升级blog的一次记录 |

前言

升级之前是用docker的wordpress镜像,默认的网站协议是http(基于apache环境)，非SSL的，想到现在的网站都是采用HTTPS SSL方式了，我觉得也需要升级一下。

基础环境准备

拉取nginx、php镜像

运行容器

运行容器前建立好宿主机上的nginx的配置文件夹、网站目录文件夹、日志文件夹

1.运行php容器

[root@docker frp_tc]#docker run –name php -v /root/docker/nginx3/html:/usr/share/nginx/html -p 9000:9000 -d php:7.0-fpm

2.进入php容器安装wordpress必要的插件

[root@docker frp_tc]#docker exec -it php /bin/bash

如下是我安装的过程

root@c26eea1292d4:/var/www/html# history
1 docker-php-ext-install mysqli
2 docker-php-ext-install pdo pdo_mysql
3 exit
4 docker-php-ext-install gd
5 apt update
6 apt install -y libwebp-dev libjpeg-dev libpng-dev libfreetype6-dev
7 apt install -y libwebp-dev libjpeg-dev libpng-dev libfreetype6-dev
8 docker-php-source extract
9 cd /usr/src/php/ext/gd
10 docker-php-ext-configure gd –with-webp-dir=/usr/include/webp –with-jpeg-dir=/usr/include –with-png-dir=/usr/include –with-freetype-dir=/usr/include/freetype2
11 docker-php-ext-install gd
12 php -m | grep gd
13 exit
14 history

3.运行nginx容器

[root@docker frp_tc]#docker run –name wordpress -d -p 8088:80 -p 4443:443 -v /root/docker/nginx3/html:/usr/share/nginx/html -v /root/docker/nginx3/conf/nginx.conf:/etc/nginx/nginx.conf -v /root/docker/nginx3/logs:/var/log/nginx -v /root/docker/nginx3/conf.d:/etc/nginx/conf.d -d –link php:php nginx:1.16.0

4.查看容器运行状态

[root@docker frp_tc]# docker ps |grep wordpress
a13b3d1eaf51 nginx:1.16.0 “nginx -g ‘daemon of…” 4 days ago Up 3 days 0.0.0.0:8088->80/tcp, 0.0.0.0:4443->443/tcp wordpress
[root@docker frp_tc]# docker ps |grep php
c26eea1292d4 php:7.0-fpm “docker-php-entrypoi…” 4 days ago Up 3 days 0.0.0.0:9000->9000/tcp php

5.进入原来的MySQL数据库容器备份数据库(为了方便回退，备份整库)

[root@docker frp_tc]# docker exec -it OLDMysql /bin/bash
root@e9cd6eb732c7:/# history

1 mysqldump -u root -p myword > wp_20201203.sql

6.进入数据库新建一个名为wordpress的数据库，然后恢复刚才的备份，授权登录

root@e9cd6eb732c7:/# mysql -u root -p

mysql> create database wordpress;

mysql> grant all privileges on wordpress.* to “wp”@”172.17.0.%” Identified by “password”

root@e9cd6eb732c7:/# mysql -u root -p wordpress < wp_20201203.sql

7.拷贝原来的网站文件

通过docker inspect OLDwp命令查看volume在宿主机的位置

[root@docker frp_tc]# cd /var/lib/docker/volumes/7c2392a1a9ad7b1bf38b31d76a7f91481045377f236e1cf664d5365e99b7b29f/_data
[root@docker _data]# ls
index.php readme.html wp-admin wp-config.php wp-cron.php wp-load.php wp-settings.php xmlrpc.php
jwplayer.js readme.txt wp-blog-header.php wp-config-sample.php wp-includes wp-login.php wp-signup.php
license.txt wp-activate.php wp-comments-post.php wp-content wp-links-opml.php wp-mail.php wp-trackback.php

[root@docker _data]# cp -a * /root/docker/nginx3/html/

[root@docker _data]#chmod -R 777 /root/docker/nginx3/html/

8.修改网站的配置文件

[root@docker _data]#vi /root/docker/nginx3/html/wp-config.php（最主要修改Mysql的主机IP和用户密码）

/** MySQL hostname */
define( ‘DB_HOST’, ‘172.17.0.5’);

9.写一个nginx的配置文件(前提将SSL证书目录新建并放置证书)

[root@docker nginx3]# cat conf.d/wordpress.conf
server {
listen 443 ssl;
server_name localhost;
##ssl on;
ssl_certificate /usr/share/nginx/html/cert/blog.pem;
ssl_certificate_key /usr/share/nginx/html/cert/blog.key;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
ssl_prefer_server_ciphers on;
#charset koi8-r;
#access_log /var/log/nginx/host.access.log main;
root /usr/share/nginx/html;
if (!-e $request_filename){
rewrite ^/(.*) /index.php last;
}

location / {
index index.php index.html index.htm;
}

#error_page 404 /404.html;

# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}

# proxy the PHP scripts to Apache listening on 127.0.0.1:80
#
#location ~ \.php$ {
# proxy_pass http://127.0.0.1;
#}

# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
location ~* \.php$ {
fastcgi_index index.php;
fastcgi_pass php:9000;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
}

# deny access to .htaccess files, if Apache’s document root
# concurs with nginx’s one
#
#location ~ /\.ht {
# deny all;
#}
}

10.重启php容器、wordpress容器

[root@docker nginx3]# docker restart php

[root@docker nginx3]# docker restart wordpress

[root@docker nginx3]# docker ps |grep php

[root@docker nginx3]# docker ps |grep wordpress

11.用Navicat Premium连接数据库修改一些表的数据内容(因为采用https的缘故，原本以发布的网站参数和网站数据文件链接会改变，所以需要执行update一下的脚本)

12.将网站发布到公网，用腾讯云的反向代理(提前在pfsense开启端口映射和建立证书放置的目录和证书上传)

[root@tcvps conf.d]# cat https.conf
#server {
# listen 80;
# server_name www.starz.top;
# return 301 https://$server_name$request_uri;

# location / { root html; index index.php index.html index.htm Login.aspx;
#}
#}
server {
listen 443 ssl;
server_name www.starz.top;
##ssl on;
ssl_certificate /data/blog.pem;
ssl_certificate_key /data/blog.key;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
ssl_prefer_server_ciphers on;

location / {
proxy_pass https://docker.starz.top:4443;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header REMOTE-HOST $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_cache_valid 200 10m;
proxy_read_timeout 300;
proxy_send_timeout 300;

}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}

13.在frpc.ini加入字段，并重启frpc服务

[blog]
type = http
local_ip = 192.168.1.237
local_port = 80
custom_domains = www.starz.top

14.在proxy容器配置文件写入如下文件并重启容器(提前建立证书文件路径和放置证书)proxy的目的是给内网访问和外网的80网址自动重写跳转443

[root@docker frp_tc]# cat /root/docker/proxy/conf.d/https.conf
server {
listen 80;
server_name www.starz.top;
return 301 https://$server_name$request_uri;

location / { root html; index index.php index.html index.htm Login.aspx;
}
}
server {
listen 443 ssl;
server_name www.starz.top;
##ssl on;
ssl_certificate /data/blog.pem;
ssl_certificate_key /data/blog.key;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
ssl_prefer_server_ciphers on;

location / {
proxy_pass https://172.17.0.12;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header REMOTE-HOST $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#proxy_cache webserver;
proxy_cache_valid 200 10m;
proxy_read_timeout 300;
proxy_send_timeout 300;

}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}

内网和公网的域名新增

公网域名