Turkey (Turkish)
Germany (German)
Worldwide (English)
For HTTP validation/redirect and HTTPS traffic, verify both firewall policy and listening services.
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
“Nginx is installed and PHP works” is not a production definition. DNS, TLS, FPM sockets, deployment layout, logs, health checks and rollback must form one observable chain.
PHP-FPM version and socket path depend on installed packages. Inspect `/run/php/` instead of blindly copying an example socket path.
Validate the app locally over HTTP first, then add domain and TLS. For 502 errors check PHP-FPM socket/upstream before DNS; for TLS failures verify DNS and ports 80/443 before application code.
Validate the app locally over HTTP first, then add domain and TLS. For 502 errors check PHP-FPM socket/upstream before DNS; for TLS failures verify DNS and ports 80/443 before application code.
Build a production web stack on Ubuntu 26.04 with Nginx server blocks, PHP-FPM sockets, TLS, UFW, log rotation, health checks, deployment layout and rollback.
For HTTP validation/redirect and HTTPS traffic, verify both firewall policy and listening services.
Inspect actual installed PHP-FPM sockets rather than guessing a versioned path.
Run syntax validation before every Nginx reload.
A homepage 200 can hide DB/queue failures; a dedicated health endpoint is more meaningful.
Separating code releases, public web root and persistent data makes rollback safer.
| Path | Purpose |
|---|---|
| /var/www/app/releases/20260817-2200 | Immutable release code |
| /var/www/app/current | Active release symlink |
| /var/www/app/shared | Persistent uploads/config |
sudo install -d -o www-data -g www-data /var/www/app/releases /var/www/app/sharedsudo ln -sfn /var/www/app/releases/20260817-2200 /var/www/app/currentProve the domain → server → Nginx → application chain over plain HTTP before adding TLS.
sudo apt install nginx -ysudo nginx -tsudo systemctl enable --now nginxcurl -I http://127.0.0.1ss -lntp | grep -E ":80|:443"A wrong socket path is a common Nginx 502 cause; exhausted or crashing FPM workers are another.
ls -lah /run/php/systemctl list-units --type=service | grep phpgrep -R "^pm\.\|^listen" /etc/php/*/fpm/pool.d/www.confjournalctl -u php*-fpm --since "20 min ago" --no-pager 2>/dev/null | tail -80Many ACME failures come from wrong A/AAAA records, blocked ports or proxy/origin routing.
dig +short A example.comdig +short AAAA example.comsudo ufw allow "Nginx Full"sudo apt install certbot python3-certbot-nginx -ysudo certbot --nginx -d example.com -d www.example.comsystemctl list-timers | grep certbotProduction logs should answer which layer failed. Correlation IDs across Nginx, PHP-FPM and application logs speed diagnosis.
sudo tail -f /var/log/nginx/error.logsudo logrotate -d /etc/logrotate.d/nginxjournalctl -u nginx -u php*-fpm --since today --no-pager 2>/dev/null | tail -100A release symlink allows code rollback without recopying files. Database migration rollback must be designed separately.
readlink -f /var/www/app/currentsudo ln -sfn /var/www/app/releases/ONCEKI_SURUM /var/www/app/currentsudo nginx -t && sudo systemctl reload nginxA curl from the server can bypass DNS, network and CDN layers. Use an external probe.
curl -fsS https://example.com/healthcurl -o /dev/null -sS -w "code=%{http_code} connect=%{time_connect} ttfb=%{time_starttransfer} total=%{time_total}
" https://example.com/openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates -issuerPHP-FPM workers, cache, database and storage I/O share VPS resources. Choose a simple single-server or staging+production design on Eka Sunucu based on real traffic.
Primary documentation and technical references used by this guide.
Continue with related infrastructure and implementation guides.
Ubuntu 26.04 Web Server
Do not blindly hard-code a version or socket. Discover installed packages with `php -v`, `/run/php/` and systemd because PPAs/panels can change the version.
No. The upstream can be down, socket path wrong, permissions invalid or reverse proxy pointing to the wrong target.
It can be used for origin TLS behind Cloudflare proxy, but direct browser-to-origin access and SSL mode must be designed accordingly.
Release directories plus symlinks, prebuilt dependencies and controlled FPM reloads reduce code-switch time; database migrations require separate planning.