First LXC LAMP Stack Template

Starting with an Ubuntu 26.04 LXC template:

adduser kstadmin
usermod -aG sudo kstadmin
nano /etc/sudoers
#Add kstadmin ALL=(ALL) NOPASSWD: ALL

apt update && apt upgrade -y

#ChatGPT instructions:

apt autoremove -y

#Install some baseline utilities:

apt install -y \
  curl \
  wget \
  vim \
  nano \
  htop \
  tree \
  unzip \
  zip \
  rsync \
  git \
  jq \
  dnsutils \
  net-tools \
  software-properties-common
  
#2. Install Nginx
apt install -y nginx

#Enable and start:

systemctl enable nginx
systemctl start nginx

#Verify:

systemctl status nginx

#You should be able to browse to:

#http://<server-ip>

#and get the Nginx welcome page.

#3. Install MariaDB
apt install -y mariadb-server mariadb-client

Enable:

systemctl enable mariadb
systemctl start mariadb

Run the hardening script:

mariadb-secure-installation

Recommended answers:

Switch to unix_socket authentication? Y
Change root password? Y (see Vault)
Remove anonymous users? Y
Disallow root login remotely? Y
Remove test database? Y
Reload privilege tables? Y

Verify:

systemctl status mariadb

Test:

mariadb

You should get a MariaDB prompt.

Exit:

exit;
4. Install PHP 8.5 FPM

Install PHP and common modules:

apt install -y \
  php-fpm \
  php-cli \
  php-common \
  php-curl \
  php-gd \
  php-intl \
  php-mbstring \
  php-mysql \
  php-xml \
  php-zip \
  php-bcmath \
  php-imagick \
  php-soap

Enable PHP-FPM:

systemctl enable php8.5-fpm
systemctl start php8.5-fpm

Verify:

systemctl status php8.5-fpm
5. Configure Nginx to use PHP-FPM

Backup the default site:

cp /etc/nginx/sites-available/default \
   /etc/nginx/sites-available/default.backup

Edit:

nano /etc/nginx/sites-available/default

Replace the contents with:

server {
    listen 80;
    listen [::]:80;

    root /srv/www/site;
    index index.php index.html;

    server_name _;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.5-fpm.sock;
    }

    location ~ /\.ht {
        deny all;
    }
}

#Test:

nginx -t

Reload:

systemctl reload nginx
6. Test PHP

Create a test file:

echo "<?php phpinfo(); ?>" > /var/www/html/info.php

Browse:

http://server-ip/info.php

You should see the PHP information page.

Remove it afterward:

rm /var/www/html/info.php
7. Configure PHP production settings

Edit:

nano /etc/php/8.5/fpm/php.ini

Recommended baseline:

Find/change:

memory_limit = 256M
upload_max_filesize = 64M
post_max_size = 64M
max_execution_time = 120

Enable OPcache settings:

opcache.enable=1
opcache.memory_consumption=128
opcache.max_accelerated_files=10000
opcache.validate_timestamps=1

Restart PHP:

systemctl restart php8.5-fpm
8. Install security basics

Fail2ban:

apt install -y fail2ban

Enable:

systemctl enable fail2ban
systemctl start fail2ban
9. Create a web application directory structure

Instead of dumping everything into /var/www/html:

mkdir -p /srv/www
mkdir -p /srv/www/site

Ownership:

chown -R www-data:www-data /srv/www
chmod -R 755 /srv/www
10. Create a database administration baseline

Install a useful client:

apt install -y mariadb-client

Create a helper command:

mysql --version
11. Cleanup
apt autoremove -y
apt clean
12. Reboot test

Because this will become a template/appliance:

reboot

After reboot:

systemctl status nginx mariadb php8.5-fpm