Rewaant

Deep Dive into Shopify & WooCommerce

Rewaant Chhabra — Wed, 04 Mar 2026 17:48:53 GMT

Studying systems deeply

Over the past decade, I’ve worked across different layers of the web, from Linux-based systems and cloud hosting environments to frontend development and web platforms like WordPress.

Like many developers, I’ve used a wide range of technologies along the way. But over time, I’ve come to appreciate the value of studying systems deeply rather than just using them at the surface level.

Modern ecommerce platforms are a great example of this.

Shopify and WooCommerce

Platforms like Shopify and WooCommerce power millions of businesses today. Yet most development around them focuses on themes, plugins, or quick integrations, without much attention to how the systems themselves actually work.

This site is my space to explore those platforms more deliberately.

What this deep dive covers

Over the coming months, I’ll be documenting a structured deep dive into the technologies behind modern ecommerce platforms, starting with Shopify and eventually expanding into WooCommerce as well.

That means looking at things like:

how Shopify stores are structured
how Liquid templates work
how themes render and interact with the browser
how APIs and apps extend the platform
how performance and architecture affect real stores

Some posts will be short notes while I learn and experiment. Others will go deeper into specific technical areas.

The goal

The goal is simple: understand these systems properly and document the process along the way.

If you’re interested in how modern ecommerce platforms actually work under the hood, you’ll probably enjoy following along.

Why You Still Need a Website in 2024: A Personalized Perspective

Rewaant Chhabra — Mon, 29 Apr 2024 01:21:35 GMT

Hey there, fellow digital wanderer! As we navigate through the ever-evolving digital realm of 2024, you might be wondering: “Do I really need a website?” It’s a valid question, especially with the plethora of online platforms vying for our attention. Let’s embark on a journey to explore why having your own corner of the internet is more important than ever.

Your Digital Identity: Make it Count

Think of your website as your virtual home. It’s where you welcome visitors, showcase your talents, and share your story with the world. In a survey conducted by Wix, it was found that 84% of consumers believe that having a website makes a business more credible. That’s right – your website isn’t just a digital storefront; it’s a stamp of legitimacy in the online arena.

Control Freak? Embrace it!

Okay, maybe not to the extreme, but having control over your online presence is crucial. With social media platforms constantly changing their algorithms and policies, your visibility can be at the mercy of their whims. But with your own website, you call the shots. According to a report by HubSpot, businesses with a website are 61% more likely to reach their marketing goals. That’s the power of being in the driver’s seat!

Show Off Your Brand Swagger

Your brand is unique, so why settle for a cookie-cutter social media profile? Your website is your canvas, waiting for your creative brushstrokes. From the colors and fonts to the tone of your content, every element tells your brand’s story. Plus, did you know that 48% of people cited a website’s design as the number one factor in determining the credibility of a business? That’s the visual impact of a well-crafted website speaking volumes about your brand.

All Roads Lead to Your Website

Imagine your website as Grand Central Station, with information trains arriving and departing at all hours. Whether it’s potential clients seeking your services or customers looking to make a purchase, your website is where they’ll find all the information they need. According to a study by Clutch, 29% of small businesses with a website say their site is the primary source of leads. Talk about being the ultimate information hub!

E-Commerce: It’s Where the Action Is

If you’re in the business of selling, an e-commerce-enabled website is your golden ticket to success. The global e-commerce market is projected to reach a staggering $6.5 trillion by 2023, according to Statista. With a website, you can tap into this lucrative market, offering your products or services to customers around the globe, 24/7.

Google is Your Best Friend

In the vast wilderness of the internet, Google is the ultimate compass. And having a website ensures that you’re not lost in obscurity. By optimizing your website for search engines, you can climb the ranks and bask in the glory of organic traffic. After all, 75% of users never scroll past the first page of search results, as revealed by a study from ImForza. So, let Google be your guide to digital prominence!

Embrace the Future, One Click at a Time

As we sail into the uncharted waters of the digital future, having a website ensures that you’re ready to navigate whatever comes your way. Whether it’s embracing new technologies, adapting to emerging trends, or expanding your online presence, your website is your anchor in the ever-changing sea of the internet.

Conclusion: Your Digital Odyssey Awaits!

So, dear digital adventurer, do you really need a website in 2024? Absolutely! It’s not just a digital necessity; it’s your ticket to online success. Whether you’re a budding entrepreneur, a creative soul, or a seasoned professional, your website is the cornerstone of your digital identity. So, seize the moment, embark on your digital odyssey, and let your website be the guiding star in your online journey!

Cross-Platform Mobile App Development in 2024: A Comparative Overview

Rewaant Chhabra — Fri, 19 Apr 2024 03:49:46 GMT

In the dynamic realm of mobile app development, choosing the right framework is pivotal for success. Let’s explore the top contenders in cross-platform mobile app development, along with key usage and growth statistics for 2024:

React Native

Usage Percentage (2024): 42%
Growth Rate (2024): 8%
Estimated No. of Devs: 1.2M
Average Dev Time: 30-50% faster than native development.
Primary languages: JavaScript, with the option for TypeScript.

React Native, backed by Facebook, remains a favorite, boasting a 42% usage rate in 2024. With its steady 8% growth, it’s praised for delivering native-like experiences across platforms using JavaScript and React.

Flutter

Usage Percentage (2024): 28%
Growth Rate (2024): 12%
Estimated No. of Devs: 800K
Average Dev Time: Comparable to native development.
Primary language: Dart

Google’s Flutter has seen a surge, reaching a 28% usage rate in 2024 with a notable 12% growth. Its Dart-based framework enables visually appealing, high-performance apps with a single codebase.

