README

Maintainable, plugin-first open-source forum framework.

Core is the host (identity, forum primitives, permissions, extension runtime, contracts). Deployment-specific behavior—mail transport, optional search engines, storage vendors, and similar—lives in extensions.

Screenshots

Forum home

Topic feed, category navigation, and live site statistics.

Topic and discussion

Article body, tags, and threaded replies, with theme-injected extensions in the right rail.

Composer

Rich-text toolbar, draft controls, pre-publish checks, and publishing settings on one screen.

Sign in and sign up

Account entry with password strength checks, locale, and appearance controls.

Account security

Admin · Extension overview

Plugin and theme status, host capability declarations, and ZIP upload from the control panel.

Documentation

Language	Start here
简体中文	`docs/zh-CN/README.md`
English	`docs/en-US/README.md`
Hub	`docs/README.md`

Quick paths:

快速开始 / Getting started
使用说明 / Usage
开发指南 / Development
生产部署 / Deployment
Extension technical reference: docs/extensions/

Repository map

Path	Role
`apps/web`	Nuxt 4 frontend
`apps/api`	Go Fiber API with embedded River worker, CLI
`contracts/`	OpenAPI + Protobuf
`extensions/`	Built-in / optional / dev packages
`docs/`	Bilingual handbooks + extension reference
`knowledge/`	Decisions, module notes, session handoffs
`scripts/`	Dev and test helpers
`deploy.sh`, `upgrade.sh`, `sforum-latest.sh` + `compose*.yaml`	Production orchestration, updates, and the verified-latest entry

Local development

./scripts/dev.sh                 # PostgreSQL, Redis, Mailpit + migrations
./scripts/api-dev.sh             # API (embeds worker in dev)
cd apps/web && bun run dev       # Nuxt on :3000

Background jobs: the API process always embeds the River worker in development and production. Worker ownership is not configurable, so saved settings, SecretStore access, extension runtimes, and queue consumers share one process.

Useful URLs:

Web: http://127.0.0.1:3000
API health: http://127.0.0.1:3000/api/v1/health
API ready: http://127.0.0.1:3000/api/v1/ready
Mailpit: http://127.0.0.1:18025

Meilisearch is optional (docker compose --profile search up -d meilisearch). Default search is built-in site PostgreSQL FTS.

Full steps: docs/zh-CN/getting-started.md or docs/en-US/getting-started.md.

Production

One line installs the latest stable Release. It asks for the install directory first — the default is ./sforum, shown as an absolute path — and prints that path again once the install succeeds:

curl -fsSL https://github.com/keeptrue/SForum/releases/latest/download/sforum-install.sh | bash

SFORUM_INSTALL_DIR or -d DIR sets the target without asking, SFORUM_NONINTERACTIVE=1 never prompts, --version <TAG> pins an immutable tag, and --yes skips prompts. The loader resolves the tag, verifies that tag's sforum-bootstrap.sh against SHA256SUMS (plus GitHub build provenance when gh is available), promotes it, and hands off. The bootstrap then refreshes the complete matching deploy toolkit before the install wizard starts.

Running the same line inside an existing installation updates it instead. To update without trusting the bootstrap already on disk:

curl -fsSL https://github.com/keeptrue/SForum/releases/latest/download/sforum-install.sh | bash -s -- upgrade

Only the loader may run from a pipe; it contains no install logic. The auditable equivalent — download the bootstrap and its SHA256SUMS, select exactly one filename entry, verify, then execute — stays documented in docs/en-US/deployment/one-click.md (中文).

A local ./sforum-bootstrap.sh upgrade behaves the same way: every run refreshes the bootstrap and the target Release's complete deploy toolkit before handing off to upgrade.sh. The default resolves to the newest stable Release and is confirmed before any change (--yes skips prompts). Prereleases are never selected implicitly: pass --channel prerelease or an explicit tag. Every choice resolves to an immutable vX.Y.Z tag — floating latest images are never used in production Compose.

For toolkit repair — re-syncing every managed file from a Release instead of only the bootstrap — use the repository-side sforum-latest.sh wrapper documented in docs/en-US/deployment/one-click.md. It resolves the newest Release, downloads and verifies its complete sforum-deploy.tar.gz, syncs every managed toolkit file (deploy.sh, upgrade.sh, Compose files, deploy/scripts, Caddy examples, VERSION) to that version, backs up the previous files under .sforum/tooling-backups/, and only then delegates to install or upgrade. --check lists exactly which files are missing or stale without writing anything.

Production uses one API process with an embedded River worker, sharing the database pool, SecretStore-backed settings, and extension runtime. Existing standalone Worker containers from older releases are removed during an update; legacy environment settings cannot disable the API-owned worker.

The first blue/green ingress conversion has a short maintenance window. Later releases keep API/Web HTTP traffic available when the database is unchanged or every pending Core migration explicitly declares backward-compatible online execution; WebSockets may reconnect while durable River jobs remain protected by the queue during the API slot handoff. Undeclared Core and all River migrations use the blue/green-aware deploy.sh maintenance path.

Full guides:

Community

Report vulnerabilities privately according to SECURITY.md.
SForum is available under the MIT License.

Contributing / agents

Read AGENTS.md
Read docs/ for usage and development
Read knowledge/index.md for current project memory
Keep OpenAPI, tests, and knowledge notes updated with code changes

zhuchunshu / sforum

Package info

Security

Fund package maintenance!

Statistics