在CentOS 7 上安裝 wordpress

在CentOS 7 上安裝 wordpress

軟件版本：

• 操縱系統： CentOS 7
• PHP: 7.4
• MySQL: 8.0
• Wordpress: 5.6

配置CentOS和epel源（可選）：

sed -i 's#https\?://[^/]*/\(centos\|\$contentdir\)/#http://mirrors.aliyun.com/centos/#g; s/^#baseurl/baseurl/; s/^metalink=/#metalink=/; s/^mirrorlist=/#mirrorlist=/' /etc/yum.repos.d/CentOS-Base.repo
sed -i 's#https\?://[^/]*/\(pub/\)\?epel#http://mirrors.aliyun.com/epel#g; s/^#baseurl/baseurl/; s/^metalink=/#metalink=/; s/^mirrorlist=/#mirrorlist=/' /etc/yum.repos.d/epel*.repo
yum install -y epel-release
sed -i 's#https\?://[^/]*/\(pub/\)\?epel#http://mirrors.aliyun.com/epel#g; s/^#baseurl/baseurl/; s/^metalink=/#metalink=/; s/^mirrorlist=/#mirrorlist=/' /etc/yum.repos.d/epel*.repo

安裝nginx

yum -y install nginx       # 安裝nginx
systemctl start nginx.service       # 啓動nginx
systemctl enable nginx.service      # 設置爲開機啓動

安裝MySQL

清華大學yum源

# 安裝 mysql release
releasever=$(cat /etc/redhat-release |awk '{print $(NF-1)}'|awk -F. '{print$1}')
yum install http://mirrors.tuna.tsinghua.edu.cn/mysql/yum/mysql80-community-el${releasever}/mysql80-community-release-el${releasever}-3.noarch.rpm
# 備份配置
cp /etc/yum.repos.d/mysql-community.repo /etc/yum.repos.d/mysql-community.repo.bak
# 修改成清華大學軟件源
sed -i 's#repo.mysql.com/yum#mirrors.tuna.tsinghua.edu.cn/mysql/yum#; s/mysql-\([0-9]\)\.\([0-9]\)/mysql\1\2/; s#/el/\([0-9]\)/#-el\1/#; s#$basearch/##' /etc/yum.repos.d/mysql-community.repo
# 安裝MySQL
yum install -y mysql-community-server

騰訊雲內網yum源

# 安裝 mysql release
releasever=$(cat /etc/redhat-release |awk '{print $(NF-1)}'|awk -F. '{print$1}')
yum install http://mirrors.tencentyun.com/mysql/yum/mysql80-community-el${releasever}/mysql80-community-release-el${releasever}-3.noarch.rpm
# 備份配置
cp /etc/yum.repos.d/mysql-community.repo /etc/yum.repos.d/mysql-community.repo.bak
# 修改成騰訊雲內網軟件源
sed -i 's#repo.mysql.com/yum#mirrors.tencentyun.com/mysql/yum#; s/mysql-\([0-9]\)\.\([0-9]\)/mysql\1\2/; s#/el/\([0-9]\)/#-el\1/#; s#$basearch/##' /etc/yum.repos.d/mysql-community.repo
# 安裝MySQL
yum install -y mysql-community-server

啓動並配置MySQL

啓動MySQL

systemctl start mysqld.service
systemctl enable mysqld.service

查看MySQL初始密碼

grep 'temporary password' /var/log/mysqld.log

運行 mysql_secure_installation 更改密碼，加固MySQL

Securing the MySQL server deployment.

Enter password for user root:   <–輸入上一步獲得的MySQL初始密碼

The existing password for the user account root has expired. Please set a new password.

New password:  <– 設置新的root用戶的密碼

Re-enter new password:  <– 再輸入一次新的root用戶的密碼
The 'validate_password' component is installed on the server.
The subsequent steps will run with the existing configuration
of the component.
Using existing password for root.

Estimated strength of the password: 100 
Change the password for root ? ((Press y|Y for Yes, any other key for No) : y  <– 系統檢測到 'validate_password' 組件被安裝，須要再次設置一次密碼。 輸入y並回車或直接回車

New password: <– 設置新的root用戶的密碼

Re-enter new password: <– 再輸入一次新的root用戶的密碼

Estimated strength of the password: 100 
Do you wish to continue with the password provided?(Press y|Y for Yes, any other key for No) : y  <– 是否確認更新root用戶密碼，輸入y並回車或直接回車
By default, a MySQL installation has an anonymous user,
allowing anyone to log into MySQL without having to have
a user account created for them. This is intended only for
testing, and to make the installation go a bit smoother.
You should remove them before moving into a production
environment.

Remove anonymous users? (Press y|Y for Yes, any other key for No) : y  <– 是否刪除匿名用戶,輸入y並回車或直接回車
Success.

Normally, root should only be allowed to connect from
'localhost'. This ensures that someone cannot guess at
the root password from the network.

Disallow root login remotely? (Press y|Y for Yes, any other key for No) : y   <–是否禁止root遠程登陸,輸入y並回車或直接回車
Success.

