Nginx+Docker+WordPress部署可扩展的个人博客

使自己变强和会宣传自己一样重要。

要做啥？

部署个人博客，通过https://yousite.xx网址访问，后期比如我们开发了AI业务，可以通https://ai.yousite.xx访问。

怎么做？

首先，在阿里云购买ECS 和 域名，这样你就拥有了”土地“和”门牌号“，接下来我们就开始构建我们的房屋了。

先明确，我们经常在浏览器中使用的http和https他们默认的端口号是80和443。接着我们要做的事情就是在服务器上部署Nginx，它默认监听的端口是80，也就是http的请求，我们要修改配置让它监听443端口，也就是监听https过来的请求。当可以监听所有https的请求的时候，我们就可以通过请求的路径来区别yousite.xx和other_server _name.yousite.xx了。

有了能够区别不同请求之后，我们就可以通过不同的请求提供不同的服务，当然我们这篇文章的主题是个人博客，所以访问主域名yousite.xx我们要提供展示博客内容。我们将使用nginx部署部署wordpress服务，然后通过nginx监听443端口，指向wordpress所在的容器中的服务。

1. 安装Nginx：Nginx源码安装教程

下载Nginx源码，推荐下载Stable版本，下载后放到ECS服务器上。

Copied!//复制文件到服务器
scp /path/to/local/nginx-1.26.1.tar.gz username@192.168.1.100:/root/

//安装依赖库
yum -y install gcc pcre-devel zlib-devel openssl openssl-devel

//解压
tar -zxvf nginx-1.26.1.tar.gz

// 执行配置
./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-http_stub_status_module

//编译 安装
make
make install

//检查安装情况
cd /usr/local/nginx/sbin/
./nginx -v

//启动
./nginx 

//访问默认页面
此时通过 http://[你的公网Ip] 可以打开nginx默认页面
//复制文件到服务器
scp /path/to/local/nginx-1.26.1.tar.gz username@192.168.1.100:/root/

//安装依赖库
yum -y install gcc pcre-devel zlib-devel openssl openssl-devel

//解压
tar -zxvf nginx-1.26.1.tar.gz

// 执行配置
./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-http_stub_status_module

//编译 安装
make
make install

//检查安装情况
cd /usr/local/nginx/sbin/
./nginx -v

//启动
./nginx 

//访问默认页面
此时通过 http://[你的公网Ip] 可以打开nginx默认页面

1.1 配置证书

使用Certbot配置免费证书，自动到期续签。这个网站做的很完善，可以筛选系统提供很详细的配置教程。配置完成后，就可以通过https:[你的公网IP]访问Nginx默认页面了。

自动签发并配置证书命令，到期自动续期

Copied!// 自动获取并配合证书，且到期自动续期
sudo certbot --nginx -d xxx.xusubest.com -d www.xxx.xusubest.com

// 测试续期是否正常
sudo certbot renew --dry-run
// 自动获取并配合证书，且到期自动续期
sudo certbot --nginx -d xxx.xusubest.com -d www.xxx.xusubest.com

// 测试续期是否正常
sudo certbot renew --dry-run

2. 安装Docker

通过阿里云官方教程安装Docker

3. 使用Docker 容器部署WordPress

新建docker-compose.yml文件，内容如下：

Copied!version: '3'

services:
  db:
    image: mysql:5.7
    volumes:
      - db_data:/var/lib/mysql
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: your_mysql_root_password
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: wordpress

  wordpress:
    depends_on:
      - db
    image: wordpress:latest
    ports:
      - "8000:80"
    restart: always
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_NAME: wordpress
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
    volumes:
      - wordpress_data:/var/www/html
    networks:
      - wordpress_net

volumes:
  db_data:
  wordpress_data:

networks:
  wordpress_net:
version: '3'

services:
  db:
    image: mysql:5.7
    volumes:
      - db_data:/var/lib/mysql
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: your_mysql_root_password
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: wordpress

  wordpress:
    depends_on:
      - db
    image: wordpress:latest
    ports:
      - "8000:80"
    restart: always
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_NAME: wordpress
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
    volumes:
      - wordpress_data:/var/www/html
    networks:
      - wordpress_net

volumes:
  db_data:
  wordpress_data:

networks:
  wordpress_net:

Copied!//部署
docker-compose up -d
//部署
docker-compose up -d

这样你的WordPress就运行好了，它是运行在8000端口，然后再配置你的Nginx，监听443端口指向8000端口。以下是参考配置

/usr/local/nginx/conf/nginx.conf

Copied!#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

# pid        logs/nginx.pid;
pid /var/run/nginx.pid;

events {
    worker_connections  1024;
}


http {
    include       mime.types;
    include       /usr/local/nginx/conf.d/*.conf;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    server {
       
 listen              443 ssl; # managed by Certbot

       ...

       location / {
            proxy_pass http://localhost:8000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    } 
}
#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

# pid        logs/nginx.pid;
pid /var/run/nginx.pid;

events {
    worker_connections  1024;
}


http {
    include       mime.types;
    include       /usr/local/nginx/conf.d/*.conf;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    server {
       
 listen              443 ssl; # managed by Certbot

       ...

       location / {
            proxy_pass http://localhost:8000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    } 
}

到现在为止我们就可以通过公网ip地址访问我们的博客了。

4. 域名指向IP地址

配置域名指向我们的服务器地址，之后，我们就可以通过域名访问我们的博客了。

再说说如何扩展，我们更希望增加一个配置，不去改动目前的配置。这样可以减少不必要的问题。在我们的nginx配置文件中有这样一句话

Copied!include       /usr/local/nginx/conf.d/*.conf;
 include       /usr/local/nginx/conf.d/*.conf;

这句话也很好理解，就是说他会将conf.d目录下以.conf结尾的配置文件导入进来。我们只需要在conf.d目录增加子域名的配置即可，比如前面提到的ai.yousite.xx域名，我们就可以有个对应的ai.conf配置文件，文件内容大致如下：

Copied!server {
    server_name ai.xusubest.com;

    location / {
        # proxy_pass https://localhost:1080;
		
        return 200 'Hello, ai';
        add_header Content-Type text/plain;
 
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/ai.xusubest.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/ai.xusubest.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = ai.xusubest.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    server_name ai.xusubest.com;
    return 404; # managed by Certbot


}
server {
    server_name ai.xusubest.com;

    location / {
        # proxy_pass https://localhost:1080;
		
        return 200 'Hello, ai';
        add_header Content-Type text/plain;
 
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/ai.xusubest.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/ai.xusubest.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = ai.xusubest.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    server_name ai.xusubest.com;
    return 404; # managed by Certbot


}

仔细看，其实这里的配置和nginx.conf内容差不多，只是做了些简化，参考nginx.conf的配置，监听端口然后配置代理转发即可，这里的证书配置也是使用Certbot，我相信如何你已经学会了。

最后，恭喜你🎉