Haack's Wiki

User Tools

Site Tools

Trace: • fail2ban • selfhostedwp • nextcloud
computing:selfhostedwp

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
computing:selfhostedwp [2019/08/18 01:04] – oemb1905computing:selfhostedwp [2026/04/12 15:53] (current) – oemb1905
Line 11: Line 11:
 ------------------------------------------- -------------------------------------------
  
-This tutorial is for setting up a self-hosted WordPress instance on Debian GNU/Linux.  This tutorial assumes you already have a LAMP stack with active TLS.  If not, you should read the [[https://wiki.haacksnetworking.com/doku.php?id=computing:apachesurvival|Apache Survival]] tutorial first and set up a virtual host like the site1.com in that tutorial and then use it for this instance.  Once you get back over here, begin with some common php extensions needed for Word Press to function:+This tutorial is for setting up a self-hosted WordPress instance on Debian GNU/Linux. This tutorial assumes you have some familiarity setting up a LAMP stack. If you need help with that, check out [[https://wiki.haacksnetworking.com/doku.php?id=computing:apachesurvival|Apache Survival]]. Alright, let's install our LAMP stack and required/optional php modules. //Make sure to review what your instance requires and don't install or configure modules you don't need.//
  
-  sudo apt install php7.3-cgi php7.3-cli php7.3-zip php7.3-mysql php7.3-mbstring php7.3-intl php7.3-fpm php7.3-curl php7.3-gd php7.3-mbstring php-imagick php7.3-xml php7.3-xmlrpc wget unzip+  sudo apt install apache2 mariadb-server php8.4 php-common php-cgi php-cli php-zip php-mysql php-mbstring php-intl php-fpm php-curl php-gd php-imagick php-xml php-xmlrpc php-soap php-opcache php-apcu php-bcmath memcached wget unzip
      
-Move index.php to the top priority as follows:+Sometimes dpkg can choose which version of php you want and it's not always the version you want. In those cases, you can explicitly specify the version you need. Some packages are only available as ''php-xx'' so run the above command first and then the command below when those situations arise:
      
-  sudo nano /etc/apache2/mods-enabled/dir.conf +  sudo apt-get install php8.4-{common,cgi,cli,zip,mysql,mbstring,intl,fpm,curl,gd,imagick,xml,xmlrpc,soap,opcache,apcu,bcmath}
-  <DirectoryIndex index.php index.html index.cgi index.pl index.xhtml index.htm>+
      
-Above, we installed phpmyadmin, which you should secure as follows:+Apache2 will set up a 000-default.conf automatically and your host should now resolve. Be sure to set up TLS with certbot. Here's my preferred method:
  
-  sudo htpasswd -c /etc/apache2/.phpmyadmin phpmyadmin   +  sudo apt install certbot letsencrypt python3-certbot-apache 
-  sudo nano /usr/share/phpmyadmin/.htaccess+  sudo certbot --authenticator standalone --installer apache -d site1.com --pre-hook "systemctl stop apache2" --post-hook "systemctl start apache2" 
 +  crontab -e 
 +  <30 2 * * 1 /usr/bin/certbot renew >> /var/log/le-renew.log>
      
-Enter the following in the file that opens:+Once you have the LAMP stack setup and TLS properly configured, it's time to make some decisions on your php handler and your apache2 multi-processing module (mpm). There's extensive debate on this which you can read up on [[https://www.datadoghq.com/blog/monitoring-apache-web-server-performance/#prefork-mpm|here]]. In this tutorial, I've chosen not to use mpm_prefork and libapache2-mod-php. Instead I am using mpm_event and php-fpm. This is not necessary for many smaller instances or self-hosted scenarios. If you are new to self-hosting, simply run ''sudo apt install libapache2-mod-php8.x'' and remove the php-fpm and mpm_event steps below.
      
