Set up a LEMP stack on Ubuntu 24.04 LTS: Nginx, MariaDB, PHP 8.3 and Let's Encrypt

# Update package lists and upgrade installed packages
sudo apt update && sudo apt upgrade -y

# Remove unused leftover dependencies without residue
sudo apt autoremove --purge -y && sudo apt autoclean

# Check disk space on the root partition
df -h /

# Check RAM availability and swap status
free -h

# Ensure time synchronization via NTP
timedatectl status

# Install UFW and Fail2ban
sudo apt install ufw fail2ban -y

# Define default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Unlock SSH before enabling (port 22)
sudo ufw allow OpenSSH

# Enable the firewall and check status
sudo ufw --force enable
sudo ufw status verbose

# Check existing web-server services (e.g. Apache leftovers)
sudo ss -tuln | grep -E ':(80|443)' || echo "Ports 80 and 443 are free"

# Install Nginx from the official Ubuntu repositories
sudo apt install nginx -y

# Register the service for automatic start and start it
sudo systemctl enable nginx
sudo systemctl start nginx

# Allow HTTP (port 80) and HTTPS (port 443) in the firewall
sudo ufw allow 'Nginx Full'
sudo ufw status

# Check the running status of the systemd unit
systemctl status nginx --no-pager

# Test the local HTTP response
curl -I http://127.0.0.1

┌─────────────────────────────────────────────────────────────┐
│                 Nginx directory structure                   │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│   /etc/nginx/                                               │
│   ├── nginx.conf          Global main configuration         │
│   ├── conf.d/             Modular server configurations     │
│   ├── sites-available/    VHost templates (inactive)        │
│   └── sites-enabled/      Active VHost symlinks             │
│                                                             │
└─────────────────────────────────────────────────────────────┘

# Install MariaDB server and client tools
sudo apt install mariadb-server mariadb-client -y

# Enable the service and check status
sudo systemctl enable mariadb
sudo systemctl status mariadb --no-pager

# Run the interactive security wizard
sudo mariadb-secure-installation

┌─────────────────────────────────────────────────────────────┐
│                MariaDB directory structure                  │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│   /etc/mysql/                                               │
│   ├── my.cnf              Central inclusion symlink         │
│   └── mariadb.conf.d/     Server configurations             │
│       ├── 50-server.cnf   Main daemon configuration         │
│       └── 60-galera.cnf   Cluster and replication profiles  │
│                                                             │
└─────────────────────────────────────────────────────────────┘

# Open the configuration for editing
sudo nano /etc/mysql/mariadb.conf.d/50-server.cnf

[mysqld]
# Restrict network binding strictly to localhost
bind-address            = 127.0.0.1

# Performance and InnoDB tuning
innodb_buffer_pool_size = 512M          # At 2 GB RAM; at 4 GB+ set to 50-70% of RAM
innodb_log_file_size    = 128M          # Writes transactions efficiently to the log
innodb_flush_log_at_trx_commit = 2     # Reduces disk I/O under write load
innodb_file_per_table   = 1             # Creates its own .ibd files per table
max_connections         = 100           # Prevents overload from too many clients

# Reload the MariaDB configuration
sudo systemctl restart mariadb

# Install PHP 8.3-FPM plus database, image and optimization modules
sudo apt install -y php8.3-fpm php8.3-common php8.3-mysql php8.3-xml                     php8.3-curl php8.3-gd php8.3-mbstring php8.3-zip                     php8.3-opcache php8.3-intl

# Check the PHP-FPM status
sudo systemctl status php8.3-fpm --no-pager

# List installed PHP version and active extensions
php -v
php -m | grep -E '(mysqli|pdo_mysql|opcache|curl)'

┌─────────────────────────────────────────────────────────────┐
│                PHP 8.3 directory structure                  │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│   /etc/php/8.3/                                             │
│   ├── fpm/                                                  │
│   │   ├── php-fpm.conf    Global master settings            │
│   │   ├── php.ini         FPM runtime configuration         │
│   │   └── pool.d/         Worker pools                      │
│   │       └── www.conf    Default pool (www-data socket)    │
│   └── cli/                                                  │
│       └── php.ini         CLI runtime configuration         │
│                                                             │
└─────────────────────────────────────────────────────────────┘

; /etc/php/8.3/fpm/pool.d/www.conf
[www]
user = www-data
group = www-data

; Communication via local Unix-domain socket
listen = /run/php/php8.3-fpm.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660

; Process management
pm = dynamic
pm.max_children = 25
pm.start_servers = 4
pm.min_spare_servers = 2
pm.max_spare_servers = 8
pm.max_requests = 500

# Determine average RAM use of active PHP-FPM workers (in MB)
ps --no-headers -o rss -C php-fpm8.3 | awk '{total+=$1; count++} END {if (count>0) print int(total/count/1024) " MB"; else print "60 MB (default guideline)"}'

# Rule of thumb for pm.max_children:
# max_children = (available RAM for PHP in MB) / (average RAM per worker in MB)

# Calculation example: 2048 MB assigned RAM at about 60 MB per worker
echo $(( 2048 / 60 ))
# Result: 34

# After a configuration change, reload the FPM service
sudo systemctl reload php8.3-fpm

┌─────────────────────────────────────────────────────────────┐
│                 Nginx and PHP-FPM request flow              │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│   Client request (HTTP port 80 / HTTPS port 443)            │
│   ▼                                                         │
│   Nginx web server                                          │
│   ├── Static files       ──▶ Served directly                │
│   └── location ~ \.php$  ──▶ FastCGI proxy pass             │
│                              │                              │
│                              ▼                              │
│                              Socket: php8.3-fpm.sock        │
│                              │                              │
│                              ▼                              │
│                              PHP-FPM worker process         │
│                              │                              │
│                              ▼                              │
│   Client response        ◀── HTML / JSON response           │
│                                                             │
└─────────────────────────────────────────────────────────────┘

