At the weekend I had to move a NodeBB forum. It's actually quite simple, as only the database and the NodeBB directory need to be copied. Actually.

The problem is that the cookieDomain is stored in the database and cannot be changed beforehand. The result is a failed login, which is always acknowledged with an invalid csrf token. Great.
The solution is to remove this parameter from the database. As I use Redis as my database, here is an example of how to do this:

redis-cli # Starts the Redis CLI programme
auth PASSWORD # The password from NodeBB/config.json for accessing the database
hdel config cookieDomain # Removes the parameter from the database

Login is then possible again.