1
2
3
4

# 使用 apt 安装
sudo apt update
sudo apt install certbot python3-certbot-nginx  # 对于 Nginx
sudo apt install certbot python3-certbot-apache # 对于 Apache

1
2
3
4
5
6
7
8

# CentOS/RHEL 8+
sudo dnf install certbot python3-certbot-nginx

# CentOS/RHEL 7
sudo yum install certbot python3-certbot-nginx

# Fedora
sudo dnf install certbot python3-certbot-nginx

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# 安装 Snap
sudo apt install snapd  # Debian/Ubuntu
sudo dnf install snapd  # Fedora
sudo yum install snapd  # CentOS

# 确保 Snap 核心已安装
sudo snap install core
sudo snap refresh core

# 安装 Certbot
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

1
2
3
4
5

# Nginx 自动配置
sudo certbot --nginx

# Apache 自动配置
sudo certbot --apache

1
2
3
4
5

root /var/www/html;
location / {
    try_files $uri $uri/ =404;  # 先查找静态文件，找不到才返回404
    proxy_pass http://127.0.0.1:8080;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

server {
    listen 80;
    server_name _;
    
    # 移除静态文件根目录
    # root /var/www/html;
    
    location / {
        # 直接代理到 Java 应用，不检查静态文件
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 超时控制
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
        
        # 等保要求：安全头部
        add_header X-Content-Type-Options nosniff;
        add_header X-Frame-Options DENY;
        add_header X-XSS-Protection "1; mode=block";
    }

    # 等保要求：禁止敏感文件访问
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

server {
    listen 80;
    server_name _;
    root /var/www/html;

    location / {
        # 优先尝试静态文件，不存在则代理到 Java 应用
        try_files $uri @java_app;
    }

    location @java_app {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }

    # 静态资源安全配置
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        try_files $uri =404;
    }

    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
}

1
2
3
4
5
6
7
8

# 检查应用是否在运行
ps aux | grep phoneCard-admin.jar

# 检查端口监听
netstat -tlnp | grep 8080

# 直接测试应用
curl http://127.0.0.1:8080

1

tail -f /var/log/nginx/error.log

1
2
3
4
5
6
7

# 测试配置语法
sudo nginx -t

# 重新加载配置
sudo systemctl reload nginx
# 或
sudo nginx -s reload

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

server {
    listen 80;
    server_name _;
    
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }
    
    location ~ /\. {
        deny all;
    }
}

1
2
3
4
5
6
7
8

flowchart TD
    A[开始部署] --> B[使用 root 安装软件]
    B --> C[创建专属用户和组]
    C --> D[创建目录并设置权限]
    D --> E[配置文件调整]
    E --> F[创建 systemd 服务]
    F --> G[使用专属用户启动服务]
    G --> H[验证和测试]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

# 1. 安装 JDK
yum install java-11-openjdk-devel   # CentOS/RHEL
# 或
apt install openjdk-11-jdk          # Ubuntu/Debian

# 2. 安装 MySQL
# 方式1: 使用包管理器
yum install mysql-server
# 方式2: 下载官方二进制包解压（此时还是用root）
tar -xzf mysql-8.0.xx.tar.gz -C /usr/local/
cd /usr/local && ln -s mysql-8.0.xx mysql

# 3. 安装 Redis
yum install redis
# 或从源码编译
tar -xzf redis-7.0.x.tar.gz
cd redis-7.0.x && make && make install

# 4. 安装 Nginx
yum install nginx
# 或从源码编译
tar -xzf nginx-1.20.x.tar.gz
cd nginx-1.20.x && ./configure --prefix=/usr/local/nginx && make && make install

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 创建系统用户组
groupadd -r mysql-group
groupadd -r redis-group
groupadd -r nginx-group
groupadd -r app-group  # 为你的Java应用创建

# 创建系统用户，并指定家目录（后续作为其工作目录），并禁止登录
useradd -r -g mysql-group -s /bin/false -d /usr/local/mysql mysql-user
useradd -r -g redis-group -s /bin/false -d /var/lib/redis redis-user
useradd -r -g nginx-group -s /bin/false -d /usr/local/nginx nginx-user
useradd -r -g app-group -s /bin/false -d /opt/your-java-app app-user