This guide shows you how to install Chamilo with LEMP Stack on Rocky Linux 8 and finish with a secured HTTPS learning portal. You will deploy Chamilo 1.11.40 with Nginx, MariaDB, PHP 8.3, and SELinux-aware permissions in about 15\u201320 minutes, assuming DNS already points to the VPS.<\/p>\n\n\n\n
sudo<\/code>.<\/li>\n\n\n- A public IPv4 address and a domain such as
YOUR_DOMAIN<\/code>, with an A record already pointed at the server.<\/li>\n\n\n- Ports 22, 80, and 443 allowed in both the VPS firewall and the server’s
firewalld<\/code> policy.<\/li>\n\n\n- A long database password, a separate Chamilo administrator password, and an email address for certificate notices.<\/li>\n\n\n
- A VPSLake Linux VPS<\/a> with enough memory for your expected number of learners and uploaded course files.<\/li>\n\n<\/ul>\n\n\n\n
Step 1: Install the Rocky Linux web stack<\/h2>\n\n\n\n
Rocky Linux 8’s default PHP stream is not the right target for the 1.11 branch, so enable PHP 8.3 from Remi before installing PHP-FPM and its extensions.<\/p>\n\n\n\n
sudo dnf update -y\nsudo dnf install -y epel-release firewalld mariadb-server nginx unzip curl bind-utils policycoreutils-python-utils\nsudo dnf install -y https:\/\/rpms.remirepo.net\/enterprise\/remi-release-8.rpm\nsudo dnf module reset php -y\nsudo dnf module enable php:remi-8.3 -y\nsudo dnf install -y php php-cli php-fpm php-curl php-gd php-intl php-mbstring php-mysqlnd php-opcache php-process php-soap php-xml php-zip\nsudo sed -ri 's\/^[; ]*user = .*\/user = nginx\/; s\/^[; ]*group = .*\/group = nginx\/; s\/^[; ]*listen.owner = .*\/listen.owner = nginx\/; s\/^[; ]*listen.group = .*\/listen.group = nginx\/' \/etc\/php-fpm.d\/www.conf\nsudo sed -ri 's\/^memory_limit = .*\/memory_limit = 256M\/; s\/^upload_max_filesize = .*\/upload_max_filesize = 100M\/; s\/^post_max_size = .*\/post_max_size = 100M\/; s\/^max_execution_time = .*\/max_execution_time = 300\/; s\/^max_input_time = .*\/max_input_time = 600\/; s\/^max_input_vars = .*\/max_input_vars = 3000\/' \/etc\/php.ini\nsudo systemctl enable --now firewalld mariadb nginx php-fpm\nsudo systemctl restart php-fpm\nphp -v\nnginx -v\nmariadb --version<\/code><\/pre>\n\n\n\nYou should see PHP 8.3.x, an Nginx version, and a MariaDB client version. Package patch numbers will change as Rocky Linux and Remi publish updates.<\/p>\n\n\n\n
PHP 8.3.x (cli) ...\nnginx version: nginx\/...\nmariadb Ver ...<\/code><\/pre>\n\n\n\nStep 2: Create the Chamilo database<\/h2>\n\n\n\n
Chamilo keeps accounts, courses, and portal settings in MariaDB. A local database account restricted to one schema keeps that data separate from other applications on the VPS.<\/p>\n\n\n\n
First run the MariaDB hardening wizard and remove anonymous users, the test database, and remote root login when prompted:<\/p>\n\n\n\n
sudo mysql_secure_installation<\/code><\/pre>\n\n\n\nCreate the database after replacing YOUR_DB_PASSWORD<\/code> with a unique password. Do not reuse your SSH or Chamilo administrator password.<\/p>\n\n\n\nsudo mariadb <<'SQL'\nCREATE DATABASE chamilo CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;\nCREATE USER 'chamilo_user'@'localhost' IDENTIFIED BY 'YOUR_DB_PASSWORD';\nGRANT ALL PRIVILEGES ON chamilo.* TO 'chamilo_user'@'localhost';\nFLUSH PRIVILEGES;\nSQL\nsudo mariadb -e \"SHOW DATABASES LIKE 'chamilo';\"<\/code><\/pre>\n\n\n\nThe check should return a row named chamilo<\/code>. The database does not need a public port because PHP-FPM will connect through the local socket or loopback interface.<\/p>\n\n\n\nStep 3: Download Chamilo and label its writable directories<\/h2>\n\n\n\n
