LEMP Server Installation Guide on Debian 12

From Acenet Knowledgebase
Jump to navigation Jump to search

This guide shows how to set up a LEMP server (Linux, Nginx, MariaDB and PHP; the "E" comes from how Nginx is pronounced, "engine-x") on Debian 12, so you can host websites without a control panel. When you finish, your server will run:

  • Nginx 1.22 web server
  • MariaDB 10.11 database server (a drop-in replacement for MySQL)
  • PHP 8.2, run through PHP-FPM
  • A free Let's Encrypt SSL certificate for your website

Debian 12 (Bookworm) is now in Debian's long-term support (LTS) period and receives security updates until June 2028. For a new server, we recommend Debian 13.

The version numbers are from October 2026; regular updates may install newer releases of the same versions. If you'd rather use Apache, see our LAMP guides.

Nginx and .htaccess files

Nginx doesn't read .htaccess files. Settings that applications put in .htaccess, such as rewrite rules for friendly URLs, go in the website's Nginx configuration instead (step 6). The configuration in this guide already handles friendly URLs for WordPress and most other PHP applications.

Before you start

  • A server running a fresh installation of Debian 12, such as an Acenet cloud server, virtual server or dedicated server, with no control panel installed.
  • Root access over SSH. Run every command in this guide as root, or put sudo in front of it.
  • A domain name whose A record points to your server's IP address. In this guide, replace example.com with your own domain.

Step 1: Update the server

apt update
apt -y upgrade

If the update installed a new kernel, restart the server with reboot and log in again.

Step 2: Install Nginx

apt -y install nginx
systemctl status nginx

Nginx starts automatically and is set to start at boot. Open http://your-server-ip/ in a browser. You should see the "Welcome to nginx!" page. If the page doesn't load, check the firewall (step 3).

Step 3: Open the firewall

Debian doesn't turn on a firewall by default. If you want one, you can install ufw. Allow SSH first so you don't lock yourself out (change 22 if your SSH server uses a different port): 

apt -y install ufw
ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable
ufw status

If you use a different firewall, allow incoming connections on ports 80 (HTTP) and 443 (HTTPS).

Step 4: Install MariaDB

apt -y install mariadb-server
mariadb-secure-installation

The mariadb-secure-installation script asks a few questions:

  • Enter current password for root: press Enter (there is none yet).
  • Switch to unix_socket authentication and Change the root password: answering n is fine. The database's root user can only log in as the server's root user, through mariadb on the command line, which is secure without a password.
  • Answer Y to remove anonymous users, disallow root login remotely, remove the test database and reload the privilege tables.

Step 5: Install PHP

Install PHP-FPM and the extensions most websites need (for example WordPress): 

apt -y install php-fpm php-mysql php-gd php-mbstring php-xml php-intl php-zip php-curl
systemctl status php8.2-fpm
php -v

PHP-FPM starts automatically and runs as www-data, the same user as Nginx. It listens on /run/php/php8.2-fpm.sock, which you'll use in the next step. Installing PHP-FPM doesn't install Apache.

Step 6: Set up your website

Each website gets its own folder and its own Nginx configuration file (a "server block").

1. Create the folder and give it to Nginx's user: 

mkdir -p /var/www/example.com/public_html
chown -R www-data:www-data /var/www/example.com

2. Create /etc/nginx/sites-available/example.com: 

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    root /var/www/example.com/public_html;
    index index.php index.html;

    access_log /var/log/nginx/example.com-access.log;
    error_log /var/log/nginx/example.com-error.log;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
    }

    location ~ /\.ht {
        deny all;
    }
}

The try_files line sends requests for pages that don't exist as files to index.php, which is what WordPress and most PHP applications need for friendly URLs. The last block stops visitors from downloading any .htaccess files that come with an application.

3. Turn on the website, check the configuration and reload Nginx: 

ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
nginx -t
systemctl reload nginx

Optionally, turn off Nginx's default welcome page with unlink /etc/nginx/sites-enabled/default and reload Nginx.

Step 7: Test PHP

Create a test page in your website's folder: 

echo '<?php phpinfo();' > /var/www/example.com/public_html/info.php

Open http://example.com/info.php. You should see the PHP information page showing PHP 8.2 and Server API: FPM/FastCGI. Then delete the test page, because it shows details about your server that visitors shouldn't see: 

rm /var/www/example.com/public_html/info.php

Step 8: Create a database and user for your website

Log in to MariaDB as root: 

mariadb

Run these commands, replacing the database name, user name and password with your own (use a long, random password): 

CREATE DATABASE exampledb;
CREATE USER 'exampleuser'@'localhost' IDENTIFIED BY 'a-strong-password';
GRANT ALL PRIVILEGES ON exampledb.* TO 'exampleuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Your website's software connects with these details and host localhost. Upload your website's files to /var/www/example.com/public_html.

Step 9: Add a free SSL certificate

apt -y install certbot python3-certbot-nginx
certbot --nginx -d example.com -d www.example.com

Certbot asks for an email address for renewal notices, gets the certificate, and adds HTTPS to your website's Nginx configuration, including a redirect from HTTP to HTTPS.

Let's Encrypt certificates last 90 days. Automatic renewal is set up when Certbot is installed. To test it: 

certbot renew --dry-run

Keep your server updated

Install updates regularly, so you get security fixes for Nginx, MariaDB, PHP and the operating system: 

apt update
apt -y upgrade

To install security updates automatically, you can use the unattended-upgrades package.

Where to find things

Item Location
Nginx configuration /etc/nginx/ (websites in sites-available/, turned on with a link in sites-enabled/)
Nginx logs /var/log/nginx/
PHP settings /etc/php/8.2/fpm/php.ini
PHP-FPM settings /etc/php/8.2/fpm/pool.d/www.conf
MariaDB settings /etc/mysql/mariadb.conf.d/
Restart a service systemctl restart nginx (or php8.2-fpm, or mariadb)

If you have any questions, please open a support ticket from your client area.

Retrieved from "https://kb.acenet.us/index.php?title=LEMP_Server_Installation_Guide_on_Debian_12&oldid=2766"