Global Cloud Global Cloud Contact Us

Alibaba Cloud Ubuntu server setup guide with Nginx and MySQL database

Alibaba Cloud / 2026-08-20 15:10:52

Alibaba Cloud Ubuntu server setup guide with Nginx and MySQL database (with the account parts people usually skip)

If you’re searching this title, you’re likely trying to do two things at once: (1) get a usable Ubuntu instance on Alibaba Cloud fast, and (2) deploy Nginx + MySQL without wasting days on account/renewal/payment/risk-control issues. Below is the workflow I’d use in a real purchase-to-production run, including the account steps that commonly block people.

Alibaba Cloud 1) Before you provision: the “account readiness” checklist (so you don’t get stuck mid-deploy)

Many “setup guides” only cover server commands. In practice, deployments fail earlier due to account readiness. Here’s what to verify first on Alibaba Cloud:

  • Identity verification (KYC) status: check if your account is verified for the regions/services you plan to use. Some users can create ECS resources but later hit restrictions when adding certain networking, IP, or billing changes.
  • Payment method availability: ensure your selected payment method can handle auto-renew and recurring charges. If you use cards that are frequently blocked by bank risk rules, your renewals can fail and your instance may get terminated or go into a non-billable/limited state depending on your plan.
  • Region and network constraints: confirm the region has your preferred Ubuntu image and that security groups can open ports you need (22/80/443/3306).
  • Compliance/risk control controls: if you expect to expose public services, plan for standard hardening. Alibaba Cloud risk systems may monitor unusual outbound traffic patterns, repeated failed logins, or sudden spikes right after instance launch.

Quick decision rule (real-world)

If you’re new and your KYC is not completed yet, don’t rely on last-minute rush. I’ve seen cases where users provisioned an ECS but couldn’t keep it running after a failed renewal because verification/payment status wasn’t fully enabled.

2) Purchasing an Ubuntu server on Alibaba Cloud: what to select for an Nginx + MySQL stack

Use the “end-state” view: you want a stable web server (Nginx) and a database (MySQL). That implies you must consider storage and networking first, not just CPU.

Alibaba Cloud Instance sizing that avoids common pain

Workload assumption Typical starting ECS Why this size matters
Personal site / small landing pages + light traffic 1 vCPU / 2GB–4GB RAM / 40–80GB disk MySQL will fit comfortably without frequent OOM or slow queries.
Small app + moderate traffic (WordPress/WooCommerce-like or small SaaS) 2 vCPU / 4GB–8GB RAM / 80–120GB disk InnoDB + caching needs headroom; disk latency affects DB performance.
Production-like testing (traffic bursts, backups, later scaling) 2–4 vCPU / 8GB–16GB RAM / 120GB+ More stable under connection spikes; easier to tune MySQL buffers.

OS image choice: Ubuntu version you should actually pick

For most Nginx/MySQL setups, pick an Ubuntu LTS (e.g., 20.04/22.04). The advantage isn’t “compatibility in theory”—it’s fewer package dependency surprises when you install MySQL and update Nginx security settings.

Storage: don’t ignore it

If you plan to keep production data on the same server (not separate managed DB), choose disk performance carefully. MySQL performance often collapses when disk IOPS is insufficient. If you can only afford one improvement, prioritize stable disk + adequate RAM.

Alibaba Cloud 3) Identity verification (KYC) and enterprise verification: what usually blocks users

You don’t need KYC knowledge to deploy Nginx, but you do need it to keep the account active and avoid sudden billing/risk blocks. Here are the issues I’ve seen most frequently when users try to buy ECS + add networking/IP.

Common KYC failure reasons (practical patterns)

  • Mismatch between account name and ID documents: even small differences in romanization or middle name formatting can trigger re-check.
  • Using a personal phone/email that doesn’t match the identity: Alibaba Cloud account risk systems may require consistent contact information.
  • Document glare/low quality: photos with shadows or blurred IDs are a top reason for resubmission loops.
  • Verification timed too close to provisioning: in some cases, users submit verification while actively provisioning and then hit limits on certain operations until the review completes.