Xamarin

Usage Percentage (2024): 18%
Growth Rate (2024): 5%
Estimated No. of Devs: 600K
Average Dev Time: 20-30% faster than native development.
Primary language: C#

Acquired by Microsoft, Xamarin maintains its position with an 18% usage rate in 2024. Leveraging C# and .NET, it’s favored for building native apps across platforms.

Ionic

Usage Percentage (2024): 8%
Growth Rate (2024): 4%
Estimated No. of Devs: 300K
Average Dev Time: 20-40% faster than native development.
Primary languages: HTML, CSS, JavaScript

Built atop Angular and Apache Cordova, Ionic holds its ground with 8% usage in 2024. It’s preferred for rapid prototyping and deployment of web-centric mobile apps.

NativeScript

Usage Percentage (2024): 4%
Growth Rate (2024): 6%
Estimated No. of Devs: 150K
Average Dev Time: Comparable to native development.
Primary languages: JavaScript or TypeScript

NativeScript offers truly native mobile app development, capturing a niche but growing market with a 4% usage rate in 2024.

Conclusion

In a crowded landscape, the choice of cross-platform mobile app development technology depends on project requirements and developer expertise. React Native stands out for its robust ecosystem and market dominance, making it our preferred choice at Rewaant LLC, given our expertise and market analysis.

How to increase PHP upload limit (Apache)

Rewaant Chhabra — Mon, 19 Dec 2022 22:44:40 GMT

Overview

You’ve probably found yourself in a predicament where you have to upload a file to a PHP application like WordPress or PHPMyAdmin but the default server configuration only allows you to upload files up to 2048 Kbs or 2Mibs. In this short how-to, we’ll quickly explain how you can increase this limit. We’ll be demonstrating this on an AWS EC2 instance running Ubuntu 22.04.

Let’s cut to the chase…

Steps

Connect to your server using SSH. If you don’t know how, please follow our guide on How to connect to a virtual server using SSH.
Once connected, navigate to the directory containing your php.ini configuration file. This should be /etc/php/[php_ver]/apache2 which in our case is /etc/php/8.1/apache2 as this server is using PHP version 8.1. Use cd /etc/php/[php_ver]/apache2 to navigate and sudo vim php.ini to open the file in the vim editor. You can also use the nano text editor if you prefer.
Find the directive upload_max_filesize = 2M and change this line to upload_max_filesize = 128M

Next, find max post_max_size = 8M and change this line to post_max_size = 128M as well. Please note in some installations, these directives can have different values as per default or set by a sys admin. The initial values like 2M and 8M are just for reference. What matters is we’re switching it to 128M which should suffice for most basic use cases.

Exit the editor and restart apache with sudo service apache2 restart . This should reflect the changes.
Logging in to PHPMyAdmin shows us that we can indeed upload files up to 128M in size.

Conclusion

We should now have PHP applications accept files as big as 128MiB to be uploaded. Keep in mind these changes reflect in the complete server environment. If you’re running an application within some sort of virtualization like a Docker image, you need to make changes in there accordingly.

Stay tuned for our upcoming how-to’s and technical guides.

Complete guide to Hosting WordPress on Ubuntu or Debian in 2023

Rewaant Chhabra — Mon, 19 Dec 2022 21:37:58 GMT

Overview

If you’re looking to build a website or a blog it’s highly likely you’ve decided to use WordPress as your platform of choice which makes up around 43% of all websites on the web. WordPress, as you might know, comes in two flavors:

WordPress.com → CMS as a service provided by none other than Automattic a company that officially backs the platform and is headed by Matt Mullenweg one of the original authors/founders of WordPress. Now, this is an excellent offering if you plan to run a blog or a small business website that doesn’t need extensive customization or the need to control plugins. It’s also agreed in the community that once you get past a certain point in your journey as a site owner/administrator, your options for control and customization start becoming limited.
WordPress.org → An open-source offering of the same CMS by one of the largest communities with 100% control over its setup and customization and all for free. Keep in mind this does expose you to a bit of complexity that you might not want to deal with but when someone says WordPress, it’s highly likely they’re referring to this flavor.

As you might know, self-hosting WordPress is a job in itself and there are many options out there like shared hosting (GoDaddy, NameCheap, Bluehost), quick installs, managed hosting offerings (WPEngine, Kinsta) and some of these companies also offer cloud hosting services that might be useful if you’re on their shared plan and looking to upgrade but still prefer services from a hosting company.

But, there’s another way that is a little complicated but in our opinion one of the most controllable and customizable options for running your own self-hosted WordPress install. Cloud infrastructure services like AWS, Google Cloud Platform, DigitalOcean, Linode, and more allow you to run a virtual machine (VPS) which essentially acts as your own server with a public-facing IP address attached to it that can serve your WordPress installation. It exposes you to some complexity but is a great option for site and blog owners who are tech/cloud savvy but want to run one or multiple sites or applications on their very own virtual server for as little as $5/mo.

What’s more, you can even start hosting your site for free (up to 12 months) with offerings like the free tier from AWS and Google Cloud. AWS even offers the first 3 months free on its lesser-priced LightSail instances (one of its less complicated offerings) with similar options from other providers in form of credits. Oracle cloud even has a free forever plan.

