Install Bagisto on Rocky Linux 8 with Apache, PHP 8.4, MariaDB 10.11, and Composer, then put the store behind HTTPS. Budget about 25 minutes on a clean VPS, including the interactive store installer and certificate setup.
Prerequisites
- Rocky Linux 8.10, fully updated, with a public IPv4 address.
- A root account or a sudo-enabled user connected over SSH.
- At least 2 GB RAM and 10 GB free disk space for the application, dependencies, database, and uploaded media.
- A domain such as
YOUR_DOMAINpointing to the VPS; ports 80 and 443 must reach the server. - A Linux server from VPSLake with enough storage for your catalog and media.
- A strong database password, a separate Bagisto administrator password, and an email address for certificate notices.
This guide installs the current Bagisto 2.5 release line. Bagisto’s system requirements call for PHP 8.4, Composer 2, and MariaDB 10.11 or another supported database. Rocky Linux 8’s original PHP stream is older, so the first step enables the Remi PHP 8.4 stream.
Step 1: Install the LAMP packages
Rocky’s package manager installs Apache and PHP-FPM, while a MariaDB repository supplies the database version expected by Bagisto.
sudo dnf -y update
sudo dnf -y install epel-release dnf-plugins-core
sudo dnf config-manager --set-enabled powertools
sudo dnf -y install https://rpms.remirepo.net/enterprise/remi-release-8.rpm
sudo dnf module reset php -y
sudo dnf module enable php:remi-8.4 -y
sudo tee /etc/yum.repos.d/MariaDB.repo > /dev/null <<'REPO'
[mariadb]
name=MariaDB 10.11
baseurl=https://rpm.mariadb.org/10.11/rhel/$releasever/$basearch
gpgkey=https://rpm.mariadb.org/RPM-GPG-KEY-MariaDB
gpgcheck=1
enabled=1
module_hotfixes=1
REPO
sudo dnf -y install httpd MariaDB-server MariaDB-client php php-cli php-common php-fpm php-bcmath php-curl php-gd php-intl php-mbstring php-mysqlnd php-opcache php-pdo php-process php-xml php-zip unzip curl policycoreutils-python-utils firewalld
sudo systemctl enable --now firewalld httpd mariadb php-fpmSet PHP limits that allow larger product images and Composer operations without changing the package-managed php.ini.
sudo tee /etc/php.d/99-bagisto.ini > /dev/null <<'INI'
memory_limit = 512M
upload_max_filesize = 100M
post_max_size = 110M
max_execution_time = 300
max_input_time = 300
INI
sudo systemctl restart php-fpm
php -v
mariadb --version
sudo systemctl is-active httpd mariadb php-fpmPHP 8.4.x (cli) ...
mariadb Ver 15.1 Distrib 10.11.x-MariaDB ...
active
active
activeStep 2: Configure firewalld before publishing the site
Allow SSH for administration and the two web services; do not expose MariaDB’s port because the application uses the database locally.
sudo firewall-cmd --permanent --zone=public --add-service=ssh
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-servicesssh dhcpv6-client http httpsStep 3: Harden MariaDB and create the Bagisto database
The hardening wizard removes unused database access, and a dedicated account limits Bagisto to its own schema.
sudo mariadb-secure-installationWhen prompted, remove anonymous users, disallow remote root login, remove the test database, and reload the privilege tables. Then create the database and grant access for both common local connection forms; this prevents a localhost versus 127.0.0.1 mismatch during installation.
sudo mariadb <<'SQL'
CREATE DATABASE bagisto CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'bagisto'@'localhost' IDENTIFIED BY 'YOUR_DB_PASSWORD';
CREATE USER 'bagisto'@'127.0.0.1' IDENTIFIED BY 'YOUR_DB_PASSWORD';
GRANT ALL PRIVILEGES ON bagisto.* TO 'bagisto'@'localhost';
GRANT ALL PRIVILEGES ON bagisto.* TO 'bagisto'@'127.0.0.1';
FLUSH PRIVILEGES;
SQL
mariadb -u bagisto -p -h 127.0.0.1 bagisto -e 'SELECT VERSION();'Replace YOUR_DB_PASSWORD in the SQL block with a long, unique password. The final command asks for it without placing the value in shell history.
