How to Install LOMP Stack (OpenLiteSpeed, MySQL, and PHP) on Rocky Linux 9

OpenLiteSpeed is a lightweight and open-source version of the LiteSpeed Server developed by LiteSpeed Technologies. It supports Apache Rewrite rules, HTTP/2 and HTTP/3, and TLS v1.3 and QUIC protocols. It comes with a WebGUI-based Administration panel, making it different from other servers and easier to manage.

The LOMP Stack is an acronym for Linux, OpenLiteSpeed, MySQL/MariaDB, and PHP. Litespeed servers are known for their speed, especially with PHP which integrates using the LiteSpeed Server Application Programming Interface (LSAPI). The LiteSpeed PHP (LSPHP) interpreter serves dynamic PHP pages via LSAPI.

This tutorial will show you step-by-step how to install a LOMP Server on a Rocky Linux 9 machine.

Prerequisites

• A server running Rocky Linux 9.

• A non-root user with sudo privileges.

• A fully qualified domain name (FQDN) like example.com pointing to the server.

• SELinux doesn't need to be disabled or configured to work with OpenLiteSpeed.

• Make sure everything is updated.

  $ sudo dnf update
  

• Few packages that your system needs.

  $ sudo dnf install wget curl nano unzip yum-utils -y
  

  Some of these packages may already be installed on your system.

Step 1 - Configure Firewall

The first step is to configure the firewall. Rocky Linux uses Firewalld Firewall. Check the firewall's status.

$ sudo firewall-cmd --state
running

The firewall works with different zones, and the public zone is the default one that we will use. List all the services and ports active on the firewall.

$ sudo firewall-cmd --permanent --list-services

It should show the following output.

cockpit dhcpv6-client ssh

OpenLiteSpeed needs the 7080 port for its administration panel.

$ sudo firewall-cmd --permanent --add-port=7080/tcp

We also need HTTP and HTTPS ports to function. Open them.

$ sudo firewall-cmd --permanent --add-service=http
$ sudo firewall-cmd --permanent --add-service=https

Reload the firewall to apply the changes.

$ sudo firewall-cmd --reload

List all the services again.

$ sudo firewall-cmd --permanent --list-services

You should get the following output.

cockpit dhcpv6-client http https ssh

Step 2 - Install OpenLiteSpeed

Download the OpenLiteSpeed binary file. You can get the link to the latest binary file from the OpenLiteSpeed official downloads page.

$ wget https://openlitespeed.org/packages/openlitespeed-1.7.16.tgz

Extract the file.

$ tar -zxf openlitespeed-*.tgz

Switch to the extracted directory.

$ cd openlitespeed

Run the installer.

$ sudo ./install.sh

Wait for some time for the installer to finish.

There are some issues with OpenLiteSpeed on Rocky Linux 9 machine due to which you might see some errors about missing PHP packages. You can ignore them for now because the server can still run with various workarounds.

The installer script installs and enables the lshttpd systemd service.

Start the OpenLiteSpeed server.

$ sudo systemctl start lshttpd

Check the version of the server installed.

$ /usr/local/lsws/bin/lshttpd -v
LiteSpeed/1.7.16 Open (BUILD built: Thu Nov 17 16:18:46 UTC 2022) 
        module versions:
        lsquic 3.1.1
        modgzip 1.1
        cache 1.64
        mod_security 1.4

Create the Administrator Password

Run the password reset script.

$ sudo /usr/local/lsws/admin/misc/admpass.sh

You will get the following output. Give admin as the username and set a strong password.

Please specify the user name of administrator.
This is the user name required to login the administration Web interface.

User name [admin]: admin

Please specify the administrator's password.
This is the password required to login the administration Web interface.

Password: 
Retype password: 
Administrator's username/password is updated successfully!

You can now use the new administrator password.

Open http://<YOURSERVERIP>:7080 to access OpenLiteSpeed's administration panel. On your first login, your browser will warn that your connection is not private. Click Advanced and click "Accept the risk and Continue" (in the case of Firefox) or "Proceed to <YOURSERVERIP>(unsafe)" (in the case of Chromium-based browser). You won't see the warning again.

You should see the login page.

Enter admin as the username and password, you set earlier, and press the Login button to proceed.

You will get the following screen.

Step 3 - Install PHP

OpenLiteSpeed installer usually installs PHP 7.4 by default. In the case of Rocky Linux 9, it doesn't get automatically installed. Moreover, we will install a recent version of PHP. Before doing that, we need to install the LiteSpeed repository.

