技术札记 on 七三的小站

Nginx 从源码安装与配置

Mon, 15 Jun 2026 00:00:00 +0800

一、环境准备

1.1. 下载软件包

`OpenSSL`

# https://github.com/openssl/openssl/releases/
wget https://github.com/openssl/openssl/releases/download/openssl-4.0.1/openssl-4.0.1.tar.gz && \
sudo tar -zxf openssl-4.0.1.tar.gz -C /usr/local/src

`Pcre2`

# https://github.com/PhilipHazel/pcre2/releases
wget -c https://github.com/PhilipHazel/pcre2/releases/download/pcre2-10.47/pcre2-10.47.tar.gz && \
sudo tar -zxf pcre2-10.47.tar.gz -C /usr/local/src

`FancyIndex`

# https://github.com/aperezdc/ngx-fancyindex/releases
wget -c https://github.com/aperezdc/ngx-fancyindex/releases/download/v0.6.0/ngx-fancyindex-0.6.0.tar.xz && \
xz -d ngx-fancyindex-0.6.0.tar.xz && \
sudo tar -xf ngx-fancyindex-0.6.0.tar -C /usr/local/src

`NJS`

# https://github.com/nginx/njs/tags
wget https://github.com/nginx/njs/archive/refs/tags/0.9.9.tar.gz -O njs-0.9.9.tar.gz && \
sudo tar -zxf njs-0.9.9.tar.gz -C /usr/local/src

`GeoIP2`

# https://github.com/leev/ngx_http_geoip2_module/releases
wget -c https://github.com/leev/ngx_http_geoip2_module/archive/refs/tags/3.4.tar.gz -O ngx_http_geoip2_module-3.4.tar.gz && \
sudo tar -zxf ngx_http_geoip2_module-3.4.tar.gz -C /usr/local/src

`Nginx`

# https://nginx.org/en/download.html
wget -c http://nginx.org/download/nginx-1.30.2.tar.gz && \
sudo tar -zxf nginx-1.30.2.tar.gz -C /usr/local/src

1.2. 新增用户和组 (可选)

本文使用自带的 www-data 用户和组

# On Ubuntu/Debian:
sudo adduser \
 --system \
 --shell /bin/bash \
 --gecos 'Nginx web server' \
 --group \
 --disabled-password \
 --home /var/www \
 nginx
  
# On Fedora/RHEL/CentOS:
sudo groupadd --system nginx
sudo adduser \
 --system \
 --shell /bin/bash \
 --comment 'Nginx web server' \
 --gid nginx \
 --home-dir /home/nginx \
 --create-home \
 nginx

二、编译安装

2.1. 安装编译工具

# On Ubuntu/Debian:
sudo apt -y install build-essential libzip-dev libxml2-dev libxslt-dev

# On Fedora/RHEL/CentOS:
# sudo yum -y groupinstall 'Development Tools'
sudo yum install -y gcc gcc-c++ zlib-devel

2.2. 安装扩展工具

安装 MaxmindDB

# https://github.com/maxmind/libmaxminddb/releases
# sudo yum install libmaxminddb libmaxminddb-devel -y
sudo apt install libmaxminddb-dev mmdb-bin -y

# https://github.com/P3TERX/GeoLite.mmdb
sudo mkdir -p /usr/share/geoip/

# 国内
sudo wget -c --no-check-certificate -P /usr/share/geoip \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/geoip/{GeoLite2-ASN.mmdb,GeoLite2-City.mmdb,GeoLite2-Country.mmdb}

# 国外
sudo wget -c --no-check-certificate -P /usr/share/geoip \
     https://git.io/{GeoLite2-ASN.mmdb,GeoLite2-City.mmdb,GeoLite2-Country.mmdb}

mmdblookup --file /usr/share/geoip/GeoLite2-Country.mmdb --ip 43.138.171.130 country names en
mmdblookup --file /usr/share/geoip/GeoLite2-City.mmdb --ip 43.138.171.130 city names en

安装 Perl (可选)

# https://www.cpan.org/src/
wget -c https://code.wangyan.cloud//wangyan/packages/releases/download/perl/perl-5.42.1.tar.gz
wget -c https://www.cpan.org/src/5.0/perl-5.42.1.tar.gz
tar -xzf perl-5.42.1.tar.gz -C /usr/local/src && \
cd /usr/local/src/perl-5.41.5 && \
./Configure -des -Dprefix=/usr/local/perl && \
make && make install && \
perl -v

2.3. 编译安装

注意修改 openssl 、pcre 、ngx-fancyindex 、ngx_http_geoip2_module 版本号。

部分组件不需要，可以删减。

cd /usr/local/src/nginx-1.30.2

sudo ./configure \
 --prefix=/usr/local/nginx \
 --user=www-data \
 --group=www-data  \
 --with-stream \
 --with-http_ssl_module \
 --with-http_v2_module \
 --with-http_realip_module \
 --with-http_sub_module \
 --with-http_gzip_static_module \
 --with-http_stub_status_module \
 --with-openssl=/usr/local/src/openssl-4.0.1 \
 --with-pcre=/usr/local/src/pcre2-10.47 \
 --http-client-body-temp-path=/usr/local/nginx/temp/client_body \
 --http-proxy-temp-path=/usr/local/nginx/temp/proxy \
 --http-fastcgi-temp-path=/usr/local/nginx/temp/fastcgi \
 --http-uwsgi-temp-path=/usr/local/nginx/temp/uwsgi \
 --http-scgi-temp-path=/usr/local/nginx/temp/scgi \
 --add-dynamic-module=/usr/local/src/ngx-fancyindex-0.6.0 \
 --add-dynamic-module=/usr/local/src/ngx_http_geoip2_module-3.4 \
 --add-dynamic-module=/usr/local/src/njs-0.9.9/nginx

sudo make && sudo make install

sudo ln -s /usr/local/nginx/conf/ /etc/nginx && \
sudo ln -s /usr/local/nginx/sbin/nginx  /usr/bin/ && \
sudo mv -f /usr/local/nginx/conf/nginx.conf /usr/local/nginx/conf/nginx.conf.bak

2.5. 设置环境变量

sudo vim /etc/profile

PATH=$PATH:/usr/local/mysql/bin:/usr/local/php/bin:/usr/local/nginx/sbin
export PATH

三、配置

3.1. 配置文件目录

缓存目录

sudo mkdir -p /usr/local/nginx/temp/{client_body,proxy,fastcgi,uwsgi,scgi} && \
sudo chown -R www-data:www-data /usr/local/nginx/temp/

日志目录

sudo mkdir -p /var/log/nginx && \
sudo chmod 711 /var/log/nginx && \
sudo chown -R www-data:www-data /var/log/nginx

配置文件目录

复制配置文件

cd ~/nginx && \
sudo cp -r resources/conf/* /usr/local/nginx/conf/ && \
sudo cp -r resources/geoip /usr/share/ && \
sudo chown -R www-data:www-data /usr/share/geoip

下载配置文件（可选）

sudo mkdir -p /usr/local/nginx/conf/{conf.d,custom-config,error-pages,modules-available,modules-enabled,rewrite-rules,sites-available,sites-enabled,ssl-certs}

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/nginx.conf

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf/conf.d \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/conf.d/default_server.conf

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf/custom-config \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/custom-config/{fancyindex.conf,general.conf,geoip.conf,ips.conf,php_fastcgi.conf,reverse-proxy.conf,security.conf}

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf/error-pages \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/error-pages/{400.html,403.html,404.html,500.html,502.html}

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf/modules-available \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/modules-available/{ngx_http_fancyindex.conf,ngx_http_geoip2_module.conf,ngx_http_js.conf,ngx_stream_geoip2.conf,ngx_stream_js.conf}

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf/rewrite-rules \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/rewrite-rules/wordpress.conf

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf/sites-available \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/sites-available/{example.com.conf,proxy.example.com.conf}

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf/ssl-certs \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/ssl-certs/dhparam.pem

设置目录权限

sudo chown 0:0 /usr/local/nginx/conf -R && \
find /usr/local/nginx/conf -type f -exec sudo chmod 644 {} \; && \
find /usr/local/nginx/conf -type d -exec sudo chmod 755 {} \;

证书特殊权限

sudo chmod 777 /usr/local/nginx/conf/ssl-certs && \
sudo chmod o+t /usr/local/nginx/conf/ssl-certs

3.2. 开机自启动

sudo vim /usr/lib/systemd/system/nginx.service

[Unit]
Description=nginx - high performance web server
Documentation=http://nginx.org/en/docs/
After=network.target remote-fs.target nss-lookup.target
  
[Service]
Type=forking
PIDFile=/run/nginx.pid
ExecStartPre=/usr/local/nginx/sbin/nginx -t -c /usr/local/nginx/conf/nginx.conf
ExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s QUIT $MAINPID
PrivateTmp=true
  
[Install]
WantedBy=multi-user.target

sudo chmod +x /usr/lib/systemd/system/nginx.service && \
sudo systemctl enable --now nginx.service

3.3. 防火墙设置

Fedora/RHEL/CentOS:

systemctl enable --now firewalld.service 
sudo firewall-cmd --permanent --zone=public --add-service=http && \
sudo firewall-cmd --permanent --zone=public --add-service=https && \
sudo firewall-cmd --reload

Ubuntu/Debian:

sudo apt install ufw

sudo vim /etc/ufw/applications.d/ufw-mysqlserver

[MySQL]
title=MySQL database server
description=MySQL database server
ports=3306/tcp

sudo ufw allow 'WWW Full'
sudo ufw allow 'OpenSSH'
sudo ufw allow 'MySQL'
sudo ufw enable

sudo ufw status verbose
sudo ufw delete allow 80/tcp

sudo ufw status numbered
sudo ufw delete 1

Nginx 配置 SSL 可信证书

Thu, 15 Jan 2026 00:00:00 +0800

1. 使用 acme.sh 签发 ZeroSSL 证书

1.1. 安装依赖

# On Ubuntu/Debian:
sudo apt install cron socat -y

# On Fedora/RHEL/CentOS:
sudo yum install nc socat -y

1.2. 安装 acme.sh

1.2.1. 一键安装

# https://github.com/acmesh-official/acme.sh/wiki/说明
curl https://get.acme.sh | sh -s email=service@wangyan.org

1.2.2. 自定义安装（可选）

git clone https://github.com/Neilpang/acme.sh.git
cd acme.sh
sudo ./acme.sh --install  \
--home /usr/local/acmesh \
--config-home /usr/local/acmesh/data \
--cert-home  /usr/local/acmesh/data \
--accountemail  "service@wangyan.org"

1.3. 签发证书（DNS 模式）

1.3.1. 注册 ZeroSSL

获取 eab-kid 和 eab-hmac-key替换 xxxx

acme.sh --register-account --server zerossl \
        --eab-kid xxxx \
        --eab-hmac-key xxxx

1.3.2. 导入域名注册商 KEY

dnsapi

##acmesh-official / ##acme.sh

# Cloudflare
export CF_Key="" && \
export CF_Email=""

# DNSPod
export DP_Id="" && \
export DP_Key=""

# West
export WEST_Username="" && \
export WEST_Key=""

1.3.3. 签发 ECC 证书

注意修改 dns_west_cn 为 dns_cf 或者其他 dns_dp

acme.sh --register-account --server zerossl \
        --eab-kid xxx \
        --eab-hmac-key xxxxx

acme.sh --server zerossl --issue --force \
        -d 'wangyan.cloud/' -d '*.wangyan.cloud/' \
        --dns dns_cf --keylength ec-256

ln -s wangyan.cloud/_ecc /usr/local/nginx/conf/ssl-certs/

1.3.4. 撤销 && 删除

acme.sh --revoke -d 'wangyan.cloud/' -d '*.wangyan.cloud/' --ecc
acme.sh --list

2. 二、Nginx SSL 配置

2.1. 生成 dhparam

sudo chmod 777 /usr/local/nginx/conf/ssl-certs && \
sudo chmod o+t /usr/local/nginx/conf/ssl-certs

sudo openssl dhparam -out /etc/nginx/ssl-certs/dhparam.pem 2048
sudo curl https://ssl-config.mozilla.org/ffdhe2048.txt > /etc/nginx/ssl-certs/dhparam.pem

LLM 本地化部署6：安装 Ollama 模型推理引擎

Sat, 30 Aug 2025 00:00:00 +0800

1. 安装

在线安装

curl -fsSL https://ollama.com/install.sh | sh

离线安装

curl -L https://ollama.com/download/ollama-linux-amd64.tgz -o ollama-linux-amd64.tgz
sudo tar -C /usr -xzf ollama-linux-amd64.tgz

权限设置

sudo useradd -r -s /bin/false -U -m -d /usr/share/ollama ollama
sudo usermod -a -G ollama $(whoami)

2. 配置

https://github.com/ollama/ollama/blob/main/docs/faq.md

# /etc/systemd/system/ollama.service.d/override.conf
sudo systemctl edit ollama

[Service]
Environment="OLLAMA_HOST=172.17.0.1:8888"
Environment="OLLAMA_KEEP_ALIVE=1h"
Environment="OLLAMA_MAX_LOADED_MODELS=2"
Environment="OLLAMA_NUM_PARALLEL=3"

默认位置： /usr/share/ollama/.ollama/models

**特别注意：**修改了默认主机后，运行ollama命令需要增加加前缀 OLLAMA_HOST=172.17.0.1:8888

例如：OLLAMA_HOST=172.17.0.1:8888 ollama ps

3. 自启动

sudo vim /etc/systemd/system/ollama.service

[Unit]
Description=Ollama Service
After=network-online.target

[Service]
ExecStart=/usr/bin/ollama serve
User=ollama
Group=ollama
Restart=always
RestartSec=3
Environment="PATH=$PATH"

[Install]
WantedBy=default.target

启动

sudo systemctl daemon-reload
sudo systemctl enable --now ollama

4. 卸载

sudo systemctl stop ollama
sudo systemctl disable ollama
sudo rm /etc/systemd/system/ollama.service
sudo rm $(which ollama)
sudo rm -r /usr/share/ollama
sudo userdel ollama
sudo groupdel ollama
sudo rm -rf /usr/local/lib/ollama

5. 导入GGUF模型

5.1. 创建 Modelfile 文件

vim DeepSeek-R1-Distill-Qwen-7B-GGUF/Modelfile

FROM DeepSeek-R1-Distill-Qwen-7B-Q4_K_M.gguf

TEMPLATE """{{- if .System }}{{ .System }}{{ end }}
{{- range $i, $_ := .Messages }}
{{- $last := eq (len (slice $.Messages $i)) 1}}
{{- if eq .Role "user" }}<｜User｜>{{ .Content }}
{{- else if eq .Role "assistant" }}<｜Assistant｜>{{ .Content }}{{- if not $last }}<｜end▁of▁sentence｜>{{- end }}
{{- end }}
{{- if and $last (ne .Role "assistant") }}<｜Assistant｜>{{- end }}
{{- end }}"""

PARAMETER stop "<｜begin▁of▁sentence｜>"
PARAMETER stop "<｜end▁of▁sentence｜>"
PARAMETER stop "<｜User｜>"
PARAMETER stop "<｜Assistant｜>"

5.2. 创建、运行模型

#ollama create <model_name> -f <path_to_Modelfile>
ollama create deepseek-r1-7b
ollama run deepseek-r1-7b
ollama list
ollama ps

LLM 本地化部署5：安装 xinference 模型推理平台

Fri, 29 Aug 2025 00:00:00 +0800

Xinference 是一款开源模型推理平台，支持多种推理引擎（如 Transformers、vLLM 和 GGML），它提供多种灵活的 API 和接口，除了支持 LLM，它还可以部署 Embedding 和 ReRank 模型，这在企业级 RAG 构建中非常关键。Xinference 还支持分布式多机部署，能够在多个设备或机器间高效分配模型推理任务，满足多模型和高可用的部署需要。

1. 安装 xinference

https://inference.readthedocs.io/zh-cn/latest/getting_started/installation.html
https://inference.readthedocs.io/zh-cn/latest/user_guide/client_api.html

# uv 虚拟环境 （官方推荐3.10环境）
#pip install Cython
#uv pip install "xinference[all]" --no-build-isolation
#sudo apt-get install python3.12-dev libfst-dev
uv venv xinference --python 3.10 --seed
source xinference/bin/activate
uv pip install "xinference[all]"

2. 查询模型推理引擎

# 启动 xinference 本地服务
XINFERENCE_MODEL_SRC=modelscope xinference-local --host 0.0.0.0 --port 9997

# 查询LLM模型支持的所有的推理引擎
xinference engine -e http://0.0.0.0:9997 --model-name deepseek-r1

# 进一步查询vllm引擎所支持的参数组合
xinference engine -e http://0.0.0.0:9997 --model-name deepseek-r1 --model-engine vllm

# 进一步查询ggufv2格式所支持的参数组合
xinference engine -e http://0.0.0.0:9997 --model-name deepseek-r1 -f ggufv2

3. 启动和停止模型

xinference launch --model-name <MODEL_NAME> \
                  [--model-engine <MODEL_ENGINE>] \
                  [--model-type <MODEL_TYPE>] \
                  [--model-uid <MODEL_UID>] \
                  [--endpoint "http://<XINFERENCE_HOST>:<XINFERENCE_PORT>"] \

示例：deepseek-r1

xinference launch --model-name deepseek-r1-distill-qwen \
                  --model-engine llama.cpp \
                  --model-type LLM \
                  --model-uid deepseek/deepseek-r1-distill-qwen \
                  --endpoint "http://0.0.0.0:9997" \
                  --model-format ggufv2 \
                  --size-in-billions 7 \
                  --quantization Q4_K_M \
                  --n-gpu auto \
                  --replica 1 \
                  --n-worker 1 \
                  --model-path DeepSeek-R1-Distill-Qwen-7B-Q4_K_M.gguf \
                  --n_ctx 10240

示例：whisper-large-v3-turbo

xinference launch --model-name whisper-large-v3-turbo --model-type audio

4. 管理模型

# 列出 Xinference 中所有可以启动的、某种类型的模型
# type: LLM / embedding / image /audio / rerank video
xinference registrations --model-type LLM --endpoint "http://0.0.0.0:9997"

# 列出所有在运行的模型
xinference list

# 释放模型资源
xinference terminate --model-uid "qwen2.5-instruct"

LLM 本地化部署4：Transformers 模型量化

Thu, 28 Aug 2025 00:00:00 +0800

低精度模型：表示模型权重数值格式为 FP16（半精度浮点）或者 INT8（8位的定点整数）。
常规精度模型：表示模型权重数值格式为、 FP32（32位浮点，单精度）。
混合精度（Mixed precision）：表示模型中同时使用 FP32 和 FP16 的权重数值格式。 FP16 减少了一半的内存大小，但有些参数或操作符必须采用 FP32 格式才能保持准确度。

1. 下载 Transformers 模型

2. Transformers 模型转 GGUF 格式

~/llama.cpp/convert_hf_to_gguf.py DeepSeek-R1-Distill-Qwen-14B --outfile DeepSeek-R1-Distill-Qwen-14B-GGUF/DeepSeek-R1-Distill-Qwen-14B-F16.gguf

--outtype f32 参数可以指定量化精度

3. GGUF 模型量化

# 评估量化效果
llama-quantize-stats -m DeepSeek-R1-Distill-Qwen-7B-F16.gguf

# Q 代表量化。
# 5 表示量化过程中使用的位数。
# K 表示在量化中使用 k 均值聚类。
# M 表示量化后的模型大小。S = 小，M = 中，L = 大。
llama-quantize DeepSeek-R1-Distill-Qwen-7B-F16.gguf DeepSeek-R1-Distill-Qwen-7B-Q5_K_M.gguf Q5_K_M

# 14B
llama-quantize DeepSeek-R1-Distill-Qwen-14B-F16.gguf DeepSeek-R1-Distill-Qwen-14B-Q4_K_M.gguf Q4_K_M

q4_0：这是最初的量化方案，使用 4 位精度。
q4_1 和 q4_k_m、q4_k_s：这些提供了不同程度的准确性和推理速度，适合需要平衡资源使用的场景。
q5_0、q5_1、q5_k_m、q5_k_s：这些版本在保证更高准确度的同时，会使用更多的资源并且推理速度较慢。
q6_k 和 q8_0：这些提供了最高的精度，但是因为高资源消耗和慢速度，可能不适合所有用户。
fp16 和 f32: 不量化，保留原始精度。

4. 运行 GGUF 模型

llama-cli -m DeepSeek-R1-Distill-Qwen-7B-Q5_K_M.gguf
llama-cli -m DeepSeek-R1-Distill-Qwen-7B-Q5_K_M.gguf--port 8080

LLM 本地化部署3：安装本地模型推理引擎

Wed, 27 Aug 2025 00:00:00 +0800

3.1. 安装 Transformers 引擎

3.1.1. PyTorch 和 Transformers 关系

PyTorch 是由 Facebook 开发的机器学习框架，基于 Torch 库，底层由 C++ 实现，提供了丰富的工具和API，使得构建和训练神经网络变得更加简单和高效。
TensorFlow 是由 Google 开发的机器学习框架，具有静态计算图和高度优化的执行引擎，使其适用于大规模的分布式训练和部署。
Transformers 库是由 Hugging Face 开发的，它建立在 PyTorch 和 TensorFlow 之上，支持几乎有所的最新模型。

3.1.2. 使用 pip 安装 pytorch

注意：当前 pytorch 稳定版(2.8.0) 只支持到 CUDA 12.9，

https://pytorch.org/get-started/locally

最新稳定版：ptorch-2.8.0/cuda-12.9

# conda 虚拟环境
conda create --name pytorch280_cu129 python=3.12
conda activate pytorch280_cu129
pip3 install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu129

# uv 虚拟环境
uv venv pytorch280_cu129 --python 3.12 --seed
source pytorch280_cu129/bin/activate
uv pip install torch torchvision --index-url https://download.pytorch.org/whl/cu129

3.1.3. 使用 conda 安装 pytorch（不推荐）

https://pytorch.org/get-started/previous-versions/

# CUDA 12.4
conda install pytorch==2.5.1 torchvision==0.20.1 torchaudio==2.5.1 pytorch-cuda=12.4 -c pytorch -c nvidia

# CPU Only
conda install pytorch==2.5.1 torchvision==0.20.1 torchaudio==2.5.1 cpuonly -c pytorch

3.1.4. 验证 Torch/CUDA 版本

python ~/torch-test.py

import torch

# 显示当前torch版本
print(torch.__version__)

# 检查CUDA是否可用
print(torch.cuda.is_available())

# 显示当前CUDA版本
print(torch.version.cuda)

3.2. 安装 llama.cpp 引擎

llama.cpp 是一个用纯C/C++编写的开源大语言模型推理库,旨在实现高性能、跨平台的LLM推理。如果资源有限，可以优先使用 llama.cpp 引擎，因为他提供了更多的量化选项。

3.2.1. 安装依赖

# conda 虚拟环境
conda create --name llama_cpp python=3.12
conda activate llama_cpp
pip install -r requirements.txt

# uv 虚拟环境
# 注意目前只支持到 python 3.12
uv venv llama_cpp --python 3.12 --seed
source llama_cpp/bin/activate
git clone https://ghfast.top/https://github.com/ggml-org/llama.cpp
cd llama.cpp
uv pip install numpy==1.26.4 huggingface-hub==0.23.2 matplotlib==3.10.0
uv pip install -r requirements.txt --prerelease=allow

3.2.2. 导入 CUDA 环境

vim ~/.cuda.env
# set cuda environment
export CUDA_HOME=/usr/local/cuda
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/cuda/lib64:/usr/local/cuda/extras/CUPTI/lib64
export PATH=$PATH:$CUDA_HOME/bin

vim ~/.bashrc
# import cuda environment
source ~/.cuda.env

3.2.3. 源码编译 llama.cpp

https://github.com/ggml-org/llama.cpp/blob/master/docs/build.md

# 安装编译工具
sudo apt -y install build-essential g++ cmake libcurl4-openssl-dev

# CUDA Build
cmake -B build -DGGML_CUDA=ON
cmake --build build --config Release -- -j 8

# CPU Build
cmake -B build
cmake --build build --config Release -- -j 8

3.2.4. llama.cpp 命令补全

~/llama.cpp/build/bin/llama-cli --completion-bash > ~/.llama-completion.bash

vim ~/.profile

# set llama PATH if it exists
if [ -d "$HOME/llama.cpp/build/bin" ] ; then
    PATH="$HOME/llama.cpp/build/bin:$PATH"
fi

# llama completion
source ~/.llama-completion.bash

3.3. 安装 vLLM 引擎

vLLM 专为高效服务大型语言模型（LLM）而设计，通过有效管理注意力键和值来改善内存管理，吞吐量能够达到 Transformers 的 24 倍，因此 vLLM 适合在生产环境中使用，应对高并发的用户访问。

由于 vLLM 编译了许多 CUDA 内核，导致与有 CUDA 和 PyTorch 出现很多兼容问题，因此官方建议在全新环境中部署。

详细安装方法见官方文档： https://docs.vllm.ai/en/latest/getting_started/installation/gpu/index.html

uv venv vllm --python 3.12 --seed
source vllm/bin/activate
uv pip install vllm

需要注意的是，vllm 默认安装的是 cu124 版本，请确保与系统的一致。

LLM 本地化部署2：安装 Python 环境

Tue, 26 Aug 2025 00:00:00 +0800

1. 使用 Conda 虚拟环境

1.1. 安装 Anaconda

https://docs.anaconda.com/anaconda/install/

# 安装
curl -O https://repo.anaconda.com/archive/Anaconda3-2025.06-0-Linux-x86_64.sh
bash ~/Anaconda3-2025.06-0-Linux-x86_64.sh

# 设置默认是否进入base环境
conda config --set auto_activate_base True
conda config --set auto_activate_base False

# 手动初始化
source <PATH_TO_CONDA>/bin/activate
conda init --all

# 更新Conda环境
conda update --all

1.2. 解决 GLIBCXX not found 问题

# 查看系统 libstdcxx 版本
strings /usr/lib/x86_64-linux-gnu/libstdc++.so.6 | grep GLIBCXX

# 查询 conda libstdcxx 版本
cd ~/anaconda3/envs/xinference/lib/
strings libstdc++.so.6| grep GLIBCXX

# 升级 conda libstdcxx 版本
conda install conda-forge::libstdcxx-ng --update-deps
conda install conda-forge::libgcc-ng --update-deps

# 或者做软链接
rm libstdc++.so.6
ln -s /usr/lib/x86_64-linux-gnu/libstdc++.so.6 libstdc++.so.6

1.3. 常用 conda 命令

conda 会检查当前环境安装的 Python 版本，并仅安装与该 Python 版本兼容的包。

# 查看
conda env list

# 搜索
conda search <PACKAGE>
conda search <CHANNEL>::<PACKAGE>
conda search python

# 新建
conda create --name <ENVIRONMENT> python=<VERSION>
conda create --name python311 python=3.11
conda create --name pytorch251_cu126 --clone python311
conda create --name xinference --clone pytorch251_cu126

# 激活、退出、删除
conda activate xinference
conda deactivate
conda env remove --name xinference

# 导出、导入
conda env export --name pytorch251 > pytorch251.yml
conda env create -f pytorch251.yml

1.4. conda 和 pip 区别

conda 可以管理非python包，pip只能管理python包。
conda 可以用来创建虚拟环境，pip不能，需要依赖virtualenv之类的包。
conda 安装的包是编译好的二进制文件，pip安装的包是wheel或源码，需要解禁依赖问题。
conda 安装的包会统一下载到当前虚拟环境对应的目录下，下载一次多次安装，pip是直接下载到对应环境中。

1.5. 通过 conda 安装

https://docs.anaconda.com/working-with-conda/packages/install-packages/

# 全局代理
vim ~/.condarc

proxy_servers:
    http: http://127.0.0.1:7890
    https: http://127.0.0.1:7890

# 安装包
conda install <PACKAGE>
conda install <PACKAGE> --name <ENVIRONMENT>
conda install <PACKAGE_PATH/PACKAGE>.conda
conda install conda-forge::transformers

1.6. 通过 pip 安装包

https://docs.anaconda.com/working-with-conda/packages/pip-install/

# 全局代理
pip config set global.proxy http://127.0.0.1:7890

# 安装包
pip install <PACKAGE>

2. 使用 uv 虚拟环境

2.1. 安装 uv

https://docs.astral.sh/uv/getting-started/installation/

curl -LsSf https://astral.sh/uv/install.sh | sh
source $HOME/.local/bin/env

# Shell 自动补全
echo 'eval "$(uv generate-shell-completion bash)"' >> ~/.bashrc

# 安装 python
uv python list
uv python install 3.13

2.2. 镜像设置

https://docs.astral.sh/uv/reference/settings

vim ~/.config/uv/uv.toml

[[index]]
url = "https://mirrors.tuna.tsinghua.edu.cn/pypi/web/simple"
default = true

2.3. 常用命令

默认缓存目录：$HOME/.cache/uv

安装包： https://docs.astral.sh/uv/pip/packages

# 设置代理
export HTTPS_PROXY=http://192.168.60.181:7890
export HTTP_PROXY=http://192.168.60.181:7890
export UV_HTTP_TIMEOUT=300

# 新建
uv venv pytorch --python 3.12 --seed
source pytorch/bin/activate

# 退出
deactivate

LLM 本地化部署1：安装 CUDA 环境

Mon, 25 Aug 2025 00:00:00 +0800

1. 安装 CUDA Toolkit

1.1. 检查 CUDA 支持

首先，确保你的 GPU 支持 CUDA

https://developer.nvidia.com/cuda-gpus

1.2. 在线安装（新版本）

https://developer.nvidia.com/cuda-downloads

# cu13.0
wget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/x86_64/cuda-keyring_1.1-1_all.deb
sudo dpkg -i cuda-keyring_1.1-1_all.deb
sudo apt-get update
sudo apt-get -y install cuda-toolkit-13-0
sudo apt-get install -y cuda-drivers

注：最新版 cu13 存在非常非常多的兼容问题，大量第三方框架没有适配，不推荐安装。

1.3. 离线安装（旧版本）

https://developer.nvidia.com/cuda-toolkit-archive

1.3.1. 下载安装包

# cuda 12.9 (ubuntu24.04)
# pytorch 最新稳定版适配到 cu129
# https://pytorch.org/get-started/locally/
wget https://developer.download.nvidia.com/compute/cuda/12.9.1/local_installers/cuda_12.9.1_575.57.08_linux.run
sudo sh cuda_12.9.1_575.57.08_linux.run

# cuda 12.4
# cu124 兼容性最好，但只能在 ubuntu22.4 中安装
wget https://developer.download.nvidia.com/compute/cuda/12.4.1/local_installers/cuda_12.4.1_550.54.15_linux.run
sudo sh cuda_12.4.1_550.54.15_linux.run

注：若第一次安装失败，需重启后再安装。

1.3.2. 环境设置

# sudo vim /etc/profile
PATH=$PATH:/usr/local/cuda-12.9/bin
export PATH

1.3.3. 检查卸载

nvidia-smi
cuda-uninstaller
nvidia-uninstall

2. 安装 Container Toolkit

NVIDIA Container Toolkit 是一组库和实用程序，使用户能够构建和运行 GPU 加速的容器。它目前包括：

NVIDIA Container Runtime (nvidia-container-runtime)
NVIDIA Container Toolkit CLI (nvidia-ctk)
NVIDIA CDI Hooks (nvidia-cdi-hook)
NVIDIA Container Runtime Hook (nvidia-container-runtime-hook)
NVIDIA Container CLI (nvidia-container-cli)
NVIDIA Container Library (libnvidia-container1)

2.1. 安装 Docker

https://docs.docker.com/engine/install/ubuntu/

curl https://code.wangyan.cloud/wangyan/docker-compose/raw/branch/main/shell-script/docker-setup-ubuntu-aliyun.sh | bash

2.2. 安装 container-toolkit

https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html

curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | sudo gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg \
  && curl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | \
    sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' | \
    sudo tee /etc/apt/sources.list.d/nvidia-container-toolkit.list

sudo apt-get update
sudo apt-get install -y nvidia-container-toolkit

2.3. 配置 Docker 运行时

sudo nvidia-ctk runtime configure --runtime=docker
sudo systemctl restart docker

PHP 8 从源码安装与配置

Wed, 16 Jul 2025 00:00:00 +0800

1. 一、安装依赖

1.1. 安装编译工具及依赖

CentOS Stream 8/9

#sudo yum groupinstall 'Development Tools'
sudo yum install -y \
    gcc gcc-c++ autoconf \
    systemd-devel openssl-devel libcurl-devel \
    oniguruma-devel zlib-devel \
    libwebp-devel libjpeg-turbo-devel freetype-devel libpng-devel \
    libxml2-devel libxslt-devel \
    libsq3-devel libzip-devel file-devel

Debian/Ubuntu

sudo apt install -y pkg-config gcc autoconf \
	libsystemd-dev libssl-dev libcurl4-openssl-dev \
	libonig-dev libzip-dev libsqlite3-dev \
	libwebp-dev libjpeg-dev libfreetype6-dev libpng-dev \
	libxml2-dev  libxslt-dev libgmp-dev libsodium-dev

1.2. 安装 libiconv

wget https://ftp.gnu.org/pub/gnu/libiconv/libiconv-1.18.tar.gz
tar -zxf libiconv-1.18.tar.gz &&\
cd libiconv-1.18 &&\
./configure --prefix=/usr/local/ &&\
make &&\
sudo make install &&\
sudo ln -s /usr/local/lib/libiconv.so.2.7.0 /usr/lib64/ &&\
sudo ldconfig

1.3. 安装 libzip（已过时，选做）

1.3.1. 通过 RPM 安装

https://pkgs.org/download/libzip

yum remove -y libzip
rpm -Uvh http://rpms.remirepo.net/enterprise/7/remi/x86_64//libzip-last-1.1.3-1.el7.remi.x86_64.rpm
rpm -Uvh http://rpms.remirepo.net/enterprise/7/remi/x86_64//libzip-last-devel-1.1.3-1.el7.remi.x86_64.rpm

1.3.2. 手动编译安装

安装 cmake

wget https://cmake.org/files/v3.26/cmake-3.26.1-linux-x86_64.sh && \
chmod +x cmake-3.26.1-linux-x86_64.sh && \
./cmake-3.26.1-linux-x86_64.sh

mv cmake-3.26.1-linux-x86_64 /usr/local/cmake
ln -s /usr/local/cmake/bin/cmake /usr/local/bin/cmake

编译安装 libzip

wget https://libzip.org/download/libzip-1.10.0.tar.gz &&\
tar -zxf libzip-1.10.0.tar.gz &&\
cd libzip-1.10.0 &&\
mkdir build &&\
cd build &&\
cmake .. &&\
make &&\
make install

更新 lib

echo '/usr/local/lib64
/usr/local/lib
/usr/lib
/usr/lib64'>>/etc/ld.so.conf.d/local.conf

ldconfig

1.4. 安装 imap（已过时，选做）

centOS7 已经没有了 libc-client，需要编译安装

注：epel 源可以找到 libc-client-devel uw-imap-devel uw-imap-static uw-imap-utils，但直接安装还是会出现一些问题。