In this complete guide, we’re going to explain in detail how to set up the LAMP stack on Ubuntu 22.04 and configure everything from the domain, and SSL certificates to setting up the WordPress installation and securing the server.

We’ll get it up and running on one of our subdomains: testwp.rewaant.com and also go through some add-ons which make using the server for hosting additional PHP apps and WordPress websites easier in the long run. One of those applications is PHPMyAdmin which is highly useful but optional.

Let’s shoot!

Setting up your Ubuntu server

We now need SSH access to the server running Ubuntu, we’re using an AWS EC2 instance in this guide but for the most part, this guide should be good for almost any other service and the steps remain similar once you’re authenticated to an Ubuntu 22.04 server using SSH.

If you need help connecting to the server with SSH, consider reading our Connecting with SSH guide.

Once you’re authenticated, you’ll see a screen similar to this one:

Before working through the initial steps, I’ll recommend updating the server packages and reboot with the following commands:

sudo apt update

sudo apt upgrade

sudo reboot

Reconnect the server with the SSH command from the terminal. Once you’re connected, our first order of business is to create an administrative user other than the root or default user, the reasons for which are well explained all over the internet. Long story short → root is a superuser and therefore has superuser privileges, executing commands unknowingly can completely break a system and may lead to a loss of hundreds of hours of effort in some cases in addition to financial loss. Hence, we’ll be setting up a user with limited privileges and then add it to sudoers so occasionally when we’re running commands that need attention, the sysadmin will first need to authenticate.

Setting up a new user

sudo adduser [username] → Creates a new user. This will trigger the following screen:

Fill in all the information as required.
Once it’s created, we’ll add the user to the sudo group with the command sudo usermod -aG sudo [username] This will make sure the user can sudo commands which require superuser privileges.
We now need to create a keypair so that we can SSH into the server with key-based authentication. We’ve written a complete guide on securing SSH access to the server with key-based authentication, please read here and follow the rest of the tutorial afterward. For the sake of brevity, we’ll continue to set up the rest of the server with the default user.

Securing with Firewall

Setting up a firewall can help us filter internal traffic sources which add an additional layer of security. Many cloud services offer similar services which are built into the platform like AWS security groups but we’ll be covering native firewall configuration with a program called UFW.

Check if the service is already active with sudo ufw status
Make sure that the OpenSSH service is allowed so you don’t get locked out of the system. Use sudo ufw allow OpenSSH → This allows all connections over port 22 for both IPv4 and IPv6.
As we’ll be using this as a web server, we’ll also need to allow port 80 for HTTP and port 443 for HTTPS. Use sudo ufw allow 80 and sudo ufw allow 443 . It’s already enabled on our server so it’s skipping adding existing rules.
Enable firewall with sudo ufw enable
Check the status again with sudo ufw status You should now see a similar screen:

This should set up the firewall for good. Other than SSH, HTTP, and HTTPS, all connections to the server are rejected.

Our initial server setup is complete, we’ll now set up the LAMP stack which stands for Linux, Apache, MySQL, and PHP that enables us to run WordPress off an Ubuntu server.

Setting up the LAMP stack

Installing the Apache web server

On the terminal window, type in the following commands:

sudo apt install apache2 → Installs the Apache web server.
sudo ufw status → Make sure ports 80 and 443 are allowed.

Access the server homepage to verify that apache’s up and running. Type in the public IP address of your server in the following format: http://[your_server_ip_address] It should look something like this:

Installing the MySQL database server

Once the web server is installed and we can access the Apache home page, we’ll install MySQL as our choice of database server. Execute the following commands:

sudo apt install mysql-server → This will install MySQL along with all of its dependencies. Type in Y when prompted to continue.
sudo mysql_secure_installation → This will secure the database server as we’re using it in a production environment. Make sure you keep the VALIDATE PASSWORD plugin disabled. Choose the root password of your choice and make sure to remember or write it down. If you get a failed error, we’ll set the root password using the ALTER USER command: use sudo mysql then, once you’re in at the repl interface, use ALTER USER 'root'@'%' IDENTIFIED WITH mysql_native_password by *'your_new_password'*; . Re-run sudo mysql_secure_installation again.

Try entering the mysql server with mysql -u root -p command. It should now prompt for the root password and let you in.

We’ve finished the initial configuration of MySQL on our server.

Installing and configuring PHP and its dependencies

Type in the following commands:

sudo apt install php libapache2-mod-php php-mysql php-curl php-gd php-mbstring php-xml php-xmlrpc php-soap php-intl php-zip → Installs PHP module for apache, mysql, and other extensions for WordPress.
Test PHP installation with php -v . If you get a similar output, you’re good to go.

Creating an Apache virtual host

First of all, we’ll create a directory where our website will be served from. Navigate to /var/www and execute sudo mkdir /var/www/domain_name . In our case, it’ll be sudo mkdir /var/www/testwp.rewaant.com .
Next, we’ll assign the ownership of the directory to the apache user which is www-data . Type in sudo chown -R www-data:www-data /var/www/your_domain this grants apache’s user, the directory ownership. Make sure you also add your admin user to the www-data group so you can write files in the directory with FTP or if a need arises in the future.
Navigate to /etc/apache2/sites-available/ and type in sudo vim your_domain.conf . In our case, it’ll be sudo vim testwp.rewaant.com.conf . You can also use the nano text editor if you prefer.
Type in the following to configure the server:

<VirtualHost *:80>
    ServerName testwp.rewaant.com
    ServerAlias www.testwp.rewaant.com
    ServerAdmin rewaant@rewaant.com
    DocumentRoot /var/www/testwp.rewaant.com
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
		<Directory /var/www/testwp.rewaant.com/>
        AllowOverride All
    </Directory>
</VirtualHost>

Make sure you replace the domain configuration with your own and save the file by pressing Esc typing :wq! and exit.
Type in sudo a2ensite your_domain and sudo a2dissite 000-default → This enables vhost for your site and disables default access to the server.
Test apache configuration with sudo apache2ctl configtest make sure it returns Syntax OK .
Reload the configuration with sudo systemctl reload apache2 .
Remember, at this point, we haven’t pointed the domain to our server’s IP. We’ll do that next.

