Install WordPress on Nginx with a privacy-safe FastCGI cache

WordPress server, Bash, existing sudo administrator.

(
set -euo pipefail
. /etc/os-release
test "$ID" = almalinux
test "$VERSION_ID" = 9.8
test "$(uname -m)" = x86_64
test "$(ps -p 1 -o comm=)" = systemd
sudo python3 - <<'PY'
import os,pathlib,stat
paths=['/var/www/wordpress','/var/cache/nginx/wordpress','/etc/nginx','/etc/php','/etc/php-fpm.d','/var/lib/mysql','/etc/letsencrypt','/etc/academy-wordpress','/etc/php-fpm.conf','/etc/mysql','/etc/my.cnf','/etc/my.cnf.d','/var/lib/letsencrypt']
selected=[pathlib.Path(x)for x in paths[:2]]
if any(not x.is_absolute()or '..'in x.parts or x.parts[1:2]in[('home',),('root',)] for x in selected):raise SystemExit('Choose absolute system paths; STOP')
if selected[0]==selected[1] or any(x in y.parents for x,y in (selected,selected[::-1])):raise SystemExit('Paths must be disjoint')
for x in selected:
 for raw in paths[2:]:
  y=pathlib.Path(raw)
  if x==y or x in y.parents or y in x.parents:raise SystemExit('Selected path overlaps reserved state: '+str(x))
for raw in paths:
 p=pathlib.Path(raw)
 if p.exists()or p.is_symlink():raise SystemExit('Existing state: '+raw)
 for a in p.parents:
  try:s=a.lstat()
  except FileNotFoundError:continue
  if stat.S_ISLNK(s.st_mode)or not stat.S_ISDIR(s.st_mode)or s.st_uid!=0 or s.st_mode&0o022:raise SystemExit('Unsafe parent: '+str(a))
PY
if getent passwd wp-php || getent group wp-php; then exit 1; fi
for unit in nginx.service mariadb.service mysql.service php-fpm.service php8.5-fpm.service php8.4-fpm.service php8.3-fpm.service php8.2-fpm.service certbot.service certbot.timer certbot-renew.service certbot-renew.timer; do
  state=$(systemctl show "$unit" -p LoadState --value)
  test "$state" = not-found
done
sudo ss -lntup
getent ahosts blog.example.com
)

WordPress server, Bash, existing sudo administrator.

(
set -euo pipefail
. /etc/os-release
test "$ID" = 'almalinux'
test "$VERSION_ID" = '9.8'
sudo systemctl mask nginx.service mariadb.service php-fpm.service
sudo dnf install -y dnf-plugins-core epel-release
sudo dnf config-manager --set-enabled crb
sudo dnf module enable -y php:8.3 mariadb:10.11
curl_pkg=curl-minimal
if rpm -q curl >/dev/null 2>&1; then curl_pkg=curl; fi
sudo dnf install -y nginx mariadb-server php-fpm php-cli php-mysqlnd php-gd php-mbstring php-xml php-intl php-pecl-zip "$curl_pkg" ca-certificates tar rsync openssl nano certbot python3 shadow-utils policycoreutils-python-utils audit
sudo test ! -e /etc/my.cnf.d/zz-academy-wordpress.cnf
sudo test ! -L /etc/my.cnf.d/zz-academy-wordpress.cnf
printf '[mysqld]\nbind-address=127.0.0.1\n' | sudo tee /etc/my.cnf.d/zz-academy-wordpress.cnf >/dev/null
sudo systemctl unmask mariadb.service
sudo systemctl enable --now mariadb.service
php -v
mariadb --version
nginx -v
rpm -q nginx mariadb-server php-fpm certbot
sudo ss -lntp 'sport = :3306'
)

Fresh dedicated Linux VM, existing sudo administrator.

(
set -euo pipefail
sudo test ! -e /etc/nginx/nginx.conf.academy-before
sudo test ! -L /etc/nginx/nginx.conf.academy-before
sudo cp -a /etc/nginx/nginx.conf /etc/nginx/nginx.conf.academy-before
sudo install -d -o root -g root -m 0755 /etc/nginx/conf.d
sudo nano /etc/nginx/nginx.conf
)

Fresh dedicated Linux VM, existing sudo administrator.

user nginx;
worker_processes auto;
pid /run/nginx.pid;
events { worker_connections 1024; }
http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    sendfile on;
    keepalive_timeout 65;
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;
    include /etc/nginx/conf.d/*.conf;
}

MariaDB administrator console opened in the previous panel, not Bash.

CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wp_site'@'localhost' IDENTIFIED BY 'REPLACE_WITH_A_LONG_RANDOM_PASSWORD';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, ALTER, INDEX
  ON wordpress.* TO 'wp_site'@'localhost';
SHOW GRANTS FOR 'wp_site'@'localhost';
EXIT;