Deployment Overview of Ispconfig on Server¶

Prerequisites and Basic Requirements¶

To ensure a successful deployment, the following requirements must be met:

• Operating System: Ubuntu (specifically Jammy Jellyfish/22.04 is supported) or Debian.

• Privileges: Root or sudo access is required for all installation steps.

• Domain Configuration: A valid FQDN must be assigned to the server and correctly mapped in /etc/hosts.

• Network Ports: The following TCP ports must be open:

• 22 (SSH)

• 80 (HTTP)

• 443 (HTTPS)

• 8080 (ISPConfig Interface)

FQDN of the final panel on the hostkey.in domain¶

The ISPConfig interface is accessible via a specific subdomain template:

File and Directory Structure¶

The deployment utilizes several specific paths for configuration and data management:

• ISPConfig Interface: /usr/local/ispconfig/interface

• Nginx Configuration (User): /data/nginx/user_conf.d/

• Nginx Compose Files: /root/nginx/compose.yml

• Certbot Secrets: Managed via a Docker volume named nginx_secrets.

• ISPConfig Log File: /root/ispconfig-ai-run.log

Application Installation Process¶

The installation of ISPConfig is performed using an automated installer script and manual configuration steps:

1. Environment Preparation: The system updates the APT cache, installs base helpers (wget, curl, ca-certificates, etc.), and ensures ufw is installed and configured.

2. Docker Setup: Docker is installed to manage the Nginx-Certbot proxy service.

3. MariaDB Preparation: A corporate MariaDB image (docker-srv.hostkey.com/docker-anonymous/bitnami/mariadb:latest) is pulled to ensure version consistency.

4. ISPConfig Installation: The official ISPConfig autoinstaller script is downloaded and executed with the following parameters:

5. --use-nginx (Nginx is used as the web server).

6. --no-roundcube (Roundcube is not installed by default).

7. --no-mail, --no-dns, --no-ftp (Minimal installation mode).

8. --unattended-upgrades (Enabled for security updates).

9. PHP Configuration: PHP 8.1 FPM is installed and configured to serve the ISPConfig interface via a Unix socket (/run/php/php8.1-fpm.sock).

10. Nginx Integration: A custom Nginx vhost is created at /etc/nginx/sites-available/ispconfig.vhost which listens on port 8080.

Access Rights and Security¶

Security is managed through several layers:

• Firewall (UFW): The firewall is enabled with rules specifically allowing traffic on ports 22, 80, 443, and 8080.

• File Permissions:

• ISPConfig temporary directories (/usr/local/ispconfig/interface/temp and /usr/local/ispconfig/interface/lib/classes/IDS/tmp) are owned by www-data with 0770 permissions.

• The configuration file /usr/local/ispconfig/interface/lib/config.inc.php is set to 0640 and owned by the www-data group to allow web server access while restricting other users.

Databases¶

The application uses a MariaDB database for storage:

• Database Name: dbispconfig

• Connection Method: Localhost via socket/TCP.

• Root Password: Defined during installation (defaulting to admin123).

• Application User: An ispconfig user is created with a specific password defined in the configuration files.

Docker Containers and Their Deployment¶

The deployment utilizes one primary application container for SSL management:

Nginx-Certbot Container

• Image: jonasal/nginx-certbot:latest

• Network Mode: host

• Ports: Binds to host ports 80 and 443 via host network mode.

• Volumes:

• nginx_secrets:/etc/letsencrypt (Stores SSL certificates).

• /data/nginx/user_conf.d:/etc/nginx/user_conf.d (Provides custom Nginx configurations).

• Environment Variables:

• CERTBOT_EMAIL: Set to the administrative contact email.

• Restart Policy: unless-stopped

Custom Scripts and Additional Setup¶

Several actions are performed during deployment that go beyond standard package installation:

• Hostname Configuration: The system's hostname is explicitly set to the FQDN, and /etc/hosts is updated to ensure local resolution.

• Nginx Proxy Configuration: A configuration script modifies Nginx user files to include a proxy_pass directive pointing to http://127.0.0.1:8080, allowing the Certbot container to handle SSL termination for the ISPConfig interface.

• Database Password Update: An SQL command is executed immediately after installation to update the ISPConfig admin password in the database.

Application Update Instructions¶

To update the main application:

• If using Docker components, navigate to /root/nginx and run:

  docker compose pull && docker compose up -d
  

• For the core ISPConfig installation, follow the official upgrade procedures provided by the ISPConfig documentation.

Location of Configuration Files and Data¶

• ISPConfig Main Config: /usr/local/ispconfig/interface/lib/config.inc.php

• Nginx Vhost for ISPConfig: /etc/nginx/sites-enabled/000-ispconfig.vhost

• Docker Compose (Proxy): /root/nginx/compose.yml

Available Ports for Connection¶

Starting and Stopping the Application¶

• Restart Nginx: systemctl reload nginx

• Restart PHP-FPM: systemctl restart php8.1-fpm

• Manage Proxy Container:

• Start: docker compose up -d (inside /root/nginx)

• Stop: docker compose down (inside /root/nginx)