-  AuthType Basic +  sudo apt remove libapache2-mod-php* --purge 
-  AuthName "Restricted Files" +  sudo apt install php8.4-fpm php8.4-cgi 
-  AuthUserFile /etc/apache2/.phpmyadmin +  sudo a2enmod ssl 
-  Require valid-user+  sudo a2enmod headers 
 +  sudo a2enmod cache 
 +  sudo a2enmod rewrite 
 +  sudo a2enmod setenvif 
 +  sudo a2dismod php8.1 
 +  sudo a2dismod php8.2 
 +  sudo a2dismod php8.3 
 +  sudo a2dismod mpm_prefork 
 +  sudo a2enmod mpm_event 
 +  sudo a2enmod proxy 
 +  sudo a2enmod proxy_fcgi 
 +  sudo a2enconf php8.4-fpm 
 +  sudo a2enconf php8.4-cgi 
 +  sudo apache2ctl configtest   
 +  sudo systemctl restart apache2 
 +  sudo systemctl restart php8.4-fpm 
 + 
 +There are two standard ways to configure php-fpm. One of those is to use ProxyPassReverse, however, this will disable the use of .htaccess in your WordPress root which is not ideal. The next common way which I prefer and use here, is to add a FilesMatch condition to your virtual host as follows. Within the <Include> and </Include> portion of your default-ssl.conf virtual host, add something like: 
 + 
 +  <FilesMatch ".+\.ph(ar|p|tml)$"> 
 +      SetHandler "proxy:unix:/run/php/php8.4-fpm.sock|fcgi://localhost" 
 +  </FilesMatch> 
 + 
 +That takes care of configuring php-fpm and mpm_event. Before proceeding, navigate to your tld.domain in a web browser and make sure that your site resolves properly. If it does not, then you should debug your setup. To do that, there's three tools that can help: phpmyadmin, phpinfo page, and configuration checking. If your page does not even resolve, your first recourse should be to check the php handler, multi-processing modules, and your apache config files: 
 + 
 +  sudo apachectl -M | grep 'mpm' 
 +  sudo apachectl -M | grep 'proxy' 
 +  sudo apache2ctl configtest 
 + 
 +The output of mpm should show mpm_event and the output of proxy grep should show proxy_module and proxy_fcgi_module in use. If not, trace back over the steps above and see what went wrong. As for configtest, it should either tell you what's wrong or return "Syntax OK". If the output of the above commands is incorrect and/or you simply want a graphical way to check your handler and mult-processing module, then you can either create a phpinfo page or install phpadmin. There are many additional benefits to using phpmyadmin, so let's review how to install that first: 
 + 
 +  sudo apt install phpmyadmin 
 +  sudo htpasswd -c /etc/apache2/.phpmyadmin phpmyadmin   
 +  sudo nano /usr/share/phpmyadmin/.htaccess   
 +  <AuthType Basic> 
 +  <AuthName "Restricted Files"> 
 +  <AuthUserFile /etc/apache2/.phpmyadmin> 
 +  <Require valid-user> 
 + 
 +If you don't need something as heavy as phpmyadmin, you can optionally create a phpinfo page instead: 
 + 
 +  sudo nano /var/www/wordpress.com/public_html/info.php 
 +  sudo htpasswd -c /etc/apache2/.phpinfo phpinfo   
 +  sudo nano /usr/share/phpinfo/.htaccess   
 +  <AuthType Basic> 
 +  <AuthName "Restricted Files"> 
 +  <AuthUserFile /etc/apache2/.phpinfo> 
 +  <Require valid-user> 
 + 
 +Use these tools to make sure your handler and multi-processing module are configured to your preference and functional. After that's all working, let's make sure that your WordPress index.php is set to top priority as follows:
      
-Close and save the file.  Let's set up a database now for the WordPress instance:+  sudo nano /etc/apache2/mods-enabled/dir.conf 
 +  <DirectoryIndex //index.php// index.html index.cgi index.pl index.xhtml index.htm> 
 + 
 +Close and save the file. Let's now set up a database now for the WordPress instance as follows:
  
   sudo mysql -u root -p   sudo mysql -u root -p
-  mysql> CREATE DATABASE databasename DEFAULT CHARACTER SET utf8 COLLATE utf8_unicode_ci; +  CREATE DATABASE databasename DEFAULT CHARACTER SET utf8 COLLATE utf8_unicode_ci; 
-  mysql> GRANT ALL ON databasename.* TO 'databaseuser'@'localhost' IDENTIFIED BY 'passwordhere'; +  GRANT ALL ON databasename.* TO 'databaseuser'@'localhost' IDENTIFIED BY 'passwordhere'; 
-  mysql> FLUSH PRIVILEGES; +  FLUSH PRIVILEGES; 
-  mysql> EXIT;+  EXIT;
  
-Next up, it is time to allow overrides in your primary apache configuration:+Next up, it is time to allow overrides in your primary apache configuration. This is optional but/and it allows WordPress extensions to make configuration changes to .htaccess and/or other changes to the web server. It's often helpful, but you can leave it off if you prefer and configure everything manually.
  
   sudo nano /etc/apache2/apache2.conf   sudo nano /etc/apache2/apache2.conf
-  <Directory /var/www/> +  <AllowOverride All>
-  ... +
-  AllowOverride All +
-  ...+
      
-Okay, let's now enable fast cgi and rewrite php modules and then check your config. +Let's now shell into our instance and set up WordPress.
-   +
-  sudo a2enmod rewrite +
-  sudo a2enmod proxy_fcgi +
-  sudo apache2ctl configtest +
-   +
-If you have not set the fully qualified domain name, you may get an error - that can safely be ignored unless you desire it.  If you want to get rid of that, navigate to ''/etc/apache2/apache.conf'' and enter a ''ServerName''.  Otherwise, time to download Word Press:+
  
-  cd ~/Downloads +  ssh root@site1.com
-  mkdir wpdownload +
-  cd wpdownload+
   curl -O https://wordpress.org/latest.tar.gz   curl -O https://wordpress.org/latest.tar.gz
   tar xzvf latest.tar.gz   tar xzvf latest.tar.gz
-  touch ~/Downloads/wpdownload/wordpress/.htaccess +  mv wordpress /var/www/site1.com/public_html 
-  sudo chmod 660 ~/Downloads/wpdownload/wordpress/.htaccess +  
-  cp ~/Downloads/wpdownload/wordpress/wp-config-sample.php ~/Downloads/wpdownload/wordpress/wp-config.php +
-  mkdir ~/Downloads/wpdownload/wordpress/wp-content/upgrade +
 Okay, we will need the files and directories I created once we get it running.  Now, let's move the wordpress directory to the proper location for self-hosting. Okay, we will need the files and directories I created once we get it running.  Now, let's move the wordpress directory to the proper location for self-hosting.
  
-  sudo cp -ar ~/Downloads/wpdownload/wordpress/* /var/www/site1.com/public_html/ +  sudo mv ~/Downloads/wpdownload/wordpress /var/www/site1.com/public_html
-  sudo cp -ar ~/Downloads/wpdownload/wordpress/.htaccess /var/www/site1.com/public_html/+
  
-Now, let's set up permissions and ownership:+Now, create proper permissions for your Word Press directories and files:
  
   sudo chown -R www-data:www-data /var/www/site1.com/public_html   sudo chown -R www-data:www-data /var/www/site1.com/public_html
Line 79: Line 117:
   sudo chmod -R 755 /var/www/site1.com/public_html/wp-content/plugins   sudo chmod -R 755 /var/www/site1.com/public_html/wp-content/plugins
  
-Ok, time to grab 'secure values' from WP.com and then set up ''wp-config.php'' for the installation:+It's now time to configure your ''wp-config.php'' file. To do that, however, we need to replace the example salts in the configuration file with random ones from WordPress. They have an API tool that does that for us automatically:
      
   curl -s https://api.wordpress.org/secret-key/1.1/salt/   curl -s https://api.wordpress.org/secret-key/1.1/salt/
   sudo nano /var/www/site1.com/public_html/wp-config.php   sudo nano /var/www/site1.com/public_html/wp-config.php
-  <swap these into the proper section in the wp-config.php file> +  <Replace the example salts with those you just downloaded using copy/paste>
- +
-Enter user name and password for database in ''wp-config.php'': +
- +
-  sudo nano /var/www/site1.com/public_html/wp-config.php +
-  +
-It looks something like this: +
      
