Install and maintain Dolibarr on Ubuntu

Dolibarr is deployed with Apache, PHP 8.2, MariaDB, a domain-specific document root, TLS, UFW, and Fail2ban.

Before you start

• Use a clean, supported Ubuntu server with root or sudo access.
• Point app.example.com to the server before requesting a public TLS certificate.
• Replace every value written as CHANGE_ME and store the generated credentials in a password manager.
• Take a snapshot before changing an existing installation.
• A database name, database user, database password, Dolibarr administrator credentials, and a certificate email address.
• PHP 8.2 packages are supplied from the Ondřej Surý Ubuntu PPA, matching the current playbook.

What the AppStore installation creates

• Apache with rewrite, ssl, and domain virtual hosts
• PHP 8.2 and the extensions required by Dolibarr
• MariaDB with a dedicated database and least-scope local user
• Dolibarr 20.0.2 files under /var/www/app.example.com/public_html

1. Install Apache, PHP, and MariaDB

The AppStore playbook uses PHP 8.2.

sudo apt update
sudo apt install -y software-properties-common ca-certificates curl unzip mariadb-server apache2
sudo add-apt-repository -y ppa:ondrej/php
sudo apt update
sudo apt install -y php8.2 php8.2-cli php8.2-common php8.2-mysql php8.2-curl \
  php8.2-gd php8.2-intl php8.2-mbstring php8.2-xml php8.2-zip php8.2-soap \
  libapache2-mod-php8.2 certbot python3-certbot-apache ufw fail2ban
sudo systemctl enable --now mariadb apache2

2. Create the database

Generate strong values first and keep shell history in mind when handling secrets.

sudo mysql
CREATE DATABASE dolibarr CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'dolibarr'@'localhost' IDENTIFIED BY 'CHANGE_ME_DB_PASSWORD';
GRANT ALL PRIVILEGES ON dolibarr.* TO 'dolibarr'@'localhost';
FLUSH PRIVILEGES;
EXIT;

3. Install Dolibarr files

The current playbook installs Dolibarr 20.0.2 from its GitHub tag archive.

sudo install -d -o www-data -g www-data -m 0750 /var/www/app.example.com/public_html
cd /tmp
curl -fL https://github.com/Dolibarr/dolibarr/archive/refs/tags/20.0.2.tar.gz -o dolibarr-20.0.2.tar.gz
sudo tar -xzf dolibarr-20.0.2.tar.gz --strip-components=1 -C /var/www/app.example.com/public_html
sudo chown -R www-data:www-data /var/www/app.example.com

4. Configure Apache and TLS

Use /var/www/app.example.com/public_html/htdocs as the public document root.

sudo a2enmod rewrite ssl headers
sudo nano /etc/apache2/sites-available/app.example.com.conf
# Set ServerName app.example.com and DocumentRoot /var/www/app.example.com/htdocs
sudo a2ensite app.example.com.conf
sudo a2dissite 000-default.conf
sudo apache2ctl configtest
sudo systemctl reload apache2
sudo certbot --apache -d app.example.com -m admin@example.com --agree-tos --redirect

5. Finish the web installer

Browse to https://app.example.com, enter the database values, create the administrator, and remove or lock the installer when Dolibarr asks you to.

Important files and data

• Application files: /var/www/app.example.com/public_html
• Apache site: /etc/apache2/sites-available/app.example.com.conf
• MariaDB database: dolibarr in this example
• Dolibarr documents directory: record the value selected during setup and include it in backups

Health checks and logs

Run these checks after installation and after each upgrade:

sudo apache2ctl configtest
sudo systemctl status apache2 mariadb --no-pager
curl -I https://app.example.com
sudo tail -n 100 /var/log/apache2/error.log

Routine maintenance

Review release notes and take a backup or snapshot before upgrading. Use the following playbook-aligned commands as the starting point:

sudo mariadb-dump --single-transaction dolibarr > dolibarr.sql
sudo systemctl reload apache2
sudo certbot renew --dry-run

Backup scope

• A consistent MariaDB dump of the Dolibarr database
• /var/www/app.example.com/public_html, including htdocs/conf/conf.php
• The Dolibarr documents directory and Apache site configuration

A usable backup needs both application files and application data. Test restoration on a separate server; an untested backup is not a recovery plan.

Troubleshooting

• Confirm DNS with dig +short app.example.com before retrying Certbot.
• Test the web-server configuration before reloading it: sudo nginx -t or sudo apache2ctl configtest.
• Check free space with df -h and listening ports with sudo ss -ltnup.
• If a service fails, inspect its systemd journal before changing configuration.
• A blank page commonly indicates a missing PHP extension or a PHP error; inspect the Apache error log.
• If uploads fail, check PHP upload limits and ownership of the Dolibarr documents directory.

Security notes

• Do not paste passwords, API keys, repository credentials, private keys, or access tokens into tickets or public logs.
• Expose only the documented public ports. Keep database and application backend ports bound to localhost or a private network.
• Keep SSH access working before enabling UFW, then allow only the ports this guide lists.
• Renewal can be tested safely with sudo certbot renew --dry-run where Certbot manages TLS.