最近域名主机双双到期了，原来的服务商建议域名迁出，于是转移到了Godaddy，过程很顺利。主机迁到了linode，一个是因为它便宜，另一个是因为想给自己的网站加个SSL证书。
首先是服务器环境Apache, PHP, MaraiDB(MySQL)的配置。 linode 创建主机很简单，点点就好了，然后可以去启动机器，设置SSH访问。
yum update yum install httpd php php-cli php-mbstring php-pdo php-mysql php-gd php-tidy
启动Apache
systemctl start httpd.service systemctl enable httpd.service
然后直接访问你的服务器ip，可以看到默认的欢迎界面
ip addr show eth0 | grep inet | awk '{ print $2; }' | sed 's/\/.*$//'
curl 1.139.x.x
CentOS 7目前默认不提供Mysql Server，而是Mariadb。MySQL的命令行仍然可以使用并兼容， PHP仍然可以使用PDO及MySQL扩展访问它。
yum install mariadb-server mariadb systemctl start mariadb
然后设置管理员密码及安全设置
mysql_secure_installation
开机启动Mariadb服务
systemctl enable mariadb.service
可以在/var/www/html目录下创建一个测试脚本来验证安装情况
<?php phpinfo();
WordPress则是从原本的数据库全部导出，文件全部打包回来。
在Linode上创建对应的数据库，用户及导入脚本
MariaDB [(none)]> CREATE database courages_wordpress; MariaDB [(none)]> CREATE USER courages_wp IDENTIFIED BY '*************'; MariaDB [(none)]> grant all privileges on courages_wordpress.* to [email protected] identified by '*************';
导入数据库
mysql -uroot -p courages_wordpress < /tmp/wordpress.sql
将文件解压并复制到/var/www/html目录
tar -xzvf backup.tar.gz cp -R backup/public_html/* /var/www/html/* chown -R apache:apache /var/www/html
更改Apache设置AllowOverride 为all，以便支持WordPress的链接重定向。
vim /etc/httpd/conf/httpd.conf
<Directory "/var/www/html">
#
# Possible values for the Options directive are "None", "All",
# or any combination of:
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
#
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.
#
# The Options directive is both complicated and important. Please see
# http://httpd.apache.org/docs/2.4/mod/core.html#options
# for more information.
#
Options Indexes FollowSymLinks
#
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
# Options FileInfo AuthConfig Limit
#
AllowOverride All
#
# Controls who can get stuff from this server.
#
Require all granted
</Directory>
重启Apache
systemctl restart httpd.service
在linode的DNS manager那里新增一个新的domain，在服务器列表里面选中对应的服务器就可以了，然后就可以看到对应的域名解析信息。
域名转移会要求一个key，从原注册商那里解锁并获得，在Godday输入Key后，它会发邮件与你确认，然后将DNS域名服务器改为linode的域名服务器就好了。
Let’s Encrypt提供免费90天的SSL证书，如果证书到期了就需要再次更新下。如果你有shell权限，它推荐使用Cerbot来安装和更新证书。CentOS 7 + Apache的安装非常简单。首先安装EPEL源，要不然找不到对应的安装包
yum install epel-release yum install certbot-apache certbot --authenticator webroot --installer apache
设置一下域名，网站目录及域名重定向
Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator webroot, Installer apache Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel): <[email protected]> Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org ------------------------------------------------------------------------------- Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must agree in order to register with the ACME server at https://acme-v01.api.letsencrypt.org/directory ------------------------------------------------------------------------------- (A)gree/(C)ancel: A ------------------------------------------------------------------------------- Would you be willing to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about EFF and our work to encrypt the web, protect its users and defend digital rights. ------------------------------------------------------------------------------- (Y)es/(N)o: Y Starting new HTTPS connection (1): supporters.eff.org No names were found in your configuration files. Please enter in your domain name(s) (comma and/or space separated) (Enter 'c' to cancel): courages.us Obtaining a new certificate Performing the following challenges: http-01 challenge for courages.us Input the webroot for courages.us: (Enter 'c' to cancel): /var/www/html