完成了重大升级：
硬件：印度->广州
软件：Centos 6->Centos 7；Apache->Nginx；PHP 5->PHP 7；Mysql 5->MariaDB 10
还上了Redis，HTTPS

Contents

在Centos 7搭好LEMP

MariaDB

（参考了这里和这里）

添加文件：

# MariaDB 10.1 CentOS repository list - created 2017-02-11 13:31 UTC
# http://downloads.mariadb.org/mariadb/repositories/
[mariadb]
name = MariaDB
baseurl = http://yum.mariadb.org/10.1/centos7-amd64
gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB
gpgcheck=1

# MariaDB 10.1 CentOS repository list - created 2017-02-11 13:31 UTC

# http://downloads.mariadb.org/mariadb/repositories/

[mariadb]

name = MariaDB

baseurl = http://yum.mariadb.org/10.1/centos7-amd64

gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB

gpgcheck=1

执行以下命令

# 安装
yum update
yum install MariaDB-server MariaDB-client
# 打开
systemctl start mariadb
# 初始化（一路选yes即可）
mysql_secure_installation
# 设置开机自动启动
systemctl enable mariadb.service

# 安装

yum update

yum install MariaDB-server MariaDB-client

# 打开

systemctl start mariadb

# 初始化（一路选yes即可）

mysql_secure_installation

# 设置开机自动启动

systemctl enable mariadb.service

通过 mysql -u root -p进入mysql后，执行以下命令

# 创建数据库供wordpress使用
CREATE DATABASE wordpress;
# 创建用户供wordpress使用（自觉改wordpressuser和password）
CREATE USER wordpressuser@localhost IDENTIFIED BY 'password';
# 授予权限（自觉改wordpressuser和password）
GRANT ALL PRIVILEGES ON wordpress.* TO wordpressuser@localhost IDENTIFIED BY 'password';
# 刷新
FLUSH PRIVILEGES;
# 退出
exit

# 创建数据库供wordpress使用

CREATE DATABASE wordpress;

# 创建用户供wordpress使用（自觉改wordpressuser和password）

CREATE USER wordpressuser@localhost IDENTIFIED BY 'password';

# 授予权限（自觉改wordpressuser和password）

GRANT ALL PRIVILEGES ON wordpress.* TO wordpressuser@localhost IDENTIFIED BY 'password';

# 刷新

FLUSH PRIVILEGES;

# 退出

exit

PHP

首先参考这里安装好PHP 7
然后为你的网站创建专属用户（安全第一

# 用website用户组管理网站群
groupadd website
# 用site-blog用户管理博客
adduser -g website site-blog

# 用website用户组管理网站群

groupadd website

# 用site-blog用户管理博客

adduser -g website site-blog

然后为你的网站创建专属php pool
先把默认的复制过去
cp /usr/local/php/etc/php-fpm.d/www.conf.default /usr/local/php/etc/php-fpm.d/blog.conf
然后设置好 /usr/local/php/etc/php-fpm.d/blog.conf里的以下几项

[blog]
user = website
group = site-blog
listen = /var/run/php-fpm_blog.sock
listen.owner = nobody
listen.group = nobody
listen.mode = 0660

[blog]

user = website

group = site-blog

listen = /var/run/php-fpm_blog.sock

listen.owner = nobody

listen.group = nobody

listen.mode = 0660

令php与mariaDB对接好，设置好 /etc/php.ini里的以下两项

pdo_mysql.default_socket= /var/lib/mysql/mysql.sock
mysqli.default_socket = /var/lib/mysql/mysql.sock

1 2	pdo_mysql.default_socket= /var/lib/mysql/mysql.sock mysqli.default_socket = /var/lib/mysql/mysql.sock

