Host a web app with Nginx, PHP-FPM and MariaDB

Everything runs on rocky01 as student with sudo, except step 8, which tests from ubu01. Take a snapshot first (VBoxManage snapshot rocky01 take before-l56 on the laptop), because step 1 adds a volume to /etc/fstab. The passwords below are lab passwords; at work they come from your password vault and never appear in a ticket or a wiki page.

1Give MariaDB its own logical volume

Check the space in vg_data, then create, format and mount lv_db before MariaDB is installed:

sudo vgs vg_data
sudo lvcreate -L 2G -n lv_db vg_data
sudo mkfs.xfs -L dbdata /dev/vg_data/lv_db
sudo mkdir -p /var/lib/mysql
UUID=$(sudo blkid -s UUID -o value /dev/vg_data/lv_db)
echo "UUID=$UUID  /var/lib/mysql  xfs  defaults  0 0" | sudo tee -a /etc/fstab
sudo systemctl daemon-reload
sudo mount -a
findmnt /var/lib/mysql
ls -ldZ /var/lib/mysql

You should see something like this (mkfs.xfs output cut):

  VG      #PV #LV #SN Attr   VSize VFree
  vg_data   2   2   0 wz--n- 9.99g 4.24g
  Logical volume "lv_db" created.
UUID=5c1f7a52-0d3e-4c8b-9a51-2f6e4b7d9c03  /var/lib/mysql  xfs  defaults  0 0
TARGET         SOURCE                   FSTYPE OPTIONS
/var/lib/mysql /dev/mapper/vg_data-lv_db xfs    rw,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota
drwxr-xr-x. 2 root root system_u:object_r:unlabeled_t:s0 6 Oct 27 11:31 /var/lib/mysql

vg_data has two PVs (sdb from Lesson 44 and sdd from Lesson 45) and a little over 4 GiB unallocated (VFree), so 2 GiB for the database fits. The fstab entry uses the UUID, as in Lesson 44, and daemon-reload lets systemd pick up the new line before mount -a. The new file system’s root has no SELinux label yet (unlabeled_t), and MariaDB, confined as mysqld_t, would refuse to start on it.

The policy already knows what /var/lib/mysql should be, so restorecon fixes it:

sudo restorecon -Rv /var/lib/mysql

Relabeled /var/lib/mysql from system_u:object_r:unlabeled_t:s0 to system_u:object_r:mysqld_db_t:s0

✅ Checkpoint: findmnt shows /var/lib/mysql on /dev/mapper/vg_data-lv_db, and ls -ldZ /var/lib/mysql now shows mysqld_db_t.

2Install Nginx, PHP-FPM and MariaDB

Run this:

sudo dnf install -y nginx php-fpm php-cli php-mysqlnd mariadb-server policycoreutils-python-utils
rpm -q nginx php-fpm php-mysqlnd mariadb-server
sudo chown mysql:mysql /var/lib/mysql
ls -ldZ /var/lib/mysql

You should see something like this:

nginx-1.26.3-6.el10_2.5.x86_64
php-fpm-8.3.31-1.el10_2.x86_64
php-mysqlnd-8.3.31-1.el10_2.x86_64
mariadb-server-10.11.18-1.el10_2.x86_64
drwxr-xr-x. 2 mysql mysql system_u:object_r:mysqld_db_t:s0 6 Oct 27 11:33 /var/lib/mysql

php-mysqlnd brings the PDO MySQL driver that PHP needs to talk to MariaDB; without it the app fails with “could not find driver”. policycoreutils-python-utils gives you semanage for step 5. The package normally sets the owner of /var/lib/mysql itself, and the chown makes sure of it on a folder that existed before the package did. Your patch numbers may be newer, which is fine.

✅ Checkpoint: All four packages are installed and /var/lib/mysql is owned by mysql:mysql with the mysqld_db_t label.

