Install Sym8 on Debian 13 with Nginx

Select the Debian 13 image

When creating a new VPS, select Debian 13 (minimal) as the operating system image. Depending on your hosting provider, the image can usually be selected during the ordering process or installed later through the provider’s control panel.

An IPv4 address—and, if applicable, an IPv6 address—has already been assigned to the VPS. The domain or subdomain you intend to use should point to the VPS via an A and, if IPv6 is enabled, an AAAA record.

First, log in to the vServer as root via SSH using the domain/subdomain or IP address:

              ssh root@123.xxx.xxx.xxx
            

System update

Before you set up or install anything, check whether the OS and the installed packages are up to date. If updates are available, install them as root:

              apt update
apt upgrade
            

Install and enable sudo

With sudo, regular users can also perform administrative tasks as root.

Install the package if it isn’t already installed:

              apt install sudo
            

Next create a new user with a very strong password and an own home directory (replace username with the desired name):

              adduser username
            

Grant the new user permission to perform administrative tasks:

              usermod -aG sudo username
            

Log out and log in again as the new user, then run:

              sudo whoami
            

If everything worked correctly, root should be displayed.

Passwordless SSH login

In this step, we will use an existing SSH key for logging in and disable password-based login. This enhances security and significantly reduces the attack surface.

I recommend creating and using a separate SSH key for each project. That way, if a key is compromised, it only needs to be replaced for that one project.

Another recommendation: Use an Ed25519 SSH key. It is compact, fast, and widely supported by modern SSH implementations.

You can find your SSH keys in the .ssh subdirectory of your home directory. Example:

• id_ed25519-project-name (private key)
• id_ed25519-project-name.pub (public key)

Never copy or upload your private key to the server.

To upload your public key to the temporary directory of your server use the command scp (secure copy):

              scp ~/.ssh/id_ed25519-project-name.pub root@123.xxx.xxx.xxx:/tmp
            

On your server create the subdirectory .ssh in the home directory of the user and set the right owner:

              mkdir -p /home/username/.ssh
chown username:username /home/username/.ssh
            

Then append the public key to the file authorized_keys in the home directories of root and the user (username):

              cat /tmp/id_ed25519-project-name.pub >> ~/.ssh/authorized_keys
cat /tmp/id_ed25519-project-name.pub >> /home/username/.ssh/authorized_keys
            

Make sure, the directories and files have the right permissions:

              chmod 700 ~/.ssh
chmod 700 /home/username/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod 600 /home/username/.ssh/authorized_keys
            

After this, open a second connection and login as user (username):

              ssh username@123.xxx.xxx.xxx
            

If this works, then you can disable password login in the file sshd_config and change the following settings to these values:

              vi /etc/ssh/sshd_config

PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-password
            

Test the settings and reload the ssh daemon:

              sshd -t
systemctl reload ssh
            

From now, administrative commands are shown with sudo mode.

Nginx

In this step we will only install Nginx and start the web server. The configuration will be done later after all components have been installed.

Install Nginx from the package manager:

              sudo apt install nginx
            

Confirm the installation with Y when prompted.

After installation check the status of Nginx:

              sudo systemctl status nginx
            

The expected status should be active (running).

PHP-FPM

Debian 13 ships with PHP 8.4 by default.

To serve dynamic pages, we need PHP-FPM. PHP FastCGI Process Manager (FPM) provides a separate process manager for serving PHP applications and allows PHP to run independently of the web server.

Install PHP-FPM with the following command:

              sudo apt install php-fpm
            

Install the following PHP extensions as well with the following single command:

• php-bcmath
• php-curl
• php-gd
• php-intl
• php-json
• php-mbstring
• php-mysql
• php-xml
• php-zip

              sudo apt install -y php-bcmath php-curl php-gd php-intl php-json php-mbstring php-mysql php-xml php-zip
            

MariaDB

Sym8 requires a database to store its entries. We use MariaDB for this purpose. MariaDB is an open-source relational database that can be used as a drop-in replacement for MySQL.

In a first step we install MariaDB server and client:

              sudo apt install mariadb-server
sudo apt install mariadb-client-compat
            

Check the status after the installation:

              sudo systemctl status mariadb
            

The expected result is active (running).

Secure MariaDB installation

With the command mysql_secure_installation you can run MariaDB’s build-in script to set up and secure the database:

              sudo mysql_secure_installation

Step 1
Enter current password for root (enter for none):

Step 2
Setting the root password or using the unix_socket ensure that nobody
can log into the MariaDB root user without the proper authorisation.

You already have root account protected, so you can safely answer 'n'.

Switch to unix_socket authentication [Y/n] n

Step 3
You already have your root account protected, so you can safely answer "n".

Change the root password? [Y/n] Y
New password: ******** 
Re-enter new password: ********

Step 4
By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them. This is intended only for testing, and to make the installation
go a bit smoother. You should remove them before moving into a 
production environment.

Remove anonymous users? [Y/n] Y

Step 5
Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] Y

Step 6
By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] Y

Step 7
Reload privilege tables now? [Y/n] Y
... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!
            

Create Database and user

Login to the mariadb shell with the following command:

              mysql -u root -p
            

Create a database and a user (replace db_name with the name of the database and user_name with the username):

              CREATE DATABASE db_name
    CHARACTER SET utf8mb4
    COLLATE utf8mb4_unicode_ci;

CREATE USER 'user_name'@'localhost'
    IDENTIFIED BY 'your-very-strong-password';

GRANT ALL PRIVILEGES
    ON db_name.*
    TO 'user_name'@'localhost';
            

Note: As MariaDB is running on the same server, there is no need to expose the database server to the public network. So localhost is your friend.

Let's Encrypt

To obtain SSL certificates from Let’s Encrypt and renew them automatically, we need to install Certbot for Nginx.

When obtaining a certificate, Certbot can perform the following steps:

• Reads the Nginx configuration
• Performs the HTTP challenge
• Retrieves the certificate
• Updates the Nginx configuration
• Executes a reload

              sudo apt install certbot python3-certbot-nginx
            

Now, all components are installed. On the next page, we’ll configure all the components (including creating an SSL certificate).