Enterprise verification (when you need it)

If you’re buying for a company, you’ll likely need enterprise verification for smoother billing management and for long-term usage. Typical triggers: you need invoicing requirements, procurement controls, or you want to avoid personal-account limits when expanding resources.

Scenario: “I created the instance but can’t change billing options later”

This happens when your account is partially verified or your billing settings weren’t fully enabled. Fix: complete KYC, ensure the billing method supports recurring payments, then revisit instance renewal/changes.

4) Payment methods and renewal mechanics: what to use to avoid surprise downtime

People usually focus on “how to pay” and ignore “what happens next month.” For an Nginx + MySQL server, the most painful failure is not the initial purchase—it’s renewal failure.

Choosing between common payment behaviors

  • Card/bank payments: convenient, but subject to bank risk rules. If your bank blocks international transactions or e-commerce rules, renewals fail.
  • Local transfer / third-party top-ups (where available): can be more stable if your account needs manual top-up, but you must monitor balances.
  • Auto-renew setup: only works reliably if the billing method is valid for recurring charges at the renewal date.

Operational recommendation

Enable auto-renew for the instance and related components you can, and set at least one proactive reminder in your calendar 3–7 days before renewal. If you’ve changed payment methods recently, update auto-renew immediately—don’t assume Alibaba Cloud will keep the old payment authorization.

5) Network and security group setup (the part that determines if your ports are reachable)

You’ll configure Nginx to listen on 80/443 and MySQL on 3306. But the server will still look “broken” if your security group blocks inbound traffic or your cloud firewall rules are missing.

Recommended inbound rules for a typical Ubuntu Nginx + MySQL

  • SSH (22/tcp): allow only your IP (or VPN IP range). Avoid 0.0.0.0/0 unless you enjoy bot attacks and lockouts.
  • HTTP (80/tcp): allow 0.0.0.0/0 if you expect public web access.
  • HTTPS (443/tcp): allow 0.0.0.0/0.
  • MySQL (3306/tcp): do not open it to the internet for a typical deployment. Allow access only from the web server’s private IP (if same instance, skip inbound entirely) or from a restricted admin IP/VPN.

If MySQL is exposed to the public internet, even with a strong password, automated scanning and brute attempts can trigger risk-control alarms and CPU load spikes. That’s where “setup success” turns into “server unstable.”

6) Ubuntu provisioning steps: SSH in and harden before installing services

After the ECS instance is running, SSH in and do minimal hardening first. This reduces later debugging time when Nginx/MySQL appear to “install fine” but behave insecurely or fail due to config conflicts.

Alibaba Cloud Initial login

# Replace with your ECS public IP and the proper username/image default
ssh ubuntu@YOUR_ECS_PUBLIC_IP

Update packages and set timezone

sudo apt-get update -y
sudo apt-get upgrade -y
sudo timedatectl set-timezone Asia/Shanghai

Install basic tools

sudo apt-get install -y curl vim ufw ca-certificates

Firewall policy suggestion (UFW)

If you already manage security via Alibaba Cloud security groups, UFW is still useful as an extra layer. I usually keep UFW enabled for defense-in-depth. 

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp   # or your SSH port
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

7) Install and configure Nginx on Ubuntu (with a practical deployment-ready config)

Install Nginx

sudo apt-get install -y nginx
sudo systemctl enable nginx --now
sudo systemctl status nginx --no-pager

Validate HTTP locally

curl -I http://localhost

Create a server block for your domain or IP

Use your actual domain if you’ll add TLS later. If not, start with a default site. 

sudo mkdir -p /var/www/your_site
sudo chown -R $USER:$USER /var/www/your_site
echo "<h1>Nginx is running</h1>" > /var/www/your_site/index.html

sudo vim /etc/nginx/sites-available/your_site

Example config (HTTP):

server {
    listen 80;
    server_name _;

    root /var/www/your_site;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    access_log /var/log/nginx/your_site.access.log;
    error_log  /var/log/nginx/your_site.error.log;
}

sudo ln -s /etc/nginx/sites-available/your_site /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Common Nginx issues that cost time

  • Port conflict: you already have a service on 80/443. Check with sudo ss -lntp.
  • Incorrect root/permissions: 403/404 errors are usually file ownership or missing index.
  • DNS not pointing yet: browser “site not reachable” is often a DNS/route issue, not Nginx.