# Create the new server-block configuration
sudo nano /etc/nginx/sites-available/lemp.conf

server {
    listen 80;
    listen [::]:80;
    server_name your-domain.example www.your-domain.example;

    root /var/www/html;
    index index.php index.html index.htm;

    # Security headers against clickjacking and MIME sniffing
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # Static files and directory lookups
    location / {
        try_files $uri $uri/ =404;
    }

    # Forward dynamic scripts to the PHP 8.3 FastCGI Unix socket
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;

        # Buffer tuning for dynamic responses
        fastcgi_buffer_size 128k;
        fastcgi_buffers 4 256k;
        fastcgi_busy_buffers_size 256k;
    }

    # Strictly block access to hidden files (.git, .env, .htaccess)
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
}

# Enable the VHost via symlink
sudo ln -s /etc/nginx/sites-available/lemp.conf /etc/nginx/sites-enabled/

# Disable the outdated default VHost
sudo rm -f /etc/nginx/sites-enabled/default

# Check Nginx syntax before reload
sudo nginx -t

# Reload Nginx configuration without downtime
sudo systemctl reload nginx

┌─────────────────────────────────────────────────────────────┐
│             End-to-end test: web, app and database          │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│   HTTP GET /db-test.php                                     │
│   ▼                                                         │
│   Nginx server block                                        │
│   ▼                                                         │
│   PHP 8.3-FPM (Unix domain socket)                          │
│   ▼                                                         │
│   PDO MySQL connection ────▶ MariaDB (127.0.0.1:3306)       │
│                              ├── UTF8mb4 connection         │
│                              ├── Prepared statement         │
│                              └── Process test data          │
│   ▼                                                         │
│   Status response ─────────▶ 200 OK (text/HTML)             │
│                                                             │
└─────────────────────────────────────────────────────────────┘

# Log into the MariaDB console
sudo mariadb -u root

CREATE DATABASE lemp_test CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'lemp_user'@'localhost' IDENTIFIED BY 'AVerySecretPassword123!';
GRANT ALL PRIVILEGES ON lemp_test.* TO 'lemp_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;

sudo nano /var/www/html/db-test.php

<?php
// /var/www/html/db-test.php - For verification purposes only!
declare(strict_types=1);

$dbConfig = [
    'host'    => '127.0.0.1',
    'dbname'  => 'lemp_test',
    'user'    => 'lemp_user',
    'pass'    => 'AVerySecretPassword123!',
    'charset' => 'utf8mb4'
];

$options = [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    PDO::ATTR_EMULATE_PREPARES   => false,
    PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8mb4'
];

try {
    $dsn = "mysql:host={$dbConfig['host']};dbname={$dbConfig['dbname']};charset={$dbConfig['charset']}";
    $pdo = new PDO($dsn, $dbConfig['user'], $dbConfig['pass'], $options);

    // Create the test table
    $pdo->exec("CREATE TABLE IF NOT EXISTS health_check (
        id INT AUTO_INCREMENT PRIMARY KEY,
        checked_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
    )");

    // Insert a test row via prepared statement
    $stmt = $pdo->prepare("INSERT INTO health_check (checked_at) VALUES (NOW())");
    $stmt->execute();

    // Fetch the number of rows
    $count = (int) $pdo->query("SELECT COUNT(*) FROM health_check")->fetchColumn();

    header('Content-Type: text/plain; charset=utf-8');
    echo "LEMP-Stack Health Check: OK
";
    echo "PHP Version: " . PHP_VERSION . "
";
    echo "MariaDB connection: Successful
";
    echo "Rows in health_check: {$count}
";

} catch (PDOException $e) {
    http_response_code(500);
    header('Content-Type: text/plain; charset=utf-8');
    echo "LEMP-Stack Health Check: ERROR
";
    echo "Reason: " . $e->getMessage() . "
";
}

# Set file permissions for the web-server user
sudo chown www-data:www-data /var/www/html/db-test.php
sudo chmod 640 /var/www/html/db-test.php

# Run the test via the local CLI
curl -s http://localhost/db-test.php

LEMP-Stack Health Check: OK
PHP Version: 8.3.x
MariaDB connection: Successful
Rows in health_check: 1

┌─────────────────────────────────────────────────────────────┐
│            Production HTTPS request flow                    │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│   Client browser (HTTPS port 443)                           │
│   ▼                                                         │
│   TLS 1.3 handshake and Let's Encrypt certificate check     │
│   ▼                                                         │
│   Nginx web server with HSTS and security headers           │
│   ▼                                                         │
│   FastCGI Unix socket (/run/php/php8.3-fpm.sock)            │
│   ▼                                                         │
│   PHP-FPM worker process ──▶ MariaDB (127.0.0.1:3306)       │
│   ▼                                                         │
│   Gzip compression ────────▶ Response to client browser     │
│                                                             │
└─────────────────────────────────────────────────────────────┘

# Ensure snapd and install Certbot classically
sudo snap install core && sudo snap refresh core
sudo snap install --classic certbot

# Create a symlink in the standard path
sudo ln -sf /snap/bin/certbot /usr/bin/certbot

# Request a certificate and configure the VHost for HTTPS automatically
sudo certbot --nginx -d your-domain.example -d www.your-domain.example

# Addition in the server block (port 443)
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;

# HSTS (enforces 2 years of HTTPS in the browser including subdomains)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

# Validate the configuration and reload Nginx
sudo nginx -t && sudo systemctl reload nginx

# Test automatic certificate renewal in a dry run
sudo certbot renew --dry-run