apt install ca-certificates apt-transport-https
wget -q https://packages.sury.org/php/apt.gpg -O- | apt-key add -
echo deb https://packages.sury.org/php/ stretch main | tee /etc/apt/sources.list.d/php.list
apt update
apt install php7.2-fpm php7.2-cli php7.2-common php7.2-curl php7.2-mbstring php7.2-mysql php7.2-xml php7.2-gd php7.2-zip php7.2-bcmath
service php7.2-fpm reload
apt install nginx
server {
charset utf-8;
client_max_body_size 0;
listen 80; ## listen for ipv4
server_name superskid.ru www.superskid.ru;
# include inc_letsencrypt;
# Редирект с http на https.
location / {
return 301 https://$host:443$request_uri$args;
}
root /var/www/superskid.ru/web;
index index.php index.html;
access_log /var/log/nginx/ngixn-cp.access.log;
error_log /var/log/nginx/ngixn-cp.error.log;
location ~ \.(js|css|png|jpg|gif|swf|ico|pdf|mov|fla|zip|rar)$ {
try_files $uri =404;
}
location ~ ^/assets/.*\.php$ {
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
}
}
server {
client_max_body_size 0;
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name superskid.ru www.superskid.ru;
proxy_connect_timeout 300;
proxy_send_timeout 300;
proxy_read_timeout 300;
send_timeout 300;
# Подключаем все необходимое для ssl.
ssl on;
ssl_certificate /etc/letsencrypt/live/superskid.ru/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/superskid.ru/privkey.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_dhparam /etc/nginx/dhparam.pem;
ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/superskid.ru/chain.pem;
resolver 8.8.8.8;
root /var/www/superskid.ru/web;
index index.php;
add_header X-Frame-Options "SAMEORIGIN";
add_header x-xss-protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
location ~ /.well-known/acme-challenge {
root /var/www/superskid.ru/;
allow all;
}
location / {
try_files $uri $uri/ /index.php$is_args$args;
}
location ~ ^/assets/.*\.php$ {
deny all;
}
location /phpmyadmin/ {
alias /usr/share/phpmyadmin/;
index index.html index.htm index.php;
}
location /nginx_status_page {
stub_status on;
access_log off;
allow 176.99.14.108;
deny all;
}
# Compression.
gzip on;
gzip_min_length 10240;
gzip_proxied expired no-cache no-store private auth;
gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml;
gzip_disable "msie6";
open_file_cache max=200000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;
open_file_cache_errors on;
location ~ \.php$ {
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
try_files $uri =404;
}
location ~ \.(js|css|png|jpg|gif|swf|ico|pdf|mov|fla|zip|rar)$ {
try_files $uri =404;
}
location ~ ^/assets/.*\.php$ {
deny all;
}
# location ~* /\. {
# deny all;
# }
access_log /var/log/nginx/frontend-cp.access.log;
error_log /var/log/nginx/frontend-cp.error.log;
}
ln -s /etc/nginx/sites-available/superskid.ru /etc/nginx/sites-enabled/superskid.ru
service nginx reload
nginx -t
apt install python-certbot-nginx
Пример теста получения сертификата:
certbot certonly --manual -d *.superskid.ru --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory
Добавляем записи в DNS TXT
Кроме сертификата необходимо сгенерировать ключ:
openssl dhparam -out /etc/nginx/dhparam.pem 4096
apt install mysql-server php7.2-mysql phpmyadmin
При установки phpmyadmin ни каких модулей не выбираем, оставляем пустое окно и нажимаем далее
mysql_secure_installation
Remove anonymous users? : y
Disallow root login remotely? : y
Remove test database and access to it? : y
Reload privilege tables now? : y
Перевыпуск сертификатов
certbot renew
