If you are planning to create an online store, you will find plenty of free, open source (FOSS) platforms you can use to host your e-commerce site. In a previous Linux Magazine article [1], I reviewed OpenCart, the shopping cart service that currently powers my online store. While OpenCart works well enough, I find it a bit lacking after running it for a couple of years.

Often, FOSS e-commerce solutions are distributed on a disguised freemium model. While the core of these solutions are free and open source, they have just enough features to get by. If you need additional features, you must purchase downloadable modules and extensions, which are often pricey and developed by third parties. OpenCart in particular needs a lot of modules and add-ons to turn it into a useful web store. After installing all these extra plugins, you soon realize that you have either spent a bunch of money buying the extensions, or a bunch of time developing them yourself.

In addition to the issue of extra plugins, the person in charge of OpenCart has been involved in some controversies regarding security advisories [2, 3] and version upgrades [4]. I once had OpenCart break during a minor upgrade, which did not inspire confidence.

With all of this in mind, I couldn't help but wonder if there might be a better alternative. In my search, I discovered thirty bees [5], an e-commerce web application released under the Open Software License v3.0 (OSL-3.0). Designed for end users, thirty bees doesn't require you to be an expert to deploy it. A fork of PrestaShop, thirty bees was developed out of concerns about the direction PrestaShop was taking with version 1.7 and onward. Among other things, thirty bees aims to be a stable version of PrestaShop with a focus on fixing bugs rather than adding new features.

Getting Started

Because thirty bees is intended to run on a Linux, Apache, MySQL, PHP (LAMP) stack, the official installation guide assumes that you are using a commercial web-hosting service that provides the LAMP stack. Because the documentation does not offer a guide for installing thirty bees on a fresh server of your own, I will provide up-to-date, detailed instructions if you want to try thirty bees on your own machine.

Installing an Environment

Because I run my production environments on OpenBSD, I will use it as the base here. However, the following steps should be easily adaptable to any popular Linux distribution, such as Rocky Linux or Devuan.

In order to get started, you need to install a number of components on your system of choice. You need a web server, a database, and PHP. The database will store thirty bees's data, PHP will execute the web application, and the web server will accept requests from the visitor's web browsers.

From a fresh OpenBSD 7.5 install, you can fetch all the required components using the following command as root:

# pkg_add php-8.2.16 php-gd-8.2.16 php-zip-8.2.16 php-pdo_mysql-8.2.16 php-intl-8.2.16 php-imap-8.2.16 php-curl-8.2.16 php-soap-8.2.16 mariadb-server-10.9.8p0v1 apache-httpd-2.4.58p1 php-apache-8.2.16 unzip

Next, you need to configure the components that have been installed. I always recommend editing /etc/hosts first to ensure the operating system knows its own name (see Listing 1 for an example).

127.0.0.1       localhost
::1             localhost
192.168.90.175  thirtybees  thirtybees.operationalsecurity.es

While thirty bees supports the MySQL database, OpenBSD uses MariaDB, which is a compatible replacement (at least for this example). To deploy the database engine on OpenBSD, issue the following command as the superuser:

# mariadb-install-db

PHP has set tight limits by default, so it needs some minor tweaks to work with thirty bees. First of all, you must edit /etc/php-8.2.ini and modify the values in Listing 2. This will allow visitors' browsers to issue larger HTTP POST messages, let thirty bees access external resources, and permit the administrator to upload files to the shop. Once this is done, you can enable the PHP extensions required by thirty bees with the script in Listing 3.

max_input_vars = 10000
post_max_size = 32M
upload_max_filesize = 16M
allow_url_fopen = On

for file in `find /etc/php-8.2.sample/ -type f`; do
  ln -s $file /etc/php-8.2/`basename $file`;
done

To configure the Apache web server, edit the file /etc/apache2/httpd2.conf. You need to find the AllowOverride line within the definition for the directory you intend to use as the document root for your service and edit it as shown in Listing 4. This allows thirty bees to set its own redirection rules, which are handy for creating URLs that are compatible with search engine optimization (SEO). You also need to set the DirectoryIndex file to index.php (as shown in Listing 4).

