How to Install Chevereto Free on Debian 11 with LAMP

Install Chevereto Free on Debian 11 and turn a fresh VPS into a private image-hosting site in about 20 minutes. This guide builds the LAMP stack around Apache, MariaDB, and PHP 8.2, then adds HTTPS and the recurring Chevereto scheduler.

Debian 11 (Bullseye) is past its normal release lifecycle, so use this procedure for an existing Bullseye server and plan a move to a supported Debian release. The current Chevereto Free line needs PHP 8.2, which is why the guide uses the signed PHP repository instead of Debian 11’s older default PHP package.

Prerequisites

• A 64-bit VPS running Debian GNU/Linux 11 (Bullseye), with at least 2 GB of RAM and 20 GB of free disk space for the application, thumbnails, and uploads.
• SSH access as root, or a normal account with working sudo privileges.
• A domain such as YOUR_DOMAIN pointed with an A record to the VPS IPv4 address. Use the domain’s DNS name for HTTPS; an IP-only installation cannot receive a normal Let’s Encrypt certificate.
• Outbound HTTPS access to the Debian mirrors, the PHP package repository, and Chevereto’s download service.
• A VPSLake Linux VPS if you need a Debian server with root access for this installation.

The commands below use sudo. If you are already logged in as root, remove sudo from each command. Replace every uppercase placeholder immediately before running its block.

Step 1: Confirm Bullseye and install the base LAMP packages

Confirming the release first prevents you from mixing Debian repositories meant for another version.

grep -E '^(PRETTY_NAME|VERSION_CODENAME)=' /etc/os-release
dpkg --print-architecture
sudo apt update
sudo apt install -y apache2 mariadb-server ca-certificates curl gnupg unzip ufw certbot python3-certbot-apache

Debian 11 should report VERSION_CODENAME=bullseye; the common VPS architectures are amd64 and arm64.

PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
VERSION_CODENAME=bullseye
amd64

Enable both services now and after every reboot:

sudo systemctl enable --now apache2 mariadb
sudo systemctl is-active apache2 mariadb

Expected output:

active
active

Step 2: Install PHP 8.2 and Chevereto’s required extensions

Chevereto Free 4.5 uses PHP 8.2, but Bullseye’s standard repository does not provide that branch. Add the signed Bullseye repository maintained by the Debian PHP package maintainer, then install the Apache PHP module and the extensions Chevereto uses for database access, image processing, uploads, and XML handling.

sudo apt install -y lsb-release
sudo curl -fsSL https://packages.sury.org/debsuryorg-archive-keyring.deb -o /tmp/debsuryorg-archive-keyring.deb
sudo dpkg -i /tmp/debsuryorg-archive-keyring.deb
printf '%s\n' 'Types: deb' 'URIs: https://packages.sury.org/php/' 'Suites: bullseye' 'Components: main' 'Architectures: amd64 arm64 armhf' 'Signed-By: /usr/share/keyrings/deb.sury.org-php.gpg' | sudo tee /etc/apt/sources.list.d/php.sources >/dev/null
sudo apt update
sudo apt install -y php8.2 libapache2-mod-php8.2 php8.2-cli php8.2-mysql php8.2-curl php8.2-gd php8.2-imagick php8.2-mbstring php8.2-xml php8.2-zip

If dpkg --print-architecture returned only one architecture, the extra architectures line is harmless for APT, but packages are selected for the host’s native architecture. Check the PHP version and important modules:

php8.2 -v
php8.2 -m | grep -E 'curl|exif|fileinfo|gd|imagick|mysqli|PDO|pdo_mysql|xml|zip'

You should see PHP 8.2 and module names including curl, gd, imagick, PDO, pdo_mysql, xml, and zip. Chevereto’s PHP stack requirements list the extensions and writable paths used by the application.

Set sensible upload and memory limits for an image site, then reload Apache:

sudo sed -i 's/^memory_limit = .*/memory_limit = 512M/' /etc/php/8.2/apache2/php.ini
sudo sed -i 's/^upload_max_filesize = .*/upload_max_filesize = 64M/' /etc/php/8.2/apache2/php.ini
sudo sed -i 's/^post_max_size = .*/post_max_size = 64M/' /etc/php/8.2/apache2/php.ini
sudo sed -i 's/^max_execution_time = .*/max_execution_time = 120/' /etc/php/8.2/apache2/php.ini
sudo a2enmod php8.2 rewrite headers
sudo systemctl restart apache2

Step 3: Create a MariaDB database and account

Give Chevereto a separate database and least-privilege account so the application does not use the MariaDB administrator login.

