Ubuntu Server LEMP Setup script

README.md

How to Install

• Download script curl -fsSL https://gist.githubusercontent.com/EmranAhmed/a1a61b710f72317c775715fe1509e99d/raw/bootstrap.sh | bash -s
• Make it executable chmod +x bootstrap.sh

How to use

• ./bootstrap.sh --domain=domain.com --user=myname

bootstrap.sh

#!/usr/bin/env bash

set -euo pipefail

DEBIAN_FRONTEND="noninteractive"

# Default values for parameters
DEFAULT_PHP_VERSION=8.3
DEFAULT_NODE_VERSION=20
DEFAULT_DOMAIN="example.test"
DEFAULT_USER="example"
DEFAULT_MYSQL_PASSWORD=$(openssl rand -base64 10)
NGINX_WORKER_CONNECTIONS=$(ulimit -n)

# Initialize parameters with default values
PHP_VERSION=$DEFAULT_PHP_VERSION
NODE_VERSION=$DEFAULT_NODE_VERSION
MYSQL_PASSWORD=$DEFAULT_MYSQL_PASSWORD
DOMAIN=""
CUSTOM_USER=""


# Function to display help text
show_help() {
  echo "Usage: $0 [options]"
  echo ""
  echo "Options:"
  echo "  --domain=         Specify the domain (default: $DEFAULT_DOMAIN)"
  echo "  --php=            Specify the php version (default: $DEFAULT_PHP_VERSION)"
  echo "  --node=           Specify the NodeJS version (default: $DEFAULT_NODE_VERSION)"
  echo "  --mysql-password= Specify the MySQL Password (default: Randomly generated)"
  echo "  --help            Display this help and exit"
}

# Parse the command line arguments
for arg in "$@"; do
  case $arg in
    --php=*)
    PHP_VERSION="${arg#*=}"
    shift # Remove --php= from processing
    ;;
    --node=*)
    NODE_VERSION="${arg#*=}"
    shift # Remove --node= from processing
    ;;
    --mysql-password=*)
    MYSQL_PASSWORD="${arg#*=}"
    shift # Remove --mysql-password= from processing
    ;;
    --domain=*)
    DOMAIN="${arg#*=}"
    shift # Remove --domain= from processing
    ;;
    --user=*)
    CUSTOM_USER="${arg#*=}"
    shift # Remove --user= from processing
    ;;
    --help)
    show_help
    exit 0
    ;;
    *)
    echo "Unknown option: $arg"
    show_help
    exit 1
    ;;
  esac
done

if [ -z "$DOMAIN" ]; then
  read -p "Enter domain [default: $DEFAULT_DOMAIN]: " DOMAIN
  DOMAIN=${DOMAIN:-$DEFAULT_DOMAIN}
fi

if [ -z "$CUSTOM_USER" ]; then
  read -p "Enter username [default: $DEFAULT_USER]: " CUSTOM_USER
  CUSTOM_USER=${CUSTOM_USER:-$DEFAULT_USER}
fi

# configure mysql with random password
debconf-set-selections <<< "mariadb-server mysql-server/root_password password $MYSQL_PASSWORD"
debconf-set-selections <<< "mariadb-server mysql-server/root_password_again password $MYSQL_PASSWORD"
echo $MYSQL_PASSWORD > /root/.mysql_password

# for certbot 
add-apt-repository universe -yq

# install common packages
apt update -q && apt install -yq \
    apt-utils software-properties-common \
    rsync git git-core htop zip unzip ufw apt-transport-https \
    ca-certificates gnupg git ufw zip unzip curl wget \
    nginx libnginx-mod-http-cache-purge certbot python3-certbot-nginx \
    redis-server supervisor mariadb-server

# ufw configiguration

ufw allow ssh
ufw allow http
ufw allow https
ufw allow redis
ufw allow mysql
ufw enable


# Add system user with custom home directory
useradd -m -d /srv/$CUSTOM_USER -s /bin/bash $CUSTOM_USER
mkdir -p /srv/$CUSTOM_USER/{apps,logs,ssl}
mkdir -p /srv/$CUSTOM_USER/apps/$DOMAIN/releases
mkdir -p /srv/$CUSTOM_USER/logs/{nginx,php,mysql,supervisor,ssl}
chown -R $CUSTOM_USER:$CUSTOM_USER /srv/$CUSTOM_USER
chmod 755 /srv/$CUSTOM_USER

# install php and extensions
add-apt-repository -y ppa:ondrej/php
apt update -q
apt install -yq \
    php$PHP_VERSION-{common,cli,opcache,fpm,mysql,mbstring,xml,curl,zip,gd,imagick,bcmath,redis,intl,soap,sqlite3}