编译安装

wget ftp://ftp.cac.washington.edu/imap/imap-2007f.tar.gz
tar -zxf imap-2007f.tar.gz
cd imap-2007f
make lr5 PASSWDTYPE=std SSLTYPE=unix.nopwd EXTRACFLAGS=-fPIC IP=4
mkdir -p /usr/local/imap-2007f/{include,lib,c-client}
cp c-client/*.h /usr/local/imap-2007f/include/ && \
cp c-client/*.c /usr/local/imap-2007f/lib/  && \
cp c-client/*.c /usr/local/imap-2007f/c-client/  && \
cp c-client/c-client.a /usr/local/imap-2007f/lib/libc-client.a  && \
cp c-client/c-client.a /usr/local/imap-2007f/c-client/libc-client.a

备注：在 64 位下编译时 make 参数需要带 EXTRACFLAGS=-fPIC ，在 32 位下则不需要。

1.5. 其他（已过时，选做）

yum install -y libicu-devel libmcrypt-devel pam-devel bison bison-devel re2c

libmcrypt-devel 需要使用 epel 源

dnf config-manager --set-enabled powertools
dnf install epel-release epel-next-release

2. 二、安装 PHP

2.1. 下载软件包

mkdir ~/packages && cd ~/packages && \
wget http://us.php.net/distributions/php-8.4.10.tar.gz  && \
sudo tar zxf php-8.4.10.tar.gz -C /usr/local/src

2.2. 新增用户和组 (选做)

# On Ubuntu/Debian:
sudo addgroup --system --gid 37 www-data  && \
sudo adduser \
    --system \
    --home /usr/local/php \
    --shell /bin/false \
    --uid 37 \
    --gecos 'PHP Server' \
    --gid 37 \
    --disabled-password \
    www-data

# On Fedora/RHEL/CentOS:
sudo groupadd --system www-data  && \
sudo adduser \
   --system \
   --shell /bin/bash \
   --comment 'PHP server' \
   --gid www-data \
   --home-dir /usr/local/php \
   --create-home \
   www-data

2.3. 编译安装

cd /usr/local/src/php-8* && \
sudo ./configure \
  --prefix=/usr/local/php \
  --with-config-file-path=/usr/local/php/etc  \
  --with-config-file-scan-dir=/usr/local/php/conf.d  \
  --enable-fpm  \
  --with-fpm-user=www-data  \
  --with-fpm-group=www-data  \
  --with-fpm-systemd  \
  --with-openssl \
  --with-zlib \
  --enable-bcmath \
  --enable-calendar \
  --with-curl  \
  --enable-exif \
  --enable-ftp \
  --enable-gd  \
  --with-webp  \
  --with-jpeg  \
  --with-freetype  \
  --with-gettext  \
  --with-gmp \
  --with-iconv=/usr/local \
  --with-mhash \
  --enable-mbstring \
  --with-mysqli=mysqlnd \
  --enable-pcntl \
  --with-pdo-mysql=mysqlnd \
  --enable-sockets \
  --with-xsl \
  --with-zip \
  --enable-mysqlnd \
  --with-sodium

#make ZEND_EXTRA_LIBS='-liconv' -j4
sudo make -j4
sudo make install

3. 三、php 配置

3.1. php-fpm.conf 设置

sudo mkdir /var/log/php-fpm/ & \
sudo cp /usr/local/php/etc/php-fpm.conf.default /usr/local/php/etc/php-fpm.conf

sudo vim /usr/local/php/etc/php-fpm.conf

pid = /var/run/php-fpm.pid
error_log = /var/log/php-fpm/error.log

3.2. www.conf 设置

sudo vim /usr/local/php/etc/php-fpm.d/www.conf

[www]
user = www-data
group = www-data

listen = /dev/shm/php-fpm.sock
listen.allowed_clients = 127.0.0.1
listen.owner = www-data
listen.group = www-data
listen.mode = 0660
listen.allowed_clients = 127.0.0.1

pm = dynamic
pm.max_children = 30
pm.start_servers = 15
pm.min_spare_servers = 10
pm.max_spare_servers = 20
pm.max_requests = 1024

pm.status_path = /status
ping.path = /ping
access.log = /var/log/php-fpm/$pool.access.log
slowlog = /var/log/php-fpm/$pool.log.slow
request_slowlog_timeout = 10s
request_terminate_timeout = 60

3.3. php.ini 设置

sudo cp php.ini-production /usr/local/php/etc/php.ini

sudo sed -i "s|;*date.timezone =.*|date.timezone = PRC|i" /usr/local/php/etc/php.ini && \
sudo sed -i "s|;*memory_limit =.*|memory_limit = 1024M|i" /usr/local/php/etc/php.ini && \
sudo sed -i "s|;*upload_max_filesize =.*|upload_max_filesize = 2G|i" /usr/local/php/etc/php.ini && \
sudo sed -i "s|;*max_file_uploads =.*|max_file_uploads = 50|i" /usr/local/php/etc/php.ini && \
sudo sed -i "s|;*post_max_size =.*|post_max_size = 2G|i" /usr/local/php/etc/php.ini

3.4. 开机自启动

sudo cp sapi/fpm/php-fpm.service  /usr/lib/systemd/system/ && \
sudo systemctl enable --now php-fpm

3.5. 配置环境变量

sudo vim /etc/profile

PATH=$PATH:/usr/local/mysql/bin:/usr/local/php/bin:/usr/local/nginx/sbin
export PATH

source /etc/profile

4. 四、安装 PHP 扩展

4.1. PHPRedis

git clone https://github.com/phpredis/phpredis.git && \
cd phpredis && \
/usr/local/php/bin/phpize && \
./configure --with-php-config=/usr/local/php/bin/php-config && \
make && sudo make install

4.2. ImageMagick

https://pecl.php.net/package/imagick

安装依赖

sudo yum install autoconf gcc gcc-c++ ImageMagick-devel

下载安装

wget https://pecl.php.net/get/imagick-3.7.0.tgz && \
tar xf imagick-3.7.0.tgz && \
cd imagick-3.7.0 && \
/usr/local/php/bin/phpize && \
./configure --with-php-config=/usr/local/php/bin/php-config && \
make && sudo make install

4.3. php.ini添加扩展

sudo vim /usr/local/php/etc/php.ini

extension=redis
zend_extension=opcache

sudo systemctl restart php-fpm

5. 五、安装 Composer

curl -O https://getcomposer.org/composer.phar && \
sudo mv composer.phar /usr/local/bin/composer && \
sudo chmod +x /usr/local/bin/composer

Nginx 从软件源安装与配置

Wed, 14 May 2025 00:00:00 +0800

一、安装

1.1. 安装依赖

# ubuntu
sudo apt install curl gnupg2 ca-certificates lsb-release ubuntu-keyring

# debian
sudo apt install curl gnupg2 ca-certificates lsb-release debian-archive-keyring

# Fedora/RHEL/CentOS
sudo yum install yum-utils

1.2. 添加软件源

# On Fedora/RHEL/CentOS:
sudo sh -c "cat > /etc/yum.repos.d/nginx.repo" <<EOF
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

[nginx-mainline]
name=nginx mainline repo
baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
EOF

# Ubuntu/Debian:
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor \
    | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null

# Debian
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/debian `lsb_release -cs` nginx" \
    | sudo tee /etc/apt/sources.list.d/nginx.list

# Ubuntu
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/ubuntu `lsb_release -cs` nginx" \
    | sudo tee /etc/apt/sources.list.d/nginx.list

1.3. 安装运行

# On Fedora/RHEL/CentOS:
sudo yum-config-manager --enable nginx-mainline
sudo yum install nginx

# On Ubuntu/Debian:
sudo apt update
sudo apt install nginx

1.4. 防火墙设置

sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reload

二、配置

默认配置文件路径

默认网站根目录 /usr/share/nginx/html
默认网站根配置文件 /etc/nginx/conf.d/default.conf
其他网站配置文件 /etc/nginx/conf.d/
全局配置文件 /etc/nginx/nginx.conf

新建额外配置目录

mkdir -p /etc/nginx/{sites-available,sites-enabled,conf.d,rewrite-rules,ssl-certs} && \
chmod 755 /etc/nginx/{sites-available,sites-enabled,conf.d,rewrite-rules,ssl-certs}

# vim /etc/nginx/nginc.conf
nclude /etc/nginx/sites-enabled/*.conf;

SSL 证书目录

chmod 777 /etc/nginx/ssl-certs && \
chmod o+t /etc/nginx/ssl-certs
  
openssl dhparam -out /etc/nginx/ssl-certs/dhparam.pem 2048
curl https://ssl-config.mozilla.org/ffdhe2048.txt > /etc/nginx/ssl-certs/dhparam.pem

运行 Nginx

查看主机IP地址

ip addr show eth0 | grep inet | awk '{ print $2; }' | sed 's/\/.*$//'

运行

sudo systemctl enable --now nginx

OpenSSL 生成自签署证书

Wed, 14 May 2025 00:00:00 +0800

一、准备

克隆项目

git clone https://code.wangyan.cloud//wangyan/gen-ssl-cert.git /tmp/gen-ssl-cert

初始化工作目录

cd /tmp/gen-ssl-cert
make init

分别修改 ica.cnf 和 ca.cnf 配置文件中的 Custom Section单元，自定义服务器域名和IP地址

[ alt_section ]
DNS.1                   = wangyan.cloud/
DNS.2                   = *.wangyan.cloud/
IP.1                    = 119.29.17.197
IP.2                    = 101.32.204.113

[crl_section]
URI = http://safe.wangyan.cloud//crl/ica-crl.pem

[ocsp_section]
OCSP;URI = http://ocsp.wangyan.cloud/

在 Makefile 文件中，查找 subjectAltName 和 subj 部分，自定义服务器域名和IP地址

-subj "/C=CN/ST=Guangdong/L=Zhuhai/O=Selfsigned/CN=wangyan.cloud/" \
-addext "subjectAltName = IP:119.29.17.197,DNS:wangyan.cloud/"

二、自签署 CA 根证书

2.1. 创建 `CA KEY`

make gen-ca-key

2.2. 创建 CA 请求文件

make gen-ca-csr

2.3. 创建 CA 根证书

# 根据上面请求文件，生成CA证书
make gen-ca-cert

2.4. 查看 CA 根证书详情（可选）

make view-ca-cert

三、自签署中间证书

3.1. 创建中间证书`KEY`

make gen-ica-key

3.2. 创建中间证书请求文件

make gen-ica-csr

3.3. 创建中间证书

make gen-ica-cert

3.4. 查看中间证书详情（可选）

make view-ica-cert

3.5. 合成中间证书链（可选）

将CA证书与中间证书合并

make gen-ica-chain

四、自签署服务器证书

4.1. 创建服务器证书`KEY`

make gen-server-key

4.2. 创建服务器证书请求文件

修改 Makefile 文件 gen-server-csr 单元的值

# 将域名 wangyan.cloud/ 和 IP 地址改成自己服务器的
openssl req -config ica.cnf \
	-new -sha256 \
    -key ica/private/server-key.pem \
    -subj "/C=CN/ST=Guangdong/L=Zhuhai/O=Selfsigned/CN=wangyan.cloud/" \
    -out ica/csr/server-csr.pem \
	-addext "subjectAltName = IP:119.29.17.197,IP:101.32.204.113,DNS:wangyan.cloud/,DNS:*.wangyan.cloud/"

生成证书请求文件

make gen-server-csr

4.3. 创建服务器证书

make gen-server-cert

4.4. 查看服务器证书详情（可选）

make view-server-cert

4.5. 合成完整服务器证书（可选）

make gen-server-full

五、自签署客户端证书（可选）

客户端证书与服务器证书生成过程一致，不再展开。

make gen-client-key
# 同样要修改Makefile 文件 gen-client-csr 单元的值
make gen-client-csr
make gen-client-cert
make view-client-cert
# 创建 PKCS12 证书
make gen-client-pkcs12

客户端证书与服务器证书区别体现在用途上，详见 ica.cnf 配置文件

# The Client Certificate
[ usr_cert ]
keyUsage                = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement
extendedKeyUsage        = clientAuth,codeSigning,emailProtection,timeStamping

# The Server Certificate
[ server_cert ]
keyUsage                = digitalSignature, nonRepudiation, keyAgreement
extendedKeyUsage        = serverAuth

六、吊销证书 CRL（可选）

创建证书吊销列表

make gen-ica-crl

吊销客户端证

吊销上面生成的客户端证书 client-cert.crt

make gen-ica-revoke-client

七、OCSP 证书查询（可选）

创建OCSP服务器证书

make gen-ocsp-key
# 修改 Makefile 文件 gen-ocsp-csr 单元的值,自定义域名和IP地址。
make gen-ocsp-csr
make gen-ocsp-cert

运行OCSP服务器

make run-ocsp-server

连接OCSP检查证书状态

make chk-ocsp-cert

使用 Docker Compose 安装 Gitea

Fri, 21 Mar 2025 00:00:00 +0800

Gitea 是一个轻量级的 DevOps 平台软件。从开发计划到产品成型的整个软件生命周期，他都能够高效而轻松的帮助团队和开发者。包括 Git 托管、代码审查、团队协作、软件包注册和 CI/CD。

项目网址：https://github.com/go-gitea/gitea
官方文档： https://docs.gitea.com/zh-cn/

1. 镜像选择

Gitea 提供的镜像包括 标准 和 rootless 。

rootless 镜像使用 Gitea 内部 SSH 功能来提供 Git 协议，不支持 OpenSSH，不需要 root 权限。

项目	标准镜像	rootless 镜像
执行用户	root	非 root
ssh 端口	22	2222
git 用户与组	任意（由配置文件中指定）	1000:1000
openssh	支持	不支持
AppPath	/usr/local/bin/gitea	/usr/local/bin/gitea
WorkPath	/data/gitea	/var/lib/gitea
CustomPath	/data/gitea	/var/lib/gitea/custom
ConfigFile	/data/gitea/conf/app.ini	/etc/gitea/app.ini

2. 安装部署

2.1. 使用 `rootless` 镜像

2.1.1. 创建工作目录

docker 自动创建的目录是root 权限，因此需要手动创建目录，以确保权限一致。

rootless 镜像内的git 用户与组的id是1000:1000 ，所以建议主机也使用1000:1000 。

当然了，不一致也没关系，但需要通过user: xxxx:xxxx 指定具体值。

mkdir data config
sudo chown 1000:1000 data config

2.1.2. 创建配置文件

特别注意：data config 文件夹应由user: xxxx:xxxx指定的用户所有，以确保主机能够正常访问这两个文件夹。

services:
  server:
    image: gitea/gitea:1.21-rootless
    container_name: gitea
    hostname: gitea
    restart: always
    user: 1000:1000
    volumes:
      - ./data:/var/lib/gitea
      - ./config:/etc/gitea
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "0.0.0.0:3000:3000"
      - "0.0.0.0:2222:2222"

2.1.3. 启动运行

注意：如果在 HTTP 上使用的是非 3000 端口，请将 app.ini 更改为匹配 LOCAL_ROOT_URL = http://localhost:3000/。

docker compose up -d
docker compose logs -f

2.2. 使用 `标准` 镜像

2.2.1. 创建工作目录

docker 自动创建的目录是root 权限，因此要手动创建目录。

与 rootless 镜像不同，标准镜像内的 git 用户id可以通过环境变量指定，自由度更高。

mkdir data
chown 1000:1000 data

2.2.2. 创建配置文件

注意事项：

data 文件夹应由 environment 指定的用户所有。
只需挂载一个路径 /data ，相比rootless 更简单
支持 openssh 标准 22 端口
特别注意：生成的 ssh 文件夹是 root 权限的，因此主机要有 root 权限。

services:
  server:
    image: gitea/gitea:latest
    container_name: gitea
    hostname: gitea
    restart: always
    environment:
    # - GITEA___server__PROTOCOL=http
    # - GITEA___server__DOMAIN=code.wangyan.cloud/
    # - GITEA___server__ROOT_URL=https://code.wangyan.cloud/
    # - GITEA___server__HTTP_ADDR=0.0.0.0
    # - GITEA___server__HTTP_PORT=3000
    # - GITEA___server__SSH_DOMAIN=wangyan.cloud/
    # - GITEA___server__SSH_PORT=22
    # - GITEA___server__LFS_START_SERVER=true
    # - GITEA__database__DB_TYPE=mysql
    # - GITEA__database__HOST=127.0.0.1:3306
    # - GITEA__database__NAME=gitea
    # - GITEA__database__USER=gitea
    # - GITEA__database__PASSWD=123456
    # - GITEA__mailer__ENABLED=true
    # - GITEA__mailer__PROTOCOL=smtp+starttls
    # - GITEA__mailer__SMTP_ADDR=smtp-mail.outlook.com
    # - GITEA__mailer__SMTP_PORT=587
    # - GITEA__mailer__FROM="No-Reply" <no-reply@outlook.com>
    # - GITEA__mailer__USER=no-reply@outlook.com
    # - GITEA__mailer__PASSWD=123456
      - USER_UID=1000
      - USER_GID=1000
    volumes:
      - ./data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "0.0.0.0:3000:3000"
      - "0.0.0.0:2222:22"

2.2.3. 启动运行

docker compose up -d
docker compose logs -f

3. SSH 容器直通

由于 SSH 在容器内运行，如果需要 SSH 支持，则需要将 SSH 从主机传递到容器。

3.1. 创建 `git` 用户

这里的git 用户用于ssh 容器透传。如果不需要 git clone git@host:username 功能，可以忽略。

# uid 和 gid 也可以随机不指定。
sudo groupadd -g 1100 git && \
sudo useradd -c "Git Version Control" -m -d /home/git -s /bin/bash -u 1100 -g 1100 git

# 将用户添加到docker用户组
sudo usermod -aG docker git

3.2. 方法一：使用 AuthorizedKeysCommand

该方法最大优点是：通过 AuthorizedKeysCommand 进入容器获取git用户的 authorized_keys，不需要挂载主机的 .ssh 目录到容器。

客户端执行 git clone 命令后，会进入容器执行 gitea keys 命令，返回用户的 authorized_keys 公钥信息完成认证，该信息是带有 command="/usr/local/bin/gitea 路径的，与容器上 Gitea 二进制文件的位置匹配。
通过验证后，主机 SSH 服务器为git用户建立会话，并使用主机git用户的 shell 执行后续命令。

3.2.1. Docker 获取 authorized_keys（推荐）

主机使用 docker exec 方式进入容器获取 authorized_keys。

# gitea 是容器名称，请根据实际修改。
# 标准镜像需要加 "-u git" 指定用户，root 身份运行 docker exec 会报错。
cat <<"EOF" | sudo tee -a /etc/ssh/sshd_config
Match User git
  AuthorizedKeysCommandUser git
  AuthorizedKeysCommand /usr/bin/docker exec -i -u git gitea /usr/local/bin/gitea keys -e git -u %u -t %t -k %k
EOF

sudo systemctl restart sshd

3.2.2. SSH 获取 authorized_keys（二选一）

与docker shell 基本一样，不同地方在于没有使用 docker exec 进入容器，而是通过 ssh git@127.0.0.1 进入容器。

此方法需要将容器的 22 端口映射到主机，比如映射为 2222，并且主机git用户要创建一个密钥对，并提前将公钥添加到容器的 /data/git/.ssh/authorized_keys 目录。

cat <<"EOF" | sudo tee -a /etc/ssh/sshd_config
Match User git
  AuthorizedKeysCommandUser git
  AuthorizedKeysCommand /usr/bin/ssh -p 2222 -o StrictHostKeyChecking=no git@127.0.0.1 /usr/local/bin/gitea keys -e git -u %u -t %t -k %k
EOF

sudo systemctl restart sshd

3.3. 方法二：共享 authorized_keys

此方法是通过与容器共享 authorized_keys文件的方式来进行用于认证，用于带有 openssh 的标准镜像。

为了使转发正常工作，需要将容器的 SSH 端口（22）映射到主机端口 2222。

#docker-compose.yml
ports:
  - "127.0.0.1:2222:22"

接下来要使容器git用户的uid 和 gid 与主机上的git用户一致。

#docker-compose.yml
environment:
  - USER_UID=1000
  - USER_GID=1000

然后，创建主机与容器互联的密钥。

# 生成 authorized_keys 文件
sudo -u git mkdir /home/git/.ssh/
sudo -u git ssh-keygen -f "/home/git/.ssh/idrsa" -t rsa -b 4096 -C "Gitea Host Key"
sudo -u git echo "$(cat /home/git/.ssh/idrsa.pub)" >> /home/git/.ssh/authorized_keys
sudo -u git chmod 600 /home/git/.ssh/authorized_keys

接下来将主机/home/git/.ssh挂载到容器中。这可确保authorized_keys文件在主机用户和容器之间共享。

volumes:
  - /home/git/.ssh/:/data/git/.ssh

通过 Gitea 界面添加的所有用户公钥都将有前缀 command="/usr [...]。

/home/git/.ssh/authorized_keys内容如下：

# SSH pubkey from git user
ssh-rsa <Gitea Host Key>

# other keys from users
command="/usr/local/bin/gitea --config=/data/gitea/conf/app.ini serv key-1"...

因此，当客户端执行 git clone 命令时会执行 /usr/local/bin/gitea 文件。

3.4. 转发主机命令到容器

3.4.1. 方法1：shell 方式（推荐）

为了能够在容器内执行命令，我们还需要修改git 用户的默认shell

# gitea 是容器名称，请根据实际修改。
cat <<"EOF" | sudo tee /home/git/docker-shell
#!/bin/sh
/usr/bin/docker exec -i -u git --env SSH_ORIGINAL_COMMAND="$SSH_ORIGINAL_COMMAND" gitea sh "$@"
EOF

sudo chmod +x /home/git/docker-shell
sudo usermod -s /home/git/docker-shell git

当然，也可以使用下面SSH方式执行。（二选一）

cat <<"EOF" | sudo tee /home/git/ssh-shell
#!/bin/sh
ssh -p 2222 -o StrictHostKeyChecking=no git@127.0.0.1 "SSH_ORIGINAL_COMMAND=\"$SSH_ORIGINAL_COMMAND\" $@"
EOF

sudo chmod +x /home/git/ssh-shell
sudo usermod -s /home/git/ssh-shell git

3.4.2. 方法2：Shim 方式

在主机创建虚假gitea可执行文件，该文件将把命令从主机转发到容器。

# gitea 是容器名称，请根据实际修改。
# 与 shell 相比多了 $0
cat <<'EOF' | sudo tee /usr/local/bin/gitea
#!/bin/sh
/usr/bin/docker exec -i -u git --env SSH_ORIGINAL_COMMAND="$SSH_ORIGINAL_COMMAND" gitea sh $0 "$@"
EOF
sudo chmod +x /usr/local/bin/gitea

当然，也可以使用下面SSH方式执行。（二选一）

cat <<"EOF" | sudo tee /usr/local/bin/gitea
#!/bin/sh
ssh -p 2222 -o StrictHostKeyChecking=no git@127.0.0.1 "SSH_ORIGINAL_COMMAND=\"$SSH_ORIGINAL_COMMAND\" $0 $@"
EOF
sudo chmod +x /usr/local/bin/gitea

4. Gitea Actions

4.1. Act Runner

4.1.1. 使用二进制文件

# 下载
wget https://gitea.com/gitea/act_runner/releases/download/v0.2.7/act_runner-0.2.7-linux-amd64
mv act_runner-0.2.7-linux-amd64 gitea-runner
chmod +x gitea-runner
./gitea-runner --version

# 导出默认配置文件
./gitea-runner generate-config > config.yaml

# 注册
# ./gitea-runner --config config.yaml register
./gitea-runner register \
 --no-interactive \
 --instance https://codes.wangyan.cloud/ \
 --token xx \
 --name gitea-runner

4.1.2. 使用 Docker 镜像

导出配置文件

sudo docker pull gitea/act_runner:latest
sudo docker run --entrypoint="" --rm -it gitea/act_runner:latest act_runner generate-config > config.yaml

配置 Cache

#vim config.yaml
cache:
enabled: true
dir: ""
# 使用步骤 1. 获取的 LAN IP
host: "192.168.8.17"
# 使用步骤 2. 获取的端口号
port: 3030

运行

#vim docker-compose.yml
version: "3.8"
  services:
    runner:
    image: gitea/act_runner:nightly
    environment:
    CONFIG_FILE: /config.yaml
    GITEA_INSTANCE_URL: "http://119.29.17.197:3000"
    GITEA_RUNNER_REGISTRATION_TOKEN: "xx"
    GITEA_RUNNER_NAME: "gitea-runner"
    volumes:
    - ./config.yaml:/config.yaml
    - ./data:/data
    - /var/run/docker.sock:/var/run/docker.sock
    ports:
    - "3030:3030"

4.2. Actions Demo

vim .gitea/workflows/demo.yaml

name: Gitea Actions Demo
run-name: ${{ gitea.actor }} is testing out Gitea Actions 🚀
on: [push]
  
jobs:
 Explore-Gitea-Actions:
 runs-on: ubuntu-latest
 steps:
 - run: echo "🎉 The job was automatically triggered by a ${{ gitea.event_name }} event."
 - run: echo "🐧 This job is now running on a ${{ runner.os }} server hosted by Gitea!"
 - run: echo "🔎 The name of your branch is ${{ gitea.ref }} and your repository is ${{ gitea.repository }}."
 - name: Check out repository code
 uses: actions/checkout@v3
 - run: echo "💡 The ${{ gitea.repository }} repository has been cloned to the runner."
 - run: echo "🖥️ The workflow is now ready to test your code on the runner."
 - name: List files in the repository
 run: |
 ls ${{ gitea.workspace }}
 - run: echo "🍏 This job's status is ${{ job.status }}."

参考文档：

Mariadb 二进制版安装与配置

Wed, 05 Mar 2025 00:00:00 +0800

一、准备工作

1.1. 下载 Mariadb

根据系统选择相应版本版本，然后下载解压。

下载地址：https://downloads.mariadb.org/

wget https://mirrors.xtom.com.hk/mariadb//mariadb-11.4.5/bintar-linux-systemd-x86_64/mariadb-11.4.5-linux-systemd-x86_64.tar.gz
sudo tar zxf mariadb-11.4.5-linux-systemd-x86_64.tar.gz -C /usr/local/src
sudo ln -s /usr/local/src/mariadb-11.4.5-linux-systemd-x86_64 /usr/local/mysql

1.2. 安装依赖

# On Ubuntu/Debian:
sudo apt -y install build-essential libaio-dev
sudo apt -y install libncurses5

# On Fedora/RHEL/CentOS:
yum -y install libaio-devel numactl-libs (centos)
dnf -y install ncurses-devel (centos8)
ln -s /usr/lib64/libncurses.so.6 /usr/lib64/libncurses.so.5
ln -s /usr/lib64/libtinfo.so.6 /usr/lib64/libtinfo.so.5

1.3. 新增用户和组

# On Ubuntu/Debian:
sudo addgroup --system --gid 36 mysql
sudo adduser \
    --system \
    --home /var/lib/mysql \
    --shell /bin/false \
    --uid 36 \
    --gecos 'MariaDB Server' \
    --gid 36 \
    --disabled-password \
    mysql

# On Fedora/RHEL/CentOS:
sudo groupadd --system mysql
sudo adduser \
   --system \
   --shell /bin/bash \
   --comment 'MariaDB server' \
   --gid mysql \
   --home-dir /var/lib/mysql \
   --create-home \
   mysql

1.4. 创建工作目录

# 日志目录
sudo mkdir /var/log/mariadb && \
sudo chown mysql:mysql /var/log/mariadb

# 安全目录
sudo mkdir /var/lib/mysql-files && \
sudo chown mysql:mysql /var/lib/mysql-files && \
sudo chmod 750 /var/lib/mysql-files

二、配置文件

2.1. 主配置文件

Configuring MariaDB with Option Files

sudo mkdir -p /etc/mysql/conf.d
sudo vim /etc/mysql/my.cnf

sudo sh -c "cat > /etc/mysql/my.cnf" <<EOF
#
# This group is read both by the client and the server
#
[client-server]
port=3306
socket=/tmp/mysql.sock

#
# include all files from the config directory
#
!includedir /etc/mysql/conf.d/
EOF

2.2. 客户端配置文件

sudo vim /etc/mysql/conf.d/client.cnf

sudo sh -c "cat > /etc/mysql/conf.d/client.cnf" <<EOF
#
# These two groups are read by the client library
# Use it for options that affect all clients, but not the server
#
[client]
default-character-set = utf8mb4

#
# This group is not read by mysql client library,
#
[client-mariadb]
EOF

2.3. 服务端配置文件

sudo vim /etc/mysql/conf.d/server.cnf

sudo sh -c "cat > /etc/mysql/conf.d/server.cnf" <<EOF
#
# This groups are read by MariaDB server.
# Use it for options that only the server (but not clients)
#
[server]

#
# This group is read both by the MariaDB Server and MySQL Server.
#
[mysqld]

# Basic Settings
datadir=/var/lib/mysql
bind-address=0.0.0.0
pid-file=/var/lib/mysql/mariadb.pid

# Character Settings
character-set-server=utf8mb4
character-set-filesystem=utf8mb4
collation-server=utf8mb4_general_ci

# InnoDB Settings
# innodb_buffer_pool_size=6G

# Connection settings
# max_connections=500

#
# This group is only read by MariaDB servers, not by MySQL.
#
[mariadb]
server_id=1

# Error Log
log_error=/var/log/mariadb/error.log
aria_log_dir_path=/var/log/mariadb

# General Query Log
general_log=0
general_log_file=/var/log/mariadb/general_query.log

# Binary Log

log-bin=/var/log/mariadb/master-bin
log-bin-index=/var/log/mariadb/master-bin.index
binlog-format=mixed
#binlog-do-db=mydb
#binlog-ignore-db=test
expire-logs-days=3

# Slow Query Log
slow_query_log=1
slow_query_log_file=/var/log/mariadb/slow_query.log
long_query_time=5.0
log_queries_not_using_indexes=0

# MariaDB Audit Plugin
#https://mariadb.com/kb/en/mariadb-audit-plugin-options-and-system-variables
plugin-load=server_audit=server_audit.so
server_audit=FORCE_PLUS_PERMANENT
server_audit_events=CONNECT,QUERY,TABLE
server_audit_logging=ON
server_audit_file_rotate_size=20M
server_audit_file_rotations=10
server_audit_file_path=/var/log/mariadb/audit.log
EOF

三、安装启动

3.1. 初始化数据目录

cd /usr/local/mysql
sudo ./scripts/mariadb-install-db --user=mysql

3.2. 开机自启动

方法1： systemd

sudo cp support-files/systemd/mariadb.service /usr/lib/systemd/system/mariadb.service
sudo systemctl daemon-reload
sudo systemctl enable --now mariadb.service
sudo systemctl disable mariadb.service

方法2：不推荐

sudo cp support-files/mysql.server /etc/init.d/mysql
sudo chkconfig mysql on
sudo service mysql start

方法3：手动启动

export PATH=$PATH:/usr/local/mysql/bin/
echo 'export PATH=$PATH:/usr/local/mysql/bin/' >> ~/.bashrc
mysqld_safe --user=mysql &

三、设置 MariaDB

3.1. 初始化设置

MariaDB 10.4+ 以后，root 帐号认证机制已经变更，详见官网说明：

Authentication in MariaDB 10.4 — Understanding the Changes

mysql 帐号登录：

# root@localhost 和 mysql@localhost 均是系统自动创建的账号
sudo mysql #root
mysql #mysql

如果报错 sudo: mysql: command not found 请检查 sudo 配置是否开启了 secure_path

sudo visudo

# 注释以下内容
Defaults secure_path="......"

不想使用 unix_socke 方式登陆？设置 root 密码：

ALTER USER root@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD("verysecret");

MariaDB 10.4 以前版本继续使用以下方法设置root密码：

/usr/local/mysql/bin/mysqladmin -u root -h 'hosts-name' password 'verysecret'
/usr/local/mysql/bin/mysql_secure_installation

3.2. 开启远程登录

sudo mysql
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY 'verysecret' WITH GRANT OPTION;
FLUSH PRIVILEGES;

3.3. 创建数据库、用户、授权

# 创建数据库
CREATE DATABASE mydb CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;

# 创建用户
CREATE USER 'myuser'@'localhost' IDENTIFIED BY 'mypasswd';

# 授权
GRANT ALL ON mydb.* TO 'myuser'@'localhost';

# 刷新生效
FLUSH PRIVILEGES;

3.4. 数据备份

导出为SQL文件

mysqldump -u root -p --opt [database name] > [database name].sql

迁移至另一台主机

mysqldump -u root -pPassword --all-databases | ssh user@new_host.host.com 'cat - | mysql -u root -pPassword'

加密sql文件

zip --encrypt dump.zip db.sql
unzip -P your-password dump.zip

导入SQL文件

mysql -u root -p newdatabase < /path/to/newdatabase.sql

3.5. 其他

错误修复

mysqlcheck --all-databases --check-upgrade --auto-repair
mysql_upgrade -uroot -p --force

官方文档：

Installing MariaDB Binary Tarballs

Server System Variables

Configuring MariaDB with Option Files

MySQL 二进制版安装与配置

Wed, 05 Mar 2025 00:00:00 +0800

一、准备工作

1.1. 下载 MySQL

根据系统选择相应版本版本，然后下载解压。

下载地址：https://dev.mysql.com/downloads/mysql/

wget https://dev.mysql.com/get/Downloads/MySQL-8.4/mysql-8.4.5-linux-glibc2.28-x86_64.tar.xz && \
sudo tar xvf mysql-8.4.5-linux-glibc2.28-x86_64.tar.xz -C /usr/local/src && \
sudo ln -s /usr/local/src/mysql-8.4.5-linux-glibc2.28-x86_64 /usr/local/mysql && \
export PATH=/usr/local/mysql/bin:$PATH

1.2. 安装 libaio 依赖

# On Debian:
sudo apt install -y libaio1 libnuma-dev libncurses-dev

# On Ubuntu:
sudo apt install -y libaio-dev libnuma-dev libncurses-dev
cd /usr/lib/x86_64-linux-gnu/
sudo ln -s libaio.so.1t64.0.2 libaio.so.1

1.3. 新增用户和组

# On Ubuntu/Debian:
sudo addgroup --system --gid 36 mysql && \
sudo adduser \
    --system \
    --home /var/lib/mysql \
    --shell /bin/false \
    --uid 36 \
    --gecos 'MySQL Server' \
    --gid 36 \
    --disabled-password \
    mysql

# On Fedora/RHEL/CentOS:
sudo groupadd --system mysql && \
sudo adduser \
   --system \
   --shell /bin/bash \
   --comment 'MariaDB server' \
   --gid mysql \
   --home-dir /var/lib/mysql \
   --create-home \
   mysql

1.4. 创建工作目录

日志目录

sudo mkdir /var/log/mysql && \
sudo chown mysql:mysql /var/log/mysql

安全目录

sudo mkdir /var/lib/mysql-files && \
sudo chown mysql:mysql /var/lib/mysql-files && \
sudo chmod 750 /var/lib/mysql-files

pid 文件目录

sudo mkdir /var/run/mysqld/ && \
sudo chown mysql:mysql /var/run/mysqld/

配置文件目录

sudo mkdir -p /etc/mysql/conf.d/ && \
sudo chown -R mysql:mysql /etc/mysql/

二、配置文件

2.1. 主配置文件

sudo sh -c "cat > /etc/mysql/my.cnf" <<EOF
# The MySQL database server configuration file.
#
# You can copy this to one of:
# - "/etc/mysql/my.cnf" to set global options,
# - "~/.my.cnf" to set user-specific options.
#
# For explanations see
# http://dev.mysql.com/doc/mysql/en/server-system-variables.html

# * IMPORTANT: Additional settings that can override those from this file!
#   The files must end with '.cnf', otherwise they'll be ignored.

