lushuncheng 4 years ago
parent
commit
74c17cfe9b
4 changed files with 144 additions and 5 deletions
  1. 9 3
      .example.env
  2. 132 0
      README.md
  3. 1 0
      app/middleware/Safe.php
  4. 2 2
      config/cache.php

+ 9 - 3
.example.env

@@ -14,18 +14,24 @@ CHARSET = utf8mb4
 DEBUG = true
 
 [REDIS]
+# REDIS 服务器地址
 HOST=
-PORT=
+# REDIS 服务器端口
+PORT= 6379
+# REDIS 服务器密码
 PASS=
 
 [LANG]
 default_lang = zh-cn
 
 [WEIBO]
+# 接口地址
 API_HOST=
+# 接口KEY
 API_KEY=
+# 接口密钥
 API_SECRET=
-# if mock weibo's api
+# 是否Mock掉对微博接口的请求,线上配置成0
 MOCK=
-# the h5 referer to check for safe
+# H5前端页面的域名,用于线上Referer检测
 REFERER=

+ 132 - 0
README.md

@@ -6,6 +6,138 @@
 - 环境需开启 PATHINFO,不再支持 ThinkPHP 的 URL 兼容模式运行(源于如何优雅地展示);
 - 项目默认不带`composer`模块`vendor`目录,下载后需要自行`composer install`安装;
 
