4.1.15 Installing Subrion CMS on hosting and server

Subrion CMS The Host Banner

Subrion CMS is a free CMS and PHP/MySQL framework for websites of any type: from blogs and directories to complex portals with paid subscriptions and an advanced system of permissions and packages. The project is distributed under the GPLv3 license and supports plugins, templates, and a flexible user access model.

This guide uses the classic installation from the Subrion archive, configuration of the Nginx + PHP-FPM + MySQL/MariaDB stack on Ubuntu 24.04 LTS, and subsequent launch of the web installer.

Preparation

Requirements

  • An active Hosting, Virtual or Dedicated server plan
  • CPU: 2–4 vCPU; RAM: from 4 GB; SSD: from 20 GB
  • OS: Ubuntu 22.04 LTS or 24.04 LTS
  • Web server: Nginx 1.20+ or Apache 2.4+

Environment variables

  • DOMAIN_NAME — your domain name
  • SERVER_IP — the public IP address of the server
  • DB_NAME, DB_USER, DB_PASSWORD — database parameters for Subrion
  • SUBRION_PATH — path to the project directory, for example /var/www/subrion
  • PHP_FPM_SOCKET — path to the PHP-FPM socket, for example /run/php/php8.2-fpm.sock

Installing Subrion CMS on hosting

  1. Download the stable version of Subrion CMS from the official Subrion CMS website.
  2. Upload the archive to the hosting account via the file manager or over FTP.
  3. Create a user and a database. Save DB_HOST, DB_NAME, DB_USER, DB_PASSWORD.
  4. Run the installer in a browser. Open http://DOMAIN_NAME and follow the installation wizard:
  • Check that the technical requirements are met;

Pre-Installation_Check

  • Accept the license agreement;

Subrion_License

  • Fill in the parameters of the previously created database (DB_HOST, DB_NAME, DB_USER, DB_PASSWORD) and administrator;

Configuration

  • If necessary, download the configuration file;

Script_Installation

Installing Subrion CMS on a server

Updating packages and basic utilities
sudo apt update && sudo apt -y upgrade
sudo apt -y install curl gnupg2 software-properties-common unzip ca-certificates

This updates system packages and installs utilities required for downloading archives and working with repositories.

Install PHP-FPM and required extensions

Installing PHP 8.2 with extensions
sudo apt -y install php8.2 php8.2-fpm php8.2-cli \
  php8.2-mbstring php8.2-xml php8.2-gd php8.2-zip \
  php8.2-curl php8.2-mysql php8.2-intl php8.2-opcache
php -v

Subrion runs on a modern PHP version; this set of modules covers the requirements for working with the database, images, archives, and locales. The php -v command confirms the installed PHP version.

Install Nginx

Installing and starting Nginx
sudo apt -y install nginx
sudo systemctl enable --now nginx

Nginx will handle HTTP requests and pass PHP scripts to PHP-FPM.

Install and prepare the DBMS (MySQL/MariaDB)

Installing MySQL server
sudo apt -y install mysql-server
mysql --version

Create a database and user for Subrion:

Creating the Subrion database
sudo mysql <<SQL
CREATE DATABASE DB_NAME CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'DB_USER'@'localhost' IDENTIFIED BY 'DB_PASSWORD';
GRANT ALL PRIVILEGES ON DB_NAME.* TO 'DB_USER'@'localhost';
FLUSH PRIVILEGES;
SQL

The utf8mb4 encoding is used for full Unicode support and emojis in site content.

Download and deploy Subrion

Subrion is distributed as a zip archive; installation is performed from the official project archive. Download the stable version of Subrion CMS from the official Subrion CMS website.

Downloading Subrion from the official archive
sudo mkdir -p SUBRION_PATH
cd SUBRION_PATH

wget https://tools.subrion.org/get/latest.zip
unzip latest.zip
rm latest.zip

The latest.zip archive contains the current 4.2.x branch release; after extraction, the application files are ready for launching the installer.

Permissions and project owner

Permissions for Subrion files
sudo chown -R www-data:www-data SUBRION_PATH
sudo find SUBRION_PATH -type d -exec chmod 755 {} \;
sudo find SUBRION_PATH -type f -exec chmod 644 {} \;

The www-data owner (web server and PHP-FPM user) ensures correct writing of temporary files, cache, and uploaded files.

Nginx configuration for Subrion

Below is an example of an Nginx virtual host adapted for Subrion and a PHP-FPM socket. The configuration is based on a working example for Subrion on Nginx with correct handling of SEO URLs and the installer.

