4 min read

This guide is for GoZen VPS and Cloud servers.

LEMP is Linux + Nginx + MySQL/MariaDB + PHP. It’s the modern alternative to LAMP (which uses Apache). Nginx handles static files faster and uses less memory. It’s the better choice for most workloads.

This guide assumes you’ve completed initial server setup: non-root user, SSH keys, and a firewall.

Install Nginx 

  sudo apt update
sudo apt install nginx -y
sudo systemctl enable nginx
sudo systemctl start nginx
  
  sudo dnf install nginx -y
sudo systemctl enable nginx
sudo systemctl start nginx

Open HTTP and HTTPS in the firewall:

  sudo ufw allow 'Nginx Full'     # UFW (Ubuntu/Debian)
# or
sudo firewall-cmd --permanent --add-service={http,https} && sudo firewall-cmd --reload   # firewalld (Rocky/Alma)

Open your server’s IP in a browser. You should see the Nginx welcome page.

Install MariaDB

MariaDB is a drop-in MySQL replacement and the default MySQL-compatible server on Debian, Ubuntu, and Rocky/AlmaLinux.

  sudo apt install mariadb-server -y
sudo systemctl enable mariadb
sudo systemctl start mariadb
  
  sudo dnf install mariadb-server -y
sudo systemctl enable mariadb
sudo systemctl start mariadb

Secure the Installation 

  sudo mysql_secure_installation

Answer the prompts:

PromptAnswer
Set root password?Y (set a strong password)
Remove anonymous users?Y
Disallow root login remotely?Y
Remove test database?Y
Reload privilege tables?Y

Create a Database and User 

  sudo mysql
  
  CREATE DATABASE myapp;
CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'your-strong-password';
GRANT ALL PRIVILEGES ON myapp.* TO 'appuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Install PHP

This guide installs PHP 8.4.

  # Add the PHP PPA (Ubuntu only) for PHP 8.4
sudo apt install software-properties-common -y
sudo add-apt-repository ppa:ondrej/php -y
sudo apt update

# Install PHP 8.4 with common extensions
sudo apt install php8.4-fpm php8.4-mysql php8.4-mbstring php8.4-xml php8.4-curl php8.4-zip php8.4-gd php8.4-intl -y
  
  # PPAs don't work on Debian. Add the packages.sury.org repository instead
sudo apt install -y lsb-release ca-certificates curl
sudo curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
sudo dpkg -i /tmp/debsuryorg-archive-keyring.deb
sudo sh -c 'echo "deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'
sudo apt update

# Install PHP 8.4 with common extensions
sudo apt install php8.4-fpm php8.4-mysql php8.4-mbstring php8.4-xml php8.4-curl php8.4-zip php8.4-gd php8.4-intl -y
  
  # Enable the Remi repository (commands for release 9; see rpms.remirepo.net/wizard/ for others)
sudo dnf install epel-release -y
sudo dnf install https://rpms.remirepo.net/enterprise/remi-release-$(rpm -E %{rhel}).rpm -y
sudo dnf module enable php:remi-8.4 -y

# Install PHP 8.4 with common extensions
sudo dnf install php-fpm php-mysqlnd php-mbstring php-xml php-curl php-zip php-gd php-intl -y

Start PHP-FPM:

  sudo systemctl enable --now php8.4-fpm    # Ubuntu/Debian
sudo systemctl enable --now php-fpm       # Rocky/Alma

Configure Nginx for PHP

Create a site configuration:

  sudo nano /etc/nginx/sites-available/mysite
  
  server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    root /var/www/mysite;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php8.4-fpm.sock;
    }

    location ~ /\.ht {
        deny all;
    }

    # Static file caching
    location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff2)$ {
        expires 30d;
        add_header Cache-Control "public";
    }
}

Enable the site:

  sudo ln -s /etc/nginx/sites-available/mysite /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default    # Remove default site
sudo nginx -t
sudo systemctl reload nginx

Rocky and AlmaLinux have no sites-available directory or snippets/fastcgi-php.conf. Server blocks go in /etc/nginx/conf.d/, and PHP-FPM listens on /run/php-fpm/www.sock.

Make PHP-FPM run as the nginx user. In /etc/php-fpm.d/www.conf, set:

  user = nginx
group = nginx

Then restart PHP-FPM and create the site configuration:

  sudo systemctl restart php-fpm
sudo nano /etc/nginx/conf.d/mysite.conf
  
  server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    root /var/www/mysite;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        try_files $uri =404;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass unix:/run/php-fpm/www.sock;
    }

    location ~ /\.ht {
        deny all;
    }

    # Static file caching
    location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff2)$ {
        expires 30d;
        add_header Cache-Control "public";
    }
}
  
  sudo nginx -t
sudo systemctl reload nginx

Only add immutable to the Cache-Control header if your asset filenames change on every release (for example style.3f9a1c.css). Otherwise browsers keep serving old CSS and JS after you update the site.

Verify the Stack

Create a test file:

  sudo mkdir -p /var/www/mysite
echo '<?php phpinfo(); ?>' | sudo tee /var/www/mysite/index.php
sudo chown -R www-data:www-data /var/www/mysite    # Ubuntu/Debian
sudo chown -R nginx:nginx /var/www/mysite          # Rocky/Alma

Visit http://yourdomain.com (or your server IP). You should see the PHP info page.

Add SSL with Let’s Encrypt 

  sudo apt install certbot python3-certbot-nginx -y    # Ubuntu/Debian
sudo dnf install certbot python3-certbot-nginx -y    # Rocky/Alma (from EPEL)
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Certbot auto-configures Nginx for HTTPS and sets up auto-renewal.

Test the renewal:

  sudo certbot renew --dry-run

Stack Summary

ComponentVersionConfig Location
NginxLatest from package manager/etc/nginx/
MariaDBYour distro’s packaged version/etc/mysql/ (Ubuntu/Debian), /etc/my.cnf.d/ (Rocky/Alma)
PHP-FPM8.4/etc/php/8.4/fpm/ (Ubuntu/Debian), /etc/php-fpm.d/ (Rocky/Alma)
CertbotLatestAuto-managed in /etc/letsencrypt/

What to Do Next

Last updated 21 Oct 2026, 00:00 +0300. history

Was this page helpful?