项目实战：利用LNMP环境部署 KodBox私有云盘

利用 LNMP（Linux + Nginx + MySQL + PHP）环境部署 KodBox 私有云盘，是搭建轻量、可控私有存储的常用方案

角色	主机名	IP	操作系统
php+nginx+nfs	web01	10.0.0.110/172.16.1.110	kylinv10sp3
php+nginx+nfs	web02	10.0.0.111/172.16.1.111	kylinv10sp3
mysql+redis	db01	10.0.0.114/172.16.1.114	kylinv10sp3
nginx(7层负载)	lb01	10.0.0.115/172.16.1.115	kylinv10sp3
nfs	nfs01	10.0.0.102/172.16.1.102	kylinv10sp3

环境准备

(1)检查网络

ping 10网段是否能连外网
ping 172网段内网是否互通

(2)配置主机名

hostnamectl set-hostname web01
hostnamectl set-hostname web02
hostnamectl set-hostname db01
hostnamectl set-hostname lb01

(3)配置时间同步

yum install -y ntpdate
echo "*/3 * * * * root ntpdate ntp.aliyun.com   >/dev/null 2>&1"  >> /etc/crontab

db01安装MySQL8.4

#1.下载源到本地并安装
mkdir -p /download ;yum install -y wget && cd /download ; wget https://dev.mysql.com/get/mysql84-community-release-el7-2.noarch.rpm && yum localinstall -y mysql84-community-release-el7-2.noarch.rpm
#2.安装
yum install -y mysql-community-server
#3.开启mysql
systemctl enable mysqld --now
#4.从日志中获取登录密码
grep -i password /var/log/mysqld.log
#5.修改mysql root密码
mysqladmin -u root -p'旧密码' password '新密码'
#6.登陆mysql
mysql -uroot -pAbc@1234
#7.创建kodbox数据库
create database kodbox;
#8.创建kodbox用户并授权它只能从本地和内网登陆
CREATE USER 'kodbox'@'172.16.1.%' IDENTIFIED BY 'Abc@1234';
CREATE USER IF NOT EXISTS 'kodbox'@'localhost' IDENTIFIED BY 'Abc@1234';
#查看用户是否创建成功
SELECT user, host FROM mysql.user;
#9.将kodbox用户授权kodbox库
GRANT ALL  ON kodbox.* TO 'kodbox'@'localhost';
GRANT ALL  ON kodbox.* TO 'kodbox'@'172.16.1.%';
#10.查看是否授权成功
SELECT user, host FROM mysql.user WHERE user = 'kodbox';
#登陆测试
mysql -ukodbox -pAbc@1234

#11.给172.16.1.0/24内网网段允许访问3306端口
firewall-cmd --add-rich-rule='rule family="ipv4" source address="172.16.1.0/24" port protocol="tcp" port="3306" accept' --permanent
firewall-cmd --reload

web01/web02安装Nginx、PHP

Nginx1.28

#1.安装nginx源
cat > /etc/yum.repos.d/nginx.repo <<'EOF'
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/8/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

[nginx-mainline]
name=nginx mainline repo
baseurl=http://nginx.org/packages/mainline/centos/8/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
EOF
#2.安装nginx1.28
yum install -y nginx-1:1.28.0-1.el8.ngx.x86_64
#3.启动nginx
systemctl enable --now nginx.service
#4.nginx服务启动完成，并放行nginx 80端口
firewall-cmd --add-port=80/tcp --permanent 
firewall-cmd --reload
#5..创建www用户
groupadd -g 1999 www
useradd -u 1999 -g www -M -s /sbin/nologin www
#6.查看是否创建成功
id www
#7.修改nginx的系统用户为www，方便后续管理
grep www /etc/nginx/nginx.conf 
user  www;
#8.重新加载nginx配置文件
systemctl reload nginx
#9.查看nginx的系统用户是否为www
ps -ef |grep nginx

PHP8.4

#0.安装编译依赖
yum install -y re2c \
bison \
autoconf \
make \
libtool \
ccache \
libxml2-devel \
curl-devel \
openssl-devel \
bzip2-devel \
libcurl-devel \
libpng-devel \
libwebp-devel \
libjpeg-devel \
oniguruma-devel \
libzip-devel \
freetype-devel \
sqlite-devel \
wget
#1.下载并解压php8.4
wget https://www.php.net/distributions/php-8.4.14.tar.xz -P /download
tar -Jxvf /download/php-8.4.14.tar.xz -C /download/