3Start MariaDB, lock it to localhost and secure it

SaatShop talks to MariaDB on the same server, so keep the database off the network with a small drop-in file, then start it:

printf '[mysqld]\nbind-address = 127.0.0.1\n' | sudo tee /etc/my.cnf.d/90-saatshop.cnf
sudo systemctl enable --now mariadb
sudo ss -ltnp | grep 3306
sudo mariadb -e "SELECT VERSION();"
ls /var/lib/mysql | head -n 5

You should see something like this:

[mysqld]
bind-address = 127.0.0.1
Created symlink '/etc/systemd/system/multi-user.target.wants/mariadb.service' → '/usr/lib/systemd/system/mariadb.service'.
LISTEN 0      80         127.0.0.1:3306      0.0.0.0:*    users:(("mariadbd",pid=4518,fd=19))
VERSION()
10.11.18-MariaDB
aria_log.00000001
aria_log_control
ib_buffer_pool
ib_logfile0
ibdata1

The first start created the system tables on lv_db. Port 3306 listens on 127.0.0.1 only, so even if someone opened 3306 in the firewall by mistake, nothing outside rocky01 could reach it. sudo mariadb worked without a password because MariaDB’s root account uses unix_socket authentication: Linux root is MariaDB root, and nobody else is. Now remove the test leftovers:

sudo mariadb-secure-installation

✅ Checkpoint: ss shows mariadbd on 127.0.0.1:3306 only, and the script ends with “Thanks for using MariaDB!”.

4Create the SaatShop database, table and user

Save the SQL in a file, so the same steps can be repeated in Lesson 81:

cat > ~/saatshop.sql <<'EOF'
CREATE DATABASE saatshop CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'saatshop'@'localhost' IDENTIFIED BY 'Lab-Only-Pass-56';
GRANT SELECT, INSERT, UPDATE, DELETE ON saatshop.* TO 'saatshop'@'localhost';
USE saatshop;
CREATE TABLE orders (
  id         INT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
  customer   VARCHAR(60)  NOT NULL,
  item       VARCHAR(80)  NOT NULL,
  qty        SMALLINT UNSIGNED NOT NULL DEFAULT 1,
  amount     DECIMAL(10,2) NOT NULL,
  created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
) ENGINE=InnoDB;
INSERT INTO orders (customer, item, qty, amount) VALUES
  ('Priya Sharma', 'Steel water bottle', 2,  598.00),
  ('Arjun Rao',    'Cotton kurta',       1, 1199.00),
  ('Meena Iyer',   'Pressure cooker 5 L',1, 2450.00),
  ('Rahul Verma',  'Masala tea 500 g',   3,  735.00),
  ('Fatima Khan',  'Bedsheet set',       1, 1599.00);
EOF
sudo mariadb < ~/saatshop.sql
sudo mariadb -t -e "SELECT * FROM saatshop.orders;"
sudo mariadb -t -e "SHOW GRANTS FOR 'saatshop'@'localhost';"

You should see something like this:

+----+--------------+---------------------+-----+---------+---------------------+
| id | customer     | item                | qty | amount  | created_at          |
+----+--------------+---------------------+-----+---------+---------------------+
|  1 | Priya Sharma | Steel water bottle  |   2 |  598.00 | 2026-10-27 11:42:18 |
|  2 | Arjun Rao    | Cotton kurta        |   1 | 1199.00 | 2026-10-27 11:42:18 |
|  3 | Meena Iyer   | Pressure cooker 5 L |   1 | 2450.00 | 2026-10-27 11:42:18 |
|  4 | Rahul Verma  | Masala tea 500 g    |   3 |  735.00 | 2026-10-27 11:42:18 |
|  5 | Fatima Khan  | Bedsheet set        |   1 | 1599.00 | 2026-10-27 11:42:18 |
+----+--------------+---------------------+-----+---------+---------------------+
+-----------------------------------------------------------------------------------------------------------------+
| Grants for saatshop@localhost                                                                                   |
+-----------------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO `saatshop`@`localhost` IDENTIFIED BY PASSWORD '*DE964D166B9428B7A44591FF1BCE10CEBC0E9228' |
| GRANT SELECT, INSERT, UPDATE, DELETE ON `saatshop`.* TO `saatshop`@`localhost`                                  |
+-----------------------------------------------------------------------------------------------------------------+

The app user can work with rows in saatshop and nothing else: no CREATE, no DROP, no access to the mysql database. The USAGE line only means “may log in”. Test the login the way PHP will do it, through the socket with the password:

mariadb -u saatshop -p saatshop -e "SELECT COUNT(*) AS orders FROM orders;"

Enter password:
orders
5

✅ Checkpoint: The table shows five orders and the saatshop user can count them with its own password.

