Editing Wiki.tetrain.com Runbook (section)

== Phase 4 — Production stack (verified exact — matches live installed packages/config) ==

On the same Rocky 9 box, independent of the Docker hop chain (which is only used to walk the DB schema forward — production runs natively, not in Docker).

=== 4.1 Packages ===

<pre>
<nowiki>
dnf install -y httpd mod_ssl
dnf module reset php -y
dnf module enable php:8.3 -y     # confirms which stream — live box runs 8.3.31
dnf install -y php php-fpm php-mysqlnd php-gd php-mbstring php-xml php-intl php-opcache
dnf install -y mariadb-server mariadb-backup
dnf install -y certbot python3-certbot-apache
</nowiki>
</pre>

(Exact versions confirmed live: <code><nowiki>httpd-2.4.62</nowiki></code>, <code><nowiki>php-8.3.31</nowiki></code>/<code><nowiki>php-fpm-8.3.31</nowiki></code>, <code><nowiki>mariadb-server-10.11.18</nowiki></code>, <code><nowiki>certbot-3.1.0</nowiki></code>.)

=== 4.2 PHP-FPM ↔ Apache wiring ===

<code><nowiki>/etc/php-fpm.d/www.conf</nowiki></code> (confirmed live values):

<pre>
<nowiki>
listen = /run/php-fpm/www.sock
listen.acl_users = apache,nginx
listen.allowed_clients = 127.0.0.1
</nowiki>
</pre>

Apache vhost routes <code><nowiki>.php</nowiki></code> to that socket (see the full vhost block in Phase 8, which shows the final version after the DNS-cutover edit — the original pre-cutover version was identical minus the <code><nowiki>ServerAlias</nowiki></code>):

<pre>
<nowiki>
<FilesMatch \.php$>
    SetHandler "proxy:unix:/run/php-fpm/www.sock|fcgi://localhost"
</FilesMatch>
</nowiki>
</pre>

<pre>
<nowiki>
systemctl enable --now php-fpm
systemctl enable --now httpd
</nowiki>
</pre>

=== 4.3 MariaDB — hardened, scoped DB user (not root) ===

<pre>
<nowiki>
systemctl enable --now mariadb
mysql_secure_installation   # [reconstructed] — remove anonymous users, remove remote root,
                             # drop test DB; interactive, answers: Y to all prompts, set a root
                             # password when asked

mysql -u root -p <<'EOF'
CREATE DATABASE my_wiki CHARACTER SET binary;
CREATE USER 'wikiuser'@'localhost' IDENTIFIED BY '<random-generated-password>';
GRANT ALL PRIVILEGES ON my_wiki.* TO 'wikiuser'@'localhost';
FLUSH PRIVILEGES;
EOF
</nowiki>
</pre>

Credentials were generated randomly and stored root-only-readable at <code><nowiki>/root/.mariadb_root_credentials</nowiki></code> and <code><nowiki>/root/.wiki_db_credentials</nowiki></code> on the box — never in chat, never in this doc. Confirmed live: <code><nowiki>wikiuser</nowiki></code>@<code><nowiki>localhost</nowiki></code> exists and is what <code><nowiki>LocalSettings.php</nowiki></code> actually uses (<code><nowiki>$wgDBuser = "wikiuser"</nowiki></code>), not <code><nowiki>root</nowiki></code>.

=== 4.4 Firewall + TLS ===

<pre>
<nowiki>
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

certbot --apache -d wiki-new.tetrain.com --non-interactive --agree-tos \
  -m root@wiki-new.tetrain.com --redirect
</nowiki>
</pre>

Confirmed live via <code><nowiki>/etc/letsencrypt/renewal/wiki-new.tetrain.com.conf</nowiki></code>: <code><nowiki>authenticator = apache</nowiki></code>, <code><nowiki>installer = apache</nowiki></code>, ECDSA key type, auto-renewal configured. This is the exact same command pattern used again in Phase 8 to expand the cert — see there for the real, later-run command including <code><nowiki>--expand</nowiki></code>.

'''Verify''': <code><nowiki>curl -I https://wiki-new.tetrain.com/</nowiki></code> returns a real TLS handshake (this session's original note: "confirmed serving HTTPS correctly, 403 expected — empty docroot, MediaWiki not deployed yet" at this point in the sequence).

----