Server spec and contract attached, please help review

For servers, I always go for the long-term stability of debian over ubuntu. Ubuntu is great as a desktop OS, but my experience is that debian is the best choice for servers.

While Ubuntu is based on Debian, the two distros have fundamentally different philosophies.

Debian (the stable release), focuses on stability, interoperability and security before anything else. Packages with shared libraries will all work on the same distributed version of that library. If you install the right packages PHP will just work with Apache. This is less the case with Ubuntu, which focuses on new software and user experience before stability and interoperability. Once a stable version of Debian is released, all packages in the distribution are frozen, no new versions of packages are added. If you are running Debian etch, at this point, your packages are roughly 1.5 - 2 year old versions of the various packages. The only exception is for security patches made against the current version of the software. So unlike Drupal there are never new features in security releases.

Debian has a very long release curve. It can take up to 2-3 years for a new version of Debian to be released, and once a new version is released, security support is maintained until the next release (similar to way Drupal 5.x is supported until 7 comes out). This usually leads to something like 4 years of support for a single release. Ubuntu has retrofitted its model with LTS to replicate what Debian already does, but that only guarantees security support and (as far as I understand it) does not reflect the several months of code freeze stability testing that Debian enjoys.

Ubuntu, even the server versions, still installs a ton of packages that the maintainers think you need. With the Debian installer it is really easy to achieve a totally stripped down install, kernel, core-utils, and little else. At which point you pull in only what is needed for the server. As far as I know, you simply cannot install Ubuntu without, for instance, "less" (which I always install anyway). Having less software installed means that there are fewer pieces to fail, and fewer potential security holes.

Also, because we all care about Free Software, Debian has one of the highest standards of what is and isn't Free of any of the major Linux distributions. With its free and non-free classifications, you can install things like flash player, but if you are concerned with using only truly Free software, you can choose to keep you system "pure". Ubuntu does this to some degree as well, however there is the added component of "Ubuntu support", which is funded by Canonical. This is a key distinction. Debian is community centric because its not underwritten by a single corporation. Ubuntu has a great community, and has done tons of work as far as promoting free software adoption (Red Hat never shipped on Dells), but it's ultimately a private venture.

Given the fundamental differences in what you need a desktop and a server to do, Debian is just a better choice. You do not need your server to be running the latest and greatest of every piece of software, including ones that you don't really need the new features for. Most people don't care which point version of the Linux kernel, Apache 2, MySQL 5 or PHP 5 that you are running - just that they are all there and working together reliably. Debian does all of this as part of the way the distro operates, and has done so for longer than most of the F/OSS projects out there have existed. Its entire structure is built to achieve security, stability and interoperability, and that's simply not the way Canonical has structured Ubuntu. I'm not railing on Ubuntu, but Debian has really been a leader in setting gold standards with package management that achieves stability and security.