To install Bludit CMS with Nginx on AlmaLinux 8, you will configure PHP-FPM, download the current Bludit release, and publish it over HTTPS. A fresh VPS with DNS already configured should reach the browser installer in about 15 minutes, with no database server required.
Prerequisites
- A fresh AlmaLinux 8.x VPS with at least 1 GB RAM, 10 GB of free disk space, and a public IPv4 address.
- Root access or a sudo-enabled user connected over SSH. The commands below use
sudo. - A domain such as
YOUR_DOMAINwith an A record pointing to the VPS. Keep ports 80 and 443 available for the website and certificate validation. - A strong, unique Bludit administrator password. Bludit stores content in files, so MariaDB or MySQL is not needed.
- A VPSLake Linux VPS running AlmaLinux 8 is a suitable starting point for a small Bludit site.
- The latest Bludit requirements call for PHP 8.0 or newer plus the
mbstring,gd,dom, andjsonmodules.
Step 1: Install Nginx and PHP-FPM
AlmaLinux 8 uses dnf, while the Remi PHP stream provides a current PHP branch that meets Bludit 3.22.0’s PHP requirement.
sudo dnf update -y
sudo dnf install -y epel-release firewalld nginx curl unzip bind-utils policycoreutils-python-utils
sudo dnf install -y https://rpms.remirepo.net/enterprise/remi-release-8.rpm
sudo dnf module reset php -y
sudo dnf module enable php:remi-8.3 -y
sudo dnf install -y php php-fpm php-cli php-gd php-mbstring php-xml php-curl php-zip php-opcache
sudo sed -ri 's/^[;[:space:]]*user[[:space:]]*=.*/user = nginx/; s/^[;[:space:]]*group[[:space:]]*=.*/group = nginx/; s/^[;[:space:]]*listen\.owner[[:space:]]*=.*/listen.owner = nginx/; s/^[;[:space:]]*listen\.group[[:space:]]*=.*/listen.group = nginx/' /etc/php-fpm.d/www.conf
sudo systemctl enable --now firewalld nginx php-fpm
sudo systemctl restart php-fpm
php -v
php -m | grep -E 'dom|gd|json|mbstring'The version check should show PHP 8.3.x, followed by dom, gd, json, and mbstring. Patch numbers can change as the repositories publish updates. PHP-FPM will listen on /run/php-fpm/www.sock, which the Nginx server block uses later.
Step 2: Download Bludit and set secure permissions
Bludit is a flat-file CMS, so the application archive and the writable bl-content directory replace the database setup used by many other PHP applications.
cd /tmp
curl -fL -o bludit.zip https://www.bludit.com/releases/bludit-3-22-0.zip
sudo unzip -q bludit.zip -d /tmp
sudo install -d /var/www/bludit
sudo cp -a /tmp/bludit-3-22-0/. /var/www/bludit/
sudo chown -R root:nginx /var/www/bludit
sudo find /var/www/bludit -type d -exec chmod 0750 {} \;
sudo find /var/www/bludit -type f -exec chmod 0640 {} \;
sudo chown -R nginx:nginx /var/www/bludit/bl-content
sudo find /var/www/bludit/bl-content -type d -exec chmod 0770 {} \;
sudo find /var/www/bludit/bl-content -type f -exec chmod 0660 {} \;The archive is pinned to Bludit 3.22.0 so a future release cannot silently change this installation. Root owns the code, while PHP-FPM can write only the content area that stores pages, settings, users, uploads, and workspace data.
Keep SELinux enforcing and label those two areas according to how they are used:
sudo semanage fcontext -a -t httpd_sys_content_t '/var/www/bludit(/.*)?'
sudo semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/bludit/bl-content(/.*)?'
sudo restorecon -Rv /var/www/bluditStep 3: Create the Nginx server block
Bludit routes friendly URLs through index.php; the protected locations prevent direct access to its JSON data and executable core files.
Create /etc/nginx/conf.d/bludit.conf, replacing YOUR_DOMAIN with the hostname in your DNS record:
server {
listen 80;
listen [::]:80;
server_name YOUR_DOMAIN;
root /var/www/bludit;
index index.php;
client_max_body_size 16m;
location ^~ /bl-content/databases/ { deny all; }
location ^~ /bl-content/pages/ { deny all; }
location ^~ /bl-content/workspaces/ { deny all; }
location ~* ^/bl-kernel/.*\.php$ { deny all; }
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ \.php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param HTTPS $https if_not_empty;
fastcgi_pass unix:/run/php-fpm/www.sock;
}
}Write the file with your editor, then test before reloading Nginx:
sudo vi /etc/nginx/conf.d/bludit.conf
sudo nginx -t
sudo systemctl reload nginxExpected output is:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successfulThe ~* ^/bl-kernel/.*\.php$ expression is a real regular-expression match. A ^~ location containing *.php would treat the asterisk literally and would not protect nested PHP files.