+## 生产服务器部署
+
+### 环境要求
+
+- PHP7.1+
+- Mysql5.7+
+- Redis3.2+
+- nginx 1.18+
+
+### 部署步骤
+
+1、新建网站根目录,例:/var/www/html
+2、解压代码到该目录
+3、拷贝目录下的.example.env 文件为.env,即:cp .example.env .env
+4、修改.env 里面的数据库,redis,微博 API 接口相关配置,特别注意将 APP_DEBUG 设置成 false
+5、在目录下创建 runtime 目录,并给网站运行用户,即 php-fpm 用户写权限
+6、配置 nginx , https 相关配置请自行参考 nginx 相关教程,或者在 LVS 负载均衡层配置
+vhost 参考配置:
+
+```
+log_format logid '[$time_local] "$host" "$http_x_real_ip" "$http_x_forwarded_for" "$remote_addr" "$remote_user" "$request" "$request_time" "$request_length" "$body_bytes_sent" "$status" '
+                        '"$server_addr" "$upstream_addr" "$upstream_response_time" "$upstream_status" "$http_referer" "$http_user_agent" "logId=$temp_request_id"';
+server {
+    server_name www.weibo.cn;
+    listen 80;
+    root /var/www/html/public;
+    index index.php index.html index.htm;
+
+    set $temp_request_id $http_x_request_id;
+    if ($temp_request_id = "") {
+        set $temp_request_id $request_id;
+    }
+    access_log /var/log/access.log logid;
+
+    location / {
+        if (!-e $request_filename) {
+            rewrite  ^(.*)$  /index.php?s=$1  last;
+            break;
+        }
+    }
+
+    location ~ ^/(composer.json|composer.lock|ThinkPHP/|vendor/|src/|bin/|App/|.git) {
+        deny all;
+    }
+    location ~ \.php$ {
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_index index.php;
+        include fastcgi_params;
+        fastcgi_param HTTP_X_REQUEST_ID $temp_request_id;
+    }
+}
+```
+
+fastcgi_params 配置参考:
+
+```
+fastcgi_param  QUERY_STRING       $query_string;
+fastcgi_param  REQUEST_METHOD     $request_method;
+fastcgi_param  CONTENT_TYPE       $content_type;
+fastcgi_param  CONTENT_LENGTH     $content_length;
+
+fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
+fastcgi_param  REQUEST_URI        $request_uri;
+fastcgi_param  DOCUMENT_URI       $document_uri;
+fastcgi_param  DOCUMENT_ROOT      $document_root;
+fastcgi_param  SERVER_PROTOCOL    $server_protocol;
+fastcgi_param  REQUEST_SCHEME     $scheme;
+fastcgi_param  HTTPS              $https if_not_empty;
+
+fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
+fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
+
+fastcgi_param  REMOTE_ADDR        $remote_addr;
+fastcgi_param  REMOTE_PORT        $remote_port;
+fastcgi_param  SERVER_ADDR        $server_addr;
+fastcgi_param  SERVER_PORT        $server_port;
+fastcgi_param  SERVER_NAME        $server_name;
+
+# PHP only, required if PHP was built with --enable-force-cgi-redirect
+fastcgi_param  REDIRECT_STATUS    200;
+fastcgi_split_path_info ^(.+\.php)(/.+)$; #增加这一句
+fastcgi_param PATH_INFO $fastcgi_path_info; #增加这一句
+fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+```
+
+7、配置 fpm
+配置参考:
+
+```
+[www]
+user = www-data
+group = www-data
+
+; listen = /var/run/php7-fpm.sock
+listen = 127.0.0.1:9000
+listen.owner = www-data
+listen.group = www-data
+
+pm = static
+pm.max_children = 32
+pm.start_servers = 32
+pm.min_spare_servers = 32
+pm.max_spare_servers = 32
+pm.max_requests = 20000
+request_terminate_timeout = 10
+rlimit_files=1048576
+
+pm.status_path = /status
+;FPM状态页面的网址. 如果没有设置, 则无法访问状态页面. 默认值: none. munin监控会使用到
+
+ping.path = /ping
+;FPM监控页面的ping网址. 如果没有设置, 则无法访问ping页面. 该页面用于外部检测FPM是否存活并且可以响应请求. 请注意必须以斜线开头 (/)。
+
+ping.response = pong
+;#用于定义ping请求的返回相应. 返回为 HTTP 200 的 text/plain 格式文本. 默认值: pong.
+
+chroot =
+;#启动时的Chroot目录. 所定义的目录需要是绝对路径. 如果没有设置, 则chroot不被使用.
+
+chdir =
+;#设置启动目录,启动时会自动Chdir到该目录. 所定义的目录需要是绝对路径. 默认值: 当前目录,或者/目录(chroot时)
+
+catch_workers_output = yes
+;#重定向运行过程中的stdout和stderr到主要的错误日志文件中. 如果没有设置, stdout 和 stderr 将会根据FastCGI的规则被重定向到 /dev/null . 默认值: 空
+
+php_admin_value[memory_limit] = 64M
+
+env[ENV] = prod
+```
+
+8、导入根目录下的 sql.sql 文件
+
 ## 注解权限
 
 注解权限是指通过方法注释来实现后台 RBAC 授权管理,用注解来管理功能节点。

+ 1 - 0
app/middleware/Safe.php

@@ -24,6 +24,7 @@ class Safe
     public function handle(Request $request, Closure $next)
     {
         $referer = $_SERVER['HTTP_REFERER'] ?? '';
+        // 非调试模式 开启referer检测
         if (env('app_debug') === false || env('app_debug') === 'false') {
             if (strpos($referer, env('weibo.referer')) === false) {
                 abort(

+ 2 - 2
config/cache.php

@@ -12,7 +12,7 @@ return [
             // 缓存名称前缀
             'prefix'     => '',
             // 缓存有效期 0 表示永久缓存
-            'expire'     => 0,
+            'expire'     => 15552000,
             // 缓存标签前缀
             'tag_prefix' => 'tag:',
             // 序列化机制
@@ -26,7 +26,7 @@ return [
             'password' => env('redis.pass', ''),
             'select'   => '0',
             // 全局缓存有效期(0为永久有效)
-            'expire'   => 0,
+            'expire'   => 15552000,
             // 缓存前缀
             'prefix'   => 'wbm:',
             'timeout'  => 0,