从零开始搭建Wordpress个人博客

1

sudo dnf install mariadb

1

sudo mysql_secure_installation

1

./configure --with-curl --enable-exif --enable-gd --with-webp --with-jpeg --with-freetype --enable-gd-jis-conv --enable-mbstring --with-mysqli --with-sodium --with-openssl --with-zip --with-zlib  --enable-ftp --enable-fpm --with-fpm-user=nginx --with-fpm-group=nginx --with-fpm-systemd --disable-short-tags --with-libdir=lib64

1
2
3

dnf config-manager --set-enabled PowerTools
dnf install epel-release
dnf install gcc gcc-c++ autoconf automake tar xz libtool bison libcurl libcurl-devel libsodium libsodium-devel openssl openssl-devel libzip libzip-devel libssh2 libssh2-devel gd ImageMagick ImageMagick-devel ghostscript zlib zlib-devel systemd-devel libxml2 libxml2-devel sqlite sqlite-devel re2c oniguruma oniguruma-devel memcached libmemcached-devel

1

./configure --help

1
2
3

make
make test
sudo make install

1
2
3
4
5
6

sudo cp php.ini-production /usr/local/lib/
sudo cp sapi/fpm/php-fpm.service /etc/systemd/system/
...
sudo cp php-fpm.conf.default php-fpm.conf
sudo cp php-fpm.d/www.conf.default php-fpm.d/www.conf
...

1

php -ini

1
2
3

phpize
make
sudo make install

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

;不向客户端报告PHP
expose_php = Off
;命令最长执行时间
max_execution_time = 180
;接受最多参数个数
max_input_vars = 1500
;单进程最多使用内存
memory_limit = 128M
;上传最大文件大小
upload_max_filesize = 32M
post_max_size = 32M
;其他安全设置
session.use_strict_mode = 1
session.use_only_cookies = 1
session.cookie_secure = 1
;这里特意提一下 cgi.fix_pathinfo 是因为，有太多的应该放在博物馆里的化石教程里面讲这个选项需要关闭，但是这个问题已经早~~~~~~~~就在默认配置的情况下修复了，推荐开启。在开启的情况下，nginx的设置会省事很多。
cgi.fix_pathinfo = 1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

[nginx-mainline]
name=nginx mainline repo
baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

1

sudo dnf install nginx

1

./build_module.sh -v 1.18.0 https://github.com/FRiCKLE/ngx_cache_purge.git

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

sudo dnf install createrepo
sudo mkdir /opt/rpm
sudo bash -c "cat << EOF > /etc/yum.repos.d/localrepo.repo
[localrepo]
name=Dynamic modules for NGINX
baseurl=file:///opt/rpm
gpgcheck=0
enabled=1
EOF"
sudo cp ~/rpmbuild/RPMS/x86_64/nginx-module-nickname-1.18.0-1.el8.ngx.x86_64.rpm /opt/rpm
createrepo -v /opt/rpm

1

sudo dnf install nginx-module-nickname

1

load_module modules/ngx_http_cache_purge_module.so;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

sendfile on;
tcp_nopush on;
tcp_nodelay on;
client_max_body_size 32m;
# 开启gzip压缩
gzip on;
gzip_vary on;
gzip_comp_level 6;
gzip_buffers 16 8k;
gzip_min_length 1000;
gzip_proxied any;
gzip_disable "msie6";
gzip_http_version 1.0;
gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript;

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102

fastcgi_cache_path /run/nginx-cache levels=1:2 keys_zone=WPCACHE:300m inactive=60m max_size=10g;
fastcgi_temp_path /run/nginx-cache-temp;
fastcgi_cache_key "$scheme$request_method$host$request_uri";
server {
    listen 443 ssl http2 fastopen=50 reuseport;
    server_name example.net;
    root /your/wordpress/root;

    #这里省略TLS的配置部分。

    # 禁止非本域名访问
    if ($host != "example.net") {
        return 444;
    }
    index index.php index.html;
    set $skip_cache 0;
    location ~ /purge(/.*) {
            allow 127.0.0.1;
            allow your_server_ip;
            deny all;
            fastcgi_cache_purge WPCACHE "$scheme$request_method$host$1";
    }
    location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
    access_log off; log_not_found off; expires max;
    }
    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }
    location = /ads.txt {
        allow all;
        log_not_found off;
    }
    location = /human.txt {
        allow all;
        log_not_found off;
        access_log off;
    }
    location ~ /\. {
        deny all;
    }

    # 这一段是用来bypass掉一部分不应该使用缓存的请求，但是这段的配置我是直接抄的，我并不清楚是否完善或者有问题，但是至少看起来是没有什么问题。
    set $skip_cache 0;
    if ($request_method = POST) {
        set $skip_cache 1;
    }
    if ($query_string != "") {
        set $skip_cache 1;
    }
    if ($request_uri ~* "/wp-admin/|/xmlrpc.php|wp-.*.php|/index.php|/feed/|sitemap(_index)?.xml") {
        set $skip_cache 1;
    }
    if ($http_cookie ~* "comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_no_cache|wordpress_logged_in") {
        set $skip_cache 1;
    }

    location / {
        try_files $uri $uri/ /index.php?$args;
    }
    location ~ \.php$ {
        try_files $uri =404;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $request_filename;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        # fastcgi_pass路径要与php-fpm的设置相匹配
        fastcgi_pass unix:/run/php-fpm.sock;
        fastcgi_cache_bypass $skip_cache;
        fastcgi_cache WPCACHE;
        fastcgi_cache_valid 200 6h;
        fastcgi_cache_use_stale error timeout invalid_header updating http_500 http_503;
        fastcgi_ignore_headers Cache-Control Expires Set-Cookie;
        proxy_cache_background_update on;
        proxy_cache_lock on;
    }
    # 如果你建立的是个人博客并且有固定ip的话，你应该不想让其他人访问你的登录页面。
    location = /wp-login.php {
    allow your_ip;
    deny all;
    try_files $fastcgi_script_name =404;
    fastcgi_intercept_errors on;
    fastcgi_index  index.php;
    include        fastcgi_params;
    fastcgi_param  SCRIPT_FILENAME  $request_filename;
    fastcgi_param  PATH_INFO $fastcgi_path_info;
    fastcgi_pass   unix:/run/php-fpm.sock;
    fastcgi_read_timeout 300s;
    }
}
# 将非HTTPS访问跳转到HTTPS。如果需要最大兼容性的话，这里应该使用301跳转而不是308跳转。就我的体感看来，两种跳转在使用中并没有什么实质性的区别，所以也许用301跳转会更好一些？
server {
    listen 80;
    server_name example.com;
    return 308 https://$server_name$request_uri;
}
#禁止非本域名访问。这是一个server块，你应该只在主配置文件中添加一次，如果你像我一样只有一个网站的话，你也可以像我一样放在站点的配置文件中（但是不推荐）。
server {
    listen 80;
    server_name "";
    return 444;
}

1
2
3

sudo mkdir /run/nginx-cache
sudo mkdir /run/nginx-cache-temp
sudo chown nginx:nginx /run/nginx-cache /run/nginx-cache-temp

1
2
3
4
5
6
7
8
9

define( 'FS_METHOD', 'ssh2' ); // 上传文件方式，我们这里使用sftp。
define( 'FTP_BASE', 'root' ); // Wordpress网站根目录
define( 'FTP_CONTENT_DIR', 'root/wp-content/' ); // wp-content文件夹位置，默认情况下可省略。
define( 'FTP_PLUGIN_DIR ', 'root/wp-content/plugins/' ); // plugins文件夹位置，默认情况下可省略。
define( 'FTP_PUBKEY', 'sshkey/id_ecdsa.pub' ); // 公钥位置
define( 'FTP_PRIKEY', 'sshkey/id_ecdsa' ); // 私钥位置
define( 'FTP_USER', 'www-data' ); // ssh用户
define( 'FTP_PASS', '' ); // 密码，若使用带密码保护的私钥的密码可放在这里，但不推荐，据Wordpress官网说法，带密码保护的私钥会有兼容性问题。可省略。
define( 'FTP_HOST', 'localhost:22' ); //ssh端口

1
2
3
4
5
6
7
8

sudo firewall-cmd --add-port=80/tcp --add-port=443/tcp
sudo firewall-cmd --reload

sudo systemctl enable nginx --now
sudo systemctl enable mariadb --now
sudo systemctl enable php-fpm --now

sudo setenforce 0

1

sudo grep nginx /var/log/audit/audit.log | audit2why

1

sudo grep -E "some_id|another_id..." /var/log/audit/audit.log | audit2allow -m nginx

1
2

sudo grep -E "some_id|another_id..." /var/log/audit/audit.log | audit2allow -M nginx
sudo semodule -i nginx.pp

1

sudo setenforce 1