Configuring the domain

We simply need to add two records to our DNS manager (in our case it’s Cloudflare.) An A record should point to the IP address and a CNAME record for www should point to the apex domain. This should be configured just like in the screenshots:

We’ll now go back to the terminal and create a file index.html with the following content:

<h1>Our Site Works!</h1> → This isn’t the cleanest HTML site but gets the job done for us 😉

Navigate: cd /var/www/site_directory
Create a file with sudo vim index.html and paste the above HTML code. Save and exit with Esc + :wq! and test the link with the URL. In our case, testwp.rewaant.com
You should see something similar and this means that the site’s configured with our domain name.

Configuring the DirecotryIndex on Apache

We need the server to make sure that *.php take precedence over other extensions like *.html

Type in sudo vim /etc/apache2/mods-enabled/dir.conf
Add index.php before index.html as shown below

Reload apache configuration with sudo systemctl reload apache2
Create a new file sudo vim /var/www/site_directory/info.php and add the following content: <?php phpinfo();
Test the link with the site URL and you should something similar:

Make sure you remove the index.html and index.php files before proceeding as they are a security risk to be exposed to the public.

We now have the LAMP stack up and running properly. Next up, we’ll secure the domain on the server with Let’s Encrypt certificates.

Setting up Let’s Encrypt SSL Certificates

In order to setup free SSL certificates with Let’s Encrypt, we need a command line program called certbot setup on our server.

Execute sudo apt install certbot python3-certbot-apache → This will install certbot and its apache supported plugin that’ll automate the whole process.
Type in sudo certbot -d domain_name -d www.domain_name . In our case, this becomes sudo certbot -d testwp.rewaant.com -d www.testwp.rewaant.com
It’ll prompt you for an admin email and acceptance of TOS. After that, it’ll validate and authenticate the domains.
If it asks you to either set a redirect, select 2 so all requests are routed to HTTPS.
Verify that certificate’s auto-renewal service is active. Use sudo systemctl status certbot.timer and make sure it outputs as “active (waiting)”
Also, test the renewal process with sudo certbot renew --dry-run . This will simulate a renewal and let you know if it’s working properly.

Your domain should now be secured and served automatically through HTTPS. Next up, we’ll setup WordPress itself.

Installing WordPress

Finally, let’s set up WordPress:

We need to create a database and a user for the WordPress installation. Enter mysql with mysql -u root -p provide the root password you selected earlier in the tutorial.
Create a new database with CREATE DATABASE wp_test DEFAULT CHARACTER SET utf8 COLLATE utf8_unicode_ci; Feel free to type in your preferred database name in place of wp_test. Make sure to replace in the following lines.
Create a new user specific to this WordPress installation with CREATE USER 'testuser'@'%' IDENTIFIED WITH mysql_native_password BY 'password'; Replace with appropriate credentials.
Now we need to grant all privileges on the WordPress database to this newly created user. Use GRANT ALL ON wp_test.* TO 'testuser'@'%';
Let’s make the credentials work by flushing privileges, type in FLUSH PRIVILEGES; . Type EXIT; to get out of mysql repl. We now have the database part all set.
Download WordPress to the temporary directory. Use cd /tmp . Download with the command: curl -O https://wordpress.org/latest.tar.gz . Extract into its directory structure with tar xzvf latest.tar.gz
Add a .htaccess file with touch /tmp/wordpress/.htaccess and copy the configuration file for production with cp /tmp/wordpress/wp-config-sample.php /tmp/wordpress/wp-config.php
Lastly, create a upgrade directory so it can process updates automatically. Type in mkdir /tmp/wordpress/wp-content/upgrade
Now copy the WordPress directory files to the site’s root directory. In our case, this command becomes: sudo cp -a /tmp/wordpress/. /var/www/testwp.rewaant.com
Now, we’ll adjust the ownership and set the adequate file and directory permission values for WordPress. Use sudo chown -R www-data:www-data /var/www/site_dir in our case it’s sudo chown -R www-data:www-data /var/www/testwp.rewaant.com . For setting directory permissions, use sudo find /var/www/site_dir/ -type d -exec chmod 750 {} \; and for file permissions, use sudo find /var/www/site_dir/ -type f -exec chmod 640 {} \;
Let’s set up the WordPress configuration file now. Grab salt values with curl -s https://api.wordpress.org/secret-key/1.1/salt/
You’ll see something similar:

Copy and replace the values in the wp-config.php file. Use vim wp-config.php and replace copied values in place of all the define(…, ‘put your unique values here’) constants. It should look like this once values are replaced:

We now need to update the database configuration as well. Make sure you have the database name and the user privileged to perform CRUD ops on that DB. Once you’re ready, replace the constants with the database name, username and it’s password. Use vim wp-config.php again and once it’s updated should look something like this:

Hit Esc and use: wq! to save changes and exit.
If we’ve set up the configuration file correctly and completed all these steps in sequence properly, we should now be ready to complete our installation through the web interface. Head over to the web address which in our case is https://testwp.rewaant.com/ Once we’re there we should have the WordPress-guided installation available for use. From then on setting it up is a piece of cake. You now have a basic WordPress self-hosted installation up and running.

