Linux: 综合实战——从零搭建 Web 开发服务器

1. SSH 登录          → 6. 部署 Node.js 应用
2. 用户创建 + SSH 加固 → 7. 配置 HTTPS 证书
3. 防火墙配置        → 8. 配置 PM2 进程管理
4. 安装 Nginx        → 9. 自动备份
5. 配置反向代理      → 10. 健康检查 + 告警

□ SSH 登录（root 密码）
□ 更新系统（apt update && apt upgrade）
□ 创建普通用户（useradd -m -s /bin/bash）
□ 配置 sudo（usermod -aG sudo）
□ SSH 密钥认证
□ 禁用 root + 密码登录
□ 防火墙（ufw: 22/80/443）
□ fail2ban 防护
□ 自动安全更新

# Nginx
sudo apt install nginx
sudo systemctl enable --now nginx

# 如果使用 MySQL
sudo apt install mysql-server
sudo mysql_secure_installation

# 应用部署方式对比

#!/bin/bash
# 部署 Node.js 应用到生产环境

# 1. 创建应用目录
sudo mkdir -p /opt/webapp
sudo chown -R alice:alice /opt/webapp

# 2. 拷贝应用文件（假设已开发好）
git clone https://github.com/example/webapp.git /opt/webapp

# 3. 安装依赖和构建
cd /opt/webapp
npm install
npm run build

# 4. 配置 PM2
npm install -g pm2
pm2 start server.js --name webapp -i max
pm2 save
pm2 startup

# 5. 配置 Nginx 反向代理
sudo tee /etc/nginx/sites-available/webapp << 'EOF'
server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /static/ {
        alias /opt/webapp/public/;
        expires 30d;
    }
}
EOF

sudo ln -sf /etc/nginx/sites-available/webapp /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx

# 安装 certbot
sudo apt install certbot python3-certbot-nginx -y

# 获取证书（会自动修改 Nginx 配置）
sudo certbot --nginx -d example.com -d www.example.com

# 查看证书
sudo certbot certificates

# 验证自动续期
sudo certbot renew --dry-run

# 证书会自动续期（certbot 会添加 systemd timer）
sudo systemctl list-timers | grep certbot

#!/bin/bash
# health-check.sh - 多服务健康检查

check_service() {
    local name="$1"
    local url="$2"
    local expect="${3:-200}"
    
    local status=$(curl -s -o /dev/null -w "%{http_code}" "$url" 2>/dev/null)
    
    if [ "$status" = "$expect" ]; then
        echo "[✓] $name: $status (正常)"
        return 0
    else
        echo "[✗] $name: $status (异常)"
        return 1
    fi
}

echo "=== 系统健康检查 ==="
echo "时间: $(date)"
echo ""

# 系统资源
echo "CPU: $(top -bn1 | grep "Cpu(s)" | awk '{print $2}')%"
echo "内存: $(free -h | grep Mem | awk '{print $3 "/" $2}')"
echo "磁盘: $(df -h / | tail -1 | awk '{print $3 "/" $2 " (" $5 ")"}')"
echo ""

# Web 服务
check_service "Nginx" "http://localhost/nginx_status" 200
check_service "WebApp" "http://localhost:3000/health" 200
check_service "HTTPS" "https://example.com/" 200

echo ""
echo "=== 检查完成 ==="

#!/bin/bash
# setup-server.sh - 从零搭建 Web 开发服务器
# 用法: sudo ./setup-server.sh example.com

set -euo pipefail

DOMAIN="${1:-example.com}"
APP_DIR="/opt/webapp"
APP_PORT=3000
ADMIN_USER="admin"

echo "========================================"
echo "    从零搭建 Web 开发服务器"
echo "    域名: $DOMAIN"
echo "========================================"

# 1. 系统更新
echo ""
echo ">>> 1/10 更新系统..."
apt update && apt upgrade -y

# 2. 创建普通用户
echo ""
echo ">>> 2/10 创建管理用户..."
if ! id "$ADMIN_USER" &>/dev/null; then
    useradd -m -s /bin/bash "$ADMIN_USER"
    usermod -aG sudo "$ADMIN_USER"
    echo "请为 $ADMIN_USER 设置密码："
    passwd "$ADMIN_USER"
    
    # 注意：请手动将你的 SSH 公钥添加到 /home/$ADMIN_USER/.ssh/authorized_keys
    mkdir -p /home/$ADMIN_USER/.ssh
    cp /root/.ssh/authorized_keys /home/$ADMIN_USER/.ssh/ 2>/dev/null || true
    chown -R $ADMIN_USER:$ADMIN_USER /home/$ADMIN_USER/.ssh
    chmod 700 /home/$ADMIN_USER/.ssh
    chmod 600 /home/$ADMIN_USER/.ssh/authorized_keys
fi

# 3. SSH 加固
echo ""
echo ">>> 3/10 SSH 加固..."
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/^#PubkeyAuthentication yes/PubkeyAuthentication yes/' /etc/ssh/sshd_config
systemctl restart sshd

