Setup NGINX, PHP-FPM, and MariaDB on Debian 8

This guide will show you how to correctly install and configure an “alternative” LAMP stack on Debian 8 utilizing NGINX, PHP Fast Process Manager, and MariaDB.

NGINX

NGINX is a “reverse proxy first, web server second”. It is a popular and growing alternative to Apache, offering greater flexibility and better performance in many instances. In this tutorial, we will be using it as our web server.

Fire up your favorite SSH client and login to your server. For Windows users, “PuTTY” is a free and lightweight SSH client. Linux and Mac users can use the terminal included by default with their operating system. For this tutorial, we will assume that you are logged in to your server as the “root” user.

For starters, let’s just make sure everything is up to date. Type the following to check for and then install updates.

apt-get update && apt-get upgrade

We’ll be editing our configuration files in vim. Vim is not installed by default, so let’s install it!

apt-get install vim

Now it’s time to install NGINX. We’ll want to install the latest version of NGINX from the official NGINX Debian repository.

wget http://nginx.org/keys/nginx_signing.key
apt-key add nginx_signing.key
echo 'deb http://nginx.org/packages/debian/ jessie nginx' >> /etc/apt/sources.list
echo 'deb-src http://nginx.org/packages/debian/ jessie nginx' >> /etc/apt/sources.list
apt-get update && apt-get install nginx

Now we need to tweak the NGINX configuration some. Navigate to the configuration directory.

cd /etc/nginx

A quick vim lesson

Use the arrow keys to navigate the text document. To begin making edits, press the “insert” button on your keyboard. If your keyboard doesn’t have an insert button, then press the “i” key. Towards the bottom of vim you’ll notice it now says “INSERT”. Insert mode will let you delete via backspace or insert new characters by typing them.

Let’s open up our nginx.conf and poke around:

vi nginx.conf

Let’s change the default user, check the number of worker processes, and turn off the access log.

The directives “user” and “worker_processes” are near the top. Try the values below:

Note that you’ll want to set “worker_processes” to the number of CPU cores available on your server. In this example, we have 1, which is the NGINX default.

user www-data;
worker_processes 1;

We’ll also want to disable the access log, for sake of improving I/O performance. Navigate downwards with the arrow keys until you find “access_log”. Modify it to the following:

access_log off;

And lastly, we’ll set the “client_max_body_size” to correspond with some changes made to PHP later on. Let’s save the trouble and do it now. Add just below “access_log”:

client_max_body_size 12m;

When you’ve finished up editing, press “Esc” on your keyboard. Vim will no longer say “INSERT” towards the bottom of the file.

To save our changes and quit vim, press the following key sequence:

SHIFT :(colon)
wq
Press "Enter"

The above vim kung fu will write your changes to disk and exit vim, dropping you back into the bash shell.

Now, we need to make a site-specific configuration for our example! We’ll also delete the other example configurations. Try the following:

cd conf.d
rm example_ssl.conf default.conf
vi my_site.conf

We’ll make a short and simple www.conf based loosely on the default NGINX configuration, but with a few tweaks. Press insert and you can copy/paste the below example.

Don’t forget to edit the “root” directive to point to the root directory of your website, and “server_name” to correspond to your domain.

server {
    listen 80;

    root /path/to/your/website;
    index index.php index.html index.htm;

    server_name mydomainname.com www.mydomainname.com;

    location / {
            try_files $uri $uri/ /index.php;
    }

    location ~ \.php$ {
            try_files $uri =404;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            include fastcgi_params;
            fastcgi_pass unix:/var/run/php5-fpm.sock;
    }
}

Now we’re done with the NGINX configuration section of this tutorial. We’ll restart NGINX in a little bit, right after we install PHP.

PHP-FPM

PHP-FPM is the PHP Fast Process Manager. It’s required when using NGINX, because unlike Apache, NGINX doesn’t run PHP as a module. This was done to reduce NGINX’s memory footprint. Remember that part about NGINX being a reverse proxy first and foremost? Here’s where that comes into play; PHP requests sent to NGINX are fed to PHP-FPM to do the heavy lifting.

