於 2015.6.4 的 LaraDiner (Laravel 讀書會) 中，導讀《Modern PHP》的第七章。

1. Modern PHP
Ch 7. provisioning
導讀
ChengWei @ LaraDiner 2015.6.4

2. 前言
• 這是⼀一本關於 PHP 的書，所以不會講太深
⼊入的 system administration
• 本章範圍適⽤用於 VPS 或可⾃自由安裝軟體及
設置 config 的環境。
• 如果你不喜歡透過 Command Line 管理主
機，那建議可以改⽤用 PaaS，例如 Engine
Yard、Heroku

3. 目標
• 先有⼀一台 VPS
• 設置 Web Server 處理 HTTP request
• 設置 PHP processes 處理 php request
• 以前常⾒見的做法是
Apache + Apache mod_php
現在則是
Nginx + php-fpm

4. VPS
• 推薦 Linode 或 DigitalOcean
• 最⼩小計費單位為，按⼩小時計費
• 成功開機後，就會收到 root 密碼，及
⼀一些基本的資料。

5. VPS
• 推薦 Linode 或 DigitalOcean
• 最⼩小計費單位為，按⼩小時計費
• 成功開機後，就會收到 root 密碼，及
⼀一些基本的資料。
補充說明：DigitalOcean 可以預先設置 SSH Key-Pair

6. First Login
• use SSH
• root / password

7. First Login
補充說明

8. Software Update
• Ubuntu -> apt-get update
-> apt-get upgrade
• CentOS -> yum update

9. Basic Security
• Nonroot User (with SUDO)
• SSH Key-Pair Authentication
• Disable Passwords and Root Login
• setup firewall (iptables)

10. Basic Security
• Nonroot User (with SUDO)
adduser <username>
usermod -a -G sudo <username>

11. Basic Security
• SSH Key-Pair Authentication
!
Local
~/.ssh/
id_rsa.pub
!
VPS
~/.ssh/
authorized_keys

12. Basic Security
• SSH Key-Pair Authentication
!
Local
~/.ssh/
id_rsa.pub
!
VPS
~/.ssh/
authorized_keys
chmod 700 ~/.ssh/
chmod 600 ~/.ssh/authorized_keys

13. Basic Security
• Disable Passwords and Root Login
編輯 /etc/ssh/sshd_config

14. Basic Security
• setup firewall (iptables)
就是好好的讀⼀一下 iptables ⽂文件，
參考別⼈人的 Examples。
補充說明

15. PHP-FPM
• PHP FastCGI Process Manager
• Master process -> Child process
!
!
Master
Child
Child
Child

16. PHP-FPM - install
• Ubuntu 14.04 -> apt-get -> v5.5.9
• newer version -> read the book
• Or Google
“how to install latest php on …”
• Or build php from source

17. PHP-FPM - Global Configuration
• edit php.ini
ubuntu -> /etc/php5/fpm/php.ini
• edit php-fpm.conf
ubuntu
-> /etc/php5/fpm/php-fpm.conf

18. PHP-FPM - Global Configuration
• emergency_restart_threshold = 10
• emergency_restart_interval = 1m

19. PHP-FPM - Global Configuration
• emergency_restart_threshold = 10
• emergency_restart_interval = 1m
What this mean? So if 10 PHP-FPM child
processes exit with SIGSEGV or SIGBUS within
1 minute then PHP-FPM restart automatically.

20. !
Pool
PHP-FPM - Pool Configuration
• Master Process -> Pool (Child Process)
• Pool name
!
!
Master
Child
Child
Child

21. • Master Process -> Pool (Child Process)
• Pool name
!
Pool: www2
!
Pool: www
PHP-FPM - Pool Configuration
!
!
Master
Child
Child

22. pool.d/www.conf
pool.d/www2.conf
!
Pool: www2
!
Pool: www
PHP-FPM - Pool Configuration
Child
Child
!
Master
Child

23. pool.d/www.conf
pool.d/www2.conf
!
Pool: www2
!
Pool: www
PHP-FPM - Pool Configuration
Child
Child
!
Master
Child

24. PHP-FPM - Pool Configuration
• user = deploy
• group = deploy
• listen = 127.0.0.1:9000
• listen.allowed_clients = 127.0.0.1

25. PHP-FPM - Pool Configuration
• user = deploy
• group = deploy
• listen = 127.0.0.1:9000
• listen.allowed_clients = 127.0.0.1
Security
Security
Security

26. PHP-FPM - Global Configuration
• user = deploy
• group = deploy
• listen = 127.0.0.1:9000
listen = /var/run/php5-fpm.sock
• listen.allowed_clients = 127.0.0.1
補充說明
Security
Security
Security

27. PHP-FPM - Global Configuration
• pm.max_children = 51
• pm.start_servers = 3
• pm.min_spare_servers = 2
• pm.max_spare_servers = 4
• pm.max_requests = 1000

28. PHP-FPM - Global Configuration
• pm.max_children = 51
• pm.start_servers = 3
• pm.min_spare_servers = 2
• pm.max_spare_servers = 4
• pm.max_requests = 1000
tuning
tuning
tuning
tuning
tuning

29. PHP-FPM - Global Configuration
• slowlog = /path/to/slowlog.log
• request_slowlog_timeout = 5s

30. PHP-FPM - Global Configuration
• slowlog = /path/to/slowlog.log
• request_slowlog_timeout = 5s
performance
performance

31. Nginx
• 發⾳音 (in gen ex) (影居ㄟ 可斯)

32. Nginx - install
• Ubuntu 14.04 -> apt-get -> v1.4.6
• newer version -> read the book
• Or Google
“how to install latest Nginx on …”
• Or build Nginx from source

33. Nginx - Virtual Host
• ubuntu
-> /etc/nginx/sites-available/
-> /etc/nginx/sites-enabled/
• server { … }
手動 ln

34. Nginx - Virtual Host

35. Nginx - Virtual Host
注意權限

36. Nginx - Virtual Host
80(http), 443(https)

37. Nginx - Virtual Host
80(http), 443(https)
SSL config

38. Nginx - Virtual Host
domain name

39. Nginx - Virtual Host
default file (index.html,index.php …)

40. Nginx - Virtual Host
HTTP request body size

41. Nginx - Virtual Host
root directory

42. Nginx - Virtual Host
try_files 檔案是否存在

43. Nginx - Virtual Host
PHP request

44. Nginx - Virtual Host
or “unix:/var/run/php5-fpm.sock;”

45. Automate Server Provisioning
• Puppet (https://puppetlabs.com/)
• Chef (https://www.chef.io/chef/)
• Ansible (http://www.ansible.com)
• SaltStack (http://saltstack.com/)

46. Automate Server Provisioning
• Puppet (https://puppetlabs.com/)
• Chef (https://www.chef.io/chef/)
• Ansible (http://www.ansible.com)
• SaltStack (http://saltstack.com/)
Ruby
Ruby
Python
Python

47. Automate Server Provisioning
• Puppet (https://puppetlabs.com/)
• Chef (https://www.chef.io/chef/)
• Ansible (http://www.ansible.com)
• SaltStack (http://saltstack.com/)
Ruby
Ruby
Python
Python
補充說明: AWS OpsWorks supports Chef recipes

48. Delegate Server Provisioning
• Forge
(https://forge.laravel.com/)

49. Further Reading
The best system administration learning
resource for developers.
Servers for Hackers by Chris Fidao
• Website
(https://serversforhackers.com/)
• ebook
(https://book.serversforhackers.com/)
agree

50. 結束 (誠徵高手補充說明)
ChengWei @ LaraDiner 2015.6.4