# create php-fpm pool
cat > /etc/php/$PHP_VERSION/fpm/pool.d/$CUSTOM_USER.conf <<EOF
[$CUSTOM_USER]
user = $CUSTOM_USER
group = $CUSTOM_USER
listen = /run/php/php$PHP_VERSION-fpm-$CUSTOM_USER.sock
listen.owner = www-data
listen.group = www-data
pm = dynamic
pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3
access.log = /srv/$CUSTOM_USER/logs/php/$CUSTOM_USER.access.log
slowlog = /srv/$CUSTOM_USER/logs/php/$CUSTOM_USER.slow.log
php_admin_value[error_log] = /srv/$CUSTOM_USER/logs/php/$CUSTOM_USER.error.log
EOF

systemctl restart php$PHP_VERSION-fpm

# install composer
curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer

# install wp-cli
curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
chmod +x wp-cli.phar && mv wp-cli.phar /usr/local/bin/wp

# install nodejs
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg
echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_VERSION.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list
apt update -q && apt install -yq nodejs

# install yarn and pm2
npm install -g yarn pm2

# install laravel
cd /srv/$CUSTOM_USER/apps/$DOMAIN/releases
RELEASE_NAME=$(date +%s)
sudo -u $CUSTOM_USER composer create-project laravel/laravel $RELEASE_NAME
sudo -u $CUSTOM_USER ln -nfs /srv/$CUSTOM_USER/apps/$DOMAIN/releases/$RELEASE_NAME /srv/$CUSTOM_USER/apps/$DOMAIN/current
sudo -u $CUSTOM_USER mv /srv/$CUSTOM_USER/apps/$DOMAIN/releases/$RELEASE_NAME/storage /srv/$CUSTOM_USER/apps/$DOMAIN/storage
sudo -u $CUSTOM_USER mv /srv/$CUSTOM_USER/apps/$DOMAIN/releases/$RELEASE_NAME/.env /srv/$CUSTOM_USER/apps/$DOMAIN/.env
sudo -u $CUSTOM_USER ln -nfs /srv/$CUSTOM_USER/apps/$DOMAIN/.env /srv/$CUSTOM_USER/apps/$DOMAIN/releases/$RELEASE_NAME/.env
sudo -u $CUSTOM_USER ln -nfs /srv/$CUSTOM_USER/apps/$DOMAIN/storage /srv/$CUSTOM_USER/apps/$DOMAIN/releases/$RELEASE_NAME/storage
sudo -u $CUSTOM_USER ln -nfs /srv/$CUSTOM_USER/apps/$DOMAIN/storage/app/public /srv/$CUSTOM_USER/apps/$DOMAIN/releases/$RELEASE_NAME/public/storage

# create site based nginx config
cat > /etc/nginx/sites-available/$DOMAIN <<EOF
server {
    listen 80;
    listen [::]:80;
    server_name $DOMAIN;
    root /srv/$CUSTOM_USER/apps/$DOMAIN/current/public;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";

    index index.html index.php;

    charset utf-8;

    location / {
        try_files \$uri \$uri/ /index.php?\$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    # error_log /srv/$CUSTOM_USER/logs/nginx/$DOMAIN.error.log;
    # access_log /srv/$CUSTOM_USER/logs/nginx/$DOMAIN.access.log;

    error_page 404 /index.php;

    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php$PHP_VERSION-fpm-$CUSTOM_USER.sock;
        fastcgi_param SCRIPT_FILENAME \$realpath_root\$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }
}
EOF

# remove default nginx config

rm /etc/nginx/sites-enabled/default

# enable nginx config
ln -s /etc/nginx/sites-available/$DOMAIN /etc/nginx/sites-enabled/$DOMAIN

systemctl restart nginx

# install lets encrypt

openssl dhparam -out /etc/nginx/dhparam.pem 2048
mkdir -p /opt/www/_letsencrypt
chown www-data /opt/www/_letsencrypt

certbot certonly --non-interactive --webroot -d $DOMAIN --email info@$DOMAIN -w /opt/www/_letsencrypt -n --agree-tos --force-renewal


cat > /etc/nginx/nginx.conf <<EOF
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections $NGINX_WORKER_CONNECTIONS;
    multi_accept on;
}

http {

    ##
    # Basic Settings
    ##

    charset                 utf-8;
    sendfile                on;
    tcp_nopush              on;
    tcp_nodelay             on;
    server_tokens           off;
    log_not_found           off;
    types_hash_max_size     2048;
    types_hash_bucket_size  64;
    client_max_body_size    64M; # File Upload Limit
    client_body_buffer_size 64M;
    keepalive_timeout       60; # Fixing upstream timed out (110: Connection timed out)...

