Magento open source is a fantastic platform. Get your stores online with Magento Setup. This tutorial you to setup Magento with high performance Web Server – Nginx and secure the same with Lets Encrypt SSL Certificate.
Pre-Requisites
- Server with Ubuntu – 18.0.4
- SSH – Enabled
- HTTP & HTTPS Ports enabled and should be accessible over the Web
SSH to your instance and let’s update and install dependencies, MySQL and Nginx
sudo apt update && sudo apt upgrade
sudo apt install unzip certbot
sudo apt-get -y install nginx
sudo apt install mysql-serverLet secure the Database & Create your DB Root Password
sudo mysql_secure_installationLogin to MySQL command line and execute the following queries to create database and user for magneto database access
CREATE DATABASE magentodb;
CREATE USER 'magentoadmin'@'localhost' IDENTIFIED BY 'yourpassword';
GRANT ALL PRIVILEGES ON magentodb.* TO ‘magentoadmin’@’localhost';
FLUSH PRIVILEGES;
exit;Next we want to create the magneto user, group, folder and give correct permissions
sudo useradd -m -U -r -d /opt/magento magento
sudo usermod -a -G magento www-data
mkdir /opt/magento/public_html
sudo chmod 750 /opt/magentoInstall PHP dependencies
sudo apt install php7.2-common php7.2-cli php7.2-fpm php7.2-opcache php7.2-gd php7.2-mysql php7.2-curl php7.2-intl php7.2-xsl php7.2-mbstring php7.2-zip php7.2-bcmath php7.2-soapConfigure PHP parameters for Magento requirements
sudo sed -i 's/memory_limit = .*/memory_limit = 2048M/' /etc/php/7.2/fpm/php.ini
sudo sed -i 's/upload_max_filesize = .*/upload_max_filesize = 256M/' /etc/php/7.2/fpm/php.ini
sudo sed -i 's/zlib.output_compression = .*/zlib.output_compression = on/' /etc/php/7.2/fpm/php.ini
sudo sed -i 's/max_execution_time = .*/max_execution_time = 18000/' /etc/php/7.2/fpm/php.ini
sudo sed -i 's/;date.timezone.*/date.timezone = UTC/' /etc/php/7.2/fpm/php.ini
sudo sed -i 's/;opcache.save_comments.*/opcache.save_comments = 1/' /etc/php/7.2/fpm/php.iniNow we will create PHP Magento Config File
vim /etc/php/7.2/fpm/pool.d/magento.conf
user = magento
group = www-data
listen.owner = magento
listen.group = www-data
listen = /var/run/php/php7.2-fpm-magento.sock
pm = ondemand
pm.max_children = 50
pm.process_idle_timeout = 10s
pm.max_requests = 500
chdir = /Restart PHP FPM to reload the config
sudo systemctl restart php7.2-fpmNow Let’s Download and Install composer
curl -sS https://getcomposer.org/installer -o composer-setup.php
php composer-setup.php --install-dir=/usr/local/bin --filename=composerFor better security, we want to generate a Diffie-Hellman parameters strong enough
sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096Now let us install Magento via the composer method
sudo su — magento
composer create-project — repository-url=https://repo.magento.com/ magento/project-community-edition /opt/magento/public_html
cd ~/public_html
php bin/magento setup:install --base-url=https://yourwebsite.com/ --base-url-secure=https://mywebsite.com/ --admin-firstname=FirstName --admin-lastname=LastName --admin-email="[email protected]" --admin-user=admin --admin-password="youradminpassword" --db-host=localhost --db-name=magentodb --db-user=magentoadmin --db-password=yourdbpassword --currency=USD --timezone=America/Chicago --use-rewrites=1
php ~/public_html/bin/magento cron:installCreate Config File
sudo vim /etc/nginx/sites-available/mywebsite.comAdd below mentioned configuration in above mentioned file “mywebsite.com”
upstream fastcgi_backend {
server unix:/var/run/php/php7.2-fpm-magento.sock;
}
server {
listen 80;
server_name mywebsite.com;
include snippets/letsencrypt.conf;
return 301 https://mywebsite.com$request_uri;
}
server {
listen 443 ssl http2;
server_name mywebsite.com;
ssl_certificate /etc/letsencrypt/live/mywebsite.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mywebsite.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/mywebsite.com/chain.pem;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS";
ssl_prefer_server_ciphers on;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 30s;
keepalive_timeout 300s;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
include snippets/letsencrypt.conf;
set $MAGE_ROOT /opt/magento/public_html;
set $MAGE_MODE developer; # or production
access_log /var/log/nginx/mywebsite.com-access.log;
error_log /var/log/nginx/mywebsite.com-error.log;
include /opt/magento/public_html/nginx.conf.sample;
}Create Link
ln -s /etc/magento/sites-available/mywebsite.com /etc/magento/sites-enabled/Test, Reload and Restart Nginx Service
nginx -t
sudo service nginx reload
sudo service nginx restartNow We will secure the same using Let’s Encrypt Certificate. Switch to Root user and perform below mentioned steps
sudo su
mkdir -p /var/lib/letsencrypt/.well-known
chgrp www-data /var/lib/letsencrypt
chmod g+s /var/lib/letsencryptCreate Config for Letsencrypt
vim /etc/nginx/snippets/letsencrypt.conf
#Add below mentioned content in above conf file.
location ^~ /.well-known/acme-challenge/ {
allow all;
default_type “text/plain”;
rewrite /.well-known/acme-challenge/(.*) /$1 break;
root /var/lib/letsencrypt/;
try_files $uri =404;
}Generate Certificate (Make sure – your web server is reachable using host name). Certificate generated will be valid for 90 Days.
sudo certbot certonly — agree-tos — email [email protected] — webroot -w /var/lib/letsencrypt/ -d mywebsite.comCreate Cron Job to Automatically renew your Lets Encrypt Certificate
vim /etc/cron.d/certbot
0 */12 * * * root abc -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e ‘sleep int(rand(3600))’ && certbot -q renew — renew-hook “systemctl reload nginx”Create CRON Job to Automatically renew your Lets Encrypt Certificate
sudo service nginx reload
sudo service nginx restart