Install and maintain Joomla on Ubuntu

Joomla is installed from the latest selected release under a domain-specific Apache root, with PHP 8.3, MariaDB, a prepared installer configuration, TLS, UFW, and Fail2ban.

Before you start

• Use a clean, supported Ubuntu server with root or sudo access.
• Point app.example.com to the server before requesting a public TLS certificate.
• Replace every value written as CHANGE_ME and store the generated credentials in a password manager.
• Take a snapshot before changing an existing installation.
• A database name/user/password, site name, administrator username/password, and administrator email.
• A unique database table prefix.

What the AppStore installation creates

• Apache, PHP 8.3 extensions, and MariaDB
• Joomla release files below /var/www/app.example.com/public_html
• Domain Apache virtual host and TLS
• Prepared installation settings followed by normal Joomla configuration

1. Install Apache, PHP 8.3, and MariaDB

sudo apt update
sudo apt install -y apache2 mariadb-server curl unzip \
  php8.3 php8.3-cli php8.3-mysql php8.3-curl php8.3-gd php8.3-intl php8.3-mbstring php8.3-xml php8.3-zip \
  libapache2-mod-php8.3 certbot python3-certbot-apache ufw fail2ban

2. Create the Joomla database

sudo mysql
CREATE DATABASE joomla CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'joomla'@'localhost' IDENTIFIED BY 'CHANGE_ME_DB_PASSWORD';
GRANT ALL PRIVILEGES ON joomla.* TO 'joomla'@'localhost';
FLUSH PRIVILEGES;
EXIT;

3. Install the Joomla release

Download the selected full-package archive from Joomla’s official release source and verify it before extraction.

sudo install -d -o www-data -g www-data -m 0750 /var/www/app.example.com/public_html
curl -fL https://downloads.joomla.org/cms/joomla5/5-3-0/Joomla_5-3-0-Stable-Full_Package.tar.gz -o /tmp/joomla-5.3.0.tar.gz
sudo tar -xzf /tmp/joomla-5.3.0.tar.gz -C /var/www/app.example.com/public_html
sudo chown -R www-data:www-data /var/www/app.example.com/public_html

4. Complete configuration and enable TLS

Use the CLI/web installer with the database and administrator values, then delete the installer directory.

sudo a2enmod rewrite ssl
sudo nano /etc/apache2/sites-available/app.example.com.conf
sudo a2ensite app.example.com.conf
sudo apache2ctl configtest
sudo systemctl reload apache2
sudo certbot --apache -d app.example.com -m admin@example.com --agree-tos --redirect
sudo rm -rf /var/www/app.example.com/public_html/installation

Important files and data

• Joomla root and configuration.php: /var/www/app.example.com/public_html
• User media: images and other configured media paths
• Extensions/templates and Apache site configuration
• MariaDB Joomla database

Health checks and logs

Run these checks after installation and after each upgrade:

sudo apache2ctl configtest
sudo systemctl status apache2 mariadb --no-pager
curl -I https://app.example.com
sudo test ! -d /var/www/app.example.com/public_html/installation

Routine maintenance

Review release notes and take a backup or snapshot before upgrading. Use the following playbook-aligned commands as the starting point:

# Back up files and database first.
# Use Joomla's Update component for the selected tested release.
sudo chown -R www-data:www-data /var/www/app.example.com/public_html
sudo apache2ctl configtest
sudo systemctl reload apache2

Backup scope

• MariaDB Joomla database
• configuration.php, user media, extensions, and templates
• Apache/PHP configuration and installed-version inventory

A usable backup needs both application files and application data. Test restoration on a separate server; an untested backup is not a recovery plan.

Troubleshooting

• Confirm DNS with dig +short app.example.com before retrying Certbot.
• Test the web-server configuration before reloading it: sudo nginx -t or sudo apache2ctl configtest.
• Check free space with df -h and listening ports with sudo ss -ltnup.
• If a service fails, inspect its systemd journal before changing configuration.
• If Joomla insists installation is incomplete, check that configuration.php exists and the installation directory has been removed.
• After updates, verify extensions are compatible before re-enabling them.

Security notes

• Do not paste passwords, API keys, repository credentials, private keys, or access tokens into tickets or public logs.
• Expose only the documented public ports. Keep database and application backend ports bound to localhost or a private network.
• Keep SSH access working before enabling UFW, then allow only the ports this guide lists.
• Renewal can be tested safely with sudo certbot renew --dry-run where Certbot manages TLS.