sudo mariadb <<'SQL'
CREATE DATABASE chevereto CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'chevereto'@'localhost' IDENTIFIED BY 'YOUR_DB_PASSWORD';
GRANT ALL PRIVILEGES ON chevereto.* TO 'chevereto'@'localhost';
FLUSH PRIVILEGES;
SQL

Replace YOUR_DB_PASSWORD with a long, unique password before running the block. Keep it available for the web installer; do not put it in a public script or commit it to a repository. Confirm that the account can reach the empty database:

mariadb -u chevereto -p -e 'SELECT VERSION(), DATABASE();' chevereto

After entering the password, MariaDB should return one row with its version and chevereto as the selected database.

Step 4: Create the Apache virtual host

The virtual host maps your domain to a dedicated document root, while AllowOverride All lets Chevereto’s bundled .htaccess route requests through its front controller.

sudo mkdir -p /var/www/chevereto
sudo tee /etc/apache2/sites-available/YOUR_DOMAIN.conf >/dev/null <<'APACHE'
<VirtualHost *:80>
    ServerName YOUR_DOMAIN
    ServerAdmin YOUR_EMAIL
    DocumentRoot /var/www/chevereto

    <Directory /var/www/chevereto>
        Options -Indexes +FollowSymLinks +MultiViews
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/YOUR_DOMAIN-error.log
    CustomLog ${APACHE_LOG_DIR}/YOUR_DOMAIN-access.log combined
</VirtualHost>
APACHE
sudo a2dissite 000-default.conf
sudo a2ensite YOUR_DOMAIN.conf
sudo apache2ctl configtest
sudo systemctl reload apache2

Replace YOUR_DOMAIN with the real hostname and YOUR_EMAIL with an administrator email address. A successful syntax check prints:

Syntax OK

Step 5: Download and place Chevereto Free

The official release endpoint supplies the current self-hosted package; extracting it directly into the virtual host keeps the URL at the domain root.

sudo curl -fL https://chevereto.com/api/download/latest -o /tmp/chevereto.zip
sudo unzip -q /tmp/chevereto.zip -d /var/www/chevereto
test -f /var/www/chevereto/index.php

The final command should produce no output and return successfully. Chevereto’s installation documentation describes the release package and the browser-based setup.

Give Apache read access to the code and write access only to the directories Chevereto uses for configuration and user-generated media:

sudo chown -R root:www-data /var/www/chevereto
sudo find /var/www/chevereto -type d -exec chmod 0755 {} \;
sudo find /var/www/chevereto -type f -exec chmod 0644 {} \;
sudo install -d -o www-data -g www-data -m 0775 /var/www/chevereto/content /var/www/chevereto/images /var/www/chevereto/importing
sudo chown root:www-data /var/www/chevereto/app
sudo chmod 0775 /var/www/chevereto/app

Step 6: Allow web traffic and enable HTTPS

Open only SSH, HTTP, and HTTPS in UFW, then let Certbot create the TLS virtual-host rules and redirect plain HTTP to HTTPS.

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw --force enable
sudo ufw status verbose

The status should show Status: active and rules for the three services. If SSH uses a custom port, add that port before enabling UFW or you can lock yourself out.

Make sure YOUR_DOMAIN resolves to this VPS before requesting the certificate:

sudo certbot --apache --redirect --agree-tos --no-eff-email -m YOUR_EMAIL -d YOUR_DOMAIN

Certbot should finish with a success message and write the certificate under /etc/letsencrypt/live/YOUR_DOMAIN/. Its renewal timer handles future renewals; test the renewal path without changing the live certificate:

sudo certbot renew --dry-run

Step 7: Finish the web installer and add the scheduler

The browser setup creates Chevereto’s tables, writes its environment file, and creates the first administrator account.

Open https://YOUR_DOMAIN in a browser. When the setup form appears, enter these database values:

• Database driver: MySQL/MariaDB
• Database host: localhost
• Database name: chevereto
• Database user: chevereto
• Database password: the value used for YOUR_DB_PASSWORD
• Table prefix: chv_

Choose a unique administrator username and a strong password. After the installer completes, remove the temporary write permission from the application directory and protect the generated environment file:

sudo chmod 0755 /var/www/chevereto/app
sudo chown root:www-data /var/www/chevereto/app/env.php
sudo chmod 0640 /var/www/chevereto/app/env.php

