349 lines
8.7 KiB
Markdown
349 lines
8.7 KiB
Markdown
# WordPress sur Debian / nginx
|
||
|
||
|
||
|
||
#### Installation nginx/php/mariadb
|
||
|
||
Ajouter le dépôt PPA pour PHP 7.4
|
||
|
||
```bash
|
||
$ sudo apt-get install apt-transport-https lsb-release ca-certificates
|
||
$ sudo wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
|
||
$ echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" >> /etc/apt/sources.list.d/php.list
|
||
apt-get update
|
||
```
|
||
|
||
Installer nginx, mariadb, php7.4 et ses modules
|
||
|
||
```bash
|
||
sudo apt-get install nginx mariadb-server mariadb-client unzip wget git -y
|
||
|
||
sudo apt-get install php7.4-fpm php7.4-cli
|
||
sudo apt-get install php7.4-{bcmath,bz2,curl,imagick,intl,gd,mbstring,mcrypt,memcache,mysql,redis,xdebug,xml,zip}
|
||
```
|
||
|
||
Démarrer nginx et mariadb
|
||
|
||
```bash
|
||
sudo systemctl start nginx.service
|
||
sudo systemctl enable nginx.service
|
||
sudo systemctl start mariadb.service
|
||
sudo systemctl enable mariadb.service
|
||
```
|
||
|
||
|
||
|
||
#### PHP
|
||
|
||
Voir les logs:
|
||
|
||
```bash
|
||
sudo nano /etc/php/7.4/fpm/php.ini
|
||
```
|
||
|
||
|
||
|
||
#### mariadb
|
||
|
||
Sécuriser mariadb
|
||
|
||
```bash
|
||
$ sudo mysql_secure_installation
|
||
```
|
||
|
||
Créer la base de donnée wordpress
|
||
|
||
```bash
|
||
$ sudo mysql -u root -p
|
||
```
|
||
|
||
```mysql
|
||
# Supprimer une ancienne base:
|
||
# DROP DATABASE wordpress;
|
||
|
||
CREATE DATABASE wordpress;
|
||
GRANT ALL ON wordpress.* TO 'adm_wp'@'localhost' IDENTIFIED BY 'Kpm!65YU';
|
||
```
|
||
|
||
|
||
|
||
#### Installation WordPress
|
||
|
||
Télécharger WordPress
|
||
|
||
```bash
|
||
cd /var/www/html
|
||
sudo wget https://wordpress.org/latest.tar.gz
|
||
sudo tar -xzvf latest.tar.gz
|
||
```
|
||
|
||
Corriger les autorisations
|
||
|
||
```bash
|
||
#$ sudo chown -R $USER:$USER /var/www/html/wordpress/
|
||
$ sudo chown -R www-data:www-data /var/www/html/wordpress/
|
||
$ sudo chmod -R 755 /var/www/html/wordpress/
|
||
$ find /var/www/html/wordpress/ -type d -exec chmod 755 {} \;
|
||
$ find /var/www/html/wordpress/ -type f -exec chmod 644 {} \;
|
||
```
|
||
|
||
Configurer WordPress
|
||
|
||
```bash
|
||
$ curl -s https://api.wordpress.org/secret-key/1.1/salt/
|
||
define('AUTH_KEY', 'nqx$&&2@.PlOv:R-@D5O@1J!fxBV).%}|4$E,<]3V6wK:>s;N*_qZgX1v%Clj.nY');
|
||
define('SECURE_AUTH_KEY', 'k/iGx=P!Q,I=-f-_JhI-hNNlvL]036/W;h@,-a>l:DN#w}@.RdqehTDC>Da{$`v,');
|
||
define('LOGGED_IN_KEY', 'e!2g+-jFty5(}j>Oxtdt1+krNu&[TIrP}|)G&0jt%Z+q#+?TTP1mM+MVTH-zD5#w');
|
||
define('NONCE_KEY', '9 @VoZ.-OVd!wy5mT$?&-$RHIX%xImw]M2jKK+vUet+pImeiNYGx~Jm>shu}p0B7');
|
||
define('AUTH_SALT', ':pyo`{Fk*YNww+V-]-8Oy|}daBoedBnlO?AWKw;Gj+X9n|qm#Ndk~?R-d`N!I21v');
|
||
define('SECURE_AUTH_SALT', ' +dgn@u/e#rZ.4(t}#.3d<)Y2>d)3c)t$j>_C^}sEwSK&VZ+]C=b2/.gzyA#.$Kz');
|
||
define('LOGGED_IN_SALT', 'q1},|Tm|kBb!?H*T`PkGt;}>JF/8fHRRzGaVPB[Et!#gjbm4rjG-}-J`jlzZ<I|E');
|
||
