Complete LEMP Stack Setup on Ubuntu 24.04 LTS: Nginx, MariaDB & PHP 8.3 FPM

[ Worldwide Client Traffic ]
             │ (HTTPS / HTTP/2 & HTTP/3 via TLS 1.3)
             ▼
┌─────────────────────────────────────────────────────────────┐
│ Linux Kernel Network Subsystem (sysctl net.core & tcp_bbr)  │
└────────────────────────────┬────────────────────────────────┘
                             │
                             ▼
┌─────────────────────────────────────────────────────────────┐
│ Nginx Event-Driven Master/Worker Architecture               │
│ - epoll event notification loop                             │
│ - Non-blocking static asset delivery (open_file_cache)      │
│ - FastCGI Microcaching & Rate Limiting Engine               │
└──────────────┬──────────────────────────────┬───────────────┘
               │                              │
(Static Files) │                              │ (FastCGI Request via
               ▼                              ▼  Unix Domain Socket)
┌──────────────────────────────┐ ┌────────────────────────────┐
│ Linux File System / NVMe SSD │ │ PHP 8.3 FPM Worker Pool    │
│ /var/www/html/public/        │ │ - OPcache Shared Memory    │
└──────────────────────────────┘ │ - JIT Compilation Engine   │
                                 │ - Static PM Process Model  │
                                 └─────────────┬──────────────┘
                                               │
                                               │ (Unix Socket / TCP 3306)
                                               ▼
                                 ┌────────────────────────────┐
                                 │ MariaDB 11.4 InnoDB Engine │
                                 │ - 75% RAM Buffer Pool      │
                                 │ - Adaptive Hash Indexing   │
                                 │ - ACID Transaction Logs    │
                                 └────────────────────────────┘

# Upgrade all core distribution packages
sudo apt-get update && sudo apt-get dist-upgrade -y

# Install foundational administration utilities
sudo apt-get install -y curl wget git ufw htop iotop net-tools software-properties-common \
  ca-certificates lsb-release apt-transport-https unzip chrony

sudo systemctl enable --now chrony
chronyc tracking

# Add official Nginx signing key
curl -fsSL https://nginx.org/keys/nginx_signing.key | sudo gpg --dearmor -o /etc/apt/keyrings/nginx.gpg

# Add the official Nginx mainline repository for Ubuntu 24.04
echo "deb [signed-by=/etc/apt/keyrings/nginx.gpg] http://nginx.org/packages/mainline/ubuntu $(lsb_release -cs) nginx" \
  | sudo tee /etc/apt/sources.list.d/nginx.list

# Install Nginx
sudo apt-get update
sudo apt-get install -y nginx
sudo systemctl enable --now nginx

user www-data;
worker_processes auto;
worker_rlimit_nofile 65535;
pid /var/run/nginx.pid;

events {
    worker_connections 8192;
    use epoll;
    multi_accept on;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # High-efficiency zero-copy disk I/O
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    server_tokens off;

    # Buffer allocations
    client_body_buffer_size 128k;
    client_max_body_size 64m;
    client_header_buffer_size 4k;
    large_client_header_buffers 4 16k;

    # Open file descriptor cache for static files
    open_file_cache max=10000 inactive=30s;
    open_file_cache_valid 60s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;

    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 5;
    gzip_min_length 256;
    gzip_types application/atom+xml application/javascript application/json application/ld+json 
               application/manifest+json application/rss+xml application/vnd.geo+json 
               application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json 
               font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest 
               text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

sudo mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled /etc/nginx/snippets

# Add MariaDB signing key and repository
sudo apt-get install -y apt-transport-https curl
curl -LsS https://r.mariadb.com/downloads/mariadb_repo_setup | sudo bash -s -- --mariadb-server-version="mariadb-11.4"

sudo apt-get update
sudo apt-get install -y mariadb-server mariadb-client
sudo systemctl enable --now mariadb

sudo mariadb-secure-installation

[mysqld]
# Network & General Settings
bind-address = 127.0.0.1
max_connections = 300
max_connect_errors = 10000
open_files_limit = 65535

# InnoDB Performance Architecture
innodb_buffer_pool_size = 5G
innodb_buffer_pool_instances = 4
innodb_log_file_size = 1G
innodb_log_buffer_size = 64M
innodb_flush_log_at_trx_commit = 2
innodb_flush_method = O_DIRECT
innodb_file_per_table = 1
innodb_read_io_threads = 8
innodb_write_io_threads = 8

# Temp Table and Memory Settings
tmp_table_size = 64M
max_heap_table_size = 64M
join_buffer_size = 4M
table_definition_cache = 4096
table_open_cache = 4096

# Binary Logging & Durability
sync_binlog = 0

sudo systemctl restart mariadb

# Add Ondrej Sury's official PHP PPA
sudo add-apt-repository ppa:ondrej/php -y
sudo apt-get update

# Install PHP 8.3 FPM and standard web modules
sudo apt-get install -y php8.3-fpm php8.3-cli php8.3-common php8.3-mysql \
  php8.3-zip php8.3-gd php8.3-mbstring php8.3-curl php8.3-xml php8.3-bcmath \
  php8.3-soap php8.3-intl php8.3-readline php8.3-redis php8.3-imagick \
  php8.3-opcache

expose_php = Off
memory_limit = 256M
max_execution_time = 60
max_input_time = 60
upload_max_filesize = 64M
post_max_size = 64M
max_input_vars = 5000
date.timezone = UTC
session.cookie_httponly = 1
session.cookie_secure = 1
session.use_strict_mode = 1

; Production OPcache Architecture
opcache.enable = 1
opcache.enable_cli = 0
opcache.memory_consumption = 256
opcache.interned_strings_buffer = 32
opcache.max_accelerated_files = 32531
opcache.revalidate_freq = 0
opcache.validate_timestamps = 1
opcache.save_comments = 1

[www]
user = www-data
group = www-data
listen = /run/php/php8.3-fpm.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660

; Static Worker Sizing: (Total RAM - OS/DB RAM) / Avg PHP Process (50MB)
; On an 8GB server with 5GB DB and 1GB OS, allocate 2GB to PHP: ~40 workers
pm = static
pm.max_children = 40
pm.max_requests = 1000

pm.status_path = /fpm-status
ping.path = /fpm-ping

catch_workers_output = yes
request_terminate_timeout = 60s

sudo systemctl restart php8.3-fpm
sudo systemctl enable php8.3-fpm

sudo mkdir -p /var/www/example.com/public
sudo chown -R www-data:www-data /var/www/example.com
sudo chmod -R 755 /var/www/example.com

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    root /var/www/example.com/public;
    index index.php index.html;

    # SSL Certificates (Managed by Certbot)
    # ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    # ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Logging
    access_log /var/log/nginx/example.com.access.log;
    error_log /var/log/nginx/example.com.error.log warn;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ .php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_intercept_errors on;
        fastcgi_buffer_size 128k;
        fastcgi_buffers 256 16k;
        fastcgi_busy_buffers_size 256k;
        fastcgi_temp_file_write_size 256k;
    }

    # Deny access to sensitive files
    location ~ /.(ht|git|env) {
        deny all;
    }

    location ~* .(jpg|jpeg|gif|png|webp|svg|woff|woff2|ttf|css|js|ico)$ {
        expires 365d;
        add_header Cache-Control "public, no-transform, immutable";
        access_log off;
    }
}

sudo ln -s /etc/nginx/sites-available/example.com.conf /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

sudo ss -tulpn