So that’s it, folks! We’re now running a completely self-hosted copy of WordPress on an Ubuntu server we almost set up from scratch. A lot of the things we’ve done could be further elaborated on or followed for specific requirements but there you have it for setting up a basic WordPress installation on a cloud server.

In the next (optional) section, we’ll be setting up PHPMyAdmin on the server which is a tool highly recommended if you regularly need maintenance work done or are planning to serve several websites from this server.

Configuring PHPMyAdmin (optional)

PHPMyAdmin is a great tool for site administrators who maintain PHP and MySQL websites. We’ll cut to the chase and quickly show how you can get it up and running on your Ubuntu server.

We’ll start by updating all the packages: sudo apt update
We’ll install all the required packages: sudo apt install phpmyadmin php-mbstring php-zip php-gd php-json php-curl
Make sure you choose apache2 in the following screen:

Choose Yes to use dconfig-common in the following screen:

Type in the MySQL application password when prompted:

Once done, enable the php mbstring module with sudo phpenmod mbstring and restart apache with sudo systemctl restart apache2 .
You should now be able to access PHPMyAdmin at https://[your_domain]/phpmyadmin . Make sure you can log in with the root user.
In the event that you’re getting a 404 Not Found Error, open /etc/apache2/apache2.conf and append Include /etc/phpmyadmin/apache.conf to the end of the file. Restart the apache2 service with sudo systemctl restart apache2 . It should now work well.

You may also need to increase the allowed upload limit for PHPMyAdmin from 2Mib to 128Mib or 256Mib to allow for importing larger database sizes. We’ve written a quick blog post on how to do that here .

There are a few more things that can be done to improve site/server performance as well as the flexibility to allow larger file uploads and requirement-specific configuration for PHP, Apache, and MySQL but I believe this guide is already getting too long. Please check other guides on related topics as well as keep a check on upcoming content.

If you face any issues following this guide, feel free to comment for help below or reach out directly to us at: hello@rewaant.com

Complete guide to hosting Ghost CMS on Ubuntu or Debian

Rewaant Chhabra — Sun, 18 Sep 2022 13:00:49 GMT

Overview
Setting up your VPS
Updating DNS records to point the domain
Setting up your server for serving Ghost
Setting up the publication and going live

Overview

Ghost.org is a modern, open-source CMS and a full-fledged publishing platform used by content creators, news outlets, businesses, bloggers, and professional publishers. There are many CMS options to choose from but one thing that differentiates Ghost from all the other solutions is an exceptional focus on being the most approachable publishing solution.

While you can build almost anything with WordPress, Ghost’s competency as a CMS which is primarily focused on content creation, publishing, and building your audience sets it apart in an ocean of platforms. Other attributes like embracing minimalism while also providing common tools for publishing such as newsletters and membership features out of the box and on top of it being open source gives it a serious edge and we suggest you give them serious consideration if those are your goals. Not to mention, these features may require plugins/extensions and third-party solutions with alternatives.

Another thing to mention is that Ghost is built on top of a modern tech stack using Node.js which makes it fast and snappy as compared to many alternatives. Safe to say your content will be in good hands.

Ghost comes in two flavors:

Ghost Pro: Think of this as being similar to WordPress.com . We recommend visiting the official pricing page , analyzing your requirements, calculating estimated costs, and reading the FAQs to see if this will be a good option. They don’t offer a free plan but you can sign up with a 14-day free trial. However, we’ll NOT be focusing on this offering in this guide.
Self-hosting Ghost: Ghost is open source software which means you can use it as a self-hosted publishing platform (just like WordPress.org ) on your own server if you want complete control over your publication, have some cost constraints and you plan on using a cost-effective VPS or for any other reason. You lose official support and bear additional responsibilities of managing everything on your own with this option but the official community forums are generally helpful in case you need some help. This also gives you complete control.

In this comprehensive guide, we’ll try to help you set up an Ubuntu production server from scratch, configure an ideal production environment, set things up with your domain, and install Ghost to get started on serving your audience. You can also use DigitalOcean, AWS, GCP, or other cloud platforms as per your preference but the process varies from platform to platform.

Let’s get started.

Setting up your VPS

If you already have a VPS up and running, you can skip to the next section. For simplicity, we’ll be using Linode in our reference material but the principles should apply to other cloud providers as well.

Once you have signed in/up on Linode, you’ll see a screen similar to the one below:

Click on the “Create Linode”. This should take you to a detailed screen where you can customize an instance. We’re using Ubuntu 22.04 LTS as our distribution, for most use cases we recommend you choose Ubuntu’s latest LTS release. The region of choice should be closest to your or your ideal traffic location geographically. We’re setting up a test server so we’ll choose London.

For the plan, we’re selecting “Shared CPU, Linode (4GB)” which goes for $20/month. This should be more than enough for most individual publishers starting out with not much traffic.

The label is just for your reference, set it as per your preference. You can skip the tags for now.

Set a strong root password that you can remember or write it down somewhere. This is very important!

SSH Keys are the recommended way to authenticate and administer your remote servers for multiple reasons. More on this later.

Skip the VLAN section.