By default, MySQL comes with a database named 'test' that
anyone can access. This is also intended only for testing,
and should be removed before moving into a production
environment.

Remove test database and access to it? (Press y|Y for Yes, any other key for No) : y   <– 是否刪除test數據庫,輸入y並回車或直接回車
 - Dropping test database...
Success.

 - Removing privileges on test database...
Success.

Reloading the privilege tables will ensure that all changes
made so far will take effect immediately.

Reload privilege tables now? (Press y|Y for Yes, any other key for No) : y   <– 是否從新加載權限表，輸入y並回車或直接回車
Success.

All done!

建立 wordpress 數據庫和用戶

用MySQL的root用戶登陸

mysql -u root -p

wordpress 數據庫和用戶

CREATE DATABASE wordpressdb;  //新建的數據庫爲 wordpressdb
CREATE USER wordpressuser@'%' IDENTIFIED BY 'user1.Password';   //用戶爲 wordpressuser，密碼爲 user1.Password
GRANT ALL PRIVILEGES ON wordpressdb.* TO wordpressuser@'%';   //受權 wordpressuser 訪問 wordpressdb
quit

安裝PHP

# 安裝 remi release
wget http://mirrors.aliyun.com/remi/enterprise/remi-release-7.rpm
yum -y localinstall remi-release-7.rpm

# 修改成阿里雲鏡像源
sed -e 's!^metalink=!#metalink=!g' \
    -e 's!^mirrorlist=!#mirrorlist=!g' \
    -e 's!^#baseurl=!baseurl=!g' \
    -e '/^baseurl=/s!http://rpms.remirepo.net/\(.*\)!http://mirrors.aliyun.com/remi/\1!g;' \
    -i /etc/yum.repos.d/remi*.repo;
# 配置 php 7.4 爲系統默認源 
yum-config-manager --disable 'remi-php*'
yum-config-manager --enable   remi-php74

# 安裝php及其組件
yum install -y php php-bcmath php-cli php-common php-gd php-json php-mbstring php-mcrypt php-mysqlnd php-opcache php-pdo php-soap php-xml php-xmlrpc php-fpm

# 啓動 php-fpm 並設置開機自動啓動
systemctl start php-fpm.service
systemctl enable php-fpm.service

修改nginx配置

vi /etc/nginx/nginx.conf 打開nginx主配置文件，按i進入編輯模式，修改其中的sever部分爲如下內容

server {
    listen       80 default_server;
    listen       [::]:80 default_server;
    server_name  _;
    root         /usr/share/nginx/html; # 你的站點的目錄

    # Load configuration files for the default server block.
    include /etc/nginx/default.d/*.conf;

    location / {
        index index.php index.html index.htm;
        try_files $uri $uri/ /index.php?$args;
    }

    rewrite /wp-admin$ $scheme://$host$uri/ permanent;

    location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
                access_log off; log_not_found off; expires max;
    }

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
}

輸入完成後，按ESC進入命令模式，輸入:wq，回車保存並退出後，重載nginx

systemctl reload nginx.service

測試php-fpm是否安裝成功

輸入vi /usr/share/nginx/html/info.php，按i進入編輯模式，輸入如下內容：

<?php
    echo phpinfo();
?>

輸入完成後，按ESC進入命令模式，輸入:wq，回車保存並退出；
接着在瀏覽器中輸入http：//當前服務器公網IP/info.php；
若是瀏覽器中出現php 相關信息!則表示配置成功,可繼續進行如下步驟，若出現文件下載彈窗，則配置失敗，檢查以上步驟是否出錯。

安裝wordpress並配置wordpress

cd ~/
wget https://cn.wordpress.org/wordpress-5.6-zh_CN.tar.gz  # 下載wordpress安裝包
tar zxvf wordpress-5.6-zh_CN.tar.gz   # 解壓縮
cd wordpress/   # 進入到wordpress目錄
cp wp-config-sample.php wp-config.php   # 複製wp-config-sample.php並重命名爲wp-config.php
vim wp-config.php   # 打開該文件

找到mysql設置的配置部分，按i進入編輯模式，將步驟2中配置的mysql信息填入如下內容中

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define('DB_NAME', 'wordpressdb'); # 數據庫名

/** MySQL database username */
define('DB_USER', 'wordpressuser');  # 數據庫用戶名

/** MySQL database password */
define('DB_PASSWORD', 'user1.Password');    # 數據庫密碼

/** MySQL hostname */
define('DB_HOST', 'localhost'); # 通常不修改，若是數據庫安裝在其餘服務器上，修改成對應服務器的IP或域名
.....