!includedir /etc/mysql/conf.d/
EOF

2.2. 客户端配置文件

sudo sh -c "cat > /etc/mysql/conf.d/client.cnf" <<EOF
# The MySQL database client configuration file
#
# Ref to https://dev.mysql.com/doc/refman/en/mysql-command-options.html

[mysql]
default-character-set=utf8mb4
socket=/var/run/mysqld/mysqld.sock
EOF

2.3. 服务端配置文件

sudo sh -c "cat > /etc/mysql/conf.d/server.cnf" <<EOF
# The MySQL database server configuration file.
#
# For explanations see
# http://dev.mysql.com/doc/mysql/en/server-system-variables.html

# Here is entries for some specific programs
# The following values assume you have at least 8G ram

[mysqld]

# Basic Settings
user=mysql
bind-address=0.0.0.0
mysqlx-bind-address=0.0.0.0
port=3306
pid-file=/var/run/mysqld/mysqld.pid
socket=/var/run/mysqld/mysqld.sock
datadir=/var/lib/mysql
secure_file_priv=/var/lib/mysql-files
local_infile=OFF

# Character Settings
character-set-server=utf8mb4
character-set-filesystem=utf8mb4
collation-server=utf8mb4_general_ci

# InnoDB Settings
innodb_buffer_pool_size=2G

# Connection settings
max_connections=300

# Error Log
log_error=/var/log/mysql/error.log
log_error_verbosity=2

# General Query Log
general_log=0
general_log_file=/var/log/mysql/general_query.log

# Binary Log
log-bin=/var/log/mysql/mysql-bin
log-bin-index=/var/log/mysql/mysql-bin.index
binlog-do-db=mysql
binlog-ignore-db=test
binlog_expire_logs_seconds=604800
binlog_expire_logs_auto_purge=1
max_binlog_size=1G

# Slow Query Log
slow_query_log=1
slow_query_log_file=/var/log/mysql/slow_query.log
long_query_time=5.0
log_slow_admin_statements=1
log_queries_not_using_indexes=0
EOF

三、安装启动

3.1. 初始化数据目录

# 指定配置文件初始化
sudo /usr/local/mysql/bin/mysqld --defaults-file=/etc/mysql/my.cnf --initialize

# 不指定配置文件初始化
sudo /usr/local/mysql/bin/mysqld --initialize --user=mysql \
  --basedir=/usr/local/mysql \
  --datadir=/var/lib/mysql

3.2. 数据目录权限设置

sudo chmod 750 /var/lib/mysql && \
sudo chown mysql:mysql /var/lib/mysql

3.3. 使用 systemd 启动服务器

sudo vim /usr/lib/systemd/system/mysql.service

[Unit]
Description=MySQL Server
Documentation=man:mysqld(8)
Documentation=http://dev.mysql.com/doc/refman/en/using-systemd.html
After=network.target
After=syslog.target

[Install]
WantedBy=multi-user.target

[Service]
User=mysql
Group=mysql

# Have mysqld write its state to the systemd notify socket
Type=notify

# Disable service start and stop timeout logic of systemd for mysqld service.
TimeoutSec=0

# Start main service
ExecStart=/usr/local/mysql/bin/mysqld --defaults-file=/etc/mysql/my.cnf $MYSQLD_OPTS 

# Use this to switch malloc implementation
EnvironmentFile=/etc/sysconfig/mysql

# Sets open_files_limit
LimitNOFILE = 10000

Restart=on-failure

RestartPreventExitStatus=1

# Set environment variable MYSQLD_PARENT_PID. This is required for restart.
Environment=MYSQLD_PARENT_PID=1

PrivateTmp=false

sudo mkdir /etc/sysconfig/ && \
sudo vim /etc/sysconfig/mysql

TZ=Asia/Shanghai
NO_INIT=true

开启自启动

sudo systemctl daemon-reload
sudo systemctl enable --now mysql.service
sudo systemctl disable mysql.service
systemctl status mysql
journalctl -u mysql.service

四、常用命令

4.1. 重置 root 密码

初始化后，mysql 会生成临时密码,可通过 sudo cat /var/log/mysql/error.log | grep password 获得。

# 更改当前账号密码
mysql -u root -p
ALTER USER USER() IDENTIFIED BY 'password';

# 更改指定用户密码
ALTER USER 'myuser'@'localhost'
  IDENTIFIED BY 'password';

4.2. 开启远程连接

UPDATE mysql.user SET Host='%' WHERE Host='localhost' AND User='root';
FLUSH PRIVILEGES;
SELECT DISTINCT Host,User FROM mysql.user;

4.3. 创建数据库、用户、授权

# 创建数据库
CREATE DATABASE mydb CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;

# 创建用户
CREATE USER 'myuser'@'localhost' IDENTIFIED BY 'mypasswd';

# 授权
GRANT ALL ON mydb.* TO 'myuser'@'localhost';

# 刷新生效
FLUSH PRIVILEGES;

4.4. 数据库导入导出

mysqldump -u myuser -p mydb > mydb.sql
mysql -u myuser -p mydb < /var/lib/mysql-files/mydb.sql

参考文档：

GnuPG 安装与使用

Sat, 09 Nov 2024 00:00:00 +0800

1. 关于 GPG

1.1. GPG 是什么?

GnuPG，即 GNU Privacy Guard (GPG) 是一个密码学软件，用于加密、签名内容及管理非对称密钥。

GPG 的核心是 GPG 密钥对，分为公钥和私钥。在密码学技术上，GPG 可以使用若干不同的加密算法来向外提供加密解密服务。

1.2. KEYID 是什么？

KEYID 就是你的 GPG Key 指纹的缩短版：

Long Fingerprint 的末尾 16 位数字
Short Fingerprint 的末尾 8 位数字

在很多命令中，--keyid-format [none|short|0xshort|long|0xlong] 可以决定 KEYID 的显示格式。

1.3. USER-ID 是什么？

USER-ID 通常是指你为邮箱地址所关联的姓名字段，有时候也指所关联的注释文本。

2. 安装 GPG

2.1. macOS

https://gpgtools.org

2.2. windows

https://gpg4win.org/download.html

2.3. Linux

gpg --version # 查看是否安装
sudo apt-get install -y gnupg
sudo yum install -y gnupg

3. GPG 密钥管理

3.1. 生成 GPG 密钥对

gpg --full-generate-key

gpg 密钥是与 email 绑定的，它是一个身份证明。
算法建议选择默认值 RSA，其用途是完整的。
密钥强度首选 4096 bits。
建议生成一个不过期的根密钥，然后再建立若干子密钥，用于不同的用途。

3.2. 列出密钥

# 列出公钥和指纹
gpg --list-keys --keyid-format=short

# 列出私钥和指纹
gpg --list-secret-keys -keyid-format=short

参数 --keyid-format 可以指定长度。

3.3. 列出指纹

gpg --fingerprint me@wangyan.org

3.4. 生成子密钥

gpg --expert --edit-key 2E0E8722
gpg> addkey

3.5. 删除密钥

# 删除公钥
gpg --delete-key [USER-ID or KEYID]

# 删除私钥
gpg --delete-secret-key [USER-ID or KEYID]

3.6. 导出密钥

# 导出公钥
gpg --armor --output user.gpg.public.asc --export MASTER-KEYID

# 导出私钥
gpg --armor --output user.gpg.private.key.asc --export-secret-keys MASTER-KEYID

# 不导出子密钥
gpg --armor --output user.gpg.private.key.asc --export-secret-keys MASTER-KEYID!

# 导出指定子密钥
gpg --armor --output 2E0E8722.pub.asc --export 2E0E8722

默认导出主密钥的同时，将会连同其全部子密钥一起导出
根据非对称密钥体系原理，导出私钥就代表着同时也导出了公钥，因为私钥能够推导出公钥。
使用子密钥的公钥KEYID，可以指定导出子密钥

3.7. 导入密钥

gpg --import user.gpg.public.pem
gpg --import user.gpg.private.key

3.8. 信任密钥

重新导入密钥后会显示未知，因此需要信任。

gpg --edit-key user@useremail.com
gpg> trust
gpg> 5
gpg> save

导出信任文件：gpg --export-ownertrust > file.txt

3.9. 分发公钥

一旦密钥创建就绪，你就可以将其发表到 GPG 公共服务器，其他人通过指纹或者邮箱地址能够检索到你的公钥。

# 默认发布到 hkps://keys.openpgp.org 服务器
gpg --send-keys 2E0E8722

# 发布到指定服务器
gpg  --keyserver hkps://keyserver.ubuntu.com --send-keys 2E0E8722

3.10. 检索公钥

# 检索默认服务器
gpg --search-keys 70B152332E0E8722
gpg --auto-key-locate keyserver --locate-keys no-reply@wangyan.org

# 检索指定服务器
gpg --keyserver hkps://keyserver.ubuntu.com --search-keys 70B152332E0E8722
gpg --keyserver hkps://keyserver.ubuntu.com --search-keys no-reply@wangyan.org

3.11. 接收他人的公钥

# 使用 Long-KEYID 从指定服务器接收
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 70B152332E0E8722

3.12. 签名他人公钥

接收他的公钥

gpg -recv-keys 70B152332E0E8722
签名这个公钥

gpg –ask-cert-level –sign-key no-reply@wangyan.org
签名后导出

#使用他的公钥加密签名再导出 gpg -a –export no-reply@wangyan.org | gpg -se -r no-reply@wangyan.org > no-reply@wangyan.org.asc.pgp
接收方解密并导入

gpg –decrypt no-reply@wangyan.org.asc.pgp > no-reply@wangyan.org.asc gpg –import no-reply@wangyan.org.asc
发布新公钥到服务器

gpg –send-keys no-reply@wangyan.org.

4. GPG 文件操作

4.1. 加解与解密

4.1.1. 加密

gpg -e -r 2E0E8722 original.file

-e, --encrypt 加密数据
-r, --recipient 为 USER-ID 加密
加密后默认生成一个新文件 original.file.gpg

4.1.2. 解密

gpg -d -r 2E0E8722 original.file.gp

-d, --decrypt 解密数据

4.2. 签名与验证

4.2.1. 签名且加密

gpg -u 2E0E8722 -s original.file

-u, --local-user 使用 USER-ID 来签名或者解密
-s, --sign 生成一份签名
这会生成一个加密文件 original.file.gpg，同时它也是被签名的。
发给他人，只需分发加密文件，无需附带原始文件。

4.2.2. 只签名不加密

gpg -u 2E0E8722 -a -b -s original.file

-a, --armor 创建 ASCII 字符封装的输出
-b, --detach-sign 生成一份分离的签名
签名后生成一个纯文本的签名文件 original.file.asc。
发给他人，需要和原始文件一同分发。

4.2.3. 只签名不加密，且使用明文签名

gpg -u 2E0E8722 --clear-sign original.file

--clear-sign 生成一份明文签名
区别在于包含了原始文件的内容，无需和原始文件一同分发。

4.2.4. 验证

gpg -u 2E0E8722 --verify original.file.gpg
gpg -u 2E0E8722 --verify original.file.asc

5. GPG 吊销操作

一旦发布到 keyserver 上，你的 GPG Key 就不能被真正删除了。

对于失效的、过时的、可能已经泄漏的密钥，你要使用吊销功能。

5.1. 生成吊销证书

gpg --output revoke.asc --gen-revoke key-ID

5.2. 导入吊销证书

gpg --import revoke.asc

注意：吊销并不删除密钥本身，它是标记该密钥被作废了

5.3. 撤销密钥服务器上的密钥

gpg --keyserver hkps://keys.openpgp.org --send-keys key-ID

已标记作废的密钥会被发送到服务器

6. Git 配置

git config --global gpg.program gpg
git config --global commit.gpgsign true
git config user.name wangyan
git config user.email no-reply@wangyan.org
git config user.signingkey 2E0E8722
git commit -S -m your commit message

参考文档：

https://hedzr.com/security/gpg/gpg-short-guide/

使用 Oh My Posh 设置自定义提示符

Sat, 09 Nov 2024 00:00:00 +0800

1. 安装 Nerd Font

自定义命令提示符通常使用字形来设置样式，若要在终端中查看所有字形，则需要安装 Nerd Font。

Nerd Font 是带图标的字库，能够从 Font Awesome、Devicons、Octicons 等图标库中添加了大量额外的字形。

# 从列表选择
oh-my-posh font install

# 直接安装 MesloLGM Nerd 字体
oh-my-posh font install meslo

LGM 代表标准间距大小， Mono 用于终端，Propo 用于GUI界面，

2. 安装 Oh My Posh

2.1. 安装 Oh My Posh for PowerShell

# 自动安装
# https://github.com/JanDeDobbeleer/oh-my-posh/releases/
winget install JanDeDobbeleer.OhMyPosh -s winget

# 手动添加环境变量
$env:Path += ";C:\Users\user\AppData\Local\Programs\oh-my-posh\bin"

2.2. 安装 Oh My Posh for WSL

curl -s https://ohmyposh.dev/install.sh | bash -s

3. 选择并应用 Oh My Posh 主题

可在 Oh My Posh 主题页面浏览主题的完整列表。

3.1. 应用 PowerShell 提示符主题

首先，修改 PowerShell 执行策略，将 PowerShell 执行策略设置为不受限制。

Get-ExecutionPolicy -List # list
set-ExecutionPolicy -ExecutionPolicy Unrestricted # add
Set-ExecutionPolicy -ExecutionPolicy Undefined -Scope LocalMachine # remove

选择主题，并更新 PowerShell 配置文件。

# 首次运行，创建配置文件
new-item -type file -path $profile -force

# 编辑
# C:\Users\WangYan\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
code $PROFILE

# 设置主题
# 将 jandedobbeleer 替换为你选择的主题。
oh-my-posh init pwsh --config "$env:POSH_THEMES_PATH\jandedobbeleer.omp.json" | Invoke-Expression

3.2. 应用 WSL 提示符主题

修改配置文件 .profile 应用主题

cat >> ~/.profile << EOF
eval "$(oh-my-posh init bash --config /home/wangyan/.cache/oh-my-posh/themes/jandedobbeleer.omp.json)"
EOF

cat >> ~/.zshrc << EOF
eval "$(oh-my-posh init zsh --config /home/wangyan/.cache/oh-my-posh/themes/jandedobbeleer.omp.json)"
EOF

参考文档：

使用 Oh My Posh 为 PowerShell 或 WSL 设置自定义提示符

MariaDB 常用 SQL 语句

Thu, 07 Nov 2024 00:00:00 +0800

一、MariaDB 账户管理

1.1. 查询在线用户

SHOW processlist;
mysqladmin -u admin -p processlist

1.2. 查询全部用户

SELECT DISTINCT User,Host,Password,plugin FROM mysql.user;

1.3. 创建普通用户

CREATE USER 'wangyan'@'%' IDENTIFIED BY 'xxx';
GRANT ALL PRIVILEGES ON wangyan\_%.* TO 'wangyan'@'%' IDENTIFIED BY 'xxx';

1.4. 删除普通用户

DROP USER 'wangyan'@'%';
DELETE FROM mysql.user WHERE host = '%' AND user = 'wangyan';

1.5. 修改用户密码

SET PASSWORD=PASSWORD("xxx");
SET PASSWORD for "wangyan"@"%"=PASSWORD("xxx");
ALTER USER 'root'@'localhost' IDENTIFIED BY 'xxx';

1.6. ROOT密码找回

vim /etc/my.cnf.d/server.cnf
在Mysqld区域添加skip-grant-table语句，重启
sudo mysql -u root -p #免密码登陆数据库
UPDATE mysql.user SET password = password('123') WHERE user = 'root';
修改完成后将skip-grant-table属性去掉

二、MariaDB 权限管理

2.1. 查询所有权限

SHOW GRANTS FOR wangyan; #查询指定用户权限
SHOW GRANTS FOR 'wangyan'@'%';
FLUSH PRIVILEGES;

2.2. 收回用户授权

REVOKE ALL ON . FROM 'wangyan'@'%';
FLUSH PRIVILEGES;

2.3. 快速创建数据库和用户

DROP USER IF EXISTS 'wangyan'@'%';
DROP DATABASE IF EXISTS wangyan_gitea;
CREATE DATABASE wangyan_gitea CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;

三、MariaDB 数据操作

3.1. 导入导出

mysqldump  -u wangyan -p databasename > databasename.sql
mysql -u wangyan -p databasename < /var/lib/mysql-files/databasename.sql

MariaDB 从 Yum 源安装与配置

Thu, 07 Nov 2024 00:00:00 +0800

一、安装 MariaDB

https://lug.ustc.edu.cn/wiki/mirrors/help/mariadb

1.1. 添加 MariaDB Yum 源

方法一：官方一键设置脚本（推荐）

curl -sS https://downloads.mariadb.com/MariaDB/mariadb_repo_setup | bash

方法二：命令行工具

使用 MariaDB Repository Configuration Tool 生成一份配置，保存为 /etc/yum.repos.d/mariadb.repo

cat >/etc/yum.repos.d/mariadb.repo<<'EOF'
[mariadb]
name = MariaDB
baseurl = http://yum.mariadb.org/10.4/centos8-amd64
module_hotfixes=1
gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB
gpgcheck=1
EOF

然后执行以下命令替换源地址：

sudo sed -i 's#yum\.mariadb\.org#mirrors.ustc.edu.cn/mariadb/yum#' /etc/yum.repos.d/mariadb.repo
# 建议使用 HTTPS
sudo sed -i 's#http://mirrors\.ustc\.edu\.cn#https://mirrors.ustc.edu.cn#g' /etc/yum.repos.d/mariadb.repo

sudo dnf install MariaDB-server
sudo systemctl start mariadb

1.2. 安装 MariaDB

sudo yum install -y MariaDB-server MariaDB-client MariaDB-shared
sudo apt-get install mariadb-server mariadb-client MariaDB-shared

RHEL 8

yum module install mariadb -y
rpm -qi mariadb-server
systemctl enable --now mariadb

MariaDB MaxScale:（选做）

sudo yum install maxscale
sudo apt-get install maxscale

Percona XtraBackup:

sudo yum install percona-xtrabackup
sudo apt-get install percona-xtrabackup

cracklib_password_check:

https://mariadb.com/kb/en/cracklib-password-check-plugin/

sudo yum install MariaDB-cracklib-password-check

1.3. 启动 MariaDB

sudo systemctl start mariadb
sudo systemctl enable mariadb

二、设置 MariaDB

2.1. 初始化

mysql_secure_installation

初始密码为空，直接回车。
设置 root 密码
是否移除匿名用户
是否禁止 root 远程登录
是否删除 ’test’ 测试数据库

2.2. 解决 MariaDB 中文乱码

https://mariadb.com/kb/en/mariadb/setting-character-sets-and-collations/

/etc/my.cnf

[client]
...
default-character-set = utf8mb4
...
[mysql]
...
default-character-set = utf8mb4

...
[mysqld]
...
character-set-server  = utf8mb4
character-set-filesystem = utf8mb4
collation-server      = utf8mb4_general_ci
...

2.3. 完整配置文件

vim /etc/my.cnf

cat >/etc/my.cnf<<'EOF'
#
# This group is read both by the client and the server
#
[client-server]
port=3306
socket=/dev/shm/mysql.sock

#
# include all files from the config directory
#
!includedir /etc/my.cnf.d
EOF

vim /etc/my.cnf.d/client.cnf

cat >/etc/my.cnf.d/client.cnf<<'EOF'
#
# These two groups are read by the client library
# Use it for options that affect all clients, but not the server
#
[client]
default-character-set = utf8mb4

#
# This group is not read by mysql client library,
#
[client-mariadb]
EOF

/etc/my.cnf.d/mariadb-server.cnf

#
# These groups are read by MariaDB server.
# Use it for options that only the server (but not clients) should see
#
# See the examples of server my.cnf files in /usr/share/mysql/
#

# this is read by the standalone daemon and embedded servers
[server]

# this is only for the mysqld standalone daemon
# Settings user and group are ignored when systemd is used.
# If you need to run mysqld under a different user or group,
# customize your systemd unit file for mysqld/mariadb according to the
# instructions in http://fedoraproject.org/wiki/Systemd
[mysqld]
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
log-error=/var/log/mariadb/mariadb.log
pid-file=/run/mariadb/mariadb.pid
character-set-server=utf8mb4
character-set-system=utf8mb4
character-set-filesystem=utf8mb4
collation-server=utf8mb4_general_ci

#
# * Galera-related settings
#
[galera]
# Mandatory settings
#wsrep_on=ON
#wsrep_provider=
#wsrep_cluster_address=
#binlog_format=row
#default_storage_engine=InnoDB
#innodb_autoinc_lock_mode=2
#
# Allow server to accept connections on all interfaces.
#
#bind-address=0.0.0.0
#
# Optional setting
#wsrep_slave_threads=1
#innodb_flush_log_at_trx_commit=0

# this is only for embedded server
[embedded]

# This group is only read by MariaDB servers, not by MySQL.
# If you use the same .cnf file for MySQL and MariaDB,
# you can put MariaDB-only options here
[mariadb]

# This group is only read by MariaDB-10.3 servers.
# If you use the same .cnf file for MariaDB of different versions,
# use this group for options that older servers don't understand
[mariadb-10.3]

/etc/my.cnf.d/mysql-clients.cnf

#
# These groups are read by MariaDB command-line tools
# Use it for options that affect only one utility
#

[mysql]
default-character-set=utf8mb4

[mysql_upgrade]

[mysqladmin]

[mysqlbinlog]

[mysqlcheck]

[mysqldump]

[mysqlimport]

[mysqlshow]

[mysqlslap]

/etc/my.cnf.d/auth_gssapi.cnf

[mariadb]
plugin-load-add=auth_gssapi.so

/etc/my.cnf.d/enable_encryption.preset

#
# !include this file into your my.cnf (or any of *.cnf files in /etc/my.cnf.d)
# and it will enable data at rest encryption. This is a simple way to
# ensure that everything that can be encrypted will be and your
# data will not leak unencrypted.
#
# DO NOT EDIT THIS FILE! On MariaDB upgrades it might be replaced with a
# newer version and your edits will be lost. Instead, add your edits
# to the .cnf file after the !include directive.
#
# NOTE that you also need to install an encryption plugin for the encryption
# to work. See https://mariadb.com/kb/en/mariadb/data-at-rest-encryption/#encryption-key-management
#
[mariadb]
aria-encrypt-tables
encrypt-binlog
encrypt-tmp-disk-tables
encrypt-tmp-files
loose-innodb-encrypt-log
loose-innodb-encrypt-tables

三、测试 MariaDB

mysqladmin -u root -p version

查看效果

mysql -uroot -p
SHOW VARIABLES WHERE Variable_name LIKE 'character\_set\_%' OR Variable_name LIKE 'collation%';

参考配置文件：/usr/share/mysql/
数据文件夹：/var/lib/mysql/
执行文件：/usr/bin/mysql

参考文档：

Mariadb 启用 TLS 安全连接

Thu, 07 Nov 2024 00:00:00 +0800

一、概述

默认情况下，MariaDB 在服务器和客户端之间传输数据时不加密。当服务器和客户端运行在同一主机上保证处于安全的网络中时，这通常是可以接受的。然而，如果服务器和客户端位于不同的网络上或者位于高风险网络中，缺乏加密确实会带来安全问题，因为恶意行为者可能会窃听通过服务器和客户端之间的网络发送的流量。

为了减轻这种担忧，MariaDB 允许您使用传输层安全 (TLS) 协议对服务器和客户端之间传输的数据进行加密。 TLS 以前称为安全套接字层 (SSL)，但严格来说，SSL 协议是 TLS 的前身，该版本的协议现在被认为是不安全的。MariaDB 文档仍然使用 SSL 术语表述，是出于兼容性原因，但实际上，MariaDB 仅支持 TLS。

二、创建自签署证书

OpenSSL 自签署证书生成

生成服务器证书和客户端证书

# 初始化
git clone https://code.wangyan.cloud//wangyan/gen-ssl-cert.git /tmp/gen-ssl-cert
cd /tmp/gen-ssl-cert
make init

# 根证书
make gen-ca-key
make gen-ca-csr
make gen-ca-cert

# 中间证书
make gen-ica-key
make gen-ica-csr
make gen-ica-cert
make gen-ica-chain

# 服务器证书
make gen-server-key
make gen-server-csr
make gen-server-cert

# 客户端证书
make gen-client-key
make gen-client-csr
make gen-client-cert
make gen-client-pkcs12

准备证书文件

#准备目录
sudo mkdir /etc/my.cnf.d/certificates && \
sudo chmod 777 /etc/my.cnf.d/certificates && \
sudo chmod o+t /etc/my.cnf.d/certificates

# 服务端证书
cp /tmp/gen-ssl-cert/ica/certs/ica-chain-cert.crt /etc/my.cnf.d/certificates/ca.pem && \
cp /tmp/gen-ssl-cert/ica/certs/server-cert.crt /etc/my.cnf.d/certificates/server-cert.pem && \
cp /tmp/gen-ssl-cert/ica/private/server-key.pem /etc/my.cnf.d/certificates/server-key.pem

# 客户端证书
cp /tmp/gen-ssl-cert/ica/certs/client-cert.crt /etc/my.cnf.d/certificates/client-cert.pem && \
cp /tmp/gen-ssl-cert/ica/private/client-key.pem /etc/my.cnf.d/certificates/client-key.pem

# 修改权限
sudo chown mysql:mysql -R /etc/my.cnf.d/certificates/

二、MariaDB 服务端启用 TLS

ssl_cert 设置服务器的 X509 证书的路径。

ssl_key 设置服务器私钥的路径。

ssl_ca 设置证书颁发机构 (CA) 链的路径，用来验证服务器证书。

sudo sh -c "cat >/etc/my.cnf.d/enable_tls.cnf" <<EOF
[mariadb]
# Use Secure Connections to transfer data
ssl_ca = /etc/my.cnf.d/certificates/ca.pem
ssl_cert = /etc/my.cnf.d/certificates/server-cert.pem
ssl_key = /etc/my.cnf.d/certificates/server-key.pem
EOF

重启 & 检查

# 重启
sudo systemctl restart mariadb

# 动态刷新证书，可不用重启
FLUSH SSL

# 检查 TLS 是否已启用
SHOW GLOBAL VARIABLES LIKE 'have_ssl';
SHOW SESSION STATUS LIKE 'Ssl_cipher';

三、MariaDB 客户端启用 TLS

3.1. 什么是证书验证？

服务端证书验证

客户端根据证书中的某些属性检查服务器的主机名和 IP 地址来验证服务器证书。对于大多数客户端，默认情况下禁用服务器证书验证，并且仅在指定选项（例如ssl-verify-server-cert指定）时才启用它。
为了验证服务器的证书，客户端和实用程序将根据服务器的主机名和 IP 地址检查位于证书主题字段中的通用名称 (CN)属性。如果公用名 (CN)与其中任何一个匹配，则证书通过验证。
使用主题备用名称 (SAN) 也叫 subjectAltName 进行服务器证书验证。当使用支持使用 subjectAltName 字段进行服务器证书验证的客户端时，如果服务器证书包含任何 subjectAltName 字段，则还将根据服务器的主机名和 IP 地址检查这些字段。

客户端证书验证

服务器通过SUBJECT根据客户端证书中的主题属性检查客户端的已知信息来验证客户端证书。

3.2. 双向 TLS

双向 TLS 意味着客户端和服务器都提供私钥和 X509 证书，客户端和服务器都要验证彼此身份。

即客户端要对服务端证书进行验证。同时，服务端也要对客户端的证书进行验证。

（1）通过配置文件：

sudo sh -c "cat >>/etc/my.cnf.d/enable_tls.cnf" <<EOF

[client-mariadb]
ssl_cert = /etc/my.cnf.d/certificates/client-cert.pem
ssl_key = /etc/my.cnf.d/certificates/client-key.pem
ssl_ca = /etc/my.cnf.d/certificates/ca.pem
ssl-verify-server-cert
EOF

（2）通过命令行：

mariadb -u myuser -p -h myserver.mydomain.com \
   --ssl-cert=/etc/my.cnf.d/certificates/client-cert.pem \
   --ssl-key=/etc/my.cnf.d/certificates/client-key.pem \
   --ssl-ca=/etc/my.cnf.d/certificates/ca.pem \
   --ssl-verify-server-cert

3.3. 单向 TLS

当在没有客户端证书的情况下使用 TLS 时，称为单向 TLS，因为只有服务器提供私钥和 X509 证书，因此只能在一个方向进行身份验证。然而，双向加密仍然是可能的。服务器证书验证是指客户端验证证书是否属于服务器。

（1）通过配置文件：

[client-mariadb]
...
ssl_ca = /etc/my.cnf.d/certificates/ca.pem
ssl-verify-server-cert

（2）通过命令行：

mariadb -u myuser -p -h myserver.mydomain.com \
   --ssl-ca=/etc/my.cnf.d/certificates/ca.pem \
   --ssl-verify-server-cert

3.4. 双向 vs 单向

不管是双向还是单向，都要对服务器证书进行验证。区别在于单向没有指定客户端证书，因此，服务器不能验证客户端，但客户端都能验证服务端。

当然了，还有一种情况是，启用了单向 TLS，但是也不验证服务器证书

方法如下：

（1）通过配置文件：

[client-mariadb]
...
ssl

（2）通过命令行：

mariadb -u myuser -p -h myserver.mydomain.com \
   --ssl

四、强制使用 TLS

4.1. 特定用户帐户使用 TLS

您可以为特定用户帐户设置 TLS 相关的限制，例如，需要访问敏感数据的用户帐户。可以使用 CREATE USER、ALTER USER 或 GRANT 语句为用户帐户启用这些限制。

(1) 必须通过 TLS 连接

ALTER USER 'alice'@'%' 
   REQUIRE SSL;

(2) 必须通过 TLS 且是有效的客户端证书

ALTER USER 'alice'@'%' 
   REQUIRE X509;

(3) 必须通过 TLS 且是特定的客户端证书

ALTER USER 'alice'@'%' 
   REQUIRE SUBJECT '/CN=alice/O=My Dom, Inc./C=US/ST=Oregon/L=Portland';

4.2 特定主机的特定帐户使用 TLS

CREATE USER 'alice'@'localhost' 
   REQUIRE NONE;

CREATE USER 'alice'@'%'
   REQUIRE SUBJECT '/CN=alice/O=My Dom, Inc./C=US/ST=Oregon/L=Portland'
   AND ISSUER '/C=FI/ST=Somewhere/L=City/ O=Some Company/CN=Peter Parker/emailAddress=p.parker@marvel.com'
   AND CIPHER 'ECDHE-ECDSA-AES256-SHA384';

# 初始化
git clone https://code.wangyan.cloud//wangyan/gen-ssl-cert.git /tmp/gen-ssl-cert

参考文档

Secure Connections Overview

Securing Connections for Client and Server

Connecting to MariaDB

Mariadb 日志审计与密码插件

Thu, 07 Nov 2024 00:00:00 +0800

一、启用日志

1.1. 错误日志

Error Log

# /etc/my.cnf.d/mariadb-logs.cnf
[mariadb]
......
# Error Log
log_error=/var/log/mariadb/error.log
log_warnings=3

日志详细程度：0-9，默认值为 2

1.2. 通用查询日志

General Query Log

通用查询日志是从客户端接收到的每个 SQL 查询以及每个客户端连接和断开连接的日志。由于它是服务器收到的每个查询的记录，因此它可能会很快变大。

但是，如果您只想记录更改数据的查询，那么最好使用二进制日志。一个重要的区别是，二进制日志仅在服务器提交事务时记录查询，而通用查询日志在服务器接收到查询后立即记录查询。

# /etc/my.cnf.d/mariadb-logs.cnf
[mariadb]
......
# General Query Log
general_log
log_output=FILE
general_log_file=/var/log/mariadb/queries.log
log_disabled_statements='slave,sp'

1.3. 二进制日志

Binary Log

二进制日志包含对数据库的所有更改（数据和结构）以及每个语句执行所需时间的记录。它由一组二进制日志文件和一个索引组成。

这意味着诸如 CREATE、ALTER、INSERT、UPDATE 和 DELETE 之类的语句将被记录，但对数据没有影响的语句（如 SELECT 和 SHOW ）将不会被记录。如果您想记录这些（以性能为代价），请使用通用查询日志。

# /etc/my.cnf.d/mariadb-logs.cnf
[mariadb]
# Binary Log
# datadir/log-basename-bin
log_bin=ON
log_basename=mariadb
binlog_format=mixed
expire_logs_days=90
max_binlog_size=512M
max_binlog_total_size=5G
--binlog-ignore-db=database_name

1.4. 清除二进制日志

PURGE BINARY LOGS

# 列出所有日志
SHOW BINARY LOGS;

# 查看正在读取的文件
SHOW SLAVE STATUS;

# 删除所有二进制日志文件
RESET MASTER;

# 清除到指定位置
PURGE BINARY LOGS TO 'mariadb-bin.000057';

# 清除指定日期之前的
PURGE BINARY LOGS BEFORE '2019-04-02 22:46:26';

# 清除3天前的日志
#SELECT DATE_SUB(CURRENT_DATE, INTERVAL 3 DAY);
PURGE MASTER LOGS BEFORE DATE_SUB(CURRENT_DATE, INTERVAL 3 DAY);
PURGE BINARY LOGS BEFORE DATE_SUB(CURRENT_DATE, INTERVAL 3 DAY);

1.5. 慢查询日志

Slow Query Log

慢查询日志是执行时间较长的 SQL 查询的记录。

请注意，如果您的查询包含用户的密码，则慢查询日志也可能包含密码。因此，应该对其进行保护。

# /etc/my.cnf.d/mariadb-logs.cnf
[mariadb]
......
## Slow Query Log
log_output=FILE
slow_query_log
slow_query_log_file=/var/log/mariadb/slow.log
long_query_time=5.0
log_queries_not_using_indexes=ON
log_slow_admin_statements=ON
log_slow_rate_limit=10

long_query_time 定义慢速查询的时间
log_queries_not_using_indexes 记录不使用索引的查询
log_slow_admin_statements 记录缓慢的管理语句
log_slow_rate_limit 限制每10次慢查询才记录一次

二、轮换日志

2.1. Logrotate

2.1.1. 身份验证

使用 MariaDB 进行身份验证的最简单方法是将用户帐户配置 root@localhost 为使用 unix_socket 身份验证。

在MariaDB 10.4及更高版本不许设置

ALTER USER 'root'@'localhost' IDENTIFIED VIA unix_socket;

2.1.2. 配置文件

/etc/logrotate.conf
/etc/logrotate.d/

$ sudo tee /etc/logrotate.d/mariadb <<EOF
/var/log/mysql/* {
        su mysql mysql
        missingok
        create 660 mysql mysql
        notifempty
        daily
        minsize 1M
        maxsize 100M
        rotate 30
        dateext
        dateformat .%Y-%m-%d-%H-%M-%S
        compress
        delaycompress
        sharedscripts 
        olddir archive/
        createolddir 770 mysql mysql # only use with logrotate >= 3.8.9
    postrotate
        # just if mysqld is really running
        if test -x /usr/local/mysql/bin/mysqladmin && \
           /usr/local/mysql/bin/mariadb-admin ping &>/dev/null
        then
           /usr/local/mysql/bin/mariadb-admin --local flush-error-log \
              flush-engine-log flush-general-log flush-slow-log
        fi
    endscript
}
EOF

重要参数：

daily：每天轮换每个日志文件一次。
minsize 1M：该指令将其配置为在日志轮转期间跳过小于 1 MB 的日志文件。
maxsize 100M：此指令将其配置为在日志文件增长超过 100 MB 时比每天更频繁地轮换日志文件。
rotate 30：该指令将其配置为保留每个日志文件的 30 个旧副本。
dateext：该指令将其配置为使用日期作为扩展名，而不仅仅是数字。
olddir archive/：该指令将其配置为将轮换日志文件存档在/var/log/mariadb/archive/.