最后记得 php-fpm start

Redis

（参考了这里、这里、这里和这里）

首先是安装

wget http://download.redis.io/redis-stable.tar.gz
tar xvzf redis-stable.tar.gz
cd redis-stable
make
sudo make install
sudo cp utils/redis_init_script /etc/init.d/redis_6379
sudo mkdir -P /var/lib/redis/6379
sudo mkdir /etc/redis
sudo cp redis.conf /etc/redis/6379.conf

wget http://download.redis.io/redis-stable.tar.gz

tar xvzf redis-stable.tar.gz

cd redis-stable

make

sudo make install

sudo cp utils/redis_init_script /etc/init.d/redis_6379

sudo mkdir -P /var/lib/redis/6379

sudo mkdir /etc/redis

sudo cp redis.conf /etc/redis/6379.conf

然后是配置
设置好 /etc/redis/6379.conf里的以下几项

bind 127.0.0.1
port 6379
daemonize yes
pidfile /var/run/redis_6379.pid
dir /var/lib/redis/6379
logfile "/var/log/redis_6379.log"
maxmemory 50mb
maxmemory-policy allkeys-lru

bind 127.0.0.1

port 6379

daemonize yes

pidfile /var/run/redis_6379.pid

dir /var/lib/redis/6379

logfile "/var/log/redis_6379.log"

maxmemory 50mb

maxmemory-policy allkeys-lru

在 /etc/sysctl.conf里添加

vm.overcommit_memory = 1
net.core.somaxconn = 512

1 2	vm.overcommit_memory = 1 net.core.somaxconn = 512

之后要令Redis开机自动启动
先创建两个文件

#!/bin/bash
echo never > /sys/kernel/mm/transparent_hugepage/enabled

1 2	#!/bin/bash echo never > /sys/kernel/mm/transparent_hugepage/enabled

[Unit]
Description=Redis on port 6379
After=network.target

[Service]
Type=forking
ExecStartPre=/etc/init.d/redis_pre.sh
ExecStart=/etc/init.d/redis_6379 start
ExecStop=/etc/init.d/redis_6379 stop
Restart=on-failure

[Install]
WantedBy=multi-user.target

[Unit]

Description=Redis on port 6379

After=network.target

[Service]

Type=forking

ExecStartPre=/etc/init.d/redis_pre.sh

ExecStart=/etc/init.d/redis_6379 start

ExecStop=/etc/init.d/redis_6379 stop

Restart=on-failure

[Install]

WantedBy=multi-user.target

最后记得

systemctl enable redis_6379.service
systemctl start redis_6379.service

1 2	systemctl enable redis_6379.service systemctl start redis_6379.service

Nginx

首先参考这里安装好Nginx
然后是一大波配置
（参考了这里和这里）

user  nobody;
worker_processes  1;

error_log  logs/error.log;

pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    gzip  on;

    client_max_body_size 13m;
    index              index.php index.html index.htm;

    include sites-enabled/*;
}

user nobody;

worker_processes 1;

error_log logs/error.log;

pid logs/nginx.pid;

events {

worker_connections 1024;

}

http {

include mime.types;

default_type application/octet-stream;

log_format main '$remote_addr - $remote_user [$time_local] "$request" '

'$status $body_bytes_sent "$http_referer" '

'"$http_user_agent" "$http_x_forwarded_for"';

access_log logs/access.log main;

sendfile on;

#tcp_nopush on;

keepalive_timeout 65;

gzip on;

client_max_body_size 13m;

index index.php index.html index.htm;

include sites-enabled/*;

}

#move next 4 lines to /etc/nginx/nginx.conf if you want to use fastcgi_cache across many sites 
#fastcgi_cache_path /var/run/nginx-cache levels=1:2 keys_zone=WORDPRESS:100m inactive=60m;
#fastcgi_cache_key "$scheme$request_method$host$request_uri";
#fastcgi_cache_use_stale error timeout invalid_header http_500;
#fastcgi_ignore_headers Cache-Control Expires Set-Cookie;

server {
    listen 80;
    server_name blog.goushi.me goushi.me www.goushi.me;
    root /var/www/wordpress;

    ssl_certificate /etc/letsencrypt/live/goushi.me/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/goushi.me/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/goushi.me/chain.pem;

    include global/ssl.conf;

    include global/restrictions.conf;
 
