Hướng dẫn Deploy PHP lên VPS: Self-hosting với Docker và Nginx

User → Domain → DNS → Nginx (Port 80/443)
                        ↓
                   Docker Network
                        ↓
              ┌─────────┴─────────┐
              ↓                   ↓
        PHP-FPM Container   MySQL Container
        (Port 9000)         (Port 3306)

ssh root@your_server_ip
# hoặc nếu dùng non-root user
ssh user@your_server_ip

sudo apt update && sudo apt upgrade -y

sudo apt install -y curl wget git build-essential

# Remove old versions
for pkg in docker.io docker-doc docker-compose docker-compose-v2 podman-docker containerd runc; do sudo apt-get remove $pkg; done

# Add Docker's official GPG key:
sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update

# Install latest version
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Start Docker service
sudo systemctl start docker
sudo systemctl enable docker

# Verify installation
docker --version

sudo usermod -aG docker $USER
newgrp docker

# Update package index
sudo apt update

# Install Nginx
sudo apt install nginx

# Verify installation
nginx -v

# Check firewall status
sudo ufw status

# Nếu firewall chưa active, enable nó
sudo ufw enable

# Allow OpenSSH (quan trọng - nếu không bạn có thể bị lock out)
sudo ufw allow 'OpenSSH'

# Allow Nginx traffic
sudo ufw allow 'Nginx Full'

# Verify firewall rules
sudo ufw status

# Check Nginx status
sudo systemctl status nginx

# Nếu chưa chạy, start Nginx
sudo systemctl start nginx

# Enable Nginx để tự động start khi reboot
sudo systemctl enable nginx

# Tạo file config cho domain của bạn
sudo nano /etc/nginx/sites-available/your-domain.com

server {
    listen 80;
    listen [::]:80;

    server_name your-domain.com www.your-domain.com;

    root /var/www/html;
    index index.php index.html index.htm;

    # Logging
    access_log /var/log/nginx/your-domain.access.log;
    error_log /var/log/nginx/your-domain.error.log;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass php-fpm:9000;  # PHP-FPM container
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny all;
    }
}

php-simple-app/
├── src/                    # PHP source code
│   ├── index.php          # Main entry point
│   ├── config.php         # Configuration
│   └── db.php             # Database connection
├── public/                # Public files (assets)
├── Dockerfile             # PHP-FPM container definition
├── docker-compose.yml     # Multi-container setup
├── nginx.conf             # Nginx configuration
├── deploy.sh              # Deployment script
└── .env.example           # Environment variables example

FROM php:8.2-fpm-alpine

# Install system dependencies
RUN apk add --no-cache \
    git \
    curl \
    libpng-dev \
    libzip-dev \
    zip \
    unzip \
    mysql-client

# Install PHP extensions
RUN docker-php-ext-install pdo_mysql mysqli zip gd

# Install Composer
COPY --from=composer:latest /usr/bin/composer /usr/bin/composer

# Set working directory
WORKDIR /var/www/html

# Copy application files
COPY src/ /var/www/html/
COPY public/ /var/www/html/public/

# Set permissions
RUN chown -R www-data:www-data /var/www/html
RUN chmod -R 755 /var/www/html

# Expose PHP-FPM port
EXPOSE 9000

CMD ["php-fpm"]

services:
    nginx:
        image: nginx:alpine
        ports:
            - "80:80"
            - "443:443"
        volumes:
            - ./src:/var/www/html:ro
            - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
        depends_on:
            - php-fpm
        networks:
            - app_network

    php-fpm:
        build:
            context: .
            dockerfile: Dockerfile
        volumes:
            - ./src:/var/www/html
            - ./public:/var/www/html/public
        environment:
            - DB_HOST=mysql
            - DB_NAME=${DB_NAME}
            - DB_USER=${DB_USER}
            - DB_PASSWORD=${DB_PASSWORD}
        depends_on:
            - mysql
        networks:
            - app_network

    mysql:
        image: mysql:8.0
        environment:
            MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
            MYSQL_DATABASE: ${DB_NAME}
            MYSQL_USER: ${DB_USER}
            MYSQL_PASSWORD: ${DB_PASSWORD}
        volumes:
            - mysql_data:/var/lib/mysql
        ports:
            - "3306:3306"
        networks:
            - app_network

volumes:
    mysql_data:

networks:
    app_network:
        driver: bridge

<?php
require_once 'config.php';
require_once 'db.php';

$db = new Database();
$conn = $db->getConnection();

// Example query
$stmt = $conn->prepare("SELECT * FROM users LIMIT 10");
$stmt->execute();
$users = $stmt->fetchAll(PDO::FETCH_ASSOC);

?>
<!DOCTYPE html>
<html lang="vi">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>PHP Simple App</title>
    <style>
        body {
            font-family: Arial, sans-serif;
            max-width: 1200px;
            margin: 0 auto;
            padding: 20px;
            background: #f5f5f5;
        }
        .container {
            background: white;
            padding: 30px;
            border-radius: 8px;
            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
        }
        h1 {
            color: #333;
        }
        table {
            width: 100%;
            border-collapse: collapse;
            margin-top: 20px;
        }
        th, td {
            padding: 12px;
            text-align: left;
            border-bottom: 1px solid #ddd;
        }
        th {
            background-color: #4CAF50;
            color: white;
        }
        .info {
            background: #e3f2fd;
            padding: 15px;
            border-radius: 4px;
            margin-bottom: 20px;
        }
    </style>
</head>
<body>
    <div class="container">
        <h1>🚀 PHP Application trên VPS</h1>

