从0开始速配VPS用于网站等

前言

鸽了好久好久,终于再写篇文章了.

写这篇文章主要是想记录📝一下VPS配置过程,
(本地其实有的,只不过太杂了,本文精减一下内容,有些东西是不必要的,所以整理一下,方便我以后CV)

今早上起床一看邮箱,咦,今天凌晨新注册账号然后申请的Vultr Free Tier Program居然过了.

作为白嫖党、当然马上就开整.配置过程,发现本地记录配置的东西有些不适合这个小小的垃圾VPS(1 颗虚拟核心、512MB 内存、10GB 硬盘、一个 IPv4 地址),所以打算写篇文章,精简精简内容.

注:本文对Windows用户不太友好.部分问题可能需要自己解决.本文包安装器为apt,archlinux等用户看我以后有木有空整整.

密钥登陆

首先,配置vps的sshd服务,为了安全,我只推荐使用密钥登陆,密码的话,服务器天天被爆破,我感觉很难受.

如何配置这个免密登陆呢?

其实很简单,网上教程很多,但是很乱,我这里直接说怎么做.实现本机免密登陆

获取本机公钥

如果你是Linux或者macOS用户.打开终端.

曾生成过公私钥

直接命令

1	cat .ssh/id_rsa.pub

将输出的内容复制

未生成过公私钥

1	ssh-keygen

然后一路回车默认就行(当然输点内容也是可以的)

然后按照👆上面操作就行.

配置免密登陆

在vultr开机子的界面有SSH Keys这个地方.点Add New将你的上面复制的公钥粘贴进去.(Name自己随便起个名字)

或者用下面命令行解决.

1
2
3

ssh-copy-id -i ~/.ssh/id_rsa.pub root@ip

然后机子开完后有ip地址,复制它.

然后在终端输入

1	ssh root@ip -p 22

登进去后,先改改sshd的配置

1	vim /etc/ssh/sshd_config

更改部分内容为下面(对应的建议取消注释)👇

PermitRootLogin prohibit-password 
Port 12345 
LogLevel VERBOSE 
AuthorizedKeysFile	.ssh/authorized_keys 
PasswordAuthentication no 
PubkeyAuthentication yes 
GatewayPorts yes 
AllowTcpForwarding yes 
X11Forwarding yes 
PrintMotd yes 
PrintLastLog yes 
TCPKeepAlive yes 
ClientAliveInterval 60 
ClientAliveCountMax 60

防火墙

接下来弄防火墙

apt update 
apt upgrade -y 
apt dist-upgrade -y
ufw enable 
ufw status numbered 
ufw delete 1 
ufw delete 2
ufw allow 12345 
ufw allow 443

配置VIM,使得好用

sudo apt update && sudo apt upgrade && sudo apt autoremove
apt install vim-gtk3 wget git 
mkdir -p ~/.vim/colors/
wget https://raw.githubusercontent.com/tomasr/molokai/master/colors/molokai.vim -O ~/.vim/colors/molokai.vim
git clone --depth=1 https://github.com/VundleVim/Vundle.vim.git ~/.vim/bundle/Vundle.vim
vim ~/.vimrc

填入一下内容(注意,格式不要乱)

 "----------------- Configuration file for vim-----------------------
 set modelines=0     " CVE-2007-2438

 " Normally we use vim-extensions. If you want true vi-compatibility
 " remove change the following statements
 set nocompatible    " Use Vim defaults instead of 100% vi compatibility
 set backspace=2     " more powerful backspacing

 " Don't write backup file if vim is being called by "crontab -e"
 au BufWrite /private/tmp/crontab.* set nowritebackup nobackup
 " Don't write backup file if vim is being called by "chpass"
 au BufWrite /private/etc/pw.* set nowritebackup nobackup