DocumentRoot "/var/www/htdocs"
<Directory "/var/www/htdocs">
  #
  # Possible values for the Options directive are "None", "All",
  # or any combination of:
  #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
  #
  # Note that "MultiViews" must be named *explicitly* --- "Options All"
  # doesn't give it to you.
  #
  # The Options directive is both complicated and important.  Please see
  # http://httpd.apache.org/docs/2.4/mod/core.html#options
  # for more information.
  #
  Options Indexes FollowSymLinks
  #
  # AllowOverride controls what directives may be placed in .htaccess files.
  # It can be "All", "None", or any combination of the keywords:
  #   AllowOverride FileInfo AuthConfig Limit
  #
  AllowOverride All
  #
  # Controls who can get stuff from this server.
  #
  Require all granted
</Directory>
#
# DirectoryIndex: sets the file that Apache will serve if a directory
# is requested.
#
<IfModule dir_module>
  DirectoryIndex index.php
</IfModule>

If you intend to use SEO-friendly URLs, then you must enable the mod_rewrite module in Apache by uncommenting the corresponding LoadModule line in /etc/apache2/httpd2.conf as well.

Please note that this configures Apache to not use Transport Layer Security (TLS) encryption, which a web store definitively needs. The reason I do this is because I place my web services behind a load balancer that takes care of encryption (a topic for another article).

It is important to enable PHP support for Apache, which can be done easily with

# ln -sf /var/www/conf/modules.sample/php-8.2.conf /var/www/conf/modules/php.conf

The final step for getting the execution environment ready is to enable it and launch it. OpenBSD does not use systemd. Instead, services are managed with the rcctl command:

# rcctl enable mysqld apache2
# rcctl start mysqld apache2

It is recommended to harden the MariaDB install before going into production (Figure 1). If the previous instructions have been followed, a hardening script will be already installed on the system. You can just call it as root and let it perform its magic:

# mariadb-secure-installation

Figure 1: Before going into production, you should use mariadb-secure-installation to harden your database's security.

The hardening script will ask you some questions. Feel free to respond to them with answers that make sense to you.

Installation

With the LAMP stack set, you are ready to install thirty bees. Download thirty bees into the web server folder and decompress it. I like to use /var/www/htdocs/, the default web folder for OpenBSD installs. The folder will have some demo content inside, which you will have to remove:

# rm -rf /var/www/htdocs/*

Downloading and decompressing thirty bees is trivial. Make sure the downloaded code is owned by the www user, or the web server won't be able to work properly with it:

# cd /tmp
# ftp https://thirtybees.com/versions/thirtybees-v1.5.1-php8.2.zip
# unzip thirtybees-v1.5.1-php8.2.zip -d /var/www/htdocs
# chown -R www:www /var/www/htdocs

At this point, thirty bees is nearly installed, but you still need to create a database for it within your MariaDB install. Just invoke mysql and issue the SQL statements shown in Listing 5. Once the database is set, open a web browser and visit your web server. The install script will trigger automatically.

CREATE DATABASE thirtybees;
GRANT ALL PRIVILEGES ON thirtybees.* TO 'thirtybees'@'localhost' IDENTIFIED BY 'somepassword';
FLUSH PRIVILEGES;
QUIT;

The installer is intuitive and self explanatory (Figure 2). The only complex step is configuring the database connection (Figure 3). If you are following along with this example, the database login will be thirtybees and the password will be the one you defined in Listing 5. Once finished, the installer will instruct you to delete the install directory from your web server and give you a link to the admin dashboard. Please, bookmark the dashboard link for later, because it is randomly generated and you won't be able to easily log in as administrator if you lose it. The install directory can be deleted with a simple command:

Figure 2: As long as the web server is properly configured, the thirty bees web installer is very easy to use. The web installer will report any important misconfigurations that are detected before the install is attempted.

# rm -r /var/www/htdocs/install

Figure 3: The installer will ask some questions regarding the database connection. I recommend using 127.0.0.1 instead of localhost as the database host in this example.