{"id":130,"date":"2026-06-30T01:33:23","date_gmt":"2026-06-30T01:33:23","guid":{"rendered":"https:\/\/www.skillnotes.cloud\/?p=130"},"modified":"2026-06-30T09:03:34","modified_gmt":"2026-06-30T09:03:34","slug":"wordpress%e6%9c%ac%e7%ab%99%e6%90%ad%e5%bb%ba%e8%bf%87%e7%a8%8b","status":"publish","type":"post","link":"https:\/\/www.skillnotes.cloud\/?p=130","title":{"rendered":"wordpress\u672c\u7ad9\u642d\u5efa\u8fc7\u7a0b"},"content":{"rendered":"\n<ul class=\"wp-block-list\">\n<li>\u51c6\u5907\u5de5\u4f5c<\/li>\n<\/ul>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u8d2d\u4e70\u4e91\u4e3b\u673a<\/li>\n\n\n\n<li>\u8d2d\u4e70\u5bf9\u5e94\u7684\u57df\u540d\u5e76\u5b8c\u6210\u5907\u6848\u6ce8\u518c<\/li>\n<\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u672c\u7ad9\u4f7f\u7528\u5b9d\u5854Linux\u53d1\u884c\u7248\uff0c\u9664nginx\u4e4b\u5916\u4f7f\u7528\u5b9d\u5854Linux dnf \u5b89\u88c5\u8f6f\u4ef6<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u4ece <a href=\"https:\/\/nginx.org\/en\/download.html\">https:\/\/nginx.org\/en\/download.html<\/a> \u4e0b\u8f7dnginx\u5e76\u7f16\u8bd1\uff0c\u7531\u4e8enginx\u76f4\u63a5\u9762\u5bf9\u516c\u7f51\uff0c\u4fee\u6539\u90e8\u5206\u7f16\u8bd1\u53c2\u6570<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code alignwide\"><code>\u914d\u7f6e\u7f16\u8bd1\u53c2\u6570\u9009\u9879\ndeclare -x CC=\"gcc\"\ndeclare -x CFLAGS=\"-O2 -Wall -fstack-protector-all -mindirect-branch=thunk -mfunction-return=thunk\"\n\n\u4f7f\u7528 \n.\/configure --user=httpd --group=httpd --with-http_ssl_module\n\u914d\u7f6enginx\n\n\u4f7f\u7528\nmake install \u5b89\u88c5nginx\u5230\u76ee\u6807\u6587\u4ef6\u5939<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u4e3anginx\u670d\u52a1\u6dfb\u52a0\u57fa\u4e8enft\u7684rate\u63a7\u5236\uff0c\u4e0b\u9762\u7684\u4f8b\u5b50\u4e3a\u4e00\u4e2a\u57fa\u7840\u9632\u706b\u5899\u914d\u7f6e<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code alignwide\"><code>\/etc\/nft_protection.nft\n\ntable inet filter {\n\tset synflood {\n\t\ttype ipv4_addr\n\t\tsize 65535\n\t\tflags dynamic\n\t}\n\n\tset limitrate {\n\t\ttype ipv4_addr\n\t\tsize 65535\n\t\tflags dynamic\n\t}\n\n\tchain input {\n\t\ttype filter hook input priority filter; policy accept;\n\t\ttcp dport 80 ct state new update @synflood { ip saddr limit rate over 20\/second burst 5 packets } counter reject with tcp reset\n\t\ttcp dport 80 ct state new update @limitrate { ip saddr ct count over 100 } counter reject with tcp reset\n                tcp dport 443 ct state new update @synflood { ip saddr limit rate over 20\/second burst 5 packets } counter reject with tcp reset\n                tcp dport 443 ct state new update @limitrate { ip saddr ct count over 100 } counter reject with tcp reset\n\t}\n}\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u4fee\u6539\u9ed8\u8ba4\u7684 nginx systemd service\u5e76\u914d\u7f6eletsencrypt\u7684\u53c2\u6570,\u5220\u9664nginx\u8fd0\u884c\u65f6\u4f7f\u7528root\u8d26\u53f7\u8fd0\u884c\uff0c\u7531\u4e8enginx\u76f4\u63a5\u63d0\u4f9b\u5bf9\u5916\u7684https\/https\u8bbf\u95ee\uff0c\u6240\u4ee5\u5728systemd.service\u4e2d\u6839\u636e\u4f7f\u7528\u9700\u8981\u914d\u7f6e\u6c99\u7bb1<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code