MattSec.Com

A Security Blog With A Focus On The Cloud

How To Host Your Own WordPress Site For Free!

by · September 11, 2022

And learn some cloud along the way…

Have you ever wanted to host your blog? Or maybe you’re a small business owner who wants to make the move online. Well, thanks to Oracle Clouds’ free tier, you can, and it won’t cost you a penny.

About Oracle Cloud Infrastructure (OCI)

Oracle Cloud is a cloud computing service offered by Oracle Corporation providing servers, storage, network, applications and services through a global network of Oracle Corporation managed data centers. The company allows these services to be provisioned on demand over the Internet

But How Is It Free?

Well, OCI actually has a really good free tier. It’s better than AWS, Azure and GCP’s free tiers combined. Hopefully, in the future, as OCI becomes more widely adopted, Oracle will still support the free tier as it’s great for people wanting to learn cloud concepts and small business owners alike.

The free tier includes:

  • Two Oracle Autonomous Databases with powerful tools like Oracle APEX and Oracle SQL Developer
  • Two AMD Compute VMs
  • Up to 4 instances of ARM Ampere A1 Compute with 3,000 OCPU hours and 18,000 GB hours per month
  • Block, Object, and Archive Storage; Load Balancer and data egress; Monitoring and Notifications

A complete list of services can be found here. The services are also not time-dependent, so you can use them for as long as you want. So, all in all, that’s a pretty amazing free tier (I’d even argue the best you can get right now).

Table Of Contents:

Creating An Oracle Cloud Infrastructure Account.

Note: You will need an active credit card to perform this step. Oracle will make a small charge to the card to verify it is genuine and immediately refund this charge.

Head to https://signup.cloud.oracle.com/ and complete the required form. Select your home region as something close to most of your user base. Once that is completed, you should see a screen that looks something like this:

OCI home screen.

Deploying a VM (and all the other required bits)

Now we’ve got our account, we can go ahead and deploy our VM. Head to the menu button in the top left, then press “compute” and finally “instances”.

Now press the “Create Instance” button.

The name and placement section doesn’t matter much, but scroll down a little until you see the OS selection and “shape” selection.

I’d recommend using Ubuntu as an OS as it’s very user-friendly because it has a great community backing it, so if you ever have an issue, someone else has no doubt had it, and they will be an article on the internet somewhere.

For the shape, be careful you are selecting resources within your free tier. It doesn’t really matter which one you use, as this tutorial should work on all, but I’d recommend using OCI’s arm offering, and you will end up with quite a powerful machine that can do way more than run a word press site for you in the future.

The configuration setup I’d recommend that will keep you in your free tier allowance.

For networking, select the “Create new virtual cloud network” option.

For this tutorial, we will assume you already have a DNS name to point to your website as. We also won’t be using a load balancer, so select the “Assign a public IPv4 address” option.

Finally, either create or import an SSH key.

Now hit “Create”.

Installing WordPress

Now that you’ve created your VM, SSH into it with the key you created. To install WordPress, run the following commands on the VM:

Install packages that WordPress needs (dependencies)

sudo apt update
sudo apt install apache2 \
                 ghostscript \
                 libapache2-mod-php \
                 mysql-server \
                 php \
                 php-bcmath \
                 php-curl \
                 php-imagick \
                 php-intl \
                 php-json \
                 php-mbstring \
                 php-mysql \
                 php-xml \
                 php-zip

Install WordPress

sudo mkdir -p /srv/www
sudo chown www-data: /srv/www
curl https://wordpress.org/latest.tar.gz | sudo -u www-data tar zx -C /srv/www

Configure Apache

Firstly create the following file "/etc/apache2/sites-available/wordpress.conf"

Then paste the contents below into the file.

<VirtualHost *:80>
    DocumentRoot /srv/www/wordpress
    <Directory /srv/www/wordpress>
        Options FollowSymLinks
        AllowOverride Limit Options FileInfo
        DirectoryIndex index.php
        Require all granted
    </Directory>
    <Directory /srv/www/wordpress/wp-content>
        Options FollowSymLinks
        Require all granted
    </Directory>
</VirtualHost>

And finally, run the following commands

#Enable the site with:
sudo a2ensite wordpress

#Enable URL rewriting with:
sudo a2enmod rewrite

#Disable the default “It Works” site with:
sudo a2dissite 000-default

#Finally, reload apache2 to apply all these changes:
sudo service apache2 reload

Database configuration

sudo mysql -u root
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 7
Server version: 5.7.20-0ubuntu0.16.04.1 (Ubuntu)

Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> CREATE DATABASE wordpress;
Query OK, 1 row affected (0,00 sec)

mysql> CREATE USER wordpress@localhost IDENTIFIED BY '<your-password>';
Query OK, 1 row affected (0,00 sec)

mysql> GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,DROP,ALTER
    -> ON wordpress.*
    -> TO wordpress@localhost;
Query OK, 1 row affected (0,00 sec)

mysql> FLUSH PRIVILEGES;
Query OK, 1 row affected (0,00 sec)

mysql> quit
Bye

#Enable MySQL with 
sudo service mysql start.

