Nginx & Apache Config Generator

🔒 Certbot auto-renews — but only if your config is valid

Certbot sets up a systemd timer or cron job to renew certificates before they expire. It does a dry run test first. If your config has a syntax error, renewal will fail silently. Run certbot renew --dry-run monthly to confirm renewal still works.

📁 File permissions matter more than the config

Nginx/Apache runs as www-data (or nginx). Your document root must be readable by that user. The standard setup: files owned by your deploy user, group www-data, with chmod 755 on directories and 644 on files. Laravel's storage and bootstrap/cache need 775.

🧪 Always test config before reloading

A typo in your config will take down all sites on the server. Before reloading: nginx -t (Nginx) or apachectl configtest (Apache). Only reload after a clean test: systemctl reload nginx.

🚀 PHP-FPM pools: match workers to your CPU

The default PHP-FPM pool uses dynamic process management. For production, set pm = ondemand on low-traffic sites to save RAM, or pm = static with pm.max_children = 2× CPU cores for high-traffic sites.

🔑 Security headers are free performance and protection

The X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers cost nothing to add and block entire classes of attacks. Enable the Security Headers option above — they're added as a single block.

📊 Logs rotate automatically — but check their size

Access logs can grow to gigabytes on busy sites. On Ubuntu, logrotate handles this automatically. Confirm it's configured: cat /etc/logrotate.d/nginx. If you're on a small VPS, point logs to /dev/null for static assets to reduce I/O.