2.2. Journal

systemd-journal 是一个改进型的日志管理服务。

常见用法如下：

# 查看文件情况
du -h --max-depth=1 /var/log

# 日志总体磁盘占用情况
journalctl --disk-usage

# 硬性指定日志总体体积，删除超出部分
journalctl --vacuum-size=10M

# 只保留近一周的日志
journalctl --vacuum-time=1w

# 直接删除 /var/log/journal/ 目录下的日志文件
rm -rf /var/log/journal/f9d400c5e1e8c3a8209e990d887d4ac1

三、启用审计

3.1. 查看当前开启审计

show variables like '%audit%';

如果没有，则先查看审计插件目录

SHOW VARIABLES LIKE 'plugin_dir';

3.2. 启用审计

具体参数详见官方文档：

MariaDB Audit Plugin Options and System Variables

# /etc/my.cnf.d/server-audit.cnf

[mariadb]
## MariaDB Audit Plugin
server_audit_events=CONNECT,QUERY,TABLE,QUERY_DDL,QUERY_DML,QUERY_DCL,QUERY_DML_NO_SELECT
server_audit_file_path=/var/log/mariadb/server_audit.log
server_audit_file_rotate_size=100M
server_audit_file_rotations=10
server_audit_logging=ON
server_audit_output_type=file
server_audit=FORCE_PLUS_PERMANENT

3.3. 重启

sudo systemctl restart mariadb

四、密码插件

Password Validation Plugin API

4.1. simple_password_check

Simple Password Check Plugin

# /etc/my.cnf.d/simple_password_check.cnf
[mariadb]
# Password Validation
plugin_load_add = simple_password_check.so
simple_password_check_digits=1
simple_password_check_letters_same_case=1
simple_password_check_minimal_length=8
simple_password_check_other_characters=1

4.2. cracklib_password_check

Cracklib Password Check Plugin

sudo yum install MariaDB-cracklib-password-check
sudo apt-get install mariadb-plugin-cracklib-password-check

安装

[mariadb]
...
plugin_load_add = cracklib_password_check

Tailscale 安装部署教程

Thu, 07 Nov 2024 00:00:00 +0800

1. 安装 Tailscale 控制服务器

1.1. 下载 headscale 二进制文件

官方文档：https://headscale.net/running-headscale-linux

最新版本：https://github.com/juanfont/headscale/releases

加速工具：https://mirror.ghproxy.com/

# 下载
wget https://github.com/juanfont/headscale/releases/download/v0.23.0/headscale_0.23.0_linux_amd64  -O /usr/local/bin/headscale

# 增加可执行权限
chmod +x /usr/local/bin/headscale

1.2. 创建 headscale 用户

useradd \
  --create-home \
  --home-dir /var/lib/headscale/ \
  --system \
  --user-group \
  --shell /usr/sbin/nologin \
  headscale

1.3. 创建数据存储目录

# 配置文件目录
mkdir -p /etc/headscale

# 数据存储与证书目录
mkdir -p /var/lib/headscale /var/run/headscale
   
# 创建空的 SQLite 数据库文件：
touch /var/lib/headscale/db.sqlite

# 权限
chown -R headscale:headscale /var/lib/headscale /etc/headscale

1.4. 创建配置文件

wget https://mirror.ghproxy.com/https://github.com/juanfont/headscale/raw/main/config-example.yaml -O /etc/headscale/config.yaml
chown -R headscale:headscale /var/lib/headscale /etc/headscale

# 根据自身情况修改
vim /etc/headscale/config.yaml
server_url: https://headscale.wangyan.cloud/
listen_addr: 127.0.0.1:8181
base_domain: wangyan.cloud/

1.5. Nginx 反向代理配置

选做，需将上面 server_url 改成 ip+端口 的形式。

server {
    listen               443 ssl;
    listen               [::]:443 ssl;
    http2                on;
    server_name          headscale.wangyan.cloud/;

    # SSL
    ssl_certificate      /etc/nginx/ssl-certs/wangyan.cloud/_ecc/fullchain.cer;
    ssl_certificate_key  /etc/nginx/ssl-certs/wangyan.cloud/_ecc/wangyan.cloud/.key;

    # logging
    access_log           /var/log/nginx/wangyan.cloud//headscale-access.log combined buffer=512k flush=1m;
    error_log            /var/log/nginx/wangyan.cloud//headscale-error.log warn;

    # reverse proxy
    location / {
        proxy_pass       http://localhost:8181;
        proxy_set_header Host $host;
        include          nginx-config/proxy.conf;
    }
}

1.6. 系统自启动文件

sudo sh -c "cat >/etc/systemd/system/headscale.service" <<EOF
[Unit]
Description=headscale controller
After=syslog.target
After=network.target

[Service]
Type=simple
User=headscale
Group=headscale
ExecStart=/usr/local/bin/headscale serve
Restart=always
RestartSec=5

# Optional security enhancements
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/headscale
AmbientCapabilities=CAP_NET_BIND_SERVICE
RuntimeDirectory=headscale

[Install]
WantedBy=multi-user.target
EOF

1.7. 启动 && 卸载

# 启动
systemctl daemon-reload
systemctl enable --now headscale
systemctl restart headscale

# 卸载
systemctl stop headscale
rm -rf /var/lib/headscale /etc/headscale /var/run/headscale

#查看占用端口
systemctl status headscale
ss -tulnp|grep headscale

1.8. 使用 Headscale 创建用户

headscale user create admin
headscale user list
headscale user destroy admin

2. 安装 Tailscale 客户端

稳定版：https://pkgs.tailscale.com/stable/

最新版：https://pkgs.tailscale.com/unstable/

2.1. 安装 linux 客户端

2.1.1. 安装

wget https://pkgs.tailscale.com/unstable/tailscale_1.77.67_amd64.tgz
tar -zxf tailscale_*.tgz
cd tailscale_*_amd64
cp tailscaled /usr/sbin/tailscaled
cp tailscale /usr/bin/tailscale

2.1.2. 启动

cp systemd/tailscaled.service /lib/systemd/system/tailscaled.service
cp systemd/tailscaled.defaults /etc/default/tailscaled
systemctl enable --now tailscaled
systemctl status tailscaled
systemctl restart tailscaled

2.1.3. 卸载

systemctl stop tailscaled
rm -rf /var/lib/tailscale/

# 彻底删除
systemctl disable tailscaled
rm -rf /usr/sbin/tailscaled /usr/bin/tailscale 
rm -rf /lib/systemd/system/tailscaled.service
rm -rf /etc/default/tailscaled

2.2. 安装 windows 客户端

安装完毕后，打开 https://headscale.wangyan.cloud//windows

按照提示下载注册表文件，最后再登陆。

# 下载
wget https://pkgs.tailscale.com/unstable/tailscale-setup-full-1.77.67.exe

# 登陆
tailscale login --login-server https://headscale.wangyan.cloud/

# 进阶设置
# tailscale up --login-server=https://headscale.wangyan.cloud/ --advertise-routes=192.168.57.0/24 --accept-dns=false --accept-routes

2.3. 注册 tailscale 节点

2.3.1. 方法1：正常登录

在客户端机上，运行 tailscale 登录命令：

# 无需开启子网路由
tailscale up --login-server https://headscale.wangyan.cloud/

# 需要开启子网路由的情况
tailscale up \
 --accept-routes \
 --advertise-routes=192.168.10.0/24 \
 --login-server=https://headscale.wangyan.cloud/

会生成如下链接：https://headscale.wangyan.cloud/:443/register/mkey:xxx ，复制到浏览器。

然后，在 Tailscale 控制服务器上注册节点

headscale nodes register --user admin --key mkey:xxx
headscale nodes list #列出节点
headscale nodes delete  -i 1 #删除指定节点
headscale nodes rename android -i 3 # 重命名

2.3.2. 方法2：使用预认证密钥注册机器

适用于移动客户端，不方便登录等情形。

# 生成密钥
headscale --user admin preauthkeys create --reusable --expiration 24h

# 注册
tailscale up --login-server=https://headscale.wangyan.cloud/ --authkey <YOUR_AUTH_KEY>

2.4. 客户端开启子网路由

官方文档： Subnet routers and traffic relay nodes

Install the Tailscale client.
Connect to Tailscale as a subnet router.
Enable subnet routes from the admin console.
Add access rules for advertised subnet routes.
Verify your connection.
Use your subnet routes from other devices.

2.4.1. 开启 IP 转发

echo 'net.ipv4.ip_forward = 1' | tee -a /etc/sysctl.d/ipforwarding.conf
echo 'net.ipv6.conf.all.forwarding = 1' | tee -a /etc/sysctl.d/ipforwarding.conf
sysctl -p /etc/sysctl.d/ipforwarding.conf

使用 firewalld 防火墙的系统，需打开 masquerade

firewall-cmd --permanent --add-masquerade

使用 iptables 系统，可以查看路由情况

iptables -S
iptables -S -t nat

2.4.2. 指定子网地址

tailscale up --advertise-routes=192.168.0.0/24,192.168.1.0/24 #设置
tailscale set --advertise-routes "192.168.10.0/24" #修改

2.4.3. 批准子网路由

# 在控制服务器查看子网路由开启情况
headscale routes list
# 删除路由
headscale routes delete -r 1
#批准指定网段
headscale routes enable -r 1

2.4.4. 测试

tailscale status
tailscale netcheck
tailscale ping 192.168.10.100

3. 部署私有 DERP 中继服务器

3.1. 中继服务器配置

vim docker-compose.yml 不需要特殊权限，可以直接 docker compose up -d 启动

项目网址：https://hub.docker.com/r/sparanoid/derp

services:
  derp:
    image: sparanoid/derp:edge
    container_name: derp
    hostname: derp
    volumes:
      - /var/run/tailscale/tailscaled.sock:/var/run/tailscale/tailscaled.sock
    ports:
      - "8282:80"
      - "3478:3478/udp"
    command: derper -a :80 -verify-clients true

然后，配置Ngixn反向代理vim derp.wangyan.cloud/.conf

server {
    listen               443 ssl;
    listen               [::]:443 ssl;
    http2                on;
    server_name          derp.wangyan.cloud/;

    # SSL
    ssl_certificate      /etc/nginx/ssl-certs/wangyan.cloud/_ecc/fullchain.cer;
    ssl_certificate_key  /etc/nginx/ssl-certs/wangyan.cloud/_ecc/wangyan.cloud/.key;

    # logging
    access_log           /var/log/nginx/wangyan.cloud//derp-access.log combined buffer=512k flush=1m;
    error_log            /var/log/nginx/wangyan.cloud//derp-error.log warn;

    # reverse proxy
    location / {
        proxy_pass       http://localhost:8282;
        proxy_set_header Host $host;
        include          nginx-config/proxy.conf;
    }
}

3.2. 控制服务器配置

vim /etc/headscale/derp.yaml

regions:
  901:
    regionid: 901
    regioncode: DERP
    regionname: "Custom DERP"
    nodes:
      - name: vps-tc-gz
        regionid: 901
        hostname: derp.wangyan.cloud/
        stunport: 3478
        stunonly: false
        derpport: 443

vim /etc/headscale/config.yaml

# 删除掉官方derp服务器
urls: []
# 自定义配置文件
 paths:
    - /etc/headscale/derp.yaml

启动 && 检查

systemctl restart headscale
tailscale netcheck

3.3. DERP 启用 TLS 支持

3.3.1. 修改 DERP 配置

开启 verify-clients true 客户端验证，需要确保 tailscale 已经正常启动。

这里有个巨坑：请务必确保先启动 headscale 和 tailscale 后，再启动 derp 容器

# /docker-compose.yml
services:
  derp:
    image: sparanoid/derp:edge
    restart: always
    init: true
    container_name: derp
    hostname: derp
    ports:
      - "8383:80"
      - "8443:443"
      - "3478:3478/udp"
    volumes:
      - /etc/nginx/ssl-certs/wangyan.cloud/_ecc/fullchain.cer:/app/certs/derp.wangyan.cloud/.crt
      - /etc/nginx/ssl-certs/wangyan.cloud/_ecc/wangyan.cloud/.key:/app/certs/derp.wangyan.cloud/.key
      - /var/run/tailscale/tailscaled.sock:/var/run/tailscale/tailscaled.sock
    command: sh -c "
      derper \
        -hostname derp.wangyan.cloud/ \
        -certdir /app/certs \
        -certmode manual \
        -verify-clients true"

tailscaled 没启动是很多错误出现的原因，可通过下面命令验证：

curl --unix-socket /var/run/tailscale/tailscaled.sock "http://local-tailscaled.sock/localapi/v0/whois?addr=nodekey%3Axxx"

3.3.2. 修改 Nginx 配置

location / {
  proxy_pass       https://127.0.0.1:8443;
  proxy_set_header Host $host;
}

4. 开启 headscale 远程控制

远程控制需要开启 remote CLI 功能，这里面有个坑是必须开启 headscale 服务器内置的 tls 支持，通过 nginx 反代实现的 ssl 是不行的。

4.1. 通过 Remote CLI 远控

官方文档：https://headscale.net/remote-cli/

4.1.1. 启用 TLS

vim /etc/headscale/config.yaml

要使用自定义证书，只填写以下两个选项，其他勿填。

tls_cert_path: "/etc/nginx/ssl-certs/wangyan.cloud/_ecc/fullchain.cer"
tls_key_path: "/etc/nginx/ssl-certs/wangyan.cloud/_ecc/wangyan.cloud/.key"

需要ACME申请证书，可以填写以下选项：

tls_letsencrypt_hostname: ""
tls_letsencrypt_listen: ":http"
tls_letsencrypt_cache_dir: ".cache"
tls_letsencrypt_challenge_type: HTTP-01

4.1.2. 启用 gRPC

# 不要使用 127.0.0.1
grpc_listen_addr: 0.0.0.0:50443
# 可以保持 false 不变
grpc_allow_insecure: false

4.1.3. 创建 API key

# 创建
headscale apikeys create --expiration 180d
# 列表
headscale apikeys list
# 吊销
headscale apikeys expire --prefix "<PREFIX>"

4.1.4. 设置环境变量

# 执行权限
chmod +x /usr/local/bin/headscale

# 设置环境变量
# 特别注意：这里没有 https://
export HEADSCALE_CLI_ADDRESS="headscale.wangyan.cloud/:50443"
export HEADSCALE_CLI_API_KEY="<API KEY FROM PREVIOUS STAGE>"

# 测试
headscale nodes list

4.2. 通过 UI 面板远控

项目地址：https://github.com/GoodiesHQ/headscale-admin

4.2.1. docker-compose.yml

services:
  headscale-admin:
    image: goodieshq/headscale-admin:dev
    container_name: headscale-admin
    ports:
        - "0.0.0.0:8282:80"
    restart: always

4.2.2. Nginx

这里有一个坑，api url 不是填写上面的gRPC API地址，而是带 https 的 server_url

请先确保访问 https://headscale.wangyan.cloud//api/api/v1/apikey 不会报错

location  / {
        proxy_pass       https://127.0.0.1:8181;
        proxy_set_header Host $host;
        include          nginx-config/proxy.conf;
    }

    location /admin {
        proxy_pass       http://127.0.0.1:8282;
        proxy_set_header Host $host;
        include          nginx-config/proxy.conf;
    }

Laravel 5 开发知乎笔记

Fri, 01 Sep 2017 00:00:00 +0800

第一章基础设置

1.1 开发环境

OS： macOS High Sierra 10.13
Homestead: 6.5
Vagrant box: parallels 4.0.0
Laravel 5.5
PHP 7.1.10 , MySQL 5.7.19 , Nginx 1.13.3

1.2 配置国内软件源

Composer

composer config -g repo.packagist composer https://packagist.laravel-china.org

NodeJS

# 推荐使用 yarn 
yarn config set registry https://registry.npm.taobao.org --global && \
yarn config set disturl https://npm.taobao.org/dist --global && \
yarn config set sass-binary-site https://npm.taobao.org/mirrors/node-sass

# 二选一
npm config set registry https://registry.npm.taobao.org --global && \
npm config set disturl https://npm.taobao.org/dist --global && \
npm config set sass-binary-site https://npm.taobao.org/mirrors/node-sass

# 查看效果
yarn config list

Ubuntu 16.04

sed -i 's/archive.ubuntu.com/mirrors.163.com/g' /etc/apt/sources.list && \
sed -i 's/deb http:\/\/security/#deb http:\/\/security/g' /etc/apt/sources.list && \
sed -i 's/deb-src http:\/\/security/#deb-src http:\/\/security/g' /etc/apt/sources.list && \
apt-get -y update

1.3 创建 Laravel 项目

# 创建项目
composer create-project --prefer-dist laravel/laravel zhihu "5.5.*"

# 更新依赖库
yarn install && \
composer update && \
composer dump-autoload 

# 其他参考命令
yarn install --no-bin-links (windows)
yarn install --force （重构某个包）
npm rebuild node-sass

# 导入 Git 配置文件
cat .gitconfig > ~/.gitconfig
git config --global --edit

1.4 更改 User 模型位置

将 User.php 放置到 app/Models/ 文件夹，命名空间改成：

namespace App\Models;

修改 auth.php 配置文件：

<?php
// config\auth.php
    'providers' => [
        'users' => [
            'driver' => 'eloquent',
            'model' => App\Models\User::class,
        ],
    ],

1.5 数据库 User 表设计

文档：《Laravel 的数据库迁移 Migrations》

设计 User 表结构

<?php
// database/migrations/2014_10_12_000000_create_users_table.php

    public function up()
    {
        Schema::create('users', function (Blueprint $table) {
            $table->increments('id');
            $table->string('name')->unique();
            $table->string('email')->unique();
            $table->string('password');
            $table->string('avatar');
            $table->string('confirmation_token');
            $table->smallInteger('is_active')->default(0);
            $table->string('questions_count')->default(0);
            $table->string('answers_count')->default(0);
            $table->string('comments_count')->default(0);
            $table->string('favorites_count')->default(0);
            $table->string('likes_count')->default(0);
            $table->string('followers_count')->default(0);
            $table->string('following_count')->default(0);
            $table->json('settings')->nullable();
            $table->rememberToken();
            $table->timestamps();
        });
    }

修改 .env 配置信息

运行数据库迁移

php artisan migrate

第二章用户注册后发送验证邮件

2.1 阿里云邮件推送服务

修改 composer.json 然后 composer update

"require": {
    "wang_yan/directmail": "dev-master"
},

或者在项目目录下执行

composer require wang_yan/directmail:dev-master

然后修改 config/app.php，添加服务提供者

<?php
'providers' => [
   // 添加这行
    WangYan\DirectMail\DirectMailTransportProvider::class,
];

最后在 .env 中配置你的密钥，并修改邮件驱动为 directmail

MAIL_DRIVER=directmail

DIRECT_MAIL_KEY=     # AccessKeyId
DIRECT_MAIL_SECRET=  # AccessSecret

2.2 发送注册验证邮件

初始化 Laravel 认证模块

php artisan make:auth

修改 RegisterController 控制器

<?php 
// app\Http\Controllers\Auth\RegisterController.php

    use App\Models\User;
    use Illuminate\Support\Facades\Mail;

    protected function create(array $data)
    {
        $user =  User::create([
            'name' => $data['name'],
            'email' => $data['email'],
            'avatar' => 'default.jpg',
            'confirmation_token' => str_random(40),
            'password' => bcrypt($data['password']),
        ]);

        $this->sendVerifyEmailTo($user);
        return $user;
    }

    private function sendVerifyEmailTo($user)
    {
        $data = [
            'name' => $user->name,
            'url'  => Route('email.verify',['token' => $user->confirmation_token])
        ];

        Mail::send('emails.register', $data, function ($message) use ($user) {
            $message->from('service@dm.mail.wangyan.org', env('APP_NAME','Laravel'));
            $message->to($user->email);
            $message->subject('请验证您的 Email 地址');
        });
    }

修改 User 模型

<?php 
// app\Models\User.php
    protected $fillable = [
        'name', 'email', 'password', 'avatar', 'confirmation_token',
    ];

增加邮件模板

vim resources\views\emails\register.blade.php

增加路由

<?php
// routes\web.php
Route::get('/email/verify/{token}', 'EmailController@verify')->name('email.verify');

增加控制器

php artisan make:controller EmailController

编辑控制器

<?php
// app\Http\Controllers\EmailController.php
use App\Models\User;

class EmailController extends Controller
{
    /**
     * @param $token
     * @return \Illuminate\Http\RedirectResponse|\Illuminate\Routing\Redirector
     */
    function verify($token)
    {
        $user = User::where('confirmation_token',$token)->first();

        if(is_null($user)){
            return redirect('/');
        }

        $user->is_active = 1;

        $user->confirmation_token= str_random(40);
        $user->save();

        return redirect('/home');
    }
}

2.3 Sendcloud 邮件服务

修改 composer.json 然后 composer update

"require": {
    "naux/sendcloud": "^1.1",
},

或者在项目目录下执行

composer require naux/sendcloud

修改 config/app.php，添加服务提供者

<?php
'providers' => [
   // 添加这行
    Naux\Mail\SendCloudServiceProvider::class,
];

在 .env 中配置你的密钥，并修改邮件驱动为 sendcloud

MAIL_DRIVER=sendcloud

SEND_CLOUD_USER=   # 创建的 api_user
SEND_CLOUD_KEY=    # 分配的 api_key

第三章用户注册与登录消息提示

3.1 引入 `laracasts/flash` 包

这个包的作用是将消息提示放到 session 中

项目：《Easy Flash Messages for Laravel App》

用法：

flash('Message')->success(): success 样式
flash('Message')->error(): error 样式
flash('Message')->warning(): warning 样式
flash('Message')->overlay(): 弹窗
flash()->overlay('Modal Message', 'Modal Title'): 有标题的弹窗
flash('Message')->important(): 有关闭按钮
flash('Message')->error()->important(): 可以关闭的错误提示

修改 composer.json 然后 composer update

"require": {
    "laracasts/flash": "^3.0"
},

或者在项目目录下执行

composer require laracasts/flash

新增服务提供者

<?php
// config\app.php
'providers' => [
    Laracasts\Flash\FlashServiceProvider::class,
];

修改 EmailController 控制器

<?php
// app\Http\Controllers\EmailController.php
    function verify($token)
    {
        $user = User::where('confirmation_token',$token)->first();

        if(is_null($user)){
            // Render the message as an overlay.
            flash()->overlay('邮箱验证失败！', '温馨提示');
            return redirect('/');
        }

        $user->is_active = 1;

        $user->confirmation_token= str_random(40);
        $user->save();

        flash('邮箱验证成功！')->success()->important();
        return redirect('/home');
    }

修改 HomeController 控制器

<?php
// app\Http\Controllers\HomeController.php
    public function index()
    {
        flash('登入成功！')->success()->important();
        return view('home');
    }

修改视图模板

<?php
// 使用到 overlay() 弹窗时引入
// resources\views\layouts\app.blade.php
    <script>
        $('#flash-overlay-modal').modal();
    </script>

<?php
// 在显示消息的位置引入
// resources\views\home.blade.php
<div class="panel-body">
    @include('flash::message')
</div>

<?php
// resources\views\welcome.blade.php
// 将下面代码放在适当位置
<link href="https://cdn.bootcss.com/bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet">

@include('flash::message')

<script src="https://cdn.bootcss.com/jquery/3.2.1/jquery.min.js"></script>
<script src="https://cdn.bootcss.com/bootstrap/3.3.7/js/bootstrap.min.js"></script>
<script>
    $('#flash-overlay-modal').modal();
</script>

3.2 设置帐号未激活不能登录

<?php
// app\Http\Controllers\Auth\LoginController.php
use Illuminate\Http\Request;

protected function attemptLogin(Request $request)
{
    $credentials = array_merge($this->credentials($request),['is_active' => '1']);
    return $this->guard()->attempt(
        $credentials,$request->has('remember')
    );
}

第四章视图文件汉化、增加中文语言包

4.1 简体中文语言包

汉化默认视图文件
将Google字体换成中科大源
增加 cmn-Hans 简体中文语言包

4.2 更新前端资源

项目：《Laravel 资源任务编译器 Laravel Mix》

/* resources/assets/sass/app.scss */
@import url(https://fonts.lug.ustc.edu.cn/css?family=Raleway:300,400,600);

编译

yarn run production

其他详细过程，略

第五章实现找回密码

详细原理（略），可从 app\Http\Controllers\Auth\ForgotPasswordController.php 开始理解

<?php
// app\Models\User.php
use Illuminate\Support\Facades\Mail;

public function sendPasswordResetNotification($token)
{
    $data = [
        'title' => env('APP_NAME','Laravel'),
        'name'  => $this->name,
        'url'   => url('password/reset',$token)
    ];
    Mail::send('emails.reset', $data, function ($message) {
        $message->from('service@sc.mail.wangyan.org', env('APP_NAME','Laravel'));
        $message->to($this->email);
        $message->subject('重设密码');
    });
}

增加邮件模板

vim resources\views\emails\reset.blade.php

第六章设计问题表

文档：Laravel 的数据库迁移 Migrations

创建 Model 的同时，生成 migration 迁移文件

# 注意双反斜杆
php artisan make:model Models\\Question -m

修改 migrate，设计表结构

<?php
// database/migrations/create_questions_table.php
    public function up()
    {
        Schema::create('questions', function (Blueprint $table) {
            $table->increments('id');
            $table->string('title');
            $table->string('body');
            $table->integer('user_id')->unsigned();
            $table->integer('comments_count')->default(0);
            $table->integer('followers_count')->default(0);
            $table->integer('answers_count')->default(0);
            $table->string('close_comment',8)->default('F');
            $table->string('is_hidden',8)->default('F');
            $table->timestamps();
        });
    }

运行迁移

php artisan migrate

第七章发布问题

7.1 安装 UEditor 编辑器

修改 composer.json 然后 composer update

"require": {
    "overtrue/laravel-ueditor": "~1.0"
},

或者在项目目录下执行

composer require "overtrue/laravel-ueditor:~1.0"

添加下面一行到 config/app.php 中 providers 部分

Overtrue\LaravelUEditor\UEditorServiceProvider::class,

发布配置文件与资源

php artisan vendor:publish --provider='Overtrue\LaravelUEditor\UEditorServiceProvider'

附件存储（需要以管理员身份允许终端）

文档：Laravel 的文件系统和云存储功能集成

php artisan storage:link

7.2 发布问题

创建 QuestionsController 控制器

项目：《Laravel 的 HTTP 控制器》

php artisan make:controller QuestionsController --resource

定义 questions 资源路由

<?php
// routes/web.php
Route::resource('questions','QuestionsController');

修改 QuestionsController 控制器

<?php
// app\Http\Controllers\QuestionsController.php
    use App\Models\Question;
    use Illuminate\Support\Facades\Auth;

    // 首页显示所有问题
    public function index()
    {
        $questions = Question::all();
        return $questions;
    }
 
    // 返回创建问题视图
    public function create()
    {
        return view('questions.create');
    }

    // 保存问题，然后返回该问题视图
    public function store(Request $request)
    {
        $data = [
            'title' => $request->get('title'),
            'body' => $request->get('body'),
            'user_id' => Auth::id() // 获取登陆用户 ID
        ];
        $question = Question::create($data); // 保存问题
        return redirect()->route('questions.show',$question->id); // 重定向
    }

    // 返回问题视图
    public function show($id)
    {
        $question = Question::findOrfail($id);
        return view('questions.show',compact('question'));
    }

修改 Question 模型中的 fillable

<?php
// app\Models\Question.php
class Question extends Model
{
    protected $fillable = ['title','body','user_id'];
}

新建「创建问题」视图文件

<?php
//resources\views\questions\create.blade.php
@extends('layouts.app')

@section('content')
    @include('vendor.ueditor.assets')
    <div class="container">
        <div class="row">
            <div class="col-md-8 col-md-offset-2">
                <div class="panel panel-default">
                    <div class="panel-heading">发布问题</div>
                    <div class="panel-body">
                        @include('flash::message')
                        <form action="/questions" method="post">
                            {!! csrf_field() !!}
                            <div class="form-group">
                                <label for="title">标题</label>
                                <input type="text" name="title" class="form-control" placeholder="标题" class="title">
                            </div>
                            <script id="container" name="body" type="text/plain"></script><br>
                            <button type="submit" class="btn btn-block btn-success pull-right">发布问题</button>
                        </form>
                    </div>
                    <script type="text/javascript">
                        var ue = UE.getEditor('container');
                        ue.ready(function() {
                            ue.execCommand('serverparam', '_token', '{{ csrf_token() }}');
                        });
                    </script>
                </div>
            </div>
        </div>
    </div>
@endsection

提交后问题后显示的页面

<?php
//resources\views\questions\show.blade.php
@extends('layouts.app')

@section('content')
    <div class="container">
        <div class="row">
            <div class="col-md-8 col-md-offset-2">
                <div class="panel panel-default">
                    <div class="panel-heading">{{$question->title}}</div>
                    <div class="panel-body">
                        {!! $question->body !!}
                    </div>
                </div>
            </div>
        </div>
    </div>
@endsection

第八章问题表单字段验证

文档：《Laravel 的表单验证机制详解》

8.1 方法一：快速验证

将验证逻辑直接写到控制器中，使用 Illuminate\Http\Request 对象提供的 validate 方法进行验证。

<?php
// app\Http\Controllers\QuestionsController.php
    public function store(Request $request)
    {
        $rules = [
            'title' => 'required|min:6|max:128',
            'body' => 'required|min:12',
        ];
        $messages = [
            'title.required' => '标题不能为空',
            'title.min' => '标题长度至少要6个字符',
            'title.max' => '标题最长不能超过128个字符',
            'body.required' => '内容不能为空',
            'body.min' => '内容至少要有12个字符',
        ];
        $this->validate($request,$rules,$messages);
        $data = [
            'title' => $request->get('title'),
            'body' => $request->get('body'),
            'user_id' => Auth::id()
        ];
        $question = Question::create($data);
        return redirect()->route('questions.show',$question->id);
    }

编辑视图文件

<?php
// resources\views\questions\create.blade.php
@extends('layouts.app')

@section('content')
    @include('vendor.ueditor.assets')
    <div class="container">
        <div class="row">
            <div class="col-md-8 col-md-offset-2">
                <div class="panel panel-default">
                    <div class="panel-heading">发布问题</div>
                    <div class="panel-body">
                        @include('flash::message')
                        <form action="/questions" method="post">
                            {!! csrf_field() !!}
                            <div class="form-group{{ $errors->has('title') ? ' has-error' : '' }}">
                                <label for="title">标题</label>
                                <input type="text" name="title" class="form-control" placeholder="标题" value="{{ old('title') }}" required autofocus>
                                @if ($errors->has('title'))
                                    <span class="help-block">
                                        <strong>{{ $errors->first('title') }}</strong>
                                    </span>
                                @endif
                            </div>
                            <div class="form-group{{ $errors->has('body') ? ' has-error' : '' }}">
                                <script id="container" name="body" type="text/plain">
                                    {!! old('title') !!}
                                </script><br>
                                @if ($errors->has('body'))
                                    <span class="help-block">
                                        <strong>{{ $errors->first('body') }}</strong>
                                    </span>
                                @endif
                            </div>
                            <button type="submit" class="btn btn-block btn-success pull-right">发布问题</button>
                        </form>
                    </div>
                    <script type="text/javascript">
                        var ue = UE.getEditor('container');
                        ue.ready(function() {
                            ue.execCommand('serverparam', '_token', '{{ csrf_token() }}');
                        });
                    </script>
                </div>
            </div>
        </div>
    </div>
@endsection

8.2 方法二：表单请求验证

使用 Artisan 命令 make:request 创建表单请求类来处理更复杂的验证。

php artisan make:request StoreQuestionRequest

添加验证规则到 rules 方法中

注意：表单请求类内也包含了 authorize 方法，用来判断用户是否有权限做出此请求。

<?php
namespace App\Http\Requests;
use Illuminate\Foundation\Http\FormRequest;
class StoreQuestionRequest extends FormRequest
{
    // 如果你打算在其他地方处理授权逻辑，这里返回 true
    public function authorize()
    {
        return true;
    }

    // 规则
    public function rules()
    {
        return [
            'title' => 'required|min:6|max:128',
            'body' => 'required|min:12',
        ];
    }

    // 自定义错误消息
    public function messages()
    {
        return [
            'title.required' => '标题不能为空',
            'title.min' => '标题长度至少要6个字符',
            'title.max' => '标题最长不能超过128个字符',
            'body.required' => '内容不能为空',
            'body.min' => '内容至少要有12个字符',
        ];
    }
}

修改控制器使用 StoreQuestionRequest 类替换默认的 Request 类

<?php
// app\Http\Controllers\QuestionsController.php
    use App\Http\Requests\StoreQuestionRequest;
    public function store(StoreQuestionRequest $request)
    {
        //
    }

第九章美化编辑器

9.1 登录后才能发布问题

登录后才能发布问题，index 和 show 页面例外。

<?php
// app\Http\Controllers\QuestionsController.php
    public function __construct()
    {
        $this->middleware('auth')->except(['index','show']);
    }

9.2 自定义 toolbars

<!-- 定义容器的高度为200 -->
<script id="container" style="height: 200px" name="body" type="text/plain">
    {!! old('title') !!}
</script>

<script type="text/javascript">
    var ue = UE.getEditor('container', {
        toolbars: [
            ['bold', 'italic', 'underline', 'strikethrough', 'blockquote', 'insertunorderedlist', 'insertorderedlist', 'justifyleft','justifycenter', 'justifyright',  'link', 'insertimage', 'fullscreen']
        ],
        elementPathEnabled: false,
        enableContextMenu: false,
        autoClearEmptyNode:true,
        wordCount:false,
        imagePopup:false,
        autotypeset:{ indent: true,imageBlockLine: 'center' }
    });
    ue.ready(function() {
        ue.execCommand('serverparam', '_token', '{{ csrf_token() }}');
    });
</script>

第十章定义话题与问题关系

10.1 Topic 模型

创建「话题」模型与数据表（请留意单、复数）

question_topic 是 questions 和 topics 的多对多中间表数据库表名是复数，中间表是单数

# 创建模型同时创建 topics 表（复数）
php artisan make:model Models\\Topic -m

# 注意是 create_questions_topics_table 
php artisan make:migration create_questions_topics_table --create=question_topic

定义「话题」数据表结构

<php
// database/migrations/create_topics_table.php
    public function up()
    {
        Schema::create('topics', function (Blueprint $table) {
            $table->increments('id');
            $table->string('name');
            $table->text('bio')->nullable();
            $table->integer('questions_count')->default(0);
            $table->integer('followers_count')->default(0);
            $table->timestamps();
        });
    }