Use the numbered archive listed on the official Chamilo download page<\/a> instead of an unversioned development checkout. Chamilo 1.11.40 supports PHP 8.3 and is documented in the official 1.11 installation guide<\/a>.<\/p>\n\n\n\nThe extraction check below finds the archive’s top-level directory, so it remains safe if the ZIP layout changes slightly:<\/p>\n\n\n\n
CHAMILO_VERSION=1.11.40\nsudo curl -fL -o \"\/tmp\/chamilo-${CHAMILO_VERSION}.zip\" \"https:\/\/github.com\/chamilo\/chamilo-lms\/releases\/download\/v${CHAMILO_VERSION}\/chamilo-${CHAMILO_VERSION}.zip\"\nsudo mkdir -p \"\/tmp\/chamilo-${CHAMILO_VERSION}-extract\" \/var\/www\/chamilo\nsudo unzip -q \"\/tmp\/chamilo-${CHAMILO_VERSION}.zip\" -d \"\/tmp\/chamilo-${CHAMILO_VERSION}-extract\"\nCHAMILO_SOURCE=\"$(find \"\/tmp\/chamilo-${CHAMILO_VERSION}-extract\" -type f -path '*\/main\/install\/index.php' -printf '%h\\n' | sed 's#\/main\/install$##' | head -n 1)\"\ntest -n \"$CHAMILO_SOURCE\"\nsudo cp -a \"$CHAMILO_SOURCE\"\/. \/var\/www\/chamilo\/<\/code><\/pre>\n\n\n\nNginx needs to read the application, while only the directories used for configuration and uploads should be writable. The SELinux rules make that permission survive a relabel or reboot.<\/p>\n\n\n\n
sudo chown -R root:nginx \/var\/www\/chamilo\nsudo find \/var\/www\/chamilo -type d -exec chmod 0750 {} \\;\nsudo find \/var\/www\/chamilo -type f -exec chmod 0640 {} \\;\nsudo chown -R nginx:nginx \/var\/www\/chamilo\/app \/var\/www\/chamilo\/web \/var\/www\/chamilo\/main\/default_course_document\/images \/var\/www\/chamilo\/main\/lang\nsudo find \/var\/www\/chamilo\/app \/var\/www\/chamilo\/web \/var\/www\/chamilo\/main\/default_course_document\/images \/var\/www\/chamilo\/main\/lang -type d -exec chmod 0770 {} \\;\nsudo find \/var\/www\/chamilo\/app \/var\/www\/chamilo\/web \/var\/www\/chamilo\/main\/default_course_document\/images \/var\/www\/chamilo\/main\/lang -type f -exec chmod 0660 {} \\;\nsudo semanage fcontext -a -t httpd_sys_content_t '\/var\/www\/chamilo(\/.*)?'\nsudo semanage fcontext -a -t httpd_sys_rw_content_t '\/var\/www\/chamilo\/(app|web|main\/default_course_document\/images|main\/lang)(\/.*)?'\nsudo restorecon -Rv \/var\/www\/chamilo<\/code><\/pre>\n\n\n\nStep 4: Configure the Chamilo Nginx server block<\/h2>\n\n\n\n
Chamilo’s course, SCORM, document, and badge URLs need explicit rewrites; a basic try_files<\/code> rule alone often produces 404 errors after login. Create the HTTP server block below and replace YOUR_DOMAIN<\/code> in the server_name<\/code> line.<\/p>\n\n\n\nsudo tee \/etc\/nginx\/conf.d\/chamilo.conf > \/dev\/null <<'NGINX'\nserver {\n listen 80;\n listen [::]:80;\n server_name YOUR_DOMAIN;\n\n root \/var\/www\/chamilo;\n index index.php;\n charset utf-8;\n client_max_body_size 100m;\n autoindex off;\n\n location @chamilo_routes {\n rewrite ^\/certificates\/$ \/certificates\/index.php last;\n rewrite ^\/courses\/([^\/]+)\/$ \/main\/course_home\/course_home.php?cDir=$1 last;\n rewrite ^\/courses\/([^\/]+)\/index.php$ \/main\/course_home\/course_home.php?cDir=$1 last;\n rewrite ^\/courses\/([^\/]+)\/scorm\/(.