After seeing a few of /public related posts I'm wondering if people get why we're doing this in the first place (no offense, we might genuinely need a better explanation in the docs)
Multiple people seem to have installed Flarum "the old way" and actually kept /public in the url, which completely defeats the purpose.
The thing to remember is that you don't want storage, vendor, flarum, config.php, composer.json and composer.lock be served publicly. ever. That's because they are sensitive files. config.php and storage because they contain sensitive data, vendor and flarum because they can expose untrusted code that anyone will be able to run and composer.* because they contain advanced information on your setup.
Now there are two choices. Either you don't place these folders under the webroot (where everything will be served by the web server), or you place them there but you make extra sure to tell the web server to never return them.
Which itself leads to 3 placement options in my opinion:
Dedicated folder, own webroot (recommended)
That's kind of the new standard, in particular for modern web applications like Laravel. You install Flarum in a folder wherever you want, but not under the webroot.
For example place Flarum in /home/ubuntu/flarum.
Then in the web server config, add a virtualhost (for own hostname) or alias (for subfolder), pointing the webroot to /home/ubuntu/flarum/public.
This means all files in /home/ubuntu/flarum but out of /public will never be served by the web server, keeping you safe.
