Ubuntu24, MariaDB, Nginx, PHP‐FPM 설정으로 고성능 웹 서버 구축 - ohipark/btstack GitHub Wiki

ubuntu-24.04.1-live-server-amd64.iso
- minimum server로 설치
- user : mcq / mcq***

$ sudo apt-get update
$ sudo apt-get install iputils-ping
$ sudo apt-get install net-tools
$ sudo apt-get install vim
$ sudo apt install vi

sudo apt update
sudo apt install nginx
sudo apt install apt-utils nginx-common fcgiwrap nginx-doc ssl-cert 

sudo systemctl start nginx
sudo systemctl enable nginx

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root /var/www/html;
    index index.html index.htm index.nginx-debian.html;

    server_name _;

    location / {
        try_files $uri $uri/ =404;
    }
}

sudo nginx -t
sudo systemctl restart nginx

apt install mariadb-server mariadb-client

systemctl start mariadb
systemctl enable mariadb
systemctl status mariadb

systemctl status mariadb

mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user.  If you've just installed MariaDB, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.

Set root password? [Y/n] y
New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
 ... Success!

mysql -e "SHOW DATABASES;" -p

$ sudo mariadb

MariaDB [(none)]> CREATE DATABASE example_database;
MariaDB [(none)]> GRANT ALL ON example_database.* TO 'test'@'localhost' IDENTIFIED BY 'test123' WITH GRANT OPTION;
MariaDB [(none)]> FLUSH PRIVILEGES;
MariaDB [(none)]> exit

$ mariadb -u test -p
Enter password: test123

MariaDB [(none)]> SHOW DATABASES;
MariaDB [(none)]> exit

sudo apt update
sudo apt install php-fpm php-mysql

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root /var/www/html;
    index index.php index.html index.htm index.nginx-debian.html;

    server_name _;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
        #fastcgi_index index.php;
        #include fastcgi_params;
    }
}

sudo nginx -t
sudo systemctl restart nginx
sudo systemctl restart php8.3-fpm

<?php
phpinfo();
?>

$ mariadb -u test -p
Enter password: test123

MariaDB [(none)]> CREATE TABLE example_database.todo_list (
	item_id INT AUTO_INCREMENT,
	content VARCHAR(255),
	PRIMARY KEY(item_id)
);

MariaDB [(none)]> INSERT INTO example_database.todo_list (content) VALUES ("My first important item");
MariaDB [(none)]> INSERT INTO example_database.todo_list (content) VALUES ("My second important ite");
MariaDB [(none)]> INSERT INTO example_database.todo_list (content) VALUES ("My third important item");
MariaDB [(none)]> INSERT INTO example_database.todo_list (content) VALUES ("and this one more thing");

MariaDB [(none)]> SELECT * FROM example_database.todo_list;

nano /var/www/your_domain/todo_list.php

<?php
$user = "test";
$password = "test123";
$database = "example_database";
$table = "todo_list";

try {
  $db = new PDO("mysql:host=localhost;dbname=$database", $user, $password);
  echo "<h2>TODO</h2><ol>"; 
  foreach($db->query("SELECT content FROM $table") as $row) {
    echo "<li>" . $row['content'] . "</li>";
  }
  echo "</ol>";
} catch (PDOException $e) {
    print "Error!: " . $e->getMessage() . "<br/>";
    die();
}
?>

http://192.168.10.77/todo_list.php

worker_processes auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 4096;
    use epoll;
    multi_accept on;
}

http {
    keepalive_timeout 65;
    keepalive_requests 100;
}

http {
    keepalive_timeout 65;
    keepalive_requests 100;
}

client_body_buffer_size 10K;
client_header_buffer_size 1k;
client_max_body_size 8m;
large_client_header_buffers 2 1k;

location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
    expires 30d;
    add_header Cache-Control "public, no-transform";
}

gzip on;
gzip_comp_level 5;
gzip_min_length 256;
gzip_proxied any;
gzip_vary on;
gzip_types
  application/atom+xml
  application/javascript
  application/json
  application/ld+json
  application/manifest+json
  application/rss+xml
  application/vnd.geo+json
  application/vnd.ms-fontobject
  application/x-font-ttf
  application/x-web-app-manifest+json
  application/xhtml+xml
  application/xml
  font/opentype
  image/bmp
  image/svg+xml
  image/x-icon
  text/cache-manifest
  text/css
  text/plain
  text/vcard
  text/vnd.rim.location.xloc
  text/vtt
  text/x-component
  text/x-cross-domain-policy;

open_file_cache max=1000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;
open_file_cache_errors on;

access_log /var/log/nginx/access.log combined buffer=16k;
error_log /var/log/nginx/error.log warn;

sudo nginx -t
sudo systemctl restart nginx

pm = dynamic
pm.max_children = 50
pm.start_servers = 5
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500

pm.max_children = 50
pm.start_servers = 5
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500

opcache.enable=1
opcache.memory_consumption=128
opcache.interned_strings_buffer=8
opcache.max_accelerated_files=4000
opcache.revalidate_  freq=60
opcache.fast_shutdown=1
opcache.enable_cli=1

memory_limit = 256M

max_execution_time = 30
max_input_time = 60

session.save_handler = redis
session.save_path = "tcp://127.0.0.1:6379"

realpath_cache_size = 4096k
realpath_cache_ttl = 600

opcache.jit_buffer_size=100M
opcache.jit=1235

php_admin_value[error_log] = /var/log/php-fpm/www-error.log
php_admin_flag[log_errors] = on
catch_workers_output = yes

sudo systemctl restart php8.3-fpm
sudo systemctl status php8.3-fpm

<?php phpinfo(); ?>

fastcgi_cache_path /var/cache/nginx levels=1:2 keys_zone=MYAPP:100m inactive=60m;
fastcgi_cache_key "$scheme$request_method$host$request_uri";

server {
    # ... 기존 서버 설정 ...

    location ~ \.php$ {
        fastcgi_cache MYAPP;
        fastcgi_cache_valid 200 60m;
        fastcgi_cache_use_stale error timeout invalid_header updating http_500;
        fastcgi_cache_lock on;
        fastcgi_cache_bypass $query_string;
        fastcgi_no_cache $query_string;

        # ... 기존 FastCGI 설정 ...
    }
}

pm.status_path = /status

location /status {
    access_log off;
    allow 127.0.0.1;
    deny all;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_index index.php;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
}

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;

listen.owner = www-data
listen.group = www-data
listen.mode = 0660

user = www-data
group = www-data

display_errors = Off
display_startup_errors = Off
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT

upload_max_filesize = 2M
post_max_size = 8M

sudo apt update
sudo apt upgrade