Staging Server Setup Prompt for AlmaLinux 9 Use this prompt to set up a fresh AlmaLinux 9 server as a staging environment for BuyerKiosk. --- ## Prompt Set up a comprehensive LAMP stack staging server on this AlmaLinux 9 server with the following requirements: ### 1. LAMP Stack - Install Apache (latest), PHP 8.4, MariaDB (latest stable), Git - Enable and start all services ### 2. User & Directory Setup - Create user `buyerkiosk` with home directory `/home/buyerkiosk` - This will be the document root - Set proper permissions (711 on home dir for Apache access) ### 3. SSH Key for BitBucket - Generate an ED25519 SSH key for the buyerkiosk user - Display the public key so I can add it to BitBucket - Clone `git@bitbucket.org:buyerkiosk/buyerkiosk-web-codebase.git` (daybook branch) to `/home/buyerkiosk` ### 4. Apache Virtual Host - Create vhost for `staging.buyerkiosk.com` - Document root: `/home/buyerkiosk/public_html` - Configure PHP-FPM with Unix socket - Set up SSL with Let's Encrypt (use DNS validation since server may be behind Cloudflare) - Add HTTP to HTTPS redirect - Add `X-Robots-Tag: noindex, nofollow, noarchive` header - Set up HTTP Basic Authentication (create user `staging` with a strong password) - Configure error/access logs to `/home/buyerkiosk/logs/` ### 5. SSH Hardening - Key-only authentication (disable password auth) - Restrict SSH access to IP: `208.67.99.88` - Create an unlock script at `/root/unlock-ssh.sh` that can disable/enable IP restrictions (for VNC recovery access) ### 6. Firewall Configuration - Allow Cloudflare IP ranges for ports 80/443 - Restrict SSH to specific IP - Use firewalld rich rules ### 7. PHP Configuration - Harden PHP but allow `proc_open`, `proc_close`, `proc_get_status`, `proc_nice`, `proc_terminate` (needed for Composer) - Disable dangerous functions: `exec`, `passthru`, `shell_exec`, `system`, `popen`, `show_source`, `parse_ini_file`, `dl` - Hide PHP version (`expose_php = Off`) ### 8. Composer - Install Composer globally - Run `composer update` in `/home/buyerkiosk/userfrosting` - If there are security audit blocks, add `"audit": {"block-insecure": false}` to composer.json config ### 9. Environment Files - Copy `.env` files from `/root/` to `/home/buyerkiosk/.env` and `/home/buyerkiosk/userfrosting/.env` - Update paths to use `/home/buyerkiosk` as HOME_DIR - Update SERVER_NAME to `staging.buyerkiosk.com` - Update APP_DOMAIN to `https://staging.buyerkiosk.com` - Set proper permissions (640, owner buyerkiosk, group apache) ### 10. Redis - Install and enable Redis server ### 11. MySQL Configuration - Create MySQL user `kiosk_db` with the password from .env files - Grant ALL PRIVILEGES ON *.* (needs server-wide access for all kiosk_* databases) - Tune MySQL for large imports: - `max_connections = 500` - `max_allowed_packet = 1G` - `innodb_buffer_pool_size = 1G` - `innodb_log_file_size = 256M` - `innodb_buffer_pool_size = 1G` - `innodb_log_file_size = 256M` - `innodb_flush_log_at_trx_commit = 2` - `net_read_timeout = 3600` - `net_write_timeout = 3600` - `wait_timeout = 28800` ### 12. Database Sync Script - Create `/usr/local/bin/sync-prod-databases.sh` to sync all `kiosk_*` databases from production server `host.v2technologysolut> - Use SSH key at `/root/.ssh/id_ed25519` for connection - Include optimizations: `--extended-insert`, `--disable-keys`, `--net-buffer-length=16384` for mysqldump - Include import optimizations: `SET FOREIGN_KEY_CHECKS=0; SET UNIQUE_CHECKS=0; SET AUTOCOMMIT=0; SET sql_log_bin=0;` - Track synced databases to allow resume if interrupted - Log to `/home/buyerkiosk/logs/db-sync/` ### 13. Staging Security - Block search engines with `robots.txt` (Disallow all) in public_html - Disable outbound emails (stop and disable postfix) - Configure log rotation for all logs in `/home/buyerkiosk/logs/` - Enable automatic security updates with dnf-automatic ### 14. TaskEngine Setup - Create CLI entry point at `/home/buyerkiosk/userfrosting/task` for TaskEngine commands - Create systemd service `buyerkiosk-workers.service` to run `php task worker:manager --daemon` - Enable and start the service ### 15. Cron Jobs (all logs to /home/buyerkiosk/logs/) ``` # Database sync - midnight 0 0 * * * root /usr/local/bin/sync-prod-databases.sh >> /home/buyerkiosk/logs/db-sync/sync.log 2>&1 # Schema migrations - 4:30 AM 30 4 * * * root cd /home/buyerkiosk/userfrosting && php conductor run >> /home/buyerkiosk/logs/migrations.log 2>&1 # Phase4 user migration - 5:30 AM 30 5 * * * root cd /home/buyerkiosk/userfrosting && php migrations/scripts/phase4_run_all.php --skip-backup --yes >> /home/buye> # Aggregate store stats - 6:00 AM 0 6 * * * root cd /home/buyerkiosk/userfrosting && php scripts/aggregate-store-stats.php >> /home/buyerkiosk/logs/aggregate-sta> # Build wait time analysis - 7:00 AM 0 7 * * * root cd /home/buyerkiosk/userfrosting && php scripts/build-waittime-analysis.php >> /home/buyerkiosk/logs/waittime-an> # TaskEngine scheduler - every minute * * * * * root cd /home/buyerkiosk/userfrosting && php task scheduler:run >> /home/buyerkiosk/logs/task-scheduler.log 2>&1 # TaskEngine worker cleanup - every 5 minutes */5 * * * * root cd /home/buyerkiosk/userfrosting && php task worker:manager --cleanup >> /home/buyerkiosk/logs/task-workers.lo> ``` ### 16. Post-Setup Tasks - Run the database sync script (this will take several hours for large databases) - After sync completes, run database migrations: `php conductor run` - Run phase4 migration: `php migrations/scripts/phase4_run_all.php --skip-backup --yes` - Run aggregate stats: `php scripts/aggregate-store-stats.php` ### 17. DNS Configuration (Manual Step) After setup, update Cloudflare DNS: - A record for `staging.buyerkiosk.com` pointing to this server's IP --- ## Server Details to Provide - Server IP: (will be detected) - SSH access IP to whitelist: `208.67.99.88` - Production server: `host.v2technologysolutions.com` - Git repo: `git@bitbucket.org:buyerkiosk/buyerkiosk-web-codebase.git` - Branch: `daybook` - Domain: `staging.buyerkiosk.com` --- --- ## Files to Have Ready in /root/ 1. `.env` - Main environment file with database credentials 2. `userfrosting/.env` - UserFrosting environment file 3. SSH private key for production server access (if not already set up) [ Read 148 lines ]