定义「问题」——「话题」数据表结构

// database\migrations\create_questions_topics_table.php
    public function up()
    {
        Schema::create('question_topic', function (Blueprint $table) {
            $table->increments('id');
            $table->integer('question_id')->unsigned()->index();
            $table->integer('topic_id')->unsigned()->index();
            $table->timestamps();
        });
    }

php artisan migrate

定义「问题」——「话题」多对多关系

文档：《Eloquent：关联：多对多》

10.2 Question 模型

问题模型：一个问题属于多个话题

<?php
// app/Models/Question.php
class Question extends Model
{
    protected $fillable = ['title','body','user_id'];

    // 获得此问题所属话题（复数）
    public function topics()
    {
        //  一个问题属于多个话题
        // belongsToMany('关联模型「Topic」','中间表表名','当前模型「Question」在中间表的外键','关联模型「Topic」在中间表的外键')
        // 中间表表名，Eloquent 会按照字母顺序合并两个关联模型的名称
        // question_id 默认采用的是下划线方式命名 
        return $this->belongsToMany(Topic::class)->withTimestamps();
        return $this->belongsToMany('App\Models\Topic', 'question_topic','question_id','topic_id')->withTimestamps();
    }
}

话题模型：一个话题下有多个问题

<?php
// app\Models\Topic.php
class Topic extends Model
{
    protected $fillable = ['name','questions_count','followers_count'];

    public function questions()
    {
        // 参数也可以使用 App\Models\Qeustion
        return $this->belongsToMany(Qeustion::class)->withTimestamps();
    }
}

第十一章使用 Select2 优化话题选择

11.1 编译压缩 Select2 资源

文档：《Laravel 的资源任务编译器 Laravel Mix》

引人 Select2 的 JS、CSS 文件

https://github.com/select2/select2

resources\assets\css\select2.min.css
resources\assets\js\select2.min.js
resources\assets\js\select2.zh-CN.js

引入 JS

// resources\assets\js\app.js
require('./select2.min');
require('./select2.zh-CN');

引入 css

/* resources\assets\sass\app.scss */
@import "../css/select2.min";

禁用缓存

// webpack.mix.js
mix.js('resources/assets/js/app.js', 'public/js')
   .sass('resources/assets/sass/app.scss', 'public/css')
   .version(['public/js/app.js','public/css/app.css']);

编译资源

yarn run production

修改引入文件地址

<?php
// resources\views\layouts\app.blade.php
<link href="{{ mix('css/app.css') }}" rel="stylesheet">

<script src="{{ mix('js/app.js') }}"></script>
@yield('js');

11.2 多选框（静态）

http://select2.github.io/examples.html

<?php
// resources\views\questions\create.blade.php

<div class="form-group">
    <label for="topic">话题</label>
    <select class="js-example-basic-multiple form-control" multiple="multiple">
        <option value="AL">Alabama</option>
        <option value="WY">Wyoming</option>
    </select>
</div>

@section('js')
    <script type="text/javascript">
        $(".js-example-basic-multiple").select2();
    </script>
@endsection

11.3 多选框（动态）

生成测试数据

文档：《Laravel 数据库之：数据填充》

php artisan make:factory TopicFactory

<?php
// database\factories\TopicFactory.php
use Faker\Generator as Faker;

$factory->define(App\Models\Topic::class, function (Faker $faker) {
    return [
        'name' => $faker->word,
        'bio' => $faker->paragraph,
    ];
});

修改 Topic 模型中的 fillable

<?php
// app\Models\Topic.php
protected $fillable = ['name','questions_count','followers_count','bio'];

使用 tinker 填充数据

php artisan tinker
factory(App\Models\Topic::class,10)->create();
quit

定义 Topic 的 api 路由

<?php
// routes\api.php
Route::get('/topics', function (Request $request) {
    $topics = App\Models\Topic::select(['id','name'])->where('name','like','%'.$request->query('q').'%')->get();
    return $topics;
});

修改「创建问题」视图文件

<?php
// resources\views\questions\create.blade.php
<div class="form-group">
    <label for="topic">话题</label>
    <select name="topic[]" class="select2-placeholder-multiple form-control" multiple="multiple"></select>
</div>

@section('js')
    <script type="text/javascript">
        $(document).ready(function() {
            function formatTopic (topic) {
                return  "<div class='select2-result-repository clearfix'>" +
                        "<div class='select2-result-repository__meta'>" +
                        "<div class='select2-result-repository__title'>" +
                        topic.name ? topic.name : "Laravel"   +
                        "</div></div></div>";
            }

            function formatTopicSelection (topic) {
                return topic.name || topic.text;
            }

            $(".select2-placeholder-multiple").select2({
                language: "zh-CN",
                tags: true,
                placeholder: '选择相关话题',
                minimumInputLength: 1,
                ajax: {
                    url: '/api/topics',
                    dataType: 'json',
                    delay: 250,
                    data: function (params) {
                        return {
                            q: params.term,
                        };
                    },
                    processResults: function (data) {
                        return {
                            results: data,
                        };
                    },
                    cache: true
                },
                templateResult: formatTopic,
                templateSelection: formatTopicSelection,
                escapeMarkup: function (markup) { return markup; }
            });
        });
    </script>
@endsection

第十二章创建和显示话题

12.1 新建话题

文档：《Laravel 的集合 Collection》、文档：《Eloquent：多对多关联》

<?php
// app\Http\Controllers\QuestionsController.php
    use App\Models\Topic;
    public function store(StoreQuestionRequest $request)
    {
        // 返回「话题」数组
        // 如果不是数组，则「话题」($topicsArray) 为空
        $topics = $request->get('topic');
        if(is_array($topics)){
            $topicsArray = $this->normalizeTopic($topics);
        }
        $data = [
            'title' => $request->get('title'),
            'body' => $request->get('body'),
            'user_id' => Auth::id()
        ];
        $question = Question::create($data);
        // 使用 attach 方法向「问题」——「话题」中间表插入一条数据
        // 前提是 Question 模型下有 topics() 方法
        $question->topics()->attach($topicsArray);
        return view('questions.show',compact('question'));
    } 
    // collect 函数：从数组中创建一个全新的「集合」实例
    // map 方法遍历集合并将每一个值传入给定的回调
    // map 返回一个新的集合实例,它不会修改它所调用的集合
    private function normalizeTopic(array $topics)
    {
        return collect($topics)->map(function($topic){
            // 如果话题存在，则$topic返回话题的ID（数字类型），否则返回新话题名称
            if(is_numeric($topic)){
                // 该话题的问题数+1
                Topic::find($topic)->increment('questions_count');
                return (int) $topic;
            }
            // 新建话题后返回该话题ID
            $newTopic = Topic::create(['name'=>$topic,'questions_count'=>1]);
            return $newTopic->id;
        })->toArray();
    }

12.2 显示问题的所有话题

QuestionsController 控制器

<?php
// app\Http\Controllers\QuestionsController.php
    public function show($id)
    {
        // 使用 with 方法进行预加载，减少查询次数
        // Question 模型下要有 topics() 方法
        $question = Question::where('id',$id)->with('topics')->first();
        return view('questions.show',compact('question'));
    }

「问题」视图

<?php
// resources\views\questions\show.blade.php
@extends('layouts.app')

@section('content')
    <div class="container">
        <div class="row">
            <div class="col-md-8 col-md-offset-2">
                <div class="panel panel-default">
                    <div class="panel-heading">
                        {{$question->title}}
                        @foreach($question->topics as $topic)
                            <a class="topic btn btn-link pull-right" href="/topic/{{$topic->id}}">{{$topic->name}}</a>
                        @endforeach
                    </div>
                    <div class="panel-body">
                        {!! $question->body !!}
                    </div>
                </div>
            </div>
        </div>
    </div>
@endsection

css 美化

resources\assets\css\style.css

/* resources\assets\sass\app.scss */
@import "../css/style";

yarn run production

第十三章使用 Repository 模式

Repository 模式的目的是将一些高频操作放在一起

在 App\Repositories 文件夹创建 QuestionsRepository

<?php````
// app\Repositories\QuestionsRepository.php
namespace App\Repositories;
use App\Models\Question;
class QuestionsRepository
{
    //通过「问题ID」查找带有「话题」的「问题」
    public function byIdWithTopics($id)
    {
        $questions = Question::where('id',$id)->with('topics')->first();
        return $questions;
    }

    // 根据 $attributes 数组来创建「问题」 
    public function create(array $attributes)
    {
        return Question::create($attributes);
    }
}

编辑 QuestionsController 控制器

<?php
// app\Http\Controllers\QuestionsController.php
use App\Repositories\QuestionsRepository;
class QuestionsController extends Controller
{
    protected $questionRepository;
    
    public function __construct(QuestionsRepository $questionRepository)
    {
        $this->questionRepository = $questionRepository;
        $this->middleware('auth')->except(['index','show']);
    }
    
    public function store(StoreQuestionRequest $request)
    {
        // 修改 $question = Question::create($data);
        $question = $this->questionRepository->create($data);
    }
    
    public function show($id)
    {
        // 修改 $question = Question::where('id',$id)->with('topics')->first();
        $question = $this->questionRepository->byIdWithTopics($id);
    }
}

第十四章实现编辑问题

14.1 编辑问题

路由情况

修改 QuestionsController 控制器

<?php
// app\Http\Controllers\QuestionsController.php
    public function edit($id)
    {
        $question = $this->questionRepository->byID($id);
        // 只有问题创建者才能编辑
        if (Auth::user()->owns($question)){
            return view('questions.edit',compact('question'));
        }
        return back();
    }

在 QuestionsRepository 中，通过ID获取问题

<?php
// app\Repositories\QuestionsRepository.php
class QuestionsRepository
{
    public function byID($id)
    {
        $question = Question::findOrfail($id);
        return $question;
    }
}

只有问题创建者才能编辑自己的问题

<?php
// app\Models\User.php
    use Illuminate\Database\Eloquent\Model;
    public function owns(Model $model)
    {
        // 判断当前用户Id是否等于问题创建者的ID
        // Auth::user()->id == $question->user_id
        return $this->id == $model->user_id;
    }

「编辑问题」视图文件

复制 create.blade.php 文件为edit.blade.php，并修改以下内容:

<?php
// resources/views/questions/edit.blade.php
// PATCH 方法对应的是 update 路由
<form action="/questions/{{ $question->id }}" method="post">
    {{ method_field('PATCH') }}
</form>

14.2 更新问题

QuestionsController 控制器

文档：《多对多关联》

StoreQuestionRequest 是验证规则，sync 用于同步关联

<?php
// app\Http\Controllers\QuestionsController.php
    public function update(StoreQuestionRequest $request, $id)
    {
        
        $question = $this->questionRepository->byID($id);
        $question->update([
            'title' => $request->get('title'),
            'body' => $request->get('body'),
        ]);
        // sync 方法可以接收 ID 数组，向中间表插入对应关联数据记录。
        // 所有没放在数组里的 IDs 都会从中间表里移除。
        $topics = $request->get('topic');
        if(is_array($topics)){
            $topicsArray = $this->normalizeTopic($topics);
        }
        $question->topics()->sync($topicsArray);
        return redirect()->route('questions.show',$question->id);
    }

「问题」视图文件

<?php
// resources/views/questions/show.blade.php
@extends('layouts.app')

@section('content')
    <div class="container">
        <div class="row">
            <div class="col-md-8 col-md-offset-2">
                <div class="panel panel-default">
                    <div class="panel-heading">
                        {{$question->title}}
                        @foreach($question->topics as $topic)
                            <a class="topic btn btn-link pull-right" href="/topic/{{$topic->id}}">{{$topic->name}}</a>
                        @endforeach
                    </div>
                    <div class="panel-body">
                        {!! $question->body !!}
                    </div>
                    <div class="actions panel-footer">
                        @if(Auth::check()  && Auth::user()->owns($question))
                            <span class="edit">
                                <a href="/questions/{{$question->id}}/edit">编辑</a>
                            </span>
                        @endif
                    </div>
                </div>
            </div>
        </div>
    </div>
@endsection

第十五章问题列表和删除问题

15.1 问题列表

编辑问题控制器

http://php.net/manual/zh/function.compact.php

<?php
// app\Http\Controllers\QuestionsController.php
    public function index()
    {
        $questions = $this->questionRepository->getQuestionsFeed();
        return view('questions.index',compact('questions'));
    }

编辑 QuestionsRepository

文档：《本地作用域》

本地作用域允许我们定义通用的约束集合以便在应用中复用，只需简单在对应 Eloquent 模型方法前加上一个 scope 前缀。

<?php
// app\Repositories\QuestionsRepository.php
    public function getQuestionsFeed()
    {
        // 获取 is_hidden 为 false 的问题，并按更新时间排序，同时获取该问题对应的用户信息。
        return Question::published()->latest('updated_at')->with('user')->get();
    }

Eloquent 模型中任何以 scope 开始的方法都被当做 Eloquent scope

<?php
// app\Models\Question.php
    public function scopePublished($query)
    {
        //  约束条件是 is_hidden 为 false
        return $query->where('is_hidden','F');
    }
    
    public function user()
    {
        return $this->belongsTo(User::class);
    }

问题首页视图文件

<?php
// resources\views\questions\index.blade.php
@extends('layouts.app')
@section('content')
    <div class="container">
        <div class="row">
            <div class="col-md-8 col-md-offset-2">
                @foreach($questions as $question)
                    <div class="media">
                        <div class="media-left">
                            <a href="">
                                <!-- 头像地址：public/images/avatar.png -->
                                <img width="48" src="{{ url('images',$question->user->avatar) }}" alt="{{$question->user->name}}" >
                            </a>
                        </div>
                        <div class="media-body">
                            <h4 class="media-heading">
                                <a href="/questions/{{$question->id}}">{{$question->title}}</a>
                            </h4>
                        </div>
                    </div>
                @endforeach
            </div>
        </div>
    </div>
@endsection

15.2 删除问题

视图文件

<?php
// resources\views\questions\show.blade.php
<div class="actions panel-footer">
    @if(Auth::check()  && Auth::user()->owns($question))
        <span class="edit">
            <a href="/questions/{{$question->id}}/edit">编辑</a>
        </span>
        <form action="/questions/{{$question->id}}" method="post" class="delete-form">
            {{method_field('DELETE')}}
            {{csrf_field()}}
            <button class="button delete-button is-naked">删除</button>
        </form>
    @endif
</div>

「删除问题」控制器

<?php
// app\Http\Controllers\QuestionsController.php
    public function destroy($id)
    {
        $question = $this->questionRepository->byID($id);
        if (Auth::user()->owns($question)){
            $question->delete();
            return redirect('/questions/');
        }
        abort(403,'Forbidden');
    }

第十六章创建问题的答案 Answer 模型

# 模型名称首字母大写且是单数，自动创建的数据库表是复数
php artisan make:model models\\Answer -m

<?php
    public function up()
    {
        Schema::create('answers', function (Blueprint $table) {
            $table->increments('id');
            $table->integer('user_id')->index()->unsigned();
            $table->integer('question_id')->index()->unsigned();
            $table->text('body');
            $table->integer('votes_count')->default(0);
            $table->integer('comments_count')->default(0);
            $table->string('is_hidden',8)->default('F');
            $table->string('close_comment',8)->default('F');
            $table->timestamps();
        });
    }

php artisan migrate

Answer 模型

<?php
// app\Models\Answer.php
class Answer extends Model
{
    protected $fillable = ['user_id', 'question_id', 'body'];
    public function user()
    {
        return $this->belongsTo(User::class);
    }
    public function question()
    {
        return $this->belongsTo(Question::class);
    }
}

Question 模型

<?php
// app\Models\Question.php
    public function answers()
    {
        return $this->hasMany(Answer::class);
    }

User 模型

<?php
// app\Models\User.php
    public function answers()
    {
        return $this->hasMany(Answer::class);
    }

第十七章实现提交回答

17.1 创建 Answer 控制器

# 单数
php artisan make:controller AnswerController

定义保存 Answer 的路由

<?php
// routes\web.php
Route::post('questions/{question}/answer','AnswerController@store');

Answer 控制器

<?php
// app\Http\Controllers\AnswerController.php
use App\Repositories\AnswerRepository;
use Illuminate\Support\Facades\Auth;
use Illuminate\Http\Request;

class AnswerController extends Controller
{
    protected $answer;

    public function __construct(AnswerRepository $answer)
    {
        $this->answer = $answer;
    }

    public function store(Request $request, $question)
    {
        // ID 是当前登录用户ID
        $answer = $this->answer->create([
            'question_id' => $question,
            'user_id'     => Auth::id(),
            'body'        => $request->get('body')
        ]);
        // 问题回答数+1
        $answer->question()->increment('answers_count');
        return back();
    }

AnswerRepository 模式

<?php
// app\Repositories\AnswerRepository.php
use App\Models\Answer;
class AnswerRepository
{
    public function create(array $attributes)
    {
        return Answer::create($attributes);
    }
}

17.2 验证 Answer 表单

新建规则文件

php artisan make:request StoreAnswerRequest

<?php
// app\Http\Requests\StoreAnswerRequest.php
public function authorize()
{
    return true;
}
public function rules()
{
    return [
        'body' => 'required|min:12'
    ];
}

将规则依赖注入

<?php
// app\Http\Controllers\AnswerController.php
use App\Http\Requests\StoreAnswerRequest;
public function store(StoreAnswerRequest $request, $question)
{
    //
}

17.3 视图中显示 Answer

修改 byIdWithTopics 为 byIdWithTopicsAndAnswers

<?php
// app\Http\Controllers\QuestionsController.php
    public function show($id)
    {
        $question = $this->questionRepository->byIdWithTopicsAndAnswers($id);
        return view('questions.show',compact('question'));
    }

<?php
// app\Repositories\QuestionsRepositories.php
    public function byIdWithTopicsAndAnswers($id)
    {
        $question = Question::where('id',$id)->with('topics','answers')->first();
        return $question;
    }

「问题」视图

<?php
// resources\views\questions\show.blade.php
@extends('layouts.app')

@section('content')
    @include('vendor.ueditor.assets')
    <div class="container">
        <div class="row">
            <div class="col-md-8 col-md-offset-2">
            <!-- ...... -->
            </div>

            <div class="col-md-8 col-md-offset-2">
                <div class="panel panel-default">
                    <div class="panel-heading">
                        {!! $question->answers_count !!} 个答案
                    </div>
                    <div class="panel-body">
                        @foreach($question->answers as $answer)
                            <div class="media">
                                <div class="media-left">
                                    <a href="">
                                        <img width="48" src="{{ url('images',$answer->user->avatar) }}" alt="{{$answer->user->name}}" >
                                    </a>
                                </div>
                                <div class="media-body">
                                    <h4 class="media-heading">
                                        <a href="/user/{{$answer->user->name}}">
                                            {{$answer->user->name}}
                                        </a>
                                    </h4>
                                    {!! $answer->body !!}
                                </div>
                            </div>
                        @endforeach
                        <form action="/questions/{{$question->id}}/answer" method="post">
                            {!! csrf_field() !!}
                            <div class="form-group{{ $errors->has('body') ? ' has-error' : '' }}">
                                <label for="body">内容</label>
                                <script id="container" style="height: 120px" name="body" type="text/plain">
                                    {!! old('body') !!}
                                </script><br/>
                                @if ($errors->has('body'))
                                <span class="help-block">
                                    <strong>{{ $errors->first('body') }}</strong>
                                </span>
                                @endif
                            </div>
                            <button type="submit" class="btn btn-block btn-success pull-right">提交答案</button>
                        </form>
                    </div>
                </div>
            </div>

        </div>
    </div>
@endsection

@section('js')
<script type="text/javascript">
    var ue = UE.getEditor('container', {
        toolbars: [
            ['bold', 'italic', 'underline', 'strikethrough', 'blockquote', 'insertunorderedlist', 'insertorderedlist', 'justifyleft','justifycenter', 'justifyright',  'link', 'insertimage', 'fullscreen']
        ],
        elementPathEnabled: false,
        enableContextMenu: false,
        autoClearEmptyNode:true,
        wordCount:false,
        imagePopup:false,
        autotypeset:{ indent: true,imageBlockLine: 'center' }
    });
    ue.ready(function() {
        ue.execCommand('serverparam', '_token', '{{ csrf_token() }}');
    });
</script>
@endsection

第十八章用户关注问题

18.1 提交回答需要登录

在前端限制

<?php
// resources\views\questions\show.blade.php
@if(Auth::check())
    <form action="/questions/{{$question->id}}/answer" method="post">
    </form>
@else
    <a href="{{ url('login') }}" class="btn btn-warning btn-block">登录提交答案</a>
@endif

在后端限制

<?php
// app/Http/Controllers/AnswerController.php
public function __construct(AnswerRepository $answer)
{
    $this->middleware('auth');
}

18.2 关注问题

实质是创建 user_question 表，记录了登录用户ID和所关注问题的ID，点击关注该问题便生成一条记录。

18.2.1 数据库迁移

注意 user_question 表是复数

<?php
php artisan make:migration create_user_question --create=user_question

注意 user_id question_id 外键是单数

<?php
// database/migrations/create_user_question.php
Schema::create('user_question', function (Blueprint $table) {
    $table->increments('id');
    $table->integer('user_id')->unsigned()->index();
    $table->integer('question_id')->unsigned()->index();
    $table->timestamps();
});

php artisan migrate

18.2.2 视图文件

<?php
// resources\views\questions\show.blade.php
<div class="container">
        <div class="row">
            <!-- offset-2 改成 offset-1  -->
            <div class="col-md-8 col-md-offset-1">
            ......
            </div>
            <div class="col-md-3">
                <div class="panel panel-default">
                    <div class="panel-heading question-follow">
                        <h2>{{ $question->followers_count }}</h2>
                        <span>关注者</span>
                    </div>
                    <div class="panel-body">
                        <a href="/question/{{$question->id}}/follow" class="btn btn-default">
                            关注该问题
                        </a>
                        <a href="#editor" class="btn btn-primary pull-right">撰写答案</a>
                    </div>
                </div>
            </div>
            <!-- offset-2 改成 offset-1  -->
            <div class="col-md-8 col-md-offset-1">
                <div class="panel panel-default">
                    <div class="panel-heading">
                        {!! $question->answers_count !!} 个答案
                    </div>
                </div>
            </div>
        </div>
    </div>
</div>

18.2.3 路由

<?php
// zhihu\routes\web.php
Route::get('question/{question}/follow','QuestionFollowController@follow');

18.2.4 「关注问题」控制器

php artisan make:controller QuestionFollowController

<?php
// app\Http\Controllers\QuestionFollowController.php
use App\Models\Question;
use Illuminate\Support\Facades\Auth;
public function __construct()
{
    // 需要登录，否则下面 Auth::user() 爆错
    $this->middleware('auth');
}

public function follow($question)
{
    // 别忘了 use Auth
    // $question 是从路由传入的问题ID
    Auth::user()->follows($question);
    Question::find($question)->increment('followers_count');
    return back();
}

18.2.5 模型

<?php
// app\Models\User.php
public function follows($question)
{
   return Follow::create([
       'question_id' => $question,
       'user_id' => $this->id
   ]);
}

php artisan make:model models\\Follow

<?php
// app\Models\Follow.php
class Follow extends Model
{
    protected $table = 'user_question';
    protected $fillable = ['user_id', 'question_id'];
}

第十九章用户关注问题（下）

19.1 使用 toggle 方法避免重复关注

<?php
// app\Http\Controllers\QuestionFollowController.php
public function follow($question)
{
    Auth::user()->followThis($question);
    ......
}

文档：《多对多关联：同步关联》

<?php
// app\Models\User.php
    public function follows()
    {
        // 多对多，一个用户可以关注多个问题，一个问题也能被多个用户关注
        return $this->belongsToMany(Question::class,'user_question')->withTimestamps();
    }
    
    public function followThis($question)
    {
        // 如果给定 ID 已附加，就会被移除。
        // 同样的，如果给定 ID 已移除，就会被附加：
        return $this->follows()->toggle($question);

        // 关注成功则+1，否则反之
        if ($this->followed($question))
            Question::find($question)->increment('followers_count');
        else
            Question::find($question)->decrement('followers_count');
    }

19.2 获取关注状态

<?php
// app\Models\User.php
public function followed($question)
{
    // 通过问题ID查询该用户是否关注该问题 
    return  $this->follows()->where('question_id',$question)->count();
}

前端

<?php
// resources\views\questions\show.blade.php
<div class="panel-body">
    @if(Auth::check())
        <a href="/question/{{$question->id}}/follow"
            class="btn btn-default {{Auth::user()->followed($question->id) ? 'btn-success' : ''}}">
            {{Auth::user()->followed($question->id) ? '已关注' : '关注该问题'}}
        </a>
    @else
        <a href="/question/{{$question->id}}/follow" class="btn btn-warning">关注该问题</a>
    @endif
    <a href="#editor" class="btn btn-primary pull-right">撰写答案</a>
</div>

第二十章使用 Vuejs 实现关注问题

在上一节使用 toggle 避免重复关注，并且使用超链接来实现关注和取消关注。而使用 Vuejs 可以避免跳转，用户体验更佳。

路由

<?php
// routes/api.php

// 根据用户ID和问题ID，查询是否关注成功
Route::post('/question/follower',function (Request $request){
    $followed = \App\Models\Follow::where('question_id',$request->get('question'))
        ->where('user_id',$request->get('user'))
        ->count();
    if ($followed) {
        return response()->json(['followed' => true]);
    }
    return response()->json(['followed' => false]);

})->middleware('api');

// 关注成功后写入数据到 user_question 表
Route::post('/question/follow',function (Request $request){
    $question_id =  $request->get('question');
    $followed = \App\Models\Follow::where('question_id',$question_id)
        ->where('user_id',$request->get('user'))
        ->first();
    //若已经关注，则取消关注
    if ($followed !== null) {
        $followed->delete();
        \App\Models\Question::find($question_id)->decrement('followers_count');
        return response()->json(['followed' => false]);
    }
    //否则写入数据
    \App\Models\Follow::create([
        'question_id'=>$request->get('question'),
        'user_id'=>$request->get('user'),
    ]);
    \App\Models\Question::find($question_id)->increment('followers_count');
    return response()->json(['followed' => true]);

})->middleware('api');

安装 props 包

yarn add props

// resources\assets\js\components\QuestionFollowButton.vue
<template>
    <button
            class="btn btn-default"
            v-bind:class="{'btn-success' : followed}"
            v-text="text"
            v-on:click="follow"
    ></button>
</template>

<script>
    export default {
        props:['question','user'],
        mounted() {
            // 查询是否已经关注
            axios.post('/api/question/follower',{'question':this.question,'user':this.user}).then(response => {
                //console.log(response.data);
                this.followed = response.data.followed
            })
        },
        data(){
            return {
                followed:false //默认值
            }
        },
        computed:{
            text(){
                return this.followed ? '已关注' : '关注该问题'
            }
        },
        methods:{
            // 关注
            follow() {
                axios.post('/api/question/follow',{'question':this.question,'user':this.user}).then(response => {
                    this.followed = response.data.followed
                })
            }
        }
    }
</script>

// resources\assets\js\app.js
Vue.component('question-follow-button', require('./components/QuestionFollowButton.vue'));

视图

 <div class="panel-body">
    @if(Auth::check())
        <question-follow-button question="{{$question->id}}" user="{{Auth::id()}}"></question-follow-button>
    @else
        <a href="/question/{{$question->id}}/follow" class="btn btn-warning">关注该问题</a>
    @endif
    <a href="#editor" class="btn btn-primary pull-right">撰写答案</a>
</div>

编译

yarn run prod

第二十一章前后端分离 API token 认证

21.1 在 `users` 表新增 `api_token` 字段

php artisan make:migration add_api_token_to_users --table=users

<?php
// database\migrations\2017_09_19_133744_add_api_token_to_users.php
    public function up()
    {
        Schema::table('users', function (Blueprint $table) {
            $table->string('api_token',64)->unique();
        });
    }
    public function down()
    {
        Schema::table('users', function (Blueprint $table) {
            $table->dropColumn(['api_token']);
        });
    }

php artisan migrate

将生成的随机字符串手动粘贴到 user 表中

php artisan migrate
php artisan tinker
>>> str_random(60)
=> "79hiXQBXMSWwrZDqybMTxZGjbB0nkFv2DkrAqyGoQ1f9WscoHwTSaB0btktm"
=> "ry8k58UcyZoSZJtIyZtegp3M5pqJbkceEPyC2dxm8zH5NaUoWDR9ykvY1EMX"

注册时自动生成随机字符串

<?php
// app\Http\Controllers\Auth\RegisterController.php
    protected function create(array $data)
    {
        $user = User::create([
            'api_token' => str_random(60),
        ]);
    }

<?php
// app\Models\User.php
  protected $fillable = [
        'api_token'
    ];

21.2 获取前端生成的 `api_token` 字符串

<?php
// resources\assets\js\bootstrap.js
// 注意 Authorization
let apiToken = document.head.querySelector('meta[name="api-token"]');

if (apiToken) {
    window.axios.defaults.headers.common['Authorization'] = apiToken.content;
} else {
    console.error('API token not found');
}

前端从数据库读取 api_token 内容

<?php
// resources\views\layouts\app.blade.php
<meta name="api-token" content="{{  Auth::check() ? 'Bearer '.Auth::user()->api_token : 'Bearer ' }}">

21.3 前端安全优化

去掉 user 部分

// resources\assets\js\components\QuestionFollowButton.vue
    export default {
        props:['question'],
        mounted() {
            axios.post('/api/question/follower',{'question':this.question}).then(response => {
                //
            })
        },
        methods:{
            follow() {
                axios.post('/api/question/follow',{'question':this.question}).then(response => {
                    //
                })
            }
        }
    }

路由部分，新增 $user 并且将 $request->get('user') 替换成 $user->id

<?php
// routes\api.php
Route::post('/question/follower',function (Request $request){
    $user = Auth::guard('api')->user(); //新增内容
    $followed = \App\Models\Follow::where('question_id',$request->get('question'))
        ->where('user_id',$user->id) // 注意 $user->id
        ->count();
})->middleware('auth:api');

Route::post('/question/follow',function (Request $request){
    $user = Auth::guard('api')->user(); //新增内容
    $question_id =  $request->get('question');
    $followed = \App\Models\Follow::where('question_id',$question_id)
        ->where('user_id',$user->id) //注意 $user->id
        ->first();
    \App\Models\Follow::create([
        'question_id'=>$request->get('question'),
        'user_id'=>$user->id, //注意 $user->id
    ]);
})->middleware('auth:api');

视图

<?php
// resources\views\questions\show.blade.php
// 移除了 user="{{Auth::id()}}
<question-follow-button question="{{$question->id}}"></question-follow-button>

编译

yarn run prod

21.4 优化路由

https://d.laravel-china.org/docs/5.5/eloquent-relationships#updating-many-to-many-relationships

<?php
// routes\api.php
Route::post('/question/follower',function (Request $request){
    $user = Auth::guard('api')->user();
    // 原路由需要提供 user_id ，优化后将 Follow::where 封装成 $user->followed
    //  $followed = \App\Models\Follow::where('question_id',$request->get('question'))
    //   ->where('user_id',$user->id)
    //   ->count();
    $followed = $user->followed($request->get('question'));
    if ($followed) {
        return response()->json(['followed' => true]);
    }
    return response()->json(['followed' => false]);

})->middleware('auth:api');

Route::post('/question/follow',function (Request $request){
    $user = Auth::guard('api')->user();
    $question_id =  $request->get('question');
    // 原路由需要提供 user_id ，优化后将 Follow::where 封装成 $user->followThis
    // followThis 这里用到了 toggle 特性，省去了 Follow::create 步骤
    // $followed = \App\Models\Follow::where('question_id',$question_id)
    //    ->where('user_id',$user->id)
    //    ->first();
    $question = \App\Models\Question::find($question_id);
    $followed = $user->followThis($question_id);
    if (count($followed['detached']) > 0){
        $question->decrement('followers_count');
        return response()->json(['followed' => false]);
    }
    $question->increment('followers_count');
    return response()->json(['followed' => true]);

})->middleware('auth:api');

第二十二章关注用户（上）

22.1 新增 followers 表

该表存放关注者 ID 和被关注者 ID

php artisan make:migration create_followers_table --create=followers

<?php
// database/migrations/create_followers_table.php
public function up()
    {
        Schema::create('followers', function (Blueprint $table) {
            $table->increments('id');
            $table->integer('follower_id')->unsigned()->index();
            $table->integer('followed_id')->unsigned()->index();
            $table->timestamps();
        });
    }

php artisan migrate

一个用户（follower）既可以关注多个用户（正在关注他人，即following），也能被多个用户（关注者，followers）所关注。

<?php
// app\Models\User.php

// 用户（follower）关注了哪些人（followed）
public function following()
{
    // 用户（follower） 和已经关注的人（followed）均在 user 表，故self::class
    // 顺序：类 -- 中间表 -- 用户在中间表的外键 -- 已经关注的人在中间表的外键
    return $this->belongsToMany(self::class, 'followers', 'follower_id', 'followed_id')->withTimestamps();
}

22.2 视图

<?php
// resources/views/questions/show.blade.php
<div class="container">
    <div class="row">
        ......
        <!-- start -->
        <div class="col-md-3">
            <div class="panel panel-default">
                <div class="panel-heading question-follow">
                    <h5>关于作者</h5>
                </div>
                <div class="panel-body">
                    <div class="media">
                        <div class="media-left">
                            <a href="#">
                                <img width="36" src="{{ url('images',$question->user->avatar) }}" alt="{{$question->user->name}}">
                            </a>
                        </div>
                        <div class="media-body">
                            <h4 class="media-heading"><a href="">
                                    {{ $question->user->name }}
                                </a>
                            </h4>
                        </div>
                        <div class="user-statics" >
                            <div class="statics-item text-center">
                                <div class="statics-text">问题</div>
                                <div class="statics-count">{{ $question->user->questions_count }}</div>
                            </div>
                            <div class="statics-item text-center">
                                <div class="statics-text">回答</div>
                                <div class="statics-count">{{ $question->user->answers_count }}</div>
                            </div>
                            <div class="statics-item text-center">
                                <div class="statics-text">关注者</div>
                                <div class="statics-count">{{ $question->user->followers_count }}</div>
                            </div>
                        </div>
                    </div>
                    <user-follow-button user="{{$question->user_id}}"></user-follow-button>
                    <send-message user="{{$question->user_id}}"></send-message>
                </div>
            </div>
        </div>
        <!-- end -->
    </div>
</div>

第二十三章关注用户（下）

23.1 vuejs 组件

这个按钮在关注用户（上）已经添加了

<?php
// resources/views/questions/show.blade.php
<user-follow-button user="{{$question->user_id}}"></user-follow-button>

所以，直接新增 UserFollowButton.vue

// resources\assets\js\components\UserFollowButton.vue
// 页面载入时就向 /api/user/followers/ 发起get请求，查询是否关注了该问题的作者。
// 点击按钮时向 /api/user/follow 发起post请求，直接关注该问题的作者。
<template>
    <button
            class="btn btn-default"
            v-bind:class="{'btn-success': followed}"
            v-text="text"
            v-on:click="follow"
    ></button>
</template>