-  /** The name of the database for WordPress */ +Sometimes, for reasons I am not sure about, WordPress does not allow users direct uploading. If/when that happens, add the entry to wp-config.php. If anyone knows why this is needed, please let me know!
-  define('DB_NAME', 'database1name'); +
-   +
-  /** MySQL database username */ +
-  define('DB_USER', 'databaseuser'); +
-   +
-  /** MySQL database password */ +
-  define('DB_PASSWORD', 'passwdhere'); +
-   +
-Let's add the following line to the ''wp-config.php'' file for updates:+
  
   sudo nano /var/www/site1.com/public_html/wp-config.php   sudo nano /var/www/site1.com/public_html/wp-config.php
   <define('FS_METHOD','direct');>   <define('FS_METHOD','direct');>
-   
-Plug-ins and other WP services can mess with the ''.htaccess'' file often, so use this default configuration below //when that happens//; more templates can be found here:  [[https://codex.wordpress.org/htaccess|WP Codex]] 
  
-  sudo nano /var/www/site1.com/public_html/.htaccess +Let's now visit site1.com in a web browser. Enter the credentials that you created for the database above. Choose the settings you prefer and set up an admin account and record your credentials securely. You should now have a proper WordPress site! Now that you have a WordPress, check the SiteHealth tab and follow its advice and/or know why you don't. In my case, I typically adjust cache, rewrites, and headers. 
-   + 
-  # BEGIN WordPress +  apt install memcached 
-  <IfModule mod_rewrite.c> +  nano /etc/default/memcached 
-  RewriteEngine On +  <ENABLE_MEMCACHED=yes> 
-  RewriteBase / +  a2enmod cache 
-  RewriteRule ^index\.php$ - [L] +  a2enmod expires 
-  RewriteCond %{REQUEST_FILENAME} !-f +  a2enmod headers 
-  RewriteCond %{REQUEST_FILENAME} !-d +  a2enmod rewrite 
-  RewriteRule . /index.php [L] + 
-  </IfModule> +After isntalling memcached and enabling those modules, navigate to your web root and adjust your .htaccess as follows: 
-  # END WordPress+ 
 +<code> 
 +<IfModule mod_expires.c> 
 +    ExpiresActive On 
 +    ExpiresByType image/jpg "access 1 year" 
 +    ExpiresByType image/jpeg "access 1 year" 
 +    ExpiresByType image/gif "access 1 year" 
 +    ExpiresByType image/png "access 1 year" 
 +    ExpiresByType text/css "access 1 week" 
 +    ExpiresByType text/html "access 1 month" 
 +    ExpiresByType text/x-javascript "access 1 week" 
 +    ExpiresDefault "access 1 month" 
 +</IfModule> 
 +</code> 
 + 
 +<code> 
 +<IfModule mod_rewrite.c> 
 +    RewriteEngine On 
 +    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] 
 +    RewriteBase / 
 +    RewriteRule ^index\.php$ - [L] 
 +    RewriteCond %{REQUEST_FILENAME} !-f 
 +    RewriteCond %{REQUEST_FILENAME} !-d 
 +    RewriteRule . /index.php [L] 
 +    <FilesMatch "\.(js|css|jpe?g|png|gif|eot|otf|svg|ttf|woff2?)$"> 
 +        Header set Timing-Allow-Origin "*" 
 +    </FilesMatch> 
 +</IfModule> 
 +</code> 
 + 
 +<code> 
 +<IfModule mod_headers.c> 
 +    # X-origin core security headers 
 +    Header always set X-Content-Type-Options "nosniff" 
 +    Header always set X-Frame-Options "SAMEORIGIN" 
 +    Header always set Referrer-Policy "strict-origin-when-cross-origin" 
 +    # HSTS 
 +    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS 
 +    # Feature Policy 
 +    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), fullscreen=*" 
 +    # Cross Origin Openerand Embedder policies permissive for Gutenberg/iframes 
 +    Header always set Cross-Origin-Opener-Policy "same-origin-allow-popups" 
 +    Header always set Cross-Origin-Embedder-Policy "unsafe-none" 
 +    # Cache and download protections; limited to dynamic files 
 +    <FilesMatch "\.(php|html)$"> 
 +        Header set X-Download-Options "noopen" 
 +        Header set X-Permitted-Cross-Domain-Policies "none" 
 +        Header set Pragma "no-cache" 
 +        Header set Cache-Control "no-store, no-cache, must-revalidate, max-age=0" 
 +    </FilesMatch> 
 +    # Safe CSP for WordPress + Gutenberg  
 +    <FilesMatch "\.(php|html)$"> 
 +        Header set Content-Security-Policy "default-src 'self' https: data: blob:; \ 
 +            script-src 'self' https: data: blob: 'unsafe-inline' 'unsafe-eval'; \ 
 +            style-src 'self' https: data: 'unsafe-inline'; \ 
 +            img-src 'self' https: data: blob:; \ 
 +            font-src 'self' https: data:; \ 
 +            connect-src 'self' https: data: blob:; \ 
 +            frame-src 'self' https: data: blob:; \ 
 +            media-src 'self' https: data: blob:; \ 
 +            object-src 'none'; \ 
 +            base-uri 'self'; \ 
 +            form-action 'self'; \ 
 +            upgrade-insecure-requests;" 
 +    </FilesMatch> 
 +</IfModule> 
 +</code> 
 + 
 +I was getting a stubborn TLS redirect error for images. To address this, I went into ''/wp-content/themes/mytheme/header.php'' and added:
  
