Deployment Overview of Ispconfig on Server¶

Prerequisites and Basic Requirements¶

Before beginning the installation, ensure the server meets the following requirements:

• Operating System: Ubuntu or Debian.

• Privileges: Root or sudo access is required for all installation steps.

• Network/Ports: The following TCP ports must be open in the firewall:

• 22 (SSH)

• 80 (HTTP)

• 443 (HTTPS)

• 8080 (ISPConfig Panel)

FQDN of the final panel on the hostkey.in domain¶

The ISPConfig panel is accessible via a specific Fully Qualified Domain Name (FQDN) based on the server ID.

File and Directory Structure¶

The following paths are used for configuration files, application data, and SSL certificates:

• /usr/local/ispconfig: Main installation directory of the ISPConfig interface.

• /usr/local/ispconfig/interface/lib/config.inc.php: Primary ISPConfig configuration file.

• /etc/nginx/sites-available/000-ispconfig.vhost: Nginx virtual host for the ISPConfig panel.

• /data/nginx/user_conf.d/: Directory containing custom Nginx user configurations and proxy settings.

• /root/nginx/compose.yml: Docker Compose file for the SSL management container.

Application installation process¶

The application is installed using a combination of package management and an automated installer script:

1. System Preparation: The system updates the APT cache, installs base utilities (wget, curl, ca-certificates, etc.), and ensures necessary dependencies like nginx and bind9 are present.

2. Docker Installation: Docker is installed to manage the SSL certificate container.

3. ISPConfig Download: The application source is downloaded from the official ISPConfig repository, extracted to /tmp/ispconfig-ai, and prepared for installation.

4. Automated Installation: An installation script (ispconfig.ai.php) is executed with specific flags:

5. --use-nginx: Configures Nginx as the web server.

6. --no-roundcube: Skips Roundcube installation.

7. --no-mail, --no-dns, --no-ftp: Disables these components from being managed by the autoinstaller to allow for custom configuration.

8. --unattended-upgrades: Enables automatic security updates.

9. PHP Environment: PHP 8.3 is installed via a dedicated repository to provide the necessary FPM environment for the panel's web interface.

Access Rights and Security¶

Security is managed through several layers:

• Firewall (UFW): The Uncomplicated Firewall (UFW) is enabled, with rules specifically allowing traffic on ports 22, 80, 443, and 8080.

• User Permissions: The www-data user is granted read access to the ISPConfig configuration file (config.inc.php) and write access to the /usr/local/ispconfig/interface/temp and /usr/local/ispconfig/interface/lib/classes/IDS/tmp directories.

• Directory Permissions: Critical application directories are set to 0755 or 0770 as required for proper service operation.

Databases¶

ISPConfig utilizes a MariaDB database for its internal configuration and user management:

• Database Name: dbispconfig

• Connection Method: Localhost via socket/TCP.

• Storage Location: Managed by the system's MariaDB service.

• Default Credentials:

• Root User: root (Password managed via system defaults).

• ISPConfig User: ispconfig.

Docker Containers and Their Deployment¶

The deployment includes one primary application container used for SSL certificate management:

Nginx Certbot Container

• Image: jonasal/nginx-certbot:latest

• Ports: Binds to host ports 80 and 443.

• Volumes:

• nginx_secrets:/etc/letsencrypt: Persists SSL certificates.

• /data/nginx/user_conf.d:/etc/nginx/user_conf.d: Provides custom Nginx configurations.

• Network Mode: host

• Restart Policy: unless-stopped

Custom Scripts and Additional Setup¶

The deployment performs several non-standard actions to ensure the panel is correctly integrated with the host's web server:

• Nginx Proxy Configuration: A configuration file is generated in /data/nginx/user_conf.d/ that uses proxy_pass to route traffic from port 443 (via Certbot) to the ISPConfig service running on port 8080.

• ISPConfig Vhost Setup: A custom Nginx virtual host (000-ispconfig.vhost) is created and enabled, configured specifically to communicate with the PHP 8.3 FPM socket.

• Database Password Update: An automated command updates the sys_user table in the MariaDB database to set the ISPConfig admin password.

Application Update Instructions¶

To update the main application:

1. If using Docker components, navigate to /root/nginx and run:

   docker compose pull && docker compose up -d
   

2. For system-level updates, use the standard package manager:

   apt update && apt upgrade
   

Location of configuration files and data¶

Available ports for connection¶

• 80: HTTP (Redirected or used by Certbot).

• 443: HTTPS (Managed via Nginx Certbot).

• 8080: ISPConfig Web Interface (Internal/Local access).

• 22: SSH.

Starting and Stopping the application¶

The application relies on several system services:

• Starting ISPConfig Panel: Ensure PHP-FPM and Nginx are running:

  systemctl start php8.3-fpm
  systemctl start nginx
  

• Stopping ISPConfig Panel:

  systemctl stop php8.3-fpm
  systemctl stop nginx
  

Proxy Servers (Nginx, SSL, custom domains)¶

The deployment uses a reverse proxy architecture:

• Certbot/Nginx Container: Handles SSL termination and manages certificates via Let's Encrypt.

• Host Nginx: Acts as the primary entry point for traffic on ports 80 and 443. It is configured to proxy requests to the ISPConfig backend running on 127.0.0.1:8080.