phpIPAM 1.8 Complete Guide

Instalasi produksi phpIPAM 1.8.x pada Debian 12 Bookworm, Debian 13 Trixie, Ubuntu 24.04 LTS, dan Ubuntu 26.04 LTS dengan Nginx, PHP-FPM, MySQL/MariaDB, TLS, dan subdomain ipam.domain.tld.

1.8.x

phpIPAM

8.2–8.5

PHP Distro

Nginx

+ PHP-FPM

TLS

Let's Encrypt

Navigasi Cepat Bab

OS Stack phpIPAM Nginx TLS Wizard Cron Security

Ringkasan Arsitektur phpIPAM 1.8

phpIPAM 1.8 (rilis stabil 1.8.0 / perbaikan 1.8.1) adalah IP Address Management open source berbasis PHP. Cabang git stabil resmi kini master; develop untuk pengembangan. Panduan ini mengikuti dokumentasi resmi phpipam.net dan praktik produksi ALSYUNDAWY IT Solution.

Komponen Utama

Aplikasi web di /var/www/phpipam
PHP-FPM pool terpisah (bukan Apache mod_php)
MySQL 8 / MariaDB 10.11+ dengan utf8mb4
Pretty URL via try_files Nginx
Integrasi opsional PowerDNS, LDAP/AD, API

Prinsip Produksi

Subdomain khusus: ipam.domain.tld
TLS 1.2/1.3, HSTS, header keamanan
DB user terbatas, bukan root aplikasi
Timezone Asia/Jakarta, locale UTF-8
Backup harian + uji restore

Referensi resmi: phpipam.net/documents/installation, rilis 1.8 di GitHub, serta berita keamanan XSS/SQLi/RCE yang sudah ditutup di 1.8.x.

Persyaratan Sistem

Komponen	Minimum	Rekomendasi produksi
CPU / RAM	1 vCPU / 1 GB	2–4 vCPU / 4 GB+
Disk	10 GB	20 GB+ SSD, backup terpisah
OS	Debian 12 / Ubuntu 24.04	Debian 13 atau Ubuntu 26.04 LTS
PHP	7.2+ (resmi lama)	PHP distro: 8.2–8.5 + ekstensi lengkap
DB	MySQL 5.1+	MariaDB 10.11+ / MySQL 8.0+ utf8mb4
Web	Apache atau Nginx+php-fpm	Nginx + php-fpm + Certbot
Utilitas	git, fping	git, fping, cron, fail2ban, ufw

Ekstensi wajib: pdo, pdo_mysql, session, sockets, openssl, gmp, json, gettext, filter, mbstring, xml, gd, curl, zip. Opsional: ldap, pcntl, cli (scan), SimpleXML (RIPE/API).

Hardening OS, Hostname & Versi PHP

Distribusi	PHP default (2026)	Paket web/db
Debian 12 Bookworm	8.2	nginx, php-fpm, mariadb-server
Debian 13 Trixie	8.4	nginx, php-fpm, mariadb-server
Ubuntu 24.04 LTS	8.3	nginx, php-fpm, mysql-server atau mariadb
Ubuntu 26.04 LTS	8.5	nginx, php-fpm, mysql-server atau mariadb

Baseline OS

sudo timedatectl set-timezone Asia/Jakarta
sudo hostnamectl set-hostname ipam.domain.tld
echo "127.0.1.1 ipam.domain.tld ipam" | sudo tee -a /etc/hosts
sudo apt update && sudo DEBIAN_FRONTEND=noninteractive apt full-upgrade -y
sudo apt install -y ca-certificates curl git unzip fping locales
sudo sed -i 's/^# *en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
sudo locale-gen
sudo update-locale LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8

Instalasi Nginx, PHP-FPM, MySQL/MariaDB

Paket stack

sudo apt install -y nginx mariadb-server \
  php-fpm php-mysql php-gmp php-gd php-curl php-xml php-mbstring \
  php-zip php-ldap php-intl php-bcmath php-cli php-opcache php-pear

php -v
php -m | sort
PHP_VER="$(php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;')"
sudo systemctl enable --now nginx "php${PHP_VER}-fpm" mariadb

Di Ubuntu Anda boleh memakai mysql-server sebagai pengganti MariaDB. Socket PHP-FPM biasanya /run/php/php8.X-fpm.sock — sesuaikan X dengan versi distro (jangan pakai glob php*-fpm di systemctl karena unit tidak selalu di-expand).

