1. 项目概述在CentOS系统上搭建LNMPLinuxNginxMySQLPHP环境是Web开发者和运维人员的常见需求。相比一键安装脚本通过yum手动安装能更好地控制组件版本和配置细节特别适合需要定制化环境的生产场景。我最近在CentOS 7.9上为电商项目搭建LNMP环境时发现网上教程要么过于简单要么版本老旧。经过多次实践总结出一套稳定可靠的安装方案重点解决三个核心问题如何通过官方源安装最新稳定版组件Nginx与PHP-FPM的高效协作配置MySQL的安全加固措施提示建议使用至少2GB内存的服务器避免因资源不足导致安装失败或性能问题。2. 环境准备与系统配置2.1 系统更新与基础配置首先通过SSH连接服务器执行系统更新确保所有软件包为最新版本sudo yum update -y sudo yum install -y epel-release # 安装EPEL扩展源设置时区并同步时间sudo timedatectl set-timezone Asia/Shanghai sudo yum install -y chrony sudo systemctl enable --now chronyd2.2 防火墙与SELinux配置放行必要端口并设置防火墙规则sudo firewall-cmd --permanent --add-servicehttp sudo firewall-cmd --permanent --add-servicehttps sudo firewall-cmd --reload对于SELinux建议保持启用但调整策略sudo setsebool -P httpd_can_network_connect 1 sudo semanage port -a -t http_port_t -p tcp 9000 # 为PHP-FPM放行端口3. 组件安装与配置3.1 Nginx安装与优化添加Nginx官方源并安装sudo tee /etc/yum.repos.d/nginx.repo -EOF [nginx-stable] namenginx stable repo baseurlhttps://nginx.org/packages/centos/7/$basearch/ gpgcheck1 enabled1 gpgkeyhttps://nginx.org/keys/nginx_signing.key EOF sudo yum install -y nginx关键配置调整/etc/nginx/nginx.confworker_processes auto; # 自动匹配CPU核心数 worker_connections 1024; keepalive_timeout 65; gzip on; # 启用压缩启动服务并测试sudo systemctl enable --now nginx curl -I 127.0.0.1 # 应返回HTTP 2003.2 MySQL 8.0安全部署添加MySQL官方源并安装sudo rpm -Uvh https://repo.mysql.com/mysql80-community-release-el7-7.noarch.rpm sudo yum install -y mysql-community-server安全加固步骤获取临时密码sudo grep temporary password /var/log/mysqld.log运行安全脚本sudo mysql_secure_installation创建应用专用用户CREATE USER app_userlocalhost IDENTIFIED BY ComplexPassword123; GRANT ALL PRIVILEGES ON app_db.* TO app_userlocalhost; FLUSH PRIVILEGES;性能优化建议/etc/my.cnf[mysqld] innodb_buffer_pool_size 1G # 建议为内存的50-70% innodb_log_file_size 256M max_connections 2003.3 PHP 7.4/8.0安装与调优通过Remi源安装指定版本PHPsudo yum install -y https://rpms.remirepo.net/enterprise/remi-release-7.rpm sudo yum-config-manager --enable remi-php80 # 或remi-php74 sudo yum install -y php php-fpm php-mysqlnd php-opcache关键配置/etc/php-fpm.d/www.conflisten /var/run/php-fpm/php-fpm.sock listen.owner nginx listen.group nginx pm dynamic pm.max_children 50 pm.start_servers 5 pm.min_spare_servers 5 pm.max_spare_servers 10OPcache优化/etc/php.d/10-opcache.iniopcache.enable1 opcache.memory_consumption128 opcache.interned_strings_buffer8 opcache.max_accelerated_files4000 opcache.revalidate_freq604. 服务集成与测试4.1 Nginx与PHP-FPM集成创建专用站点配置/etc/nginx/conf.d/php-site.confserver { listen 80; server_name example.com; root /var/www/html; index index.php index.html; location / { try_files $uri $uri/ /index.php?$args; } location ~ \.php$ { fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock; fastcgi_index index.php; include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; } }测试配置并重载sudo nginx -t sudo systemctl reload nginx sudo systemctl restart php-fpm4.2 环境验证创建测试脚本/var/www/html/info.php?php phpinfo(); $conn new mysqli(localhost, app_user, ComplexPassword123); if ($conn-connect_error) { die(MySQL连接失败: . $conn-connect_error); } echo LNMP环境验证通过; ?访问测试后务必删除sudo rm -f /var/www/html/info.php5. 常见问题排查5.1 502 Bad Gateway错误可能原因及解决方案PHP-FPM未运行sudo systemctl status php-fpmSocket权限问题sudo chown nginx:nginx /var/run/php-fpm/php-fpm.sock sudo chmod 660 /var/run/php-fpm/php-fpm.sockSELinux限制sudo audit2allow -a # 查看拒绝日志 sudo setsebool -P httpd_execmem 15.2 MySQL连接问题典型错误排查# 检查服务状态 sudo systemctl status mysqld # 测试本地连接 mysql -u app_user -p # 检查错误日志 sudo tail -50 /var/log/mysqld.log5.3 性能优化建议Nginx工作进程调整worker_processes 4; # 匹配CPU核心数 worker_rlimit_nofile 65535;PHP-FPM进程管理优化高流量场景pm static pm.max_children 100 # 根据内存调整(总内存 - 系统占用) / 单个进程内存6. 进阶配置与维护6.1 日志管理配置Nginx日志切割/etc/logrotate.d/nginx/var/log/nginx/*.log { daily missingok rotate 30 compress delaycompress notifempty create 640 nginx adm sharedscripts postrotate /bin/kill -USR1 cat /run/nginx.pid 2/dev/null 2/dev/null || true endscript }PHP-FPM慢日志记录/etc/php-fpm.d/www.confslowlog /var/log/php-fpm/www-slow.log request_slowlog_timeout 5s6.2 安全加固措施关键安全配置禁用危险PHP函数disable_functions exec,passthru,shell_exec,system,proc_open,popen限制PHP访问目录open_basedir /var/www/html:/tmpNginx防注入规则location ~* \.(php|asp|aspx|jsp)$ { deny all; }6.3 备份与恢复方案MySQL定时备份脚本/usr/local/bin/mysql_backup.sh#!/bin/bash DATE$(date %Y%m%d) BACKUP_DIR/backup/mysql mkdir -p $BACKUP_DIR mysqldump -u root -pYourPassword --all-databases | gzip $BACKUP_DIR/full_$DATE.sql.gz find $BACKUP_DIR -type f -mtime 30 -delete设置定时任务sudo chmod x /usr/local/bin/mysql_backup.sh (crontab -l 2/dev/null; echo 0 2 * * * /usr/local/bin/mysql_backup.sh) | crontab -这套方案已在多个生产环境稳定运行关键点在于使用官方源保证组件兼容性精细化的服务配置确保性能严格的安全设置防范风险。对于需要多版本PHP的场景可以通过Remi源灵活切换PHP版本。