8) Install MySQL on Ubuntu (pick the right MySQL source to reduce dependency issues)

On Ubuntu, you can install MySQL from OS repositories or via vendor repositories. For most users wanting stability quickly, use the official Ubuntu packages (or the MySQL apt repository if you need a specific version).

Option A: Install from Ubuntu repositories (fastest)

sudo apt-get install -y mysql-server
sudo systemctl enable mysql --now
sudo mysql -u root -p

Run MySQL secure setup

sudo mysql_secure_installation

Create a dedicated database and user

Replace names and passwords with your values.

mysql> CREATE DATABASE appdb CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
mysql> CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'StrongPasswordHere';
mysql> GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'localhost';
mysql> FLUSH PRIVILEGES;
mysql> exit;

Alibaba Cloud Important: don’t grant remote MySQL unless you must

If your app runs on the same server as MySQL, using localhost is safer. If you need remote access, restrict by IP and add firewall rules accordingly.

9) Make MySQL work well for a small VM (configuration you should do early)

The default MySQL settings often work for tiny tests but can be sluggish or unstable under real usage. Do these adjustments based on RAM size.

Find your RAM and set InnoDB buffer pool

free -h

Rule of thumb (VM-level): set innodb_buffer_pool_size to ~25%–40% of total RAM. For 4GB RAM, 1GB–2GB is usually a reasonable starting point.

Edit MySQL configuration

sudo vim /etc/mysql/mysql.conf.d/mysqld.cnf
Add/update: 
[mysqld]
bind-address = 127.0.0.1
innodb_buffer_pool_size = 1024M
innodb_flush_log_at_trx_commit = 1

bind-address = 127.0.0.1 keeps MySQL from listening on the public network interface. This aligns with the security group recommendation to never open 3306 to the internet. 

sudo systemctl restart mysql
sudo ss -lntp | grep 3306

10) Data safety: backups, snapshots, and why MySQL needs a plan even on “small” servers

If you’re deploying quickly, the next real question is: “What if the instance is deleted because renewal fails or I made a mistake?” This is where risk control and billing mechanics connect with your database.

Minimum backup plan (practical)

  • Enable automatic snapshots/backup for the ECS disk if the platform offers it for your plan.
  • For MySQL, schedule mysqldump or logical backups to external storage (or another server) depending on your compliance needs.
  • Test restore occasionally—backups that never restore are a common surprise.

11) TLS/HTTPS on Nginx: avoid the “works on LAN but not for real users” trap

Many users test with HTTP and later enable HTTPS but forget that security groups and firewall must allow 443. Another common issue: certificate issuance fails due to domain DNS not pointing to the instance.

Quick checklist

  • Security group allows 443 inbound.
  • DNS A/AAAA record points to your instance public IP (for domain-based cert issuance).
  • Nginx server_name matches the domain you request.

If you need a fast “production-like” setup

Use Let’s Encrypt (Certbot) or Alibaba Cloud’s certificate integration if you plan to operate at scale. Operationally, the key is aligning DNS, Nginx config, and open ports before you request certificates.