alignwide\"><code>\/usr\/lib\/systemd\/system\/nginx.service\n\n&#91;Unit]\nDescription=The NGINX HTTP and reverse proxy server\nAfter=network.target remote-fs.target nss-lookup.target\n\n&#91;Service]\nEnvironment=\"LD_PRELOAD=\/usr\/lib64\/libclang_rt.scudo_standalone.so\"#\u6839\u636e\u9700\u8981\u914d\u7f6e\uff0c\u672c\u7ad9\u4f7f\u7528LLVM\u7684libscudo\u66ff\u6362glibc\u7684\u5185\u5b58\u5206\u914d\u5668\nType=forking\nExecStartPre=+\/usr\/sbin\/nft flush table inet filter           # nft \u9700\u8981root\u6743\u9650\u914d\u7f6enetfilter\nExecStartPre=+\/usr\/sbin\/nft -f \/etc\/nft_protection.nft        # nft \u9700\u8981root\u6743\u9650\u914d\u7f6enetfilter\nExecStartPre=\/usr\/local\/bin\/nginx -t -e \/var\/log\/nginx\/logs\/error.log -c \/usr\/local\/nginx\/conf\/nginx.conf\nExecStart=\/usr\/local\/bin\/nginx -e \/var\/log\/nginx\/logs\/error.log -c \/usr\/local\/nginx\/conf\/nginx.conf\nExecReload=\/usr\/local\/bin\/nginx -s reload -e \/var\/log\/nginx\/logs\/error.log -c \/usr\/local\/nginx\/conf\/nginx.conf\nExecStartPost=\/bin\/chmod 664 \/usr\/local\/nginx\/logs\/nginx.pid\nPrivateTmp=true\nUser=httpd\nGroup=httpd\nAmbientCapabilities=CAP_NET_BIND_SERVICE\nProtectSystem=full\nProtectHome=true\nProtectKernelTunables=true\nProtectKernelModules=true\nLockPersonality=true\nSystemCallFilter=~@chown @module @clock @privileged @keyring @reboot @swap @sync @debug @pkey @cpu-emulation @aio @mount\nSystemCallErrorNumber=EPERM \nInaccessiblePaths=\/root \/home \/boot\nBindPaths=\/usr\/local\/nginx\/etc:\/etc\nReadOnlyPaths=\/etc\/letsencrypt\nReadWritePaths=\/var\/log\/nginx\/logs \/usr\/local\/nginx\/logs\/ \/usr\/local\/nginx\/client_body_temp\/ \/usr\/local\/nginx\/fastcgi_temp\/ \/usr\/local\/nginx\/scgi_temp\/ \/usr\/local\/nginx\/uwsgi_temp\/ \/usr\/local\/nginx\/proxy_temp\/\nSystemCallArchitectures=native\nNoNewPrivileges=true\nMemoryDenyWriteExecute=true\nPrivateDevices=true\n\n&#91;Install]\nWantedBy=multi-user.target\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u914d\u7f6enginx\u7684\u914d\u7f6e\u6587\u4ef6\/usr\/local\/nginx\/etc\/conf\/nginx.conf, certbot\u4f1a\u66f4\u65b0\u6b64\u914d\u7f6e\u6587\u4ef6\u6dfb\u52a0\u5bf9\u5e94\u7684\u8bc1\u4e66\u4fe1\u606f<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code alignwide\"><code>\/usr\/local\/nginx\/etc\/conf\/nginx.conf\n\nworker_processes  1;\n\nerror_log  \/var\/log\/nginx\/logs\/error.log;\nerror_log  \/var\/log\/nginx\/logs\/error.log  notice;\nerror_log  \/var\/log\/nginx\/logs\/error.log  info;\n\n\nevents {\n    worker_connections  1024;\n}\n\nhttp {\n    include       mime.types;\n    include       fastcgi.conf;\n    default_type  application\/octet-stream;\n\n    error_log   \/var\/log\/nginx\/logs\/error.log;\n    server_tokens off;\n    sendfile        on;\n    fastcgi_buffering off;\n\n    keepalive_timeout  65;\n\n    upstream php {\n        server unix:\/var\/run\/php-fpm\/www.sock;\n    }\n\n    server {\n        server_name  \u5bf9\u5e94\u7684\u57df\u540d;\n\n\tclient_max_body_size 5m;\n\n\troot \/var\/lib\/www\/html;\n        index index.php;\n\n        location \/ {\n            try_files $uri $uri\/ \/index.php?