Installation & Hosting

sudo nano /etc/ssh/sshd_config

# 1. Change the port (security by obscurity, reduces 99% of bot logs)
Port 54321  # Choose a number between 1024 and 65535 and note it down!

# 2. Forbid direct root login
PermitRootLogin no

# 3. Forbid passwords (SSH key mandatory)
PasswordAuthentication no
PermitEmptyPasswords no

# 4. Limit to authorized users
AllowUsers my_pseudo

ls /etc/ssh/sshd_config.d/

sudo rm /etc/ssh/sshd_config.d/*.conf

# Check if the socket is active
systemctl is-active ssh.socket

sudo systemctl stop ssh.socket
sudo systemctl disable ssh.socket

sudo systemctl restart ssh

ssh -p 54321 my_pseudo@YOUR_VPS_IP

[sshd]
enabled = true
port    = 54321 # Your SSH port here
logpath = %(sshd_log)s
backend = %(sshd_backend)s
maxretry = 3 ; To be added generally
bantime = 1h ; To be added generally
findtime = 10m

sudo systemctl restart fail2ban

sudo dpkg-reconfigure keyboard-configuration

sudo systemctl restart keyboard-setup

sudo ss -ltnp | grep ssh

echo"" > /var/www/pragma-cms/public/test.php

# Replace X.X.X.X with your VPS IP
http://X.X.X.X {
    root * /var/www/pragma-cms/public
    encode gzip
    file_server
    
    # PHP 8.4
    php_fastcgi unix//run/php/php8.4-fpm.sock
}

sudo systemctl reload caddy

rm /var/www/pragma-cms/public/test.php

sudo caddy hash-password

staging-site-test.mon-site.com

# =========================================================================
# == SNIPPETS (Reusable configurations)
# =========================================================================

# Common CMS configuration (Security, PHP, Assets)
(cms_common) {
    # 1. Web root (argument {args[0]} passed when importing)
    root * {args[0]}/public

    # 2. ASSET / MEDIA / UPLOAD / THEME HANDLING (core logic)
    # If a file is requested in /assets or /media and does NOT exist,
    # redirect to asset handler script
    @missing_assets {
        path /assets/* /media/* /uploads/* /themes/*
        not file {path}
    }
    rewrite @missing_assets /assets/serve-site-assets.php?{query}

    # 3. PHP FastCGI (Script execution) – Make sure it’s compatible with your version of PHP!
    php_fastcgi unix//run/php/php8.4-fpm.sock

    # 4. Front Controller (main routing)
    # If the file does not exist, everything is redirected to index.php
    try_files {path} {path}/ /index.php?{query}

    # 5. Compression and Static File Server
    encode gzip zstd
    file_server
}

# =========================================================================
# == SERVER BLOCKS
# =========================================================================

# 1. Global SSL (on-demand TLS)
{
    on_demand_tls {
        ask http://localhost:8080/check-domain
    }
}

# 2. Internal server for check-domain (inaccessible from outside)
# This server is only accessible by Caddy itself (localhost)
# It is used solely to respond to the ‘ask’
http://localhost:8080 {
    root * /var/www/pragma-cms/public

    # We use php_fastcgi just for this specific route
    route /check-domain {
        php_fastcgi unix//run/php/php8.4-fpm.sock
    }
}

# 3. PROD PLATFORM (Super Admin / Main Dashboard)
# Caddy will manage this certificate automatically and ‘for free’ (without involving PHP)
NOM_DE_DOMAINE_DE_LA_PLATEFORME {
    # Import the shared configuration with the PROD path
    import cms_common /var/www/pragma-cms

    log {
        output file /var/log/caddy/platform-access.log
    }
}

# 4. STAGING (Platform & Test client sites)
# Replace $USER with your username and MY_HASH with your generated hash
staging.mon-site.com,
staging-site-test.mon-site.com {
    # Password protection
    basic_auth {
        $user MY_HASH
    }

    # Import the shared configuration using the STAGING path
    import cms_common /var/www/pragma-cms-staging

    # Google anti-indexing
    header X-Robots-Tag "noindex, nofollow"

    log {
        output file /var/log/caddy/staging-access.log
    }
}

# 5. CLIENT PRODUCTION SITES (catch-all HTTPS)
https:// {
    # On-demand SSL activation
    tls {
        on_demand
    }

    # Import the shared configuration using the PROD path
    import cms_common /var/www/pragma-cms

    log {
        output file /var/log/caddy/pragma-access.log
    }
}

sudo systemctl reload caddy

    ServerName platform.pragma-cms.com
    ServerAlias *.platform.pragma-cms.com
    
    # IMPORTANT NOTE: We are pointing directly to /public
    # The .htaccess file in the project root directory is therefore ignored.
    # Only the .htaccess file located WITHIN /public will be read.
    DocumentRoot /var/www/pragma-cms/public