#2.编译安装php8.4
###进入编译目录
cd /download/php-8.4.14/
###编译前的配置，指定安装目录,和配置文件目录
./configure \
  --prefix=/usr/local/php-8.4.14 \
  --with-config-file-path=/usr/local/php-8.4.14/etc \
  --enable-fpm \
  --with-fpm-user=www \
  --with-fpm-group=www \
  --enable-mbstring \
  --with-curl \
  --with-openssl \
  --with-zlib \
  --with-mysqli \
  --with-pdo-mysql \
  --enable-gd \
  --with-jpeg \
  --with-webp \
  --with-freetype \
  --with-zip \
  --with-bz2
###编译 源代码-->可执行文件(命令) 
make  -j `nproc`  && echo $? 
###安装 创建目录,复制文件
make install  && echo $? 
###添加软链接简化路径
ln -s  /usr/local/php-8.4.14/ /usr/local/php


#3.配置php8.4
###将配置文件复制到正确的位置（很多情况下修改配置不生效就是配置文件地址没搞对）
###复制PHP配置文件
cp /download/php-8.4.14/php.ini-production /usr/local/php/etc/php.ini
###复制PHP-FPM配置文件
cp /usr/local/php/etc/php-fpm.conf.default /usr/local/php/etc/php-fpm.conf
cp /usr/local/php/etc/php-fpm.d/www.conf.default /usr/local/php/etc/php-fpm.d/www.conf
###配置环境变量
echo 'export PATH=${PATH}:/usr/local/php/bin:/usr/local/php/sbin' >> /etc/profile
source /etc/profile
###查看php版本号
php -m && php -v


#4.php-fpm.d/www.conf 子配置文件 <==修改目标
grep -E '^(user|group|listen =)' /usr/local/php/etc/php-fpm.d/www.conf
#修改如下内容
user = www
group = www
listen = 127.0.0.1:9000


#4.配置php服务启动文件
cat > /usr/lib/systemd/system/php-fpm.service <<'EOF'
[Unit]
Description=The PHP FastCGI Process Manager
After=syslog.target network.target

[Service]
Type=simple
PIDFile=/usr/local/php/var/run/php-fpm.pid
ExecStart=/usr/local/php/sbin/php-fpm --nodaemonize --fpm-config /usr/local/php/etc/php-fpm.conf
ExecReload=/bin/kill -USR2 $MAINPID

[Install]
WantedBy=multi-user.target
EOF
###重新加载php服务配置文件并启动php服务器
systemctl daemon-reload
systemctl enable --now php-fpm

设置会话保持Redis

db01安装redis

#db01节点安装redis
yum install -y redis
#配置redis
[root@db01 ~]# grep -E "^(bind|require)" /etc/redis.conf 
bind 127.0.0.1 -::1 172.16.1.114
requirepass Abc@1234
#设置redis开启并开机自启
systemctl enable --now redis
#放行6379端口
firewall-cmd --add-port=6379/tcp --permanent
firewall-cmd --reload

web01/web02配置php的redis扩展模块

由于我是通过编译安装方式安装的php，需要添加redis扩展模块，需要通过PHP扩展的源码编译安装

核心思路

下载扩展源码 → 用phpize生成编译配置 → 编译安装 → 配置php.ini加载扩展 → 重启PHP服务

#1.确认phpize路径（编译扩展的必备工具）
#编译安装的 PHP，phpize通常在 PHP 安装目录的bin文件夹下
find /usr/local/ -name phpize

#2.下载redis扩展源码
## 下载源码包（以6.2.0版本为例，可到https://pecl.php.net/package/redis查看最新版）
wget https://pecl.php.net/get/redis-6.2.0.tgz

#3.解压
tar -zxvf redis-6.2.0.tgz

#4.进入编译目录使用phpize生成编译配置
cd redis-6.2.0/
phpize 
#5.执行后会生成configure文件，此时配置编译参数（指定PHP的配置文件路径）
./configure --with-php-config=/usr/local/php/bin/php-config