5Put the app in place with the right owner and SELinux label

Create the config file outside the web root, readable only by root and the apache group that PHP-FPM runs as:

sudo mkdir -p /etc/saatshop
sudo tee /etc/saatshop/db.ini >/dev/null <<'EOF'
; SaatShop database settings (read by PHP-FPM, kept outside the web root)
[database]
dsn  = "mysql:unix_socket=/var/lib/mysql/mysql.sock;dbname=saatshop;charset=utf8mb4"
user = "saatshop"
pass = "Lab-Only-Pass-56"
EOF
sudo chown root:apache /etc/saatshop/db.ini
sudo chmod 0640 /etc/saatshop/db.ini

Create the app folder for webteam (Lesson 15) and the two PHP files:

sudo mkdir -p /srv/app/saatshop
sudo chown root:webteam /srv/app/saatshop
sudo chmod 2775 /srv/app/saatshop
sudo tee /srv/app/saatshop/index.php >/dev/null <<'EOF'
<?php
// SaatShop: a tiny order list for the SaatVedha Linux course (Lesson 56)
declare(strict_types=1);
$cfg = parse_ini_file('/etc/saatshop/db.ini', true)['database'] ?? null;
if ($cfg === null) {
    http_response_code(500);
    exit("SaatShop: config missing\n");
}
try {
    $db = new PDO($cfg['dsn'], $cfg['user'], $cfg['pass'],
                  [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
    $rows = $db->query('SELECT id, customer, item, qty, amount FROM orders ORDER BY id')
               ->fetchAll(PDO::FETCH_ASSOC);
} catch (PDOException $e) {
    error_log('saatshop: ' . $e->getMessage());
    http_response_code(503);
    exit("SaatShop: database unavailable\n");
}
$h = fn($s) => htmlspecialchars((string) $s, ENT_QUOTES);
?>
<!doctype html>
<html lang="en">
<head><meta charset="utf-8"><title>SaatShop orders</title></head>
<body>
<h1>SaatShop orders</h1>
<p>Served by <?= $h(gethostname()) ?> with PHP <?= PHP_VERSION ?></p>
<table border="1" cellpadding="4">
<tr><th>#</th><th>Customer</th><th>Item</th><th>Qty</th><th>Amount (INR)</th></tr>
<?php foreach ($rows as $r): ?>
<tr><td><?= $h($r['id']) ?></td><td><?= $h($r['customer']) ?></td><td><?= $h($r['item']) ?></td><td><?= $h($r['qty']) ?></td><td><?= $h($r['amount']) ?></td></tr>
<?php endforeach; ?>
</table>
<p><?= count($rows) ?> orders</p>
</body>
</html>
EOF
sudo tee /srv/app/saatshop/health.php >/dev/null <<'EOF'
<?php
// SaatShop health check: one line of text, HTTP 200 only if the database answers
header('Content-Type: text/plain');
$cfg = parse_ini_file('/etc/saatshop/db.ini', true)['database'] ?? [];
try {
    $db = new PDO($cfg['dsn'] ?? '', $cfg['user'] ?? '', $cfg['pass'] ?? '',
                  [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::ATTR_TIMEOUT => 3]);
    $n = $db->query('SELECT COUNT(*) FROM orders')->fetchColumn();
    echo "OK db=up orders=$n\n";
} catch (Throwable $e) {
    error_log('saatshop health: ' . $e->getMessage());
    http_response_code(503);
    echo "FAIL db=down\n";
}
EOF
sudo chown root:webteam /srv/app/saatshop/*.php
sudo chmod 0664 /srv/app/saatshop/*.php
php -l /srv/app/saatshop/index.php
php -l /srv/app/saatshop/health.php

