Debian, 安装lnmp及配置多PHP实例记录

By | 2023-10-13
59 Comments

服务器环境为Linode预置的Debian 11，因为众所周知的原因。手工安装和配置LNMP( Linux, nginx, MySQL, php-fpm, memcached)

安装

先决条件
#创建用户和分组及wwwroot目录
groupadd www && useradd -M -s /sbin/nologin -g www www
mkdir -p /home/wwwroot/

NGINX的安装

NGINX官方安装方法
# 导入官方 nginx 签名密钥，以便 apt 可以验证包的真实性
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null

# 验证下载的文件是否包含正确的密钥, 输出应包含完整指纹, 如果指纹不同，请删除该文件
mkdir -p ~/.gnupg
chmod 700 ~/.gnupg
gpg --dry-run --quiet --no-keyring --import --import-options import-show /usr/share/keyrings/nginx-archive-keyring.gpg

# 使用稳定包
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/debian `lsb_release -cs` nginx" | sudo tee /etc/apt/sources.list.d/nginx.list

# 设置apt优先使用官方包
echo -e "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900\n" | sudo tee /etc/apt/preferences.d/99nginx

# 安装
apt update
apt install nginx -y

# 查看nginx 版本
nginx -v
# 检查 Nginx 服务的状态
systemctl status nginx

安装php-fpm

# 导入 Sury PHP 存储库的 Key
curl -fsSL https://packages.sury.org/php/apt.gpg | sudo gpg --dearmor -o /usr/share/keyrings/php-archive-keyring.gpg

# 添加 PHP 源到 sources.list (Trixie 代号)
echo "deb [signed-by=/usr/share/keyrings/php-archive-keyring.gpg] https://packages.sury.org/php/ trixie main" | sudo tee /etc/apt/sources.list.d/php.list

apt update

# 在apt cache中搜索以php8开头的安装包
apt-cache search php8

# 安装php-fpm
PHP_INS_VERSION="8.5"
apt install -y \
php$PHP_INS_VERSION-fpm \
php$PHP_INS_VERSION-cli \
php$PHP_INS_VERSION-mysql \
php$PHP_INS_VERSION-curl \
php$PHP_INS_VERSION-gd \
php$PHP_INS_VERSION-mbstring \
php$PHP_INS_VERSION-xml \
php$PHP_INS_VERSION-zip \
php$PHP_INS_VERSION-bcmath \
php$PHP_INS_VERSION-imagick \
php$PHP_INS_VERSION-memcached \
php$PHP_INS_VERSION-apcu

#查看服务状态
systemctl status php$PHP_INS_VERSION-fpm.service

安装MySQL及优化

Bash
# 来自mysql官方步骤 https://dev.mysql.com/doc/mysql-apt-repo-quick-guide/en/
# 下载官方deb包 版本查看: https://dev.mysql.com/downloads/repo/apt/
MYSQL_DEB="mysql-apt-config_0.8.36-1_all.deb"
wget https://dev.mysql.com/get/$MYSQL_DEB

# 安装存储库
dpkg -i $MYSQL_DEB

# 更新apt
apt update && apt upgrade

# 搜索
apt search --names-only ^mysql

# 安装mysql
apt install mysql-server -y

# 检查状态
systemctl status mysql

# 查看版本
mysql --version

# 安全相关初始化设置
mysql_secure_installation

# 优化mysql 配置文件
touch /home/wwwroot/mysql_error.log && chown mysql:mysql /home/wwwroot/mysql_error.log
touch /home/wwwroot/mysql_slow.log && chown mysql:mysql /home/wwwroot/mysql_slow.log
echo "[mysqld]" >> /etc/mysql/my.cnf
echo 'log-error	= /home/wwwroot/mysql_error.log' >> /etc/mysql/my.cnf
echo 'innodb_buffer_pool_size = 1G' >> /etc/mysql/my.cnf
echo 'slow_query_log = 1' >> /etc/mysql/my.cnf
echo 'slow_query_log_file = /home/wwwroot/mysql_slow.log' >> /etc/mysql/my.cnf
echo 'long_query_time = 5' >> /etc/mysql/my.cnf
echo 'log_timestamps = SYSTEM' >> /etc/mysql/my.cnf
echo "default-time-zone = '+8:00'" >> /etc/mysql/my.cnf

# 优化mysql.service
sed -i 's/LimitNOFILE = 10000/#LimitNOFILE = 10000/g' /usr/lib/systemd/system/mysql.service
systemctl daemon-reload
systemctl restart mysql && systemctl status mysql