        <div class="info">
            <strong>Server Info:</strong><br>
            PHP Version: <?php echo phpversion(); ?><br>
            Server: <?php echo $_SERVER['SERVER_SOFTWARE']; ?><br>
            Document Root: <?php echo $_SERVER['DOCUMENT_ROOT']; ?>
        </div>

        <h2>Database Connection: ✅ Connected</h2>

        <table>
            <thead>
                <tr>
                    <th>ID</th>
                    <th>Name</th>
                    <th>Email</th>
                    <th>Created At</th>
                </tr>
            </thead>
            <tbody>
                <?php if (empty($users)): ?>
                    <tr>
                        <td colspan="4">No users found. Run database migrations first.</td>
                    </tr>
                <?php else: ?>
                    <?php foreach ($users as $user): ?>
                        <tr>
                            <td><?php echo htmlspecialchars($user['id']); ?></td>
                            <td><?php echo htmlspecialchars($user['name']); ?></td>
                            <td><?php echo htmlspecialchars($user['email']); ?></td>
                            <td><?php echo htmlspecialchars($user['created_at']); ?></td>
                        </tr>
                    <?php endforeach; ?>
                <?php endif; ?>
            </tbody>
        </table>
    </div>
</body>
</html>

# Vào MySQL container
docker exec -it php-simple-app-mysql-1 mysql -u root -p

# Tạo database và user (nếu chưa có)
CREATE DATABASE IF NOT EXISTS myapp_db;
CREATE USER IF NOT EXISTS 'myuser'@'%' IDENTIFIED BY 'mypassword';
GRANT ALL PRIVILEGES ON myapp_db.* TO 'myuser'@'%';
FLUSH PRIVILEGES;
EXIT;

# Vào PHP container
docker exec -it php-simple-app-php-fpm-1 sh

# Hoặc import SQL file
docker exec -i php-simple-app-mysql-1 mysql -u myuser -pmypassword myapp_db < schema.sql

CREATE TABLE IF NOT EXISTS users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    name VARCHAR(100) NOT NULL,
    email VARCHAR(100) UNIQUE NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

INSERT INTO users (name, email) VALUES
('John Doe', 'john@example.com'),
('Jane Smith', 'jane@example.com'),
('Bob Johnson', 'bob@example.com');

# Download script
curl -o ~/deploy-php.sh https://raw.githubusercontent.com/xirothedev/blog-tech/main/deploy-php.sh

# Chỉnh sửa các biến
nano ~/deploy-php.sh
# Thay đổi: EMAIL, DOMAIN_NAME, DB credentials

# Chạy script
chmod +x ~/deploy-php.sh
./deploy-php.sh

#!/bin/bash

set -e

# Configuration
EMAIL="your-email@example.com"
DOMAIN="your-domain.com"
PROJECT_DIR="/opt/php-app"

echo "Starting PHP deployment..."

# Update system
sudo apt update && sudo apt upgrade -y

# Install Docker
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh

# Install Docker Compose
sudo curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose

# Install Nginx
sudo apt install -y nginx

# Copy project files
if [ -d "$PROJECT_DIR" ]; then
    cd $PROJECT_DIR && git pull
else
    git clone https://github.com/xirothedev/blog-tech/php-app.git $PROJECT_DIR
    cd $PROJECT_DIR
fi

# Generate SSL certificate
sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d $DOMAIN --non-interactive --agree-tos -m $EMAIL

# Build and start containers
cd $PROJECT_DIR
sudo docker-compose build
sudo docker-compose up -d

echo "Deployment completed!"

sudo apt install -y certbot python3-certbot-nginx

# Automatic configuration với Nginx
sudo certbot --nginx -d your-domain.com

# Hoặc chỉ generate certificate
sudo certbot certonly --nginx -d your-domain.com

# Test renewal
sudo certbot renew --dry-run

# Check renewal status
sudo systemctl status certbot.timer

# /etc/nginx/nginx.conf
http {
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

    server {
        location / {
            limit_req zone=api_limit burst=20 nodelay;
            try_files $uri $uri/ /index.php?$query_string;
        }
    }
}

server {
    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Hide PHP version
    fastcgi_hide_header X-Powered-By;
}

; Disable dangerous functions
disable_functions = exec,passthru,shell_exec,system,proc_open,popen

; Hide PHP version
expose_php = Off

; Error reporting (production)
display_errors = Off
log_errors = On

# Backup MySQL
docker exec php-simple-app-mysql-1 mysqldump -u myuser -pmypassword myapp_db > backup_$(date +%Y%m%d).sql

# Restore from backup
docker exec -i php-simple-app-mysql-1 mysql -u myuser -pmypassword myapp_db < backup_20250101.sql

# Check Docker containers
docker ps -a

# Check Docker logs
docker-compose logs --tail=100 php-fpm
docker-compose logs --tail=100 nginx

# Check Nginx config
sudo nginx -t

# Check PHP-FPM status
docker exec php-fpm-1 php-fpm -v

# Test database connection
docker exec mysql-1 mysql -u myuser -pmypassword -e "SHOW DATABASES;"