12) Costs: what to expect on Alibaba Cloud (and where people underestimate)

Cost depends on region, instance type, disk size, public IP, and any load balancer/CDN you add. Since you’re setting up Nginx and MySQL on a single Ubuntu ECS, your base cost usually comes from:

  • ECS instance compute hours (or monthly/term pricing depending on purchase model)
  • System disk + data disk storage
  • Public IP (if allocated) and bandwidth egress
  • Any monitoring, backup, snapshot costs

Scenario-based cost comparisons (real procurement mindset)

  • Single VM (ECS) for both Nginx and MySQL: cheapest for pilots; riskier for uptime and recovery if you don’t set backups and renewal reminders.
  • Split web and database across two VMs: slightly higher cost; better isolation (MySQL load won’t directly affect Nginx responsiveness).
  • Managed database (if you decide later): higher unit cost, but operational overhead drops (patching, backups, replication options). In real projects, this often becomes cheaper once you value engineering time.

If you want, tell me your expected traffic (requests/day) and MySQL workload (reads/writes). I can help estimate a safer baseline size to avoid paying for overprovisioning or dealing with throttling later.

13) Common operational failures after setup (and how to diagnose quickly)

Nginx starts but you can’t access the website

  • Cloud security group missing 80/443: verify inbound rules.
  • UFW blocks ports: check sudo ufw status.
  • Wrong server block loaded: run nginx -T | less to verify active config.
  • DNS points elsewhere: test via public IP directly to isolate DNS issues.

MySQL connection errors from the app

  • Bind-address = 127.0.0.1: remote apps can’t connect by design. Use localhost or adjust with strict IP allow rules.
  • User host mismatch: appuser@'localhost' won’t work for remote connections. Create the correct user/host.
  • Firewall/security group blocks 3306: open only if necessary, and restrict to app server IP.

High CPU right after deployment

  • MySQL is overloaded: check top and MySQL slow query log.
  • Port scanning/failed logins: if SSH is open to the world, bots can generate lots of failed attempts.
  • Risk-control triggers from abnormal traffic: don’t expose MySQL publicly; throttle outbound where possible; review ECS logs and security alerts.

14) FAQ (the questions users ask right before clicking “Buy”)

Q1: Do I need KYC completed before I can launch an Ubuntu ECS?

Often you can launch resources after partial account setup, but certain operations and billing/renewal behaviors may be restricted until verification finishes. If you plan to run it long-term, complete KYC first to avoid renewal and risk-control issues later.

Q2: Can I run MySQL on the same VM as Nginx?

Yes for small deployments. It’s common and cost-effective. But ensure you bind MySQL to localhost (or restrict by IP), and set proper backup/renewal reminders because a single VM failure affects both web and database.

Q3: Should I open MySQL to the internet “just for convenience”?

Don’t. Besides security risk, public exposure often leads to heavy scanning attempts and can indirectly cause stability problems. Use localhost-only binding or strict IP allowlisting via security groups/VPN.

Q4: What payment method should I choose to reduce renewal failures?

Choose a method that supports recurring charges reliably in your region and that you can keep funded. If your card/bank is known to block cross-border recurring payments, use a stable top-up method and monitor the balance.

Alibaba Cloud Q5: My instance is running but website is unreachable. What’s the fastest diagnosis?

1) Check Nginx service locally (curl http://localhost).
2) Confirm security group allows 80/443 from your IP range (or everywhere for public).
3) Try hitting the public IP directly (bypass DNS).
4) Review UFW status.

Q6: Do I need enterprise verification to run a small project?

If it’s personal or a prototype, personal KYC may be enough. If you need invoicing, procurement, or long-term organization billing governance, enterprise verification becomes practical.

15) If you tell me these 6 details, I’ll tailor the exact commands and security settings

Alibaba Cloud To avoid “works in guide, fails in your environment,” reply with:

  • Your Ubuntu version preference (20.04/22.04)
  • Your Alibaba Cloud region
  • Alibaba Cloud Traffic expectation (requests/day) and whether it’s public
  • Database workload (approx reads/writes/day)
  • Do you need remote DB access (yes/no)
  • Your payment approach preference (auto-renew vs manual top-up)

Then I can suggest the best ECS sizing, security group rules, MySQL bind/address settings, and a cost-aware backup plan for your case.

TelegramContact Us
CS ID
@cloudcup
Contact
TelegramSupport
CS ID
@yanhuacloud
Contact