VERSION()
10.11.x-MariaDBStep 4: Install Composer with checksum verification
Composer is Bagisto’s dependency manager, and checking the installer signature before executing it reduces the risk of running a corrupted download. This follows the current Composer installation procedure.
cd /tmp
curl -fsSL https://getcomposer.org/installer -o composer-setup.php
EXPECTED_CHECKSUM="$(curl -fsSL https://composer.github.io/installer.sig)"
ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
test "$EXPECTED_CHECKSUM" = "$ACTUAL_CHECKSUM"
sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer --2
rm -f composer-setup.php
composer --versionComposer version 2.x.x 20xx-xx-xxStep 5: Create the application with Composer
Running the project as a non-login service account keeps the web application files away from root-owned Composer operations.
sudo useradd --system --home-dir /var/www/bagisto --shell /sbin/nologin --user-group bagisto
sudo install -d -o bagisto -g bagisto -m 0750 /var/www/bagisto
sudo -u bagisto -H composer create-project --no-dev --prefer-dist --no-interaction bagisto/bagisto /var/www/bagisto "2.5.*"The Composer command creates the .env file and application key. The project’s public/ directory, rather than /var/www/bagisto, will be the only directory Apache exposes.
Step 6: Set permissions and keep SELinux enforcing
Apache needs read access to the application, while Laravel needs write access only to storage and bootstrap/cache; SELinux labels make that boundary persistent across relabels.
sudo chown -R bagisto:apache /var/www/bagisto
sudo find /var/www/bagisto -type d -exec chmod 0750 {} \;
sudo find /var/www/bagisto -type f -exec chmod 0640 {} \;
sudo chmod -R g+rwX /var/www/bagisto/storage /var/www/bagisto/bootstrap/cache
sudo semanage fcontext -a -t httpd_sys_content_t '/var/www/bagisto(/.*)?'
sudo semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/bagisto/storage(/.*)?'
sudo semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/bagisto/bootstrap/cache(/.*)?'
sudo restorecon -Rv /var/www/bagisto
sudo setsebool -P httpd_can_network_connect_db 1The database boolean permits the PHP-FPM web process to reach MariaDB locally without disabling SELinux.
Step 7: Configure Apache and PHP-FPM
The virtual host points requests at Bagisto’s front controller and sends PHP files to the Rocky Linux PHP-FPM socket.
Replace YOUR_DOMAIN in this block before running it.
sudo tee /etc/httpd/conf.d/YOUR_DOMAIN.conf > /dev/null <<'APACHE'
<VirtualHost *:80>
ServerName YOUR_DOMAIN
DocumentRoot /var/www/bagisto/public
<Directory /var/www/bagisto/public>
Options -Indexes +FollowSymLinks
AllowOverride All
Require all granted
</Directory>
<FilesMatch \.php$>
SetHandler "proxy:unix:/run/php-fpm/www.sock|fcgi://localhost"
</FilesMatch>
DirectoryIndex index.php
ErrorLog /var/log/httpd/YOUR_DOMAIN-error.log
CustomLog /var/log/httpd/YOUR_DOMAIN-access.log combined
</VirtualHost>
APACHE
sudo apachectl configtest
sudo systemctl restart php-fpm httpdSyntax OKStep 8: Run the Bagisto installer and enable HTTPS
The installer writes the database settings, migrations, seed data, and administrator account; Certbot then changes the public virtual host to HTTPS.
sudo -u bagisto -H bash -lc 'cd /var/www/bagisto && php artisan bagisto:install'At the prompts, enter https://YOUR_DOMAIN for the application URL, bagisto for the database name and user, 127.0.0.1 for the host, the value used for YOUR_DB_PASSWORD, and a unique administrator email and password. The command finishes after it creates the store tables and admin account.
