亚马逊云 AWS LightSail 搭建高性能 LNMP 环境并安全部署 Wordpress

# 打开 80 和 443 端口，如果需要的话
firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --permanent --zone=public --add-service=https
firewall-cmd --reload
# 安装 MariaDB 10.3
printf '%s\n' '[mariadb]' 'name = MariaDB' 'baseurl = http://yum.mariadb.org/10.3/centos7-amd64' 'gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB' 'gpgcheck=1' > /etc/yum.repos.d/MariaDB.repo
yum -y install MariaDB-server MariaDB-client
# Start+Enable MariaDB
systemctl start mariadb
systemctl enable mariadb
# 安装 PHP-FPM 7.3
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
yum -y install http://rpms.remirepo.net/enterprise/remi-release-7.rpm
yum -y install yum-utils
yum-config-manager --disable remi-php54
yum-config-manager --enable remi-php73
yum -y install php php-fpm php-mysqlnd php-zip php-devel php-gd php-mcrypt php-mbstring php-curl php-xml php-pear php-bcmath php-json php-pdo php-pecl-apcu php-pecl-apcu-devel
php -v
# Start+Enable PHP-FPM
systemctl start php-fpm
systemctl enable php-fpm
# 为 CentOS 7 配置 Nginx 的 Repo
printf '%s\n' '[nginx]' 'name=nginx repo' 'baseurl=http://nginx.org/packages/mainline/centos/7/$basearch/' 'gpgcheck=0' 'enabled=1' > /etc/yum.repos.d/nginx.repo
# 安装 Nginx
yum -y install nginx
# Start+Enable Nginx
systemctl start nginx
systemctl enable nginx
# 为 Wordpress 配置虚拟主机
mkdir /etc/nginx/sites-available
printf '%s\n' 'server {' '    listen       80;' '    server_name  你的域名;' '    # note that these lines are originally from the "location /" block' '    root   /var/www/你的域名;' '    index index.php index.html index.htm;' '    location / {' '        try_files $uri $uri/ =404;' '    }' '    error_page 404 /404.html;' '    location = /50x.html {' '        root /var/www/你的域名;' '    }' '    location ~ \.php$ {' '        try_files $uri =404;' '        fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;' '        fastcgi_index index.php;' '        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;' '        include fastcgi_params;' '    }' '}' > /etc/nginx/sites-available/你的域名
mkdir /etc/nginx/sites-enabled
ln -s /etc/nginx/sites-available/你的域名 /etc/nginx/sites-enabled/你的域名
# 删除 Nginx 默认页
rm -f /etc/nginx/conf.d/default.conf
nginx -s reload
# 准备最新版的 Wordpress
mkdir -p /var/www/你的域名
yum -y install wget
wget wordpress.org/latest.tar.gz
tar -xzvf latest.tar.gz
mv wordpress/* /var/www/你的域名
chown -R nginx:nginx /var/www/你的域名
cp /var/www/你的域名/wp-config-sample.php /var/www/你的域名/wp-config.php
# 为 Nginx 配置 SELinux 上下文
semanage fcontext -a -t httpd_config_t "/etc/nginx/sites-enabled(/.*)?"
restorecon -Rv /etc/nginx/sites-enabled
# 为 Wordpress 配置 SELinux 上下文
semanage fcontext -a -t httpd_sys_content_t "/var/www/你的域名(/.*)?"
semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/你的域名/wp-content(/.*)?"
semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/你的域名/wp-config\.php"
restorecon -Rv /var/www/你的域名

sudo su
vi /etc/ssh/sshd_config
semanage port -a -t ssh_port_t -p tcp #新的SSH端口
systemctl restart sshd

mysql_secure_installation

mysql -u root -p

create database 数据库;
create user 用户名@localhost identified by '密码';
grant all privileges on 数据库.* to 用户名@localhost;
flush privileges;

vi /etc/php-fpm.d/www.conf

vi /etc/php.ini

cgi.fix_pathinfo=0

systemctl restart php-fpm
netstat -pl | grep php-fpm

chown -R nginx:nginx /var/run/php-fpm
semanage fcontext -a -t httpd_var_run_t "/var/run/php-fpm(/.*)?"
restorecon -Rv /var/run/php-fpm

vi /etc/nginx/nginx.conf

nginx -t
nginx -s reload

vi /var/www/你的域名/wp-config.php

define( 'DB_NAME', '数据库名' );
define( 'DB_USER', '数据库用户名' );
define( 'DB_PASSWORD', '数据库用户密码' );

define('AUTH_KEY',         '-$[|c@QAw)nEh0njZ,e>me4q4NYFGnSetx^F-NS(R_Q~wCsH+In}:m4>L kA,4e<');
define('SECURE_AUTH_KEY',  'IUx~>A+0jgY_;N3N|(i!| nv4BIG4QkgOGWd/$~4<y[(4AVo-MQ1dD*u11%MD?}6');
define('LOGGED_IN_KEY',    'Wa=~154<I+y+R(_8nz|F<)QvtLT;u):S.rP{l8fCZAL?h>Pv3$S+qMG.rJAx%pzz');
define('NONCE_KEY',        '6|m>?--b8Us-Z_<bewkdK^1!cHukOA-#|RJGR(U`X[<5<0Ov|toxBSZm+,B8,9@K');
define('AUTH_SALT',        '}hO/6gM3ySFjG?xU.FH8<x5rN|;x%Sf2tBF0 M9S[OZjp!t&vDjJ~`F&|waZE7f~');
define('SECURE_AUTH_SALT', '?{+z2orv|wm_vidI!byy5IyF2H+53axITa%8[s.rjY<1Z,j9EV)P>?{FGaJm,Qto');
define('LOGGED_IN_SALT',   '1!9~R,eU:{O*1KH~MH5M <$!@^-w|_1n{CA5VuH%A5+{Syxf2};Y{~?WA)V;SmB!');
define('NONCE_SALT',       '[=2vpM1cBlowmYo,]} 9$U>ImHA+-Xdi8.9<XF|jl5LbSI<+:VFa(CuIvl$tSV#1');

ls -lZ /var/www/你的域名
ls -lZ /etc/nginx/sites-enabled/你的域名