$args;\n\t}\n\n        location ~ \\.php$ {\n            try_files $uri =404;\n            include fastcgi.conf;\n            fastcgi_pass php;\n        }\n\n\tlocation ~* \\.(js|css|png|jpg|jpeg|gif|ico)$ {\n\t    expires 1d;\n\t    log_not_found on;\n\t    try_files $uri $uri\/ \/index.php?$args; \n\t}\n\n        location ~* \\.webm$ {\n            gzip off;\n            limit_rate 5m;\n\t    tcp_nopush on;\n\t    tcp_nodelay on;\n\t    sendfile on;\n\t    max_ranges 5;\n        }\n\n\t# Deny access to hidden files (like .htaccess or .git)\n\tlocation ~ \/\\. {\n\t    deny all;\n\t    access_log off;\n\t    log_not_found off;\n\t}\n\n\t# Security: Deny direct execution of PHP files in the uploads folder\n\tlocation ~* \/(?:uploads|files)\/.*\\.php$ {\n\t    deny all;\n\t}\n\n        # redirect server error pages to the static page \/50x.html\n        #\n        error_page   500 502 503 504  \/50x.html;\n        location = \/50x.html {\n            root   html;\n        }\n\n        listen 443 ssl;\n\n    }\n\n}\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u4f7f\u7528\u53d1\u884c\u7248\u5b89\u88c5php-fpm, mariadb\u548ccertbots<\/li>\n\n\n\n<li>\u914d\u7f6ephp-fpm\u670d\u52a1\u548cnginx\u914d\u5957\u5de5\u4f5c<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code alignwide\"><code>\/usr\/lib\/systemd\/system\/php-fpm.service\n\n&#91;Unit]\nDescription=The PHP FastCGI Process Manager\nAfter=syslog.target network.target\n\n&#91;Service]\nType=notify\nExecStart=\/usr\/sbin\/php-fpm --nodaemonize\nExecReload=\/bin\/kill -USR2 $MAINPID\nPrivateTmp=true\nRuntimeDirectory=php-fpm\nRuntimeDirectoryMode=0755\nProtectSystem=full\nProtectHome=true\nProtectKernelTunables=true\nProtectKernelModules=true\nLockPersonality=true\nSystemCallFilter=~@chown @module @clock @privileged @keyring @reboot @swap @sync @debug @pkey @cpu-emulation @aio @mount\nSystemCallErrorNumber=EPERM \nReadWritePaths=\/var\/log\/php-fpm\nInaccessiblePaths=\/root \/home \/boot\nBindPaths=\/var\/lib\/php\/etc:\/etc\nSystemCallArchitectures=native\nNoNewPrivileges=true\nMemoryDenyWriteExecute=true\nPrivateDevices=true\nUser=httpd\nGroup=httpd\nRestrictAddressFamilies=AF_UNIX AF_INET\nTasksMax=256\nAmbientCapabilities=CAP_NET_ADMIN\nCapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE\n\n\n&#91;Install]\nWantedBy=multi-user.target\n\n\n\n\/var\/lib\/php\/etc\/php.ini\n\nexpose_php = Off<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u914d\u7f6emariadb\u53ea\u4f7f\u7528unix socket\u901a\u4fe1<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code alignwide\"><code>\/usr\/lib\/systemd\/system\/mariadb.service\n\n&#91;Unit]\nDescription=MariaDB 10.11 database