Install the OpenLiteSpeed repository by running the following command.

$ sudo rpm -Uvh http://rpms.litespeedtech.com/centos/litespeed-repo-1.3-1.el8.noarch.rpm

You can grab the latest version of the RPM file from the OpenLiteSpeed repo page.

Install PHP 8.2.

$ sudo dnf install lsphp82 lsphp82-mysqlnd lsphp82-process lsphp82-bcmath lsphp82-pdo lsphp82-common lsphp82-xml lsphp82-opcache lsphp82-soap

The lsphp-gd, and lsphp-mbstring packages are still missing from the repository. So if you want them, you will need to wait for a while before they are officially released.

Verify the PHP installation.

$ /usr/local/lsws/lsphp82/bin/php -v
PHP 8.2.1 (cli) (built: Jan  3 2023 18:40:55) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.2.1, Copyright (c) Zend Technologies
    with Zend OPcache v8.2.1, Copyright (c), by Zend Technologies

You can check the list of enabled PHP modules.

$ /usr/local/lsws/lsphp82/bin/php --modules
[PHP Modules]
bcmath
bz2
calendar
Core
ctype
curl
date
dom
exif
fileinfo
filter
ftp
gettext
hash
iconv
json
libxml
mysqli
mysqlnd
openssl
pcntl
pcre
PDO
pdo_mysql
pdo_sqlite
Phar
posix
random
readline
Reflection
session
shmop
SimpleXML
soap
sockets
SPL
sqlite3
standard
sysvmsg
sysvsem
sysvshm
tokenizer
xml
xmlreader
xmlwriter
xsl
Zend OPcache
zip
zlib

[Zend Modules]
Zend OPcache

We will configure OpenLiteSpeed to work with PHP later.

Step 4 - Install MySQL

Install MySQL server.

$ sudo dnf install mysql-server

Enable and start the MySQL server.

$ sudo systemctl enable mysqld --now

Check the status of the service.

$ sudo systemctl status mysqld

You will get the following output.

? mysqld.service - MySQL 8.0 database server
     Loaded: loaded (/usr/lib/systemd/system/mysqld.service; enabled; vendor preset: disabled)
     Active: active (running) since Fri 2023-02-17 07:31:00 UTC; 2s ago
    Process: 14933 ExecStartPre=/usr/libexec/mysql-check-socket (code=exited, status=0/SUCCESS)
    Process: 14955 ExecStartPre=/usr/libexec/mysql-prepare-db-dir mysqld.service (code=exited, status=0/SUCCESS)
   Main PID: 15054 (mysqld)
     Status: "Server is operational"
      Tasks: 39 (limit: 5873)
     Memory: 427.1M
        CPU: 4.079s
     CGroup: /system.slice/mysqld.service
             ??15054 /usr/libexec/mysqld --basedir=/usr

Feb 17 07:30:51 nspeaks.xyz systemd[1]: Starting MySQL 8.0 database server...
Feb 17 07:30:51 nspeaks.xyz mysql-prepare-db-dir[14955]: Initializing MySQL database
Feb 17 07:31:00 nspeaks.xyz systemd[1]: Started MySQL 8.0 database server.

Run the MySQL security script.

$ sudo mysql_secure_installation

You will receive several prompts. The first prompt will ask whether you want to install the Validate Password Plugin. Press Y to install the plugin. Choose 2 as its security level which will require your password to be at least 8 characters long and include a mix of uppercase, lowercase, numeric, and special characters.

Securing the MySQL server deployment.

Connecting to MySQL using a blank password.

VALIDATE PASSWORD COMPONENT can be used to test passwords
and improve security. It checks the strength of password
and allows the users to set only those passwords which are
secure enough. Would you like to setup VALIDATE PASSWORD component?

Press y|Y for Yes, any other key for No: Y

There are three levels of password validation policy:

LOW    Length >= 8
MEDIUM Length >= 8, numeric, mixed case, and special characters
STRONG Length >= 8, numeric, mixed case, special characters and dictionary                  file

Please enter 0 = LOW, 1 = MEDIUM and 2 = STRONG: 2

Next, you will be asked to create a strong root password. Make sure your password matches the requirements of the Validate plugin.

Please set the password for root here.

New password: 

Re-enter new password:

Estimated strength of the password: 100 
Do you wish to continue with the password provided?(Press y|Y for Yes, any other key for No) : Y

Next, you will be asked several prompts relating to increasing the security of the database. Press Y in each prompt.

