Installing a PHP Auction Script on a VPS With nginx

Shared hosting is the easiest way to start an auction site. A VPS gives you more speed, more control, and a clean place to run cron every minute. This guide installs BidKing on a fresh Ubuntu VPS with nginx, PHP-FPM and MariaDB. The same steps work for RaffKing and PrizeX, which share the same installer.

What the server needs

The installer's first step checks these, and tells you exactly what's missing:

• PHP 8.2 or newer, with the mysqli, json, curl, openssl and sodium extensions. Install gd as well, for images.
• MariaDB or MySQL. The code targets MariaDB, so use MariaDB if you have the choice.
• Folders PHP can write to: the site folder (for .env), plugins, assets/themes, images and storage, plus PHP's temporary folder.
• The whole release zip. It includes the vendor folder, so you don't need to run Composer.

On Ubuntu 24.04, whose default PHP is 8.3, this installs everything:

sudo apt update
sudo apt install nginx mariadb-server php-fpm php-mysql php-curl php-gd unzip

JSON, OpenSSL and sodium are built into Ubuntu's PHP packages.

Root of a domain or subdomain only

The site must be installed at the root of a domain or subdomain: example.com or auctions.example.com, not example.com/auctions. If you open the installer from a subfolder, it stops and tells you so.

Point your domain's DNS at the VPS, then unzip the release into the site's web root:

sudo mkdir -p /var/www/auctions
sudo unzip bidking.zip -d /var/www/auctions
sudo chown -R www-data:www-data /var/www/auctions

Check that the files are directly inside /var/www/auctions, not in a folder below it.

The database

Create an empty database and a user with full rights on it:

sudo mysql
CREATE DATABASE auctions CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'auctions'@'localhost' IDENTIFIED BY 'a-long-random-password';
GRANT ALL PRIVILEGES ON auctions.* TO 'auctions'@'localhost';
FLUSH PRIVILEGES;

Using the shipped nginx.conf.example

nginx doesn't read .htaccess files, and the script relies on them for:

• Routing pretty URLs.
• Blocking direct access to .env, connection.php, logs and database dumps.
• Stopping uploaded files from running as PHP.

The release includes nginx.conf.example, which reproduces every one of those rules as an nginx server block. Copy it rather than writing your own:

sudo cp /var/www/auctions/nginx.conf.example /etc/nginx/sites-available/auctions
sudo ln -s /etc/nginx/sites-available/auctions /etc/nginx/sites-enabled/

Then edit three things in it:

• server_name: your domain.
• root: /var/www/auctions.
• fastcgi_pass: your PHP-FPM socket. The example names PHP 8.1's socket, so change it to your version, for example unix:/run/php/php8.3-fpm.sock. Run ls /run/php/ to see the socket name.

Keep the deny rules above the PHP handler, as the file orders them. nginx uses the first regex location that matches, so moving them below the handler would let PHP run files that should be blocked.

Test the config, reload nginx, and add HTTPS:

sudo nginx -t && sudo systemctl reload nginx
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d auctions.example.com

Once HTTPS works, you can uncomment the HTTPS redirect and HSTS lines in the config.

The browser installer

Open your domain in a browser. Until the site is installed, every page redirects to /install/, a seven-step wizard:

1. Requirements check.
2. Site details and your purchase code.
3. Database details.
4. Database import.
5. Your admin account.
6. The plugins and themes your licence includes.
7. Install, which downloads and switches on what you picked, one item at a time.

When it finishes, /install/ stops answering, and you log in at /admin/.

Cron for winners and everything else

Ending auctions, declaring winners and other scheduled work all run from one script, cron/dispatch.php. Run it every minute as the web server user:

sudo crontab -u www-data -e
* * * * * php /var/www/auctions/cron/dispatch.php >/dev/null 2>&1

Without cron, auctions pass their end time but nobody is declared the winner. Settings › Security Logs › Cron Logs in the admin shows the exact line for your server, and whether the jobs are running.

Backups

Back up two things, and keep copies off the server:

• The database, every day:

  mysqldump --single-transaction auctions | gzip > /backups/auctions-$(date +%F).sql.gz

• The files that are unique to your site: .env, storage (your licence file), images (logos and uploads), and the plugins and assets/themes folders.

Test a restore once before you launch. A backup you've never restored is a guess.

Common questions

Can I install BidKing on nginx?

Yes. Use the nginx.conf.example file in the release. It reproduces the .htaccess routing and security rules. Set your domain, web root and PHP-FPM socket in it.

What PHP version does BidKing need?

PHP 8.2 or newer, with the mysqli, json, curl, openssl and sodium extensions. The installer checks these in its first step.

Can I install it in a subfolder?

No. Install it at the root of a domain or subdomain, such as auctions.example.com. The installer stops if it's opened from a subfolder.

Why aren't my auctions ending?

Cron is probably not running. Add a crontab line that runs cron/dispatch.php every minute, then check Settings › Security Logs › Cron Logs in the admin.