LNMP Linux + Nginx + MySQL + PHP
-
MySQL的安装 与LAMP中一样
-
PHP的安装 需要开启php-fpm服务 cd /usr/local/src/ wget http://cn2.php.net/distributions/php-5.6.30.tar.gz tar zxf php-5.6.30.tar.gz useradd -s /sbin/nologin php-fpm cd php-5.6.30 ./configure --prefix=/usr/local/php-fpm --with-config-file-path=/usr/local/php-fpm/etc --enable-fpm --with-fpm-user=php-fpm --with-fpm-group=php-fpm --with-mysql=/usr/local/mysql --with-mysqli=/usr/local/mysql/bin/mysql_config --with-pdo-mysql=/usr/local/mysql --with-mysql-sock=/tmp/mysql.sock --with-libxml-dir --with-gd --with-jpeg-dir --with-png-dir --with-freetype-dir --with-iconv-dir --with-zlib-dir --with-mcrypt --enable-soap --enable-gd-native-ttf --enable-ftp --enable-mbstring --enable-exif --with-pear --with-curl --with-openssl make && make install cp php.ini-production /usr/local/php-fpm/etc/php.ini vi /usr/local/php-fpm/etc/php-fpm.conf //写入如下内容 [global] 定义全局参数，如下面的pid error_log pid = /usr/local/php-fpm/var/run/php-fpm.pid error_log = /usr/local/php-fpm/var/log/php-fpm.log [www] 模块名 listen = /tmp/php-fcgi.sock 监听地址 listen.mode = 666 定义listen文件的权限 user = php-fpm 用户 group = php-fpm 组 pm = dynamic 进程信息(pm开头的) pm.max_children = 50 pm.start_servers = 20 pm.min_spare_servers = 5 pm.max_spare_servers = 35 pm.max_requests = 500 rlimit_files = 1024
cp sapi/fpm/init.d.php-fpm /etc/init.d/php-fpm chmod 755 /etc/init.d/php-fpm chkconfig --add php-fpm chkconfig php-fpm on service php-fpm start ps aux |grep php-fpm
- Nginx的安装
cd /usr/local/src
wget http://nginx.org/download/nginx-1.12.1.tar.gz
tar zxf nginx-1.12.1.tar.gz
./configure --prefix=/usr/local/nginx
make && make install
vim /etc/init.d/nginx //复制如下内容：
#!/bin/bash
#chkconfig: - 30 21
#description: http service.
#Source Function Library
. /etc/init.d/functions
#Nginx Settings
NGINX_SBIN="/usr/local/nginx/sbin/nginx"
NGINX_CONF="/usr/local/nginx/conf/nginx.conf"
NGINX_PID="/usr/local/nginx/logs/nginx.pid"
RETVAL=0
prog="Nginx"
start()
{
echo -n $"Starting $prog: "
mkdir -p /dev/shm/nginx_temp
daemon $NGINX_SBIN -c $NGINX_CONF
RETVAL=$?
echo
return $RETVAL
}
stop()
{
echo -n $"Stopping $prog: "
killproc -p $NGINX_PID $NGINX_SBIN -TERM
rm -rf /dev/shm/nginx_temp
RETVAL=$?
echo
return $RETVAL
}
reload()
{
echo -n $"Reloading $prog: "
killproc -p $NGINX_PID $NGINX_SBIN -HUP
RETVAL=$?
echo
return $RETVAL
}
restart()
{
stop
start
}
configtest()
{
$NGINX_SBIN -c $NGINX_CONF -t
return 0
}
case "$1" in
start)
start
;;
stop)
stop
;;
reload)
reload
;;
restart)
restart
;;
configtest)
configtest
;;
*)
echo $"Usage: $0 {start|stop|reload|restart|configtest}"
RETVAL=1
esac
exit $RETVAL
chmod 755 /etc/init.d/nginx
chkconfig --add nginx
chkconfig nginx on
cd /usr/local/nginx/conf/; mv nginx.conf nginx.conf.bak
vim nginx.conf //写入如下内容：
user nobody nobody;
worker_processes 2;
error_log /usr/local/nginx/logs/nginx_error.log crit;
pid /usr/local/nginx/logs/nginx.pid;
worker_rlimit_nofile 51200;
events
{
use epoll;
worker_connections 6000;
}
http
{
include mime.types;
default_type application/octet-stream;
server_names_hash_bucket_size 3526;
server_names_hash_max_size 4096;
log_format combined_realip '$remote_addr $http_x_forwarded_for [$time_local]'
' $host "$request_uri" $status'
' "$http_referer" "$http_user_agent"';
sendfile on;
tcp_nopush on;
keepalive_timeout 30;
client_header_timeout 3m;
client_body_timeout 3m;
send_timeout 3m;
connection_pool_size 256;
client_header_buffer_size 1k;
large_client_header_buffers 8 4k;
request_pool_size 4k;
output_buffers 4 32k;
postpone_output 1460;
client_max_body_size 10m;
client_body_buffer_size 256k;
client_body_temp_path /usr/local/nginx/client_body_temp;
proxy_temp_path /usr/local/nginx/proxy_temp;
fastcgi_temp_path /usr/local/nginx/fastcgi_temp;
fastcgi_intercept_errors on;
tcp_nodelay on;
gzip on;
gzip_min_length 1k;
gzip_buffers 4 8k;
gzip_comp_level 5;
gzip_http_version 1.1;
gzip_types text/plain application/x-javascript text/css text/htm
application/xml;
server
{
listen 80;
server_name localhost;
index index.html index.htm index.php;
root /usr/local/nginx/html;
location ~ .php$
{
include fastcgi_params;
fastcgi_pass unix:/tmp/php-fcgi.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /usr/local/nginx/html$fastcgi_script_name;
}
} } /etc/init.d/nginx start - Nginx默认虚拟主机
vim nginx.conf 删除以下内容
server
{
listen 80;
server_name localhost;
index index.html index.htm index.php;
root /usr/local/nginx/html;
location ~ .php$
{
include fastcgi_params;
fastcgi_pass unix:/tmp/php-fcgi.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /usr/local/nginx/html$fastcgi_script_name;
}
} 再在末行加入include vhost/*.conf； mkdir /usr/local/nginx/conf/vhost cd !$; vim default.conf //加入如下内容 server { listen 80 default_server; //有这个表示默认虚拟主机 server_name aaa.com; index index.html index.htm index.php; //指定索引页 root /data/wwwroot/default; //目标目录 }
mkdir -p /data/wwwroot/default/ echo “This is a default site.”>/data/wwwroot/default/index.html /usr/local/nginx/sbin/nginx -t //语句检验 /usr/local/nginx/sbin/nginx -s reload //重新加载 curl -x127.0.0.1:80 123.com (123.com可以为任意) 返回结果“This is a default site.”
- Nginx用户认证 vim /usr/local/nginx/conf/vhost/test.com.conf//写入如下内容 server { listen 80; server_name test.com; index index.html index.htm index.php; root /data/wwwroot/test.com; location / { auth_basic "Auth"; auth_basic_user_file /usr/local/nginx/conf/htpasswd; 密码文件 } }
yum install -y httpd 安装Apache htpasswd -c /usr/local/nginx/conf/htpasswd [用户名] // -c表示创建，之后添加用户不需要用到 /usr/local/nginx/sbin/nginx -t && -s reload curl -x127.0.0.1:80 test.com 返回结果401 curl -u[用户名][密码] -x127.0.0.1:80 123.com 返回结果“test.com” 对于目标下目录（如目标为/data/wwwroot/test.com，目标目录为/data/wwwroot/test.com/admin）单独用验证方式： 将配置文件里的location / 改为location /admin。
-
Nginx域名重定向 更改test.com.conf为 server { listen 80; server_name test.com test1.com test2.com; index index.html index.htm index.php; root /data/wwwroot/test.com; if ($host != 'test.com' ) { rewrite ^/(.*)$ http://test.com/$1 permanent; } } Nginx的server_name后面支持写多个域名 permanent为永久重定向，状态码为301，如果写redirect则为302
-
Nginx访问日志 vim /usr/local/nginx/conf/nginx.conf 搜索log_format所在行为： log_format combined_realip '$remote_addr $http_x_forwarded_for [$time_local]' ' $host "$request_uri" $status' ' "$http_referer" "$http_user_agent"'; （分号算最终结束，combined_realip为格式名称，可自定义）
除了在主配置文件nginx.conf里定义日志格式外，还需要在虚拟主机配置文件中增加，所以在test.com.conf文件里增加一行access_log /tmp/test.log combined_realip;定义访问日志文件名
日志切割
Nginx没有自带切割日志的功能，需要自定义切割脚本
vim /usr/local/sbin/nginx_log_rotate.sh//写入如下内容
#! /bin/bash
#假设nginx的日志存放路径为/data/logs/
d=date -d "-1 day" +%Y%m%d 日期（前一天）
logdir="/tmp/" 日志所在目录
nginx_pid="/usr/local/nginx/logs/nginx.pid" 重新加载写新日志
cd $logdir
for log in ls *.log //给log赋值文件名，下面$log就返回文件名了
do
mv $log $log-$d //改名，后面增加日期
done
/bin/kill -HUP cat $nginx_pid
然后添加任务计划：
0 0 * * * /bin/bash /usr/local/sbin/nginx_log_rotate.sh
静态文件不记录日志和过期时间 vi test.com.conf 加入如下内容： location ~ ..(gif|jpg|jpeg|png|bmp|swf)$ //~表示通配 { expires 7d; 过期时间7d access_log off; } location ~ ..(js|css)$ { expires 12h; 过期时间12h access_log off; }
Nginx防盗链 vi test.com.conf 第一个location改为 location ~* ^.+.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$ { expires 7d; valid_referers none blocked server_names *.test.com ; if ($invalid_referer) { return 403; } access_log off; }
