Deployment Overview of LAMP on Server¶

Prerequisites and Basic Requirements¶

To ensure a successful deployment, the server must meet the following requirements:

Operating System: Ubuntu or Debian.
Privileges: Root access or sudo privileges are required for package installation and service management.
Ports:
80 (HTTP): Used by Certbot/Nginx for SSL certificate challenges.
443 (HTTPS): The external port for secure web traffic.
8080: The internal port used by Apache to communicate with the proxy.

The application is accessible via a specific subdomain template based on the server ID.

The deployment utilizes several specific paths for configuration and data persistence:

/root/nginx: Contains the Docker Compose file for the Nginx proxy.
/data/nginx/user_conf.d: Stores custom Nginx configuration files for each domain.
/data/nginx/nginx-certbot.env: Environment variables for the Nginx container.
/etc/apache2/: Standard Apache configuration directory, modified to listen on internal ports.
/var/www/html/: The default web root where info.php is created for testing.

The installation follows a multi-stage process involving package management and container orchestration:

System Preparation: The system updates the package cache and ensures all existing package locks are released.
Web Server Installation: Apache is installed as the primary web server.
Database Installation: MariaDB is added via its official repository (including regional mirrors for specific locations) and installed.
PHP Installation:
On Ubuntu, PHP 8.2 is installed from the ondrej/php PPA along with necessary modules (mysql, curl, cgi).
On Debian, standard PHP packages are installed.
Apache Configuration: Apache is reconfigured to listen on port 8080 instead of the default port 80 to allow the Nginx proxy to handle SSL termination on port 443. Proxy headers (X-Forwarded-Proto) are configured to ensure proper redirection and host header handling.
Proxy Setup: A Docker-based Nginx instance is deployed to manage SSL certificates via Certbot and act as a reverse proxy for Apache.

Firewall: The system relies on the external port 443 being open for HTTPS traffic.
Apache Security: Apache is restricted to listening on an internal port (8080), preventing direct unencrypted access from the outside.
Docker Isolation: Nginx runs in a container with host networking mode to facilitate seamless SSL management and proxying.

The application uses MariaDB as its database engine.

Connection Method: Localhost connection via mysql client.
Storage Location: Standard MariaDB data directories (e.g., /var/lib/mysql).
Version: 10.11.x.

The deployment utilizes a single primary container to handle SSL termination and reverse proxying:

Nginx Proxy Container

Image: jonasal/nginx-certbot:latest
Ports: Uses network_mode: host.
Volumes:
nginx_secrets:/etc/letsencrypt: For persisting SSL certificates.
/data/nginx/user_conf.d:/etc/nginx/user_conf.d: For custom site configurations.
Environment Variables:
CERTBOT_EMAIL: Set via the configuration file (default: [email protected]).
Restart Policy: unless-stopped

The following actions are performed during the setup process to finalize the environment:

Apache Header Configuration: The system automatically injects proxy_set_header Host $host; and proxy_set_header X-Forwarded-Proto $scheme; into the Nginx configuration files located in /data/nginx/user_conf.d/.
Test File Generation: A file named info.php is created in /var/www/html/ to verify that the PHP module is functioning correctly.

To update the main application components:

Nginx Proxy: To pull the latest proxy image and apply changes, run:

cd /root/nginx && docker compose pull && docker compose up -d

System Packages (Apache/PHP/MariaDB): Use the standard package manager:
```
sudo apt update && sudo apt upgrade
```

Component	Configuration Path	Data/Volume Path
Nginx Proxy	`/root/nginx/compose.yml`	`/etc/letsencrypt` (via `nginx_secrets`)
Apache	`/etc/apache2/sites-available/`	`/var/www/html`
MariaDB	`/etc/mysql/mariadb.conf.d/`	`/var/lib/mysql`

Apache Service:
Start: systemctl start apache2
Stop: systemctl stop apache2
Nginx Proxy (Docker):
Start/Restart: docker compose -f /root/nginx/compose.yml up -d
Reload Config: docker compose -f /root/nginx/compose.yml exec -T nginx nginx -s reload