# 4. 防火墙
echo ""
echo ">>> 4/10 配置防火墙..."
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw --force enable

# 5. fail2ban
echo ""
echo ">>> 5/10 安装 fail2ban..."
apt install -y fail2ban
cat > /etc/fail2ban/jail.d/sshd.conf << EOF
[sshd]
enabled = true
maxretry = 3
bantime = 86400
findtime = 600
EOF
systemctl enable --now fail2ban

# 6. 安装 Nginx
echo ""
echo ">>> 6/10 安装 Nginx..."
apt install -y nginx
systemctl enable --now nginx

# 7. 安装 Node.js
echo ""
echo ">>> 7/10 安装 Node.js..."
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
apt install -y nodejs
npm install -g pm2

# 8. 配置 Nginx 反向代理
echo ""
echo ">>> 8/10 配置 Nginx..."
cat > /etc/nginx/sites-available/$DOMAIN << EOF
server {
    listen 80;
    server_name $DOMAIN www.$DOMAIN;

    location / {
        proxy_pass http://127.0.0.1:$APP_PORT;
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host \$host;
        proxy_cache_bypass \$http_upgrade;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }
}
EOF

ln -sf /etc/nginx/sites-available/$DOMAIN /etc/nginx/sites-enabled/
rm -f /etc/nginx/sites-enabled/default
nginx -t && systemctl reload nginx

# 9. HTTPS 证书
echo ""
echo ">>> 9/10 配置 HTTPS..."
apt install -y certbot python3-certbot-nginx
certbot --nginx --non-interactive --agree-tos \
    --email admin@$DOMAIN \
    -d $DOMAIN -d www.$DOMAIN \
    || echo "⚠️ certbot 失败，请手动运行: sudo certbot --nginx -d $DOMAIN"

# 10. 健康检查脚本
echo ""
echo ">>> 10/10 配置健康检查..."
mkdir -p /opt/scripts

cat > /opt/scripts/health-check.sh << 'EOF'
#!/bin/bash
WEBHOOK="https://hooks.slack.com/services/YOUR/WEBHOOK"

for svc in nginx sshd fail2ban; do
    if ! systemctl is-active --quiet "$svc"; then
        echo "[$(date)] ❌ $svc 异常" >> /var/log/health.log
    fi
done

DISK=$(df / | tail -1 | awk '{print $5}' | tr -d '%')
[ "$DISK" -gt 85 ] && echo "[$(date)] ⚠️ 磁盘 ${DISK}%" >> /var/log/health.log
EOF

chmod +x /opt/scripts/health-check.sh

# 加入 cron
(crontab -l 2>/dev/null; echo "*/10 * * * * /opt/scripts/health-check.sh > /dev/null 2>&1") | crontab -

echo ""
echo "========================================"
echo "✅ 服务器搭建完成！"
echo ""
echo "部署信息："
echo "  管理用户: $ADMIN_USER"
echo "  Nginx: http://$DOMAIN"
echo "  HTTPS: https://$DOMAIN（如果 certbot 成功）"
echo "  Node.js: $(node --version)"
echo "  PM2: $(pm2 --version)"
echo ""
echo "后续步骤："
echo "  1. 将应用代码部署到 $APP_DIR"
echo "  2. 启动应用: pm2 start $APP_DIR/server.js --name webapp"
echo "  3. 从 $ADMIN_USER 用户登录（禁止 root 直接登录）"
echo "========================================"

#!/bin/bash
# verify-deploy.sh - 部署完成后验证

echo "========================================"
echo "    部署验证"
echo "    时间: $(date)"
echo "========================================"
echo ""

errors=0

check() {
    local desc="$1"
    shift
    if "$@" &>/dev/null; then
        echo "  [✓] $desc"
    else
        echo "  [✗] $desc"
        errors=$((errors + 1))
    fi
}

echo "1. 系统服务"
echo "-----------"
check "Nginx 运行" systemctl is-active nginx
check "SSH 运行" systemctl is-active sshd
check "fail2ban 运行" systemctl is-active fail2ban
echo ""

echo "2. 网络"
echo "--------"
check "端口 80 监听" ss -tlnp | grep -q ":80 "
check "端口 443 监听" ss -tlnp | grep -q ":443 "
check "ufw 已启用" ufw status | grep -q active
echo ""

echo "3. HTTP 服务"
echo "-------------"
check "本地 Nginx 响应" curl -s -o /dev/null -w "%{http_code}" http://localhost | grep -q 200
check "应用进程运行" pm2 list 2>/dev/null | grep -q "online" || pgrep -f "node server" > /dev/null
echo ""

echo "4. 安全"
echo "--------"
check "root SSH 已禁用" grep "^PermitRootLogin" /etc/ssh/sshd_config | grep -q "no"
check "密码登录已禁用" grep "^PasswordAuthentication" /etc/ssh/sshd_config | grep -q "no"
echo ""

echo "5. 资源"
echo "--------"
echo "  CPU: $(top -bn1 | grep 'Cpu(s)' | awk '{print $2"%"}' )"
echo "  内存: $(free -h | grep Mem | awk '{print $3"/"$2}')"
echo "  磁盘: $(df -h / | tail -1 | awk '{print $3"/"$2"("$5")"}')"
echo ""

echo "========================================"
if [ $errors -eq 0 ]; then
    echo "✅ 全部验证通过！"
else
    echo "❌ $errors 项检查失败，请排查"
fi
echo "========================================"