    ##
    # MIME
    ##


    include /etc/nginx/mime.types;
    default_type application/octet-stream;


    ##
    # SSL Settings
    ##

    ssl_session_timeout    1d;
    ssl_session_cache      shared:SSL:10m;
    ssl_session_tickets    off;


    ##
    # Diffie-Hellman parameter for DHE ciphersuites
    ##

    ssl_dhparam            /etc/nginx/dhparam.pem;


    # Mozilla Intermediate configuration
    # based on https://nginxconfig.io/

    ssl_protocols          TLSv1.2 TLSv1.3;
    ssl_ciphers            ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

    
    # OCSP Stapling

    ssl_stapling           on;
    ssl_stapling_verify    on;
    resolver               1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
    resolver_timeout       2s;


    ##
    # Logging Settings
    ##

    access_log off;
    error_log /srv/$CUSTOM_USER/logs/nginx/$DOMAIN.error.log warn;

    ##
    # Gzip Settings
    ##

    gzip            on;
    gzip_vary       on;
    gzip_proxied    any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types      text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;


    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}
EOF

cat > /etc/nginx/sites-available/$DOMAIN <<EOF
server {
    listen 80;
    listen [::]:80;
    
    server_name $DOMAIN;

    # ACME-challenge
    location ^~ /.well-known/acme-challenge/ {
        root /opt/www/_letsencrypt;
    }

    location / {
        return 301 https://$DOMAIN\$request_uri;
    }
}

server {

    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;

    server_name $DOMAIN;
    root /srv/$CUSTOM_USER/apps/$DOMAIN/current/public;
    index index.html index.php;
    charset utf-8;

    # SSL
    ssl_certificate             /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
    ssl_certificate_key         /etc/letsencrypt/live/$DOMAIN/privkey.pem;
    ssl_trusted_certificate     /etc/letsencrypt/live/$DOMAIN/chain.pem;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";

    location / {
        try_files \$uri \$uri/ /index.php?\$args;

    }

    location ~ \.php$ {

        
        include snippets/fastcgi-php.conf;
        
        
        fastcgi_buffers               16 32k;
        fastcgi_buffer_size           64k;
    
        # Config for issue: 110: Connection Time Out
        fastcgi_read_timeout 600s;
        fastcgi_send_timeout 600s;
        fastcgi_connect_timeout 600s;


        fastcgi_pass unix:/run/php/php$PHP_VERSION-fpm-$CUSTOM_USER.sock;
    }


    # assets, media
    location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
            expires    7d;
            access_log off;
    }

    # svg, fonts
    location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
        add_header Access-Control-Allow-Origin "*";
        expires    7d;
        access_log off;
    }

    # Global restrictions configuration file.
    # Designed to be included in any server {} block.
    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }
     
    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }
     
    # Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
    # Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban)

    # . files
    location ~ /\.(?!well-known) {
        deny all;
    }

}

EOF

systemctl restart nginx

# update php config

declare -A php_config

php_config["upload_max_filesize"]="64M"
php_config["max_input_vars"]="2000"
php_config["post_max_size"]="256M"
php_config["memory_limit"]="128M"
php_config["max_execution_time"]="60"

for key in ${!php_config[@]}; do
 sed -i "s/^;\?\($key\).*/\1=${php_config[$key]}/" /etc/php/$PHP_VERSION/fpm/php.ini
done

systemctl restart php$PHP_VERSION-fpm

# install crontab
echo "* * * * * cd /srv/$CUSTOM_USER/apps/$DOMAIN/current && php artisan schedule:run >> /dev/null 2>&1" >> /var/spool/cron/crontabs/$CUSTOM_USER
chown $CUSTOM_USER:crontab /var/spool/cron/crontabs/$CUSTOM_USER
chmod 600 /var/spool/cron/crontabs/$CUSTOM_USER
systemctl restart cron

# install supervisor config
cat > /etc/supervisor/conf.d/$DOMAIN.conf <<EOF
[program:$DOMAIN]
process_name=%(program_name)s_%(process_num)02d
; if you are using horizon uncomment below line and comment queue worker line
;command=php /srv/$CUSTOM_USER/apps/$DOMAIN/current/artisan horizon
; if you are using queue worker uncomment below line and comment horizon line
command=php /srv/$CUSTOM_USER/apps/$DOMAIN/current/artisan queue:work --sleep=3 --tries=3
autostart=true
autorestart=true
user=$CUSTOM_USER
numprocs=1
redirect_stderr=true
stdout_logfile=/srv/$CUSTOM_USER/logs/supervisor/$DOMAIN.log
EOF

supervisorctl reread
supervisorctl update

echo "127.0.0.1 $DOMAIN" >> /etc/hosts
echo $DOMAIN > /etc/hostname
hostname -F /etc/hostname