    #include global/wordpress.conf;
    #include global/wordpress_with_fastcgi_cache.conf;
    include global/wordpress_with_redis_cache.conf;
}

#move next 4 lines to /etc/nginx/nginx.conf if you want to use fastcgi_cache across many sites

#fastcgi_cache_path /var/run/nginx-cache levels=1:2 keys_zone=WORDPRESS:100m inactive=60m;

#fastcgi_cache_key "$scheme$request_method$host$request_uri";

#fastcgi_cache_use_stale error timeout invalid_header http_500;

#fastcgi_ignore_headers Cache-Control Expires Set-Cookie;

server {

listen 80;

server_name blog.goushi.me goushi.me www.goushi.me;

root /var/www/wordpress;

ssl_certificate /etc/letsencrypt/live/goushi.me/fullchain.pem;

ssl_certificate_key /etc/letsencrypt/live/goushi.me/privkey.pem;

ssl_trusted_certificate /etc/letsencrypt/live/goushi.me/chain.pem;

include global/ssl.conf;

include global/restrictions.conf;

#include global/wordpress.conf;

#include global/wordpress_with_fastcgi_cache.conf;

include global/wordpress_with_redis_cache.conf;

}

# POST requests and urls with a query string should always go to PHP
if ($request_method = POST) {
	set $skip_cache 1;
}   
if ($query_string != "") {
	set $skip_cache 1;
}   

# Don't cache uris containing the following segments
if ($request_uri ~* "/wp-admin/|/xmlrpc.php|wp-.*.php|/feed/|index.php|sitemap(_index)?.xml") {
	set $skip_cache 1;
}   

# Don't use the cache for logged in users or recent commenters
if ($http_cookie ~* "comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_no_cache|wordpress_logged_in") {
	set $skip_cache 1;
}

# POST requests and urls with a query string should always go to PHP

if ($request_method = POST) {

set $skip_cache 1;

}

if ($query_string != "") {

set $skip_cache 1;

}

# Don't cache uris containing the following segments

if ($request_uri ~* "/wp-admin/|/xmlrpc.php|wp-.*.php|/feed/|index.php|sitemap(_index)?.xml") {

set $skip_cache 1;

}

# Don't use the cache for logged in users or recent commenters

if ($http_cookie ~* "comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_no_cache|wordpress_logged_in") {

set $skip_cache 1;

}

index index.php;

include 	global/wordpress_set_skip_cache.conf;

location / {
    # This is cool because no php is touched for static content.
    # include the "?$args" part so non-default permalinks doesn't break when using query string
    try_files $uri $uri/ /index.php?$args;
}

location /redis-fetch {
    internal  ;
    set  $redis_key $args;
    redis_pass  127.0.0.1:6379;
}

location /redis-store {
    internal  ;
    set_unescape_uri $key $arg_key ;
    redis2_query  set $key $echo_request_body;
    redis2_query expire $key 14400;
    redis2_pass  127.0.0.1:6379;
} 

location ~ \.php$ {
    try_files $uri = 404;
    fastcgi_hide_header X-Powered-By;

    set $key "blog-cache:$scheme$request_method$host$request_uri";
    srcache_fetch_skip $skip_cache;
    srcache_store_skip $skip_cache;
    srcache_response_cache_control off;
    set_escape_uri $escaped_key $key;
    srcache_fetch GET /redis-fetch $key;
    srcache_store PUT /redis-store key=$escaped_key;
    more_set_headers 'X-Cache $srcache_fetch_status';
    more_set_headers 'X-Cache-2 $srcache_store_status';

    include        fastcgi.conf;
    fastcgi_pass unix:/var/run/php-fpm_blog.sock;
}

# Directives to send expires headers and turn off 404 error logging.
location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
    access_log off; 
    log_not_found off; 
    expires max;
}

index index.php;

include global/wordpress_set_skip_cache.conf;

location / {

# This is cool because no php is touched for static content.

# include the "?$args" part so non-default permalinks doesn't break when using query string

try_files $uri $uri/ /index.php?$args;

