1. 添加一個用戶
[root@localhost ~]# cat /etc/redhat-release # 查看linux版本
CentOS Linux release 7.7.1908 (Core)
[root@localhost ~]# adduser flask # 添加用戶
[root@localhost ~]# passwd flask # 設(shè)置密碼
[root@localhost ~]# gpasswd -a flask wheel # 將flask加入wheel組
[root@localhost ~]# sudo -iu flask # 切換到flask用戶
2. 初始化環(huán)境
sudo yum install epel-release # 初始化倉庫
sudo yum install gcc nginx # 安裝gcc和nginx
3. 安裝anaconda
下載地址：https://www.anaconda.com/products/individual
wget https://repo.anaconda.com/archive/Anaconda3-2020.02-Linux-x86_64.sh # 下載anaconda
sh Anaconda3-2020.02-Linux-x86_64.sh # 安裝anaconda
按默認(rèn)設(shè)置安裝即可窟绷，可以簡單歸納就是“yes 回車 yes”嘲碧！
4. 創(chuàng)建python虛擬環(huán)境
source anaconda3/bin/activate # 激活anaconda
pip install virtualenv # 安裝virtualenv
mkdir ~/myweb # 創(chuàng)建目錄
cd ~/myweb
virtualenv myweb # 創(chuàng)建虛擬環(huán)境目錄
source myweb/bin/activate # 激活新建的虛擬環(huán)境
5. 安裝flask和配置uwsgi
pip install uwsgi flask # 安裝flask和uwsgi
sudo firewall-cmd --permanent --add-port=5000/tcp # 打開防火墻端口呈野，請根據(jù)實際打開相應(yīng)端口
sudo firewall-cmd --reload # 應(yīng)用防火墻設(shè)置
將flask項目復(fù)制到myweb目錄中乱灵，先執(zhí)行 python manage.py runserver 測試是否可以正常運行娱据，之后在項目目錄(myweb)下建立uwsgi配置文件（myweb.ini）,并粘貼以下內(nèi)容秃流。
vi myweb.ini
[uwsgi]
module=manage:app
master=true
processes=2
threads=50
#指向網(wǎng)站目錄
chdir=/data/www/myweb/
socket = /data/www/myweb/uwsgi.sock
socket = 127.0.0.1:8000
logto = /data/www/myweb/uwsgi.log
chmod-socket = 660
vacuum = true
文件參數(shù)說明如下：
- module：manage 是項目啟動文件 manage.py 去掉擴展名碳默，app 是 manage.py 文件中的變量 app宝磨，即 Flask 實例。
- processes 啟動的服務(wù)占用2個進程翰舌。
- socket此處包含兩個嚣潜，一個是指定了暴露的端口，另外指定了一個myproject.sock文件保存socker信息椅贱。
- chdir是項目路徑地址懂算。
- logto是日志輸出地址。
設(shè)置完成后回到命令行庇麦，使用以下命令啟動一個uwsgi服務(wù)器
uwsgi --ini myweb.ini
6. 創(chuàng)建自啟動Systemd配置
sudo vi /etc/systemd/system/myweb.service
輸入下面內(nèi)容
[Unit]
Description=uWSGI instance to serve Myweb
After=network.target
[Service]
User=flask
WorkingDirectory=/data/www/myweb
Environment="PATH=/data/www/myweb/bin"
ExecStart=/data/www/myweb/bin/uwsgi --ini /data/www/myweb/myweb.ini
Restart=always
Type=notify
NotifyAccess=all
StandardError=syslog
KillSignal=SIGQUIT
[Install]
WantedBy=multi-user.target
sudo systemctl start myweb.service # 啟動服務(wù)
sudo systemctl enable myweb.service # 開機自啟動
7. 安裝配置Nginx
yum install nginx
cd /etc/nginx # 進入nginx配置目錄
mv nginx.conf nginx.conf_bak # 備份原配置文件
vi nginx.conf # 新建nginx.conf 文件
輸入如下內(nèi)容
error_log /var/log/nginx/error.log;
worker_processes 4;
events { worker_connections 1024; }
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
server {
listen 9000;
location / {
include /etc/nginx/uwsgi_params;
uwsgi_pass 127.0.0.1:8000;
}
}
}
systemctl start nginx # 運行Nginx
如果出現(xiàn)下面錯誤计技，可能是http允許訪問的端口未設(shè)置，需要使用semanage進行配置
[emerg] bind() to 0.0.0.0:9000 failed (13: Permission denied)
安裝semanage山橄，直接yum install semanage會報No package semanage available.