#6.编译
make -j2

#7.安装
make install

#8.配置php.ini加载 Redis 扩展
# 在文件末尾添加以下内容（扩展路径替换为make install输出的路径）
echo  "extension=/usr/local/php-8.4.14/lib/php/extensions/no-debug-non-zts-20240924/redis.so" >> /usr/local/php/etc/php.ini

#检查php模块是否有redis
php -m |grep redis

#9.修改www.conf
vim /usr/local/php/etc/php-fpm.d/www.conf
#在行尾添加如下内容
php_value[session.save_handler] = redis
php_value[session.save_path] = "tcp://172.16.1.114:6379?auth=Abc@1234"


#10.检查php语法和nginx语法
php-fpm -t && nginx -t

#11.重新加载php、nginx
systemctl restart php-fpm.service

web01配置Kodbox

#下载kodbox
wget https://static.kodcloud.com/update/download/kodbox.1.64.zip -P /download/
#解压到站点目录
mkdir -p /app/code/kodbox
unzip /download/kodbox.1.64.zip  -d /app/code/kodbox/
#赋权
chown -R www:www /app/code/kodbox/
#编写站点配置文件
cat > /etc/nginx/conf.d/cloud.chenshiquan.xyz.conf <<'EOF'
server {
	listen 80;
	server_name 10.0.0.110;
	root /app/code/kodbox;
	location / {
		index index.php;
}
	location ~* \.php$ {
		fastcgi_pass 127.0.0.1:9000;
		fastcgi_index index.php;
		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
		include fastcgi_params;
	}
}
EOF
#检查nginx语法，并重启nginx
nginx -t
systemctl restart nginx

浏器访问kodbox配置数据库和redis

设置mysql和redis配置的信息，点击下一步

设置用户名密码，点击确定

输入用户名密码，点击登陆

登陆成功，退出登陆

web01将站点目录复制给web02

#1.web02创建站点目录
mkdir -p /app/code/kodbox

#2.web01将站点目录文件传输到/app/code/下，将/etc/nginx/conf.d/下的站点目录配置文件也传过去
[root@web01 ~]# cd /app/code/
[root@web01 /app/code]# scp  -r kodbox  10.0.0.111:`pwd`
[root@web01 /app/code]# cd /etc/nginx/conf.d/

#3.修改nginx配置文件
[root@web01 /etc/nginx/conf.d]# grep -i HTTPS cloud.chenshiquan.xyz.conf 
##修改如下内容
fastcgi_param HTTPS on;
##web01重新加载nginx配置文件
systemctl reload nginx

[root@web01 /etc/nginx/conf.d]# scp  cloud.chenshiquan.xyz.conf 10.0.0.111:`pwd`
#4.web02赋权
[root@web02 ~]# chown  -R www:www /app/code/kodbox/
#5.web02修改站点配置文件
sed -i  's/10.0.0.110/10.0.0.111/g'  /etc/nginx/conf.d/cloud.chenshiquan.xyz.conf
#6.web02重新加载nginx配置文件
systemctl reload nginx

配置lb01安装nginx并配置https

#1.安装nginx源
cat > /etc/yum.repos.d/nginx.repo <<'EOF'
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/8/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

[nginx-mainline]
name=nginx mainline repo
baseurl=http://nginx.org/packages/mainline/centos/8/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
EOF
#2.安装nginx1.28
yum install -y nginx-1:1.28.0-1.el8.ngx.x86_64

#3.上传证书文件解压到/etc/nginx/keys下
unzip 21270968_cloud.chenshiquan.xyz_nginx.zip -d /etc/nginx/keys

#3.修改nginx站点配置文件
cat > /etc/nginx/conf.d/cloud.chenshiquan.xyz.conf <<'EOF'
upstream slb_7 {
hash $remote_addr consistent;
server 10.0.0.110:80;
server 10.0.0.111:80;
}
server {
    listen 80;
    server_name cloud.chenshiquan.xyz;
    return 302 https://cloud.chenshiquan.xyz$request_uri;
}
server {
        listen 443 ssl;
        server_name cloud.chenshiquan.xyz;
        ssl_certificate /etc/nginx/keys/cloud.chenshiquan.xyz.pem;
        ssl_certificate_key /etc/nginx/keys/cloud.chenshiquan.xyz.key;
        ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5:!aNULL:!eNULL:!EXPORT:!IDES:!RC4:!MD5;
        ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        location / {
                #后端服务器是443这里改为https 后端服务器是http这里就是http
                proxy_pass http://slb_7;
                proxy_set_header Host $http_host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Real-Ip $remote_addr;
        }
}
EOF

