New server checklist #

This checklist is for system administrators who build a machine that will host Exponential sites. Work through it top to bottom; each item links to the page with the details. The order matters: the test installation at the end checks most of what comes before.

Server: <name>          Built by: <name>          Date: <date>          Plan(s): <plans this server serves>

Operating system #

• To do: A tier 1 or tier 2 system from Operating system support (for example AlmaLinux 9, Red Hat Enterprise Linux 9 or 10 and rebuilds, Debian 12 or 13, Ubuntu 22.04 or 24.04).
• To do: Security updates applied; automatic security updates decided.
• To do: Time synchronization running; time zone set.
• To do: Firewall: only the ports the engine or web server, SSH and your monitoring need.
• To do: SSH: keys only, no password sign-in for root.

PHP #

• To do: PHP 8.0 or later, also if Velocity will serve sites; the newest 8.x the system offers is the recommendation (PHP versions and extensions).
• To do: The required extensions installed; the setup wizard's system check or exp:install's SystemCheck step reports none missing (Chapter 2).
• To do: For Velocity: sockets, plus pcntl and openssl; php bin/php/console exp:velocity ext check --allow-root-user lists what is missing.
• To do: php.ini: memory_limit at least 64M, max_execution_time 30 or more, date.timezone set, file_uploads on (PHP settings for Exponential).
• To do: OPcache on for the web PHP (OPcache).
• To do: 64-bit PHP ("for support of more than 30 languages", Operating system support).
• To do: Composer 2 installed (Composer and Git on servers).
• To do: GD or ImageMagick's convert, both recommended (Image processing and media).

Database #

• To do: The engine chosen in the official order: SQLite 3 (no server needed), PostgreSQL, MongoDB, MariaDB, Oracle, MySQL (Databases in the official order).
• To do: For a server engine: version at or above the practical minimum on Database support.
• To do: One database and one user per customer site; no shared superuser.
• To do: The database's own backup tool tested (Database backups per engine).

Engine or web server #

• To do: Decided: Velocity, FrankenPHP, or Apache/nginx with PHP-FPM (Choosing a web server).
• To do: With PHP-FPM: one pool per site, running as the site's system user (PHP-FPM tuning).
• To do: With Velocity: the engine set to qbix for the site (the shipped default engine is PHP's built-in server, for development) (Velocity for hosts).
• To do: Only the asset paths are served as files; the rewrite rules from the installation book are in place (Chapter 8).

TLS #

• To do: Certificates issued and renewed automatically (TLS and HTTPS).
• To do: HTTP redirects to HTTPS.

Users and permissions #

• To do: One system user per customer site (Per-customer users and pools).
• To do: Writable directories as the setup's directory_permissions check lists them, nothing more (Writable directories and permissions).

Cron, mail, logs #

• To do: A crontab per site that runs runcronjobs.php (Cron jobs).
• To do: Outgoing mail with a sender domain that passes SPF and DKIM checks (Mail delivery).
• To do: Log rotation decided (Log viewer and rotation).

Backups and monitoring #

• To do: Backups of the database and var/storage, settings/override, settings/siteaccess, stored off the machine (What to back up).
• To do: External availability check and disk, memory and load alerts (Monitoring overview).

Test installation #

• To do: exp:install (or the setup wizard) completes on this server (One-click installers).
• To do: Front page and administration load over HTTPS.
• To do: An upload, a publish and a search work.
• To do: A backup of the test site is restored on another machine.
• To do: The test installation is removed, or kept as a reference site that is not public.

Demo mode.

• To do: No server-wide EXP_DEMO_MODE (/etc/environment, a global SetEnv, the default PHP-FPM pool, a base image): demo mode is set per public demo only (Demo mode for hosts).

Related pages #

• Requirements at a glance
• Hardening for hosts
• New customer site go-live
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.