VPS hosting #

This page is for hosting companies that offer Exponential on a virtual private server (VPS): one virtual machine per customer or per small group of sites, with root or sudo access. It answers which operating system and PHP to put in the image, how the site should be served, which database fits, how to set up users and permissions, and how to divide the work between host and customer.

Contents #

1. What the sources say about virtual machines
2. The base image
3. Serving the site
4. The database
5. Users, permissions and cron
6. Who does what
7. Checklist

What the sources say about virtual machines #

"Cloud virtual machines (Amazon EC2 including Graviton, Google Compute Engine, Azure, Hetzner, DigitalOcean and the rest) are ordinary Linux machines: tier 2 or 3 by their distribution" (Containers, cloud and hosting panels). A VPS from your own platform is the same: its support level is the support level of the distribution you install on it.

Source: Operating system support. Processor architecture matters only through PHP and the database: x86_64 is tier 1, aarch64 tier 2 (Processor architectures).

The base image #

A VPS image for Exponential carries:

• PHP 8.0 or later, for Apache, PHP-FPM and Velocity alike (Velocity runs on 8.0 from its release 0.0.4.54). The newest 8.x your distribution offers is the recommendation; 8.5 is supported (2.2 PHP).
• The required extensions: dom, libxml, simplexml, xsl, mbstring, iconv, intl, pcre, json, session, zlib, one database extension, gd or ImageMagick; for Velocity also sockets, with pcntl and openssl (2.3 PHP extensions).
• 64-bit PHP, recommended "for support of more than 30 languages".
• Composer 2 and Git, for installs and updates from source (Composer and Git on servers).
• The same PHP for web and command line. "Both must be of a supported version and have the same extensions" (Command line and web PHP).

On Red Hat Enterprise Linux 9 and its rebuilds, the documented package set for the stock PHP is:

dnf install php php-fpm php-mysqlnd php-gd php-intl php-mbstring php-xml php-pdo php-opcache

That stock PHP 8.0 runs Velocity too (the el9 rpm installs on it without a module stream). For a newer PHP switch to another module stream (dnf module reset php, dnf module enable php:8.3, dnf distro-sync). After an installation exists, let it check the machine:

php bin/php/console exp:velocity ext check
php bin/php/console exp:velocity ext install-hint intl xsl

The second command prints the package install command for the system it runs on (Finding what is missing).

Serving the site #

On a VPS the customer may run long-running processes, so the recommended engine is available:

Velocity binds 127.0.0.1 on ports 8088 (HTTP) and 8080 (HTTPS) as shipped. To face visitors directly it is set to Host=0.0.0.0, Port=80 and HTTPSPort=443, started as root; the workers then drop to the site's user (8.3.5 Address, ports, user and group). exp:velocity has no command that installs a boot service; Chapter 8 shows a derived systemd unit that runs exp:velocity start (8.3.11).

More: Velocity for hosts, Apache with PHP-FPM, nginx with PHP-FPM.

The database #

In the official order: 1. SQLite 3 (the default) · 2. PostgreSQL · 3. MongoDB · 4. MariaDB · 5. Oracle · 6. MySQL. Microsoft SQL Server is known to be possible with additional work at this time.

A VPS serves one site from one machine, which is exactly where 1. SQLite 3 is "a full production database". Choose a server "when more than one machine must write the database", "when many editors publish large changes at the same moment all day, or when you need replication or database-level users and grants"; then 2. PostgreSQL is "the recommended database server" (Database support). The database server can run on the VPS itself or on a separate database machine of your platform.

See Databases in the official order.

Users, permissions and cron #

• One user writes. The PHP-FPM pool, the Velocity workers, cron jobs and console scripts all run as the site's user (8.7.2). Never let workers run as root ([ServerSettings] AllowRootWorkers=disabled, the default).
• No world-writable files. Set the hardened [FileSettings] values 0770 and 0660 that site.ini recommends (13.11).
• Cron in the site user's crontab: crontab -e -u <site user> or php bin/php/console crontab:edit as that user (Chapter 10, Cronjobs).

Who does what #

A VPS offer has to say who looks after which layer. The sources do not prescribe a split; these are the options a host usually chooses between:

Checklist #

• To do: Distribution of tier 1 or 2, PHP 8.0 or later (PHP 7.4 usable without support) for web and CLI, the same extensions in both.
• To do: exp:velocity ext check clean for the features in use.
• To do: Velocity with a boot service, or Apache/nginx with PHP-FPM; HTTPS with a CA certificate.
• To do: Database chosen in the official order and documented.
• To do: Everything runs as the site user; [FileSettings] hardened.
• To do: Cron lines for runcronjobs.php in the site user's crontab.
• To do: Backups of database, var/storage, settings/override, settings/siteaccess, restored once on another machine.

Related pages #

• Choosing a hosting model, Dedicated servers
• Operating systems for hosts
• Checklist: new server
• Chapter 2: Requirements
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.