/etc/nginx/sites-available/subrion.conf
server {
  listen 80;
  server_name DOMAIN_NAME;

  root SUBRION_PATH;
  index index.php;

  location = /favicon.ico {
    log_not_found off;
    access_log off;
  }

  location = /robots.txt {
    allow all;
    log_not_found off;
    access_log off;
  }

  location / {
    try_files $uri $uri/ /index.php?q=$uri&$args;
  }

  error_page 404 /404.html;
  location = /404.html {
    root /usr/share/nginx/html;
  }

  error_page 500 502 503 504 /50x.html;
  location = /50x.html {
    root /usr/share/nginx/html;
  }

  location ~ \.php$ {
    include fastcgi_params;
    fastcgi_pass unix:PHP_FPM_SOCKET;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
  }

  location /install/ {
    rewrite ^/install/(.*)$ /install/index.php?_p=$1;
  }

  location ~ /\.ht {
    deny all;
  }

  location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
    expires max;
    log_not_found off;
  }
}

Activate the site and reload Nginx:

Activating the Subrion site
sudo ln -s /etc/nginx/sites-available/subrion.conf /etc/nginx/sites-enabled/subrion.conf
sudo nginx -t
sudo systemctl reload nginx

The try_files directive forwards requests to index.php with the q parameter, as expected by Subrion, and the separate location /install/ block ensures correct operation of the web installer.

Attention! After completing the installation, be sure to delete the /install/ directory, change the default URL of the admin panel, restrict access to the admin area by IP or HTTP authentication, and regularly update the core and plugins. For version 4.2.1, vulnerabilities related to file uploads (for example, CVE-2018-19422) were previously published, so do not use test demo login/password values and disable unused packages.

Configuring additional Subrion features

SSL certificate (HTTPS)

For operation over the secure HTTPS protocol, use Let’s Encrypt or a commercial SSL certificate.

PHP caching and performance

Enable and configure opcache to speed up Subrion:

/etc/php/8.2/fpm/php.ini
opcache.enable=1
opcache.enable_cli=1
opcache.memory_consumption=256
opcache.max_accelerated_files=20000
opcache.interned_strings_buffer=16
opcache.validate_timestamps=1
opcache.revalidate_freq=60

Restart PHP-FPM:

Restarting PHP-FPM
sudo systemctl restart php8.2-fpm

Image and media processing

Subrion actively uses images in templates and content; the GD library is sufficient for processing them, but Imagick can be additionally enabled if needed.

Installing GD and Imagick
sudo apt -y install php8.2-gd imagemagick php8.2-imagick
sudo systemctl restart php8.2-fpm

Recommendation. For typical sites, php8.2-gd is sufficient. Enable php8.2-imagick if you need to work with large images, TIFF/WEBP, or advanced effects. You can check the presence of modules with the command php -m | grep -E 'gd|imagick'.

Verifying operation

  • Go to http://DOMAIN_NAME/ and make sure the Subrion start page opens without PHP errors.

  • Log in to the admin panel (http://DOMAIN_NAME/panel/ or the renamed URL) and verify:

    • the dashboard operation,
    • creation and publication of a test page,
    • file uploads in the content section.
Common issues
Error / Symptom Cause Solution
502 Bad Gateway when opening the site Incorrect PHP_FPM_SOCKET in the Nginx configuration or PHP-FPM is not running Verify the socket path (/run/php/php8.2-fpm.sock), restart php8.2-fpm and nginx
The installer loops on /install/ or redirects to /install/install/ Incorrect location / block or missing location /install/ rule in Nginx Apply the configuration from the example (try_files $uri $uri/ /index.php?q=$uri&$args; line and the location /install/ block), then reload Nginx
Access denied for user 'DB_USER'@'localhost' during installation Incorrect DB_USER/DB_PASSWORD or missing privileges on DB_NAME Recreate the user with the required password and grant GRANT ALL PRIVILEGES ON DB_NAME.*
Blank page or HTTP 500 after installation Fatal PHP error (incompatible extension, outdated module, or plugin error) Enable error display for diagnostics, temporarily disable third-party plugins, update PHP modules
Unable to upload files or avatars Incorrect permissions on uploads/, tmp/ directories or open_basedir restrictions Set www-data as the owner and 755 permissions on the directories, check PHP settings in the control panel
Security scanners report a vulnerability in Subrion 4.2.1 An outdated, unsupported release with known vulnerabilities is being used (including arbitrary file upload) Restrict access to the admin panel, disable unsafe plugins, apply patches from the developers, or consider migrating to another up-to-date engine if updating Subrion is not possible