point a DNS A record at the VM's public IP. Then install Certbot and request a certificate for your domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d faq.your-domain.example --agree-tos -m you@your-domain.example --redirect

Certbot configures Apache for HTTPS and installs a renewal timer. Afterwards, sign in and set Configuration > Reference URL to https://faq.your-domain.example. phpMyFAQ's generated links, PDF exports and sign-in form then use your domain instead of the instance IP.

Backing up

Everything worth keeping is on the data disk: the MariaDB database and the content tree. phpMyFAQ also has its own backup export under Backup, which writes a portable dump of your content.

For a full machine-level backup, take an Azure snapshot of the data disk, or dump the database and archive the content tree:

sudo mysqldump --protocol=socket -uroot --single-transaction phpmyfaq > /var/tmp/phpmyfaq-backup.sql
sudo tar -czf /var/tmp/phpmyfaq-content.tar.gz -C /data/phpmyfaq content

Store both off the VM. The simplest scheduled option is an Azure Backup policy on the VM and its data disk.

Security notes

  • The setup wizard is denied at the web server, so the installer can never be reached or re-run against your instance.
  • The bundled MariaDB listens on 127.0.0.1:3306 only. Keep port 3306 closed in your NSG, because nothing outside the VM needs it.
  • phpMyFAQ's configuration tree, which holds the database password, is denied at the web server and cannot be fetched over HTTP.
  • The administrator and database passwords are unique to your VM, generated on first boot, and written only to /root/phpmyfaq-credentials.txt with 0600 root:root permissions.
  • Session cookies are host-only, so sign-in behaves correctly whether you browse the instance by IP address or through a DNS name.
  • Serve the knowledge base over HTTPS before you publish it, and restrict 22/tcp to your management network.
  • The base OS is fully patched at build time, and unattended security upgrades remain enabled on your VM.

Trademark

phpMyFAQ is a trademark of its respective owner. SecureAnyCloud is not affiliated with, endorsed by or sponsored by the phpMyFAQ project. This image packages the open-source phpMyFAQ software, which is distributed under the Mozilla Public License 2.0. All product and company names are the property of their respective holders.

Support

SecureAnyCloud provides 24/7 technical support for this image by email (sales@secureanycloud.com) and live chat. Support covers deployment, configuration, upgrades, performance tuning and MariaDB administration. Critical issues receive a one-hour average response time.

Deploy on Azure

Launch phpMyFAQ 4 Knowledge Base on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure