Building a LEMP Server
from Scratch

sudo apt update && sudo apt upgrade -y
sudo reboot

# Find the Pi's IP from your router's DHCP client list
ssh [email protected]

# Accept the SSH fingerprint prompt: yes
# Then update immediately
sudo apt update && sudo apt upgrade -y
sudo reboot

ip link show
# Look for eth0, ens3, enp3s0, or similar — ignore lo

ip route show
# The "default via" line shows your gateway — typically 192.168.1.1

sudo cp /etc/netplan/00-installer-config.yaml \
         /etc/netplan/00-installer-config.yaml.bak

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:             # Replace with your interface name
      dhcp4: no
      addresses:
        - 192.168.1.50/24
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses:
          - 1.1.1.1
          - 8.8.8.8

sudo netplan try
sudo netplan apply
ip addr show eth0
ping -c 4 google.com

sudo bash -c \
  'echo "network: {config: disabled}" > \
  /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg'
sudo netplan apply
sudo reboot

sudo apt install -y openssh-server
sudo systemctl enable ssh
sudo systemctl start ssh

# Replace yourusername and IP with your actual values
ssh [email protected]

# Type yes to accept fingerprint on first connection
# PowerShell paste: right-click | Linux paste: Ctrl+Shift+V | macOS: Cmd+V

Rule         Protocol  Ext Port  Int Port  Destination
─────────────────────────────────────────────────────
HTTP Web     TCP       80        80        192.168.1.50
HTTPS Web    TCP       443       443       192.168.1.50

sudo apt update && sudo apt upgrade -y

sudo apt install -y nginx
sudo systemctl enable nginx
sudo systemctl start nginx
sudo systemctl status nginx

# Allow HTTP — port 80
sudo ufw allow 80/tcp

# Allow HTTPS — port 443
sudo ufw allow 443/tcp

# Allow SSH — port 22 (do not skip this)
sudo ufw allow 22/tcp

# Alternatively use the Nginx profile shortcut for 80 and 443:
# sudo ufw allow 'Nginx Full'

# Now enable the firewall — rules are already in place
sudo ufw enable

# Verify
sudo ufw status verbose

Status: active
Default: deny (incoming), allow (outgoing)

To          Action    From
--          ------    ----
80/tcp      ALLOW IN  Anywhere
443/tcp     ALLOW IN  Anywhere
22/tcp      ALLOW IN  Anywhere

sudo apt install -y mariadb-server
sudo systemctl enable mariadb
sudo systemctl start mariadb
sudo systemctl status mariadb

sudo mysql_secure_installation

-- Log into MariaDB as root
sudo mariadb -u root -p

CREATE DATABASE mywebsite_db;
CREATE USER 'webuser'@'localhost'
  IDENTIFIED BY 'YourStrongPassword123!';
GRANT ALL PRIVILEGES ON mywebsite_db.*
  TO 'webuser'@'localhost';
FLUSH PRIVILEGES;
SELECT user, host FROM mysql.user;
EXIT;

mariadb -u webuser -p
SHOW DATABASES;
# You should see mywebsite_db listed
EXIT;

sudo apt install -y \
  php8.3-fpm \
  php8.3-mysql \
  php8.3-cli \
  php8.3-common \
  php8.3-curl \
  php8.3-gd \
  php8.3-intl \
  php8.3-mbstring \
  php8.3-xml \
  php8.3-zip \
  php8.3-bcmath \
  php8.3-opcache

# Enable and start PHP-FPM
sudo systemctl enable php8.3-fpm
sudo systemctl start php8.3-fpm
sudo systemctl status php8.3-fpm

# Verify PHP version
php --version

# Nginx runs as www-data — set ownership of the web root
sudo chown -R www-data:www-data /var/www/html

# Add your own user to the www-data group
sudo usermod -aG www-data $USER

# Directories: 755 | Files: 644
sudo find /var/www/html -type d -exec chmod 755 {} \;
sudo find /var/www/html -type f -exec chmod 644 {} \;
newgrp www-data

sudo bash -c \
  'echo "<?php phpinfo(); ?>" > /var/www/html/phpinfo.php'
sudo chown www-data:www-data /var/www/html/phpinfo.php
sudo chmod 644 /var/www/html/phpinfo.php

sudo rm /var/www/html/phpinfo.php

sudo mkdir -p /var/www/example.com/public_html
sudo chown -R www-data:www-data /var/www/example.com
sudo chmod -R 755 /var/www/example.com

<?php
echo '<h1>Success! Your LEMP Server is Running.</h1>';
echo '<p>Nginx, PHP-FPM, and MariaDB are installed.</p>';
?>

sudo nano /var/www/example.com/public_html/index.php
# Paste the PHP above, then Ctrl+X, Y, Enter to save

server {
    listen       80;
    listen       [::]:80;
    server_name  example.com www.example.com;
    root         /var/www/example.com/public_html;
    index        index.php index.html index.htm;

    access_log   /var/log/nginx/example.com-access.log;
    error_log    /var/log/nginx/example.com-error.log;

    location / {
        try_files $uri $uri/ =404;
    }

    # Pass all .php requests to PHP-FPM
    location ~ \.php$ {
        include         snippets/fastcgi-php.conf;
        fastcgi_pass    unix:/run/php/php8.3-fpm.sock;
    }

    # Block access to .htaccess files
    location ~ /\.ht {
        deny all;
    }
}

# Create the symlink to enable the site
sudo ln -s /etc/nginx/sites-available/example.com \
          /etc/nginx/sites-enabled/

# Remove the default Nginx placeholder site
sudo rm /etc/nginx/sites-enabled/default

# Test the Nginx config for syntax errors
sudo nginx -t

# If output shows "test is successful", reload Nginx
sudo systemctl reload nginx

sudo apt install -y certbot python3-certbot-nginx
certbot --version

sudo certbot --nginx -d example.com -d www.example.com

sudo cat /etc/nginx/sites-available/example.com

server {
    listen       80;
    server_name  example.com www.example.com;
    # Certbot adds redirect to HTTPS:
    return 301 https://$host$request_uri;
}

server {
    listen       443 ssl;
    listen       [::]:443 ssl;
    server_name  example.com www.example.com;
    root         /var/www/example.com/public_html;
    index        index.php index.html;

    ssl_certificate
      /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key
      /etc/letsencrypt/live/example.com/privkey.pem;
    include
      /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam
      /etc/letsencrypt/ssl-dhparams.pem;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include      snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }

    location ~ /\.ht {
        deny all;
    }
}

sudo certbot renew --dry-run
sudo systemctl status certbot.timer
sudo certbot certificates

sudo mkdir -p /var/www/secondsite.com/public_html
sudo chown -R www-data:www-data /var/www/secondsite.com
sudo chmod -R 755 /var/www/secondsite.com

sudo bash -c 'cat > /var/www/secondsite.com/public_html/index.php << EOF
<?php echo "<h1>Welcome to Second Site!</h1>"; ?>
EOF'

server {
    listen       80;
    listen       [::]:80;
    server_name  secondsite.com www.secondsite.com;
    root         /var/www/secondsite.com/public_html;
    index        index.php index.html;

    access_log   /var/log/nginx/secondsite.com-access.log;
    error_log    /var/log/nginx/secondsite.com-error.log;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include      snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }

    location ~ /\.ht {
        deny all;
    }
}

sudo ln -s /etc/nginx/sites-available/secondsite.com \
          /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

sudo certbot --nginx -d secondsite.com -d www.secondsite.com

sudo certbot --nginx -d app.example.com

# HTTP — redirect all traffic to HTTPS
server {
    listen      80;
    server_name app.example.com;
    return 301 https://$host$request_uri;
}

# HTTPS — reverse proxy to internal service
server {
    listen      443 ssl;
    listen      [::]:443 ssl;
    server_name app.example.com;

    ssl_certificate
      /etc/letsencrypt/live/app.example.com/fullchain.pem;
    ssl_certificate_key
      /etc/letsencrypt/live/app.example.com/privkey.pem;
    include
      /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam
      /etc/letsencrypt/ssl-dhparams.pem;

    # Security header
    add_header Strict-Transport-Security
      "max-age=63072000; includeSubDomains; preload" always;

    # Forward all requests to the internal service
    location / {
        proxy_pass         http://192.168.1.42:4533;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header
          X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header
          X-Forwarded-Proto $scheme;
    }
}

sudo ln -s /etc/nginx/sites-available/app.example.com \
          /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx
curl -I https://app.example.com

Internet User
     │
     ▼  (HTTPS — server2.example.com)
[Your LEMP Server — Public IP]    ← Port 443
     │
     │  (HTTP — internal LAN)
     ▼
[Second Server — 192.168.1.51]    ← Port 80

sudo apt update && sudo apt install -y nginx
sudo systemctl enable nginx
sudo systemctl start nginx

sudo mkdir -p /var/www/website2/public_html
sudo chown -R www-data:www-data /var/www/website2
sudo chmod -R 755 /var/www/website2

sudo bash -c 'echo "<?php echo \
  \"<h1>Website 2 — Running on the Second Server</h1>\"; ?>" \
  > /var/www/website2/public_html/index.php'

server {
    listen       80;
    listen       [::]:80;
    server_name  server2.example.com;
    root         /var/www/website2/public_html;
    index        index.php index.html;

    access_log   /var/log/nginx/website2-access.log;
    error_log    /var/log/nginx/website2-error.log;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include      snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }

    location ~ /\.ht {
        deny all;
    }
}

sudo ln -s /etc/nginx/sites-available/website2 \
          /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx

Type:    A
Name:    server2   (becomes server2.example.com)
Value:   YOUR.PUBLIC.IP.ADDRESS
TTL:     Auto (or 3600)

sudo certbot --nginx -d server2.example.com

server {
    listen      80;
    server_name server2.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen      443 ssl;
    listen      [::]:443 ssl;
    server_name server2.example.com;

    ssl_certificate
      /etc/letsencrypt/live/server2.example.com/fullchain.pem;
    ssl_certificate_key
      /etc/letsencrypt/live/server2.example.com/privkey.pem;
    include
      /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam
      /etc/letsencrypt/ssl-dhparams.pem;

    add_header Strict-Transport-Security
      "max-age=63072000; includeSubDomains; preload" always;

    location / {
        proxy_pass
          http://192.168.1.51:80;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header
          X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header
          X-Forwarded-Proto $scheme;
    }
}

sudo ln -s /etc/nginx/sites-available/server2.example.com \
          /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx