环境部署

[Wiflin]

又一次要装环境，干脆记一下自己的安装习惯。

[Wiflin]

【nginx】配置指令http://nginx.org/en/docs/dirindex.html
【nginx】配置变量http://nginx.org/en/docs/varindex.html
【nginx】参考原文https://segmentfault.com/a/1190000002797601

# yum -y install gcc gcc-c++ make libtool zlib zlib-devel openssl openssl-devel pcre pcre-devel
# wget http://nginx.org/download/nginx-1.12.1.tar.gz
# tar -zvxf nginx-1.12.1.tar.gz
# ./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-pcre --with-stream
Configuration summary
  + using system PCRE library
  + using system OpenSSL library
  + using system zlib library

  nginx path prefix: "/usr/local/nginx"
  nginx binary file: "/usr/local/nginx/sbin/nginx"
  nginx modules path: "/usr/local/nginx/modules"
  nginx configuration prefix: "/usr/local/nginx/conf"
  nginx configuration file: "/usr/local/nginx/conf/nginx.conf"
  nginx pid file: "/usr/local/nginx/logs/nginx.pid"
  nginx error log file: "/usr/local/nginx/logs/error.log"
  nginx http access log file: "/usr/local/nginx/logs/access.log"
  nginx http client request body temporary files: "client_body_temp"
  nginx http proxy temporary files: "proxy_temp"
  nginx http fastcgi temporary files: "fastcgi_temp"
  nginx http uwsgi temporary files: "uwsgi_temp"
  nginx http scgi temporary files: "scgi_temp"
# make && make install
# /usr/local/nginx/sbin/nginx           #启动 nginx 服务
# /usr/local/nginx/sbin/nginx -s stop   #停止 nginx 服务
# ps -aux | grep nginx
# netstat -tunlp

正则匹配 https://segmentfault.com/a/1190000002797606

在/etc/profile文件中将php添加到环境变量中

export PATH=/usr/local/nginx/sbin:$PATH

保存后，输入命令，使其立即生效，使用export查看现在环境

shell> source /etc/profile
shell> export

写入服务
/usr/lib/systemd/system/nginx.service

[Unit]
Description=nginx 服务
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
ExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
ExecReload=/usr/local/nginx/sbin/nginx -s reload
ExecStop=/usr/local/nginx/sbin/nginx -s stop
PrivateTmp=true

[Install]
WantedBy=multi-user.target

编译指令

./configure \
--prefix=/usr/local/nginx \
--pid-path=/var/run/nginx.pid \
--lock-path=/var/lock/nginx.lock \
--with-http_ssl_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_realip_module \
--with-http_gzip_static_module \
--with-http_stub_status_module \
--with-stream \
--with-mail \
--with-mail_ssl_module \
--with-debug \
--with-pcre=../pcre-8.42 \
--with-zlib=../zlib-1.2.11 \
--with-openssl=../openssl-1.1.0h 

[Wiflin]

更改主机名

# vim /etc/hostname
# reboot

[Wiflin]

【php】参考周师傅 https://authuir.com/index.php/archives/2/

# yum -y install libjpeg libjpeg-devel libpng libpng-devel freetype freetype-devel libxml2 libxml2-devel zlib zlib-devel glibc glibc-devel glib2 glib2-devel bzip2 bzip2-devel ncurses ncurses-devel curl curl-devel e2fsprogs e2fsprogs-devel krb5 krb5-devel libidn libidn-devel openldap openldap-devel nss_ldap openldap-clients openldap-servers gd gd2 gd-devel gd2-devel perl-CPAN libmcrypt libmcrypt-devel
# wget http://hk1.php.net/get/php-7.1.7.tar.gz/from/this/mirror -O  php-7.1.7.tar.gz
# tar -zxvf php-7.1.7.tar.gz
# ./configure --prefix=/usr/local/php \
     --with-config-file-path=/usr/local/php/etc \
     --enable-fpm \
     --enable-zip \
     --enable-ftp \
     --enable-soap \
     --enable-xml \
     --enable-mbstring \
     --disable-rpath \
     --disable-debug \
     --disable-fileinfo \
     --with-mysqli=mysqlnd \
     --with-pdo-mysql=mysqlnd \
     --with-pcre-regex \
     --with-iconv \
     --with-zlib \
     --with-mcrypt \
     --with-gd \
     --with-openssl \
     --with-mhash \
     --with-xmlrpc \
     --with-curl \
     --enable-opcache=no \
     --with-zlib-dir=/usr \
     --with-libdir=lib64 \
     --with-imap-ssl
# make && make install

在/etc/profile文件中将php添加到环境变量中

export PATH=/usr/local/php/bin:$PATH
export PATH=/usr/local/php/sbin:$PATH

保存后，输入命令，使其立即生效，使用export查看现在环境

shell> source /etc/profile
shell> export

写入：/usr/lib/systemd/system/php.service

[Unit]
Description=PHP 服务
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
ExecStart=/usr/local/php/sbin/php-fpm -c /usr/local/php/lib/php.ini
ExecReload=/usr/bin/kill `pgrep -f "php-fpm: master process"` && sleep 1 && /usr/local/php/sbin/php-fpm -c /usr/local/php/lib/php.ini
ExecStop=/usr/bin/kill `pgrep -f "php-fpm: master process"`
PrivateTmp=true

[Install]
WantedBy=multi-user.target

[Wiflin]

