Initial Server Setup for AlmaLinux 9

dnf update -y

reboot

dnf install epel-release -y

# Set the hostname
hostnamectl set-hostname your-server.example.com

# Set timezone to UTC (recommended for servers)
timedatectl set-timezone UTC

# Verify
hostnamectl
timedatectl

# Create a new user (replace 'deploy' with your preferred username)
adduser deploy

# Set a password
passwd deploy

# Add to the wheel group for sudo access
usermod -aG wheel deploy

# As root, copy the authorized_keys file
rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy

ssh deploy@YOUR_SERVER_IP

sudo nano /etc/ssh/sshd_config

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

sudo systemctl restart sshd

# Ensure firewalld is running
sudo systemctl enable firewalld
sudo systemctl start firewalld

# Allow SSH (usually enabled by default)
sudo firewall-cmd --permanent --add-service=ssh

# Allow HTTP and HTTPS for web traffic
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https

# Reload to apply changes
sudo firewall-cmd --reload

# Verify active rules
sudo firewall-cmd --list-all

# View current status
sestatus

# Should show: SELinux status: enabled, Current mode: enforcing

sudo dnf install policycoreutils-python-utils setroubleshoot-server -y

# Create a 2G swap file
sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

# Make it permanent
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

# Verify
free -h

# Install dnf-automatic
sudo dnf install dnf-automatic -y

# Configure for security updates only
sudo sed -i 's/apply_updates = no/apply_updates = yes/' /etc/dnf/automatic.conf
sudo sed -i 's/upgrade_type = default/upgrade_type = security/' /etc/dnf/automatic.conf

# Enable and start the timer
sudo systemctl enable --now dnf-automatic.timer

# Verify the timer is active
sudo systemctl status dnf-automatic.timer

sudo dnf install nginx -y
sudo systemctl enable nginx
sudo systemctl start nginx

# Allow Nginx/PHP to make network connections
sudo setsebool -P httpd_can_network_connect 1

# Allow Nginx/PHP to connect to databases
sudo setsebool -P httpd_can_network_connect_db 1

# Allow Nginx/PHP to send mail
sudo setsebool -P httpd_can_sendmail 1

sudo dnf install mariadb-server -y
sudo systemctl enable mariadb
sudo systemctl start mariadb

sudo mysql_secure_installation

sudo dnf install php-fpm php-mysqlnd php-cli php-curl php-gd php-mbstring php-xml php-zip php-json php-opcache -y

sudo sed -i 's/user = apache/user = nginx/' /etc/php-fpm.d/www.conf
sudo sed -i 's/group = apache/group = nginx/' /etc/php-fpm.d/www.conf
sudo sed -i 's/listen.owner = nobody/listen.owner = nginx/' /etc/php-fpm.d/www.conf
sudo sed -i 's/listen.group = nobody/listen.group = nginx/' /etc/php-fpm.d/www.conf

sudo systemctl enable php-fpm
sudo systemctl start php-fpm

php -v
sudo systemctl status php-fpm

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com/html;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php-fpm/www.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny all;
    }
}

# Create the web root
sudo mkdir -p /var/www/example.com/html
sudo chown -R nginx:nginx /var/www/example.com

# Save the config above to:
sudo nano /etc/nginx/conf.d/example.com.conf

# Set SELinux context for the web root
sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/example.com(/.*)?"
sudo restorecon -Rv /var/www/example.com

# Test and reload
sudo nginx -t
sudo systemctl reload nginx

echo '<?php phpinfo(); ?>' | sudo tee /var/www/example.com/html/info.php

sudo rm /var/www/example.com/html/info.php

sudo dnf install httpd -y
sudo systemctl enable httpd
sudo systemctl start httpd

sudo dnf install mariadb-server -y
sudo systemctl enable mariadb
sudo systemctl start mariadb
sudo mysql_secure_installation

sudo dnf install php php-mysqlnd php-cli php-curl php-gd php-mbstring php-xml php-zip php-json php-opcache -y

# Restart Apache to load the PHP module
sudo systemctl restart httpd

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/example.com/html

    <Directory /var/www/example.com/html>
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog /var/log/httpd/example.com-error.log
    CustomLog /var/log/httpd/example.com-access.log combined
</VirtualHost>

# Create web root
sudo mkdir -p /var/www/example.com/html
sudo chown -R apache:apache /var/www/example.com

# Save the config above to:
sudo nano /etc/httpd/conf.d/example.com.conf

# Set SELinux context for the web root
sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/example.com(/.*)?"
sudo restorecon -Rv /var/www/example.com

# Test and reload
sudo apachectl configtest
sudo systemctl reload httpd

echo '<?php phpinfo(); ?>' | sudo tee /var/www/example.com/html/info.php
# Visit http://example.com/info.php, then remove:
sudo rm /var/www/example.com/html/info.php

# Install Certbot (requires EPEL)
sudo dnf install epel-release -y

# For Nginx
sudo dnf install certbot python3-certbot-nginx -y
sudo certbot --nginx -d example.com -d www.example.com

# For Apache
sudo dnf install certbot python3-certbot-apache -y
sudo certbot --apache -d example.com -d www.example.com

# Verify auto-renewal
sudo certbot renew --dry-run