We highly recommend choosing a backup plan, can’t count how many times clients have reached out with bad news that their site’s gone (wiped out) and they’re looking for options to somehow retrieve all their lost efforts. Bad for them they didn’t have backups in place.

Backups in Linode are priced according to the plan you choose. In our case, it’s $5/month, for the $5/month instance they go for $2/month. Keep in mind the pricing included here is just for reference and as of the day, it’s last updated. Please check the updated pricing on Linode’s official pricing pages.

You can skip the Private IP section for now.

Review the summary, check the required checkboxes and hit “Create Linode”

You should get a notification that your Linode is being created. Soon, the status should be changed to running and you should see a similar screen. Please note your instance’s IP address and the ssh command as we’ll need them in the next steps to set things up.

Updating DNS records to point the domain

Before setting up the instance, we’ll get the domain part out of the way. In our case, we’ll be using this server for a Ghost publication reachable on a subdomain https://ghost.rewaant.com

We use Cloudflare, adding/updating records for your domain might vary depending on the platform you use for managing the domain’s nameservers.

For the most part, you just need to add an A and a CNAME record for your Ghost publication to be accessible publicly.

Add an A record with the following configuration:

We’re putting “ ghost “in the Name field. If you’re pointing the apex/root domain to the server, use “@”. If your domain is example.com , use “@” in the Name field so https://example.com points to your publication.
Put in the IPv4 address of your Ubuntu server. This is the IP address you noted down while creating the Linode instance. This will be your server’s IP address if you already had a server setup and didn’t follow the previous section.
TTL field should be set to Auto, and hit “Save”.

Add a CNAME record with the following configuration:

We’re putting in "www.ghost ” in the Name field. If you’re pointing the apex/root domain, use “ www “. If your domain is example.com , use “ www ” in the Name field so https://www.example.com points to your publication.
We’re putting “ ghost.rewaant.com ” in the Target field. We’re doing this because we want all requests for “ www.ghost.rewaant.com ” to be resolved to ghost.rewaant.com . If your domain is example.com use “ example.com ” in the Target field so all requests to “ www.example.com ” will be resolved to “ example.com “.
Hit “Save”.

If this doesn’t work as expected, or you’re trying to set up a different structure, we recommend you follow a domain-specific guide or post your detailed issue directly in the comments section below.

You can now ping your domain to check connectivity. That’s it, we’re good to go to the next step.

Setting up your server for serving Ghost

To connect to your VPS, you can either use a web console provided by most cloud providers or a terminal window on your computer. If you’re using Linode, the web console is called LISH console (click “Launch LISH Console”). You can also connect via a local terminal session using the ssh command directly on a terminal window. Important: If you’re using Windows, you’ll need to use a third-party software called Putty to connect to your instance. We’ll post a guide on how to connect to an instance via SSH on Windows using Putty and PuttyGen.

Once connected, you should see a window similar to the one below. Type in “yes” to continue, it’ll then ask for the root password. Type in the root password you set while creating the instance.

We’ll start with performing system updates and securing our server. If you’re setting up a production server, we highly recommend you set up key-based authentication and disable password-based authentication. We also recommend you do this before following the remaining steps of this guide. You can learn more about how to do this by following our concise guide: How to setup SSH keys on your Linux server

To perform updates, type in the following commands:

apt update && apt upgrade → Once you run this command, you’ll see a somewhat similar output. Type in Y to continue. This should take a little while to complete but should upgrade all the packages and libraries.

reboot → It’s recommended to reboot after processing updates. Allow a minute or two and reconnect via SSH following steps 1 and 2.

To set up the timezone, type in the following commands:

dpkg-reconfigure tzdata → This should take you to the following screen, Choose the timezone with the up/down arrow & enter keys then use the tab key to navigate and hit “Ok”.

You should now get back to the console.

Before proceeding further, we recommend not using root for system administration. It’s highly recommended to set up a new (less privileged) user for server administration. Type in the following commands to add a less privileged user:

adduser *preferred_username* → Type in your username in place of *“preferred_username”*, we’ll be using “rewaant” so the command becomes adduser rewaant. This will now ask for a new password, set a strong password. Type in the Full Name and skip the info for defaults that you don’t want to populate. Type in Y to continue and your new user should be created.

Type in adduser *preferred_username* sudo → Replace *“preferred_username”* with your username. In our case, the command becomes adduser rewaant sudo. This command adds the new user to the sudo group which grants root privileges to the user when prefixed with sudo.

Disconnect and reconnect using the ssh command replacing “root” with the new user. The updated ssh command becomes ssh preferred_username@server_ip_address. In our case, this becomes ssh rewaant@176.58.98.58. You should now be able to authenticate with the newly created user.

Next, we’ll harden access through SSH and set up a firewall. Please follow our guide that explains how to do both here: Hardening SSH on your Linux server

Now that we have a server setup, domain pointed, and our server secured, we can proceed to set up the stack and install ghost itself on the server. According to the official Ghost docs, we have the following prerequisites:

Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04 or Ubuntu 22.04 → Check
NGINX (minimum of 1.9.5 for SSL)
A supported version of Node.js
MySQL 8
Systemd → Check
A server with at least 1GB memory → Check
A registered domain name → Check

We’ll start with installing NGINX (Web Server), MySQL (Database Server), and the recent LTS version of Node.js. Execute the following commands:

sudo apt-get install nginx → This will install Nginx. Also, make sure to allow ufw for HTTP and HTTPS connection with this command: sudo ufw allow ‘Nginx Full’

sudo apt-get install mysql-server → This will install the MySQL database server.

curl -sL https://deb.nodesource.com/setup_16.x | sudo -E bash → This will add the APT repo for Node 16 to the package manager’s sources.

sudo apt-get install -y nodejs → This will install Node.js

Next, we’ll install the Ghost-CLI which is a command line utility to install and manage Ghost installations. Execute sudo npm install ghost-cli@latest -g → This will install the latest version of ghost-cli globally.

