CloudForge CMS Guides
Guides for deploying PHP CMS, e-commerce, forum, and LMS applications with CloudForge using the cms-service topology.
What cms-service Provides
In addition to the resources every CloudForge service gets (VPC, ALB, EFS, ECS service or Auto Scaling group, CloudWatch logs), the cms-service topology reads the CMS plugin's declared capabilities (CmsSpec) and conditionally provisions:
| Infrastructure | Condition | Details |
|---|---|---|
| S3 media bucket | CmsSpec.supportsS3MediaStorage() | Private, versioned, public access blocked; SSE-S3 (SSE-KMS for production). Bucket name is generated by CloudFormation. |
| ElastiCache Redis | CmsSpec.supportsObjectCache() and preferredCacheBackend() is redis | Single-node Redis 7.0 cluster on port 6379, reachable from the VPC CIDR. Node type: cache.t4g.micro (dev), cache.t4g.medium (staging), cache.r6g.large (production). |
| CloudFront CDN | CmsSpec.supportsCdnIntegration() and an S3 media bucket | ALB origin for dynamic pages, S3 origin for media paths. |
| Route53 DNS | A hosted zone and a domain/subdomain are configured | A + AAAA alias records. |
| ECS auto-scaling | minInstanceCapacity > 0, maxInstanceCapacity > 1, and enableAutoScaling not false | CPU target tracking (cpuTargetUtilization, default 60). |
The topology accepts runtime: fargate or runtime: ec2 only.
Current limitations (see each guide for details):
- The Redis endpoint and S3 bucket name are not injected into the container environment. Look them up in the CloudFormation console or with the AWS CLI and configure the CMS cache/media plugin yourself.
- The task role is not granted access to the media bucket. Add an IAM policy (or use plugin-level credentials) before enabling S3 offloading.
- Database connection variables are set on Fargate only when
provisionDatabaseistrue. On EC2, the UserData installs the web stack but does not write database settings.
Available CMS Applications
All IDs below are registered in cloudforge-api and accepted by the cms-service topology.
Content Management
| Application | ID | PHP | Guide |
|---|---|---|---|
| WordPress | wordpress | 8.2 | WordPress Guide |
| Drupal | drupal | 8.2 | Drupal Guide |
| Joomla | joomla | 8.2 | — |
| TYPO3 | typo3 | 8.2 | — |
| Concrete CMS | concrete-cms | 8.2 | — |
| October CMS | october-cms | 8.2 | — |
E-Commerce
| Application | ID | PHP | Guide |
|---|---|---|---|
| WooCommerce | woocommerce | 8.2 | WooCommerce Guide |
| Magento | magento | 8.2 | Magento Guide |
| PrestaShop | prestashop | 8.1 | PrestaShop Guide |
| OpenCart | opencart | 8.1 | — |
| Sylius | sylius | 8.3 | — |
| Bagisto | bagisto | 8.2 | — |
Forums and Community
| Application | ID | PHP | Guide |
|---|---|---|---|
| phpBB | phpbb | 8.2 | — |
| Flarum | flarum | 8.2 | — |
| MyBB | mybb | 8.2 | — |
| Dolphin/UNA | dolphin-una | 8.2 | — |
Business and Education
| Application | ID | PHP | Guide |
|---|---|---|---|
| SuiteCRM | suitecrm | 8.2 | — |
| MediaWiki | mediawiki | 8.2 | — |
| Moodle | moodle | 8.2 | Moodle Guide |
Minimal Deployment Example
All CMS apps follow the same pattern; only applicationId changes:
{
"stackName": "WordPress-Dev",
"runtime": "fargate",
"securityProfile": "dev",
"topology": "cms-service",
"applicationId": "wordpress",
"domain": "example.com",
"subdomain": "blog",
"enableSsl": true,
"authMode": "alb-oidc",
"cognitoAutoProvision": true,
"cognitoDomainPrefix": "myapp-auth",
"provisionDatabase": true
}
Switch to a different CMS by changing "applicationId" to "drupal", "magento", and so on. See the configuration reference for every deployment-context property.
Authentication
| Mode | Description |
|---|---|
alb-oidc | Cognito authentication at the ALB. Requires enableSsl: true. |
application-oidc | The CMS handles OIDC itself through its own plugin or module (see each app's OIDC integration). |
none | No authentication in front of the application. |
With alb-oidc, the ALB protects only the application's admin paths by default (for CMS applications, CmsSpec.protectedPaths() returns the same list as cdnAdminPaths()). Public pages remain reachable without signing in. For example:
| Application | Paths protected by default |
|---|---|
| WordPress, WooCommerce | /wp-admin/*, /wp-login.php |
| Drupal | /admin/*, /user/*, /update.php |
| Magento | /admin/*, /backend/*, /setup/* |
| PrestaShop | /admin*, /admin-dev/*, /install/* |
| Moodle | /admin/*, /login/* |
An application whose protected-path list is empty is protected on every path.
Database
All CMS applications require a relational database. When the deployment is prepared by the Interactive Deployer or CloudForgeDeployment, provisionDatabase is set to true automatically for these applications. Every built-in CMS specification declares MySQL 8.0 as its default engine.
| CMS | Supported engines (per plugin metadata) |
|---|---|
| WordPress, WooCommerce | MySQL, MariaDB |
| Drupal | MySQL, MariaDB, PostgreSQL (the Fargate auto-install uses MySQL) |
| Magento | MySQL, MariaDB |
| Moodle | MySQL, MariaDB, PostgreSQL |
| PrestaShop | MySQL, MariaDB |
{
"provisionDatabase": true,
"databaseEngine": "mysql",
"databaseVersion": "8.0",
"databaseInstanceClass": "db.t3.medium",
"databaseAllocatedStorageGB": 50
}