*\\.(js|css|png|jpg|jpeg|gif))$ \/app\/courses\/$1\/scorm\/$2 last;\n rewrite ^\/courses\/([^\/]+)\/scorm\/(.*)$ \/main\/document\/download_scorm.php?doc_url=\/$2&cDir=$1 last;\n rewrite ^\/courses\/([^\/]+)\/document\/certificates\/(.*)$ \/app\/courses\/$1\/document\/certificates\/$2 last;\n rewrite ^\/courses\/([^\/]+)\/document\/(.*)$ \/main\/document\/download.php?doc_url=\/$2&cDir=$1 last;\n rewrite ^\/courses\/([^\/]+)\/upload\/([^\/]+)\/(.*)$ \/main\/document\/download_uploaded_files.php?code=$1&type=$2&file=$3 last;\n rewrite ^\/courses\/([^\/]+)\/work\/(.*)$ \/main\/work\/download.php?file=work\/$2&cDir=$1 last;\n rewrite ^\/courses\/([^\/]+)\/upload\/course_home_icons\/(.*\\.(png|jpg|jpeg|gif))$ \/app\/courses\/$1\/upload\/course_home_icons\/$2 last;\n rewrite ^\/courses\/([^\/]+)\/(.*)$ \/app\/courses\/$1\/$2 last;\n rewrite ^\/session\/(\\d+)\/about\/?$ \/main\/session\/about.php?session_id=$1 last;\n rewrite ^\/course\/(\\d+)\/about\/?$ \/main\/course_info\/about.php?course_id=$1 last;\n rewrite ^\/badge\/(\\d+) \/main\/badge\/issued.php?issue=$1 last;\n rewrite ^\/skill\/(\\d+)\/user\/(\\d+) \/main\/badge\/issued_all.php?skill=$1&user=$2 last;\n rewrite ^\/badge\/(\\d+)\/user\/(\\d+) \/main\/badge\/issued_all.php?skill=$1&user=$2 last;\n rewrite ^\/main\/exercice\/(.*)$ \/main\/exercise\/$1 last;\n rewrite ^\/main\/newscorm\/(.*)$ \/main\/lp\/$1 last;\n rewrite ^\/service\/(\\d+)$ \/plugin\/buycourses\/src\/service_information.php?service_id=$1 last;\n rewrite ^\/main\/upload\/users\/(.*)\/(.*)\/my_files\/(.*)$ \/app\/upload\/users\/$1\/$2\/my_files\/$3 last;\n try_files $uri \/index.php$is_args$args;\n }\n\n location \/ {\n try_files $uri @chamilo_routes;\n }\n\n location \/main {\n rewrite ^\/main\/([^\/]+)\/?$ \/main\/$1\/index.php last;\n }\n\n location ~ \\.php$ {\n try_files $uri @chamilo_routes;\n include fastcgi_params;\n fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;\n fastcgi_param HTTPS $https;\n fastcgi_pass unix:\/run\/php-fpm\/www.sock;\n }\n\n location ~* \\.(png|jpe?g|gif|ico|js|css|mp3|swf|flv|mp4|ogg|woff|woff2)$ {\n rewrite ^\/courses\/([^\/]+)\/course-pic85x85.png$ \/app\/courses\/$1\/course-pic85x85.png last;\n rewrite ^\/courses\/([^\/]+)\/course-pic.png$ \/app\/courses\/$1\/course-pic.png last;\n rewrite ^\/courses\/([^\/]+)\/scorm\/(.*)$ \/main\/document\/download_scorm.php?doc_url=\/$2&cDir=$1 last;\n rewrite ^\/courses\/([^\/]+)\/document\/(.*)$ \/main\/document\/download.php?doc_url=\/$2&cDir=$1 last;\n rewrite ^\/courses\/([^\/]+)\/work\/(.*)$ \/main\/work\/download.php?file=work\/$2&cDir=$1 last;\n rewrite ^\/courses\/([^\/]+)\/upload\/(.*)$ \/app\/courses\/$1\/upload\/$2 last;\n rewrite ^\/courses\/(.*)$ \/app\/courses\/$1 break;\n expires 30d;\n access_log off;\n try_files $uri @chamilo_routes;\n }\n\n location ^~ \/app\/config\/ { deny all; }\n location ^~ \/vendor\/ { deny all; }\n location ^~ \/tests\/ { deny all; }\n location ^~ \/main\/inc\/lib\/javascript\/bigupload\/files\/ { deny all; }\n location ~ \/\\. { deny all; }\n location ~* \/web\\.config$ { deny all; }\n}\nNGINX\nsudo nginx -t\nsudo systemctl reload nginx<\/code><\/pre>\n\n\n\nNginx should print syntax is ok<\/code> and test is successful<\/code>. Keep the document root at \/var\/www\/chamilo<\/code>; the rewrite targets assume that exact path.<\/p>\n\n\n\nnginx: the configuration file \/etc\/nginx\/nginx.conf syntax is ok\nnginx: configuration file \/etc\/nginx\/nginx.conf test is successful<\/code><\/pre>\n\n\n\nStep 5: Open the firewall and enable HTTPS<\/h2>\n\n\n\n
