CentOS 7, amp + xcache， rpm包，php-fpm；
a) httpd, php, mariadb分别部署在一个单独的主机上；
b) 一个虚拟主机提供phpMyAdmin，另一个虚拟主机提供wordpress；
c) 为phpMyAdmim提供https服务；
分别三台centos 7主机分别部署 httpd , php-fpm , mariadb
第一台 172.16.100.31 -->httpd
第二台 172.16.100.32 -->php-fpm 分别在2台虚拟主机上部署wordpress和phpmyadmin
第三台 172.16.100.33 -->mariadb
开始之前 首先把iptables 和SElinux给关闭了 方便测试
#iptables -F
#setenforce 0
那么我们先从第一台开始：
#安装htppd
yum -y instal httpd
#以FQDN配置2个虚拟主机的文件：
[[email protected] ~]# vim /etc/httpd/conf.d/vhost1.conf
<VirtualHost 172.16.100.31:80>
ServerName www1.wufeng.com
DocumentRoot "/data/vhost/www1"
ProxyRequests on
DirectoryIndex index.php
ProxyPassMatch ^/(.*\.php)$ fcgi://172.16.100.32:9000/data/vhost/www1/$1 动态资源代理转发给第2台主机
<Directory "/data/vhost/www1">
Options None
AllowOverride None
Require all granted
</Directory>
</VirtualHost>
[[email protected] ~]# vim /etc/httpd/conf.d/vhost2.conf
<VirtualHost 172.16.100.31:80>
ServerName www2wufeng.com
DocumentRoot "/data/vhost/www2"
ProxyRequests on
DirectoryIndex index.php
ProxyPassMatch ^/(.*\.php)$ fcgi://172.16.100.32:9000/data/vhost/www2/$1 动态资源代理转发给第2台主机
<Directory "/data/vhost/www2">
Options None
AllowOverride None
Require all granted
</Directory>
</VirtualHost>
#修改etc下的2个配置文件指定NDS以及域名解析
[[email protected] ~]# vim /etc/resolv.conf
# Generated by NetworkManager
DNS=172.16.100.31
nameserver 172.16.0.1
#本地域名解析
[[email protected] ~]# vim /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
172.16.100.31 www1.wufeng.com www2.wufeng.com
#创建静态默认文件：
[[email protected] ~]# mkdir -pv /data/vhost/www{1,2}
[[email protected] ~]# vim /data/vhost/www1/index.html
<h1>峰哥1第1台物理机静态数据 172.16.100.31</h1>
[[email protected] ~]# vim /data/vhost/www2/index.html
<h1>峰哥2第1台物理机静态数据 172.16.100.31</h1>
#然后测试本机静态数据是否可以正常访问
================================================================
第二台主机：
#向要安装php-fpm
yum -y install php-fpm
#修改配置文件
[[email protected] ~]# vim /etc/php-fpm.d/www.conf
listen = 172.16.100.32:9000 监听本机地址端口
listen.allowed_clients = 172.16.100.31 允许第一台主机连接
#创建资源映射目录及文件
mkdir -pv /data/vhost/www{1,2}
#写入测试php的文件
[[email protected] ~]# vim /data/vhost/www1/index.php
<h1>第2台物理机a</h1>
<?php
$conn = mysql_connect(‘172.16.100.33‘,‘testuser‘,‘testpass‘);
if($conn)
echo "OK";
else
echo "Failure";
phpinfo();
?>
#然后安装加速器php-xcache
yum -y install php-xcache
#然后安装wordpress以及php-myadmin
#我们要把这2个程序分别部署在第2台主机上的2个分别的资源映射路径下
#我是直接在ftp服务器上下载的所以直接就解压了
#首先我们先搞定wordpress
[[email protected] ~]# unzip wordpress-4.3.1-zh_CN.zip
#并移动至第一个虚拟主机的资源映射路径下
[[email protected] ~]# mv wordpress /data/vhost/www1
#cd进入该目录下并且修改配置文件
#注意这个配置文件里面添加的是第3台主机上的数据库信息我们当前还没有创建数据库可以先修改，之后在以这个配置创建数据库；
#修改配置文件名并修改之；
[[email protected] ~]# cd /data/vhost/www1/wordpress/
[[email protected] wordpress]# ln -s wp-config-sample.php wp-config.php
[[email protected] wordpress]# vim wp-config.php
// ** MySQL 设置 - 具体信息来自您正在使用的主机 ** //
/** WordPress数据库的名称 */
define(‘DB_NAME‘, ‘wpdb‘);
/** MySQL数据库用户名 */
define(‘DB_USER‘, ‘wpuser‘);
/** MySQL数据库密码 */
define(‘DB_PASSWORD‘, ‘wppass‘);
/** MySQL主机 */
define(‘DB_HOST‘, ‘172.16.100.33‘); 这里的地址是指向第3台主机的数据库地址
/** 创建数据表时默认的文字编码 */
define(‘DB_CHARSET‘, ‘utf8‘);
/** 数据库整理类型。如不确定请勿更改 */
define(‘DB_COLLATE‘, ‘‘);
