Deployment Overview of LAMP on Server¶

Prerequisites and Basic Requirements¶

To ensure a successful deployment, the server must meet the following requirements:

Operating System: Ubuntu or Debian.
Privileges: Root or sudo access is required for package installation and service management.
Ports:
Port 80 (HTTP) and 443 (HTTPS) are reserved for the Nginx Certbot container to handle SSL termination and traffic routing.
Port 8080 is used by Apache for internal communication.

FQDN of the final panel on the hostkey.in domain¶

The application uses a dynamic subdomain based on the server ID. The template for the Fully Qualified Domain Name (FQDN) is provided below:

| Parameter | Value | | Prefix | lamp | | Domain | hostkey.in | | Full template | lamp{Server_ID_from_Invapi}.hostkey.in |

File and Directory Structure¶

The following directories are used for configuration, certificates, and application data:

/root/nginx: Contains the Docker Compose configuration for the Nginx Certbot container.
/data/nginx/user_conf.d: Stores custom Nginx configuration files for the specific domain.
/etc/apache2/: Standard Apache configuration directory (modified to listen on internal ports).
/var/www/html/: The default web root where info.php is created for testing.

Application installation process¶

The installation follows a multi-step process involving package management and container orchestration:

System Preparation: The system updates the package cache and removes any conflicting legacy Docker repository files to prevent dependency issues.
Web Server Installation: Apache (apache2) is installed via the system package manager.
Database Installation: MariaDB server and client are installed from the official MariaDB repositories.
PHP Installation:
On Ubuntu, PHP version 8.3 is installed via the ppa:ondrej/php repository, including modules for MySQL, Curl, and CGI.
On Debian, standard PHP packages are installed from the default repositories.
Apache Internal Reconfiguration: Apache is reconfigured to listen on port 8080 instead of the standard port 80. This allows the Nginx container to bind to ports 80 and 443. A configuration file remoteip-forwarded.conf is enabled to ensure Apache correctly handles headers like X-Forwarded-Proto.
SSL/Proxy Setup: A Docker container running jonasal/nginx-certbot:latest is deployed via Docker Compose in /root/nginx to manage SSL certificates and act as a reverse proxy.

Access Rights and Security¶

Firewall: Ensure that ports 80 (HTTP) and 443 (HTTPS) are open to the public.
Internal Traffic: Apache is restricted to internal communication on port 8080.
Permissions: Configuration files in /data/nginx/user_conf.d/ are managed with specific ownership and permissions to ensure secure proxying.

Databases¶

The application utilizes MariaDB for data storage.

Connection Method: Localhost connection via the installed MariaDB client.
Storage Location: Standard system database directories (e.g., /var/lib/mysql).
Settings: The installation includes mariadb-server and mariadb-client.

Docker Containers and Their Deployment¶

The deployment utilizes one primary container for SSL management and proxying:

Nginx Certbot Container

Image: jonasal/nginx-certbot:latest
Ports: Binds to host ports 80 and 443.
Volumes:
nginx_secrets:/etc/letsencrypt (External volume for SSL certificates)
/data/nginx/user_conf.d:/etc/nginx/user_conf.d (Custom Nginx configurations)
Environment Variables: CERTBOT_EMAIL set to the configured administrator email.
Restart Policy: unless-stopped

Custom Scripts and Additional Setup¶

The following actions are performed during or after the installation:

PHP Verification: A file located at /var/www/html/info.php is created containing <?php phpinfo(); ?> to verify that the PHP module is functioning correctly within Apache.
Nginx Header Configuration: The system automatically injects proxy_set_header Host $host; and proxy_set_header X-Forwarded-Proto $scheme; into the Nginx configuration files to ensure correct redirection and header passing from the proxy to the backend Apache server.

Application Update Instructions¶

To update the main application components:

Web Server/PHP/MariaDB: Use the system package manager:
```
apt update && apt upgrade
```
Nginx Certbot Container: To pull the latest image and restart the proxy service, navigate to /root/nginx and run:
```
docker compose pull && docker compose up -d
```

Location of configuration files and data¶

Component	Configuration / Data Path
Nginx Proxy Configs	`/data/nginx/user_conf.d/`
Apache Configs	`/etc/apache2/`
MariaDB Data	`/var/lib/mysql`
Docker Compose File	`/root/nginx/compose.yml`

Available ports for connection¶

HTTP (External): 80
HTTPS (External): 443
Apache (Internal): 8080

Starting and Stopping the application¶

Starting Apache:
```
systemctl start apache2
```
Stopping Apache:
```
systemctl stop apache2
```

Managing Nginx Proxy (Docker): Navigate to /root/nginx and use:

docker compose up -d # To start
docker compose down # To stop

Proxy Servers¶

The application uses a reverse proxy setup. An Nginx container (jonasal/nginx-certbot) handles incoming HTTPS traffic on port 443. It manages SSL certificates via Certbot and proxies requests to the Apache service running internally on port 8080. Custom domain routing is handled through configuration files located in /data/nginx/user_conf.d/.