}

location /redis-fetch {

internal ;

set $redis_key $args;

redis_pass 127.0.0.1:6379;

}

location /redis-store {

internal ;

set_unescape_uri $key $arg_key ;

redis2_query set $key $echo_request_body;

redis2_query expire $key 14400;

redis2_pass 127.0.0.1:6379;

}

location ~ \.php$ {

try_files $uri = 404;

fastcgi_hide_header X-Powered-By;

set $key "blog-cache:$scheme$request_method$host$request_uri";

srcache_fetch_skip $skip_cache;

srcache_store_skip $skip_cache;

srcache_response_cache_control off;

set_escape_uri $escaped_key $key;

srcache_fetch GET /redis-fetch $key;

srcache_store PUT /redis-store key=$escaped_key;

more_set_headers 'X-Cache $srcache_fetch_status';

more_set_headers 'X-Cache-2 $srcache_store_status';

include fastcgi.conf;

fastcgi_pass unix:/var/run/php-fpm_blog.sock;

}

# Directives to send expires headers and turn off 404 error logging.

location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {

access_log off;

log_not_found off;

expires max;

}

listen 443  ssl http2;

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 20m;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:!ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:!RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;
ssl_dhparam /etc/ssl/certs/dhparam.pem;

location ^~ /.well-known/acme-challenge/ {
    default_type "text/plain";
    root     /usr/share/nginx/certbot;
}

location = /.well-known/acme-challenge/ {
    return 404;
}

listen 443 ssl http2;

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

ssl_session_cache shared:SSL:10m;

ssl_session_timeout 20m;

ssl_prefer_server_ciphers on;

ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:!ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:!RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;

ssl_dhparam /etc/ssl/certs/dhparam.pem;

location ^~ /.well-known/acme-challenge/ {

default_type "text/plain";

root /usr/share/nginx/certbot;

}

location = /.well-known/acme-challenge/ {

return 404;

}

# Global restrictions configuration file.
# Designed to be included in any server {} block.
location = /favicon.ico {
	log_not_found off;
	access_log off;
}

location = /robots.txt {
	allow all;
	log_not_found off;
	access_log off;
}

# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
# Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban)

#location ~ /\. {
#	deny all;
#}

# Deny access to any files with a .php extension in the uploads directory
# Works in sub-directory installs and also in multisite network
# Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban)
location ~* /(?:uploads|files)/.*\.php$ {
	deny all;
}

# Global restrictions configuration file.

# Designed to be included in any server {} block.

location = /favicon.ico {

log_not_found off;

access_log off;

}

location = /robots.txt {

allow all;

log_not_found off;

access_log off;

}

# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).

# Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban)

#location ~ /\. {

# deny all;

# Deny access to any files with a .php extension in the uploads directory

# Works in sub-directory installs and also in multisite network

# Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban)

location ~* /(?:uploads|files)/.*\.php$ {

deny all;

}

最后记得 nginx -t && nginx -s reload

迁移网站

首先用 rsync命令把原服务器里的wordpress目录迁移到新服务器的 /var/www/里
（目录位置符合Nginx的配置文件就好
或者如果你是新建网站，就把下载下来的wordpress压缩包解压到 /var/www/里）
然后按照这里的命令转移数据库
（或者如果你是新建网站，就可以直接跳过这步）

诟屍

关于本站的重建

在Centos 7搭好LEMP

MariaDB

PHP

Redis

Nginx

迁移网站

Related

Leave a Reply Cancel reply

April 2024
S	M	T	W	T	F	S
« Jun
	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30