安装mariadb
apt install mariadb-server
#安全设置
mysql_secure_installation设置数据库
mysql
>CREATE DATABASE typecho;
>CREATE USER 'typecho'@'localhost' IDENTIFIED BY '密码';#设置密码,注意保留单引号
>GRANT ALL ON typecho.* TO 'typecho'@'localhost';
>FLUSH PRIVILEGES;
>exit
#命令说明
CREATE USER 'username'@'host' IDENTIFIED BY 'password';
#username：你将创建的用户名
#host：指定该用户在哪个主机上可以登陆，如果是本地用户可用localhost，如果想让该用户可以从任意远程主机登陆，可以使用通配符%
#password：该用户的登陆密码，密码可以为空，如果为空则该用户可以不需要密码登陆服务器
CREATE DATABASE 数据库名;
#数据库名可以使用“Typecho”
GRANT privileges ON databasename.tablename TO 'username'@'host'
#privileges：用户的操作权限，如SELECT，INSERT，UPDATE等，如果要授予所的权限则使用ALL
#databasename：数据库名
#tablename：表名，如果要授予该用户对所有数据库和表的相应操作权限则可用*表示，如*.*第一次登录typecho时，数据库用户名为：“typecho”，密码为：“密码（设置的密码）”,数据库名为：“typecho”
安装nginx最新版
#安装先决条件：
apt install curl gnupg2 ca-certificates lsb-release debian-archive-keyring
#导入官方 nginx 签名密钥，以便 apt 可以验证包的真实性。获取密钥：
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
#验证下载的文件是否包含正确的密钥：
gpg --dry-run --quiet --no-keyring --import --import-options import-show /usr/share/keyrings/nginx-archive-keyring.gpg
#输出应包含完整的指纹 573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62
#要为稳定的 nginx 软件包设置 apt 存储库，请运行以下命令：
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/debian `lsb_release -cs` nginx" | tee /etc/apt/sources.list.d/nginx.list
#设置存储库锁定以优先使用我们的包，而不是发行版提供的包
echo -e "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900\n" | tee /etc/apt/preferences.d/99nginx
#要安装 nginx，请运行以下命令：
apt update
apt install nginx安装php8.3
apt install curl
#添加 ondrej/php 存储库，依次执行下面的命令：
apt install apt-transport-https
curl -sSLo /usr/share/keyrings/deb.sury.org-php.gpg https://packages.sury.org/php/apt.gpg
echo "deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" >> /etc/apt/sources.list.d/php.list
apt update
#安装新的PHP 8.3包：
apt install php8.3-fpm php8.3-cli php8.3-mysql php8.3-curl php8.3-mbstring php8.3-xml php8.3-gd
#测试php是否安装正确：
php -v设置php
nano /etc/php/8.3/fpm/pool.d/www.conf
找到 listen = /run/php/php8.3-fpm.sock 注释掉
然后添加 listen = 127.0.0.1:9000安装typecho
wget --no-check-certificate https://github.com/typecho/typecho/archive/refs/tags/v1.2.1.tar.gz -O typecho.tar.gz
mkdir /html
tar -zxvf typecho.tar.gz -C /html
chmod -R 777 /html申请证书
#nginx -s stop
systemctl stop nginx
apt-get install socat curl cron
curl https://get.acme.sh | sh
#通配符证书申请
mkdir /etc/nginx/ssl/
acme.sh --issue --standalone -d kkiikk.top -d www.kkiikk.top -k ec-256
acme.sh --installcert -d kkiikk.top -d www.kkiikk.top --fullchain-file /etc/nginx/ssl/kkiikk.top.crt --key-file /etc/nginx/ssl/kkiikk.top.key --ecc
#普通证书申请
#~/.acme.sh/acme.sh --set-default-ca --server letsencrypt
#~/.acme.sh/acme.sh --issue -d www.kkiikk.top --standalone -k ec-256 --force --test
#rm -rf ~/.acme.sh/www.kkiikk.top_ecc
#以上是测试
#~/.acme.sh/acme.sh --issue -d www.kkiikk.top --standalone -k ec-256 --force
#mkdir /etc/nginx/ssl/
#~/.acme.sh/acme.sh --installcert -d www.kkiikk.top --fullchainpath /etc/nginx/ssl/www.kkiikk.top.crt --keypath /etc/nginx/ssl/www.kkiikk.top.key --ecc --force配置nginx
nginx.conf配置
nano /etc/nginx/nginx.conf 编辑nginx.conf
user root;
worker_processes auto;
error_log /etc/nginx/error.log warn;
pid /run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types; #注意路径，必须写，否则可能造成css无法加载
default_type application/octet-stream;
log_format main '\$remote_addr - \$remote_user [\$time_local] "\$request" '
'\$status \$body_bytes_sent "\$http_referer" '
'"\$http_user_agent" "\$http_x_forwarded_for"';
access_log /etc/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 120;
client_max_body_size 20m;
#gzip on;
include /etc/nginx/conf.d/*.conf;
}www.conf配置
nano /etc/nginx/conf.d/www.conf编辑www.conf
server {
listen 0.0.0.0:443 ssl;
listen [::]:443 ssl;
ssl_certificate /etc/nginx/ssl/www.kkiikk.top.crt;
ssl_certificate_key /etc/nginx/ssl/www.kkiikk.top.key;
ssl_protocols TLSv1.3;
ssl_ciphers TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+ECDSA+AES128:EECDH+aRSA+AES128:RSA+AES128:EECDH+ECDSA+AES256:EECDH+aRSA+AES256:RSA+AES256:EECDH+ECDSA+3DES:EECDH+aRSA+3DES:RSA+3DES:!MD5;
server_name www.kkiikk.top;
index index.html index.htm index.php;
root /html/typecho-1.2.1;
# error_page 400 = /400.html;
location ~ [^/]\.php(/|$) {
# try_files $uri =404;
fastcgi_pass 127.0.0.1:9000; #这里注意，填写与php-fpm的listen相对应的端口
# fastcgi_index index.php;
# set $path_info $fastcgi_path_info;
set $real_script_name $fastcgi_script_name;
# if ($fastcgi_script_name ~ "^(.+?\.php)(/.+)$") {
# set $real_script_name $1;
# set $path_info $2;
# }
fastcgi_param SCRIPT_FILENAME $document_root$real_script_name;
# fastcgi_param SCRIPT_NAME $real_script_name;
# fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
}
location / {
try_files $uri $uri/ /index.php?$args;
}
# Config for 0-RTT in TLSv1.3
ssl_early_data on;
ssl_stapling on;
ssl_stapling_verify on;
proxy_set_header Early-Data $ssl_early_data;
add_header Strict-Transport-Security "max-age=31536000";
}
server {
listen 80;
listen [::]:80; #没有ipv6的话要注释掉这行
server_name www.kkiikk.top;
return 301 https://www.kkiikk.top$request_uri;
}
server {
listen 80;
listen [::]:80; #没有ipv6的话要注释掉这行
server_name kkiikk.top;
return 301 https://www.kkiikk.top$request_uri;
}重启程序
systemctl restart php8.3-fpm
systemctl restart nginx