Webmin
This page is for hosting companies and administrators whose servers are administered through Webmin and who want to run Exponential on them. The Exponential sources do not mention Webmin. It is not placed in a tier, and nothing here comes from a test. The page explains how to proceed anyway: on a server where you edit the web server, PHP and cron configuration yourself (through any interface), the installation book's own instructions are the reference, and this page lists them in the order you need them.
Warning
.htaccess slows down every request. When .htaccess files are enabled (AllowOverride anything but None), let alone
used, Apache looks for them and reads and evaluates them on every request, in every directory of the path, and
page loading times go up drastically (measured). The only real fix is to switch the feature off for
the virtual host: AllowOverride None in the HTTPS virtual host, and the rules in the virtual host's own
configuration as mod_rewrite rules. That is far faster in production speed tests and well worth the time it takes
to optimize a production configuration. Switch over right away: copy the rules of the
example HTTPS virtual host into your virtual host (with the static cache, also
staticcache_offload.conf), set AllowOverride None, run apachectl configtest, reload Apache and
test the site. The same rules for other servers: nginx, LiteSpeed,
Caddy, IIS, Velocity (built in); where virtual host rules go in a control
panel: Plesk, cPanel, DirectAdmin, ISPConfig.
On LiteSpeed or OpenLiteSpeed, the server's own page cache can also answer anonymous visitors and crawlers without PHP: Page caching with LiteSpeed and OpenLiteSpeed.
Note
Nothing on this page describes Webmin's modules or screens. For how Webmin edits a given configuration file or service, check Webmin's documentation. Whatever interface you use, the files and commands below are what the Exponential sources describe.
Contents
- Status in the sources
- The installation book is the reference
- Order of work
- Things an administration interface must not undo
- A test plan
- Checklist
Status in the sources
| Question | Answer |
|---|---|
| Is Webmin named in the documentation or code? | no |
| Which tier? | none: it is not placed |
| What decides support instead? | the operating system and web server below it, which are placed in tiers (Operating system support) |
If the distribution below is tier 1 or 2 (for example AlmaLinux 9, Red Hat Enterprise Linux 9 and 10, Debian 12 and 13, Ubuntu 22.04 and 24.04) and the web server is Apache with PHP-FPM (tier 1) or nginx with PHP-FPM (tier 2), the stack Exponential sees is a placed one; only the administration interface on top is not.
The installation book is the reference
| Task | Where the book describes it |
|---|---|
| PHP packages per distribution | 2.9 Operating system notes |
php.ini values | 2.5 |
| Apache virtual host with PHP-FPM | 8.5.1 Step by step |
| nginx server block (derived, not shipped) | 8.6 |
| PHP-FPM settings and reload | 8.5.2 |
| Velocity, with a systemd unit | 8.3, 8.3.11 |
| File permissions and ownership | 8.7 |
| Databases: create database and user | Chapter 9 |
| Crontab | 10.3 Cronjobs |
| HTTPS and headers | 13.9 |
On such a server you also have the full choice of engines: Exponential Velocity, recommended for every stage, needs no separate web server and serves HTTPS itself (8.1).
Order of work
- PHP 8.0 or later (Velocity included) with the required extensions, for web and command line alike.
- Database, in the official order: 1. SQLite 3 (the default, no server) · 2. PostgreSQL · 3. MongoDB · 4. MariaDB · 5. Oracle · 6. MySQL; Microsoft SQL Server is known to be possible with additional work at this time. Create the database and its user before installing (Databases and users).
- Code:
git cloneandcomposer install, as the site's user (Chapter 3). - Install:
exp:install, the kickstarter or the setup wizard (Chapter 4). - Serve: Velocity with a boot service, or Apache/nginx with a PHP-FPM pool running as the site's user.
- Cron:
runcronjobs.phplines in the site user's crontab. - HTTPS: a certificate for every name; redirect HTTP; HSTS once everything works.
- Backups: database and
var/storage,settings/override,settings/siteaccess, restored once elsewhere.
php -v
php bin/php/console exp:velocity ext check
php bin/php/console exp:install --dry-runexp:install --dry-run checks "configuration and packages, nothing written"
(4.6).
Things an administration interface must not undo
Any tool that rewrites configuration files can silently revert a hand-made change. For Exponential, protect these:
| Setting | Why |
|---|---|
The rewrite rules (.htaccess or the nginx block) | they decide which files are served; without them settings/*.ini and the SQLite database are exposed (13.2) |
The PHP-FPM pool's user | one user writes var/ (8.7.2) |
AllowOverride for the document root (Apache) | .htaccess must be read |
| The crontab lines of the site user | scheduled publishing, notifications, clean-up |
| Firewall rules for Velocity's ports, if visitors reach Velocity directly | "add the port with whatever tool owns the ruleset on the box" (FrankenPHP) |
Tip
After any configuration change made through an interface, run the file-exposure check of 13.2 again. It takes seconds and catches the most dangerous regression.
A test plan
| Step | Pass when |
|---|---|
| Install | every critical test passes; site and /admin answer |
| File-exposure check from outside | 404 or an Exponential page for every path, never the file |
| Reboot the server | the site and, if used, Velocity come back on their own |
| Change a PHP setting through the interface | the change is visible in Setup > System information after the reload |
| Cron | runs appear on Setup > Cronjobs |
| Backup and restore | restored site works on another machine |
Checklist
- To do: Distribution and web server of a placed tier below the interface.
- To do: The installation book's steps followed for PHP, server, permissions, cron and HTTPS.
- To do: Rewrite rules, pool user and crontab protected from being overwritten.
- To do: File-exposure check repeated after every configuration change.
- To do: The test plan passed.
Related pages
- Control panels: overview, ISPConfig
- VPS hosting, Dedicated servers
- Checklist: new server
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.