15还是16年的时候买的阿里云和腾讯云最低配的1核1G。腾讯云和阿里云后来都涨价了，退了涨价多的那个腾讯云，阿里云一直续费到现在，wordpress这个最早的时候是用军哥的lnmp的一键包搭建的，后来改成用了带UI的宝塔，宝塔用了一段时间后发现Let's Encrypt的SSL证书续期总掉，还不如一键包的时候的cert bot。
在互联网上搜索1核1G能否安装docker，回答也是模棱两可。在wordpress上安装UpdraftPlus插件备份全部数据，最后趁着空闲时间安装上docker和docker compose后发现，这个内存cpu占用比宝塔低，感觉是真香。
简单搭了一下wordpress和portainer配置了一下域名，使用UpdraftPlus插件恢复数据，文章、主题、数据都回来了。https的问题后续再搞定。
吐槽一下，现在阿里云不让1核1G重装为Rocky Linux和Alma LInux，为了推广自己的CentOS替代真是用尽策略。现在还保留了已经EOL的CentOS8，试了一下转换Rocky Linux的脚本也失效了。所以我最终退回了Centos 7.8。
1核1G的mysql数据库在阿里云上表现不是很好，很多时候会由于io问题挂掉。所以需要关掉性能模式。阿里云原理上还是虚拟机，大家都知道虚拟机是共享内存cpu硬盘的。一般每周一9点是高峰期，这个时间测下高峰期的iops可以看看你买的机器是否合适。续费的时候需要再测一遍，因为后续还会有同一宿主机的虚拟机入驻。我的mysql不关性能模式在高峰期是直接挂掉的。
迁移后的配置
1.docker配置
docker-compose.yml的配置如下
version: '2'
services:
portainer:
image: 'portainer/portainer-ce:latest'
container_name: portainer
ports:
- '19000:9000'
volumes:
- '${PWD}/portainer/data:/data'
- '/var/run/docker.sock:/var/run/docker.sock'
restart: always
mysql:
container_name: mysql
image: 'mysql:8.0.28'
volumes:
- '${PWD}/mysql/db:/var/lib/mysql'
- '${PWD}/mysql/conf/my.cnf:/etc/mysql/my.cnf'
- '${PWD}/mysql/init:/docker-entrypoint-initdb.d'
#ports:
#- '3306:3306'
environment:
- MYSQL_ROOT_PASSWORD=wordpress@2023
- MYSQL_DATABASE=wordpress
- MYSQL_USER=wordpress
- MYSQL_PASSWORD=wordpress@2023
- TZ=Asia/Shanghai
restart: always
command:
- '--character-set-server=utf8mb4'
- '--collation-server=utf8mb4_unicode_ci'
wordpress:
container_name: wordpress
depends_on:
- mysql
image: 'wordpress:latest'
volumes:
- '${PWD}/wordpress:/var/www/html'
#ports:
#- '80:80'
restart: always
environment:
WORDPRESS_DB_HOST: 'mysql:3306'
WORDPRESS_DB_USER: wordpress
WORDPRESS_DB_PASSWORD: wordpress@2023
WORDPRESS_DB_NAME: wordpress
nginx:
container_name: nginx
image: 'nginx:1.20.0'
ports:
- '80:80'
volumes:
- '${PWD}/nginx/html:/usr/share/nginx/html'
- '${PWD}/nginx/conf.d:/etc/nginx/conf.d'
environment:
- TZ=Asia/Shanghai
restart: always
nginx配置文件default.conf
server {
listen 80;
listen [::]:80;
server_name blog.example.com;
location / {
proxy_pass http://wordpress/;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
listen [::]:80;
server_name www.example.com;
return 301 http://blog.example.com;
}
mysql配置文件my.cnf
# Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
#
# The MySQL Server configuration file.
#
# For explanations see
# http://dev.mysql.com/doc/mysql/en/server-system-variables.html
[mysqld]
pid-file = /var/run/mysqld/mysqld.pid
socket = /var/run/mysqld/mysqld.sock
datadir = /var/lib/mysql
secure-file-priv= NULL
# Custom config should go here
!includedir /etc/mysql/conf.d/访问blog.example.com进行wordpress初始化配置
然后安装UpdraftPlus插件恢复数据。
2.关闭mysql性能模式
命令如下
全局查找配置文件
#全局查找配置文件
find / -name my.cnf
#非容器模式下的路径是/etc/my,cnf
#容器下的路径是/etc/mysql/my.cnf编辑配置文件
vi /etc/mysql/my.cnf在[mysqld]后加
performance_schema=off重启mysql生效
3.安装安全增强插件
默认情况下公网总有一些ip扫描xmlrpc.php，所以我们需要安装爆破扫描插件禁掉这些访问。
如果想查看你的xmlrpc.php服务是否开启，可以访问 http://www.example.com/xmlrpc.php有返回则为开启状态。
需要安装的插件名为Disable XML-RPC-API ，安装后默认禁用xmlrpc.php访问，可添加ip白名单