Before we install Ghost, it’s highly recommended that you secure MySQL. We’ll do it with the following commands:

sudo mysql → This will log you in to MySQL as root.

ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password by *'your_new_password'*; → This will set a root password. Make sure to replace *'your_new_password'* with your password of choice and remember this for future reference or save/write it down.

Run sudo mysql_secure_installation. Type in the root password set in the previous step, type in “No” for Validate Password Component, Type in “No” for the prompt to change the root password, type in Y to remove anonymous users, type in Y to disallow root login remotely, type in Y to remove test database, type in Y to reload privilege tables now and hit Return. It should now output an “All done!” message.

We’re now ready to install ghost. Execute the following commands:

sudo mkdir -p /var/www/*sitename* → Creates a directory to host your site. In our case, this command becomes sudo mkdir -p /var/www/ghost.rewaant.com

sudo chown *<username>*:*<username>* /var/www/*sitename →* Changes the directory owner to our limited user. This helps us run the ghost install script. In our case, this command becomes sudo chown rewaant:rewaant /var/www/ghost.rewaant.com

sudo chmod 775 /var/www/ghost.rewaant.com → Sets the proper directory permissions.

cd /var/www/ghost.rewaant.com → Navigates to the target installation directory.

ghost install → Starts the installation process. It’ll now prompt you for more details:

Blog URL → Type in your blog’s URL. In our case, this becomes https://ghost.rewaant.com

MySQL hostname → Leave this to default (”localhost”) and press return/enter.

MySQL username → Type in root and supply the root password you set earlier.

Ghost database name → Enter a database name, for us we used the default ghost_rewaant_com_prod

Do you wish to set up “ghost” mysql user? → Highly recommended, press Y

Do you wish to setup “Nginx”? → Press Y

Do you wish to setup SSL? → This install LetsEncrypt SSL certificates on your instance. We again recommend doing this. Keep in mind for this to work, your domain records should already be set to point to this server. Press Y Important: If you’re using Cloudflare or your domain service proxies the domain’s IP addresses, this will most likely not work. You’ll have to stop proxying the domain to verify the ownership. Once they’re verified, you can switch them back to being proxied. Please Ignore if your nameservers don’t proxy requests to your domain.

Type in your email if you chose Y in the previous step.

Do you wish to setup Systemd? → Press Y . This will register your ghost publication as a systemd service which automatically starts on reboot. Highly recommended.

Do you want to start Ghost? → Press Y. This should start Ghost and it should be accessible at your chosen URL. In our case https://ghost.rewaant.com

You now have your production server ready. We can disconnect now by typing in exit.

If at any point the setup fails, you can try ghost setup to re-run the configuration process or reinstall with ghost uninstall and ghost install

Setting up the publication and going live

To set up the publication, visit https://your_blog_url/ghost. In our case, it’s https://ghost.rewaant.com/ghost

You’re now successfully serving a self-hosted Ghost Publication.

How to setup SSH keys on your Linux server

Rewaant Chhabra — Sun, 04 Sep 2022 06:03:28 GMT

Overview

SSH stands for “Secure Shell” which is both a protocol and a command line program that lets you administer a remote Linux computer. Here in this guide, we’ll explain setting up key-based SSH authentication for production servers. SSH keys aren’t only more secure than a regular password-based authentication but are convenient at times when you have to manage a number of remote systems.

Getting Started

Let’s get started by first creating an Authentication key pair.

Open up a terminal window on your computer. Create a key pair with the following commands:
ssh-keygen → Creates a new public/private key pair.

Type in the file names. Here we’ll use rewaant-test
Important: If you already have existing keys with the same name in the directory, this will overwrite their content which may render them useless or worse lock you out of other systems. It’s important to choose a unique name here.

It should now prompt for a passphrase. If you’ll be using this key on a personal/local computer to connect to a single instance and the key files won’t be passed around/shared, you can leave this empty. It’s highly suggested though that you use a passphrase. Whenever you’ll connect to an instance with a passphrase authenticated key, you’ll need to type in the passphrase every single time. Here for the sake of convenience, we’ll leave the passphrase empty.

Your key pair should now be generated. This pair will be saved in either your user’s home directory ~/ or in the /home/your_username/.ssh with the names you selected. The public key file is named with a .pub suffix.

Main Configuration

Next, we’ll have to set up the public key as an “authorized key” to authenticate our logins. We have to upload the public key with specific permissions for the instance’s SSH server to use it for authentication. Follow these steps:

Connect to your instance via SSH.
ssh your_username@your_instance_ip_addresswhich, in our case, becomes ssh rewaant@176.58.98.58

Once connected, type in the following commands:
mkdir ~/.ssh && sudo chmod -R 700 ~/.ssh/→ This command creates a directory (.ssh) under the user’s home directory and modifies its permission to 700.