/**#@+
 * 身份認證密鑰與鹽。
 *
 * 修改成任意獨一無二的字串！
 * 或者直接訪問{@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org密鑰生成服務}
 * 任何修改都會致使全部cookies失效，全部用戶將必須從新登陸。
 *
 * @since 2.6.0
 */
define( 'AUTH_KEY',         'put your unique phrase here' );
define( 'SECURE_AUTH_KEY',  'put your unique phrase here' );
define( 'LOGGED_IN_KEY',    'put your unique phrase here' );
define( 'NONCE_KEY',        'put your unique phrase here' );
define( 'AUTH_SALT',        'put your unique phrase here' );
define( 'SECURE_AUTH_SALT', 'put your unique phrase here' );
define( 'LOGGED_IN_SALT',   'put your unique phrase here' );
define( 'NONCE_SALT',       'put your unique phrase here' );
....

輸入完成後，按ESC進入命令模式，輸入:wq，回車保存並退出；

rm /usr/share/nginx/html/info.php  # 刪除剛纔的 info.php，防止爆漏 php 信息 
rm /usr/share/nginx/html/index.html # 刪除nginx中的主頁文件
mv * /usr/share/nginx/html/ # 將wordpress文件移動web站點的根目錄

完成後，在瀏覽器中輸入http://你的主機IP或者域名/wp-admin/install.php,進入到wordpress的配置頁面，輸入網站標題，用戶名和密碼後，就能夠進入wordpress後臺管理界面，到此便大功告成。

配置letsencrypt 證書

首先須要確保擁有公網域名，並將公網域名解析到本服務器。

測試是否能夠經過公網訪問本服務器。

下載 acme.sh 代碼。

yum install git -y
git clone https://github.com/acmesh-official/acme.sh
cd acme.sh/
./acme.sh install

申請證書

/root/.acme.sh/acme.sh --issue -w /usr/share/nginx/html/ -d <你的域名> --keylength ec-256

將證書安裝到制定位置

# 建立證書存放
mkdir /etc/nginx/certs/

# 安裝證書到指定的目錄，並指定更新證書時觸發的從新載入服務的命令
/root/.acme.sh/acme.sh --install-cert --ecc -d <你的域名> \
--key-file       /etc/nginx/certs/<你的域名>.key  \
--fullchain-file /etc/nginx/certs/<你的域名>.crt \
--reloadcmd     "/usr/bin/systemctl reload nginx.service"

配置nginx https

vi /etc/nginx/conf.d/<你的域名>.conf, 添加以下內容：

server {
        server_name <你的域名>;
        listen 443 ssl http2 ;
        ssl_session_timeout 5m;
        ssl_session_cache shared:SSL:50m;
        ssl_session_tickets off;
        ssl_certificate /etc/nginx/certs/<你的域名>.crt;
        ssl_certificate_key /etc/nginx/certs/<你的域名>.key;
        #add_header Strict-Transport-Security "max-age=31536000" always;
        root         /usr/share/nginx/html;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        location / {
            index index.php index.html index.htm;
            try_files $uri $uri/ /index.php?$args;
        }

        rewrite /wp-admin$ $scheme://$host$uri/ permanent;

        location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
                    access_log off; log_not_found off; expires max;
        }

        location ~ \.php$ {
            try_files $uri =404;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_pass 127.0.0.1:9000;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            include fastcgi_params;
        }
}

從新載入 nginx

nginx -t
nginx -s reload  # 或者 systemctl reload nginx

測試一下是否可以經過https訪問站點了： https://<你的域名>;/

修改wordpress的siteurl

因爲剛開始的時候，設置的 siteurl 是http協議，wordpress默認也從http加載，因爲瀏覽器安全限制。致使不少元素加載不下來。

修改 wordpress 的 siteurl 讓默認從https協議加載。

訪問 https://<你的域名>/wp-admin/

點擊 設置-> 常規。

將 「WordPress地址（URL）」 和 」站點地址（URL）「設置爲： https://<你的域名>;/

而後點擊保存更改。

配置 http -> https 跳轉

vi /etc/nginx/conf.d/<你的域名>.conf, 添加 http 的跳轉內容：

server {
        server_name <你的域名>;
        listen 80 ;
        # Do not HTTPS redirect Let'sEncrypt ACME challenge
        location /.well-known/acme-challenge/ {
                auth_basic off;
                allow all;
                root /usr/share/nginx/html;
                try_files $uri =404;
                break;
        }
        location / {
                return 301 https://$host$request_uri;
        }
}

server {
        server_name <你的域名>;
        listen 443 ssl http2 ;
        ssl_session_timeout 5m;
        ssl_session_cache shared:SSL:50m;
        ssl_session_tickets off;
        ssl_certificate /etc/nginx/certs/<你的域名>.crt;
        ssl_certificate_key /etc/nginx/certs/<你的域名>.key;
        #add_header Strict-Transport-Security "max-age=31536000" always;
        root         /usr/share/nginx/html;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        location / {
            index index.php index.html index.htm;
            try_files $uri $uri/ /index.php?$args;
        }

        rewrite /wp-admin$ $scheme://$host$uri/ permanent;

        location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
                    access_log off; log_not_found off; expires max;
        }

        location ~ \.php$ {
            try_files $uri =404;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_pass 127.0.0.1:9000;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            include fastcgi_params;
        }
}

從新載入 nginx

nginx -t
nginx -s reload  # 或者 systemctl reload nginx