Debian10手动搭建WEB环境Nginx,SSL,PHP,MySQL

手动搭建，使用apt,apt-get快速安装免编译

安装nginx和php

apt update
apt install openssl nginx-full php-fpm php-mysql -y

创建站点，新建文件

nano example.com.sh

内容如下

#!/bin/bash
# 创建站点目录和默认页面
mkdir /var/www/example.com
chown -R www-data:www-data /var/www/example.com
echo "hello word" > /var/www/example.com/index.html
# 添加nginx配置文件
echo "server {
	listen 80;
	listen [::]:80;
	server_name example.com;
	root /var/www/example.com;
	index index.html;
	# return 301 https://$server_name$request_uri;
} >> /etc/nginx/sites-available/default

把example.com替换成自己的域名

sed -i 's/example.com/自己的域名/' example.com.sh

给予权限并执行

chmod +x example.com.sh
bash example.com.sh
systemctl restart nginx

Certbot申请Let’s Encrypt证书SSL，安装Certbot

apt install certbot -y

获取SSL证书

certbot certonly --webroot -w /var/www/example.com -d example.com --register-unsafely-without-email

输入A同意，即可顺利签发SSL证书,使用SSL证书

如果Certbot续订证书失败，可以手动

systemctl stop nginx
certbot --force-renewal
certbot certonly
certbot renew --dry-run
systemctl start nginx

nginx+php+ssl

echo "server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	server_name example.com;
	root /var/www/example.com;
	index index.html index.htm index.php;
	#php
	location ~ \.php$ {
	include snippets/fastcgi-php.conf;
	fastcgi_pass unix:/run/php/php7.4-fpm.sock;
	}
	ssl on;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
	ssl_certificate      /etc/letsencrypt/live/example.com/fullchain.pem;
	ssl_certificate_key  /etc/letsencrypt/live/example.com/privkey.pem;
} >> /etc/nginx/sites-available/default

nginx反向代理+ssl

echo "server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  server_name example.com;
  location / {
  proxy_pass http://127.0.0.1:45729;
  proxy_redirect off;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }
  ssl on;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
  ssl_certificate      /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key  /etc/letsencrypt/live/example.com/privkey.pem;
} >> /etc/nginx/sites-available/default

把example.com替换成自己的域名

sed -i 's/example.com/自己的域名/' /etc/nginx/sites-available/default
systemctl restart nginx

更新Let’s Encrypt证书

#systemctl stop xray
#sed -i 's/81/80/' /etc/nginx/sites-available/default
systemctl restart nginx
certbot renew
#sed -i 's/80/81/' /etc/nginx/sites-available/default
systemctl restart nginx
#systemctl restart xray

更新软件源

apt update

来更新软件源。

Nginx

这里使用Nginx作为WEB服务器。

安装Nginx

apt install openssl nginx -y

完成安装后可以用

nginx -V

查看到版本号nginx/1.14.2,OpenSSL 1.1.1d及相关文件位置路径等

nginx version: nginx/1.14.2
built with OpenSSL 1.1.1d  10 Sep 2019
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -fdebug-prefix-map=/build/nginx-hfVZV6/nginx-1.14.2=. -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -fPIC' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_xslt_module=dynamic --with-stream=dynamic --with-stream_ssl_module --with-stream_ssl_preread_module --with-mail=dynamic --with-mail_ssl_module --add-dynamic-module=/build/nginx-hfVZV6/nginx-1.14.2/debian/modules/http-auth-pam --add-dynamic-module=/build/nginx-hfVZV6/nginx-1.14.2/debian/modules/http-dav-ext --add-dynamic-module=/build/nginx-hfVZV6/nginx-1.14.2/debian/modules/http-echo --add-dynamic-module=/build/nginx-hfVZV6/nginx-1.14.2/debian/modules/http-upstream-fair --add-dynamic-module=/build/nginx-hfVZV6/nginx-1.14.2/debian/modules/http-subs-filter

Nginx安装完成后默认已经启动了，此时访问http://IP就能看到Welcome to nginx!

配置网站

把域名的A记录解析到你的IPv4或者AAAA解析到IPvv6且已经生效

创建站点目录和默认页面

mkdir /var/www/example.com
echo "hello word" > /var/www/example.com/index.html

创建站点配置文件

echo "server {
  listen 80;
  listen [::]:80;
  server_name example.com;
  root /var/www/example.com;
  index index.html index.htm index.php;
}" > /etc/nginx/sites-available/example.com

创建软链接

ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/

使用nginx -t检查配置文件是否有错误，提示ok,successful就可以重启了

systemctl restart nginx

文件位置

/usr/sbin/nginx
#主程序
/etc/nginx
#存放配置文件
/usr/share/nginx
#存放静态文件
/var/log/nginx
#存放日志
/etc/nginx/nginx.conf
#默认nginx配置文件

Nginx管理命令

#启动
systemctl enable nginx
#重启
systemctl restart nginx
#停止
systemctl stop nginx
#也可以使用
/etc/init.d/nginx start # 启动Nginx服务
/etc/init.d/nginx stop # 停止Nginx服务
/etc/init.d/nginx  restart # 重启Nginx服务

Certbot申请Let’s Encrypt证书SSL

在申请Let’s Encrypt证书前确保站点http://example.com能正常访问。

安装Certbot

apt install certbot -y

获取SSL证书

certbot certonly --webroot -w /var/www/example.com -d example.com --register-unsafely-without-email

输入A同意，即可顺利签发SSL证书

这个命令会为域名example.com生成一个证书，使用–webroot模式会在/var/www/example.com站点根目录中创建.well-known文件夹，这个文件夹里面包含了一些验证文件，certbot会通过访问example.com/.well-known/acme-challenge来验证你的域名是否绑定的这个服务器。