You should see this:

No syntax errors detected in /srv/app/saatshop/index.php
No syntax errors detected in /srv/app/saatshop/health.php

The setgid bit on the folder (the 2 in 2775, from Lesson 18) makes new files belong to webteam, so priya and arjun can deploy without sudo. The password stays in /etc/saatshop/db.ini, so a mistake in the Nginx config can never send it to a browser as plain text. Now tell SELinux that this folder is web content, permanently:

sudo semanage fcontext -a -t httpd_sys_content_t "/srv/app/saatshop(/.*)?"
sudo restorecon -Rv /srv/app/saatshop
ls -lZ /srv/app/saatshop

You should see something like this:

Relabeled /srv/app/saatshop from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
Relabeled /srv/app/saatshop/index.php from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
Relabeled /srv/app/saatshop/health.php from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
total 8
-rw-rw-r--. 1 root webteam unconfined_u:object_r:httpd_sys_content_t:s0  606 Oct 27 11:47 health.php
-rw-rw-r--. 1 root webteam unconfined_u:object_r:httpd_sys_content_t:s0 1343 Oct 27 11:47 index.php

chcon would change the label too, but only until the next relabel; the semanage rule is stored in the policy, so restorecon (and a full relabel after a restore) always puts httpd_sys_content_t back.

✅ Checkpoint: Both files pass php -l and show httpd_sys_content_t in ls -lZ.

6Check the PHP-FPM pool and start it

Read the settings that matter, then start the service and look at its socket:

grep -E '^(user|group|listen|listen.acl_users|pm|pm.max_children) *=' /etc/php-fpm.d/www.conf
sudo php-fpm -t
sudo systemctl enable --now php-fpm
sudo getfacl -p /run/php-fpm/www.sock
cat /etc/nginx/conf.d/php-fpm.conf | grep -v '^#'

You should see something like this:

user = apache
group = apache
listen = /run/php-fpm/www.sock
listen.acl_users = apache,nginx
pm = dynamic
pm.max_children = 50
[27-Oct-2026 11:49:02] NOTICE: configuration file /etc/php-fpm.conf test is successful
Created symlink '/etc/systemd/system/multi-user.target.wants/php-fpm.service' → '/usr/lib/systemd/system/php-fpm.service'.
# file: /run/php-fpm/www.sock
# owner: root
# group: root
user::rw-
user:apache:rw-
user:nginx:rw-
group::---
mask::rw-
other::---

upstream php-fpm {
        server unix:/run/php-fpm/www.sock;
}

The workers run as apache (Rocky keeps that name even without Apache httpd installed), and the socket uses an ACL, the same tool you met in Lesson 19, to let only apache and nginx connect. The php-fpm package also dropped an Nginx upstream called php-fpm into conf.d, which is why the server block in the next step can say fastcgi_pass php-fpm; instead of a socket path.

✅ Checkpoint: php-fpm is active, and getfacl shows user:nginx:rw- on /run/php-fpm/www.sock.

7Add the Nginx server block and start Nginx

Write the server block, test the whole config, start Nginx and ask for the health page:

sudo tee /etc/nginx/conf.d/saatshop.conf >/dev/null <<'EOF'
# /etc/nginx/conf.d/saatshop.conf  (SaatVedha Linux course, Lesson 56)
server {
    listen       80;
    server_name  rocky01.saatlab.test rocky01 10.10.10.11;
    root         /srv/app/saatshop;
    index        index.php;

    access_log   /var/log/nginx/saatshop.access.log;
    error_log    /var/log/nginx/saatshop.error.log;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        try_files      $uri =404;
        fastcgi_pass   php-fpm;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include        fastcgi_params;
    }
}
EOF
sudo nginx -t
sudo systemctl enable --now nginx
curl -s http://10.10.10.11/health.php
curl -s http://10.10.10.11/ | grep -E '<h1>|Priya|orders</p>'