    
        Options -Indexes +FollowSymLinks
        
        # Enable the .htaccess file in /public (essential for routing and URL rewriting)
        AllowOverride All
        
        Require all granted
    

    ErrorLog ${APACHE_LOG_DIR}/pragma_error.log
    CustomLog ${APACHE_LOG_DIR}/pragma_access.log combined

server {
    listen 80;
    server_name platform.pragma-cms.com *.platform.pragma-cms.com;
    
    root /var/www/pragma-cms/public;
    index index.php;

    access_log /var/log/nginx/pragma_access.log;
    error_log /var/log/nginx/pragma_error.log;

    # --- ASSET ROUTING ---
    # Equivalent to @missing_assets in Caddy.
    # If the file does not exist in /public/assets or /public/media,
    # control is passed to serve-site-assets.php
    location ~ ^/(assets|media|uploads|themes)/ {
        try_files $uri /assets/serve-site-assets.php$is_args$args;
    }

    # Main router (Front Controller)
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # PHP execution
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    # Hidden file security
    location ~ /\.(?!well-known).* {
        deny all;
    }
}

#!/bin/bash
set -euo pipefail

# CONFIG
BACKUP_DIR="/var/backups/pragma-cms"
DATE=$(date +"%Y-%m-%d_%H-%M")
DB_USER="pragma_master"
DB_PASS="YOUR_PASSWORD_HERE"  # Replace with the actual password
KEEP_DAYS=7

# Create the backup directory
mkdir -p $BACKUP_DIR

# 1. INTELLIGENT DATABASE BACKUP
databases=$(mysql -u $DB_USER -p$DB_PASS -e "SHOW DATABASES;" -s --skip-column-names | grep -Ev "^(information_schema|performance_schema|mysql|sys)$")

for db in $databases; do
    echo " - Dumping DB: $db..."
    mysqldump -u $DB_USER -p$DB_PASS $db | gzip > "$BACKUP_DIR/db_${db}_$DATE.sql.gz"
done

# 2. Backup Files
tar -czf "$BACKUP_DIR/files_$DATE.tar.gz" \
    --exclude='storage/cache/*' \
    --exclude='storage/logs/*' \
    --exclude='storage/tmp/*' \
    /var/www/pragma-cms

# 3. Cleanup old backups
find $BACKUP_DIR -type f -name "*.gz" -mtime +$KEEP_DAYS -delete

# Make the script executable and secure (root-only read, since it contains the password)
chmod 700 /var/www/pragma-cms/scripts/cron/backup.sh
chown root:root /var/www/pragma-cms/scripts/cron/backup.sh
# Remove ACLs specifically for this sensitive file to prevent the sys_user from reading it
setfacl -b /var/www/pragma-cms/scripts/cron/backup.sh

#!/bin/bash
set -euo pipefail

# ===============================================================
# PRAGMA CMS - SYNC PROD -> STAGING
# ⚠️ WARNING: THIS WILL OVERWRITE THE ENTIRE STAGING
# ===============================================================

read -p "⚠️  This will overwrite the STAGING database and files with those from PROD. Continue? (y/n) " -n 1 -r
echo ""
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
    exit 1
fi

DB_USER="pragma_master"
read -sp "DB password ($DB_USER): " DB_PASS
echo ""

echo "🔄 1/3 Cloning the database..."
mysqldump -u $DB_USER -p$DB_PASS pragma_cms_platform | mysql -u $DB_USER -p$DB_PASS pragma_cms_platform_staging

echo "📂 2/3 Syncing files..."
rsync -av --delete \
    --exclude 'config_db.php' \
    --exclude 'storage/cache/*' \
    --exclude 'storage/logs/*' \
    /var/www/pragma-cms/ \
    /var/www/pragma-cms-staging/

echo "🔧 3/3 Adjusting permissions..."
chown -R www-data:www-data /var/www/pragma-cms-staging

echo "✅ Synchronization completed!"
echo "The staging environment is now an exact clone of production."

# -------------------------------
# Daily PROD backup
# -------------------------------
0 3 * * * /var/www/pragma-cms/scripts/cron/backup.sh >/var/www/pragma-cms/storage/logs/cron_backup.log 2>&1

# -------------------------------
# Check for CMS updates
# -------------------------------
0 4,16 * * * sudo -u www-data /usr/bin/php /var/www/pragma-cms/scripts/cron/check_updates.php >> /var/www/pragma-cms/storage/logs/cron_update.log 2>&1

systemctl status php8.4-fpm
systemctl status caddy
systemctl status mariadb
systemctl status fail2ban

curl -s http://localhost/test.php | grep"PHP Version"

sudo /var/www/pragma-cms/scripts/cron/backup.sh
ls -lh /var/backups/pragma-cms

sudo /var/www/pragma-cms/scripts/cli/deploy_staging.sh