MySQL的安装
与LAMP中一样
PHP的安装
需要开启php-fpm服务
cd /usr/local/src/
wget http://cn2.php.net/distributions/php-5.6.30.tar.gz
tar zxf php-5.6.30.tar.gz
useradd -s /sbin/nologin php-fpm
cd php-5.6.30
./configure --prefix=/usr/local/php-fpm --with-config-file-path=/usr/local/php-fpm/etc --enable-fpm --with-fpm-user=php-fpm --with-fpm-group=php-fpm --with-mysql=/usr/local/mysql --with-mysqli=/usr/local/mysql/bin/mysql_config --with-pdo-mysql=/usr/local/mysql --with-mysql-sock=/tmp/mysql.sock --with-libxml-dir --with-gd --with-jpeg-dir --with-png-dir --with-freetype-dir --with-iconv-dir --with-zlib-dir --with-mcrypt --enable-soap --enable-gd-native-ttf --enable-ftp --enable-mbstring --enable-exif --with-pear --with-curl --with-openssl
make && make install
cp php.ini-production /usr/local/php-fpm/etc/php.ini
vi /usr/local/php-fpm/etc/php-fpm.conf //写入如下内容
[global] 定义全局参数，如下面的pid error_log
pid = /usr/local/php-fpm/var/run/php-fpm.pid
error_log = /usr/local/php-fpm/var/log/php-fpm.log
[www] 模块名
listen = /tmp/php-fcgi.sock 监听地址
listen.mode = 666 定义listen文件的权限
user = php-fpm 用户
group = php-fpm 组
pm = dynamic 进程信息(pm开头的)
pm.max_children = 50
pm.start_servers = 20
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500
rlimit_files = 1024
cp sapi/fpm/init.d.php-fpm /etc/init.d/php-fpm
chmod 755 /etc/init.d/php-fpm
chkconfig --add php-fpm
chkconfig php-fpm on
service php-fpm start
ps aux |grep php-fpm
chmod 755 /etc/init.d/nginx
chkconfig --add nginx
chkconfig nginx on
cd /usr/local/nginx/conf/; mv nginx.conf nginx.conf.bak
vim nginx.conf //写入如下内容：
user nobody nobody;
worker_processes 2;
error_log /usr/local/nginx/logs/nginx_error.log crit;
pid /usr/local/nginx/logs/nginx.pid;
worker_rlimit_nofile 51200;
events
{
use epoll;
worker_connections 6000;
}
http
{
include mime.types;
default_type application/octet-stream;
server_names_hash_bucket_size 3526;
server_names_hash_max_size 4096;
log_format combined_realip ‘$remote_addr $http_x_forwarded_for [$time_local]‘
‘ $host "$request_uri" $status‘
‘ "$http_referer" "$http_user_agent"‘;
sendfile on;
tcp_nopush on;
keepalive_timeout 30;
client_header_timeout 3m;
client_body_timeout 3m;
send_timeout 3m;
connection_pool_size 256;
client_header_buffer_size 1k;
large_client_header_buffers 8 4k;
request_pool_size 4k;
output_buffers 4 32k;
postpone_output 1460;
client_max_body_size 10m;
client_body_buffer_size 256k;
client_body_temp_path /usr/local/nginx/client_body_temp;
proxy_temp_path /usr/local/nginx/proxy_temp;
fastcgi_temp_path /usr/local/nginx/fastcgi_temp;
fastcgi_intercept_errors on;
tcp_nodelay on;
gzip on;
gzip_min_length 1k;
gzip_buffers 4 8k;
gzip_comp_level 5;
gzip_http_version 1.1;
gzip_types text/plain application/x-javascript text/css text/htm
application/xml;
server
{
listen 80;
server_name localhost;
index index.html index.htm index.php;
root /usr/local/nginx/html;
location ~ .php$
{
include fastcgi_params;
fastcgi_pass unix:/tmp/php-fcgi.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /usr/local/nginx/html$fastcgi_script_name;
}
}
}
/etc/init.d/nginx start
mkdir /usr/local/nginx/conf/vhost
cd !$; vim default.conf //加入如下内容
server
{
listen 80 default_server; //有这个表示默认虚拟主机
server_name aaa.com;
index index.html index.htm index.php; //指定索引页
root /data/wwwroot/default; //目标目录
}
mkdir -p /data/wwwroot/default/
echo “This is a default site.”>/data/wwwroot/default/index.html
/usr/local/nginx/sbin/nginx -t //语句检验
/usr/local/nginx/sbin/nginx -s reload //重新加载
curl -x127.0.0.1:80 123.com (123.com可以为任意) 返回结果“This is a default site.”