 let skip_defaults_vim=1
 " 设置外观 -------------------------------------
 colorscheme molokai " 设定配色方案
 set number                      "显示行号
 set showtabline=0               "隐藏顶部标签栏"
 set guioptions-=r               "隐藏右侧滚动条"
 set guioptions-=L               "隐藏左侧滚动条"
 set guioptions-=b               "隐藏底部滚动条"
 "set cursorline                  "突出显示当前行"
 "set cursorcolumn                "突出显示当前列"
 set langmenu=zh_CN.UTF-8        "显示中文菜单
 " 变成辅助 -------------------------------------
 syntax on                       "开启语法高亮
 "set nowrap                      设置代码不折行"
 set fileformat=unix             "设置以unix的格式保存文件"
" set cindent                     "设置C样式的缩进格式"
 set tabstop=4                   "一个 tab 显示出来是多少个空格，默认 8
 set shiftwidth=4                "每一级缩进是多少个空格
 set backspace+=indent,eol,start "set backspace&可以对其重置
 set showmatch                   "显示匹配的括号"
 set scrolloff=5                 "距离顶部和底部5行"
 set laststatus=2                "命令行为两行"
 " 其他杂项 -------------------------------------
 set mouse=a                     "启用鼠标"
 set selection=exclusive
 set selectmode=mouse,key
 set matchtime=5
 set ignorecase                  "忽略大小写"
 set incsearch
 set hlsearch                    "高亮搜索项"
 set noexpandtab                 "不允许扩展table"
 set whichwrap=b,s,h,l,[,],<,>
 set autoread

set nocompatible  " be iMproved, required
filetype off  " required
"启用vundle来管理vim插件
set rtp+=~/.vim/bundle/Vundle.vim
call vundle#begin()
" 安装插件写在这之后
"Plugin 'Valloric/YouCompleteMe'
Plugin 'jiangmiao/auto-pairs'
Plugin 'frazrepo/vim-rainbow'
Plugin 'itchyny/lightline.vim'

Plugin 'VundleVim/Vundle.vim'
"安装插件写在这之前
call vundle#end() " required
"filetype plugin on " required
" 常用命令
" :PluginList       - 查看已经安装的插件
" :PluginInstall    - 安装插件
" :PluginUpdate     - 更新插件
" :PluginSearch     - 搜索插件
" :PluginClean      - 删除插件，把安装插件对应行删除，然后执行这个命令即可
" h: vundle         - 获取帮助

let g:rainbow_active = 1


" YouCompleteMe
set runtimepath+=~/.vim/bundle/YouCompleteMe
let g:ycm_collect_identifiers_from_tags_files = 1           " 开启 YCM 基于标签引擎
let g:ycm_collect_identifiers_from_comments_and_strings = 1 " 注释与字符串中的内容也用于补全
let g:syntastic_ignore_files=[".*\.py$"]
let g:ycm_seed_identifiers_with_syntax = 1                  " 语法关键字补全
let g:ycm_complete_in_comments = 1
let g:ycm_confirm_extra_conf = 0
let g:ycm_key_list_select_completion = ['<c-n>', '<Down>']  " 映射按键, 没有这个会拦截掉tab, 导致其他插件的tab不能用.
let g:ycm_key_list_previous_completion = ['<c-p>', '<Up>']
let g:ycm_complete_in_comments = 1                          " 在注释输入中也能补全
let g:ycm_complete_in_strings = 1                           " 在字符串输入中也能补全
let g:ycm_collect_identifiers_from_comments_and_strings = 1 " 注释和字符串中的文字也会被收入补全
let g:ycm_global_ycm_extra_conf='~/.vim/bundle/YouCompleteMe/third_party/ycmd/cpp/ycm/.ycm_extra_conf.py'
let g:ycm_show_diagnostics_ui = 0                           " 禁用语法检查
inoremap <expr> <CR> pumvisible() ? "\<C-y>" : "\<CR>" |            " 回车即选中当前项
nnoremap <c-j> :YcmCompleter GoToDefinitionElseDeclaration<CR>|     " 跳转到定义处
let g:ycm_min_num_of_chars_for_completion=2                 " 从第2个键入字符就开始罗列匹配项

noremap <c-z> <NOP>
" 换行的时候可以自动跳到下一行
imap {<CR> {<CR>}<ESC>O

let g:ycm_semantic_triggers =  {
			\ 'c,cpp,python,java,go,erlang,perl': ['re!\w{2}'],
			\ 'cs,lua,javascript': ['re!\w{2}'],
			\ }
let g:ycm_filetype_whitelist = {
			\ "c":1,
			\ "cpp":1,
			\ "objc":1,
			\ "sh":1,
			\ "zsh":1,
			\ "zimbu":1,
			\ }
"对话框的颜色修改为灰色
highlight PMenu ctermfg=0 ctermbg=242 guifg=black guibg=darkgrey
highlight PMenuSel ctermfg=242 ctermbg=8 guifg=darkgrey guibg=black
"关闭YCM 自动弹出函数原型预览窗口
set completeopt=menu,menuone
let g:ycm_add_preview_to_completeopt = 0

set t_Co=256

"set clipboard^=unnamed,unnamedplus

set termencoding=utf-8
set encoding=utf8
"set fileencodings=utf8,ucs-bom,gbk,cp936,gb2312,gb1803

然后输入:wq保存退出.

vim ~/.vimrc
:PluginInstall 
等待安装Done完成
然后:q然后:q就整完了.