define('NONCE_SALT', 'I}Sv1zA>I*rW/[3?d[@/jg$=95NqWDdBMf{N>o: G!R fp10Ynyoq-^Hw>-7|LEK');
|
||
|
||
```
|
||
|
||
```bash
|
||
$ cp wp-config-sample.php wp-config.php
|
||
$ nano wp-config.php
|
||
```
|
||
|
||
```php
|
||
### Modifier les réglages de base de donnée ###
|
||
|
||
// ** MySQL settings - You can get this info from your web host ** //
|
||
/** The name of the database for WordPress */
|
||
define( 'DB_NAME', 'wordpress' );
|
||
|
||
/** MySQL database username */
|
||
define( 'DB_USER', 'adm_wp' );
|
||
|
||
/** MySQL database password */
|
||
define( 'DB_PASSWORD', 'Kpm!65YU' );
|
||
|
||
/** MySQL hostname */
|
||
define( 'DB_HOST', 'localhost' );
|
||
|
||
/** Database Charset to use in creating database tables. */
|
||
define( 'DB_CHARSET', 'utf8' );
|
||
|
||
/** The Database Collate type. Don't change this if in doubt. */
|
||
define( 'DB_COLLATE', '' );
|
||
|
||
|
||
### Remplacer la section Authentication Unique Keys and Salts. ###
|
||
|
||
define('AUTH_KEY', 'nqx$&&2@.PlOv:R-@D5O@1J!fxBV).%}|4$E,<]3V6wK:>s;N*_qZgX1v%Clj.nY');
|
||
define('SECURE_AUTH_KEY', 'k/iGx=P!Q,I=-f-_JhI-hNNlvL]036/W;h@,-a>l:DN#w}@.RdqehTDC>Da{$`v,');
|
||
define('LOGGED_IN_KEY', 'e!2g+-jFty5(}j>Oxtdt1+krNu&[TIrP}|)G&0jt%Z+q#+?TTP1mM+MVTH-zD5#w');
|
||
define('NONCE_KEY', '9 @VoZ.-OVd!wy5mT$?&-$RHIX%xImw]M2jKK+vUet+pImeiNYGx~Jm>shu}p0B7');
|
||
define('AUTH_SALT', ':pyo`{Fk*YNww+V-]-8Oy|}daBoedBnlO?AWKw;Gj+X9n|qm#Ndk~?R-d`N!I21v');
|
||
define('SECURE_AUTH_SALT', ' +dgn@u/e#rZ.4(t}#.3d<)Y2>d)3c)t$j>_C^}sEwSK&VZ+]C=b2/.gzyA#.$Kz');
|
||
define('LOGGED_IN_SALT', 'q1},|Tm|kBb!?H*T`PkGt;}>JF/8fHRRzGaVPB[Et!#gjbm4rjG-}-J`jlzZ<I|E');
|
||
define('NONCE_SALT', 'I}Sv1zA>I*rW/[3?d[@/jg$=95NqWDdBMf{N>o: G!R fp10Ynyoq-^Hw>-7|LEK');
|
||
|
||
|
||
### Activer les mises à jour ###
|
||
|
||
define( 'FS_METHOD', 'direct' );
|
||
```
|
||
|
||
|
||
|
||
#### Configurer nginx
|
||
|
||
|
||
|
||
```bash
|
||
$ sudo nano /etc/nginx/sites-available/test.conf
|
||
```
|
||
|
||
```nginx
|
||
server {
|
||
listen 80;
|
||
server_name localhost;
|
||
#return 302 https://$server_name$request_uri;
|
||
|
||
root /var/www/html;
|
||
index index.php index.html index.htm index.nginx-debian.html;
|
||
|
||
location / {
|
||
if ($request_uri ~ ^/(.*)\.html$) {
|
||
return 302 /$1;
|
||
}
|
||
}
|
||
|
||
location /wordpress {
|
||
try_files $uri $uri/ /wordpress/index.php?$args;
|
||
}
|
||
|
||
error_page 500 502 503 504 /50x.html;
|
||
location = /50x.html {
|
||
root /usr/share/nginx/html;
|
||
}
|
||
|
||
location ~ \.php$ {
|
||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||
#include snippets/fastcgi-php.conf;
|
||
fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
|
||
fastcgi_index index.php;
|
||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||
include fastcgi_params;
|
||
}
|
||
|
||
}
|
||
```
|
||
|
||
```bash
|
||
sudo ln -s /etc/nginx/sites-available/test.conf /etc/nginx/sites-enabled/default
|
||
```
|
||
|
||
Vérifier la configuration et redémarrer PHP/nginx.
