Deployment Overview of LEMP on Server¶

Prerequisites and Basic Requirements¶

The deployment requires a server running Ubuntu with root privileges. The system must have Docker installed and configured to manage containers. The following ports must be available and open on the server firewall:

Port 88 for HTTP traffic (mapped to container port 80).
Port 3306 for MySQL database access.
Port 5432 for PostgreSQL database access.

File and Directory Structure¶

The application utilizes specific directories on the host system to persist data and serve web content. These directories are created with root ownership and 0755 permissions:

/root/data: Stores MySQL database files.
/root/webroot: Stores the web application files served by Nginx.
/data/nginx: Contains Nginx configuration files and environment variables for the proxy service.
/etc/letsencrypt: Stores SSL certificates managed by the Nginx container.

Application Installation Process¶

The core LEMP stack is deployed using a Docker container. The installation process involves pulling the adhocore/lemp image with the 8.3 tag. The container is named lemp-stack and is configured to restart automatically upon failure or system reboot.

The container is launched with the following specifications:

Image: adhocore/lemp:8.3
Container Name: lemp-stack
Restart Policy: always

Databases¶

The LEMP container provides access to both MySQL and PostgreSQL databases.

MySQL: Data is persisted in the /root/data directory on the host, mapped to /var/lib/mysql inside the container. The root password for MySQL is set via the MYSQL_ROOT_PASSWORD environment variable.
PostgreSQL: Accessible via port 5432.

Docker Containers and Their Deployment¶

The deployment utilizes two primary Docker components: the LEMP stack and the Nginx proxy.

LEMP Stack Container¶

The main application container is deployed with the following configuration:

Network: Connected to a custom Docker network named lemp-net.
Ports:
Host port 88 maps to container port 80.
Host port 3306 maps to container port 3306.
Host port 5432 maps to container port 5432.
Volumes:
/root/data mounted to /var/lib/mysql.
/root/webroot mounted to /var/www/html.
Environment:
MYSQL_ROOT_PASSWORD is set dynamically based on the SSH password.

Nginx Proxy Container¶

A separate Nginx container is deployed to handle SSL termination and reverse proxying. It uses the jonasal/nginx-certbot:latest image.

Restart Policy: unless-stopped.
Network Mode: host.
Environment:
CERTBOT_EMAIL is set to [email protected].
Additional environment variables are loaded from /data/nginx/nginx-certbot.env.
Volumes:
An external volume named nginx_secrets is mounted to /etc/letsencrypt.
The host directory /data/nginx/user_conf.d is mounted to /etc/nginx/user_conf.d for custom Nginx configurations.

Proxy Servers¶

The Nginx container acts as the reverse proxy and SSL manager for the application. It is configured to use Let's Encrypt for SSL certificate management via Certbot.

Email: Certbot notifications are sent to [email protected].
Configuration: Custom Nginx configurations are placed in /data/nginx/user_conf.d on the host, which are accessible inside the container at /etc/nginx/user_conf.d.
SSL Storage: Certificates are stored in the nginx_secrets volume, mounted at /etc/letsencrypt.

Permission Settings¶

The host directories used for data persistence are created with specific ownership and permissions:

/root/data and /root/webroot are owned by root:root with mode 0755.
The Nginx configuration directory /data/nginx must be accessible by the Nginx container running in host network mode.

Starting, Stopping, and Updating¶

The LEMP stack is managed as a Docker container named lemp-stack. Standard Docker commands are used to control the service:

Start: docker start lemp-stack
Stop: docker stop lemp-stack
Restart: docker restart lemp-stack

Update: To update the application, pull the latest image and recreate the container:

docker pull adhocore/lemp:8.3
docker stop lemp-stack
docker rm lemp-stack
docker run -d --name lemp-stack --restart always --network lemp-net -p 88:80 -p 3306:3306 -p 5432:5432 -v /root/data:/var/lib/mysql -v /root/webroot:/var/www/html -e MYSQL_ROOT_PASSWORD=<password> adhocore/lemp:8.3

The Nginx proxy container is managed similarly using its specific image and configuration parameters.