# 登录 MySQL 并查看mysql 身份验证方式
mysql -u root -p

mysql> SELECT user,authentication_string,plugin,host FROM mysql.user;
# 修改mysql 身份验证方式为 caching_sha2_password 
mysql> ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password BY 'password';
mysql> FLUSH PRIVILEGES;
# 查看 log_bin 变量
mysql> SHOW VARIABLES LIKE 'log_bin';

安装memcached

ShellScript
apt install memcached libmemcached-tools -y
# 检查 memcached 服务的状态
systemctl status memcached
# 查看版本
memcached -V
#验证memcached 监听的端口
ps -ef | grep memcached

配置LNMP

1.php-fpm （开启4个sock或tcp）

ShellScript
# 设置目录和权限
mkdir -p /home/wwwlogs/nginx && chown -R www:www /home/wwwlogs/nginx
mkdir -p /home/wwwlogs/php && chown -R www:www /home/wwwlogs/php
mkdir -p /home/wwwlogs/mysql && chown -R mysql:mysql /home/wwwlogs/mysql
chmod -R 750 /home/wwwlogs/*
chown -R www:www /var/lib/php/sessions


# 使用git 的php-fpm配置文件覆盖原文件(socket)
mv /etc/php/8.5/fpm/php.ini /etc/php/8.5/fpm/php.ini.backup
cp /root/lnmp/php/php.ini /etc/php/8.5/fpm/php.ini
mv /etc/php/8.5/fpm/php-fpm.conf /etc/php/8.5/fpm/php-fpm.conf.backup
cp /root/lnmp/php/php-fpm.conf.socket /etc/php/8.5/fpm/php-fpm.conf


# 删除php-fpm服务文件，复制git service文件并启用
systemctl list-units --type=service | grep php
systemctl stop php8.3-fpm.service
systemctl disable php8.3-fpm.service
mv /usr/lib/systemd/system/php8.3-fpm.service /root/php8.3-fpm.service.backup
cp /root/lnmp/php/php-fpm.service /usr/lib/systemd/system/php-fpm.service
systemctl daemon-reload
systemctl enable php-fpm.service
systemctl start php-fpm.service && systemctl status php-fpm.service

# 列出服务
systemctl list-units --type=service | grep php

2. 配置NGINX及phpmyadmin

Bash
# 备份原nginx配置文件，复制git的nginx配置文件并启用
mkdir -p /root/nginx_backup && mv /etc/nginx/* /root/nginx_backup/
cp -r /root/lnmp/nginx/* /etc/nginx/
touch /home/wwwroot/nginx_error.log && chown www:www /home/wwwroot/nginx_error.log
chown -R www:www /home/wwwroot/

# 验证配置文件
sudo systemctl stop nginx
nginx -t
sudo systemctl start nginx && sudo systemctl status nginx


# 修改phpmyadmin版本号(https://github.com/phpmyadmin/phpmyadmin/releases), 下载到default目录中

PYADMIN=5.2.2
wget https://files.phpmyadmin.net/phpMyAdmin/$PYADMIN/phpMyAdmin-$PYADMIN-all-languages.zip
unzip -q phpMyAdmin-$PYADMIN-all-languages.zip -d /home/wwwroot/default/
mv /home/wwwroot/default/phpMyAdmin-$PYADMIN-all-languages /home/wwwroot/default/phpmyadmin

# phpmyadmin 配置文件修改
sed -e "s|cfg\['blowfish_secret'\] = ''|cfg['blowfish_secret'] = '$(openssl rand -hex 16)'|" /home/wwwroot/default/phpmyadmin/config.sample.inc.php > /home/wwwroot/default/phpmyadmin/config.inc.php
echo "\$cfg['VersionCheck'] = false;" >> /home/wwwroot/default/phpmyadmin/config.inc.php
echo "\$cfg['ZeroConf'] = false;" >> /home/wwwroot/default/phpmyadmin/config.inc.php
echo "\$cfg['UploadDir'] = 'upload';" >> /home/wwwroot/default/phpmyadmin/config.inc.php
echo "\$cfg['SaveDir'] = 'save';" >> /home/wwwroot/default/phpmyadmin/config.inc.php

# 创建目录, 赋予权限
mkdir -p /home/wwwroot/default/phpmyadmin/tmp
mkdir -p /home/wwwroot/default/phpmyadmin/upload
mkdir -p /home/wwwroot/default/phpmyadmin/save
chown -R www:www /home/wwwroot/