執(zhí)行下面命令：
yum provides semanage
再執(zhí)行下面命令完成semanage的安裝
yum -y install policycoreutils-python.x86_64
使用semanage查看端口
semanage port -l | grep http_port_t
如果Nginx綁定的端口不在其中垮媒，使用下面命令添加
semanage port -a -t http_port_t -p tcp 9000
打開防火墻端口
firewall-cmd --add-port 9000/tcp
此時訪問網(wǎng)址 http://127.0.0.1:9000 出現(xiàn)502錯誤，查看日志
cat /var/log/nginx/error.log
2020/12/17 15:28:41 [crit] 44387#0: *4 connect() to 127.0.0.1:8000 failed (13: Permission denied) while connecting to upstream, client: 127.0.0.1, server: , request: "GET / HTTP/1.1", upstream: "uwsgi://127.0.0.1:8000", host: "127.0.0.1:9000"
setsebool -P httpd_can_network_connect 1
執(zhí)行上面命令后航棱，網(wǎng)站終于可以正常訪問了睡雇。
最后設(shè)置Nginx開機自啟動
systemctl enable nginx # 設(shè)置Nginx開機自啟動
8. 安裝 certbot 并獲取Let's Encrypt 的免費證書
yum install certbot python2-certbot-nginx
在使用certbot獲取證書前，需要做幾件事：
- 將域名指向服務(wù)器
- 將網(wǎng)站端口改為80（實現(xiàn)證書服務(wù)器的反向驗證）
- 打開防火墻的http和https服務(wù)端口
firewall-cmd --add-service=http --permanent
firewall-cmd --add-service=https --permanent
firewall-cmd --reload
- Nginx.conf進行簡單的設(shè)置
nano /etc/nginx/nginx.conf
error_log /var/log/nginx/error.log;
worker_processes 4;
events { worker_connections 1024; }
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
server {
server_name xxx.xxx.com; # 可以設(shè)置服務(wù)器域名了
listen 80;
location / {
include /etc/nginx/uwsgi_params;
uwsgi_pass 127.0.0.1:8000;
}
location ~ /.well-known {
allow all;
}
}
}
配置好上面內(nèi)容后饮醇，執(zhí)行下面命令開始獲取證書
certbot --nginx -d xxx.xxx.com
當(dāng)看到 Congratulations 的提示時入桂，表示證書生成成功，并告知證書放在 /etc/letsencrypt/live 目錄下
再次修改/etc/nginx/nginx.conf
error_log /var/log/nginx/error.log;
worker_processes 4;
events { worker_connections 1024; }
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
server {
server_name xxx.xxx.com;
listen 443 ssl;
ssl_certificate "/etc/letsencrypt/live/xxx.xxx.com/fullchain.pem"; #cert
ssl_certificate_key "/etc/letsencrypt/live/xxx.xxx.com/privkey.pem"; #KEY
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
ssl_prefer_server_ciphers on;
location / {
include /etc/nginx/uwsgi_params;
uwsgi_pass 127.0.0.1:8000;
}
location ~ /.well-known {
allow all;
}
}
server {
server_name xxx.xxx.com;
listen 80;
location ~ /.well-known {
allow all;
}
location / {
rewrite ^(.*) https://$host$1 permanent;
}
}
}
測試并重啟 nginx:
nginx -t
nginx -s reload
9. Let's Encrypt 證書自動更新
使用下面命令進行證書虛擬更新
certbot renew --dry-run
如果一切正常就可以設(shè)置cron任務(wù)了
30 4 * * 1 certbot renew --renew-hook "systemctl restart nginx" --quiet > /dev/null 2>&1 &
部署過程到此結(jié)束驳阎，謝謝觀看抗愁！