location /
{
auth_basic "Auth";
auth_basic_user_file /usr/local/nginx/conf/htpasswd; 密码文件
}
}
yum install -y httpd 安装Apache
htpasswd -c /usr/local/nginx/conf/htpasswd [用户名] // -c表示创建，之后添加用户不需要用到
/usr/local/nginx/sbin/nginx -t && -s reload
curl -x127.0.0.1:80 test.com 返回结果401
curl -u[用户名][密码] -x127.0.0.1:80 123.com 返回结果“test.com”
对于目标下目录（如目标为/data/wwwroot/test.com，目标目录为/data/wwwroot/test.com/admin）单独用验证方式：
将配置文件里的location / 改为location /admin。
日志切割
Nginx没有自带切割日志的功能，需要自定义切割脚本
vim /usr/local/sbin/nginx_log_rotate.sh//写入如下内容
#! /bin/bash
#假设nginx的日志存放路径为/data/logs/
d=date -d "-1 day" +%Y%m%d 日期（前一天）
logdir="/tmp/" 日志所在目录
nginx_pid="/usr/local/nginx/logs/nginx.pid" 重新加载写新日志
cd $logdir
for log in ls *.log //给log赋值文件名，下面$log就返回文件名了
do
mv $log $log-$d //改名，后面增加日期
done
/bin/kill -HUP cat $nginx_pid
然后添加任务计划：
0 0 * /bin/bash /usr/local/sbin/nginx_log_rotate.sh
静态文件不记录日志和过期时间
vi test.com.conf 加入如下内容：
location ~ ..(gif|jpg|jpeg|png|bmp|swf)$ //~表示通配
{
expires 7d; 过期时间7d
access_log off;
}
location ~ ..(js|css)$
{
expires 12h; 过期时间12h
access_log off;
}
Nginx防盗链
vi test.com.conf 第一个location改为
location ~ ^.+.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d;
valid_referers none blocked server_names .test.com ;
if ($invalid_referer) {
return 403;
}
access_log off;
}
访问控制
来源ip的控制
location /admin/
{
allow 192.168.133.1;
allow 127.0.0.1;
deny all;
}
mkdir /data/wwwroot/test.com/admin/
echo “test,test”>/data/wwwroot/test.com/admin/1.html
-t && -s reload
文件名匹配控制
location ~ .(abc|image)/..php$
{
deny all;
}
根据user_agent限制
if ($http_user_agent ~ ‘Spider/3.0|YoudaoBot|Tomato‘)
{
return 403;
}
deny all和return 403效果一样
Nginx解析PHP配置
vim test.com.conf 增加内容：
location ~ .php$
{
include fastcgi_params;
fastcgi_pass unix:/tmp/php-fcgi.sock; //指定php-fpm监听的地址或者socket
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name; 此处文件路径要与配置的前面部分的root 后跟路径一致
}
Nginx代理
cd /usr/local/nginx/conf/vhost
vim proxy.conf //加入如下内容
server
{
listen 80;
server_name ask.apelearn.com; 域名
location /
{
proxy_pass http://121.201.9.155/; 最终web服务器的ip
proxy_set_header Host $host; 返回的是server name，即上段定义的
proxy_set_header X-Real-IP $remote_addr; 定义变量
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 定义变量
}
}
负载均衡（代理多台）
vim /usr/local/nginx/conf/vhost/load.conf // 写入如下内容
upstream qq_com
{
ip_hash;
server 61.135.157.156:80;
server 125.39.240.113:80;
}
server
{
listen 80;
server_name www.qq.com;
location /
{
proxy_pass http://qq_com; 与upstream后跟的一致
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
upstream来指定多个web server
nginx不支持https
生成ssl密钥对
cd /usr/local/nginx/conf
openssl genrsa -des3 -out tmp.key 2048//key文件为私钥，genrsa表示生成rsa类型的私钥
openssl rsa -in tmp.key -out abc.key //转换key，取消密码
rm -f tmp.key 删除原有文件
openssl req -new -key abc.key -out abc.csr //生成证书请求文件，需要拿这个文件和私钥一起生产公钥文件
openssl x509 -req -days 365 -in abc.csr -signkey abc.key -out abc.crt 这里的abc.crt为公钥
Nginx配置ssl
vim /usr/local/nginx/conf/vhost/ssl.conf//加入如下内容
server
{
listen 443;
server_name aming.com;
index index.html index.php;
root /data/wwwroot/slx.com;
ssl on;
ssl_certificate abc.crt;
ssl_certificate_key abc.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
}
-t && -s reload //若报错unknown directive “ssl” ，需要重新编译nginx，加上--with-http_ssl_module
mkdir /data/wwwroot/aming.com
echo “ssl test page.”>/data/wwwroot/aming.com/index.html
编辑hosts，增加127.0.0.1 aming.com
curl https://aming.com/
pool
vim /usr/local/php-fpm/etc/php-fpm.conf//在[global]部分增加
include = etc/php-fpm.d/*.conf
mkdir /usr/local/php-fpm/etc/php-fpm.d/
cd /usr/local/php-fpm/etc/php-fpm.d/
vim www.conf //内容如下
[www]
listen = /tmp/www.sock
listen.mode=666
user = php-fpm
group = php-fpm
pm = dynamic
pm.max_children = 50
pm.start_servers = 20
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500
rlimit_files = 1024
继续编辑配置文件
vim slx.conf //内容如下
[slx]
listen = /tmp/aming.sock
listen.mode=666
user = php-fpm
group = php-fpm
pm = dynamic
pm.max_children = 50
pm.start_servers = 20
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500
rlimit_files = 1024
/usr/local/php/sbin/php-fpm –t
/etc/init.d/php-fpm restart
php-fpm的慢执行日志
vim /usr/local/php-fpm/etc/php-fpm.d/www.conf//加入如下内容
request_slowlog_timeout = 1 //执行超过1s进行记录，可以找到速度控制步骤（一般定2s较好，超过1s的执行时间算正常）
slowlog = /usr/local/php-fpm/var/log/www-slow.log
配置nginx的虚拟主机test.com.conf，把unix:/tmp/php-fcgi.sock改为unix:/tmp/www.sock
重新加载nginx服务
vim /data/wwwroot/test.com/sleep.php//写入如下内容
<?php echo “test slow log”;sleep(2);echo “done”;?>
curl -x127.0.0.1:80 test.com/sleep.php
cat /usr/local/php-fpm/var/log/www-slow.log
原文地址：http://blog.51cto.com/13582610/2093137