You should see something like this:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
Created symlink '/etc/systemd/system/multi-user.target.wants/nginx.service' → '/usr/lib/systemd/system/nginx.service'.
OK db=up orders=5
<h1>SaatShop orders</h1>
<tr><td>1</td><td>Priya Sharma</td><td>Steel water bottle</td><td>2</td><td>598.00</td></tr>
<p>5 orders</p>

The whole chain works: Nginx passed the PHP files to PHP-FPM, PHP read db.ini and fetched the rows from MariaDB. try_files $uri =404 in the PHP location is a safety line: Nginx only hands a path to PHP-FPM when that file exists, so nobody can make PHP run an uploaded image as code. $document_root$fastcgi_script_name becomes /srv/app/saatshop/index.php, the file PHP-FPM opens.

Since Lesson 16, priya and arjun may run sudo systemctl reload nginx and read the Nginx journal. That rule now has a real service behind it, so the web team can deploy a change and reload without asking you.

✅ Checkpoint: curl prints “OK db=up orders=5” and the page shows the h1 heading, Priya’s order and “5 orders”.

8Open the firewall and test from ubu01

On rocky01, allow HTTP permanently:

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload
sudo firewall-cmd --list-services

success
success
dhcpv6-client http ntp ssh

On ubu01, run this:

curl -s http://rocky01.saatlab.test/health.php
curl -sI http://rocky01.saatlab.test/ | head -n 4

You should see something like this:

OK db=up orders=5
HTTP/1.1 200 OK
Server: nginx/1.26.3
Date: Tue, 27 Oct 2026 06:24:31 GMT
Content-Type: text/html; charset=UTF-8

Only http (port 80) was added; 3306 stays closed and listens on 127.0.0.1 anyway. The Date header is always in GMT, which is why it reads 06:24 while rocky01’s clock says 11:54 IST. To open SaatShop in your laptop’s browser, add one more port forward on the laptop and browse to http://127.0.0.1:8011/:

VBoxManage natnetwork modify --netname=LinuxLab --port-forward-4="web-rocky01:tcp:[127.0.0.1]:8011:[10.10.10.11]:80"

[Add your screenshot here]: the SaatShop orders page open in the laptop browser at http://127.0.0.1:8011/, showing the five orders. If you see the Rocky test page instead, add 127.0.0.1 to the server_name line and reload Nginx.

✅ Checkpoint: ubu01 gets “OK db=up orders=5” and a 200 OK with Server: nginx.

9Read the three logs on the path

On rocky01, run this:

sudo tail -n 2 /var/log/nginx/saatshop.access.log
sudo tail -n 3 /var/log/php-fpm/error.log
sudo tail -n 2 /var/log/mariadb/mariadb.log
systemctl is-active nginx php-fpm mariadb

You should see something like this:

10.10.10.21 - - [27/Oct/2026:11:54:31 +0530] "GET /health.php HTTP/1.1" 200 18 "-" "curl/8.18.0"
10.10.10.21 - - [27/Oct/2026:11:54:31 +0530] "HEAD / HTTP/1.1" 200 0 "-" "curl/8.18.0"
[27-Oct-2026 11:49:02] NOTICE: fpm is running, pid 4702
[27-Oct-2026 11:49:02] NOTICE: ready to handle connections
[27-Oct-2026 11:49:02] NOTICE: systemd monitor interval set to 10000ms
2026-10-27 11:36:40 0 [Note] /usr/libexec/mariadbd: ready for connections.
Version: '10.11.18-MariaDB'  socket: '/var/lib/mysql/mysql.sock'  port: 3306  MariaDB Server
active
active
active

The access log shows ubu01’s address, the request, the status and the bytes sent (18 is the length of “OK db=up orders=5” plus the newline). PHP-FPM keeps its own service log in error.log and PHP errors from the pool in www-error.log, which is empty for now. MariaDB’s log confirms the socket path the app uses.

These are the files Lesson 61 will watch with Zabbix and Lesson 62 will include in the backup plan.

✅ Checkpoint: All three services are active and you can find ubu01’s requests in the SaatShop access log.