How to Set Up a LEMP Stack

A LEMP stack — Linux, Nginx, MariaDB (or MySQL), and PHP — is a proven foundation for hosting web applications, WordPress sites, and custom PHP projects. This guide walks through installing and wiring together each component on a fresh server, then verifies the stack works end-to-end before you deploy anything real.

Install Nginx

Debian / Ubuntu

sudo apt update
sudo apt install -y nginx

Fedora / RHEL / Rocky

sudo dnf install -y nginx

Arch

sudo pacman -S --noconfirm nginx

Enable and start Nginx with systemd:

sudo systemctl enable --now nginx

If a firewall is active, open HTTP and HTTPS traffic:

# ufw (Debian/Ubuntu)
sudo ufw allow 'Nginx Full'

# firewalld (Fedora/RHEL/Rocky)
sudo firewall-cmd --permanent --add-service=http --add-service=https
sudo firewall-cmd --reload

Confirm Nginx is serving by visiting http://YOUR_SERVER_IP in a browser. You should see the default welcome page.

Install MariaDB

MariaDB is the recommended drop-in replacement for MySQL on most distros. If your application specifically requires Oracle MySQL, substitute mysql-server in the commands below — the configuration steps are identical.

Debian / Ubuntu

sudo apt install -y mariadb-server

Fedora / RHEL / Rocky

sudo dnf install -y mariadb-server

Arch

sudo pacman -S --noconfirm mariadb
sudo mariadb-install-db --user=mysql --basedir=/usr --datadir=/var/lib/mysql

Enable and start the service, then run the security script:

sudo systemctl enable --now mariadb
sudo mariadb-secure-installation

The interactive script asks you to set a root password, remove anonymous users, disallow remote root login, and drop the test database. Accept all recommendations unless you have a specific reason not to.

Create an application database and user

Never let your application connect as the MariaDB root user. Create a dedicated account:

sudo mariadb -u root -p

CREATE DATABASE myapp CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'myapp_user'@'localhost' IDENTIFIED BY 'StrongPassw0rd!';
GRANT ALL PRIVILEGES ON myapp.* TO 'myapp_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Install PHP-FPM

Nginx does not execute PHP natively; it passes requests to PHP-FPM (FastCGI Process Manager) over a Unix socket. Install PHP-FPM and the extensions most applications need:

Debian / Ubuntu

sudo apt install -y php-fpm php-mysql php-mbstring php-xml php-curl php-zip

On Ubuntu/Debian the service name includes the version, e.g. php8.3-fpm. Check with:

systemctl list-units 'php*fpm*'

Fedora / RHEL / Rocky

sudo dnf install -y php-fpm php-mysqlnd php-mbstring php-xml php-curl php-zip

Arch

sudo pacman -S --noconfirm php-fpm php-gd

Enable and start PHP-FPM:

sudo systemctl enable --now php-fpm

On Debian/Ubuntu use the versioned unit name, for example:

sudo systemctl enable --now php8.3-fpm

Confirm the socket path

You need the Unix socket path to configure Nginx. The default locations are:

• Debian/Ubuntu: /run/php/php8.x-fpm.sock
• Fedora/RHEL/Rocky: /run/php-fpm/www.sock
• Arch: /run/php-fpm/php-fpm.sock

Verify the socket exists and is active:

ls -l /run/php-fpm/www.sock   # adjust path for your distro

Configure Nginx to Use PHP-FPM

Create a server block for your site. Replace example.com and the socket path as needed.

sudo nano /etc/nginx/sites-available/example.com

On Fedora/RHEL/Rocky, the equivalent directory is /etc/nginx/conf.d/; create example.com.conf there instead and skip the symlink step.

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com/public;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;   # Debian/Ubuntu
        # On RHEL/Arch replace the line above with:
        # fastcgi_split_path_info ^(.+\.php)(/.+)$;
        # include fastcgi_params;
        # fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

        fastcgi_pass unix:/run/php/php8.3-fpm.sock;  # adjust socket path
    }

    location ~ /\.ht {
        deny all;
    }
}

On Debian/Ubuntu, enable the site and remove the default:

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default

Test the configuration syntax before reloading:

sudo nginx -t

Expected output (will vary slightly): nginx: configuration file /etc/nginx/nginx.conf test is successful

sudo systemctl reload nginx

Create the Web Root and a Test Page

sudo mkdir -p /var/www/example.com/public
sudo chown -R www-data:www-data /var/www/example.com   # use 'nginx' on RHEL/Arch

echo '

sudo rm /var/www/example.com/public/info.php

systemctl is-active nginx mariadb php-fpm   # or php8.3-fpm on Debian/Ubuntu

mariadb -u myapp_user -p -e "SELECT VERSION();" myapp

listen.owner = nginx
listen.group = nginx
listen.mode = 0660

sudo setsebool -P httpd_can_network_connect 1