访问控制 来源ip的控制 location /admin/ { allow 192.168.133.1; allow 127.0.0.1; deny all; } mkdir /data/wwwroot/test.com/admin/ echo “test,test”>/data/wwwroot/test.com/admin/1.html -t && -s reload 文件名匹配控制 location ~ .(abc|image)/..php$ { deny all; } 根据user_agent限制 if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato') { return 403; } deny all和return 403效果一样 8. Nginx解析PHP配置 vim test.com.conf 增加内容： location ~ .php$ { include fastcgi_params; fastcgi_pass unix:/tmp/php-fcgi.sock; //指定php-fpm监听的地址或者socket fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name; 此处文件路径要与配置的前面部分的root 后跟路径一致 }
-
Nginx代理 cd /usr/local/nginx/conf/vhost vim proxy.conf //加入如下内容 server { listen 80; server_name ask.apelearn.com; 域名
location / { proxy_pass http://121.201.9.155/; 最终web服务器的ip proxy_set_header Host $host; 返回的是server name，即上段定义的 proxy_set_header X-Real-IP $remote_addr; 定义变量 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 定义变量 } }
负载均衡（代理多台） vim /usr/local/nginx/conf/vhost/load.conf // 写入如下内容 upstream qq_com { ip_hash; server 61.135.157.156:80; server 125.39.240.113:80; } server { listen 80; server_name www.qq.com; location / { proxy_pass http://qq_com; 与upstream后跟的一致 proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } } upstream来指定多个web server nginx不支持https
- SSL
生成ssl密钥对 cd /usr/local/nginx/conf openssl genrsa -des3 -out tmp.key 2048//key文件为私钥，genrsa表示生成rsa类型的私钥 openssl rsa -in tmp.key -out abc.key //转换key，取消密码 rm -f tmp.key 删除原有文件 openssl req -new -key abc.key -out abc.csr //生成证书请求文件，需要拿这个文件和私钥一起生产公钥文件 openssl x509 -req -days 365 -in abc.csr -signkey abc.key -out abc.crt 这里的abc.crt为公钥
Nginx配置ssl vim /usr/local/nginx/conf/vhost/ssl.conf//加入如下内容 server { listen 443; server_name aming.com; index index.html index.php; root /data/wwwroot/slx.com; ssl on; ssl_certificate abc.crt; ssl_certificate_key abc.key; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; } -t && -s reload //若报错unknown directive “ssl” ，需要重新编译nginx，加上--with-http_ssl_module mkdir /data/wwwroot/aming.com echo “ssl test page.”>/data/wwwroot/aming.com/index.html 编辑hosts，增加127.0.0.1 aming.com curl https://aming.com/
-
pool vim /usr/local/php-fpm/etc/php-fpm.conf//在[global]部分增加 include = etc/php-fpm.d/*.conf mkdir /usr/local/php-fpm/etc/php-fpm.d/ cd /usr/local/php-fpm/etc/php-fpm.d/ vim www.conf //内容如下 [www] listen = /tmp/www.sock listen.mode=666 user = php-fpm group = php-fpm pm = dynamic pm.max_children = 50 pm.start_servers = 20 pm.min_spare_servers = 5 pm.max_spare_servers = 35 pm.max_requests = 500 rlimit_files = 1024 继续编辑配置文件 vim slx.conf //内容如下 [slx] listen = /tmp/aming.sock listen.mode=666 user = php-fpm group = php-fpm pm = dynamic pm.max_children = 50 pm.start_servers = 20 pm.min_spare_servers = 5 pm.max_spare_servers = 35 pm.max_requests = 500 rlimit_files = 1024 /usr/local/php/sbin/php-fpm –t /etc/init.d/php-fpm restart
-
php-fpm的慢执行日志 vim /usr/local/php-fpm/etc/php-fpm.d/www.conf//加入如下内容 request_slowlog_timeout = 1 //执行超过1s进行记录，可以找到速度控制步骤（一般定2s较好，超过1s的执行时间算正常） slowlog = /usr/local/php-fpm/var/log/www-slow.log 配置nginx的虚拟主机test.com.conf，把unix:/tmp/php-fcgi.sock改为unix:/tmp/www.sock 重新加载nginx服务 vim /data/wwwroot/test.com/sleep.php//写入如下内容 <?php echo “test slow log”;sleep(2);echo “done”;?> curl -x127.0.0.1:80 test.com/sleep.php cat /usr/local/php-fpm/var/log/www-slow.log
-
php-fpm进程管理 在配置文件里有以下内容 pm = dynamic //动态进程管理，也可以是static pm.max_children = 50 //最大子进程数，ps aux可以查看 pm.start_servers = 20 //启动服务时会启动的进程数 pm.min_spare_servers = 5 //定义在空闲时段，子进程数的最少数量，如果达到这个数值时，php-fpm服务会自动派生新的子进程。 pm.max_spare_servers = 35 //定义在空闲时段，子进程数的最大值，如果高于这个数值就开始清理空闲的子进程。 pm.max_requests = 500 //定义一个子进程最多处理的请求数，也就是说在一个php-fpm的子进程最多可以处理这么多请求，当达到这个数值时，它会自动退出。