Step 4: Open the firewall and enable HTTPS
Allow SSH for administration, HTTP for the Let’s Encrypt challenge, and HTTPS for the finished site. If your VPS has a separate provider firewall, allow the same TCP ports there.
sudo firewall-cmd --permanent --zone=public --add-service=ssh
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-servicesConfirm that YOUR_DOMAIN resolves to this server before requesting a certificate:
dig +short YOUR_DOMAINInstall the Nginx Certbot plugin and let it add the TLS listener and HTTP-to-HTTPS redirect:
sudo dnf install -y certbot python3-certbot-nginx
sudo certbot --nginx --redirect --agree-tos --no-eff-email -m YOUR_EMAIL -d YOUR_DOMAINReplace YOUR_EMAIL with an address that receives renewal notices. Certbot needs the domain to resolve publicly and port 80 to reach this VPS. Its final output should say that the certificate was successfully deployed.
Step 5: Finish the Bludit setup in your browser
The web installer creates the site configuration and administrator account in bl-content, so no database credentials are involved.
Open https://YOUR_DOMAIN in a browser. Select the installer language, enter a site name, choose an administrator username, and create a long unique password. Save the password in a password manager, then submit the form and sign in at the administrator address shown by Bludit.
If you see a permission warning, stop the installer and run the following commands before trying again:
sudo chown -R nginx:nginx /var/www/bludit/bl-content
sudo restorecon -Rv /var/www/bludit/bl-content
sudo systemctl restart php-fpmBludit’s official Nginx notes explain the front-controller rule and the sensitive directories that should not be served directly. The site should now load at its HTTPS address, and the administrator panel should allow you to create a test page and upload an image.
Verify the Bludit installation
Run these checks from SSH, then open the site in a private browser window to confirm the certificate and login session work together.
sudo systemctl is-active nginx php-fpm firewalld
sudo nginx -t
php -m | grep -E 'dom|gd|json|mbstring'
curl -fsSI https://YOUR_DOMAINAfter the installer completes, expect four active lines, a successful Nginx test, the four PHP modules, and an HTTPS response such as HTTP/2 200. A 302 redirect to the installer is normal before the browser setup is complete.
Troubleshooting
502 Bad Gateway
Nginx cannot reach PHP-FPM, usually because the service is stopped or the socket path differs from the server block. Check sudo systemctl status php-fpm, confirm that /run/php-fpm/www.sock exists, and restart PHP-FPM after rechecking the pool settings in /etc/php-fpm.d/www.conf.
The installer says bl-content is not writable
The nginx account needs write access and an SELinux writable label on that directory. Run the ownership and restorecon commands from Step 5, then check sudo ls -Zd /var/www/bludit/bl-content; the label should include httpd_sys_rw_content_t.
Friendly URLs return 404, but the home page loads
The request may be reaching another Nginx server block, or the front-controller fallback was changed. Run sudo nginx -T | grep -A8 -B2 'server_name YOUR_DOMAIN', verify try_files $uri $uri/ /index.php?$args;, and reload Nginx after correcting the file.
Certbot reports a timeout or failed validation
The DNS A record may still point to another address, or port 80 may be blocked by firewalld, the VPS control panel, or an upstream network firewall. Compare dig +short YOUR_DOMAIN with the VPS public IP, allow HTTP, and rerun Certbot after DNS has updated.
Hardening and maintenance
- Back up the complete
/var/www/bludittree, especiallybl-content, before upgrades; it contains the pages, users, site settings, and uploaded files. - Keep AlmaLinux, PHP, Nginx, and Bludit updated. Read the release notes and take a backup before replacing files within the same Bludit major version.
- Test certificate renewal with
sudo certbot renew --dry-runafter HTTPS is working. - Keep SELinux enforcing and do not make the whole document root writable. Add write access only to a directory that a specific Bludit plugin genuinely needs.
FAQ
Does Bludit require MariaDB or MySQL?
No. Bludit is a flat-file CMS and stores its content and configuration as files and JSON beneath bl-content. That makes the installation smaller, but file backups are essential because there is no database dump to restore.
Can I install Bludit without a domain name?
You can test it over the VPS IP address, but a domain is the practical choice for a public site. This guide uses Let’s Encrypt, whose HTTP validation requires a publicly resolvable domain.
Why use PHP 8.3 on AlmaLinux 8?
The default AlmaLinux 8 PHP stream may be older than Bludit’s current minimum. The Remi 8.3 module supplies a maintained PHP branch while preserving the AlmaLinux PHP-FPM service and socket layout used here.
Where should I look when a page or image disappears?
Start with /var/www/bludit/bl-content, then inspect the Nginx error log at /var/log/nginx/error.log and the PHP-FPM journal with sudo journalctl -u php-fpm. Restore the latest complete file backup rather than creating broad permissions if content is missing or unreadable.
