最近域名主机双双到期了，原来的服务商建议域名迁出，于是转移到了Godaddy，过程很顺利。主机迁到了linode，一个是因为它便宜，另一个是因为想给自己的网站加个SSL证书。
首先是服务器环境Apache, PHP, MaraiDB(MySQL)的配置。 linode 创建主机很简单，点点就好了，然后可以去启动机器，设置SSH访问。
yum update yum install httpd php php-cli php-mbstring php-pdo php-mysql php-gd php-tidy
启动Apache
systemctl start httpd.service systemctl enable httpd.service
然后直接访问你的服务器ip，可以看到默认的欢迎界面
ip addr show eth0 | grep inet | awk '{ print $2; }' | sed 's/\/.*$//'
curl 1.139.x.x
CentOS 7目前默认不提供Mysql Server，而是Mariadb。MySQL的命令行仍然可以使用并兼容， PHP仍然可以使用PDO及MySQL扩展访问它。
yum install mariadb-server mariadb systemctl start mariadb
然后设置管理员密码及安全设置
mysql_secure_installation
开机启动Mariadb服务
systemctl enable mariadb.service
可以在/var/www/html目录下创建一个测试脚本来验证安装情况
<?php phpinfo();
WordPress则是从原本的数据库全部导出，文件全部打包回来。
在Linode上创建对应的数据库，用户及导入脚本
MariaDB [(none)]> CREATE database courages_wordpress; MariaDB [(none)]> CREATE USER courages_wp IDENTIFIED BY '*************'; MariaDB [(none)]> grant all privileges on courages_wordpress.* to courages_wp@localhost identified by '*************';
导入数据库
mysql -uroot -p courages_wordpress < /tmp/wordpress.sql
将文件解压并复制到/var/www/html目录
tar -xzvf backup.tar.gz cp -R backup/public_html/* /var/www/html/* chown -R apache:apache /var/www/html
更改Apache设置AllowOverride 为all，以便支持WordPress的链接重定向。
vim /etc/httpd/conf/httpd.conf
<Directory "/var/www/html">
#
# Possible values for the Options directive are "None", "All",
# or any combination of:
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
#
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.
#
# The Options directive is both complicated and important. Please see
# http://httpd.apache.org/docs/2.4/mod/core.html#options
# for more information.
#
Options Indexes FollowSymLinks
#
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
# Options FileInfo AuthConfig Limit
#
AllowOverride All
#
# Controls who can get stuff from this server.
#
Require all granted
</Directory>
重启Apache
systemctl restart httpd.service
在linode的DNS manager那里新增一个新的domain，在服务器列表里面选中对应的服务器就可以了，然后就可以看到对应的域名解析信息。
域名转移会要求一个key，从原注册商那里解锁并获得，在Godday输入Key后，它会发邮件与你确认，然后将DNS域名服务器改为linode的域名服务器就好了。
Let’s Encrypt提供免费90天的SSL证书，如果证书到期了就需要再次更新下。如果你有shell权限，它推荐使用Cerbot来安装和更新证书。CentOS 7 + Apache的安装非常简单。首先安装EPEL源，要不然找不到对应的安装包
yum install epel-release yum install certbot-apache certbot --authenticator webroot --installer apache
设置一下域名，网站目录及域名重定向
Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator webroot, Installer apache Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel): <email@example.com> Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org ------------------------------------------------------------------------------- Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must agree in order to register with the ACME server at https://acme-v01.api.letsencrypt.org/directory ------------------------------------------------------------------------------- (A)gree/(C)ancel: A ------------------------------------------------------------------------------- Would you be willing to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about EFF and our work to encrypt the web, protect its users and defend digital rights. ------------------------------------------------------------------------------- (Y)es/(N)o: Y Starting new HTTPS connection (1): supporters.eff.org No names were found in your configuration files. Please enter in your domain name(s) (comma and/or space separated) (Enter 'c' to cancel): courages.us Obtaining a new certificate Performing the following challenges: http-01 challenge for courages.us Input the webroot for courages.us: (Enter 'c' to cancel): /var/www/html Waiting for verification... Cleaning up challenges We were unable to find a vhost with a ServerName or Address of courages.us. Which virtual host would you like to choose? (note: conf files with multiple vhosts are not yet supported) ------------------------------------------------------------------------------- 1: ssl.conf | | HTTPS | Enabled ------------------------------------------------------------------------------- Press 1 [enter] to confirm the selection (press 'c' to cancel): 1 Deploying Certificate for courages.us to VirtualHost /etc/httpd/conf.d/ssl.conf Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. ------------------------------------------------------------------------------- 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. ------------------------------------------------------------------------------- Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 Created redirect file: le-redirect-courages.us.conf Rollback checkpoint is empty (no changes made?) ------------------------------------------------------------------------------- Congratulations! You have successfully enabled https://courages.us You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=courages.us -------------------------------------------------------------------------------
在浏览器访问一下域名即有小绿钥匙。可以在/etc/httpd/conf.d/ssl.conf查看相应的SSL证书配置
<VirtualHost _default_:443> ServerName courages.us SSLCertificateFile /etc/letsencrypt/live/courages.us/cert.pem SSLCertificateKeyFile /etc/letsencrypt/live/courages.us/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf SSLCertificateChainFile /etc/letsencrypt/live/courages.us/chain.pem </VirtualHost>
由于证书在90天后即将失效，可以加入crontab自动更新
certbot renew --dry-run crontab -e 0 0,12 * * * python -c 'import random; import time; time.sleep(random.random() * 3600)' && certbot renew
参考链接：
How To Install Linux, Apache, MySQL, PHP (LAMP) stack On CentOS 7
How to enable EPEL repository?
How to Secure Your Server
Introduction to FirewallD on CentOS