server\nDocumentation=man:mariadbd(8)\nDocumentation=https:\/\/mariadb.com\/kb\/en\/library\/systemd\/\nAfter=network.target\n\n&#91;Install]\nWantedBy=multi-user.target\nAlias=mysql.service\nAlias=mysqld.service\n\n&#91;Service]\nEnvironment=\"LD_PRELOAD=\/usr\/lib64\/libclang_rt.scudo_standalone.so\"\nType=notify\nUser=mysql\nGroup=mysql\n\nExecStartPre=\/usr\/libexec\/mariadb-check-socket\n# '%n' expands to 'Full unit name'; man systemd.unit\nExecStartPre=\/usr\/libexec\/mariadb-prepare-db-dir %n\n# MYSQLD_OPTS here is for users to set in \/etc\/systemd\/system\/mariadb@.service.d\/MY_SPECIAL.conf\n# Note: we set --basedir to prevent probes that might trigger SELinux alarms,\n# per bug #547485\nExecStart=\/usr\/libexec\/mariadbd --basedir=\/usr $MYSQLD_OPTS $_WSREP_NEW_CLUSTER\nExecStartPost=\/usr\/libexec\/mariadb-check-upgrade\n\n# Setting this to true can break replication and the Type=notify settings\n# See also bind-address MariaDB option.\nPrivateNetwork=false\nProtectSystem=full\nProtectHome=true\nProtectKernelModules=true\nLockPersonality=true\nReadWritePaths=\/var\/lib\/mysql \/var\/log\/mariadb \/run\/mariadb\nSystemCallArchitectures=native\nNoNewPrivileges=true\nMemoryDenyWriteExecute=true\nPrivateDevices=true\nRestrictAddressFamilies=AF_UNIX\n\nKillSignal=SIGTERM\n\n# Don't want to see an automated SIGKILL ever\nSendSIGKILL=no\n\n# Restart crashed server only, on-failure would also restart, for example, when\n# my.cnf contains unknown option\nRestart=on-abort\nRestartSec=5s\n\nUMask=007\n\n# Give a reasonable amount of time for the server to start up\/shut down\nTimeoutSec=300\n\n# Place temp files in a secure directory, not \/tmp\nPrivateTmp=true\n\n\n\u914d\u7f6emariadb\u670d\u52a1\u7aef\u914d\u7f6e\n\/etc\/my.cnf.d\/mariadb-server.cnf\n\n&#91;mysqld]\ndatadir=\/var\/lib\/mysql\nsocket=\/var\/lib\/mysql\/mysql.sock\nlog-error=\/var\/log\/mariadb\/mariadb.log\npid-file=\/run\/mariadb\/mariadb.pid\n\n&#91;galera]\nskip-networking\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u5b89\u88c5\u5b8c\u6210certbot\u4e4b\u540e\u914d\u7f6e\u81ea\u52a8\u66f4\u65b0\/usr\/lib\/systemd\/system\/certbot-renew.service<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code alignwide\"><code>&#91;Unit]\nDescription=This service automatically renews any certbot certificates found\n\n&#91;Service]\nEnvironmentFile=\/etc\/sysconfig\/certbot\nType=oneshot\nExecStart=+\/usr\/bin\/certbot renew --noninteractive --no-random-sleep-on-renew $PRE_HOOK $POST_HOOK $RENEW_HOOK $DEPLOY_HOOK $CERTBOT_ARGS      # certbot\u9700\u8981root\u6743\u9650\uff0c\u4f7f\u7528systemctl\u64cd\u4f5cnginx,\u672c\u7ad9\u672a\u81ea\u5b9a\u4e49hook,\u4f7f\u7528root\u8fd0\u884ccertbot\nUser=certbot                            \nGroup=httpd                             \nPrivateTmp=true\nProtectSystem=full\nProtectHome=true\nAmbientCapabilities=CAP_NET_BIND_SERVICE\nProtectKernelTunables=true\nProtectKernelModules=true\nLockPersonality=true\nSystemCallFilter=~@chown @module @clock @privileged @keyring @reboot @swap @sync @debug @pkey @cpu-emulation @aio @mount\nSystemCallErrorNumber=EPERM \nBindPaths=\/usr\/local\/nginx\/etc:\/etc\nReadWritePaths=\/var\/lib\/letsencrypt \/var\/log\/letsencrypt \/etc\/letsencrypt \/usr\/local\/nginx\/logs\/ \/var\/log\/nginx\/ \/usr\/local\/nginx\/conf\/\nInaccessiblePaths=\/root \/home \/boot \/dev \nSystemCallArchitectures=native\nNoNewPrivileges=true\nMemoryDenyWriteExecute=true\nPrivateDevices=true\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u4fee\u6539\u8fd0\u884c\u65f6\u9700\u8981\u7684\u6587\u4ef6\u4ece\/etc\/\u590d\u5236\u5230\/usr\/local\/nginx\/etc\/<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code alignwide\"><code>sudo cp \/etc\/group \/usr\/local\/nginx\/etc\/\nsudo cp \/etc\/passwd \/usr\/local\/nginx\/etc\/\n\n\u5220\u9664\/usr\/local\/nginx\/etc\/group\u548c\/usr\/local\/nginx\/etc\/passwd\u6587\u4ef6\u5185\u7684\u8d26\u53f7\u53ea\u4fdd\u7559httpd\u548c\u5fc5\u8981\u7684\u8d26\u53f7\n\n\u590d\u5236\u6240\u6709nginx\u76f8\u5173\u7684\u914d\u7f6e\u5230 \/usr\/local\/nginx\/etc\/\n\nsudo cp -rf \/etc\/crypto-policies \/usr\/local\/nginx\/etc\/\nsudo cp -rf \/etc\/letsencrypt \/usr\/local\/nginx\/etc\/\nsudo cp -rf \/etc\/nginx \/usr\/local\/nginx\/etc\/\nsudo cp -rf \/etc\/pki \/usr\/local\/nginx\/etc\/\nsudo cp -rf \/etc\/ssl \/usr\/local\/nginx\/etc\/\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u4fee\u6539\u8fd0\u884c\u65f6\u9700\u8981\u7684\u6587\u4ef6\u4ece\/etc\/\u590d\u5236\u5230\/var\/lib\/php\/etc\/<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code alignwide\"><code>sudo cp \/etc\/passwd \/var\/lib\/php\/etc\/\n\n\u5220\u9664 \/var\/lib\/php\/etc\/passwd \u5185\u7684\u8d26\u53f7 \u53ea\u4fdd\u7559\u9700\u8981\u7684httpd\n\n\u590d\u5236\u6240\u6709php\u76f8\u5173\u914d\u7f6e\u5230 \/var\/lib\/php\/etc\/\n\nsudo cp -rf \/etc\/php.d \/var\/lib\/php\/etc\/\nsudo cp \/etc\/php.ini \/var\/lib\/php\/etc\/\nsudo cp -rf \/etc\/wordpress \/var\/lib\/php\/etc\/\nsudo cp -rf \/etc\/php-fpm.d \/var\/lib\/php\/etc\/\n\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u4f7f\u7528systemctl \u91cd\u542fnginx, php-fpm <\/li>\n\n\n\n<li>\u4f7f\u7528systemctl \u6d4b\u8bd5 certbot-renew <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-130","post","type-post","status-publish","format-standard","hentry","category-6"],"_links":{"self":[{"href":"https:\/\/www.skillnotes.cloud\/index.php?rest_route=\/wp\/v2\/posts\/130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.skillnotes.cloud\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.skillnotes.cloud\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.skillnotes.cloud\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.skillnotes.cloud\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=130"}],"version-history":[{"count":14,"href":"https:\/\/www.skillnotes.cloud\/index.php?rest_route=\/wp\/v2\/posts\/130\/revisions"}],"predecessor-version":[{"id":195,"href":"https:\/\/www.skillnotes.cloud\/index.php?rest_route=\/wp\/v2\/posts\/130\/revisions\/195"}],"wp:attachment":[{"href":"https:\/\/www.skillnotes.cloud\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.skillnotes.cloud\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.skillnotes.cloud\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}