在 Ubuntu 22.04 中配置 LNMP 并安装 WordPress (2)

### 如果你忘记了 mysql 的 root 密码，请用以下命令修改 root 密码 ###
sudo mysql -u root
mysql> ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'new_password';

# 使用 root 用户登入 mysql
mysql -u root -p

# 创建一个名为 wordpress 的数据库并设置编码方式
mysql> CREATE DATABASE wordpress DEFAULT CHARACTER SET utf8 COLLATE utf8_unicode_ci;

# 创建一个名为 wordpressuser 的用户，仅允许在 localhost 上登录
# 并设置密码为 password （记得修改成你自己的密码）
mysql> CREATE USER 'wordpressuser'@'localhost' IDENTIFIED WITH mysql_native_password BY 'password';

# 将数据库 wordpress 与其中所有表的权限赋给用户 wordpressuser
mysql> GRANT ALL ON wordpress.* TO 'wordpressuser'@'localhost';

# 刷新权限
mysql> FLUSH PRIVILEGES;

# 退出
mysql> exit

sudo apt install cron openssl
sudo systemctl enable cron
# 安装 acme.sh
curl  https://get.acme.sh | sh
source ~/.zshrc

# 设置默认 ca 为 letsencrypt
acme.sh --set-default-ca --server letsencrypt

# 这里使用 DNS-01 方式验证
# 详细内容请参考官方 wiki
# https://github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_cf
# 如果想使用 HTTP-01 方式验证的话请参考我之前写的文章
# https://blog.uuz.moe/2023/09/v2ray-websocket-tls-web/#6_配置证书
# 设置一下 cloudflare 的 API
export CF_Token=""
export CF_Zone_ID=""

# 申请二级域名 uuz.moe 与其子域 *.uuz.moe 的通配符证书
acme.sh --issue --dns dns_cf -d uuz.moe -d '*.uuz.moe'

# 创建要用来存放证书的文件夹
sudo mkdir -p /etc/mycerts

# 创建一个用户组并把自己 (ubuntu) 和 nginx 添加进去以便 nginx 访问及自动更新证书
sudo groupadd certusers
sudo usermod -aG certusers ubuntu
sudo usermod -aG certusers www-data

# 安装证书
acme.sh/acme.sh --installcert -d uuz.moe --ecc \
                          --fullchain-file /etc/mycerts/uuz.moe.crt \
                          --key-file /etc/mycerts/uuz.moe.key

# 设置自动更新
acme.sh  --upgrade  --auto-upgrade

# Diffie-Helman 密钥交换
sudo openssl dhparam -out /etc/mycerts/dhparam.pem 2048
# 调整权限
sudo chown -R ubuntu:certusers /etc/mycerts
sudo chmod -R 750 /etc/mycerts

# 接下来设置一下 cron 来每月一号重启 nginx
sudo crontab -u root -e
### 加入以下内容并保存 ###
# 每月 1 日 4:00 重载 Nginx
00 04 01 * * systemctl reload nginx

server
    {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name blog.uuz.moe ;
        index index.html index.htm index.php;
        root  /var/www/wordpress;

        ssl_certificate /etc/mycerts/uuz.moe.crt;
        ssl_certificate_key /etc/mycerts/uuz.moe.key;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers "EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5";
	ssl_session_cache builtin:1000 shared:SSL:10m;
        # openssl dhparam -out dhparam.pem 2048
        ssl_dhparam /etc/mycerts/dhparam.pem;
	
	if ($request_method !~ ^(GET|HEAD|POST)$ ) {
                return 444;
        }

        include rewrite/wordpress.conf;
        #error_page   404   /404.html;

        # Deny access to PHP files in specific directory
        location ~ /(wp-content|uploads|wp-includes|images)/.*\.php$ { deny all; }
	location = /wp-config.php { deny all; }

        include include/enable-php.conf;
        #include include/disallow-ht.conf;
        location ~ /\.ht {
            deny all;
        }
	
        location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
        {
            expires      30d;
        }

        location ~ .*\.(js|css)?$
        {
            expires      12h;
        }

        location ~ /.well-known {
            allow all;
        }

        location ~ /\.
        {
            deny all;
        }

	location = /robots.txt {access_log off; log_not_found off; }

        access_log  /var/log/nginx/blog.uuz.moe.log;
    }

location / {
        try_files $uri $uri/ /index.php?$args;
}

# Add trailing slash to */wp-admin requests.
rewrite /wp-admin$ $scheme://$host$uri/ permanent;

location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
     }

cd ~
curl -O https://wordpress.org/latest.tar.gz
tar xzvf latest.tar.gz
mkdir wordpress/wp-content/upgrade
sudo mv ./wordpress /var/www/
sudo chown -R www-data:www-data /var/www/wordpress
# 调整一下权限
sudo find  /var/www/wordpress/ -type f -exec chmod 644 {} \;
sudo find  /var/www/wordpress/ -type d -exec chmod 755 {} \;
cd /var/www/wordpress/
sudo mv wp-config-sample.php wp-config.php
# 为 wp-config.php 设置权限，禁止所有者以外的用户读取，增加安全性
sudo chmod 600 ./wp-config.php

# 从 WordPress 请求一份随机密钥，复制返回的值并填入 wp-config.php
curl -s https://api.wordpress.org/secret-key/1.1/salt/
define('AUTH_KEY',         '****');
define('SECURE_AUTH_KEY',  '****');
define('LOGGED_IN_KEY',    '****');
define('NONCE_KEY',        '****');
define('AUTH_SALT',        '****');
define('SECURE_AUTH_SALT', '****');
define('LOGGED_IN_SALT',   '****');
define('NONCE_SALT',       '****');

// ** Database settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'wordpress' );

/** Database username */
define( 'DB_USER', 'wordpressuser' );

/** Database password */
define( 'DB_PASSWORD', '****' );

/** Database hostname */
define( 'DB_HOST', 'localhost' );

/** Database charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8' );

/** The database collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );

...

define('AUTH_KEY',         'put your unique phrase here');
define('SECURE_AUTH_KEY',  'put your unique phrase here');
define('LOGGED_IN_KEY',    'put your unique phrase here');
define('NONCE_KEY',        'put your unique phrase here');
define('AUTH_SALT',        'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT',   'put your unique phrase here');
define('NONCE_SALT',       'put your unique phrase here');

...

sudo nginx -t
sudo systemctl restart nginx