Configure WordPress to connect to the database

Now, let’s configure WordPress to use this database. First, copy the sample configuration file to wp-config.php:

sudo -u www-data cp /srv/www/wordpress/wp-config-sample.php /srv/www/wordpress/wp-config.php

Next, set the database credentials in the configuration file (do not replace database_name_here or username_here in the commands below. Do replace <your-password> with your database password.):

sudo -u www-data sed -i 's/database_name_here/wordpress/' /srv/www/wordpress/wp-config.php
sudo -u www-data sed -i 's/username_here/wordpress/' /srv/www/wordpress/wp-config.php
sudo -u www-data sed -i 's/password_here/<your-password>/' /srv/www/wordpress/wp-config.php

Finally, in a terminal session open the configuration file in vi:

sudo -u www-data vi /srv/www/wordpress/wp-config.php

Find the following:

define( 'AUTH_KEY',         'put your unique phrase here' );
define( 'SECURE_AUTH_KEY',  'put your unique phrase here' );
define( 'LOGGED_IN_KEY',    'put your unique phrase here' );
define( 'NONCE_KEY',        'put your unique phrase here' );
define( 'AUTH_SALT',        'put your unique phrase here' );
define( 'SECURE_AUTH_SALT', 'put your unique phrase here' );
define( 'LOGGED_IN_SALT',   'put your unique phrase here' );
define( 'NONCE_SALT',       'put your unique phrase here' );

Delete those lines (dd will delete a line each time you press the sequence). Then replace with the content of https://api.wordpress.org/secret-key/1.1/salt/. (This address is a randomiser that returns completely random keys each time it is opened.) This step is important to ensure that your site is not vulnerable to “known secrets” attacks.

Save and close the configuration file by typing :wq followed by enter

Now you’re ready to test if all this worked. However, we need to change some network settings within OCI first so we can access our site.

Head to Compute -> Instances -> Instance details (for the instance we created earlier)

Then on the middle left of the screen, you will notice a “Virtual cloud network” section – click this. This should take you to a screen that looks like this:

If you follow the default setup, your instance should be in the public subnet – click this. The next page should have a “default_security_list_for_vpc_name”. Click this. Here you should see a bunch of firewall rules.

You’ll need to add a rule for port 80 and port 443 from 0.0.0.0/0

I’d also recommend you change your SSH rule here (which is created by default to accept connections from 0.0.0.0/0 or the whole internet, basically.) You should limit this to just your public IP (which can be found on sites like https://www.whatismyip.com/ )

OCI’s extra firewall step

For some reason, iptables is enabled on all OCI instances to deny everything other than SSH traffic. I don’t really see the need for this in my opinion since there are firewall controls within OCI. However, we will need to disable this if we want our WordPress site to work.

iptables --flush

This also gets re-enabled at every reboot, so you may want to put this on a corn job. Then just control your firewall from OCI.

Testing if everything worked

Okay, now, if everything worked, you should be able to head to http://your_instance_public_ip/wp-admin, and you should see this:

You can now proceed to setup WordPress

Setting Up Lets Encrypt

Now that you’ve got your WordPress site up and running, we are going to want to enable HTTPS. It’s 2022, and there is no reason not to enable encryption. Not to mention that search engines like google will actually be discouraged from sending visitors to your site if it’s running HTTP rather than HTTPS

The good news is there is a tool that does this for us almost automatically. It’s also completely free!

But before we get to that, it’s probably a good time to register a domain at this point. However, this is the only part of this article that isn’t free – there are plenty of sites out there which can give you cheap ones, so shop around, see what works best for you and then point your domain at the public IP of your VM instance (or setup a load balancer in OCI that points to your VM).

Once you’ve got your domain registered, SSH back into your instance and run the following commands:

sudo apt install certbot python3-certbot-apache
#
sudo certbot --apache

We will now run through a set of questions, fill them in similar to the below:

Assuming everything has worked, you should see a message like this:

Now you can go to https://yourdomain.com and check everything is working as expected. If you’re using Chrome, you should see a padlock at the top left of the screen where you can validate the connection is using HTTPS.

and that’s it, HTTPS is now enabled on your site. Just make sure you change your WordPress settings to reflect this change (Sitename).

Backup.

So you’ve got your site set up, it’s probably a good idea to think about some sort of backup method in case the worst should happen.

For this script to work, you’ll need to set up a storage bucket and create API keys for the instance. However, this article is already quite long, so I’ll leave these bits for another time.

Here is the backup script…

#!/bin/bash

# This script creates a compressed backup archive of the given directory and the given MySQL table.

# Set the date format, filename and the directories where your backup files will be placed and which directory will be archived.
NOW=$(date +"%Y-%m-%d-%H%M")
FILE="something.com.$NOW.tar"
BACKUP_DIR="/wordpress_backups"
WWW_DIR="/srv/www/wordpress"

# MySQL database credentials
DB_USER="xxx"
DB_PASS="xxx"
DB_NAME="xxx"
DB_FILE="something.$NOW.sql"


# Create the archive and the MySQL dump
tar -cvf $BACKUP_DIR/$FILE $WWW_DIR
mysqldump -u$DB_USER -p$DB_PASS --no-tablespaces $DB_NAME > $BACKUP_DIR/$DB_FILE

# Append the dump to the archive, remove the dump and compress the whole archive.
tar --append --file=$BACKUP_DIR/$FILE $BACKUP_DIR/$DB_FILE
rm $BACKUP_DIR/$DB_FILE
gzip -9 $BACKUP_DIR/$FILE


# enter into python virt env to do the upload to oci

source /home/ubuntu/scripts/oracle-cli/bin/activate

oci os object put --namespace <name_space_ID> --bucket-name <bucket_name> --file $BACKUP_DIR/$FILE.gz



find $BACKUP_DIR -name "*.gz" -type f -mtime +120 -delete

Just keep in mind this won’t delete anything in the bucket, so you will need to clean it out once in a while.

Other Links

if you enjoyed this article, check out my other posts here

Tags:

You may also like...