← Zurück zu den Projekten
Sysadmin Recipes
#sysadmin-recipes
#References
#Add sudo user
Ad user
adduser <newuser>
usermod -aG sudo <newuser>
OR Edit sudoers
visudo
Add the newly created user by inserting
at the end of the user privilege section, as shown in the following example:
User privilege specification
root ALL=(ALL:ALL) ALL
newuser ALL=(ALL:ALL) ALL
#Nginx
sudo apt update sudo apt install nginx systemctl status nginx
#References
#Apache2
sudo apt-get update sudo apt-get upgrade sudo apt-get install apache2 sudo a2enmod rewrite sudo systemctl restart apache2 sudo adduser <user> www-data
#MariaDB
sudo apt install mariadb-server sudo mariadb-secure-installation sudo systemctl start mariadb.service sudo systemctl status mariadb
#PHP
sudo apt-get install -y php php-cli php-mysql php-mbstring php-bcmath php-zip php-gd php-curl php-xml php-intl php-fpm ls /etc/php/8.3/ cd /etc/php/8.3/fpm/pool.d/ sudo nano www.conf
Review this lines:
user = www-data group = www-data listen = /run/php/php8.3-fpm.sock
Save and run
sudo systemctl restart php8.3-fpm
#PHP-FPM x Nginx
Nginx server block
server {
listen 80;
listen [::]:80;
server_name DOMAIN;
root /var/www/PROJECT/public;
index index.php;
access_log /var/log/nginx/DOMAIN-access.log;
error_log /var/log/nginx/DOMAIN-error.log error;
location / {
try_files $uri $uri/ /index.php?$query_string;
}
location = /favicon.ico { access_log off; log_not_found off; }
location = /robots.txt { access_log off; log_not_found off; }
error_page 404 /index.php;
location ~ \.php$ {
fastcgi_pass unix:/var/run/php/php8.4-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
include fastcgi_params;
}
location ~ /\.(?!well-known).* {
deny all;
}
}
systemctl reload nginx
#References
#PHP FPM x Apache
#Enable required modules
sudo a2enmod proxy_fcgi setenvif rewrite sudo a2enconf php8.4-fpm sudo a2dismod php8.4 # disable mod_php if enabled sudo a2dismod mpm_prefork sudo a2enmod mpm_event # event is recommended with PHP-FPM sudo systemctl restart apache2
▎ Important: With PHP-FPM, use mpm_event instead of mpm_prefork.
▎ Prefork + mod_php causes memory leaks (orphaned UDP sockets) that can
▎ exhaust ephemeral ports and break DNS resolution on the server.
#Apache MPM Event configuration
nano /etc/apache2/mods-available/mpm_event.conf
<IfModule mpm_event_module> StartServers 2 MinSpareThreads 25 MaxSpareThreads 75 ThreadLimit 64 ThreadsPerChild 25 MaxRequestWorkers 150 MaxConnectionsPerChild 1000 </IfModule>
▎ MaxConnectionsPerChild must be > 0 in production. Value 0 means workers
▎ never recycle, causing memory/socket leaks over time.
| Scenario | MaxConnectionsPerChild |
|---|---|
| Low traffic / Low RAM | 500-1000 |
| Medium traffic | 2000-3000 |
| High traffic | 5000-10000 |
If you must use mpm_prefork (legacy)
nano /etc/apache2/mods-available/mpm_prefork.conf
<IfModule mpm_prefork_module> StartServers 5 MinSpareServers 5 MaxSpareServers 10 MaxRequestWorkers 150 MaxConnectionsPerChild 500 </IfModule>
#Apache VirtualHost with PHP-FPM
nano /etc/apache2/sites-available/DOMAIN.conf
<VirtualHost *:80> ServerName DOMAIN DocumentRoot /var/www/PROJECT/public <Directory /var/www/PROJECT/public> AllowOverride All Require all granted </Directory> <FilesMatch \.php$> SetHandler "proxy:unix:/run/php/php8.4-fpm.sock|fcgi://localhost" </FilesMatch> ErrorLog ${APACHE_LOG_DIR}/DOMAIN-error.log CustomLog ${APACHE_LOG_DIR}/DOMAIN-access.log combined </VirtualHost>
sudo a2ensite DOMAIN.conf sudo systemctl reload apache2
#ufw Firewall
sudo apt-get install ufw sudo ufw app list sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw allow OpenSSH sudo ufw allow http sudo ufw allow https sudo ufw allow 'Apache Full' sudo ufw allow 'Nginx Full' sudo ufw enable sudo ufw status
#Node
See the correct version of NVM here https://github.com/nvm-sh/nvm
wget -qO- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.<version>/install.sh | bash
# copy as 2 lines
export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" # This loads nvm
nvm install node
Any trouble to find nvm command:
source ~/.bashrc or source ~/.nvm/nvm.sh
#Add ssh-key deploy to Github
ssh-keygen
Copy .pub to Github section of the project
#Composer
wget https://getcomposer.org/installer sudo php installer --install-dir=/usr/local/bin --filename=composer rm installer
#SSL - HTTPS - Certbot
sudo apt install certbot # for apache sudo apt install python3-certbot-apache # for nginx sudo apt install python3-certbot-nginx # check is running and auto rebew sudo systemctl status certbot.timer # create ssl for all nginx domains sudo certbot --nginx # create ssl for all apache2 domains sudo certbot --apache # check autorenew wil run ok sudo certbot renew --dry-run
#References
#Laravel project
#Mysql / Mariadb database and user
# mysql sudo mysql -u root # mariadb sudo mariadb -u root # or to enter password # mysql sudo mysql -u root -p # mariadb sudo mariadb -u root -p
CREATE DATABASE 'yourDB';
SHOW DATABASES;
# User creation alternatives
CREATE USER 'user1'@localhost IDENTIFIED BY 'password1';
# Or
CREATE USER 'user1'@'localhost' IDENTIFIED VIA mysql_native_password USING PASSWORD('password1');
SELECT User FROM mysql.user;
GRANT ALL PRIVILEGES ON yourdb.* TO 'user1'@localhost;
FLUSH PRIVILEGES;
SHOW GRANTS FOR 'user1'@localhost;
#Laravel steps
git clone cd <project/root> composer install cp .env.example .env
#Review user privilegies and owner
sudo chown -R www-data:www-data ./ sudo usermod -a -G www-data <deployuser> sudo chown -R $USER:www-data . sudo find . -type f -exec chmod 664 {} \; sudo find . -type d -exec chmod 775 {} \; sudo chgrp -R www-data storage bootstrap/cache sudo chmod -R ug+rwx storage bootstrap/cache