You want a lean machine
You downloaded the Fedora Server ISO, booted it, and now you are staring at a text-based installer. You need a base that boots fast, consumes minimal RAM, and gives you full control over every running service. You do not want a desktop environment guessing what you might need later. You want a command-line-only system that stays quiet until you explicitly ask it to do something.
What the minimal profile actually does
A minimal install strips the default Fedora Server profile down to its absolute essentials. Think of it like buying a house with just the foundation, walls, and plumbing. You get systemd, NetworkManager, sshd, dnf, and a handful of core utilities. Everything else is optional. The installer does not pre-enable databases, web servers, or monitoring agents. It hands you a clean slate and expects you to add services deliberately. This reduces the attack surface and keeps background processes from competing for CPU cycles.
Boot the Fedora Server ISO from a USB drive or virtual machine. The Anaconda installer loads into a text interface. Navigate to the Software Selection screen. Choose Minimal Install as the Base Environment. Leave all add-on groups unchecked. Complete disk partitioning, network setup, and user creation. Reboot when prompted. The system drops you into a multi-user.target shell with no graphical display manager running.
Reboot before you debug. Half the time the symptom is gone.
Configure the network
Fedora uses NetworkManager for everything. Even servers. The default connection profile usually starts with DHCP. If you need a static IP for a production service, you modify the existing connection profile rather than creating a new one. NetworkManager stores connection definitions in /etc/NetworkManager/system-connections/. You interact with them through nmcli.
Here is how to assign a static IPv4 address to your primary wired interface.
# List active connections to find the exact profile name
nmcli connection show
# Apply static IP, gateway, and DNS to the existing profile
nmcli connection modify "Wired connection 1" \
ipv4.addresses 192.168.1.10/24 \
ipv4.gateway 192.168.1.1 \
ipv4.dns "8.8.8.8 1.1.1.1" \
ipv4.method manual
# Reactivate the connection to apply the new configuration
nmcli connection up "Wired connection 1"
NetworkManager validates the syntax immediately. If the gateway is unreachable or the subnet mask conflicts with your router, the command returns a clear error. Do not guess the profile name. Copy it exactly from the nmcli connection show output.
Always verify the interface state after applying changes. A silent failure leaves you disconnected.
Lock down SSH
The SSH daemon is installed and enabled by default on Fedora Server. It listens on port 22 and accepts both password and key authentication. You need to restrict access before exposing the machine to any network beyond your local lab. The configuration file lives in /etc/ssh/sshd_config. Files in /etc/ are user-modified. Files in /usr/lib/ ship with the package. Edit /etc/. Never edit /usr/lib/.
Here is how to disable root login and password authentication while keeping key-based access intact.
# Replace commented default with explicit denial for root
sudo sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
# Replace commented default with explicit denial for passwords
sudo sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
# Apply the new configuration without dropping existing sessions
sudo systemctl reload sshd
Reload the daemon instead of restarting it. A restart terminates active connections. A reload reads the new config and keeps existing sessions alive. Keep your current terminal open until you verify a new connection works.
Test the new session from a second terminal before closing your current one. Locked out sysadmins make poor heroes.
Add services and manage updates
You install software with dnf. The package manager resolves dependencies, handles repository metadata, and updates the system database in one transaction. Fedora's release cadence is six months. The N-2 release goes end-of-life when N+1 ships. Plan upgrades on that cycle. dnf upgrade --refresh is the normal weekly maintenance command. dnf system-upgrade is for crossing major Fedora releases. They are different commands. Do not conflate them.
Here is how to install a web server and configure the firewall to allow traffic.
# Install the Apache HTTP server package
sudo dnf install httpd -y
# Enable the service to start at boot and start it immediately
sudo systemctl enable --now httpd
# Add HTTP and HTTPS to the persistent firewall rules
sudo firewall-cmd --permanent --add-service=http --add-service=https
# Apply the persistent rules to the active runtime firewall
sudo firewall-cmd --reload
Run firewall-cmd --reload after every rule change. Otherwise the runtime config and the persistent config diverge. SELinux denials show up in journalctl -t setroubleshoot with a one-line summary. Read those before disabling SELinux. Both firewallld and SELinux are active and enforcing after a minimal install. Do not disable them. Use semanage or audit2allow to resolve denials that arise as you add services.
Trust the package manager. Manual file edits drift, snapshots stay.
Verify the baseline
You need to confirm the system matches the minimal profile before deploying it. Check the default systemd target, count the installed packages, and verify that only essential services are running.
Here is how to audit the current system state.
# Confirm the system boots to a command-line target
systemctl get-default
# Count installed RPM packages to verify a lean footprint
rpm -qa | wc -l
# List active services to ensure no unexpected daemons are running
systemctl list-units --type=service --state=active
A minimal install typically ships with 300 to 450 packages. If the count jumps above 600, you likely selected an add-on group during installation or installed a desktop environment accidentally. Check the output of systemctl get-default. It should return multi-user.target. If it returns graphical.target, you are not running a minimal profile.
Run journalctl -xe first. Read the actual error before guessing.
Common pitfalls
The dnf upgrade command will refuse to proceed and print Error: Transaction test error: package python3-3.12.x conflicts with python3-3.13.y. The conflict is intentional. Read the next paragraph before forcing. Fedora uses modular Python packaging. Forcing a resolution breaks the package database. Run dnf distro-sync to align packages with the repository metadata instead.
If you see [FAILED] Failed to start NetworkManager.service during boot, your network configuration probably references a missing interface name. Check /etc/NetworkManager/NetworkManager.conf and verify the device exists with ip link.
Disabling SELinux with setenforce 0 masks the real problem. The denial is usually a missing file context or a port that needs labeling. Use restorecon -Rv /path/to/data to fix context drift. Use semanage port -a -t http_port_t -p tcp 8080 to label non-standard ports.
Do not install gnome-shell or kde-plasma on a minimal server. The desktop environment pulls in hundreds of dependencies, changes the default target to graphical, and consumes RAM that your application needs. If you need a GUI for occasional administration, install tigervnc-server and run a lightweight window manager. Keep the base lean.
Snapshot the system before the upgrade. Future-you will thank you.
When to choose minimal versus other profiles
Use Minimal Install when you are building a dedicated service host and want to audit every running process. Use Server with GUI when you need remote desktop access or administrative tools that require X11 or Wayland. Use Workstation when you are developing locally and need a full desktop environment with development tools pre-configured. Stick to the default Server profile if you want a balanced baseline with common utilities like vim, curl, and git already present.