#4.启动nginx
systemctl enable --now nginx.service

#5.nginx服务启动完成，并放行nginx 80端口
firewall-cmd --add-port=80/tcp --permanent 
firewall-cmd --add-port=443/tcp --permanent 
firewall-cmd --reload

nfs01安装nfs

(1)nfs01安装nfs

#1.在kylinv10sp3中安装服务端软件包,nfs-utils包含了rpcbind
yum install -y nfs-utils && systemctl enable --now rpcbind && systemctl enable --now nfs
#2.修改配置文件
cat > /etc/exports <<EOF
/uploads 172.16.1.0/24(rw,all_squash,anonuid=1999,anongid=1999)
EOF
#3.创建用户
groupadd -g 1999 www
useradd -u 1999 -g www -M -s /sbin/nologin www
#4.给共享目录属主和属组设置为www
mkdir /uploads
chown -R www:www /uploads
#5.生效共享目录配置
exportfs -arv
#6.查看共享目录
showmount -e  localhost

2.设置nfs固定端口

#1.设置nfs固定端口，并防火墙放行端口
cat >> /etc/sysconfig/nfs <<EOF
RQUOTAD_PORT=875
LOCKD_TCPPORT=32803
LOCKD_UDPPORT=32769
MOUNTD_PORT=892
STATD_PORT=662
EOF
#2.给lockd、statd设置端口
vim /etc/nfs.conf
[lockd]
 port=32803
 udp-port=32769

[statd]
# debug=0
 port=662
#重启相关服务(多重启几次 rpcinfo -p 看看端口是否变化)
systemctl restart rpcbind && systemctl restart nfs && systemctl restart nfs-lock
#放行端口
cat > open_port.sh <<'EOF'
#!/bin/bash
##############################################################
# File Name:open_port.sh
# Version:V1.0
# Author:csq
# Organization: www.chenshiquan.xyz
# Desc:
##############################################################

no_open_port=`rpcinfo -p |awk 'NR>1{print $(NF-1)}' | sort | uniq`
for i in ${no_open_port}
do
	open_port=`firewall-cmd --list-all | grep $i | wc -l`
	if [ ${open_port} -eq 0 ];then
	   if firewall-cmd --add-port=$i/tcp --permanent >/dev/null 2>&1;then
		   echo "端口$i放行成功"
	   else
		   echo "端口放行失败"
	   fi
	else
		echo "端口$i已经放行"
	fi
done
firewall-cmd --reload >/dev/null 2>&1
firewall-cmd --list-all
EOF
[root@nfs01 ~]# bash open_port.sh 
端口111放行成功
端口20048放行成功
端口2049放行成功
端口34801放行成功
端口44395放行成功
端口662放行成功
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens33 ens34
  sources: 
  services: cockpit dhcpv6-client mdns ssh
  ports: 111/tcp 20048/tcp 2049/tcp 34801/tcp 44395/tcp 662/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

web01/web02接入nfs

#1.安装nfs-utils
yum install -y nfs-utils
#2.创建临时存放目录/backup，将/app/code/kodbox/data/files/下的文件存放在/backup中
mkdir /backup
#3.先复制/app/code/kodbox/data/files/下的文件到临时目录中
mv /app/code/kodbox/data/files/* /backup/
#4.挂载nfs
mount -t nfs 172.16.1.102:/uploads /app/code/kodbox/data/files/
###永久挂载
echo '172.16.1.102:/uploads /app/code/kodbox/data/files/ nfs defaults 0 0 ' >> /etc/fstab
mount -a
#5.web01将临时目录里的文件移进去(会同步到web02和nfs01)
mv /backup/* /app/code/kodbox/data/files/

上传文件测试

[root@nfs01 ~]# tree /uploads/
/uploads/
├── 202512
│   └── 07_e0094898
│       ├── 高德地图.oexe
│       ├── icloud.oexe
│       ├── index.html
│       └── preview.jpg  #这个就是上传的图片
└── index.html

2 directories, 5 files