Disconnect and copy the public key to your instance. Use the following commands:
scp ~/.ssh/key_name.pub your_username@your_instance_ip_address:~/.ssh/authorized_keys → SCP is a command line tool used to copy files to a remote computer. This command essentially just copies your public key file to the instance. In our case, this command becomes: scp ~/.ssh/rewaant-test.pub rewaant@176.58.98.58:~/.ssh/authorized_keys
It should prompt you for your password, once authenticated it’ll copy the file and take you back to your terminal window.

Now we need to set the proper permission to the authorized keys file. Connect to your instance again, execute sudo chmod 600 ~/.ssh/authorized_keys, disconnect by typing in exit

Try reconnecting with the command: ssh your_username@your_instance_ip_address-i ~/.ssh/key_nameIn our case, this command becomes ssh rewaant@176.58.98.58 -i ~/.ssh/rewaant-test. Make sure to substitute your public key file path if it’s different from ours.

You should now be able to connect to your instance with the SSH Keys. Keep in mind if you used a passphrase when generating the SSH keys, you’ll be asked for a passphrase to authenticate.

Conclusion

Key-based authentication is much more secure and convenient if you manage multiple systems. We highly recommend using it over passwords in production environments. If you’re setting up a production server, consider reading our guide to Hardening SSH on your production server: Link

Hardening SSH on your Linux server

Rewaant Chhabra — Sat, 03 Sep 2022 06:44:49 GMT

Overview

This guide covers important aspects of hardening SSH access for your production server so you can secure your resources against random brute-force login attempts.

We’ll be mainly covering these topics:

Use key-based authentication if you’re still using passwords
Disable SSH access over IPv6
Disable root login via SSH
Disable password-based authentication once you can connect with your keys
Set up a firewall
Using Fail2Ban to ban IP addresses after too many login attempts

Let’s get started!

Setting up key-based authentication

If you’re using a password to authenticate into your production server, we highly recommend using SSH keys which are more secure and convenient for managing servers. Follow the steps in this guide and you should be good to go: How to setup SSH keys on your Linux server

Disable the IPv6 access

IPv6 is a newer protocol compared to IPv4, but for most users out there, it’s likely they won’t be needing it presently. For enhancing security, we’ll disable SSH access over IPv6.

Connect to your instance with a less privileged user you’ve set up previously. Do not proceed if you just have the root user’s credentials.

Once connected, type in the command: sudo nano /etc/ssh/sshd_config. This should ask for your user’s password. Once you have access to the file, navigate with the arrow keys to line with the following text:

#Port 22
#AddressFamily any

It’ll most likely be on top of the file with the configuration commented out, make sure this is set to:

#Port 22
AddressFamily inet

This should allow access only over IPv4 connections.

Disable root login via SSH

Next, we’ll disable the root user to log in via SSH. “root” is a superuser with the highest administrative privileges that in the wrong/incompetent hands can wreak havoc in the system. Also, most brute-force login attempts target the root user so it’s important to disable this user for SSH entirely. It’s important to make sure that you have a less privileged user already set up on your system with sudo capabilities. You should also know the password to this less privileged user account or you may risk locking yourself out of the system entirely.

PermitRootLogin yes Change this line to PermitRootLogin no

We now have to write these changes to disk. Assuming you’re using the nano text editor, execute the following commands: Ctrl+O or Cmd+O to write changes to the file. This will confirm the filename, leave it to default, and DO NOT CHANGE. Press Ctrl+X or Cmd+X to exit the nano text editor.

Now we need to restart the SSH service to make these changes active. Execute the command: sudo systemctl restart sshd This will restart the SSH service.

Important: If at any point during or after this tutorial, you get locked out of your system, you can always fall back to using your cloud provider’s web console. They’re handy when things go awry.

Let’s continue to the next section and set up a firewall.

Set up a firewall

We’ll be using ufw in this guide which stands for Uncomplicated Firewall. This firewall program is simple to set up and more than enough for most use cases out there. To get started, let’s check if we have it pre-installed:

Execute the command: sudo apt install ufw You should see a similar output below.

Once it’s installed, we can enable/disable rules under ufw. For our use case with SSH and opening up the usual HTTP (80) and HTTPS (443) ports, we’ll execute the following commands:

sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

You should see a similar output below.

Now that we’ve allowed the basic ports with firewall, we’ll enable it with the command sudo ufw enable. Do not enable ufw without allowing ssh or port 22 as it’s likely you WILL get locked out of your system.

Check the firewall status with sudo ufw status. This should have similar output with Status: active and the rules printed out below.

We now have the firewall setup, we’ll proceed to the next and final step.

Setting up Fail2Ban

Fail2Ban is another utility that prevents your server from brute-force attacks. It’s likely that authenticated users will be able to access your server with 3 or lesser tries. This utility will ban IP addresses used by hackers and bots which may try to break into our systems using brute-force attacks.

Install Fail2Ban with sudo apt install fail2ban

Enable the fail2ban service with the command sudo systemctl enable fail2ban this will create a systemd service for fail2ban.

We’ll keep the fail2ban configuration to default for simplicity. However, we intend on writing a comprehensive guide for fail2ban later. To start the service, use sudo systemctl start fail2ban.

We’ll now check the service status. Type in sudo systemctl status fail2ban and you should see similar output.

You now have Fail2Ban active and running on your server.

This guide helps you tighten security on your production server by hardening SSH access. Following this guide keeps your resources more secure than most production servers out there. In the end, no matter how many security measures we take it’s always better when solutions are customized specifically to our needs. We recommend you read more on these topics or feel free to reach out to schedule an intro call so we can help you with setting up your sites or app’s infrastructure properly.