整个好用的SHELL

安装 zsh

如果想快速搞(不想配置)的话,直接用Fish

一条命令即可: apt install fish && chsh -s /usr/bin/fish # fish设置为默认shell,

但由于习惯了bash的语法,部分fish又有些不同,不想记.故接下来整zsh配上Oh My Zsh

apt install zsh curl
sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"

echo $SHELL 
cat /etc/shells 
chsh -s /usr/bin/zsh

配置 zsh

git clone --depth=1 https://github.com/zsh-users/zsh-syntax-highlighting.git ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-syntax-highlighting
git clone --depth=1 https://github.com/zsh-users/zsh-autosuggestions ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-autosuggestions
git clone --depth=1 https://github.com/zsh-users/zsh-completions ${ZSH_CUSTOM:-${ZSH:-~/.oh-my-zsh}/custom}/plugins/zsh-completions
vim ~/.zshrc
plugins=(git zsh-autosuggestions zsh-syntax-highlighting zsh-completions) 
然后:wq
source ~/.zshrc

关于配色,更多插件哪些就自己需要就自己去弄吧,反正我感觉常用的就行.

语言设定

1
2
3


export LC_ALL=zh_CN.UTF-8
export LANG=zh_CN.UTF-8

locale-gen zh_CN.UTF-8 
vim /etc/default/locale 
LC_ALL=zh_CN.UTF-8
LANG=zh_CN.UTF-8

~/.zshrc 添加内容参考(#后内容代表可选,需要的话就取消注释)

export HISTCONTROL=ignorespace
DISABLE_MAGIC_FUNCTIONS=true
export EDITOR='vim'

setopt HIST_IGNORE_DUPS

alias anon="unset HISTFILE"
alias enlog="export HISTFILE=/Users/lanyun/.zsh_history"
export LC_ALL=zh_CN.UTF-8
export LANG=zh_CN.UTF-8
export TERM=xterm-256color
alias git-log="git log --pretty=oneline --all --graph --abbrev-commit"
export GPG_TTY=$(tty)

alias unset-proxy="unset http_proxy && unset https_proxy && unset all_proxy"


alias cl="clear"
export TERMINFO=/usr/share/terminfo

安装screen

apt install -y screen
vim ~/.screenrc 
termcapinfo xterm* ti@:te@
defscrollback 10000

安装Nginx QUIC

下面内容已过期,无需采用下面方式,nginx主线已支持quic

什么是 HTTP/3 和 QUIC ？

HTTP/3 是一种基于 QUIC（Quick UDP Internet Connections）协议的 HTTP 协议版本，它是 HTTP/2 的后继者，旨在改进 Web 性能和安全性。

HTTP/3 与之前的 HTTP 协议有很大的不同，最明显的区别是它使用 QUIC 协议而不是 TCP 协议来传输数据。

QUIC 是一种由 Google 开发的协议，基于 UDP，它在保持安全性的同时提供更快的连接和更少的延迟。与 TCP 不同，QUIC 允许多个请求同时在同一连接上进行，从而减少了网络拥塞和握手延迟的影响。

总的来说，HTTP/3 的设计目标是通过减少延迟和提高性能，为 Web 应用程序提供更快、更安全和更高效的用户体验。

上面👆的介绍看看就行.接下来准备安装.

通常情况下,有能力,机子性能不差的话,自己编译,自定义程度高.但这里机子性能差,然后我们图方便就直接用别人编译打包📦好的版本.

