Install Magento 2 with Composer on Debian (Virtualmin)

Magento Open Source 2.4.x is most cleanly installed with Composer 2 straight from the official repository. This guide walks you through a fresh installation of version 2.4.8 on a Debian 12 (Bookworm) server managed with Virtualmin. It fully replaces our old 2017 guide (PHP 5, MySQL 5.6) with a current, hardened stack.

Requirements

Debian 12 with root or sudo access, managed through Virtualmin
PHP 8.3 (recommended and supported by Magento 2.4.8) including FPM
Composer 2 – installed globally or per virtual server
MariaDB 10.6+ or MySQL 8.0 as the database
OpenSearch 2.x as the mandatory search engine (replacing Elasticsearch)
Valid authentication keys (public/private key) from the Magento Marketplace
At least 4 GB RAM (more recommended for setup:di:compile) and a valid TLS certificate

Note on Virtualmin

First create a virtual server (domain) in Virtualmin. Then do not install Magento directly into the public_html root, but into a subfolder, and point the actual DocumentRoot to its pub/ directory. This keeps sensitive files outside the publicly reachable area.

Step-by-step installation

Install PHP 8.3 and the required extensions. Debian 12 ships PHP 8.2; for PHP 8.3 add the widely used Sury repository or use the packages provided by Virtualmin.

sudo apt update
sudo apt install -y php8.3-fpm php8.3-gd php8.3-curl php8.3-intl \
    php8.3-soap php8.3-xsl php8.3-bcmath php8.3-mbstring \
    php8.3-zip php8.3-xml php8.3-mysql

Adjust the key PHP settings. Magento needs generous limits. Set these in your FPM configuration:
```
memory_limit = 2G
max_execution_time = 1800
zlib.output_compression = On
```

Create the database and database user. Use MariaDB 10.6+ or MySQL 8.0:

CREATE DATABASE myDatabaseName CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER 'myDatabaseUser'@'localhost' IDENTIFIED BY 'myStrongPassword';
GRANT ALL PRIVILEGES ON myDatabaseName.* TO 'myDatabaseUser'@'localhost';
FLUSH PRIVILEGES;

Install and start OpenSearch 2.x. Magento 2.4.8 strictly requires a running search engine. Install OpenSearch 2.x locally or connect an external instance, and note the host and port (default 9200).
```
curl -s https://localhost:9200 -u admin:myOpenSearchPassword -k
```
Verify Composer 2. Make sure Composer is on major version 2:
```
composer --version
```
Switch to the target directory and pull Magento via Composer. On first access to repo.magento.com Composer asks for a username and password – enter your public key as the username and your private key as the password (from the Magento Marketplace under Access Keys). They are stored in auth.json.
```
cd ~/domains/your-domain.tld/magento
composer create-project --repository-url=https://repo.magento.com/ \
    magento/project-community-edition:2.4.8 .
```

Install Magento. Run setup:install with your database and OpenSearch parameters. Replace all placeholders:

bin/magento setup:install \
    --base-url=https://your-domain.tld/ \
    --db-host=localhost \
    --db-name=myDatabaseName \
    --db-user=myDatabaseUser \
    --db-password=myStrongPassword \
    --admin-firstname=Admin \
    --admin-lastname=User \
    --admin-email=your@email.domain \
    --admin-user=myAdminUser \
    --admin-password=myStrongAdminPass1 \
    --language=en_US \
    --currency=EUR \
    --timezone=Europe/Berlin \
    --use-rewrites=1 \
    --search-engine=opensearch \
    --opensearch-host=localhost \
    --opensearch-port=9200 \
    --opensearch-index-prefix=magento2 \
    --opensearch-enable-auth=1 \
    --opensearch-username=admin \
    --opensearch-password=myOpenSearchPassword

Set production mode and compile assets. For a live shop:

bin/magento deploy:mode:set production
bin/magento setup:di:compile
bin/magento setup:static-content:deploy en_US de_DE fr_FR
bin/magento indexer:reindex
bin/magento cache:flush

Set the correct file permissions. Grant write access only where Magento needs it:

find var generated vendor pub/static pub/media app/etc -type f -exec chmod g+w {} +
find var generated vendor pub/static pub/media app/etc -type d -exec chmod g+ws {} +
chmod u+x bin/magento

Virtualmin-specific adjustments

On Virtualmin servers FollowSymLinks is often disabled for security reasons. Magento ships directives in its .htaccess files that rely on symbolic links. Therefore, in the relevant .htaccess files (in the root directory and in pub/), replace the directive:

Options +FollowSymLinks

with the owner-bound variant suited to Virtualmin:

Options +SymLinksIfOwnerMatch

To prevent the contents of the media directories from being browsable via directory listings, additionally disable directory indexing in pub/media/.htaccess:

Options -Indexes

Wrap-up and tips

Set up the Magento cron job (bin/magento cron:install), since indexers, emails and reindexing depend on it.
Enforce HTTPS everywhere and check your TLS certificate regularly.
Keep Magento, PHP and OpenSearch up to date with security patches.

Stuck, or would you rather hand installation and maintenance to experienced hands? Get in touch – we are happy to help.