Confirm DNS already resolves to this VPS, then request the certificate. Replace ADMIN_EMAIL with an address that should receive renewal notices.
sudo dnf -y install certbot python3-certbot-apache mod_ssl
sudo certbot --apache --redirect --agree-tos --no-eff-email -m ADMIN_EMAIL -d YOUR_DOMAIN
sudo certbot renew --dry-runCongratulations, all simulated renewals succeededVerify the Bagisto installation
Check the installation marker, PHP modules, services, and public HTTPS response. A successful page may return 200 OK or an application redirect, depending on the storefront state.
sudo -u bagisto test -f /var/www/bagisto/storage/installed && echo 'Bagisto installed'
php -m | grep -E 'bcmath|curl|gd|intl|mbstring|PDO|pdo_mysql|SimpleXML|xml|zip'
sudo systemctl is-active httpd mariadb php-fpm
curl -I https://YOUR_DOMAIN/Bagisto installed
bcmath
curl
gd
intl
mbstring
PDO
pdo_mysql
zip
active
active
active
HTTP/2 200Troubleshooting
Composer says the PHP version is too old
Rocky’s original AppStream may still be selected, or the Remi module switch did not complete. Inspect the active stream, enable PHP 8.4 again, synchronize packages, and confirm the CLI version before rerunning Composer.
sudo dnf module list php
sudo dnf module reset php -y
sudo dnf module enable php:remi-8.4 -y
sudo dnf distro-sync -y
php -vSQLSTATE[HY000] or “Access denied for user”
The installer values do not match the MariaDB account, or MariaDB is stopped. Test the same host, username, and database interactively, then enter the matching password in the installer.
sudo systemctl status mariadb --no-pager
mariadb -u bagisto -p -h 127.0.0.1 bagisto -e 'SELECT 1;'Apache returns 403 or Bagisto cannot write to storage
The document root may point at the project root, or the writable directories lost their group permissions or SELinux labels. Reapply the deployment permissions and contexts, then restart PHP-FPM and Apache.
sudo chmod -R g+rwX /var/www/bagisto/storage /var/www/bagisto/bootstrap/cache
sudo restorecon -Rv /var/www/bagisto
sudo systemctl restart php-fpm httpd503 Service Unavailable or “Primary script unknown”
PHP-FPM may be stopped, or Apache may be configured for a socket that does not exist. Verify the service and socket, then check the Apache configuration for a typo.
sudo systemctl status php-fpm --no-pager
sudo ls -l /run/php-fpm/www.sock
sudo apachectl configtestHardening
- Keep
APP_DEBUG=falsein/var/www/bagisto/.envafter installation, and clear the configuration cache after changing environment values. - Back up the
bagistodatabase and/var/www/bagisto/storagebefore upgrades or catalog imports. - Limit SSH to your administration network when possible, and use SSH keys instead of password authentication.
- Review certificate renewal output periodically; Certbot’s
--dry-runcheck should remain successful.
FAQ
Which Bagisto version does this Rocky Linux 8 guide install?
The Composer constraint installs the Bagisto 2.5 release line. It is paired here with PHP 8.4 and MariaDB 10.11, rather than the much older package versions used by legacy Bagisto tutorials.
Does Bagisto require Node.js on the server?
Not for a normal Composer deployment serving the packaged storefront and admin assets. Install Node.js only if you plan to rebuild frontend or admin assets after customizing the source.
Why does Apache use the public directory?
Laravel’s public entry point and browser-facing files live there. Using the project root as the document root could expose .env, Composer metadata, and application code to web requests.
Can I use php artisan serve in production?
No. That command is intended for local development and does not replace Apache, PHP-FPM, TLS, or production process management. Keep Apache as the public web server and use the PHP-FPM socket configured above.
