CentOS 7中基於rpm包方式安裝部署apm(php-fpm) + xcache

CentOS 7, 基於rpm包方式安裝部署apm(php-fpm) + xcache；
a) httpd, php, mariadb分別部署在一個單獨的主機上；
b) 一個虛擬主機提供phpMyAdmin，另外一個虛擬主機提供wordpress；
c) 爲phpMyAdmim提供https服務；

環境配置：
三臺主機獨立都須要關閉防火牆和設置SELinux：

使用httpd+FastCGI的方式實現整合：
1.php-5.3.3+版本中才能默認實現；
2.httpd支持proxy_fcgi_module，默認httpd-2.2中不支持此模塊，httpd-2.4支持

第一個主機---配置httpd：
[root@chenliang ~]# yum -y install httpd
配置虛擬主機：
[root@chenliang ~]# vim /etc/httpd/conf.d/www.conf

從新啓動httpd服務：
[root@chenliang conf.d]# systemctl start httpd.service

第二個主機---提供php服務：
安裝php-fpm：
[root@chenliang ~]# rpm -q php //php-fpm和php不能同時存在，要安裝php-fpm須要首先卸載php
未安裝軟件包 php
安裝php-fpm等應用程序：
[root@chenliang ~]# yum -y install php-fpm php-mysql php-gd php-mbstring
構建在httpd配置文件中對應的映射路徑：
[root@chenliang ~]# mkdir -pv /var/www/html/vhost1
mkdir: 已建立目錄 "/var/www/html/vhost1"
[root@chenliang ~]# cd /var/www/html/vhost1
[root@chenliang vhost1]# vim index.php
提供php服務的主機。</br>
<?php
phpinfo();
?>

修改php-fpm服務進程的配置文件：
[root@chenliang ~]# vim /etc/php-fpm.d/www.conf

listen = 172.16.72.2:9000 //php-fpm服務器監聽本機套接字
listen.allowed_clients = 172.16.72.1 //監聽的httpd服務器IP地址用於接受請求
[root@chenliang ~]# systemctl start php-fpm.service
查看啓動php-fpm狀態，發現監聽的IP地址和9000端口號是咱們設定的端口號：

測試PHP鏈接順暢：

搭建WordPress：
[root@chenliang vhost1]# ls
index.php wordpress-4.2-zh_CN.tar.gz
[root@chenliang vhost1]# tar xf wordpress-4.2-zh_CN.tar.gz
[root@chenliang vhost1]# ls
index.php wordpress wordpress-4.2-zh_CN.tar.gz
[root@chenliang vhost1]# cd wordpress/
[root@chenliang wordpress]# vim wp-config-sample.php //修改WordPress配置文件，須要手動建立數據庫和用戶名等配置；其中的IP地址是第三個主機IP

下圖表明WordPress論壇界面已經能夠顯示，只須要搭建好數據庫就能夠了：

搭建phpMyAdmin 應用程序：

第三個主機---提供mariadb（數據庫）服務：
1）配置WordPress論壇：
[root@chenliang ~]# yum install -y mariadb-server
開啓數據庫服務：
[root@chenliang ~]# systemctl start mariadb.service
對WordPress論壇訪問用戶受權：

根據下面的提示，在第二個主機配置文件：

[root@chenliang wordpress]# vim wp-config.php //在其中加入提示內容
結果以下：

建立用戶後安裝：

最終結果：

[root@chenliang pma]# scp -r wordpress root@172.16.72.1:/var/www/html/vhost1/ //將首頁文件發送至第一個httpd主機下

2）配置phpMyAdmin 論壇：
在第三臺主機中對用戶進行訪問數據庫受權：

在第二臺主機/var/www/html/vhost2下安裝phpMyAdmin：
[root@chenliang vhost2]# ls
index.php phpMyAdmin-3.5.4-all-languages.tar.gz
[root@chenliang vhost2]# tar xf phpMyAdmin-3.5.4-all-languages.tar.gz
[root@chenliang vhost2]# ls
index.php phpMyAdmin-3.5.4-all-languages phpMyAdmin-3.5.4-all-languages.tar.gz
[root@chenliang vhost2]# mv phpMyAdmin-3.5.4-all-languages pma
[root@chenliang vhost2]# ls
index.php phpMyAdmin-3.5.4-all-languages.tar.gz pma
[root@chenliang vhost2]# cd pma/
[root@chenliang pma]# ls
[root@chenliang pma]# mv config.sample.inc.php config.inc.php
[root@chenliang pma]# openssl rand -base64 10
RKUJMUuBLrHlKg==
[root@chenliang pma]# vim config.inc.php //將上面的生成的隨機數修改到配置文件中，而後修改隨機數來保障數據庫訪問安全，修改數據庫所在主機IP，以下圖
$cfg['blowfish_secret'] = 'RKUJMUuBLrHlKg==';
$cfg['Servers'][$i]['host'] = '172.16.74.1';