那么wordpress基本上已经配置好了 不急于测试 下面把php-myadmin也一起安装了
#php-myadmin也是在ftp服务器上下载的所以直接解压了
[[email protected] ~]# unzip phpMyAdmin-4.4.14.1-all-languages.zip
#并且放在第2台主机上的第2个虚拟主机资源映射路径下；
[[email protected] ~]# mv phpMyAdmin-4.4.14.1-all-languages /data/vhost/www2/
#cd进该目录下并且修改文件名修改配置
[[email protected] ~]# cd /data/vhost/www2/ 进入目录
[[email protected] www2]# ln -s phpMyAdmin-4.4.14.1-all-languages myadmin 创建一个链接
[[email protected] www2]# cd myadmin/ 进入目标目录
[[email protected] myadmin]# ln -s config.sample.inc.php config.inc.php 创建配置文件连接
[[email protected] myadmin]# vim config.inc.php
$cfg[‘blowfish_secret‘] = ‘4pfPnJU4R8pA4WMWaQxD‘; /* YOU MUST FILL IN THIS FOR COOKIE AUTH! */
上面这2个单引号中间加上随机码 用openssl rand -base64 15 生成 用于通信加密
/*
* Servers configuration
*/
$i = 0;
/*
* First server
*/
$i++;
/* Authentication type */
$cfg[‘Servers‘][$i][‘auth_type‘] = ‘cookie‘;
/* Server parameters */
$cfg[‘Servers‘][$i][‘host‘] = ‘172.16.100.33‘; 这里这指向mysql数据库主机的地址
$cfg[‘Servers‘][$i][‘connect_type‘] = ‘tcp‘;
$cfg[‘Servers‘][$i][‘compress‘] = false;
$cfg[‘Servers‘][$i][‘AllowNoPassword‘] = false;
那么现在我们第2台主机的配置基本完成
=====================================================================================
下面再去第3台主机创建mysql数据库
第三台物理机： 唯一作用就是作为数据库
#那么首先安装数据库
yum -y install mariadb-server
#启动起来
systemctl start mariadb.service
#然后授权创建用户
先进mysql 然后如下
mysql> GRANT ALL ON wpdb.* TO ‘wpuser‘@‘172.16.%.%‘ IDENTIFIED BY ‘wppass‘;
mysql> FLUSH PRIVILEGES;
mysql> CREATE DATABASE wpdb；
=====================================================================================
那么现在可以测试php是否可以连接数据库了
http://www1.wufeng.com/ 测试第一台主机的静态数据
http://www2.wufeng.com/ 第1台主机的静态数据连接成功
http://www1.wufeng.com/index.php 第2台物理机的第一个虚拟主机的动态数据访问成功
http://www2.wufeng.com/index.php 第2台物理机的第二个虚拟主机的动态数据访问成功
http://www1.wufeng.com/wordpress/index.php 测试转发第2台主机第一个虚拟主机
http://www2.wufeng.com/myadmin/index.php 测试转发第2台主机第二个虚拟主机
#下面我们要给第2台物理主机的第2个虚拟主机上的php-myadmin提供https服务；
#签署CA证书并为phpmyadmin提供https服务；
#在第一台主机上安装mod_ssl模块 因为需要http来加载模块并启动443端口
[[email protected] CA]# yum install mod_ssl.x86_64
#然后在第2台主机上生成CA自签名证书；
1、生成密钥
#首先进入CA目录下
[[email protected] wordpress]# cd /etc/pki/CA/
#在CA目录下生成密钥
[[email protected]1 CA]# (umask 077; openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
............................................................................+++
...............+++
e is 65537 (0x10001)
2、生成自签证书
[[email protected]1 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:wufeng
Organizational Unit Name (eg, section) []:ops
Common Name (eg, your name or your server‘s hostname) []:ca.wufeng.com
Email Address []:[email protected]
补充文件
[[email protected]1 CA]# touch index.txt
[[email protected]1 CA]# echo 01 > serial
、
#然后在去第1台主机上生成请求签署文件以及密钥
在/etc/httpd/目录下创建一个目录
~]# mkdir ssl
~]# cd ssl
生成密钥
[[email protected]1 ssl]# (umask 077; openssl genrsa -out httpd.key 1024)
Generating RSA private key, 1024 bit long modulus
.++++++
........................................++++++
e is 65537 (0x10001)
生成签署请求文件：
[[email protected]1 ssl]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:wufeng
Organizational Unit Name (eg, section) []:ops
Common Name (eg, your name or your server‘s hostname) []:www2.wufeng.com 这个要和客户访问要加密的主机名一样