-Visit wordpress site and configure by opening a web browser of your choice and entering site1.com.  Follow the instructions it provides, especially if you do not have a publicly writeable ''wp-config.php'' file (which is a good thing).  If you need more than one site, but do not want to set up a separate virtual host, for example using ''subdomain.site1.com'', then you should read [[https://wiki.haacksnetworking.com/doku.php?id=computing:wpmultisite|Word Press Multisite]].+  /** added this to secure images **/ 
 +  <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
  
--- !old school, but good to know how to do! -- 
  
-You can optionally require an sftp server instead of using the default installer with the ''define('FS_METHOD','direct');'' php line.  Here's an example using proftp, which is still maintained:+Personally, I don't think anyone should be using ftp. Sftp is fine, and if someone needs that, here's an example of a simple sftp server using proftp. Note: you can also just use ssh nowadays as openssh-server includes a ready made sftp server. I retain this for historical knowledge.
  
   sudo apt install proftpd ftp ftp-ssl    sudo apt install proftpd ftp ftp-ssl 
-  <sudo apt install ftpd-ssl> (not sure if this is needed any longer)+  sudo a2enmod tls
   cd /etc/proftpd   cd /etc/proftpd
   sudo openssl req -new -x509 -days 7305 -nodes -out ftpd-rsa.pem -keyout ftpd-rsa-key.pem   sudo openssl req -new -x509 -days 7305 -nodes -out ftpd-rsa.pem -keyout ftpd-rsa-key.pem
   sudo nano /etc/proftpd/proftpd.conf   sudo nano /etc/proftpd/proftpd.conf
 +  <enter parameters>
      
 +Next, enter the TLS module in tls.conf underneath ''#Include /etc/proftpd/tls.conf'' and then restart the service: 
 +
 +  sudo nano /etc/proftpd/tls.conf
   <IfModule mod_tls.c>   <IfModule mod_tls.c>
      TLSEngine on      TLSEngine on
Line 144: Line 237:
      TLSOptions NoSessionReuseRequired      TLSOptions NoSessionReuseRequired
   </IfModule>   </IfModule>
 +  sudo systemctl restart proftpd.service
      
-Put this snippet under ''#Include /etc/proftpd/tls.conf'' and then restart the service:   +Refresh WordPress and it should see the sftp server and allow you to make changes that way. Note: The sftp server is public and anyone can access this with proper credentials even if it not for WordPress so use a proper password and make sure your TLS configuration is working. Your instance should now be pretty solid. The only other thing you might want is more than one WordPress site subdomain, for example, site1.cooldomain.com, site2.cooldomain.com, etc. If that's the case, then hop on over to my [[https://wiki.haacksnetworking.com/doku.php?id=computing:wpmultisite|Word Press Multisite]] tutorial. 
-   +
-  sudo systemctl restart proftpd.service +
- +
- +
-This tutorial is a designated "Invariant Section" of the "Technotronic" section of Haack's Wiki as described on the [[https://jonathanhaack.com/dokuwiki/doku.php?id=start|Start Page]].+
  
- --- //[[oemb1905@jonathanhaack.com|oemb1905]] 2019/08/09 05:32//+ --- //[[alerts@haacksnetworking.org|oemb1905]] 2026/04/12 15:47//
computing/selfhostedwp.1566090275.txt.gz · Last modified: by oemb1905

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: GNU Free Documentation License 1.3
GNU Free Documentation License 1.3 Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki