Kenya Apache ho CentOS7

Tšupiso ea semmuso

Etsa kopo

            yum -y install libmcrypt libmcrypt-devel mcrypt mhash
yum -y install httpd
        

Fetola faele ea phetolo

Kamora hore ho hlongoa ho phethe, re hloka ho etsa liphetoho tse itseng faeleng ea tlhophiso. Likahare tse ikhethileng tsa phetolo hangata li kenyelletsa: tlanngoe IP le koung, phetisetso ea khatello ea gzip, palo ea likhokahano tse tšoanang, le SSL. Ha re li hlalose ka bonngoe ka tlase.

Fetola IP le koung

IP ea kamehla le boema-kepe boo Apache e bo mamelang ke 0.0.0.0:80. Haeba re hloka ho fetola IP le boema-kepe, re ka e fetola ka kotloloho. Haeba re hloka ho tlama likoung tse ngata, re ka li eketsa. Mohlala o latelang, re tlama likoung 80 le 443. Port 443 ke nomoro ea koung ea kamehla ea HTTPS.

            Listen 80
Listen 443 https
        

Bula phetiso ea gzip

Hobane ts'ebetso ea CPU ea komporo ea rona e batla e phahame haholo, hangata bothata ba botlolo bo tla hlaha ho bandwidth ea marang-rang, ka hona re ka khetha ho bulela phetisetso ea gzip compression. Ho na le maemo a khatello a 9. Re ka khetha ho latela ts'ebetso ea seva ea rona mme ra fumana boemo bo loketseng ka ho fetisisa. Mohlala o ka tlase re o behetse boemong ba 1. Mefuta ea lifaele tse hatelitsoeng ke: html, xml, php, css, js, hape re ka eketsa mefuta ea lifaele tse hatelletsoeng ha ho hlokahala.

            <IfModule mod_deflate.c>
    DeflateCompressionLevel 1
    AddOutputFilterByType DEFLATE text/html text/plain text/xml application/x-javascript application/x-httpd-php
    AddOutputFilter DEFLATE js css
</IfModule>
        

Theha KeepAlive

Mosebetsi oa KeepAlive ke ho boloka moreki le seva li hokahane nako e telele. Ha re bula leqephe la webo, hangata re hloka ho kenya litaba tsa mantlha, js, css, le litšoantšo. Empa KeepAlive le eona e na le mathata. Haeba KeepAlive e nolofalitsoe, re boetse re hloka ho e beha nako e loketseng bakeng sa eona ho qoba seva IO ho lula nako e telele. Mohlala o latelang o na le li-setting tsa mantlha tsa KeepAlive.

            KeepAlive On
MaxKeepAliveRequests 400
KeepAliveTimeout 5
        

Lokisa palo ea concurrent

Tlhophiso e nepahetseng ea palo ea nako e le 'ngoe e ka ntlafatsa ntlafatso ea seva. Hangata Apache ea rona e sebetsa ka mpm_prefork mode. Re hloka ho hlophisa likarolo tse 'maloa tsa bohlokoa. Seo re hlokang ho se ela hloko ke hore palo e holimo ea likhokahano ha ea lokela ho ba nyane haholo, e nyane haholo e tla etsa hore palo e kholo ea likopo tsa mosebelisi li hanoe ha konteraka e le holimo. Boleng bo utloahalang boo re bo behileng bo lokela ho lebisa ho CPU le sehopotso sa seva. Hafeela lisebelisoa li lekane, re lokela ho li beha ka hohle kamoo ho ka khonehang, empa haeba re li beha haholo, lisebelisoa tsa seva li tla fela ebe Apache le eona e tla senyeha.

            <IfModule mpm_prefork_module>
    StartServers         10
    MinSpareServers      25
    MaxSpareServers      50
    ServerLimit          1500
    MaxClients           1000
    MaxRequestsPerChild  3000
</IfModule>
        

Lokisa SSL

Boholo ba libaka tsa marang-rang ha joale SSL e nolofalitsoe ho ts'ehetsa likhokahano tse sireletsehileng tsa HTTPS. Monyetla oa HTTPS ke hore litaba tse nakong ea phetisetso li patiloe, ka hona ha ho na lebaka la ho tšoenyeha ka ho dutla ha leseli ka lebaka la ho ts'oaroa ke ba bang. Pele re lumella SSL, re tlameha ho etsa kopo ea setifikeiti pele kamora hore re fumane setifikeiti, sheba phetolo e latelang ho phethela litlhophiso tsa SSL.

            <VirtualHost *:443>
    ServerAdmin www.test.com
    ServerName www.testl.com
    DocumentRoot  /var/www/test
    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3
    SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM
    SSLHonorCipherOrder on
    SSLCertificateFile /etc/httpd/conf/cert/public.crt
    SSLCertificateKeyFile /etc/httpd/conf/cert/1533528967430.key
    SSLCertificateChainFile /etc/httpd/conf/cert/chain.crt
    AllowEncodedSlashes on
    <Directory "/var/www/test.com">
         Options FollowSymLinks
         AllowOverride All
         Order allow,deny
         Allow from all
    </Directory>
</VirtualHost>