SSL证书保存路径

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/example.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/example.com/privkey.pem
   Your cert will expire on 2020-12-09. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

自动更新SSL证书

Let’s Encrypt提供的证书只有90天的有效期，certbot运行

certbot renew

可添加一个cron计划19 4 * * 3 root certbot renew意为每周三的00:19执行定时更新SSL证书计划

泛域名证书

certbot certonly --preferred-challenges dns --manual  -d *.example.com --server https://acme-v02.api.letsencrypt.org/directory

–preferred-challenges dns: 认证方式选择DNS, 泛域名支持DNS
–manual: 手动模式, 这里为了简单就使用手动认证了, 下面会说自动模式的使用.
-d *.bysir.cn: 就是要申请的泛域名了
–server https://acme-v02.api.letsencrypt.org/directory

手动配置TXT记录后回车

使用SSL证书

编辑/etc/nginx/sites-available/example.com站点配置文件修改为

server {
	listen 443 ssl;
	listen [::]:443 ssl;
	server_name example.com;
	root /var/www/example.com;
	index index.html index.htm index.php;
	ssl on;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
	ssl_certificate      /etc/letsencrypt/live/example.com/fullchain.pem;
	ssl_certificate_key  /etc/letsencrypt/live/example.com/privkey.pem;
}
server {
	listen 80;
	listen [::]:80;
	server_name example.com;
	root /var/www/example.com;
	index index.html index.htm index.php;
	return 301 https://$server_name$request_uri;
}

重启Nginx

systemctl restart nginx

PHP

Debian10系统自带的软件包源的PHP版本是PHP 7.3.19-1~deb10u1 (cli)

安装PHP

apt -y install php-fpm php-mysql

#其它组件(可选)

apt -y install php-zip php-gd  php-mbstring php-curl php-xml php-pear php-bcmath

PHP配置文件/etc/php/7.3/fpm/php.ini

更多操作：

php -v #查看PHP版本号
systemctl restart php7.3-fpm #重启
systemctl start php7.3-fpm #启动
systemctl stop php7.3-fpm #关闭
systemctl status php7.3-fpm #检查状态

Nginx使用PHP

编辑/etc/nginx/sites-available/example.com站点配置文件修改为

server {
	listen 443 ssl;
	listen [::]:443 ssl;
	server_name example.com;
	root /var/www/example.com;
	index index.html index.htm index.php;
	ssl on;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
	ssl_certificate      /etc/letsencrypt/live/example.com/fullchain.pem;
	ssl_certificate_key  /etc/letsencrypt/live/example.com/privkey.pem;
	#php
	location ~ \.php$ {
	include snippets/fastcgi-php.conf;
	fastcgi_pass unix:/run/php/php7.3-fpm.sock;
	}
	#WebSocket端口转发
	location /ray {
	proxy_redirect off;
	proxy_pass http://127.0.0.1:23433;
	proxy_http_version 1.1;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection "upgrade";
	proxy_set_header Host $http_host;
	proxy_read_timeout 300s;
	}
}
server {
	listen 80;
	listen [::]:80;
	server_name example.com;
	root /var/www/example.com;
	index index.html index.htm index.php;
	return 301 https://$server_name$request_uri;
}

重启下Nginx和php

systemctl restart nginx
systemctl restart php7.3-fpm

为PHP7.3添加yaf扩展(可选)

# 编译安装yaf扩展
apt-get install php-dev -y
wget https://raw.githubusercontent.com/pwwq/files/master/yaf-3.0.8.tar.gz
tar -zxvf yaf-3.0.8.tar.gz
cd yaf-yaf-3.0.8 && phpize
./configure --with-php-config=/usr/local/php/bin/php-config
./configure && make && make install
# 配置PHP支持yaf扩展
echo "extension=yaf.so
yaf.environ='product'
yaf.use_namespace=1" >> /etc/php/7.3/fpm/php.ini
# 重启PHP
systemctl restart php7.3-fpm

安装redis扩展(可选)

apt install php-redis -y
echo "extension=redis.so" >> /etc/php/7.3/fpm/php.ini

安装Composer(可选)

php -r "copy('https://install.phpcomposer.com/installer', 'composer-setup.php');"
php composer-setup.php
mv composer.phar /usr/local/bin/composer

输入composer验证Composer (PHP包管理器)

MySQL数据库

MariaDB 是 Debian 10 中的默认数据库系统， Mysql 并不包含在 Debian 的默认软件存储库

配置 MySQL软件源

从MySQL Apt存储库并使用以下 wget 命令下载最新的发行包

apt install lsb-release gnupg -y
wget https://dev.mysql.com/get/mysql-apt-config_0.8.13-1_all.deb
dpkg -i mysql-apt-config_0.8.13-1_all.deb

安装 MySQL

apt update
apt install mysql-server

选择MYSQL5.7的低版本就行，版本越高越占用系统资源

使用mysql -u root -p登陆管理MYSQL

用phpMyAdmin使用网页管理更方便下载phpMyAdmin_v5.0.2解压后放置到站点根目录即可，无需额外设置。

wget https://files.phpmyadmin.net/phpMyAdmin/5.0.2/phpMyAdmin-5.0.2-all-languages.zip 
unzip phpMyAdmin-5.0.2-all-languages.zip
mv phpMyAdmin-5.0.2-all-languages /var/www/example.com/phpMyAdmin
rm phpMyAdmin-5.0.2-all-languages.zip

访问https://example.com/phpMyAdmin 网页管理MySQL

Nginx#

安装Nginx#

配置网站#

文件位置#

Nginx管理命令#

Certbot申请Let’s Encrypt证书SSL#

使用SSL证书#

PHP#

安装PHP#

Nginx使用PHP#

MySQL数据库#

配置 MySQL软件源#

安装 MySQL#