【mysql】参考周师傅 https://authuir.com/index.php/archives/2/

# wget https://dev.mysql.com/get/mysql57-community-release-el7-11.noarch.rpm
# rpm -Uvh mysql57-community-release-el6-8.noarch.rpm
# yum repolist all | grep mysql
# yum install mysql-community-server
# yum install mysql-tools-community
# yum install mysql-connectors-community
# service mysqld start
# service mysqld status
# grep 'temporary password' /var/log/mysqld.log
# mysql -uroot -p
# mysql> ALTER USER 'root'@'localhost' IDENTIFIED BY 'Yu**********';

[Wiflin]

【python3】

#  yum install zlib-devel bzip2-devel openssl-devel ncurese-devel
# wget  https://www.python.org/ftp/python/3.6.2/Python-3.6.2.tgz
# tar -zxvf Python-3.6.2.tgz
# cd Python-3.6.2
# ./configure --prefix=/usr/local/python3
# make && make install
# ln -s /usr/local/python3/bin/python3 /usr/bin/python
# ln -s /usr/local/python3/bin/pip3 /usr/bin/pip
# vim /usr/bin/yum

[Wiflin]

【uwsgi】运行选项http://uwsgi-docs.readthedocs.io/en/latest/Options.html
【uwsgi】部署配置http://uwsgi-docs.readthedocs.io/en/latest/Nginx.html
【uwsgi】http://timd.cn/2015/09/15/nginx-uwsgi/

    location ~ \.py$ {
        uwsgi_pass  127.0.0.1:9001;
        uwsgi_param UWSGI_FILE	$document_root$document_uri;  
        uwsgi_param UWSGI_CHDIR $document_root;
        include uwsgi_params;
    }

/usr/lib/systemd/system/uwsgi.service

[Unit]
Description=uWSGI Emperor
After=syslog.target

[Service]
ExecStart=/usr/local/python3/bin/uwsgi --ini /etc/uwsgi.ini
Restart=always
KillSignal=SIGQUIT
Type=notify
NotifyAccess=all

[Install]
WantedBy=multi-user.target

/etc/uwsgi.ini

[uwsgi]
emperor = /etc/uwsgi
logto = /var/log/uwsgi_emperor.log

/etc/uwsgi/main.ini

[uwsgi]
socket = 127.0.0.1:9001
master = true        
vhost = true        
no-site = true      
workers = 2         
reload-mercy = 10     
vacuum = true     
max-requests = 1000   
limit-as = 512
buffer-size = 30000
daemonize = /var/log/uwsgi-main.log

[Wiflin]

【iptables】https://wsgzao.github.io/post/iptables/

#/etc/sysconfig/iptables
# Generated by iptables-save v1.4.21 on Sun Aug 13 19:39:07 2017
*filter
:INPUT DROP [6:475]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [2:878]

# lo
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

# icmp
-A INPUT -p icmp -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT

# ssh
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

# http
-A INPUT -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m multiport --sports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT

# mysql 
-A INPUT -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT

# dns server
-A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --sport 53 -j ACCEPT

COMMIT
# Completed on Sun Aug 13 19:39:07 2017

[Wiflin]

lets encrypt!

./certbot-auto certonly --standalone --email warfacezhang@gmail.com  -d ppt.uio.zwf.im

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/ppt.uio.zwf.im/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/ppt.uio.zwf.im/privkey.pem
   Your cert will expire on 2018-01-05. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

[Wiflin]

[fail2ban]
https://linux.cn/article-5067-1.html

[ssh]
https://zzz.buzz/zh/2016/04/18/hardening-sshd/
https://hyjk2000.github.io/2012/03/16/how-to-set-up-ssh-keys/
https://linux.cn/article-8172-1.html

[Wiflin]

【挂载新硬盘】https://www.alibabacloud.com/help/zh/doc-detail/25426.htm

[Wiflin]

[oh-my-zsh]

sudo chsh -s /bin/zsh

#install
sh -c "$(curl -fsSL https://raw.github.com/robbyrussell/oh-my-zsh/master/tools/install.sh)"

[theme]
# robbyrussell.zsh-theme
local ret_status="%(?:%{$fg_bold[green]%}➜ :%{$fg_bold[red]%}➜ )"
PROMPT='${ret_status}%{$fg[yellow]%}%m %{$fg[green]%}%* %{$fg[cyan]%}%~%{$reset_color%} $(git_prompt_info)'

ZSH_THEME_GIT_PROMPT_PREFIX="%{$fg_bold[blue]%}git:(%{$fg[red]%}"
ZSH_THEME_GIT_PROMPT_SUFFIX="%{$reset_color%} "
ZSH_THEME_GIT_PROMPT_DIRTY="%{$fg[blue]%}) %{$fg[yellow]%}✗"
ZSH_THEME_GIT_PROMPT_CLEAN="%{$fg[blue]%})"

[Wiflin]

[screen]

[autodetach bar]
autodetach on
startup_message off
hardstatus alwayslastline
shelltitle 'bash'

hardstatus string '%{gk}[%{wk}%?%-Lw%?%{=b kR}(%{W}%n*%f %t%?(%u)%?%{=b kR})%{= w}%?%+Lw%?%? %{g}][%{d}%l%{g}][ %{= w}%Y/%m/%d %0C:%s%a%{g} ]%{W}'

[Wiflin]

[systemd]

Systemd 入门教程：命令篇
http://www.ruanyifeng.com/blog/2016/03/systemd-tutorial-commands.html

http://www.ruanyifeng.com/blog/2016/03/systemd-tutorial-part-two.html