Email Address []:[email protected]
Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
复制给CA主机签署证书
[[email protected]1 ssl]# scp httpd.csr 172.16.100.32:/tmp
然后到centos7主机上签署文件
[[email protected]2 CA]# openssl ca -in /tmp/httpd.csr -out /etc/pki/CA/certs/httpd.crt
连续2个yes 简写y
签署完成后 复制给请求主机
[[email protected]2 CA]# scp certs/httpd.crt 172.16.100.31:/etc/httpd/ssl/
在请求主机上也就是第2台centos7上
编辑这个文件
[[email protected] ~]# vim /etc/httpd/conf.d/ssl.conf
DocumentRoot "/data/vhost/www2/myadmin" 这2个启用起来 把前面的#号去掉 改成自己的资源映射路径
ServerName www2.wufeng.com:443 主机名也改成自己的
SSLCertificateFile /etc/httpd/ssl/httpd.crt 指明签署的证书文件路径
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key 指明私钥文件的路径
#最重要的一条是需要做转发
#需要在这里面定义<VirtualHost _default_:443>
ProxyPassMatch ^/(.*\.php)$ fcgi://172.16.100.32:9000/data/vhost/www2/$1
然后reload一下
然后ss -tnl 查看一下443端口起来没
在centos7 主CA机器上 测试基于https访问相应的主机；
[[email protected] CA]# openssl s_client -connect 172.16.100.31:443 -CAfile /etc/pki/CA/cacert.pem
#然后打开浏览器输入myadmin地址访问看看是否提供了https服务
用winds上面的浏览器以ip的方式测试https
最后查看xcache服务启动没有
最后可以做个压力测试
首先做httpd主机的静态数据测试：html
[[email protected] ~]# ab -c 100 -n 1000 http://www1.wufeng.com/data/vhost/www1/index.html 静态数据
Time per request: 21.244 [ms] (mean) 十次的测试数据稳定在这个数值
Time per request: 0.212 [ms] (mean, across all concurrent requests)
Transfer rate: 1995.00 [Kbytes/sec] received
#动态数据测试info() php
[[email protected] ~]# ab -c 100 -n 1000 http://www1.wufeng.com/data/vhost/www1/index.php
Concurrency Level: 100
Time taken for tests: 0.523 seconds
Complete requests: 1000
Failed requests: 0
Write errors: 0
Non-2xx responses: 1000
Total transferred: 226000 bytes
HTML transferred: 16000 bytes
Requests per second: 1913.59 [#/sec] (mean)
Time per request: 52.258 [ms] (mean) 十次的测试数据稳定在这个数值
Time per request: 0.523 [ms] (mean, across all concurrent requests)
Transfer rate: 422.33 [Kbytes/sec] received
#测试wordpress动态数据
[[email protected] ~]# ab -c 100 -n 1000 http://www1.wufeng.com/data/vhost/www1/wordpress/index.php
Concurrency Level: 100
Time taken for tests: 0.517 seconds
Complete requests: 1000
Failed requests: 0
Write errors: 0
Non-2xx responses: 1000
Total transferred: 226000 bytes
HTML transferred: 16000 bytes
Requests per second: 1934.61 [#/sec] (mean)
Time per request: 51.690 [ms] (mean) 十次的测试数据稳定在这个数值
Time per request: 0.517 [ms] (mean, across all concurrent requests)
Transfer rate: 426.97 [Kbytes/sec] received
#动态测试myadmin数据
[[email protected] ~]# ab -c 100 -n 1000 http://www2.wufeng.com/data/vhost/www2/myadmin/index.php
Document Path: /data/vhost/www2/myadmin/index.php
Document Length: 16 bytes
Concurrency Level: 100
Time taken for tests: 0.520 seconds
Complete requests: 1000
Failed requests: 0
Write errors: 0
Non-2xx responses: 1000
Total transferred: 226000 bytes
HTML transferred: 16000 bytes
Requests per second: 1923.43 [#/sec] (mean)
Time per request: 51.990 [ms] (mean) 十次的测试数据稳定在这个数值
Time per request: 0.520 [ms] (mean, across all concurrent requests)
Transfer rate: 424.51 [Kbytes/sec] received
#友情提示不要太奔放 比如：
[[email protected] ~]# ab -c 1000 -n 10000 http://www2.wufeng.com/data/vhost/www2/index.php
然后第2台 php主机就挂了
