Hosting partner technical checklist #

This page is for system administrators at hosting partners. Use it when you build a hosting product for Exponential or audit an existing one. Each section names the chapter of the documentation that explains it.

PHP #

Source: doc/eng-us/install/02-requirements.md.

• To do: A supported PHP version: 8.0 to 8.5 for the 6.0.15 line (Velocity included, from its release 0.0.4.54)
• To do: 64-bit PHP build
• To do: Required extensions present in both the web PHP and the CLI PHP: dom, simplexml, xsl, mbstring, iconv, intl, zlib, and at least one database extension
• To do: php -v and php -m on the command line match the web server's PHP information
• To do: php.ini: memory_limit 64M or more, max_execution_time 30 or more, date.timezone set, file_uploads on, allow_url_fopen on

Database #

Source: Database support.

• To do: The database chosen in the project's order of preference: SQLite 3, PostgreSQL, MongoDB, MariaDB, Oracle, MySQL
• To do: The matching PHP extension: sqlite3, pgsql, mongodb (plus the library mongodb/mongodb), mysqli or oci8
• To do: Character set as the database page requires
• To do: Backup and restore procedure tested

Engine and web server #

Sources: doc/eng-us/install/08-serving-the-site.md, Security hardening.

• To do: Engine chosen: Velocity, FrankenPHP, or a web server with PHP-FPM
• To do: Only the public entry points are reachable; internal directories are not served
• To do: The setup wizard and installer files are not reachable after installation
• To do: The web user and any CLI/cron user can both write var/ without permission conflicts

Scheduled work #

• To do: Cronjobs for the installation run as the site's user, not as root (Security hardening)
• To do: Logs of cron runs are kept and rotated

Security #

Source: Security hardening, doc/eng-us/install/13-security-hardening.md.

• To do: TLS on every host name, with renewal automated
• To do: Security headers set; the administration's Content Security Policy not weakened
• To do: Debug output off in production
• To do: Default passwords changed (Default administrator password)
• To do: Separate users per customer site

Backups and recovery #

• To do: Database and var/storage (uploaded files) backed up on a schedule
• To do: Off-site copy
• To do: A restore tested at least every quarter, with the time it took written down

Monitoring #

• To do: Uptime check of the front page and the administration sign-in page
• To do: Disk space alarms for var/
• To do: Error log watched (When something goes wrong)

Updates #

• To do: OS and PHP security updates applied on a schedule
• To do: A staging copy for each customer site to test Exponential releases (Testing releases)
• To do: A documented path to the next PHP version before the current one ends its support

Demo mode.

• To do: Public demos run in demo mode (EXP_DEMO_MODE=1 in the demo's own pool, virtual host, unit and crontab); no customer site has the variable, and demo/mode lines in a customer's security.log raise an alert (Demo mode for hosts).

Related pages #

• Hosting partners
• Operating system support
• Security responsibilities of partners
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.