Waiting for verification... Cleaning up challenges We were unable to find a vhost with a ServerName or Address of courages.us. Which virtual host would you like to choose? (note: conf files with multiple vhosts are not yet supported) ------------------------------------------------------------------------------- 1: ssl.conf | | HTTPS | Enabled ------------------------------------------------------------------------------- Press 1 [enter] to confirm the selection (press 'c' to cancel): 1 Deploying Certificate for courages.us to VirtualHost /etc/httpd/conf.d/ssl.conf Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. ------------------------------------------------------------------------------- 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. ------------------------------------------------------------------------------- Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 Created redirect file: le-redirect-courages.us.conf Rollback checkpoint is empty (no changes made?) ------------------------------------------------------------------------------- Congratulations! You have successfully enabled https://courages.us You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=courages.us -------------------------------------------------------------------------------
在浏览器访问一下域名即有小绿钥匙。可以在/etc/httpd/conf.d/ssl.conf查看相应的SSL证书配置
<VirtualHost _default_:443> ServerName courages.us SSLCertificateFile /etc/letsencrypt/live/courages.us/cert.pem SSLCertificateKeyFile /etc/letsencrypt/live/courages.us/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf SSLCertificateChainFile /etc/letsencrypt/live/courages.us/chain.pem </VirtualHost>
由于证书在90天后即将失效，可以加入crontab自动更新
certbot renew --dry-run crontab -e 0 0,12 * * * python -c 'import random; import time; time.sleep(random.random() * 3600)' && certbot renew
最近登录后台发现WordPress提示升级到PHP 7.3，按照它的指示
- 使用UpdraftPlus备份网站和数据库，支持Google Drive, Dropbox
- 使用PHP Compatibility Checker检测代码及扩展是否支持升级到PHP 7.3
在CentOS 7上升级PHP5.4 到PHP 7.3很简单：
首先安装Remi和EPEL仓库
yum install wget wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm wget http://rpms.remirepo.net/enterprise/remi-release-7.rpm rpm -Uvh remi-release-7.rpm rpm -Uvh epel-release-latest-7.noarch.rpm yum install yum-utils
启用remi-php73的源，yum update升级会自动升级PHP及扩展
[[email protected] ~]# yum-config-manager --enable remi-php73 [[email protected] ~]# yum repolist Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirrors.linode.com * epel: kartolo.sby.datautama.net.id * extras: mirrors.linode.com * remi-php73: mirror.xeonbd.com * remi-safe: mirror.xeonbd.com * updates: mirrors.linode.com repo id repo name status base/7/x86_64 CentOS-7 - Base 10,019 epel/x86_64 Extra Packages for Enterprise Linux 7 - x86_64 13,051 extras/7/x86_64 CentOS-7 - Extras 385 remi-php73 Remi's PHP 7.3 RPM repository for Enterprise Linux 7 - x86_64 305 remi-safe Safe Remi's RPM repository for Enterprise Linux 7 - x86_64 3,188 updates/7/x86_64 CentOS-7 - Updates 1,511 repolist: 28,825 yum update -y
检查PHP版本，重启Apache
[[email protected] ~]# php -v PHP 7.3.4 (cli) (built: Apr 2 2019 13:48:50) ( NTS ) Copyright (c) 1997-2018 The PHP Group Zend Engine v3.3.4, Copyright (c) 1998-2018 Zend Technologies [[email protected] ~]# systemctl restart httpd
也可以禁用对应PHP版本的源，选择性升级PHP到对应版本
yum-config-manager --disable remi-php72
顺便升级下php-mcrypt和ZipArchive
yum install php-mcrypt yum install php-pecl-zip
参考链接：
How To Install Linux, Apache, MySQL, PHP (LAMP) stack On CentOS 7
How to enable EPEL repository?
How to Secure Your Server
Introduction to FirewallD on CentOS
How to Upgrade PHP 5.6 to PHP 7.2 on CentOS VestaCP