dillard
9645ce94e2
Fase 1 hardening (2026-07-08) moved saved QR code storage from src/saved_qrcode/ to /var/www/qrcode-storage/ (outside the webroot, SAVED_QRCODE_DIRECTORY in config.php), but docker-compose.yml's volume mount was never updated and still pointed at the old path (/var/www/html/saved_qrcode). The named volume was therefore mounted somewhere the app never wrote to - every actual qr code image the app generates at /var/www/qrcode-storage/ lived only in the container's ephemeral filesystem and was silently lost on every container recreation, while the qrcode_storage volume itself stayed permanently empty. DB rows (filenames/content) were never affected, only the generated image files. Confirmed as the cause of qr.ensembia.com's "old and new QR codes not showing in the list" report: qrcode_image.php's is_file() check failed because the file genuinely wasn't there anymore. docker-compose.prod.yml already had the correct path - only the dev compose file (what qr.ensembia.com actually runs) had this bug.
Self-hosted, open-source QR code generator.
QRForge creates and manages static and dynamic QR codes from a clean, responsive control panel. It's a security-hardened, actively maintained fork of the original PHP Dynamic Qr code project by Giandonato Inverso, built on AdminLTE.
- Try it free: qr.ensembia.com - fully functional OSS test
instance. Self-service signup isn't live yet, so log in with the temporary shared demo
account
admin/adminin the meantime. - Commercial VIP edition (self-service create-rights, logo-embedded QR codes): www.qrforge.eu.
- Self-host it yourself: this repository, MIT-licensed.
Features
- Dynamic QR codes with a database-backed URL shortener
- Create, edit, delete, enable/disable the redirect
- Download any time, bulk download/delete
- Batch-generate from a CSV file
- 16 static QR code types: Text, Email, Phone, SMS, WhatsApp, Skype, Location, vCard, Event/calendar, Bookmark, WiFi (incl. WPA3), PayPal, Bitcoin, 2FA, App Link (Android intent / universal links), Bluetooth
- QR code styling: 6 export formats, foreground/background color, 4 precision levels, 10 sizes, optional label text below the code (custom font + size), optional icon shown above the code, save/load your own style presets
- Address search (OpenStreetMap Nominatim) for Location QR codes
- Built-in QR scanner (camera or image upload, decodes entirely client-side)
- Installable as a PWA
- Role-based access:
super(full access + user management),admin(scoped to their own codes and sub-users),user(read-only, with optional per-account create rights and view toggles set by an admin) - Dashboard with QR/scan statistics and a 7-day activity chart
- CSRF protection, login rate limiting, session hardening, audit log
- Docker Compose setup, both a dev image and a production Nginx + PHP-FPM image
What is included
- PHP 8.4 application source
- Database schema + migrations
- Docker Compose files (dev and production)
- CSS/JS assets
Setup with Docker Compose
- Clone this repository.
- Copy
.env.exampleto.envand set a realDATABASE_PASSWORD/MYSQL_ROOT_PASSWORD. - Start the stack:
docker compose up -d --build - Open
http://localhostand log in withsuperadmin/superadmin. You'll be required to set a new password on first login.
For a production deployment behind a reverse proxy, use
docker-compose.prod.yml (Nginx + PHP-FPM) instead of the dev stack.
Credits
- Originally forked from PHP Dynamic Qr code by Giandonato Inverso.
- QR code rendering powered by chillerlan/php-qrcode.
- Admin panel UI built on AdminLTE.
License
MIT - see LICENSE.