[root@chenliang vhost2]# scp -r pma root@172.16.72.1:/var/www/html/vhost2/ //將phpMyAdmin的首頁文件發送到httpd主機，以保障良好的頁面展現，反向代理跳轉的話，界面較醜
測試結果以下：

爲phpMyAdmin提供https服務：

在第一臺主機中爲phpMyAdmin提供https服務：
[root@chenliang conf.d]# yum install -y mod_ssl
建立私有CA：
[root@chenliang ~]# cd /etc/pki/CA
[root@chenliang CA]# ls
certs crl newcerts private
[root@chenliang CA]# (umask 077;openssl genrsa -out private/cakey.pem 4096)
Generating RSA private key, 4096 bit long modulus
.++
.++
e is 65537 (0x10001)
生成自簽證書：
[root@chenliang CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:cl
Locality Name (eg, city) [Default City]:cl
Organization Name (eg, company) [Default Company Ltd]:cl
Organizational Unit Name (eg, section) []:cl
Common Name (eg, your name or your server's hostname) []:cl
Email Address []:
[root@chenliang CA]# ls
cacert.pem certs crl newcerts private
建立文本文件和目錄文件：
[root@chenliang CA]# touch index.txt
[root@chenliang CA]# echo 01 > serial
[root@chenliang CA]# ls
cacert.pem certs crl index.txt newcerts private serial
爲httpd服務器生成密鑰並生成證書請求：
[root@chenliang CA]# cd ~
[root@chenliang ~]# mkdir -pv /etc/httpd/ssl
mkdir: 已建立目錄 "/etc/httpd/ssl"
[root@chenliang ~]# cd /etc/httpd/ssl
[root@chenliang ssl]# (umask 077;openssl genrsa -out httpd.key 4096)
Generating RSA private key, 4096 bit long modulus
........................................++
..........................................................................................................++
e is 65537 (0x10001)
[root@chenliang ssl]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:cl
Locality Name (eg, city) [Default City]:cl
Organization Name (eg, company) [Default Company Ltd]:cl
Organizational Unit Name (eg, section) []:cl
Common Name (eg, your name or your server's hostname) []:cl
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:cl
將證書請求發送到CA：
[root@chenliang ssl]# ls
httpd.csr httpd.key
[root@chenliang ssl]# cp httpd.csr /tmp
在CA上爲這次請求籤發證書：
[root@chenliang ssl]# openssl ca -in /tmp/httpd.csr -out /etc/pki/CA/certs/httpd.crt
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: May 10 14:52:39 2018 GMT
Not After : May 10 14:52:39 2019 GMT
Subject:
countryName = CN
stateOrProvinceName = cl
organizationName = cl
organizationalUnitName = cl
commonName = cl
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
75:3A:3D:56:AE:73:1B:8E:19:D5:B8:2B:84:A8:6F:2C:0B:F1:4B:CB
X509v3 Authority Key Identifier:
keyid:79:4B:25:B7:82:DC:20:46:D9:C7:CA:5A:FD:DE:45:32:D6:4C:59:C5

Certificate is to be certified until May 10 14:52:39 2019 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
在CA上將CA簽發的證書傳送到httpd服務器：
[root@chenliang ssl]# cp /etc/pki/CA/certs/httpd.crt /etc/httpd/ssl/
在httpd服務器上，刪除證書請求文件：
[root@chenliang ssl]# ls
httpd.crt httpd.csr httpd.key
[root@chenliang ssl]# rm -f httpd.csr
在vhost2虛擬主機站點服務器上配置ssl支持：
配置https的虛擬主機（保證mod_ssl模塊被正確裝載；若是沒有，則須要單獨安裝）：

[root@chenliang ~]# cd /etc/httpd/conf.d
[root@chenliang conf.d]# vim ssl.conf
<VirtualHost 172.16.72.1:443>
DocumentRoot "/var/www/html/vhost2"
ServerName www.chenliangs.com:443
DirectoryIndex index.php
ProxyRequests on
ProxyPassMatch ^/(.*.php)$ fcgi://172.16.72.2:9000/var/www/html/vhost2/$1
<Directory "/var/www/html/vhost2">
Options None
Allowoverride None
Require all granted
</Directory>
</VirtualHost>
重啓服務：
[root@chenliang conf.d]# systemctl restart httpd.service
先測試https在靜態資源頁面的顯示效果，如圖：
[root@chenliang html]# mkdir /var/www/html/vhost2 -pv
mkdir: 已建立目錄 "/var/www/html/vhost2"
[root@chenliang html]# ls
index.html vhost2
[root@chenliang html]# cd vhost2/
[root@chenliang vhost2]# ls
[root@chenliang vhost2]# vim index.html
https's static page.

以後在第二臺主機上，測試PHP數據庫鏈接：

[root@chenliang html]# mkdir /var/www/html/vhost2 -pv
mkdir: 已建立目錄 "/var/www/html/vhost2"
[root@chenliang html]# ls
index.html vhost1 vhost2
[root@chenliang html]# cd vhost2/
[root@chenliang vhost2]# ls
[root@chenliang vhost2]# vim index.php
測試結果以下：

結果以下：