Self-Hosted Community Forum

Social & Community

A community discussion forum that arrives installed: member registration, posting and discussion, categories and tags, likes, and an admin panel. You bring it up on your own machine with Docker Compose, the forum installs itself on the first start, and the admin password is generated at random by a script. Derived from a frozen snapshot of open-source forum software under the MIT licence; the delivery adds a Dockerfile that builds the image from source, a single-service orchestration file (the database is SQLite), a password generation script and a quick-start guide in Traditional Chinese.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed4 / 5

Who it is for

Hosts who want a discussion space of their own for a community, a course or the users of a product.

How to start

$ sh scripts/quickstart/init-env.sh
$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview38 paths

▸docker2

apache-flarum.conf
entrypoint.sh

▸public5

.htaccess
assets/
index.php
web.config

▸scripts1

quickstart/

▸storage8

cache/
formatter/
less/
locale/
logs/
sessions/
tmp/
views/

▫ATTRIBUTION.md

▫CHANGELOG.md

▫Dockerfile

▫LICENSE

▫LICENSE-99LL.md

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫composer.json

▫composer.lock

▫delivery-manifest.txt

▫docker-compose.yml

▫extend.php

▫flarum

▫site.php

▫Config and hidden files 6

Latest passing run

Clone → Checkout → Toolchain → Build images → Forum install and login

Pre-purchase Disclosure

What you are buying

A self-hosted community forum system: member registration, posting and discussion, categories and tags, likes, and an admin panel. After running the password generation script you bring it up with Docker Compose, and the forum installs itself on the first start.

Derived from open-source forum software under the MIT licence, and not the original project itself. Our work: a Dockerfile that builds the image from source, a single-service orchestration file (the database is SQLite), a script that generates the admin password, and a quick-start guide in Traditional Chinese.

Delivery is a frozen snapshot: one zip, taken from the product repository at revision 74bfbc2.

Known limitations

The service serves plain HTTP on port 8080 of the local machine; TLS and a reverse proxy are yours to bring
The forum interface is in English, and only the English language pack is enabled in the delivery
Registration confirmation mail and password reset mail are only written to a log file by default and are not sent
To send mail to members, switch to SMTP in the admin panel and fill in your own mail service
No resident process for live updates is started
The forum address is written at the first install; changing the address or port afterwards means clearing the data and starting over
The admin password is applied only at the first install, and the value in .env is not synchronised afterwards
The data lives in SQLite and Docker named volumes, and docker compose down -v deletes all discussions, members and settings
The first start builds the image from source, fetching from registries, apt and Composer during that time
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit 62ff2a7. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

5 PASS0 WARN0 FAIL

Source ReviewPASS

Execution surface of the delivery reviewed item by item. Our own additions were read line by line: docker-compose.yml (the published port is bound to 127.0.0.1 on 8080 only; it refuses to start without the admin password; SQLite and two named volumes), docker/entrypoint.sh (installs non-interactively on the first start, and mail goes only to a log file by default), scripts/quickstart/init-env.sh (openssl generates a random password, .env is mode 600, existing values are not overwritten) and the Dockerfile (base images pinned by digest, installing from composer.lock). The PHP source of the forum core and the extensions is fetched by Composer at build time and was not read file by file; the basis is the MIT licence and container isolation.

Script SafetyPASS

The scripts on the buyer’s delivery path were each inspected: init-env.sh and docker/entrypoint.sh are ours (read line by line; the temporary settings file used for the install is mode 600 and deleted after use); the build goes through the Dockerfile (read line by line: apt installs and Composer installing from the lock file, with no download piped straight into a shell).

RecencyPASS

This product is a frozen snapshot and does not follow upstream: the upstream source is pinned to the main-line revision taken on the day the product repository was created (see the evidence link), and the product repository is that snapshot plus our own commits.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream LICENSE was checked word for word (the evidence link points at the file itself at the pinned version and matches the copy inside the product repository): the standard MIT text, copyright holder Stichting Flarum (Flarum Foundation). It allows commercial use, modification, derivative works, redistribution and sale; the duty is to keep the copyright notice and licence text (LICENSE and ATTRIBUTION.md ship in the zip); upstream has no NOTICE file. The decision does not rest on GitHub’s licence field. For the product as a whole the 99LL product licence template is attached: upstream’s LICENSE is kept as it is and LICENSE-99LL.md is added as the sale and liability terms for the part we built, with spdx recorded as LicenseRef-99LL-Product.

Dependency LicensesPASS

This records the declared side, not a scan result: the PHP dependencies are declared in composer.json and locked by composer.lock, and the packages themselves are fetched from the Composer package repository when the buyer builds; the base images and system packages come from a registry and apt. These dependency trees were not scanned package by package for licences. Upstream has no submodule and no third-party dataset was copied in (see ATTRIBUTION.md).