|
||
|
||
```bash
|
||
$ sudo /usr/sbin/nginx -t
|
||
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
|
||
nginx: configuration file /etc/nginx/nginx.conf test is successful
|
||
|
||
$ sudo systemctl restart nginx php7.4-fpm
|
||
```
|
||
|
||
Aller à http://localhost/wordpress/ pour terminer l'installation de WordPress.
|
||
|
||
|
||
|
||
#### Échec d’installation : Impossible de créer le dossier » dans WordPress
|
||
|
||
Aller dans Outils -> Santé du site
|
||
|
||
```bash
|
||
$ sudo chown -R www-data:www-data wordpress/
|
||
```
|
||
|
||
|
||
|
||
#### SSL
|
||
|
||
Générer clé et certificat auto-signés:
|
||
|
||
```bash
|
||
$ sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt
|
||
```
|
||
|
||
Créer un groupe Diffie-Hellman:
|
||
|
||
```bash
|
||
$ sudo openssl dhparam -out /etc/nginx/dhparam.pem 4096
|
||
```
|
||
|
||
Créer un snippet contenant les fichiers des clés et certificats:
|
||
|
||
```bash
|
||
$ sudo nano /etc/nginx/snippets/self-signed.conf
|
||
```
|
||
|
||
```nginx
|
||
ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
|
||
ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
|
||
```
|
||
|
||
Créer un snippet contenant les réglages SSL:
|
||
|
||
```bash
|
||
$ sudo nano /etc/nginx/snippets/ssl-params.conf
|
||
```
|
||
|
||
```nginx
|
||
ssl_protocols TLSv1.2;
|
||
ssl_prefer_server_ciphers on;
|
||
ssl_dhparam /etc/nginx/dhparam.pem;
|
||
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
|
||
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
|
||
ssl_session_timeout 10m;
|
||
ssl_session_cache shared:SSL:10m;
|
||
ssl_session_tickets off; # Requires nginx >= 1.5.9
|
||
ssl_stapling on; # Requires nginx >= 1.3.7
|
||
ssl_stapling_verify on; # Requires nginx => 1.3.7
|
||
resolver 8.8.8.8 8.8.4.4 valid=300s;
|
||
resolver_timeout 5s;
|
||
# Disable strict transport security for now. You can uncomment the following
|
||
# line if you understand the implications.
|
||
# add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
|
||
add_header X-Frame-Options DENY;
|
||
add_header X-Content-Type-Options nosniff;
|
||
add_header X-XSS-Protection "1; mode=block";
|
||
```
|
||
|
||
Modifier la config nginx pour gérer SSL:
|
||
|
||
```bash
|
||
$ sudo cp /etc/nginx/sites-available/test.conf /etc/nginx/sites-available/test.conf.bak
|
||
|
||
$ sudo cp /etc/nginx/sites-available/test.conf
|
||
```
|
||
|
||
```nginx
|
||
server {
|
||
#listen 80;
|
||
listen 443 ssl;
|
||
listen [::]:443 ssl;
|
||
include snippets/self-signed.conf;
|
||
include snippets/ssl-params.conf;
|
||
|
||
server_name localhost;
|
||
#return 302 https://$server_name$request_uri;
|
||
|
||
root /var/www/html;
|
||
index index.php index.html index.htm index.nginx-debian.html;
|
||
|
||
location / {
|
||
if ($request_uri ~ ^/(.*)\.html$) {
|
||
return 302 /$1;
|
||
}
|
||
}
|
||
|
||
location /wordpress {
|
||
try_files $uri $uri/ /wordpress/index.php?$args;
|
||
}
|
||
|
||
error_page 500 502 503 504 /50x.html;
|
||
location = /50x.html {
|
||
root /usr/share/nginx/html;
|
||
}
|
||
|
||
location ~ \.php$ {
|
||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||
#include snippets/fastcgi-php.conf;
|
||
fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
|
||
fastcgi_index index.php;
|
||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||
include fastcgi_params;
|
||
}
|
||
|
||
}
|
||
|
||
server {
|
||
listen 80;
|
||
listen [::]:80;
|
||
|
||
server_name localhost;
|
||
|
||
# redirection provisoire
|
||
#return 302 https://$server_name$request_uri;
|
||
|
||
# redirection permanente
|
||
return 301 https://$server_name$request_uri;
|
||
|
||
}
|
||
```
|
||
|
||
https://slacker.ro/2019/07/15/how-to-create-a-self-signed-ssl-certificate-for-nginx-on-debian-10/
|
||
|
||
|
||
|
||
```
|
||
bruno / MHxhNZ2Ax*@@cvy6XM
|
||
```
|
||
|
||
|
||
|