Database phpIPAM

sudo mysql --protocol=socket <<'SQL'
CREATE DATABASE phpipam CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'phpipam'@'localhost' IDENTIFIED BY 'GantiPasswordKuat!';
GRANT ALL PRIVILEGES ON phpipam.* TO 'phpipam'@'localhost';
FLUSH PRIVILEGES;
SQL
sudo mysql_secure_installation

Unduh phpIPAM 1.8.x

Git clone cabang 1.8

sudo mkdir -p /var/www
sudo git clone --recursive https://github.com/phpipam/phpipam.git /var/www/phpipam
cd /var/www/phpipam
sudo git fetch --tags
sudo git checkout 1.8
# Prefer tag stabil: sudo git checkout v1.8.1
# atau master jika 1.8 sudah menjadi cabang stabil resmi
sudo cp config.dist.php config.php
sudo chown -R www-data:www-data /var/www/phpipam
sudo find /var/www/phpipam -type d -exec chmod 755 {} \;
sudo find /var/www/phpipam -type f -exec chmod 644 {} \;

Edit config.php: host localhost, user/pass/db sesuai SQL di atas, dan define('BASE', "/"); karena aplikasi di root subdomain.

Potongan config.php

$db['host'] = "localhost";
$db['user'] = "phpipam";
$db['pass'] = "GantiPasswordKuat!";
$db['name'] = "phpipam";
$db['port'] = 3306;
define('BASE', "/");

Jangan commit config.php. Setelah wizard selesai, hapus atau proteksi direktori install/.

Virtual Host Nginx — ipam.domain.tld

/etc/nginx/sites-available/ipam.domain.tld

server {
    listen 80;
    listen [::]:80;
    server_name ipam.domain.tld;
    root /var/www/phpipam;
    index index.php;
    client_max_body_size 32m;

    location / {
        try_files $uri $uri/ /index.php$is_args$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.(ht|git) { deny all; }
    location ^~ /app/admin/import-export/upload/ { deny all; }
}

Aktifkan situs

# Ganti php8.4-fpm.sock sesuai php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;'
sudo ln -sf /etc/nginx/sites-available/ipam.domain.tld /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx

TLS Let's Encrypt

Arahkan A/AAAA ipam.domain.tld ke IP publik server sebelum menjalankan Certbot.

Certbot Nginx

sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d ipam.domain.tld --redirect \
  --agree-tos -m [email protected] --no-eff-email
sudo systemctl enable --now certbot.timer
sudo certbot renew --dry-run

Wizard Web & Impor Skema

Buka https://ipam.domain.tld.
Pilih Automatic database installation (user MySQL dengan hak CREATE) atau impor manual db/SCHEMA.sql.
Impor manual: sudo mysql phpipam < /var/www/phpipam/db/SCHEMA.sql
Buat akun administrator kuat (≥ 16 karakter, unik).
Set timezone, site URL https://ipam.domain.tld, pretty links ON.

Cron Discovery, Ping & Backup

crontab www-data + backup

sudo crontab -u www-data -e
# Discovery / ping / DNS (sesuaikan path php)
*/15 * * * * /usr/bin/php /var/www/phpipam/functions/scripts/discoveryCheck.php
*/15 * * * * /usr/bin/php /var/www/phpipam/functions/scripts/pingCheck.php
0    * * * * /usr/bin/php /var/www/phpipam/functions/scripts/resolveIPaddresses.php

sudo mkdir -p /var/backups/phpipam
# crontab root
15 2 * * * mysqldump --single-transaction --routines phpipam | gzip > /var/backups/phpipam/phpipam-$(date +\%F).sql.gz
20 2 * * * find /var/backups/phpipam -type f -mtime +14 -delete

Pastikan fping ada dan path ping di Administration → phpIPAM settings mengarah ke biner yang diizinkan (1.8 menutup RCE via ping_path).

Keamanan Produksi

Firewall: hanya 22/80/443 dari manajemen; jangan buka 3306 ke publik.
Setelah install: sudo rm -rf /var/www/phpipam/install
PHP: expose_php=Off, batasi upload_max_filesize, aktifkan OPcache.
Aktifkan 2FA di phpIPAM; batasi API token; jangan izinkan HTML mentah di request IP.
Upgrade hanya setelah backup DB; ikuti upgrade guide resmi 1.7 → 1.8.

UFW + hapus installer

sudo apt install -y ufw
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw --force enable
sudo rm -rf /var/www/phpipam/install

Ringkasan & Best Practices

Stack siap produksi: OS mutakhir, PHP distro 8.2–8.5, MariaDB utf8mb4, Nginx pretty URL, TLS, cron scan, dan backup teruji.

Checklist

# 1. DNS A/AAAA ipam.domain.tld
# 2. apt full-upgrade + timezone Asia/Jakarta
# 3. nginx + php-fpm + mariadb + fping
# 4. git clone --recursive + checkout 1.8 + config.php
# 5. socket PHP-FPM sesuai versi distro
# 6. certbot --nginx -d ipam.domain.tld
# 7. wizard / SCHEMA.sql + ganti Admin/ipamadmin
# 8. hapus install/ + cron + mysqldump harian

Kesimpulan: phpIPAM 1.8.x di https://ipam.domain.tld siap mengelola subnet, VLAN, perangkat, dan API dengan standar keamanan rilis 1.8.

Dokumentasi phpIPAM 1.8 — Debian 12/13 & Ubuntu 24.04/26.04 — ALSYUNDAWY IT SOLUTION

phpIPAM 1.8 Guide