From #1453 (comment) by @robocoder, I learned that you should be able to overwrite PIWIK_USER_PATH via bootstrap.php to move the writable piwik folders, config and tmp, to a read-write directory, and keep the rest read-only.

I found out that I need to copy the config folder to PIWIK_USER_PATH, and tmp is created automatically.

Problem is: Afterwards, there are errors about missing plugin folders and unfound stylesheet files. I investigated the code and found suspicious uses of PIWIK_USER_PATH in core/AssetManager/UIAssetFetcher.php and core/AssetManager/UIAssetMerger/StylesheetUIAssetMerger.php which look like they should be PIWIK_INCLUDE_PATH. I tried to patch them to PIWIK_INCLUDE_PATH, I can load the page then, but it renders without stylesheets. 😢 In that state, I could not find any error messages, so I don't really know what's not working.

https://piwik.org/docs/include-piwik-in-your-project/#bootstrap-php-execute-custom-code-before-piwik-runs notes that using PIWIK_USER_PATH and PIWIK_INCLUDE_PATH “facilitates a ‘best practice’ of preventing direct access to PHP files.” – I could not find concrete examples on how and what exactly to do to achieve this, e.g. whether I also should copy plugins or so.

Related: #10854

Steps to reproduce:

1. download piwik in a new directory from your webserver, e.g. /var/www/piwik
2. add bootstrap.php with e.g.:

<?php
define('PIWIK_USER_PATH', '/var/lib/piwik');
?>

3. create /var/lib/piwik and make it writable from the webserver
4. copy /var/www/piwik/config into /var/lib/piwik
5. access piwik

Result:

Piwik encoutered an error: An exception has been thrown during the rendering of a template ("The ui asset with 'href' = /var/lib/piwik/plugins/Morpheus/stylesheets/base/bootstrap.css is not readable").

I don't know how to get a working PIWIK_USER_PATH, seems like there is more to it that the presumably wrong use of PIWIK_USER_PATH in AssetManager classes which I do not understand.

(Not important for the problem, but for people who find this through search: I'm trying to do this to create a Nix package and NixOS module, where I have to separate statefull and stateless files)