# 为phpmyadmin添加额外验证
htpasswd -cb /home/wwwroot/default/phpmyadmin/.htpasswd USERNAME PASSWD
cat <<'EOF' >> /etc/nginx/phpmyadmin-auth.conf
location /phpmyadmin/ {
          auth_basic    "Admin-Section";
          auth_basic_user_file /home/wwwroot/default/phpmyadmin/.htpasswd;
          include       enable-php.conf;
        }
EOF
nginx -t
systemctl reload nginx && systemctl status nginx

acme.sh

ShellSession
curl https://get.acme.sh | sh -s email=EMAIL
source ~/.bashrc
acme.sh --upgrade --auto-upgrade
acme.sh --set-default-ca --server letsencrypt
mkdir -p /etc/nginx/vhost
mkdir -p /etc/nginx/ssl
openssl dhparam -out /etc/nginx/ssl/dhparam_1024.pem 1024

新建虚拟主机（https）

Bash
cp /root/lnmp/addvhost /usr/bin/addvhost
chmod +x /usr/bin/addvhost
addvhost

4. APC及Opcached配置

ShellSession
# 下载apc.php并修改密码, 注意your_passwordn改为你的密码
curl -sSL https://raw.githubusercontent.com/krakjoe/apcu/master/apc.php | sed "s/('ADMIN_PASSWORD','password')/('ADMIN_PASSWORD','your_password')/g" > /home/wwwroot/default/apc.php

# 下载opcache-gui
curl -sSL https://raw.githubusercontent.com/amnuts/opcache-gui/master/index.php -o /home/wwwroot/default/opcache.php

修改php.ini

apc.shm_size = 1024M
apc.entries_hint = 65536

Memcached

配置文件: /etc/memcached.conf

# 禁用 UDP
-U 0
# 内存分配256M
-m 256
# 最大项目尺寸
-I 5m
#最大线程数
-t 8
# 空闲超时时间
-o idle_timeout=20

防火墙配置

Bash
# 查看已安装的防火墙软件包
dpkg -l | grep -E 'iptables|nftables|ufw|firewalld'

# 检查 nftables 是否启用
sudo systemctl status nftables

# 检查 ufw 是否启用
sudo systemctl status ufw

# 检查 firewalld 是否启用
sudo systemctl status firewalld

# 使用 ufw
apt install ufw -y
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow http
ufw allow https
ufw enable
ufw status verbose

相关路径

nginx 配置文件目录: /etc/nginx/
php 配置文件目录: /etc/php/8.2/fpm/
mysql 配置文件: /etc/mysql/mysql.cnf
      datadir: /var/lib/mysql/
      socket: /var/run/mysqld/mysqld.sock
memcached 配置文件: /etc/memcached.conf

删除vhost配置文件，移除网站

ShellSession
acme.sh --remove -d example.com
rm -rf /root/.acme.sh/example.com_ecc
rm -rf /etc/nginx/vhost/example.com.conf
rm -rf /etc/nginx/ssl/example.com
chattr -i /home/wwwroot/example.com/.user.ini
mv /home/wwwroot/example.com/ /home/wwwroot/example.com_bak/

systemctl restart nginx

一些命令

# 列出 Debian 上所有用户
cat /etc/passwd | cut -d ':' -f 1

# 仅列出人类用户
cat /etc/passwd | grep -E '(/bin/bash)|(/bin/sh)' | cut -d ':' -f 1

# 查找进程
ps -ef | grep mysql

# 根据进程的 PID 查找已打开的文件和目录
lsof -p <进程ID>

# 上述两个命令结合使用
ps -ef | grep mysql | awk '{print $2}' | xargs -I {} lsof -p {}  

# 查找php服务单元
systemctl list-units --type=service | grep php

# 显示服务日志
journalctl -u mysql

# 列出已启用的服务
systemctl list-unit-files --state=enabled

###### 重新启动LNMP ######
# 重新启动php-fpm 1-4
for i in {1..4}; do systemctl reload php-fpm-$i.service; done
systemctl list-units --type=service --state=running | grep php

# 重新启动 nginx 
systemctl restart nginx.service

# 查看systemctl 配置 /etc/systemd/system.conf
systemctl show

# 查看openssl版本
openssl version

# 查看nginx版本
nginx -v

配置多PHP实例

修改LNMP管理脚本

MySQL 版本 https://dev.mysql.com/downloads/mysql/

NGINX 版本 http://nginx.org/en/download.html

PHP 版本 http://www.php.net/downloads.php

memcached 版本: https://memcached.org/downloads

phpmyadmin 版本: https://www.phpmyadmin.net/downloads/

NGINX官方指引： https://nginx.org/en/linux_packages.html#Debian

php-fpm指引：https://packages.sury.org/php/README.txt

MySQL官方APT 存储库deb包： https://dev.mysql.com/downloads/repo/apt/

moz://a SSL 配置生成器 https://ssl-config.mozilla.org/#server=nginx&version=1.26.3&config=old&openssl=3.0.15&guideline=5.7