Let’s install PHP-FPM.

apt-get install php5-fpm php5-mysqlnd

Note that depending on what your PHP scripts require, you may have to install other PHP modules not included by default. Popular ones are php5-gd and php5-mcrypt. You can install these with the following command.

apt-get install php5-module_name_here

Now that we’ve got PHP-FPM installed, we’ll want to make a few quick edits to enhance security and functionality.

cd /etc/php5/fpm
vi php.ini

Time for another quick vim lesson! The php.ini file is absolutely huge. Looking for a few key values will take all day. So since we know what we’re looking for, we’ll search. Type the following:

/upload_max_filesize

This, by default, is set to 2 megabytes. If you want to allow users to upload files to your PHP applications greater than 2 megabytes, you will need to change this. 10M is probably a safe bet for now, but higher values are also acceptable. This setting will vary among configurations. For sake of tutorial:

upload_max_filesize = 10M

One more glaring security flaw. Scroll down a little further or search. We need to turn “allow_url_fopen” to “Off”. This will prevent PHP from running PHP files hosted REMOTELY, otherwise known as RFI (Remote File Inclusion). Many servers are hacked this way.

allow_url_fopen = Off

And because we changed “upload_max_filesize”, we now have to change “post_max_size”. This value should be a little bigger than “upload_max_filesize”, because we have to take into account the overhead associated with our requests processed by PHP.

Let’s search one more time with “/post_max_size”.

post_max_size = 12M

Note that you’ll have to go back to your NGINX configuration and edit “client_max_body_size” if you decide to go with larger values than these examples for your PHP file sizes.

That’s about it for now. Make sure you aren’t in edit mode by pressing “Esc”. Save and exit vim.

SHIFT :(colon)
wq
Press 'Enter'

PHP-FPM setup is complete.

MariaDB

Even in a world continuously moving towards NoSQL or MongoDB, some of us still find it easier to just stick with MySQL. This is especially true for many web applications. Fortunately, there now exist a number of “drop-in” replacements for Oracle MySQL. Debian 8 now includes the ever popular MariaDB. MariaDB is a fork of Oracle MySQL based on version 5.5. MariaDB, for all intents and purposes, calls this MariaDB 10. It is considered a FULL replacement for Oracle MySQL. Think of it as MySQL at heart, sans the Oracle branding, and some new features.

apt-get install mariadb-server

IMPORTANT: You absolutely, positively, need to pick a strong root password for MariaDB. Save it somewhere secure. You’ll need to enter it twice during the MariaDB installation.

Let’s tweak the MariaDB configuration slightly. We’re going to disable MariaDB listening via the network interface. Instead, as with PHP-FPM earlier, we’ll stick only to a UNIX socket. Most PHP applications should support connecting to the database server via a UNIX socket instead of the local loopback interface.

cd /etc/mysql
vi my.cnf

Look for “bind-address = 127.0.0.1”. Comment that line out. Above or below it add “skip-networking”.

#bind-address = 127.0.0.1
skip-networking

We’re done with MariaDB! Eventually, you may want to tweak your MariaDB configuration depending on if you’ll be using primarily the MyISAM or InnoDB storage engines, but also for the number of CPU cores and RAM available to your server. The defaults will get us up and running in the mean time.

Let’s restart each of the services for which configuration files were modified in this tutorial.

systemctl restart nginx.service
systemctl restart php5-fpm.service
systemctl restart mysql.service

That’s it – we’re all done. At this point, you have a fully functional LNMP ( LEMP ) server online!

This guide was to serve as a general rule of thumb for getting started with with the above services with minimal tweaking. For further information, read the documentation for the above packages. While this example setup should work well right “out of the box”, adjustments can, and most likely will need to be made to better suit your needs.

Recommended areas to research:

• Utilizing and modifying NGINX’s cache control.
• PHP-FPM “static”, “dynamic”, or “ondemand” task manager settings.
• MariaDB performance tuning to get the most out of your database server.