Chevereto’s scheduler handles recurring application jobs. Run it every five minutes as the web account:

sudo tee /etc/cron.d/chevereto >/dev/null <<'CRON'
*/5 * * * * www-data cd /var/www/chevereto && /usr/bin/php8.2 app/bin/cli -C cron >/dev/null 2>&1
CRON
sudo chmod 0644 /etc/cron.d/chevereto

Verify the Chevereto installation

These checks confirm that Apache serves the HTTPS site, PHP is executing, the upload directories are writable, and the scheduler command can start without an interactive shell.

sudo apache2ctl configtest
sudo systemctl is-active apache2 mariadb
curl -sSIL https://YOUR_DOMAIN | head -n 5
sudo -u www-data test -w /var/www/chevereto/content
sudo -u www-data /usr/bin/php8.2 /var/www/chevereto/app/bin/cli -C cron

Expected results include Syntax OK, two active lines, an HTTP redirect or 200 response over HTTPS, and no output from the two successful test and scheduler commands. Sign in to the Chevereto dashboard and upload a small image; it should appear in the gallery and remain available after a page refresh.

Troubleshooting

php8.2 has no installation candidate

APT did not read the Bullseye PHP repository, or the host is not actually running Debian 11. Check the codename, keyring, and repository metadata:

grep -E '^(ID|VERSION_CODENAME)=' /etc/os-release
cat /etc/apt/sources.list.d/php.sources
apt-cache policy php8.2
sudo apt update

The source must use Suites: bullseye, and apt-cache policy should show a candidate from packages.sury.org. Fix any signature or DNS error before retrying the package install.

Apache shows 404 Not Found or ignores Chevereto routes

The site may not be enabled, or Apache cannot read the .htaccess rules because rewriting is disabled. Confirm the active vhost and modules, then reload after correcting the file:

sudo apache2ctl -S
sudo a2enmod rewrite
sudo apache2ctl configtest
sudo systemctl reload apache2

Check that the vhost’s DocumentRoot is /var/www/chevereto and that its <Directory> block has AllowOverride All. Also confirm that /var/www/chevereto/index.php exists rather than being hidden one directory deeper after extraction.

SQLSTATE or database connection failure during setup

The installer cannot authenticate with the MariaDB account or is using a different database name than the one created above. Test the exact credentials from the shell and re-enter them with host localhost:

mariadb -u chevereto -p -h localhost -e 'SELECT 1;' chevereto

If the test fails, reset the account password from a local MariaDB administrator session and use the new value in the installer. Do not use the MariaDB root account in Chevereto.

Uploads fail or the dashboard reports unwritable folders

Apache needs write access to content, images, and importing; a recursive chmod 777 is unnecessary and unsafe. Restore the intended owner and mode, then check the path as the web user:

sudo chown -R www-data:www-data /var/www/chevereto/content /var/www/chevereto/images /var/www/chevereto/importing
sudo find /var/www/chevereto/content /var/www/chevereto/images /var/www/chevereto/importing -type d -exec chmod 0775 {} \;
sudo -u www-data test -w /var/www/chevereto/images

If larger files fail, compare the upload size with upload_max_filesize and post_max_size in /etc/php/8.2/apache2/php.ini, then restart Apache.

Hardening

• Keep Debian 11 isolated from unrelated services and schedule an upgrade to a supported Debian release; the PHP repository does not extend the operating system’s support lifecycle.
• Back up both the chevereto MariaDB database and /var/www/chevereto/images before upgrades. Test restoring the database on a separate server.
• Review UFW rules with the VPSLake UFW firewall generator if you add mail, object storage, or a monitoring service.
• Keep the Chevereto package, PHP 8.2 packages, Apache, and MariaDB updated, but take a database and media backup before replacing application files.

FAQ

Can Chevereto Free run on Debian 11?

Yes, but the current Free release needs PHP 8.2, while Bullseye’s default PHP is older. This guide installs PHP 8.2 from a signed Bullseye-compatible repository and leaves the rest of the server on Debian 11 packages.

Do I need a domain for Chevereto?

You can test the site by IP address, but a domain is strongly recommended for HTTPS and a stable public URL. Let’s Encrypt certificates are issued for domain names, not bare server IP addresses.

Where does Chevereto store uploaded images?

The application stores user-generated media below its images and content directories. Include both directories in backups, along with the MariaDB database; copying only the PHP files will not preserve the gallery.

Why does the installer need PHP 8.2 instead of Debian 11’s PHP?

Chevereto V4’s supported PHP matrix does not include Bullseye’s original PHP branch. Using the required PHP version avoids runtime errors caused by missing language features and keeps the Apache module aligned with the CLI used by the scheduler.