本次采用的是烧饼博客团队打包的Nginx Quic版本,基于 Nginx QUIC 官方源码打包的,支持HTTP/3和 QUIC协议.

apt update
apt upgrade -y
apt dist-upgrade -y
apt install -y curl vim wget gnupg dpkg apt-transport-https lsb-release ca-certificates 

curl -sS https://n.wtf/public.key | gpg --dearmor > /usr/share/keyrings/n.wtf.gpg 

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/n.wtf.gpg] https://mirror-cdn.xtom.com/sb/nginx/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/n.wtf.list 

apt update
apt install nginx-extras -y
nginx -V 
systemctl enable nginx

或者自行编译最新版并安装


sudo apt update && sudo apt upgrade && sudo apt autoremove
sudo apt install -y build-essential ca-certificates zlib1g-dev libpcre3 libpcre3-dev tar unzip libssl-dev wget curl libtool git cmake ninja-build mercurial libunwind-dev pkg-config golang 

git clone --depth=1 --recurse-submodules -j8 https://github.com/google/ngx_brotli
cd ngx_brotli/deps/brotli
mkdir out && cd out
cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF -DCMAKE_C_FLAGS="-Ofast -march=native -mtune=native -flto -funroll-loops -ffunction-sections -fdata-sections -Wl,--gc-sections" -DCMAKE_CXX_FLAGS="-Ofast -march=native -mtune=native -flto -funroll-loops -ffunction-sections -fdata-sections -Wl,--gc-sections" -DCMAKE_INSTALL_PREFIX=./installed ..
cmake --build . --config Release --target brotlienc
cd ../../../..

git clone -b master --depth=1 https://github.com/openssl/openssl.git
cd openssl
./Configure --prefix=/usr/src/openssl --openssldir=/usr/src/openssl
make install
cd ..

git clone --depth=1 https://github.com/GetPageSpeed/ngx_security_headers

hg clone https://hg.nginx.org/nginx
cd nginx
make clean
./auto/configure --prefix=/etc/nginx --user=www-data --group=www-data --with-pcre --add-module=../ngx_brotli --add-module=../ngx_security_headers --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --with-http_v2_module --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-stream_realip_module --with-compat --with-threads --with-file-aio --with-http_ssl_module --with-http_gzip_static_module --with-http_gunzip_module --with-http_secure_link_module  --with-http_stub_status_module --with-http_auth_request_module --with-http_slice_module --with-http_sub_module --with-http_flv_module --with-http_addition_module --with-http_realip_module --with-http_mp4_module --with-http_dav_module --with-http_v3_module \
--with-cc-opt="-I /usr/src/openssl/include" \
--with-ld-opt="-L /usr/src/openssl/lib64"
make
make install
cd ..


rm -rf ngx_brotli openssl ngx_security_headers nginx /usr/src/openssl


nginx -V

配置Nginx

关于如何自动续期证书,本站已有相关文章,不在赘述.

另外一下内容均以 example.com 为例，网站目录位于 /var/www/example.com 的示例.

请结合实际修改.也可以参考 Mozilla 的 SSL 配置生成器

跳转所有的 HTTP 请求：

server {
    listen 80 default_server;
    listen [::]:80 default_server;
  	server_name example.com;

    location / {
    		rewrite ^(.*)$ https://${server_name}$1 permanent;
        
    }
}

生成 dhparam 文件：

1 2	mkdir -p /etc/nginx/ssl openssl dhparam -dsaparam -out /etc/nginx/ssl/dhparam 2048

性能低的也可以直接用 Mozilla 给你生成好的：

1	curl https://ssl-config.mozilla.org/ffdhe2048.txt > /etc/nginx/ssl/dhparam

监听 443 端口并开启 HTTP/2、HTTP/3、OCSP、TLS 1.3 和 HSTS:

server {	
    listen 443 ssl default_server;
    ssl_reject_handshake on;
}

server {
    listen 443 ssl http2;
		listen [::]:443 ssl http2;
		listen 443 http3 reuseport;
 		listen [::]:443 http3 reuseport;

    server_name example.com;
    root /var/www/example.com;
    index index.html;

    ssl_certificate /etc/nginx/ssl/example_com.chain.crt;
    ssl_certificate_key /etc/nginx/ssl/example_com.key;
    ssl_trusted_certificate /etc/nginx/ssl/example_com.ca.crt;

    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;

    ssl_dhparam /etc/nginx/ssl/dhparam;

    ssl_protocols TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305';
    ssl_prefer_server_ciphers off;

  	add_header Alt-Svc 'h3=":443"; ma=86400';
		add_header Referrer-Policy strict-origin-when-cross-origin;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; 
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";

    ssl_stapling on;
    ssl_stapling_verify on;

    
    
    
}

然后测试 Nginx 配置并重新加载:

1 2	nginx -t nginx -s reload

关于nginx设置防护等等,就懒的写了.

完结✅

推荐订阅源

LanYunのBlog

前言