<script>
    export default {
        props:['user'],
        mounted() {
            axios.get('/api/user/followers/' + this.user).then(response => {
                this.followed = response.data.followed
            })
        },
        data() {
            return {
                followed: false
            }
        },
        computed: {
            text() {
                return this.followed ? '已关注' : '关注他'
            }
        },
        methods:{
            follow() {
                axios.post('/api/user/follow',{'user':this.user}).then(response => {
                    this.followed = response.data.followed
                })
            }
        }
    }
</script>

运行

// resources\assets\js\app.js
Vue.component('user-follow-button', require('./components/UserFollowButton.vue'));

yarn run dev

23.2 路由

<?php
// routes\api.php
//  这里的ID是该问题的作者ID 
Route::get('/user/followers/{id}','FollowersController@index');
Route::post('/user/follow','FollowersController@follow');

23.3 控制器

UserRepository

<?php
namespace App\Repositories;
use App\Models\User;
class UserRepository
{
    public function byId($id)
    {
        return User::find($id);
    }
}

新增 FollowersController 控制器

# 控制器是复数
php artisan make:controller FollowersController

<?php
//app\Http\Controllers\FollowersController.php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
use App\Repositories\UserRepository;
use Auth;
class FollowersController extends Controller
{
    protected $user;

    public function __construct(UserRepository $user)
    {
        $this->user = $user;
    }

    public function index($id)
    {
        $user = $this->user->byId($id);
        $followers = $user->followers()->pluck('follower_id')->toArray();
        if ( in_array(Auth::guard('api')->user()->id, $followers) ) {
            return response()->json(['followed' => true]);
        }
        return response()->json(['followed' => false]);
    }

    public function follow()
    {
        $user = $this->user->byId(request('user'));
        $followed = Auth::guard('api')->user()->follow($user->id);
        if ( count($followed['attached']) > 0 ) {
            $user->increment('followers_count');
            return response()->json(['followed' => true]);
        }
        $user->decrement('followers_count');
        return response()->json(['followed' => false]);
    }
}

23.4 用户模型

<?php
// app\Models\User.php

public function following()
{
    return $this->belongsToMany(self::class, 'followers', 'follower_id', 'followed_id')->withTimestamps();
}

// 用户（follower）被哪些人（followed）所关注（关注者）
public function followers()
{
    return $this->belongsToMany(self::class, 'followers', 'followed_id', 'follower_id')->withTimestamps();
}

// 根据用户id发起关注
public function follow($user)
{
    return $this->following()->toggle($user);
}

第二十四章站内信通知

https://laravel-china.org/docs/laravel/5.5/notifications

点击关注后发送通知

<?php
// app\Http\Controllers\FollowersController.php
use App\Notifications\NewUserFollowNotification;
public function follow()
{
    if ( count($followed['attached']) > 0 ) {
        //......
        $user->notify(new NewUserFollowNotification());
    }
}

生成 notification 通知类

php artisan make:notification NewUserFollowNotification
php artisan notifications:table
php artisan migrate

<?php
// app\Notifications\NewUserFollowNotification.php
use Auth;
public function via($notifiable)
{
    return ['database'];
}

public function toDatabase($notifiable)
{
    return [
        'name' => Auth::guard('api')->user()->name,
    ];
}

web 路由

<?php
// routes\web.php
Route::get('notifications','NotificationsController@index');

控制器

php artisan make:controller NotificationsController

<?php
// app\Http\Controllers\NotificationsController.php
use Auth;
public function index()
{
    $user = Auth::user();

    return view('notifications.index', compact('user'));
}

视图

<?php
// resources\views\notifications\index.blade.php
@extends('layouts.app')

@section('content')
    <div class="container">
        <div class="row">
            <div class="col-md-8 col-md-offset-2">
                <div class="panel panel-default">
                    <div class="panel-heading">消息通知</div>
                    <div class="panel-body">
                        @foreach($user->notifications as $notification)
                            @include('notifications.'.snake_case(class_basename($notification->type)))
                        @endforeach
                    </div>
                </div>
            </div>
        </div>
    </div>
@endsection

<?php
// resources\views\notifications\new_user_follow_notification.blade.php
<li class="notifications {{ $notification->unread() ? 'unread' : ' ' }}">
    <a href="{{ $notification->data['name'] }}">
        {{ $notification->data['name'] }}
    </a> 关注了你。
</li>

第二十五章关注用户之邮件通知

25.1 Sendcloud 邮件服务

<?php
// app\Notifications\NewUserFollowNotification.php
use App\Channels\SendcloudChannel;
use Mail;
public function via($notifiable)
{
    return ['database', SendcloudChannel::class];
}

public function toSendcloud($notifiable)
{
    $data = [
        'yourName' => $notifiable->name,
        'followerName' => Auth::guard('api')->user()->name,
        'url'  => 'http://zhihu.dev/user/'.Auth::guard('api')->user()->id,
    ];
    Mail::send('emails.follow', $data, function ($message) use ($data,$notifiable) {
        $message->from('service@sc.mail.wangyan.org', env('APP_NAME','Laravel'));
        $message->to($notifiable->email);
        $message->subject($data['followerName'].'关注了你');
    });
}

<?php
// app\Channels\SendcloudChannel.php
namespace App\Channels;
use Illuminate\Notifications\Notification;
class SendcloudChannel
{
    public function send($notifiable, Notification $notification)
    {
        $message = $notification->toSendcloud($notifiable);
    }
}

视图略

resources/views/emails/follow.blade.php

25.2 Directmail 邮件服务

<?php
// .env
MAIL_DRIVER=sendcloud
SEND_CLOUD_USER=wang_yan
SEND_CLOUD_KEY=ZN1XDQ8q6jRfS3JU

<?php
// app\Notifications\NewUserFollowNotification.php
use App\Channels\DirectmailChannel;
use Mail;
public function via($notifiable)
{
    return ['database', DirectmailChannel::class];
}

public function toDirectmail($notifiable)
{
    $data = [
        'yourName' => $notifiable->name,
        'followerName' => Auth::guard('api')->user()->name,
        'url'  => 'http://zhihu.dev/user/'.Auth::guard('api')->user()->id,
    ];
    Mail::send('emails.follow', $data, function ($message) use ($data,$notifiable) {
        $message->from('service@dm.mail.wangyan.org', env('APP_NAME','Laravel'));
        $message->to($notifiable->email);
        $message->subject($data['followerName'].'关注了你');
    });
}

<?php
// app\Channels\DirectmailChannel.php
namespace App\Channels;
use Illuminate\Notifications\Notification;
class DirectmailChannel
{
    public function send($notifiable, Notification $notification)
    {
        $message = $notification->toDirectmail($notifiable);
    }
}

第二十六章重构邮件通知代码

创建基类

<?php
// app/Mailer/Mailer.php
namespace App\Mailer;
use Illuminate\Support\Facades\Mail;
use Naux\Mail\SendCloudTemplate;
class Mailer
{
    public function sendTo($template, $email, array $data)
    {
        $content = new SendCloudTemplate($template,$data);

        Mail::raw($content,  function ($message) use ($email) {
            $message->from('service@sc.mail.wangyan.org', env('APP_NAME','Laravel'));
            $message->to($email);
        });
    }
}

关注通知

<?php
// app/Mailer/UserMailer.php
namespace App\Mailer;
use Auth;
class UserMailer extends Mailer
{
    public function followNotifyEmail($email,$name)
    {
        $data = [
            'yourName' => $name,
            'followerName' => Auth::guard('api')->user()->name,
            'url'  => 'http://zhihu.dev/user/'.Auth::guard('api')->user()->id,
        ];

        $this->sendTo('zhihu_new_user_follow',$email,$data);
    }
}

<?php
// app/Notifications/NewUserFollowNotification.php
public function toSendcloud($notifiable)
{
    (new UserMailer())->followNotifyEmail($notifiable->email,$notifiable->name);
}

密码重置

<?php
// app/Mailer/UserMailer.php
class UserMailer extends Mailer
{
    public function passwordReset($name,$email,$token)
    {
        $data = [
            'title' => env('APP_NAME','Laravel'),
            'name'  => $name,
            'url'   => url('password/reset',$token)
        ];

        $this->sendTo('zhihu_password_reset',$email,$data);
    }
}

<?php
// app/Models/User.php
public function sendPasswordResetNotification($token)
{
    (new UserMailer())->passwordReset($this->name,$this->email,$token);
}

新用户注册邮件验证

<?php
// app/Mailer/UserMailer.php
class UserMailer extends Mailer
{
    public function verifyEmail($name,$email,$confirmation_token)
    {
        $data = [
            'name' => $name,
            'url'  => Route('email.verify',['token' => $confirmation_token])
        ];

        $this->sendTo('zhihu_user_register',$email,$data);
    }
}

<?php
// app/Http/Controllers/Auth/RegisterController.php
private function sendVerifyEmailTo($user)
{
    (new UserMailer())->verifyEmail($user->name,$user->email,$user->confirmation_token);
}

第二十七章对答案进行点赞

模型

php artisan make:model Vote -m

<?php
// database/migrations/create_votes_table.php
Schema::create('votes', function (Blueprint $table) {
    $table->increments('id');
    $table->unsignedInteger('user_id')->index();
    $table->unsignedInteger('answer_id')->index();
    $table->timestamps();
});

php artisan migrate

路由

<?php
// 都是post
Route::post('/answer/{id}/votes/users','VotesController@users');
Route::post('/answer/vote','VotesController@vote');

控制器

php artisan make:controller VotesController

<?php
// app/Http/Controllers/VotesController.php
namespace App\Http\Controllers;
use App\Repositories\AnswerRepository;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class VotesController extends Controller
{
    // AnswerRepository
    protected $answer;
    public function __construct(AnswerRepository $answer)
    {
        $this->answer = $answer;
    }
    
    //根据用户id查询是否已经点赞
    public function users($id)
    {
        $user = Auth::guard('api')->user();
        // hasVoteFor()
        if($user->hasVoteFor($id)){
            return response()->json(['voted' => true]);
        }
        return response()->json(['voted' => false]);
    }

    //点赞
    public function vote()
    {
        // AnswerRepository
        $answer = $this->answer->byId(request('answer'));

        // voteFor()
        $voted = Auth::guard('api')->user()->voteFor(request('answer'));
        if ( count($voted['attached']) > 0 ) {
            $answer->increment('votes_count');
            return response()->json(['voted' => true]);
        }
        $answer->decrement('votes_count');
        return response()->json(['voted' => false]);
    }
}

AnswerRepository

<?php
public function byId($id)
{
    return Answer::find($id);
}

user 模型

<?php
// app/Models/User.php
    // 一个用户可以点赞多个问题，一个问题可以被多个用户点赞，中间表是votes
    public function votes()
    {
        return $this->belongsToMany(Answer::class,'votes');
    }

    /**
     * @param $answer
     * @return array
     */
    public function voteFor($answer)
    {
        return $this->votes()->toggle($answer);
    }

    /**
     * 根据回答id查询是否有点赞记录
     *
     * @param $answer
     * @return bool
     */
    public function hasVoteFor($answer)
    {
        return !! $this->votes()->where('answer_id',$answer)->count();
    }

vuejs组件

<template>
    <button
            class="btn btn-default"
            v-bind:class="{'btn-primary': voted}"
            v-text="text"
            v-on:click="vote"
    ></button>
</template>

<script>
    export default {
        props:['answer','count'],
        mounted() {
            axios.post('/api/answer/' + this.answer + '/votes/users').then(response => {
                this.voted = response.data.voted
            })
        },
        data() {
            return {
                voted: false
            }
        },
        computed: {
            text() {
                return this.count
            }
        },
        methods:{
            vote() {
                axios.post('/api/answer/vote',{'answer':this.answer}).then(response => {
                    this.voted = response.data.voted
                    response.data.voted ? this.count ++ : this.count --
                })
            }
        }
    }
</script>

视图

<?php
<user-vote-button answer="{{$answer->id}}" count="{{$answer->votes_count}}"></user-vote-button>

运行

yarn run dev

第二十八章私信功能（上）

创建数据表

php artisan make:model Modles\\Message -m

<?php
public function up()
    {
        Schema::create('messages', function (Blueprint $table) {
            $table->increments('id');
            $table->unsignedInteger('from_user_id');
            $table->unsignedInteger('to_user_id');
            $table->text('body');
            $table->string('has_read',8)->default('F');
            $table->timestamp('read_at')->nullable();
            $table->timestamps();
        });
    }

php artisan migrate

文档：《Eloquent：关联》

私信模型

<?php
// app/Models/Message.php
class Message extends Model
{
    protected $table = 'messages';
    protected $fillable = ['from_user_id', 'to_user_id', 'body'];

    protected function fromUser()
    {
        // 反向一对一，私信由某个用户发送的
        return $this->belongsTo(User::class,'from_user_id');
    }

    public function toUser()
    {
        // 反向一对多，私信可以发送给多个用户
        return !! $this->belongsTo(User::class,'to_user_id');
    }
}

用户模型

<?php
// app/Models/User.php
    public function messages()
    {
        //用户可以向多个用户发送私信
        return $this->hasMany(Message::class,'to_user_id');
    }

第二十九章私信功能（下）

路由

<?php
// routes/api.php
Route::post('/message/store','MessagesController@store');

私信控制器

php artisan make:controller MessagesController

<?php
namespace App\Http\Controllers;

use App\Repositories\MessageRepository;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class MessagesController extends Controller
{
    protected $message;
    public function __construct(MessageRepository $message)
    {
        $this->message = $message;
    }

    public function store()
    {
        $message = $this->message->create([
            'to_user_id' => request('user'),
            'from_user_id' => Auth::guard('api')->user()->id,
            'body' => request('body')
        ]);

        if ($message) {
            return response()->json(['status' => true]);
        }

        return response()->json(['status' => false]);
    }
}

MessageRepository

<?php
// /app/Repositories/MessageRepository.php
namespace App\Repositories;
use App\Models\Message;
class MessageRepository
{
    public function create(array $attributes)
    {
        return Message::create($attributes);
    }
}

视图

<?php
// resources/views/questions/show.blade.php
<send-message user="{{$question->user_id}}"></send-message>

vuejs 组件

Vue.component('send-message', require('./components/SendMessage.vue'));

<!-- resources/assets/js/components/SendMessage.vue -->
<template>
    <div>

    <button
            class="btn btn-default pull-right"
            style="margin-top: -36px;"
            @click="showSendMessageForm"
    >发送私信</button>
        <div class="modal fade" id="modal-send-message" tabindex="-1" role="dialog">
            <div class="modal-dialog">
                <div class="modal-content">
                    <div class="modal-header">
                        <button type="button " class="close" data-dismiss="modal" aria-hidden="true">&times;</button>
                        <h4 class="modal-title">
                            发送私信
                        </h4>
                    </div>
                    <div class="modal-body">
                        <textarea name="body" class="form-control" v-model="body" v-if="!status"></textarea>
                        <div class="alert alert-success" v-if="status">
                            <strong>私信发送成功</strong>
                        </div>
                    </div>
                    <div class="modal-footer">
                        <button type="button" class="btn btn-primary" @click="store">
                            发送私信
                        </button>
                        <button type="button" class="btn btn-default" data-dismiss="modal">关闭</button>
                    </div>
                </div>
            </div>
        </div>
    </div>
</template>

<script>
    export default {
        props:['user'],
        data() {
            return {
                body:'',
                status: false
            }
        },
        methods:{
            store() {
                axios.post('/api/message/store',{'user':this.user,'body':this.body}).then(response => {
                    this.status = response.data.status
                    this.body = ''
                    setTimeout(function () {
                        $('#modal-send-message').modal('hide')
                    }, 2000)
                })
            },
            showSendMessageForm() {
                $('#modal-send-message').modal('show')
            }
        }
    }
</script>

运行

yarn run dev

第三十章实现评论（上）

创建数据表

php artisan make:model Models\\Comment -m

<?php
// database/migrations/create_comments_table.php
// commentable_id 和 commentable_type 用于多态关联
public function up()
    {
        Schema::create('comments', function (Blueprint $table) {
            $table->increments('id');
            $table->unsignedInteger('user_id');
            $table->text('body');
            $table->unsignedInteger('commentable_id');
            $table->string('commentable_type');
            $table->unsignedInteger('parent_id')->nullable();
            $table->smallInteger('level')->default(1);
            $table->string('is_hidden',8)->default('F');
            $table->timestamps();
        });
    }

php artisan migrate

多态关联

文档：《多态关联》

<?php
// app/Models/Comment.php
namespace App\Models;
use Illuminate\Database\Eloquent\Model;
class Comment extends Model
{
    protected $table = 'comments';
    protected $fillable = ['user_id', 'body', 'commentable_id', 'commentable_type'];
    // 获得拥有此评论的模型
    public function commentable()
    {
        return $this->morphTo();
    }
}

获得答案的所有评论

<?php
// app/Models/Answer.php
public function comments()
{
    return $this->morphMany('App\Models\Comment','commentable');
}

获得问题的所有评论

<?php
// app/Models/Question.php
public function comments()
{
    return $this->morphMany('App\Models\Comment','commentable');
}

第三十一章 Vuejs 实现评论组件

路由

<?php
// routes/api.php
Route::get('/answer/{id}/comments','CommentsController@answer');
Route::get('/question/{id}/comments','CommentsController@question');

Route::post('comment','CommentsController@store');

控制器

php artisan make:controller CommentsController

获取多态关联

文档：《Eloquent 预加载》

<?php
// app/Http/Controllers/CommentsController.php
namespace App\Http\Controllers;
use App\models\Answer;
use App\Models\Comment;
use App\Models\Question;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class CommentsController extends Controller
{
    // 获取答案所以评论
    public function answer($id)
    {
        $answer = Answer::with('comments','comments.user')->where('id', $id)->first();
        return $answer->comments;
    }

    // 获取问题所有评论
    public function question($id)
    {
        $question = Question::with('comments','comments.user')->where('id', $id)->first();
        return $question->comments;

    }

    // 保存评论
    public function store()
    {
        $model = $this->getModelNameFromType(request('type'));
        $comment = Comment::create([
            'commentable_id' => request('model'),
            'commentable_type' => $model,
            'user_id' => Auth::guard('api')->user()->id,
            'body' => request('body')
        ]);
        return $comment;
    }

    private function getModelNameFromType($type)
    {
        return $type === 'question' ? 'App\Models\Question' : 'App\Models\Answer';
    }
}

vuejs

<!-- resources/assets/js/components/Comments.vue -->
<template>
    <div>

        <button
                class="button is-naked delete-button"
                @click="showCommentsForm"
                v-text="text"
        ></button>
        <div class="modal fade" :id=dialog tabindex="-1" role="dialog">
            <div class="modal-dialog">
                <div class="modal-content">
                    <div class="modal-header">
                        <button type="button " class="close" data-dismiss="modal" aria-hidden="true">&times;</button>
                        <h4 class="modal-title">
                            评论列表
                        </h4>
                    </div>
                    <div class="modal-body">
                       <div v-if="comments.length > 0">
                           <div class="media" v-for="comment in comments">
                               <div class="media-left">
                                   <a href="#">
                                       <img width="24" class="media-object" :src="'http://zhihu.test/images/' + comment.user.avatar">
                                   </a>
                               </div>
                               <div class="media-body">
                                   <h4 class="media-heading">{{comment.user.name}}</h4>
                                   {{comment.body}}
                               </div>
                           </div>
                       </div>
                    </div>
                    <div class="modal-footer">
                        <input type="text" class="form-control" v-model="body">
                        <button type="button" class="btn btn-primary" @click="store">
                            评论
                        </button>
                    </div>
                </div>
            </div>
        </div>
    </div>
</template>

<script>
    export default {
        props:['type','model','count'],
        data() {
            return {
                body:'',
                comments: []
            }
        },
        computed:{
            dialog() {
                return 'comments-dialog-' + this.type + '-' + this.model
            },
            dialogId() {
                return '#' + this.dialog
            },
            text() {
                return this.count + '评论'
            },
            total() {
                return this.count
            }
        },
        methods:{
            store() {
                axios.post('/api/comment',{'type':this.type,'model':this.model,'body':this.body}).then(response => {
                    let comment = {
                        user:{
                            name:Zhihu.name,
                            avatar:Zhihu.avatar
                        },
                        body: response.data.body
                    }
                    this.comments.push(comment)
                    this.body = ''
                    this.total ++
                })
            },
            showCommentsForm() {
                this.getComments()
                $(this.dialogId).modal('show')
            },
            getComments() {
                axios.get('/api/' + this.type +'/' + this.model + '/comments').then(response => {
                    this.comments = response.data
                })
            }
        }
    }
</script>

vuejs 组件

Vue.component('comments', require('./components/Comments.vue'));

视图

<?php
// resources/views/questions/show.blade.php
<comments type="question"
    model="{{$question->id}}"
    count="{{$question->comments()->count()}}">
</comments>
// ......
@foreach($question->answers as $answer)
    // ......
    <comments type="answer"
        model="{{$answer->id}}"
        count="{{$answer->comments()->count()}}">
    </comments>
    // ......
@endforeach

由前端传入用户名和头像

<?php
// resources/views/layouts/app.blade.php
    <script>
        @if(Auth::check())
            window.Zhihu = {
                name:"{{Auth::user()->name}}",
                avatar:"{{Auth::user()->avatar}}"
            }
        @endif
    </script>

第三十二章 Repository 模式重构代码

<?php
// app/Http/Controllers/CommentsController.php
namespace App\Http\Controllers;

use App\Repositories\AnswerRepository;
use App\Repositories\CommentRepository;
use App\Repositories\QuestionsRepository;
use Illuminate\Support\Facades\Auth;

class CommentsController extends Controller
{
    protected $answer;
    protected $question;
    protected $comment;

    public function __construct(AnswerRepository $answer, QuestionsRepository $question, CommentRepository $comment)
    {
        $this->answer = $answer;
        $this->question = $question;
        $this->comment = $comment;
    }

    public function answer($id)
    {
        return $this->answer->getAnswerCommentsById($id);
    }
    
    public function question($id)
    {
        return $this->question->getQuestionCommentsById($id);
    }

    public function store()
    {
        $model = $this->getModelNameFromType(request('type'));

        return $this->comment->create([
            'commentable_id' => request('model'),
            'commentable_type' => $model,
            'user_id' => Auth::guard('api')->user()->id,
            'body' => request('body')
        ]);
    }

    private function getModelNameFromType($type)
    {
        return $type === 'question' ? 'App\Models\Question' : 'App\Models\Answer';
    }
}

AnswerRepository

<?php
// app/Repositories/AnswerRepository.php
public function getAnswerCommentsById($id)
{
    $answer = Answer::with('comments', 'comments.user')->where('id', $id)->first();
    return $answer->comments;
}

QuestionsRepository

<?php
// app/Repositories/QuestionsRepository.php
public function getQuestionCommentsById($id)
{
    $question = Question::with('comments','comments.user')->where('id',$id)->first();
    return $question->comments;
}

CommentRepository

<?php
// app/Repositories/CommentRepository.php
namespace App\Repositories;
use App\Models\Comment;
class CommentRepository
{
    public function create(array $attributes)
    {
        return Comment::create($attributes);
    }
}

第三十三章自定义 helper

33.1 优化话题路由

<?php
// routes/api.php
Route::get('/topics','TopicsController@index')->middleware('api');

php artisan make:Controller TopicsController

<?php
// app/Http/Controllers/TopicsController.php
namespace App\Http\Controllers;
use App\Repositories\TopicRepository;
use Illuminate\Http\Request;
class TopicsController extends Controller
{
   protected $topics;

   /**
    * TopicsController constructor.
    * @param $topics
    */
   public function __construct(TopicRepository $topics)
   {
       $this->topics = $topics;
   }

   public function index(Request $request)
   {
       return $this->topics->getTopicsForTagging($request);
   }
}

<?php
// app/Repositories/TopicRepository.php
namespace App\Repositories;
use App\Models\Topic;
use Illuminate\Http\Request;
class TopicRepository
{
   public function getTopicsForTagging(Request $request)
   {
       return Topic::select(['id','name'])
           ->where('name','like','%'.$request->query('q').'%')
           ->get();
   }
}

33.2 优问题路由

<?php
// routes/api.php
Route::post('/question/follower','QuestionFollowController@follower')->middleware('auth:api');
Route::post('/question/follow','QuestionFollowController@followThisQuestion')->middleware('auth:api');

<?php
// app/Http/Controllers/QuestionFollowController.php
public function follower(Request $request)
   {
       $user = Auth::guard('api')->user();
       $followed = $user->followed($request->get('question'));
       if ($followed) {
           return response()->json(['followed' => true]);
       }
       return response()->json(['followed' => false]);
   }

public function followThisQuestion(Request $request)
   {
       $user = Auth::guard('api')->user();
       $question = $this->question->byID($request->get('question'));
       $followed = $user->followThis($question->id);
       if (count($followed['detached']) > 0){
           $question->decrement('followers_count');
           return response()->json(['followed' => false]);
       }
       $question->increment('followers_count');
       return response()->json(['followed' => true]);
   }

33.3 Helpers 函数

<?php
// app/Support/Helpers.php
if ( !function_exists('user') ) {
   function user($driver = null)
   {
       if ( $driver ) {
           return app('auth')->guard($driver)->user();
       }

       return app('auth')->user();
   }
}

<?php
// composer.json
"autoload": {
   "files":[
       "app/Support/Helpers.php"
   ]
}

composer dump-autoload

<?php
// 在所有控制器中将
Auth::guard('api')->user();  
// 替换成
user('api')

第三十四章私信列表

路由

<?php
// routes/web.php
Route::get('inbox','InboxController@index');
Route::get('inbox/{userId}','InboxController@show');

控制器

php artisan make:controller InboxController

<?php
// app/Http/Controllers/InboxController.php
namespace App\Http\Controllers;

use App\Models\Message;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class InboxController extends Controller 
{
   public function __construct()
   {
       $this->middleware('auth');
   }

   public function index()
   {
       $messages = Auth::user()->messages->groupBy('from_user_id');
       return view('inbox.index',compact('messages'));
   }

   public function show($userId)
   {
       $messages = Message::where('from_user_id',$userId)->get();
       return $messages;
   }
}

视图

<?php
// resources/views/inbox/index.blade.php
@extends('layouts.app')

@section('content')
   <div class="container">
       <div class="row">
           <div class="col-md-8 col-md-offset-2">
               <div class="panel panel-default">
                   <div class="panel-heading">私信列表</div>
                   <div class="panel-body">
                       @foreach($messages as $messageGroup)
                           <div class="media">
                               <div class="media-left">
                                   <a href="#">
                                       <img src="{{ url('images', $messageGroup->first()->fromUser->avatar) }}" width="48" alt="">
                                   </a>
                               </div>
                               <div class="media-body">
                                   <h4 class="media-heading">
                                       <a href="#">
                                           {{ $messageGroup->first()->fromUser->name }}
                                       </a>
                                   </h4>
                                   <p>
                                       <a href="/inbox/{{ $messageGroup->first()->fromUser->id }}">
                                           {{ $messageGroup->first()->body }}
                                       </a>
                                   </p>
                               </div>
                           </div>
                       @endforeach
                   </div>
               </div>
           </div>
       </div>
   </div>
@endsection

第三十五章私信列表（下）

解决发件人看不到已发私信

改造数据表

php artisan make:migration add_dialog_id_to_messages --table=messages

<?php
// database/migrations/add_dialog_id_to_messages.php
    public function up()
    {
        Schema::table('messages', function (Blueprint $table) {
            $table->bigInteger('dialog_id')->default('24');
        });
    }

    public function down()
    {
        Schema::table('messages', function (Blueprint $table) {
            $table->dropColumn(['dialog_id']);
        });
    }

<?php
// app/Models/Message.php
protected $fillable = ['from_user_id', 'to_user_id', 'body', 'dialog_id'];

<?php
// app/Http/Controllers/MessagesController.php
public function store()
{
    $message = $this->message->create([
        // ......
        'dialog_id' => time().Auth::id()
    ]);
}

控制器

<?php
// app/Http/Controllers/InboxController.php
   public function index()
   {
       $messages = Message::where('to_user_id',Auth::id())
           ->orWhere('from_user_id',Auth::id())
           ->with(['fromUser','toUser'])->get();
       return view('inbox.index',['messages' => $messages->groupBy('to_user_id')]);
   }

   public function show($dialogId)
   {
       $messages = Message::where('dialog_id',$dialogId)->get();
       return $messages;
   }

路由

<?php
// routes/web.php
Route::get('inbox/{dialogId}','InboxController@show');

视图

Auth::id() == $key

按收件人分组后，如果当前登陆用户就是收件人，则显示发件人信息，否则显示收件人信息。

<?php
@extends('layouts.app')

@section('content')
    <div class="container">
        <div class="row">
            <div class="col-md-8 col-md-offset-2">
                <div class="panel panel-default">
                    <div class="panel-heading">私信列表</div>
                    <div class="panel-body">
                        @foreach($messages as $key => $messageGroup)
                            <div class="media">
                                <div class="media-left">
                                    <a href="#">
                                        @if(Auth::id() == $key)
                                            <img src="{{ url('images', $messageGroup->last()->fromUser->avatar) }}" width="48" alt="">
                                        @else
                                            <img src="{{ url('images', $messageGroup->last()->toUser->avatar) }}" width="48" alt="">
                                        @endif
                                    </a>
                                </div>
                                <div class="media-body">
                                    <h4 class="media-heading">
                                        <a href="#">
                                            @if(Auth::id() == $key)
                                                {{ $messageGroup->last()->fromUser->name }}
                                            @else
                                                {{ $messageGroup->last()->toUser->name }}
                                            @endif
                                        </a>
                                    </h4>
                                    <p>
                                        <a href="/inbox/{{ $messageGroup->last()->dialog_id }}">
                                            {{ $messageGroup->last()->body }}
                                        </a>
                                    </p>
                                </div>
                            </div>
                        @endforeach
                    </div>
                </div>
            </div>
        </div>
    </div>
@endsection

第三十六章回复私信

路由

<?php
// routes/web.php
Route::post('inbox/{dialogId}/store','InboxController@store');

<?php
// app/Http/Controllers/InboxController.php
<?php
   public function index()
   {
       $messages = Message::where('to_user_id',Auth::id())
           ->orWhere('from_user_id',Auth::id())
           ->with(['fromUser','toUser'])->get();
       return view('inbox.index',['messages' => $messages->unique('dialog_id')->groupBy('to_user_id')]);
   }

   public function show($dialogId)
   {
       $messages = Message::where('dialog_id',$dialogId)->latest()->get();
       return view('inbox.show',compact('messages','dialogId'));
   }

   public function store($dialogId)
   {
       $message = Message::where('dialog_id',$dialogId)->first();
       $toUserId = $message->from_user_id === Auth::id() ? $message->to_user_id : $message->from_user_id;
       Message::create([
           'from_user_id' => Auth::id(),
           'to_user_id' => $toUserId,
           'body' => request('body'),
           'dialog_id' => $dialogId
       ]);
       return back();
   }
}

视图

<?php
// resources/views/inbox/show.blade.php
@extends('layouts.app')

@section('content')
   <div class="container">
       <div class="row">
           <div class="col-md-8 col-md-offset-2">
               <div class="panel panel-default">
                   <div class="panel-heading">对话列表</div>
                   <div class="panel-body">
                       <form action="/inbox/{{$dialogId}}/store" method="post">
                           {{ csrf_field() }}
                           <div class="form-group">
                               <textarea name="body" class="form-control"></textarea>
                           </div>
                           <div class="form-group pull-right">
                               <button class="btn btn-success">发送私信</button>
                           </div>
                       </form>
                       <div class="messages-list">
                           @foreach($messages as $message)
                               <div class="media">
                                   <div class="media-left">
                                       <a href="#">
                                           <img src="{{ url('images',$message->fromUser->avatar) }}"  width="48" alt="">
                                       </a>
                                   </div>
                                   <div class="media-body">
                                       <h4 class="media-heading">
                                           <a href="#">
                                               {{ $message->fromUser->name }}
                                           </a>
                                       </h4>
                                       <p>
                                           {{ $message->body }} <span class="pull-right">{{ $message->created_at->format('Y-m-d') }}</span>
                                       </p>
                                   </div>
                               </div>
                           @endforeach
                       </div>
                   </div>
               </div>
           </div>
       </div>
   </div>
@endsection

第三十七章标记私信已读

<?php
// app/Http/Controllers/InboxController.php
public function show($dialogId)
{
   $messages->markAsRead();
}

<?php
// app/Models/Message.php
public function markAsRead()
   {
       if(is_null($this->read_at)) {
           $this->forceFill(['has_read' => 'T','read_at' => $this->freshTimestamp()])->save();
       }
   }

   public function newCollection(array $models = [])
   {
       return new MessageCollection($models);
   }

<?php
// /app/Models/MessageCollection.php
namespace App\Models;
use Illuminate\Database\Eloquent\Collection;
use Illuminate\Support\Facades\Auth;
class MessageCollection extends Collection
{
   public function markAsRead()
   {
       $this->each(function($message) {
           if($message->to_user_id === Auth::id() ){
               $message->markAsRead();
           }
       });
   }
}

第三十八章显示未读私信

<?php
// app/Http/Controllers/InboxController.php
// 根据 dialog_id 会话分组（一个会话有多条私信），倒序（每个会话中最后的私信排最前）。
   public function index()
   {
       $messages = Message::where('to_user_id',Auth::id())
           ->orWhere('from_user_id',Auth::id())
           ->with(['fromUser','toUser'])->latest()->get();
       return view('inbox.index',['messages' => $messages->groupBy('dialog_id')]);
   }

   public function show($dialogId)
   {
       $messages = Message::where('dialog_id',$dialogId)->latest()->get();
       $messages->markAsRead();
       return view('inbox.show',compact('messages','dialogId'));
   }

视图

<?php
// resources/views/inbox/index.blade.php
// 每个会话显示一个列表，如果登陆用户就是发件人，那么显示收件人头像，否则显示发件人头像。
// $messageGroup->first() 指回话中的最后一条私信记录（messages已经倒序）
@extends('layouts.app')

@section('content')
   <div class="container">
       <div class="row">
           <div class="col-md-8 col-md-offset-2">
               <div class="panel panel-default">
                   <div class="panel-heading">私信列表</div>
                   <div class="panel-body">
                       @foreach($messages as $messageGroup)
                           <div class="media {{ $messageGroup->first()->shouldAddUnreadClass() ? 'unread' : '' }}">
                               <div class="media-left">
                                   <a href="#">
                                       @if(Auth::id() == $messageGroup->last()->from_user_id)
                                           <img src="{{ url('images', $messageGroup->last()->toUser->avatar) }}" width="48" alt="">
                                       @else
                                           <img src="{{ url('images', $messageGroup->last()->fromUser->avatar) }}" width="48" alt="">
                                       @endif
                                   </a>
                               </div>
                               <div class="media-body">
                                   <h4 class="media-heading">
                                       <a href="#">
                                           @if(Auth::id() == $messageGroup->last()->from_user_id)
                                               {{ $messageGroup->last()->toUser->name }}
                                           @else
                                               {{ $messageGroup->last()->fromUser->name }}
                                           @endif
                                       </a>
                                   </h4>
                                   <p>
                                       <a href="/inbox/{{ $messageGroup->first()->dialog_id }}">
                                           {{ $messageGroup->first()->body }}
                                       </a>
                                   </p>
                               </div>
                           </div>
                       @endforeach
                   </div>
               </div>
           </div>
       </div>
   </div>
@endsection

模型

<?php
// app/Models/Message.php
   public function read()
   {
       return $this->has_read === 'T';
   }

   public function unread()
   {
       return $this->has_read === 'F';
   }

   public function shouldAddUnreadClass()
   {
       // 如果登陆用户就是发件人，那么始终未读
       if(Auth::id() === $this->from_user_id) {
           return false;
       }
       return $this->unread();
   }

优化

<?php
// app/Http/Controllers/InboxController.php
public function index()
   {
       $messages = Message::where('to_user_id',Auth::id())
           ->orWhere('from_user_id',Auth::id())
           ->with(['fromUser' => function ($query){
               return $query->select(['id','name','avatar']);
           },'toUser' => function ($query){
               return $query->select(['id','name','avatar']);
           }])->latest()->get();
       return view('inbox.index',['messages' => $messages->groupBy('dialog_id')]);
   }
   public function show($dialogId)
   {
       $messages = Message::where('dialog_id',$dialogId)->with(['fromUser' => function ($query){
               return $query->select(['id','name','avatar']);
           },'toUser' => function ($query){
               return $query->select(['id','name','avatar']);
           }])->latest()->get();
       $messages->markAsRead();
       return view('inbox.show',compact('messages','dialogId'));
   }

第三十九章私信实现 Repository 模式

<?php
// app/Repositories/MessageRepository.php
namespace App\Repositories;

use App\Models\Message;
use Illuminate\Support\Facades\Auth;

class MessageRepository
{
    public function create(array $attributes)
    {
        return Message::create($attributes);
    }

    public function getAllMessages()
    {
        return $messages = Message::where('to_user_id',Auth::id())
            ->orWhere('from_user_id',Auth::id())
            ->with(['fromUser' => function ($query){
                return $query->select(['id','name','avatar']);
            },'toUser' => function ($query){
                return $query->select(['id','name','avatar']);
            }])->latest()->get();
    }

    public function getDialogMessagesBy($dialogId)
    {
        return Message::where('dialog_id',$dialogId)->with(['fromUser' => function ($query){
            return $query->select(['id','name','avatar']);
        },'toUser' => function ($query){
            return $query->select(['id','name','avatar']);
        }])->latest()->get();
    }

    public function getStingleMessageBy($dialogId)
    {
        return Message::where('dialog_id',$dialogId)->first();
    }
}

控制器

<?php
// app/Http/Controllers/InboxController.php
namespace App\Http\Controllers;

use App\Repositories\MessageRepository;
use Illuminate\Support\Facades\Auth;

class InboxController extends Controller
{
    protected $message;

    public function __construct(MessageRepository $message)
    {
        $this->middleware('auth');
        $this->message = $message;
    }

    public function index()
    {
        $messages = $this->message->getAllMessages();
        return view('inbox.index',['messages' => $messages->groupBy('dialog_id')]);
    }

    public function show($dialogId)
    {
        $messages = $this->message->getDialogMessagesBy($dialogId);
        $messages->markAsRead();
        return view('inbox.show',compact('messages','dialogId'));
    }

    public function store($dialogId)
    {
        $message = $this->message->getStingleMessageBy($dialogId);
        $toUserId = $message->from_user_id === Auth::id() ? $message->to_user_id : $message->from_user_id;
        $this->message->create([
            'from_user_id' => Auth::id(),
            'to_user_id' => $toUserId,
            'body' => request('body'),
            'dialog_id' => $dialogId
        ]);
        return back();
    }
}

第四十章私信通知

 php artisan make:notification NewMessageNotification

<?php
// app/Notifications/NewMessageNotification.php
namespace App\Notifications;

use App\Models\Message;
use Illuminate\Notifications\Notification;

class NewMessageNotification extends Notification
{
   public $message;

   public function __construct(Message $message)
   {
       $this->message = $message;
   }

   public function via()
   {
       return ['database'];
   }

   public function toDatabase()
   {
        return [
            'name' => $this->message->fromUser->name,
            'dialog' => $this->message->dialog_id,
        ];
   }
}

控制器

<?php
// app/Http/Controllers/InboxController.php
public function store($dialogId)
   {
       $message = $this->message->getStingleMessageBy($dialogId);
       $toUserId = $message->from_user_id === Auth::id() ? $message->to_user_id : $message->from_user_id;
       $newMessage = $this->message->create([
           'from_user_id' => Auth::id(),
           'to_user_id' => $toUserId,
           'body' => request('body'),
           'dialog_id' => $dialogId
       ]);
       $newMessage->toUser->notify(new NewMessageNotification($newMessage));
       return back();
   }

视图

<?php
// resources/views/notifications/new_message_notification.blade.php
<li class="notifications">
   <a href="/inbox/{{$notification->data['dialog']}}">
       {{ $notification->data['name'] }} 给你发了一条私信
   </a>
</li>

第四十一章 notifications 已读

路由

# routes/web.php
Route::get('notifications/{notification}','NotificationsController@show');

控制器

<?php
// app/Http/Controllers/NotificationsController.php
public function show(DatabaseNotification $notification)
   {
       $notification->markAsRead();
       return redirect(\Request::query('redirect_url'));
   }

视图

<?php
// resources/views/notifications/new_message_notification.blade.php
<li class="notifications {{ $notification->unread() ? 'unread' : ' ' }}">
   <a href="/notifications/{{$notification->id}}?redirect_url=https://www.bg7pbp.com/inbox/{{$notification->data['dialog']}}">
       {{ $notification->data['name'] }} 给你发了一条私信
   </a>
</li>

第四十二章上传头像组件

路由

<?php
// routes/web.php
Route::get('avatar','UsersController@avatar');

控制器

php artisan make:controller UsersController

<?php
// app/Http/Controllers/UsersController.php
class UsersController extends Controller
{
   public function avatar()
   {
       return view('users.avatar');
   }
}

视图

<?php
// resources/views/users/avatar.blade.php
@extends('layouts.app')

@section('content')
   <div class="container">
       <div class="row">
           <div class="col-md-8 col-md-offset-2">
               <div class="panel panel-default">
                   <div class="panel-heading">更换头像</div>
                   <div class="panel-body">
                       <user-avatar avatar="{{ url('images',Auth::user()->avatar) }}" ></user-avatar>
                   </div>
               </div>
           </div>
       </div>
   </div>
@endsection

vue 组件

http://github.com/dai-siki/vue-image-crop-upload

yarn add vue-image-crop-upload babel-polyfill

<?php
// /resources/assets/js/app.js
Vue.component('user-avatar', require('./components/Avatar.vue'));

<!-- resources/assets/js/components/Avatar.vue -->
<template>
    <div>
        <my-upload field="img"
                   @crop-success="cropSuccess"
                   @crop-upload-success="cropUploadSuccess"
                   @crop-upload-fail="cropUploadFail"
                   v-model="show"
                   :width="300"
                   :height="300"
                   url="/upload"
                   :params="params"
                   :headers="headers"
                   img-format="png"></my-upload>
        <img :src="imgDataUrl" width="48">
        <a class="btn" @click="toggleShow">设置头像</a>
    </div>
</template>

<script>
    import 'babel-polyfill'; // es6 shim
    import myUpload from 'vue-image-crop-upload';
    export default {
        props:['avatar'],
        data() {
            return {
                show: false,
                params: {
                    token: '123456798',
                    name: 'avatar'
                },
                headers: {
                    smail: '*_~'
                },
                imgDataUrl: this.avatar
            }
        },
        components: {
            'my-upload': myUpload
        },
        methods: {
            toggleShow() {
                this.show = !this.show;
            },
            cropSuccess(imgDataUrl, field){
                console.log('-------- crop success --------');
                this.imgDataUrl = imgDataUrl;
            },
            cropUploadSuccess(jsonData, field){
                console.log('-------- upload success --------');
                console.log(jsonData);
                console.log('field: ' + field);
            },
            cropUploadFail(status, field){
                console.log('-------- upload fail --------');
                console.log(status);
                console.log('field: ' + field);
            }
        }
    }
</script>

yarn run dev

第四十三章头像上传到服务器

路由

<?php
// routes/web.php
Route::get('avatar','UsersController@avatar');

控制器

<?php
// app/Http/Controllers/UsersController.php
public function changeAvatar(Request $request)
   {
       $file = $request->file('img');
       $filename = md5(time().user()->id).'.'.$file->getClientOriginalExtension();
       $file->move(public_path('avatars'),$filename);
       user()->avatar = asset('avatars/'.$filename);
       user()->save();
       return ['url' => user()->avatar];
   }

vue 组件

<!-- resources/assets/js/components/Avatar.vue -->
<template>
    <div style="text-align: center;">
        <my-upload field="img"
                   @crop-success="cropSuccess"
                   @crop-upload-success="cropUploadSuccess"
                   @crop-upload-fail="cropUploadFail"
                   v-model="show"
                   :width="300"
                   :height="300"
                   url="/avatar"
                   :params="params"
                   :headers="headers"
                   img-format="png"></my-upload>
        <img :src="imgDataUrl" style="width: 80px;">
        <div style="margin-top: 20px;">
            <button class="btn btn-default" @click="toggleShow">设置头像</button>
        </div>
    </div>
</template>

<script>
    import 'babel-polyfill';
    import myUpload from 'vue-image-crop-upload';

    export default {
        props:['avatar','token'],
        data() {
            return {
                show: false,
                params: {
                    name: 'img'
                },
                headers: {
                    smail: '*_~',
                    'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
                },
                imgDataUrl: this.avatar
            }
        },
        components: {
            'my-upload': myUpload
        },
        methods: {
            toggleShow() {
                this.show = !this.show;
            },
            cropSuccess(imgDataUrl, field){
                this.imgDataUrl = imgDataUrl;
            },
            cropUploadSuccess(response, field){
                this.imgDataUrl = response.url
                this.toggleShow()
            },
            cropUploadFail(status, field){
                console.log('-------- upload fail --------');
                console.log(status);
                console.log('field: ' + field);
            }
        }
    }
</script>

yarn run dev

第四十四章头像上传到七牛

安装扩展包

https://github.com/overtrue/laravel-filesystem-qiniu

composer require "overtrue/laravel-filesystem-qiniu" -vvv

<?php
// config/app.php
'providers' => [
    // Other service providers...
    Overtrue\LaravelFilesystem\Qiniu\QiniuStorageServiceProvider::class,
],

<?php
// config/filesystems.php
return [
   'disks' => [
        //...
        'qiniu' => [
           'driver'     => 'qiniu',
           'access_key' => env('QINIU_ACCESS_KEY', 'xxxxxxxxxxxxxxxx'),
           'secret_key' => env('QINIU_SECRET_KEY', 'xxxxxxxxxxxxxxxx'),
           'bucket'     => env('QINIU_BUCKET', 'test'),
           'domain'     => env('QINIU_DOMAIN', 'xxx.clouddn.com'), // or host: https://xxxx.clouddn.com
        ],
        //...
    ]
];

控制器

<?php
// app/Http/Controllers/UsersController.php
public function changeAvatar(Request $request)
   {
       $file = $request->file('img');
       $filename = 'avatars/'.md5(time().user()->id).'.'.$file->getClientOriginalExtension();

       Storage::disk('qiniu')->writeStream($filename,fopen($file->getRealPath(),'r'));
       user()->avatar = 'http://'.config('filesystems.disks.qiniu.domain').'/'.$filename;

       user()->save();
       return ['url' => user()->avatar];
   }

第四十五章实现修改密码

路由

<?php
// routes/web.php
Route::get('password','PasswordController@password');
Route::post('password/update','PasswordController@update');

验证密码

php artisan make:request ChangePasswordRequest

<?php
// app/Http/Requests/ChangePasswordRequest.php
namespace App\Http\Requests;
use Illuminate\Foundation\Http\FormRequest;
class ChangePasswordRequest extends FormRequest
{
    public function authorize()
    {
        return true;
    }

    public function rules()
    {
        return [
            'old_password' => 'required|min:6',
            'password' => 'required|min:6|confirmed',
        ];
    }

    public function messages()
    {
        return [
            'old_password.required' => '原始密码不能为空',
            'old_password.min' => '原始密码不能少于6个字符',
            'password.required' => '新始密码不能为空',
            'password.min' => '新密码不能少于6个字符',
            'password.confirmed' => '两次输入新密码不符',
        ];
    }
}

控制器

php artisan make:controller PasswordController

<?php
// app/Http/Controllers/PasswordController.php
namespace App\Http\Controllers;
use Hash;
use App\Http\Requests\ChangePasswordRequest;
class PasswordController extends Controller
{
    public function password()
    {
        return view('users.password');
    }

    public function update(ChangePasswordRequest $request)
    {
        if(Hash::check($request->get('old_password'),user()->password)) {
            user()->password = bcrypt($request->get('password'));
            user()->save();
            flash('密码修改成功','success');
            return back();
        }
        flash('密码修改失败','danger');
        return back();
    }
}

视图

<?php
// resources/views/users/password.blade.php
@extends('layouts.app')

@section('content')
    <div class="container">
        <div class="row">
            <div class="col-md-8 col-md-offset-2">
                <div class="panel panel-default">
                    <div class="panel-heading">修改密码</div>
                    <div class="panel-body">
                        @include('flash::message')
                        <form class="form-horizontal" role="form" method="POST" action="/password/update">
                            {{ csrf_field() }}
                            <div class="form-group{{ $errors->has('old_password') ? ' has-error' : '' }}">
                                <label for="old_password" class="col-md-4 control-label">原始密码</label>
                                <div class="col-md-6">
                                    <input id="old_password" type="password" class="form-control" name="old_password" value="{{ old('old_password') }}" required>
                                    @if ($errors->has('old_password'))
                                        <span class="help-block">
                                        <strong>{{ $errors->first('old_password') }}</strong>
                                    </span>
                                    @endif
                                </div>
                            </div>
                            <div class="form-group{{ $errors->has('password') ? ' has-error' : '' }}">
                                <label for="password" class="col-md-4 control-label">输入新密码</label>
                                <div class="col-md-6">
                                    <input id="password" type="password" class="form-control" name="password" required>
                                    @if ($errors->has('password'))
                                        <span class="help-block">
                                        <strong>{{ $errors->first('password') }}</strong>
                                    </span>
                                    @endif
                                </div>
                            </div>
                            <div class="form-group">
                                <label for="password-confirm" class="col-md-4 control-label">确认新密码</label>
                                <div class="col-md-6">
                                    <input id="password-confirm" type="password" class="form-control" name="password_confirmation" required>
                                </div>
                            </div>
                            <div class="form-group">
                                <div class="col-md-6 col-md-offset-4">
                                    <button type="submit" class="btn btn-primary btn-block">
                                        更改密码
                                    </button>
                                </div>
                            </div>
                        </form>
                    </div>
                </div>
            </div>
        </div>
    </div>
@endsection

第四十六章用户个人设置

路由

<?php
// routes/web.php
Route::get('setting','SettingController@index');
Route::post('setting','SettingController@store');

控制器

php artisan make:controller SettingController

<?php
// app/Http/Controllers/SettingController.php
namespace App\Http\Controllers;

use Illuminate\Http\Request;

class SettingController extends Controller
{
   public function index()
   {
       return view('users.setting');
   }

   public function store(Request $request)
   {
       $settings = array_merge(user()->settings,array_only($request->all(),['city','bio']));
       user()->update(['settings' => $settings]);
       return back();
   }
}

模型

<?php
// app/Models/User.php
protected $fillable = [
   'settings',
];

protected $casts = [
   'settings' => 'array'
];

默认值

<?php
// app/Http/Controllers/Auth/RegisterController.php
$user =  User::create([
   'settings' => ['city' => ''],
]);

视图

<?php
// /resources/views/users/setting.blade.php
@extends('layouts.app')

@section('content')
   <div class="container">
       <div class="row">
           <div class="col-md-8 col-md-offset-2">
               <div class="panel panel-default">
                   <div class="panel-heading">设置个人信息</div>
                   <div class="panel-body">
                       <form class="form-horizontal" role="form" method="POST" action="/setting">
                           {{ csrf_field() }}
                           <div class="form-group{{ $errors->has('city') ? ' has-error' : '' }}">
                               <label for="city" class="col-md-4 control-label">现居城市</label>
                               <div class="col-md-6">
                                   <input id="city" type="text" class="form-control" name="city" value="{{ user()->settings['city'] }}"  required>
                                   @if ($errors->has('city'))
                                       <span class="help-block">
                                       <strong>{{ $errors->first('city') }}</strong>
                                   </span>
                                   @endif
                               </div>
                           </div>
                           <div class="form-group{{ $errors->has('city') ? ' has-error' : '' }}">
                               <label for="bio" class="col-md-4 control-label">个人简介</label>
                               <div class="col-md-6">
                                   <textarea id="bio" type="text" class="form-control" name="bio"  required>{{ user()->settings['bio'] }}</textarea>
                                   @if ($errors->has('bio'))
                                       <span class="help-block">
                                       <strong>{{ $errors->first('bio') }}</strong>
                                   </span>
                                   @endif
                               </div>
                           </div>
                           <div class="form-group">
                               <div class="col-md-6 col-md-offset-4">
                                   <button type="submit" class="btn btn-primary btn-block">
                                       更新资料
                                   </button>
                               </div>
                           </div>
                       </form>
                   </div>
               </div>
           </div>
       </div>
   </div>
@endsection

第四十七章重构用户设置

控制器

<?php
// app/Http/Controllers/SettingController.php
public function store(Request $request)
   {
       user()->settings()->merge($request->all());
       return back();
   }

模型

<?php
// app/Models/User.php
public function settings()
{
   return new Setting($this);
}

<?php
namespace App\Models;
class Setting
{
   protected $allowed = ['city','bio'];
   protected $user;

   public function __construct(User $user)
   {
       $this->user = $user;
   }

   public function merge(array $attributes)
   {
       $settings = array_merge($this->user->settings,array_only($attributes,$this->allowed));

       return $this->user->update(['settings' => $settings]);
   }
}

阿里云邮件推送 Package

Tue, 15 Aug 2017 00:00:00 +0800

邮件推送（DirectMail）是一款简单高效的电子邮件发送服务，它构建在可靠稳定的阿里云基础之上，帮助您快速、精准地实现事务邮件、通知邮件和批量邮件的发送。邮件推送历经两年双11考验，在发送速度、系统稳定性和到达率上表现优异；提供丰富的接口和灵活的使用方式，为企业和开发者解决邮件投递的难题，用户无需自建邮件服务器，开通服务即可享受阿里云优质的邮件服务，获得邮件投递的最佳实践。

DirectMail 官网： https://www.aliyun.com/product/directmail

一、安装方法

项目地址：

https://github.com/wangyan/directmail

在项目目录下执行

composer require wang_yan/directmail:dev-master

二、配置方法

修改 config/app.php，添加服务提供者

<?php
'providers' => [
   // 添加这行
    WangYan\DirectMail\DirectMailTransportProvider::class,
];

在 .env 中配置你的密钥，并修改邮件驱动为 directmail

MAIL_DRIVER=directmail

DIRECT_MAIL_KEY=     # AccessKeyId
DIRECT_MAIL_SECRET=  # AccessSecret

三、基本使用

详细用法请参考 laravel 文档：

http://d.laravel-china.org/docs/5.4/mail

使用演示：

<?php
// routes\web.php
Route::get('/email', function(){
    $data = [
        'url'  => 'https://laravel.com',
        'name' => 'laravel'
    ];

    Mail::send('emails.register', $data, function ($message) {
        $message->from('us@example.com', 'Laravel');
        $message->to('foo@example.com');
        $message->subject('Hello World');
    });
});

编辑邮件模板

<?php
resources\views\emails\register.blade.php

四、简单实例

演示怎样发送注册验证邮件，首先初始化

php artisan make:auth
php artisan migrate

修改 RegisterController 控制器

<?php 
// app\Http\Controllers\Auth\RegisterController.php

    use Illuminate\Support\Facades\Mail;

    protected function create(array $data)
    {
        $user =  User::create([
            'name' => $data['name'],
            'email' => $data['email'],
            'confirmation_token' => str_random(40),
            'password' => bcrypt($data['password']),
        ]);

        $this->sendVerifyEmailTo($user);
        return $user;
    }

    private function sendVerifyEmailTo($user)
    {
        $data = [
            'name' => $user->name,
            'url'  => Route('email.verify',['token' => $user->confirmation_token])
        ];

        Mail::send('emails.register', $data, function ($message) use ($user) {
            $message->from('service@dm.mail.wangyan.org', env('APP_NAME','Laravel'));
            $message->to($user->email);
            $message->subject('请验证您的 Email 地址');
        });
    }

修改 User 模型

<?php 
// app\User.php
    protected $fillable = [
        'name', 'email', 'password','confirmation_token'
    ];

增加邮件模板

vim resources\views\emails\register.blade.php

增加路由

<?php
// routes\web.php
Route::get('/email/verify/{token}', 'EmailController@verify')->name('email.verify');

增加控制器

php artisan make:controller EmailController

编辑控制器

<?php
class EmailController extends Controller
{
    /**
     * @param $token
     * @return \Illuminate\Http\RedirectResponse|\Illuminate\Routing\Redirector
     */
    function verify($token)
    {
        $user = User::where('confirmation_token',$token)->first();

        if(is_null($user)){
            return redirect('/');
        }

        $user->is_active = 1;

        $user->confirmation_token= str_random(40);
        $user->save();

        return redirect('/home');
    }
}

Laravel 5 开发 API 笔记

Tue, 01 Aug 2017 00:00:00 +0800

第1章填充测试数据

1.1 生成数据库表

http://d.laravel-china.org/docs/5.4/migrations

创建数据库表

php artisan make:migration create_lessons_table --create=lessons

创建模型和控制器（这里将模型放到 Models 目录下）

php artisan make:controller LessonController -m Models\\Lesson

修改 migrate

<?php
// database\migrations\2017_07_01_182454_create_lessons_table.php
Schema::create('lessons', function (Blueprint $table) {
    $table->increments('id');
    $table->string('title');
    $table->text('body');
    $table->boolean('free');
    $table->timestamps();
});

解决导入错误

<?php
// app\Providers\AppServiceProvider.php

use Illuminate\Support\Facades\Schema;

public function boot()
{
    Schema::defaultStringLength(191);
}

生成数据表

php artisan migrate

1.2 Eloquent 模型工厂填充数据

http://d.laravel-china.org/docs/5.4/database-testing#writing-factories

修改 ModelFactory.php

<?php
// database\factories\ModelFactory.php
$factory->define(App\Models\Lesson::class, function (Faker\Generator $faker) {
    static $password;

    return [
        'title' => $faker->sentence,
        'body' => $faker->paragraph,
        'free' => $faker->boolean(),
    ];
});

方法一：使用 tinker 生成数据

php artisan tinker
>>>factory(App\Models\Lesson::class,60)->create();
>>> quit

方法二：编写 Seeders 生成数据

http://d.laravel-china.org/docs/5.4/seeding

php artisan make:seeder LessonsTableSeeder

<?php
//  database\seeds\LessonsTableSeeder.php
    public function run()
    {
        factory(App\Lesson::class, 50)->create();
    }

php artisan db:seed --class=LessonsTableSeeder

第2章初步实现 API 系统

2.1 注册路由

http://d.laravel-china.org/docs/5.4/routing

<?php
// routes\api.php
Route::group(['prefix'=>'v1'], function (){
    Route::resource('lesson','LessonController');
});

查看已注册的路由

# 注意这里不是 api:route
php artisan route:list

2.2 编辑控制器

http://d.laravel-china.org/docs/5.4/controllers
http://d.laravel-china.org/docs/5.4/eloquent

<?php
// app\Http\Controllers\LessonController.php
    public function index()
    {
        return Lesson::all();
    }

    public function show(Lesson $lesson)
    {
        // 旧版本
        //return Lesson::findOrfail($id);
        return $lesson;
    }

访问：http://api.dev/api/v1/lesson 和 http://api.dev/api/v1/lesson/1

第3章 API 字段映射

3.1 附加状态到 Response 响应

http://d.laravel-china.org/docs/5.4/responses

<?php
// app\Http\Controllers\LessonController.php
    public function index()
    {
        return \Response::json([
            'status'=>'Success',
            'status_code'=>'200',
            'data'=>Lesson::all()->toArray()
        ]);
    }

    public function show(Lesson $lesson)
    {
        return \Response::json([
            'status'=>'Success',
            'status_code'=>'200',
            'data'=>$lesson->toArray()
        ]);
    }

3.2 隐藏数据库字段结构

http://php.net/manual/zh/function.array-map.php

<?php
// app\Http\Controllers\LessonController.php
    public function index()
    {
        $lessons = Lesson::all();
        return \Response::json([
            'status'=>'Success',
            'status_code'=>'200',
            'data'=>$this->transformCollection($lessons)
        ]);
    }

    public function show(Lesson $lesson)
    {
        return \Response::json([
            'status'=>'Success',
            'status_code'=>'200',
            'data'=>$this->transform($lesson->toArray())
        ]);
    }
    
    public function transformCollection($lessons)
    {
        return array_map([$this, 'transform'],$lessons->toArray());
    }

    public function transform($lessons)
    {
        return [
            'title'=>$lessons['title'],
            'content'=>$lessons['body'],
            'is_free'=>(boolean) $lessons['free']
        ];
    }

第4章重构 API 代码

<?php
// app\Transformer\LessonTransfromer.php
namespace App\Transformer;

class LessonTransfromer extends Transformer
{
    public function transform($lessons)
    {
        return [
            'title'=>$lessons['title'],
            'content'=>$lessons['body'],
            'is_free'=>(boolean) $lessons['free']
        ];
    }
}

<?php
// app\Transformer\Transformer.php
namespace App\Transformer;

abstract class Transformer
{
    public function transformCollection($items)
    {
        return array_map([$this, 'transform'],$items->toArray());
    }

    public abstract function transform($items);
}

<?php
// app\Http\Controllers\LessonController.php
use App\Transformer\LessonTransfromer;

class LessonController extends Controller
{
    protected $lessonTransfromer;

    // 依赖注入
    public function __construct(LessonTransfromer $lessonTransfromer)
    {
        $this->lessonTransfromer = $lessonTransfromer;
    }

    public function index()
    {
        $lessons = Lesson::all();
        return \Response::json([
            'status'=>'Success',
            'status_code'=>'200',
            'data'=>$this->lessonTransfromer->transformCollection($lessons)
        ]);
    }

    public function show(Lesson $lesson)
    {
        return \Response::json([
            'status'=>'Success',
            'status_code'=>'200',
            'data'=>$this->lessonTransfromer->transform($lesson->toArray())
        ]);
    }
}

第5章处理错误返回

http://d.laravel-china.org/docs/5.4/errors

生成 ApiController

php artisan make:controller ApiController

<?php
// App\Http\Controllers\ApiController
class ApiController extends Controller
{

    protected $statusCode = 200;

    public function getStatusCode()
    {
        return $this->statusCode;
    }

    public function setStatusCode($statusCode)
    {
        $this->statusCode = $statusCode;
        return $this;
    }

    public function responseNotFound($message = 'Not Found')
    {
        return $this->setStatusCode(404)->responseError($message);
    }

    public function responseError($message)
    {
        return $this->response([
            'status'=>'failed',
            'error'=>[
                'status_code'=>$this->getStatusCode(),
                'message'=>$message
            ]
        ]);
    }

    public function response($data)
    {
        return \Response::json($data);
    }
}

<?php
// LessonController.php
class LessonController extends ApiController
{
    public function index()
    {
        $lessons = Lesson::all();
        return $this->response([
            'status'=>'Success',
            'status_code'=>'200',
            'data'=>$this->lessonTransfromer->transformCollection($lessons)
        ]);
    }

    public function show(Lesson $lesson)
    {
        return $this->response([
            'status'=>'Success',
            'status_code'=>'200',
            'data'=>$this->lessonTransfromer->transform($lesson->toArray())
        ]);
    }
}

<?php
// app\Exceptions\Handler.php
    use Illuminate\Database\Eloquent\ModelNotFoundException as ModelNotFoundException;
    public function render($request, Exception $exception)
    {
        if ($exception instanceof ModelNotFoundException) {
            $api = new \App\Http\Controllers\ApiController;
            return $api->responseNotFound('404 not found');
        }
        return parent::render($request, $exception);
    }

第6章对请求API的用户认证

生成用户验证模块

php artisan make:auth

<?php
// app\Http\Controllers\Auth\RegisterController.php
use App\Models\User;

编辑控制器

<?php
// app\Http\Controllers\LessonController.php
    public function __construct(LessonTransfromer $lessonTransfromer)
    {
        $this->middleware('auth.basic',['only'=>['index', 'store']]);
    }

    public function store(Request $request)
    {
        if (! $request->get('title') or ! $request->get('body') or ! $request->get('free')){
            return $this->setStatusCode(422)->response('validata fails');
        }

        Lesson::create($request->all());

        return $this->setStatusCode(201)->response([
            'status'=>'success',
            'message'=>'lesson created'
        ]);
    }

<?php
// app\Models\Lesson.php
class Lesson extends Model
{
    protected $fillable = ['title','body','free'];
}

最后使用 postman 调试 http://api.dev/api/v1/lesson/

第7章引入 Dingo API 和 JWT

7.1 引入 Dingo API

官方： https://github.com/dingo/api
中文： https://github.com/liyu001989/dingo-api-wiki-zh

<?php
// api\composer.json
"require": {
    "dingo/api": "1.0.*@dev"
}

composer update

# config\app.php
'providers' => [
    Dingo\Api\Provider\LaravelServiceProvider::class,
]

添加 Facades

# config\app.php
'aliases' => [
    'API' => Dingo\Api\Facade\API::class,
    'DingoRoute' => Dingo\Api\Facade\Route::class,
]

发布配置文件

php artisan vendor:publish --provider="Dingo\Api\Provider\LaravelServiceProvider"

7.2 引入 JWT

主页 https://github.com/tymondesigns/jwt-auth/
安装文档 https://github.com/tymondesigns/jwt-auth/wiki/Installation

<?php
// api\composer.json
"require": {
    "tymon/jwt-auth": "0.5.*"
}

composer update

# config\app.php
'providers' => [
    Tymon\JWTAuth\Providers\JWTAuthServiceProvider::class,
]

添加 Facades

# config\app.php
'aliases' => [
    'JWTAuth' => Tymon\JWTAuth\Facades\JWTAuth::class,
    'JWTFactory' => Tymon\JWTAuth\Facades\JWTFactory::class,
]

发布配置文件

php artisan vendor:publish --provider="Tymon\JWTAuth\Providers\JWTAuthServiceProvider"

生成key

php artisan jwt:generate

第8章 Dingo API 初探

8.1 Dingo API 配置

https://github.com/liyu001989/dingo-api-wiki-zh/blob/master/Configuration.md

# api.dev\.env
API_STANDARDS_TREE=vnd
API_PREFIX=api
API_VERSION=v1
API_DEBUG=true

https://github.com/liyu001989/dingo-api-wiki-zh/blob/master/Authentication.md

# config\api.php

    // 仅供参考
    'auth' => [
        'basic' => function($app) {
            return new Dingo\Api\Auth\Provider\Basic($app['auth']);
        },
        'jwt' => function ($app){
            return new Dingo\Api\Auth\Provider\JWT($app['Tymon\JWTAuth\JWTAuth']);
        },
    ],

    'auth' => [
        'basic' => 'Dingo\Api\Auth\Provider\Basic',
        'jwt' => 'Dingo\Api\Auth\Provider\JWT',
    ],

添加路由中间件

# app\Http\Kernel.php
    protected $routeMiddleware = [
        'jwt.auth' => \Tymon\JWTAuth\Middleware\GetUserFromToken::class,
        'jwt.refresh' => \Tymon\JWTAuth\Middleware\RefreshToken::class,
    ];

8.2 Dingo API 路由

这里的路由就是 Dingo API Endpoints ，端点是路由的另一种说法,详细用法见下面文档。

https://github.com/dingo/api/wiki/Creating-API-Endpoints

请注意：v1 不能乱用，它已经在你的环境配置中定义好了。 API_VERSION=v1

<?php
$api = app('Dingo\Api\Routing\Router');

$api->version('v1', function ($api) {
    $api->group(['namespace' => 'App\Api\Controllers'], function ($api) {
        $api->get('lessons', 'LessonController@index');
    });
});

查看路由,注意区别 route:lists

php artisan api:route

地址是 /api/lessons 没有 v1 前缀，访问 http://api.dev/api/lessons/ 看到已经正常。

8.2 Dingo API 响应

https://github.com/dingo/api/wiki/Responses

下面例子演示如何使用响应生成器 (Response Builder)

8.2.1 创建 BaseController

为了使用 Dingo\Api\Routing\Helpers trait 首先要创建基础控制器

<?php
// app\Api\Controllers\BaseController.php
namespace App\Api\Controllers;

use App\Http\Controllers\Controller;
use Dingo\Api\Routing\Helpers;

class BaseController extends Controller
{
    use Helpers;
}

8.2.2 响应一个数组

意思是直接以数组形式返回 $lessons 原始数据

创建 LessonController 继承上面的 BaseController

<?php
// app\Api\Controllers\LessonController.php
namespace App\Api\Controllers;

use App\Models\Lesson;

class LessonController extends BaseController
{
    public function index()
    {
        $lessons =  Lesson::all();
        return $this->response->array($lessons->toArray());
    }
}

http://api.dev/api/lessons

8.2.3 响应一个元素

通过实例化 LessonTransformer 来处理 $lesson 数据，然后再返回经过处理的数据。

首先，新建 LessonController 类

<?php
// app\Api\Controllers\LessonController.php
namespace App\Api\Controllers;

use App\Api\Transformer\LessonTransformer;
use App\Models\Lesson;

class LessonController extends BaseController
{
    /**
     * 通过实例化 LessonTransformer 来处理 $lesson 数据，然后再返回
     * LessonTransformer 类必须继承 TransformerAbstract 抽象类
     * 因为 TransformerAbstract 类提供了 item 和 collection 方法
     * 此外 LessonTransformer 类中必须有 transform 方法
     */
    public function show($id)
    {
        $lesson = Lesson::findOrFail($id);
        return $this->response->item($lesson, new LessonTransformer);
    }

}

接着，新建 LessonTransformer ，命名空间是 App\Api\Transformer

<?php
// app\Api\Transformer\LessonTransformer.php

namespace App\Api\Transformer;

use App\Models\Lesson;
use League\Fractal\TransformerAbstract;

class LessonTransformer extends TransformerAbstract
{
    public function transform(Lesson $lesson)
    {
        return [
            'title'=>$lesson['title'],
            'content'=>$lesson['body'],
            'is_free'=>(boolean) $lesson['free']
        ];
    }
}

8.2.4 响应一个元素集合

collection 会自动调用 new LessonTransformer() 中的 transform 方法

意思就是上面 LessonTransformer 类中必须有 transform 方法

<?php
// app\Api\Controllers\LessonController.php

namespace App\Api\Controllers;

use App\Api\Transformer\LessonTransformer;
use App\Models\Lesson;

class LessonController extends BaseController
{
    public function index()
    {
        $lessons  = Lesson::all();
        return $this->collection($lessons,new LessonTransformer());
    }
}

8.2.5 响应分页

<?php
// app\Api\Controllers\LessonController.php

namespace App\Api\Controllers;

use App\Api\Transformer\LessonTransformer;
use App\Lesson;

class LessonController extends BaseController
{
    public function index()
    {
        $lessons  = Lesson::paginate(10);
        return $this->paginator($lessons, new LessonTransformer);
    }
}

第9章开始使用 JWT

9.1 路由

<?php
// routes\api.php
$api = app('Dingo\Api\Routing\Router');

$api->version('v2', function ($api) {
    $api->group(['namespace' => 'App\Api\Controllers'], function ($api) {
        $api->post('user/login', 'AuthController@authenticate');
        $api->post('user/register', 'AuthController@register');
        $api->group(['middleware' => 'jwt.auth'], function ($api) {
            $api->get('lessons', 'LessonController@index');
            $api->get('lesson/{id}', 'LessonController@show');
        });
    });
});

9.2 创建 AuthController

定义 user 模型位置

<?php
// api\config\jwt.php
 'user' => 'App\Models\User',

创建 AuthController，注意这里 use 了 Request

<?php
// app\Api\Controllers\AuthController.php
namespace App\Api\Controllers;

use App\Models\User;
// 注意这里 use 了  Request
use Illuminate\Http\Request;
use JWTAuth;
use Tymon\JWTAuth\Exceptions\JWTException;

class AuthController extends BaseController
{
    public function authenticate(Request $request)
    {
        // 返回请求中 email 和 password 的值
        $credentials = $request->only('email', 'password');

        try {
            // attempt to verify the credentials and create a token for the user
            if (! $token = JWTAuth::attempt($credentials)) {
                return response()->json(['error' => 'invalid_credentials'], 401);
            }
        } catch (JWTException $e) {
            // something went wrong whilst attempting to encode the token
            return response()->json(['error' => 'could_not_create_token'], 500);
        }

        // 登录成功后，以 json 形式返回 token 值
        return response()->json(compact('token'));
    }

    public function register(Request $request)
    {
        $newUser = [
            'email' => $request->get('email'),
            'name' =>  $request->get('name'),
            'password' =>  $request->get('password'),
        ];

        $user = User::create($newUser);
        $token = JWTAuth::fromUser($user);
        // 注册成功后返回 token
        return response()->json(compact('token'));
    }
}

9.3 调试

登录调试：post 请求，body 携带 emial 和 password 参数

http://api.dev/api/user/login

注册调试：post 请求，body 携带 emial、name 和 password 参数

http://api.dev/api/user/register

先登录获取 token ，然后显示内容

http://api.dev/api/lesson/1?token=xxx http://api.dev/api/lessons?token=xxx

第10章 JWT 其他用法

10.1 根据 token 返回用户信息

路由

<?php
// routes\api.php
   $api->group(['middleware' => 'jwt.refresh'], function ($api) {
       $api->get('user/info', 'AuthController@getAuthenticatedUser');
   });

AuthController

<?php
//app\Api\Controllers\AuthController.php

use Tymon\JWTAuth\Exceptions\JWTException;
use Tymon\JWTAuth\Exceptions\TokenExpiredException;
use Tymon\JWTAuth\Exceptions\TokenInvalidException;

    public function getAuthenticatedUser()
    {
        try {
            if (! $user = JWTAuth::parseToken()->authenticate()) {
                return response()->json(['user_not_found'], 404);
            }
        } catch (TokenExpiredException $e) {
            return response()->json(['token_expired'], $e->getStatusCode());
        } catch (TokenInvalidException $e) {
            return response()->json(['token_invalid'], $e->getStatusCode());
        } catch (JWTException $e) {
            return response()->json(['token_absent'], $e->getStatusCode());
        }

        return response()->json(compact('user'));
    }

调试：http://api.dev/api/user/info?token=xx

10.2 解决请求字段与数据库不一致问题

注意 password 没有变

<?php
//app\Api\Controllers\AuthController.php
        $credentials = [
            'user_email' => $request->get('user_email'),
            'password' => $request->get('user_password'),
        ];

增加 getAuthPassword 方法

<?php
// api\app\Models\User.php
    public function getAuthPassword()
    {
        return $this->user_password;
    }

资源：

https://coding.net/u/wangyan/p/laravel-api/git https://www.codecasts.com/series/dive-into-restful-api-with-laravel

CentOS 升级 OpenSSL 和 OpenSSH

Sat, 15 Jul 2017 00:00:00 +0800

一、查看当前版本

ssh -V
#OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017 (7.4.1708)

openssl version
#OpenSSL 1.0.2k-fips  26 Jan 2017 (7.4.1708)

查看已安装的RPM包 (可选，仅参考)

rpm -qa | grep openssl
#openssl-libs-1.0.2k-16.el7.x86_64
#openssl-1.0.2k-16.el7.x86_64
#openssl-devel-1.0.2k-16.el7.x86_64

rpm -qa | grep openssh
#openssh-7.4p1-16.el7.x86_64
#openssh-server-7.4p1-16.el7.x86_64
#openssh-clients-7.4p1-16.el7.x86_64

二、安装依赖

yum install -y wget curl gcc gcc-c++ make zlib-devel pam-devel tcp_wrappers tcp_wrappers-devel

安装Perl (可选，仅参考)

via http://www.cpan.org/src/

wget https://www.cpan.org/src/5.0/perl-5.28.1.tar.gz && \
tar -xzf perl-5.28.1.tar.gz && \
cd perl-5.28.1 && \
./Configure -des -Dprefix=/usr/local/perl && \
make && \
make install
perl -v

三、安装 OpenSSL

OpenSSL 默认安装在 /usr/local/ssl，与旧版不冲突，建议不要去卸载旧版，很多软件都依赖旧版的 SSL 库，否则你得要花更多时间去处理相关错误。

3.1 卸载现有版本（仅参考，不需要卸载）

rpm -e `rpm -qa | grep openssh`
rpm -e `rpm -qa | grep openssl` --nodeps

若误卸载了，可将下面文件复制到 /usr/lib64/

libcrypto.so.10 libcrypto.so.1.0.1e libssl.so.10 libssl.so.1.0.1e

3.2 安装 OpenSSL

注意 openssl-1.1.x 新版不兼容 openssh ，请用回最新的的 1.0.x 版本

wget https://www.openssl.org/source/openssl-1.0.2q.tar.gz && \
tar -zxf openssl-1.0.2q.tar.gz && \
cd openssl-1.0.2q && \
./config shared zlib && \
make depend && \
make install

3.3 替换旧版 OpenSSL

mv /usr/bin/openssl /usr/bin/openssl.backup && \
mv /usr/include/openssl /usr/include/openssl.backup

ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl && \
ln -s /usr/local/ssl/include/openssl/ /usr/include/openssl

echo '/usr/local/ssl/lib' >> /etc/ld.so.conf && ldconfig && \
/sbin/restorecon -v /usr/local/ssl/lib/libcrypto.so.1.0.0

四、安装 OpenSSH

4.1 卸载 OpenSSH 旧版本

OpenSSH 建议卸载旧版本，卸载前也可以备份一下。

# 备份
cp -r /usr/bin/ssh /usr/bin/ssh.bak && \
cp -r /usr/sbin/sshd /usr/sbin/sshd.bak && \
cp -r /usr/libexec/openssh/sftp-server /usr/libexec/openssh/sftp-server.bak && \
cp -r /etc/ssh /etc/ssh.bak

# 卸载
# yum remove -y openssh openssh-server openssh-clients
rpm -e `rpm -qa | grep openssh` --nodeps

4.2 安装 OpenSSH

wget http://ftp.eu.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.9p1.tar.gz && \
tar -zxf openssh-7.9p1.tar.gz && \
cd openssh-7.9p1 && \
./configure --prefix=/usr/local/ssh \
            --sysconfdir=/etc/ssh \
            --with-ssl-dir=/usr/local/ssl \
            --with-pam \
            --with-tcp-wrappers \
            --with-md5-passwords \
            --with-zlib=zlib && \
make && make install

echo "/usr/local/ssl/lib/" >> /etc/ld.so.conf.d/openssl.conf
ldconfig

如果出现"Your OpenSSL headers do not match your library. "
配置以下三个变量，让其指向新版本的opnessl库文件：

DEFAULT_LIBPATH=/usr/local/ssl/include/openssl:/usr/local/ssl/lib/ && \
LIBPATH=${LIBPATH:=$DEFAULT_LIBPATH}  && \
LD_LIBRARY_PATH=${LD_LIBRARY_PATH:=$DEFAULT_LIBPATH} && \
LIBRARY_PATH=${LIBRARY_PATH:=$DEFAULT_LIBPATH} && \
export LIBPATH LD_LIBRARY_PATH LIBRARY_PATH

更新系统库文件(选做)

yum -y install mlocate
updatedb

4.3 替换旧版 OpenSSH

ln -s /usr/local/ssh/bin/ssh /usr/bin/ssh && \
ln -s /usr/local/ssh/sbin/sshd /usr/sbin/sshd && \
mkdir -p /usr/libexec/openssh/ && \
ln -s /usr/local/ssh/libexec/sftp-server /usr/libexec/openssh/sftp-server

4.4 开机自启动（方法1，不推荐）

cp contrib/redhat/sshd.init /etc/init.d/sshd
sed -i 's/usr\/sbin/usr\/local\/ssh\/sbin/g' /etc/init.d/sshd
sed -i 's/usr\/bin/usr\/local\/ssh\/bin/g' /etc/init.d/sshd
chmod +x /etc/init.d/sshd
chkconfig --add sshd

systemctl reload sshd
systemctl enable sshd
systemctl restart sshd.service

4.5 开机自启动（systemd，推荐）

4.5.1 方法一：使用 `sshd.socket` 套接字

/usr/lib/systemd/system/sshd.socket

[Unit]
Description=OpenSSH Server Socket
Documentation=man:sshd(8) man:sshd_config(5)
Conflicts=sshd.service
Wants=sshd-keygen.service

[Socket]
ListenStream=0.0.0.0:22
Accept=yes

[Install]
WantedBy=sockets.target

/usr/lib/systemd/system/sshd-keygen.service

[Unit]
Description=OpenSSH Server Key Generation
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key
PartOf=sshd.service sshd.socket

[Service]
ExecStart=/usr/local/ssh/bin/ssh-keygen
Type=oneshot
RemainAfterExit=yes

/usr/lib/systemd/system/sshd@.service

配置文件，定义服务如何启动

[Unit]
Description=OpenSSH per-connection server daemon
Documentation=man:sshd(8) man:sshd_config(5)

[Service]
EnvironmentFile=-/etc/sysconfig/sshd
ExecStart=-/usr/local/ssh/sbin/sshd -i $OPTIONS
StandardInput=socket

/etc/sysconfig/sshd

# Configuration file for the sshd service.

# The server keys are automatically generated if they are missing.
# To change the automatic creation uncomment and change the appropriate
# line. Accepted key types are: DSA RSA ECDSA ED25519.
# The default is "RSA ECDSA ED25519"

# AUTOCREATE_SERVER_KEYS=""
# AUTOCREATE_SERVER_KEYS="RSA ECDSA ED25519"

# Do not change this option unless you have hardware random
# generator and you REALLY know what you are doing

# SSH_USE_STRONG_RNG=0
# SSH_USE_STRONG_RNG=1

切换至 sshd.socket 自启动服务

systemctl stop sshd.service
systemctl disable sshd.service

#systemctl daemon-reload
#cat /etc/systemd/system/sockets.target.wants/sshd.socket
systemctl enable sshd.socket
systemctl start sshd.socket

4.5.2 方法二：使用 `sshd.service` 服务

/usr/lib/systemd/system/sshd.service

[Unit]
Description=OpenSSH per-connection server daemon
Documentation=man:sshd(8) man:sshd_config(5)

[Service]
EnvironmentFile=-/etc/sysconfig/sshd
ExecStart=-/usr/local/ssh/sbin/sshd -i $OPTIONS
StandardInput=socket

切换

systemctl mask --now sshd.socket
systemctl restart sshd.service

参考文档：

五、安装 Telnet (可选，仅参考)

yum -y install xinetd telnet telnet-server

配置

vi /etc/securetty
pts/0
pts/1

关闭 selinux

vim /etc/selinux/config
SELINUX=disabled

防火墙

#默认zone为public 可以使用firewall-cmd --get-default-zone 来获取默认zone
firewall-cmd --permanent --zone=public --add-port=23/tcp
firewall-cmd --reload

自启动

systemctl enable telnet.socket && \
systemctl start telnet.socket && \
systemctl enable xinetd && \
systemctl start xinetd

telnet dmfy@192.168.10.251

最后更新：2019.02.13

参考文档：http://www.omgdba.com/how-to-enable-telnet-on-centos-7.html

Hexo 使用 Isso 评论系统

Sat, 01 Jul 2017 00:00:00 +0800

一、Isso 服务端

1.1 自定义配置文件

下面选项需要修改，更多解释请参考官方文档 Server Configuration

host 是你引用 Isso 的 JS 的网站地址，需要写全。
smtp 发送评论到你邮箱以及审核评论

vim /opt/isso/config/isso.conf

[general]
dbpath = /db/comments.db
host = https://www.wangyan.cloud/
max-age = 1d
notify = smtp

[moderation]
enabled = false
purge-after = 30d

[server]
listen = http://0.0.0.0:8080/

[smtp]
username = noreply@wangyan.org
password = xxxx
host = smtp.exmail.qq.com
port = 25
security = none
to = service@wangyan.org
from = "WangYan BLog" <noreply@wangyan.org>
timeout = 10

[guard]
enabled = true
ratelimit = 5
direct-reply = 10
reply-to-self = false
require-author = true
require-email = true

[markup]
options = strikethrough, superscript, autolink
allowed-elements = img
allowed-attributes = src

1.2 docker-compose.yml

vim /opt/isso/docker-compose.yml

isso:
    image: wonderfall/isso
    container_name: isso
    environment:
        - GID=1000
        - UID=1000
    ports:
        - "8080:8080"
    volumes:
        - /opt/isso/config:/config
        - /opt/isso/db:/db
    restart: always

最后运行 docker-compose up -d 就 OK 了。

二、Nginx 配置（选做）

为了网址好看些，比如说 isso.wangyan.org 还需要配置 Nginx

server {
    listen 80;
    server_name isso.wangyan.org;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header   Host    $host;
        proxy_set_header   X-Real-IP   $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto https;
    }
}

server {
    listen 443 ssl http2;
    server_name isso.wangyan.org;

    ssl on;
    ssl_certificate  /etc/nginx/ssl/isso.wangyan.org.pem;
    ssl_certificate_key /etc/nginx/ssl/isso.wangyan.org.key;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header   Host    $host;
        proxy_set_header   X-Real-IP   $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto https;
    }
}

三、客户端引入 Isso

3.1 一般设置

在页面的适当位置放下面一段代码

<script data-isso="https://www.wangyan.cloud/"
        data-isso-css="true"
        data-isso-reply-to-self="false"
        data-isso-require-author="true"
        data-isso-require-email="true"
        data-isso-max-comments-top="100"
        data-isso-max-comments-nested="5"
        data-isso-reveal-on-click="10"
        data-isso-avatar="true"
        data-isso-avatar-bg="#f0f0f0"
        data-isso-avatar-fg="#9abf88 #5698c4 #e279a3 #9163b6 ..."
        data-isso-vote="false"
        src="https://www.wangyan.cloud/js/embed.min.js"></script>

<section id="isso-thread"></section>

3.2 Hexo 设置

如果是 hexo 可以这样（不同主题放置方法不一样）

编辑主题配置文件 _config.yml

isso_url: //isso.wangyan.org/

编辑 layout/_partial/component/comments.ejs 加入一行

 <%- partial('isso') %>

最后引入 isso.ejs

/* layout/_partial/component/isso.ejs */

<% if (theme.isso_url){ %>
<script data-isso="<%= theme.isso_url %>"
        data-isso-css="true"
        data-isso-reply-to-self="false"
        data-isso-require-author="true"
        data-isso-require-email="true"
        data-isso-max-comments-top="100"
        data-isso-max-comments-nested="5"
        data-isso-reveal-on-click="10"
        data-isso-avatar="true"
        data-isso-avatar-bg="#f0f0f0"
        data-isso-avatar-fg="#9abf88 #5698c4 #e279a3 #9163b6 ..."
        data-isso-vote="false"
        src="<%= theme.isso_url %>js/embed.min.js"></script>

<section id="isso-thread"></section>
<% } %>

参考文档：

Docker 中安装配置 Seafile Pro

Thu, 15 Jun 2017 00:00:00 +0800

一、新建 Docker 容器（选做）

docker run -it --name seafile \
--restart=always \
-v /home/seafile:/opt/seafile \
-p 8082:8082 \
-p 10080:80 \
-p 10443:443 \
-d ubuntu:16.04 /bin/bash

更新源

sed -i 's/archive.ubuntu.com/mirrors.aliyun.com/g' /etc/apt/sources.list && \
sed -i 's/deb http:\/\/security/#deb http:\/\/security/g' /etc/apt/sources.list && \
sed -i 's/deb-src http:\/\/security/#deb-src http:\/\/security/g' /etc/apt/sources.list && \
apt-get -y update

安装有用工具

apt install -y curl wget net-tools vim

二、安装 mariadb (二进制版)

参考文档1： CentOS 从二进制版安装配置 Mariadb
参考文档2： CentOS 从 Yum 源安装配置 Mariadb

安装依赖

apt install -y libaio-dev

解压

cd /opt/seafile/ && \
tar -zxf mariadb-10.2.6-linux-glibc_214-x86_64.tar.gz && \
mv mariadb-10.2.6-linux-glibc_214-x86_64 /usr/local/mysql

新建 mysql 用户

groupadd mysql && \
useradd -g mysql -M -s /sbin/nologin mysql

安装初始化

cd /usr/local/mysql && \
./scripts/mysql_install_db --user=mysql

chown -R root . && chown -R mysql data

支持命令行运行

export PATH=$PATH:/usr/local/mysql/bin/ && \
echo 'export PATH=$PATH:/usr/local/mysql/bin/' >> .bashrc

开机启动

cp support-files/mysql.server /etc/init.d/mysql && \
update-rc.d mysql defaults && \
service  mysql start

密码及安全设置

/usr/local/mysql/bin/mysqladmin -u root password '123456' && \
/usr/local/mysql/bin/mysql_secure_installation

解决中文乱码

cp /usr/local/mysql/support-files/my-medium.cnf /etc/my.cnf && \
vim /etc/my.cnf

vim /etc/mysql/conf.d/mariadb.cnf
[client]
...
default-character-set=utf8
...
[mysql]
...
default-character-set=utf8
...
[mysqld]
...
character-set-server  = utf8
collation-server      = utf8_general_ci
character_set_server  = utf8
collation_server      = utf8_general_ci
...

官方文档：Installing MariaDB using APT

三、安装 Seafile

3.1 安装依赖

python2.7

apt-get -y install python && \
apt-get -y install python2.7 libpython2.7 python-setuptools python-imaging \
           python-ldap python-mysqldb python-memcache python-urllib3

安装 JRE

apt-get -y install openjdk-8-jre && \
ln -sf /usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java /usr/bin/

安装 pdf 全文搜索依赖

apt-get -y install poppler-utils

安装 Python 库

easy_install pip && pip install boto requests

3.2 安装 seafile

准备 seafile

mkdir -p seafile
mv seafile-pro-server_* seafile
cd seafile
tar -xzf seafile-pro-server_*
mkdir installed
mv seafile-pro-server_* installed

安装 seafile

cd seafile-pro-server-* && \
./setup-seafile-mysql.sh


Cloud
cloud.youdomain.com
/opt/seafile/seafile-data
8082
1
localhost
3306
seafile
seafile_ccnet
seafile_db
seafile_seahub

3.3 配置 seafile

vim /opt/seafile/conf/ccnet.conf
SERVICE_URL = https://cloud.youdomain.com

vim /opt/seafile/conf/seahub_settings.py
FILE_SERVER_ROOT = 'https://cloud.youdomain.com/seafhttp'

vim /opt/seafile/conf/seafdav.conf
[WEBDAV]
enabled = true
port = 8080
fastcgi = true
share_name = /seafdav

运行

cd /opt/seafile/seafile-server-latest
./seafile.sh start && ./seahub.sh start-fastcgi

3.4 在线预览

apt-get -y install libreoffice libreoffice-script-provider-python
apt-get -y install ttf-wqy-microhei ttf-wqy-zenhei xfonts-wqy & \
apt-get -y install poppler-utils

/opt/seafile/seafile-server-latest/seafile.sh restart
/opt/seafile/seafile-server-latest/seahub.sh stop
/opt/seafile/seafile-server-latest/seahub.sh start-fastcgi

3.5 自定义CSS

mkdir /opt/seafile/seahub-data/custom
ln -s /opt/seafile/seahub-data/custom /opt/seafile/seafile-server-latest/seahub/media/custom

3.6 时间同步

rm -rf /etc/localtime && \
ln -s /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && \
echo "Asia/Shanghai" > /etc/timezone

dpkg -l|grep ntp &>/dev/null || apt-get -y install ntpdate && \
[ "$PING" = 1 ] && ntpdate -d cn.pool.ntp.org

Seafile 参考文档：

CentOS 安装配置 Seafile Pro

Thu, 01 Jun 2017 00:00:00 +0800

一、安装 mariadb (二进制版)

安装依赖

yum install -y libaio-devel

解压

cd  /usr/local/
tar -zxf mariadb-10.2.6-linux-glibc_214-x86_64.tar.gz
ln -s /usr/local/mariadb-10.2.6-linux-glibc_214-x86_64  /usr/local/mysql
cd mysql

新建 mysql 用户

groupadd mysql && \
useradd -g mysql -M -s /sbin/nologin mysql

安装初始化

cd /usr/local/mysql && \
./scripts/mysql_install_db --user=mysql

chown -R root . && chown -R mysql data

支持命令行运行

export PATH=$PATH:/usr/local/mysql/bin/ && \
echo 'export PATH=$PATH:/usr/local/mysql/bin/' >> .bashrc

开机启动

cp support-files/mysql.server /etc/init.d/mysql && \
chkconfig --add mysql && \
service  mysql start

密码及安全设置

/usr/local/mysql/bin/mysqladmin -u root password '新密码' && \
/usr/local/mysql/bin/mysql_secure_installation

解决中文乱码

cp /usr/local/mysql/support-files/my-medium.cnf /etc/my.cnf && \
vim /etc/my.cnf

vim /etc/mysql/conf.d/mariadb.cnf
[client]
...
default-character-set=utf8
...
[mysql]
...
default-character-set=utf8
...
[mysqld]
...
character-set-server  = utf8
collation-server      = utf8_general_ci
character_set_server  = utf8
collation_server      = utf8_general_ci
...

官方文档：Installing MariaDB using APT

二、安装 Seafile

2.1 安装依赖

python2.7

yum -y install python-setuptools python-imaging MySQL-python python-memcached python-ldap python-urllib3

安装 JRE

yum -y install java-1.7.0-openjdk

安装 pdf 全文搜索依赖

yum -y install poppler-utils

安装 Python 库

easy_install pip
pip install boto requests

2.2 安装 seafile

准备 seafile

mkdir -p seafile
mv seafile-pro-server_* seafile
cd seafile
tar -xzf seafile-pro-server_*
mkdir installed
mv  seafile-pro-server_* installed

安装 seafile

cd seafile-pro-server-* && \
./setup-seafile-mysql.sh

Cloud
cloud.youdomain.com
/opt/seafile/seafile-data
8082
1
localhost
3306
seafile
seafile_ccnet
seafile_db
seafile_seahub

3.3 配置 seafile

vim /home/seafile/conf/ccnet.conf
SERVICE_URL = https://cloud.youdomain.com

vim /home/seafile/conf/seahub_settings.py
FILE_SERVER_ROOT = 'https://cloud.dmfy.gov.cn/seafhttp'

vim /home/seafile/conf/seafdav.conf
[WEBDAV]
enabled = true
port = 8080
fastcgi = true
share_name = /seafdav

运行

cd /home/seafile/seafile-server-latest
./seafile.sh start && ./seahub.sh start-fastcgi

3.4 在线预览

yum -y install libreoffice libreoffice-headless libreoffice-pyuno
yum -y install poppler-utils

/home/seafile/seafile-server-latest/seafile.sh restart
/home/seafile/seafile-server-latest/seahub.sh stop
/home/seafile/seafile-server-latest/seahub.sh start-fastcgi

3.5 自定义CSS

mkdir /opt/seafile/seahub-data/custom
ln -s /opt/seafile/seahub-data/custom /opt/seafile/seafile-server-latest/seahub/media/custom

Seafile 参考文档：

CentOS 从源码安装配置 PHP7.1

Mon, 15 May 2017 00:00:00 +0800

一、安装依赖

libmcrypt-devel 需要使用 epel 源

rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

安装必须的依赖

yum install -y \
    gcc gcc-c++ \
    freetype-devel libxml2-devel libcurl-devel libjpeg-turbo-devel libpng-devel openssl-devel libicu-devel libxslt-devel \
    libmcrypt-devel

二、安装 imap

centOS7 已经没有了 libc-client，需要编译安装

注：epel 源可以找到 libc-client-devel uw-imap-devel uw-imap-static uw-imap-utils，但直接安装还是会出现一些问题。

编译安装

http://files.wangyan.org/src/lemp/imap-2007f.tar.gz

wget ftp://ftp.cac.washington.edu/imap/imap-2007f.tar.gz
tar -zxf imap-2007f.tar.gz
cd imap-2007f
make lr5 PASSWDTYPE=std SSLTYPE=unix.nopwd EXTRACFLAGS=-fPIC IP=4
mkdir -p /usr/local/imap-2007f/{include,lib,c-client}
cp c-client/*.h /usr/local/imap-2007f/include/ 
cp c-client/*.c /usr/local/imap-2007f/lib/ 
cp c-client/*.c /usr/local/imap-2007f/c-client/ 
cp c-client/c-client.a /usr/local/imap-2007f/lib/libc-client.a 
cp c-client/c-client.a /usr/local/imap-2007f/c-client/libc-client.a

备注：在 64 位下编译时 make 参数需要带 EXTRACFLAGS=-fPIC ，在 32 位下则不需要。

三、安装 PHP

tar zxf php-7.1.6.tar.gz
cd php-7.1.6
./configure \
    --prefix=/usr/local/php \
    --with-config-file-path=/usr/local/php/etc  \
    --with-config-file-scan-dir=/usr/local/php/conf.d  \
    --with-curl  \
    --with-fpm-user=www  \
    --with-fpm-group=www  \
    --with-freetype-dir  \
    --with-gd  \
    --with-gettext  \
    --with-iconv-dir \
    --with-imap=/usr/local/imap-2007f \
    --with-imap-ssl \
    --with-jpeg-dir \
    --with-libxml-dir \
    --with-mcrypt \
    --with-mhash \
    --with-mysqli=mysqlnd \
    --with-openssl \
    --with-pdo-mysql=mysqlnd \
    --with-png-dir \
    --with-xmlrpc \
    --with-xsl \
    --with-zlib \
    --enable-calendar \
    --enable-bcmath \
    --enable-exif \
    --enable-fpm  \
    --enable-ftp \
    --enable-gd-native-ttf \
    --enable-intl \
    --enable-mbstring \
    --enable-mysqlnd \
    --enable-shmop \
    --enable-sockets \
    --enable-sysvsem \
    --enable-zip

    make -j4
    make install

三、php 配置

ln -s /usr/local/php/bin/php /usr/bin/php

mkdir -p /usr/local/php/conf.d /tmp/php
cp php-7.1.6/php.ini-production /usr/local/php/etc/php.ini
cp php-fpm.conf /usr/local/php/etc/php-fpm.conf

php.ini 设置

sed -i "s|;*date.timezone =.*|date.timezone = PRC|i" /usr/local/php/etc/php.ini && \
sed -i "s|;*memory_limit =.*|memory_limit = 512M|i" /usr/local/php/etc/php.ini && \
sed -i "s|;*upload_max_filesize =.*|upload_max_filesize = 128M|i" /usr/local/php/etc/php.ini && \
sed -i "s|;*max_file_uploads =.*|max_file_uploads = 25|i" /usr/local/php/etc/php.ini && \
sed -i "s|;*post_max_size =.*|post_max_size = 256M|i" /usr/local/php/etc/php.ini && \
sed -i "s|;\s*max_input_vars =.*|max_input_vars = 5000|i" /usr/local/php/etc/php.ini && \
sed -i "s|;*cgi.fix_pathinfo=.*|cgi.fix_pathinfo= 0|i" /usr/local/php/etc/php.ini && \
sed -i 's|;upload_tmp_dir =.*|upload_tmp_dir = \/tmp\/php|i' /usr/local/php/etc/php.ini && \
sed -i 's|max_execution_time =.*|max_execution_time = 300|i' /usr/local/php/etc/php.ini && \
sed -i 's|disable_functions =.*|disable_functions = passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,popen,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server|g' /usr/local/php/etc/php.ini

开机自启动

cp php-7.1.6/sapi/fpm/init.d.php-fpm /etc/init.d/php-fpm
chmod +x /etc/init.d/php-fpm
chkconfig --add php-fpm
service php-fpm restart

CentOS 从 Yum 源安装配置 PHP7.1

Mon, 01 May 2017 00:00:00 +0800

安装第三方YUM源

rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm

安装 php7.1.x

yum install \
    php71w-bcmath \
    php71w-common \
    php71w-fpm \
    php71w-gd \
    php71w-imap \
    php71w-mbstring \
    php71w-mcrypt \
    php71w-mysql \
    php71w-opcache \
    php71w-pdo \
    php71w-pdo_dblib \
    php71w-pear \
    php71w-pecl-mongodb \
    php71w-xml \
    php71w-xmlrpc

安装 php5.6.x

yum install \
    php56w-bcmath \
    php56w-common \
    php56w-fpm \
    php56w-gd \
    php56w-imap \
    php56w-mbstring \
    php56w-mcrypt \
    php56w-mysql \
    php56w-opcache \
    php56w-pear \
    php56w-pecl-xdebug \
    php56w-pgsql \
    php56w-xml \
    php56w-xmlrpc

启动 php

sudo systemctl start php-fpm && \
sudo systemctl enable php-fpm

    sed -i "s|;*date.timezone =.*|date.timezone = Asia/Shanghai|i" /etc/php.ini && \
    sed -i "s|;*memory_limit =.*|memory_limit = 512M|i" /etc/php.ini && \
    sed -i "s|;*upload_max_filesize =.*|upload_max_filesize = 128M|i" /etc/php.ini && \
    sed -i "s|;*max_file_uploads =.*|max_file_uploads = 25|i" /etc/php.ini && \
    sed -i "s|;*post_max_size =.*|post_max_size = 256M|i" /etc/php.ini && \
    sed -i "s|;\s*max_input_vars =.*|max_input_vars = 5000|i" /etc/php.ini && \
    sed -i "s|;*cgi.fix_pathinfo=.*|cgi.fix_pathinfo= 0|i" /etc/php.ini && \

参考文档：

https://webtatic.com/packages/php71/

CentOS 密码安全策略

Sat, 15 Apr 2017 00:00:00 +0800

1. 设置密码长度和有效期

每180天需要更改密码，并且会提前7天提醒用户密码快到期了。

vim /etc/login.defs

PASS_MAX_DAYS   180
PASS_MIN_DAYS   1
PASS_MIN_LEN    8
PASS_WARN_AGE   7

2. 设置密码复杂度

检查是否安装了 cracklib 模块

rpm -qa | grep cracklib

vim /etc/pam.d/system-auth

参数说明

retry=N 如果用户输入的密码强度不够可以重复输入的次数，默认值是 1，一般设置为 3。 difok=M 新密码与前一个旧密码之间至少有 M 个字符不相同 minlen=N 密码最小长度 dcredit=N 密码中至少有几个数字（至少 N<0 或至多 N>=0） ucredit=N 密码中至少有几个大写字母（至少 N<0 或至多 N>=0） lcredit=N 密码中至少有几个小写字母（至少 N<0 或至多 N>=0） ocredit=N 密码中至少有几个特殊字符（至少 N<0 或至多 N>=0）

password    requisite     pam_cracklib.so try_first_pass retry=3 difok=3 minlen=8 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1

防止用户再次使用以前使用过的密码remember=3（3次）

password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=3

4、配置登录失败处理

失败5次后需要180秒才解锁

auth        required      pam_tally2.so deny=3 unlock_time=300 even_deny_root root_unlock_time=300

5、配置用户最大登录数

vim /etc/security/limits.conf

root – maxlogins 3
dmfy – maxlogins 3

登录超时

vim /etc/profile
export TMOUT=600

避免普通用户 su 到 root 用户

vim /etc/pam.d/su

auth            sufficient      pam_rootok.so debug
auth            required        pam_wheel.so group=wheel

usermod -G wheel [username] #加入wheel用户组

CentOS 从二进制版安装配置 Mariadb

Wed, 15 Mar 2017 00:00:00 +0800

一、MariaDB 准备

1.1 下载

根据系统选择相应版本版本，然后下载解压。

# CentOS 7
mariadb-10.2.6-linux-glibc_214-x86_64.tar.gz 

# Debian 8+, Ubuntu 15.04+
mariadb-10.2.6-linux-systemd-x86_64.tar.gz

下载地址：https://downloads.mariadb.org/

1.2 安装依赖

yum -y install libaio-devel

1.3 配置文件

# 删除旧的
rm -f /etc/my.cnf

# 复制新的
cp /usr/local/mysql/support-files/my-medium.cnf /etc/my.cnf

二、安装 MariaDB

2.1 添加用户组

groupadd mysql
useradd -g mysql -M -s /sbin/nologin mysql

2.2 安装

tar -zxf mariadb-10.2.6-linux-glibc_214-x86_64.tar.gz
ln -s mariadb-10.2.6-linux-glibc_214-x86_64 mysql
cd mysql
./scripts/mysql_install_db --user=mysql
chown -R root .
chown -R mysql data

2.3 开机自启动

cp support-files/mysql.server /etc/init.d/mysql
chkconfig mysql on
service start mysql

手动启动

export PATH=$PATH:/usr/local/mysql/bin/
echo 'export PATH=$PATH:/usr/local/mysql/bin/' >> .bashrc
mysqld_safe --user=mysql &

三、设置 MariaDB

安全设置

/usr/local/mysql/bin/mysqladmin -u root password '新密码'
/usr/local/mysql/bin/mysqladmin -u root -h s1.dmfy.gov.cn password '新密码'
/usr/local/mysql/bin/mysql_secure_installation

开启远程登录

mysql -uroot -p
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '新密码' WITH GRANT OPTION;

解决 MariaDB 中文乱码

https://mariadb.com/kb/en/mariadb/setting-character-sets-and-collations/

vim /etc/my.cnf

[client]
...
default-character-set=utf8
...
[mysql]
...
default-character-set=utf8
...
[mysqld]
...
character-set-server  = utf8
collation-server      = utf8_general_ci
character_set_server  = utf8
collation_server      = utf8_general_ci
...

查看效果

mysql -uroot -p
SHOW VARIABLES WHERE Variable_name LIKE 'character\_set\_%' OR Variable_name LIKE 'collation%';

https://mariadb.com/kb/en/mariadb/installing-mariadb-binary-tarballs/