By default, a MySQL installation has an anonymous user,
allowing anyone to log into MySQL without having to have
a user account created for them. This is intended only for
testing, and to make the installation go a bit smoother.
You should remove them before moving into a production
environment.

Remove anonymous users? (Press y|Y for Yes, any other key for No) : Y
Success.


Normally, root should only be allowed to connect from
'localhost'. This ensures that someone cannot guess at
the root password from the network.

Disallow root login remotely? (Press y|Y for Yes, any other key for No) : Y
Success.

By default, MySQL comes with a database named 'test' that
anyone can access. This is also intended only for testing,
and should be removed before moving into a production
environment.


Remove test database and access to it? (Press y|Y for Yes, any other key for No) : Y
 - Dropping test database...
Success.

 - Removing privileges on test database...
Success.

Reloading the privilege tables will ensure that all changes
made so far will take effect immediately.

Reload privilege tables now? (Press y|Y for Yes, any other key for No) : Y
Success.

All done!

Log in to the MySQL shell.

$ mysql -u root -p

Enter your root password when prompted.

Create a test database and user with access permission. Replace testdb and testuser with appropriate names for your setup. Replace password with a strong password.

mysql> CREATE DATABASE testdb;
mysql> CREATE USER 'testuser' IDENTIFIED BY 'Your_Password123';
mysql> GRANT ALL PRIVILEGES ON testdb.* TO 'testuser';
mysql> FLUSH PRIVILEGES;

Exit the MySQL shell.

mysql> exit

Step 5 - Configure OpenLiteSpeed

Switch HTTP port back to 80

Let us change the default HTTP port to 80. Log in to your administration panel at http://<YOURSERVERIP>:7080 with the credentials you just created.

Visit the Listeners section from the left. You will see the default listeners with port 8080.

Click the View button to see the detailed configuration. On the next page under Listener Default > General Page, click on the Edit icon and change the port from 8080 to 80.

Click Save and restart the server by clicking the Graceful restart button.

Step 6 - Configure PHP

In this step, we need to associate our copy of PHP 8.2 with the server.

Click on the Server Configuration section on the left and then on the tab External App. You will see an existing LiteSpeed App for PHP. We will make some edits to it.

Click on the Edit button to edit the PHP app.

Next, match the configuration as shown below. Leave all the other fields blank.

Name: lsphp
Address: uds://tmp/lshttpd/lsphp.sock
Max Connections: 35
Environment: PHP_LSAPI_MAX_REQUESTS=500
             PHP_LSAPI_CHILDREN=35
             LSAPI_AVOID_FORK=200M
Initial Request Timeout (secs): 60
Retry Timeout : 0
Persistent Connection: Yes
Response Buffering: no
Start By Server: Yes(Through CGI Daemon)
Command: lsphp82/bin/lsphp
Back Log: 100
Instances: 1
Priority: 0
Memory Soft Limit (bytes): 2047M
Memory Hard Limit (bytes): 2047M
Process Soft Limit: 1400
Process Hard Limit: 1500

Click Save when finished.

Now that we have created our own PHP 8.2 app, we must tell the server to start using it. Since we edited the default listing, it is already configured. Restart the server by clicking on the Graceful restart button.

To test whether your PHP has been switched correctly, visit http://<YOURSERVERIP>/phpinfo.php in your browser.

Step 7 - Create VirtualHost

First, we need to create directories for our virtual host.

$ sudo mkdir /usr/local/lsws/example.com/{html,logs} -p

The html directory will hold the public files and the logs directory will contain server logs.

Next, open the Admin console, access the Virtual Hosts section from the left, and click the Add button.

Fill in the values as specified

Virtual Host Name: example.com
Virtual Host Root: $SERVER_ROOT/example.com/
Config File: $SERVER_ROOT/conf/vhosts/$VH_NAME/vhconf.conf
Follow Symbolic Link: Yes
Enable Scripts/ExtApps: Yes
Restrained: Yes
External App Set UID Mode: Server UID

Click on the Save button when finished. You will get the following error because the configuration file doesn't exist as of now. Click on the link to create the configuration file.

Click the Save button again to finish creating the Virtual Host.

Once the virtual host is created, go to Virtual Hosts -> Choose Virtual Host(example.com) -> General and modify the configuration as given.

Document Root: $VH_ROOT/html/
Domain Name: example.com
Enable GZIP Compression: Yes
Enable Brotli Compression: Yes