Allow only the services needed for administration, certificate validation, and normal web traffic. Certbot can then add the TLS listener and redirect HTTP requests without exposing MariaDB.<\/p>\n\n\n\n
sudo firewall-cmd --permanent --zone=public --add-service=ssh\nsudo firewall-cmd --permanent --zone=public --add-service=http\nsudo firewall-cmd --permanent --zone=public --add-service=https\nsudo firewall-cmd --reload\nsudo firewall-cmd --list-services\nsudo dnf install -y certbot python3-certbot-nginx\nsudo certbot --nginx --redirect --agree-tos --no-eff-email -m YOUR_EMAIL -d YOUR_DOMAIN\nsudo nginx -t<\/code><\/pre>\n\n\n\nThe service list should contain ssh<\/code>, http<\/code>, and https<\/code>. The certificate request will fail unless YOUR_DOMAIN<\/code> resolves publicly to this VPS and port 80 is reachable.<\/p>\n\n\n\nStep 6: Run the Chamilo browser installer<\/h2>\n\n\n\n
The web installer writes the portal configuration and creates the first administrator, so this is where the database values become part of the application.<\/p>\n\n\n\n
Open https:\/\/YOUR_DOMAIN\/main\/install\/index.php<\/code> and enter these values when asked:<\/p>\n\n\n\n\n\n- Database type: MySQL or MariaDB<\/li>\n\n\n
- Database host:
localhost<\/code><\/li>\n\n\n- Database port:
3306<\/code><\/li>\n\n\n- Database name:
chamilo<\/code><\/li>\n\n\n- Database user:
chamilo_user<\/code><\/li>\n\n\n- Database password: the value used for
YOUR_DB_PASSWORD<\/code><\/li>\n\n<\/ul>\n\n\n\nChoose the portal language, set a unique administrator password, and finish the wizard. If it reports a write error, fix ownership and SELinux labels from Step 3 before continuing.<\/p>\n\n\n\n
After the dashboard loads, make the generated configuration readable but no longer writable by the web process:<\/p>\n\n\n\n
sudo chown -R root:nginx \/var\/www\/chamilo\/app\/config\nsudo find \/var\/www\/chamilo\/app\/config -type d -exec chmod 0750 {} \\;\nsudo find \/var\/www\/chamilo\/app\/config -type f -exec chmod 0640 {} \\;\nsudo rm -f \/tmp\/chamilo-1.11.40.zip<\/code><\/pre>\n\n\n\nVerify the Chamilo installation<\/h2>\n\n\n\n
Check the services and required PHP modules from SSH, then sign in over HTTPS and create a small course with one uploaded document. That last browser test exercises the rewrites, database connection, TLS, and writable paths together.<\/p>\n\n\n\n
sudo systemctl is-active nginx php-fpm mariadb firewalld\nsudo nginx -t\nphp -v | head -n 1\nphp -m | grep -E 'curl|gd|intl|mbstring|mysqli|PDO|soap|xml|zip'\ncurl -fsSI https:\/\/YOUR_DOMAIN\/<\/code><\/pre>\n\n\n\nactive\nactive\nactive\nactive\nsyntax is ok\ntest is successful\nPHP 8.3.x (cli) ...\nHTTP\/2 200<\/code><\/pre>\n\n\n\nThe module order can differ, and a redirect status is also normal if the portal sends unauthenticated visitors to its login page. A successful login and course-file upload are the meaningful application checks.<\/p>\n\n\n\n