{"id":18,"date":"2022-12-31T13:15:33","date_gmt":"2022-12-31T05:15:33","guid":{"rendered":"https:\/\/www.book2022.top\/?p=18"},"modified":"2022-12-31T13:15:33","modified_gmt":"2022-12-31T05:15:33","slug":"%e6%89%8b%e5%8a%a8%e5%ae%89%e8%a3%85caddy2-debian","status":"publish","type":"post","link":"https:\/\/txt.book2020.top\/?p=18","title":{"rendered":"\u624b\u52a8\u5b89\u88c5caddy2 debian"},"content":{"rendered":"\n

\u66f4\u65b0\u7cfb\u7edf<\/strong><\/p>\n\n\n\n

apt-get update && apt-get upgrade -y<\/code><\/pre>\n\n\n\n
\u57fa\u7840\u5de5\u5177\u4e0b\u8f7d\u5b89\u88c5<\/strong><\/p>\n\n\n\n
apt update && apt -y install build-essential libnss3 libpcre3 libpcre3-dev zlib1g-dev git dbus manpages-dev aptitude g++ wget curl unzip gcc<\/code><\/pre>\n\n\n\n
\u6821\u51c6\u65f6\u95f4<\/strong><\/p>\n\n\n\n
ln -sf \/usr\/share\/zoneinfo\/Asia\/Shanghai \/etc\/localtime && date -R<\/code><\/pre>\n\n\n\n
\u4e0b\u8f7d\u5b89\u88c5GO\u7f16\u7a0b\u8bed\u8a00<\/strong><\/p>\n\n\n\n
wget https:\/\/go.dev\/dl\/go1.19.3.linux-amd64.tar.gz<\/code><\/pre>\n\n\n\n
\u89e3\u538b\u81f3\/usr\/local\/<\/strong><\/p>\n\n\n\n
tar -C \/usr\/local -xzf go1.19.3.linux-amd64.tar.gz<\/code><\/pre>\n\n\n\n
\u5728\/etc\/profile\u4e2d\u6dfb\u52a0 Go \u73af\u5883\u53d8\u91cf:<\/strong><\/p>\n\n\n\n
echo \"export PATH=$PATH:\/usr\/local\/go\/bin\" >> \/etc\/profile<\/code><\/pre>\n\n\n\n
\u4f7f\u4fee\u6539\u7684\u914d\u7f6e\u6587\u4ef6\u7acb\u5373\u751f\u6548<\/strong><\/p>\n\n\n\n
source \/etc\/profile<\/code><\/pre>\n\n\n\n
\u7f16\u8bd1\u5b89\u88c5 Caddy<\/strong><\/p>\n\n\n\n
go install github.com\/caddyserver\/xcaddy\/cmd\/xcaddy@latest<\/code><\/pre>\n\n\n\n
\u7f16\u8bd1\u5b89\u88c5(\u4e0b\u9762\u7684\u63d2\u4ef6\u611f\u89c9\u4e0d\u9700\u8981\u7684\u53ef\u4ee5\u53bb\u6389)<\/strong><\/p>\n\n\n\n
~\/go\/bin\/xcaddy build \\\n    --with github.com\/caddyserver\/forwardproxy@caddy2=github.com\/klzgrad\/forwardproxy@naive \\\n    --with github.com\/abiosoft\/caddy-exec \\\n    --with github.com\/caddy-dns\/cloudflare \\\n    --with github.com\/mholt\/caddy-l4 \\\n    --with github.com\/greenpau\/caddy-trace \\\n    --with github.com\/hairyhenderson\/caddy-teapot-module \\\n    --with github.com\/kirsch33\/realip \\\n    --with github.com\/porech\/caddy-maxmind-geolocation \\\n    --with github.com\/mholt\/caddy-webdav<\/code><\/pre>\n\n\n\n

\u5220\u9664\u7f16\u8bd1\u540e\u7684\u6587\u4ef6\u5939<\/strong><\/p>\n\n\n\n
rm -rf go go1.19.3.linux-amd64.tar.gz<\/code><\/pre>\n\n\n\n
\u521b\u5efa\u6587\u4ef6\u5939<\/strong><\/p>\n\n\n\n
mkdir -p \/usr\/share\/caddy\/ \/etc\/caddy\/ \/etc\/ssl\/caddy\/ \/var\/log\/caddy\/<\/code><\/pre>\n\n\n\n
\u521b\u5efa\u6587\u4ef6<\/strong><\/p>\n\n\n\n
touch \/var\/log\/caddy\/access.log \/etc\/caddy\/Caddyfile<\/code><\/pre>\n\n\n\n
mv .\/caddy \/usr\/bin\/<\/code><\/pre>\n\n\n\n
\u4fee\u6539Caddyfile h2<\/strong><\/p>\n\n\n\n
{\n    order reverse_proxy before route\n    admin off\n    log {\n        output file \/var\/log\/caddy\/access.log\n    }\n    servers :443 {\n        protocol {\n            experimental_http3\n        }\n    }\n}\n\n:443, t.caddy.tk {\n    header Access-Control-Allow-Origin *\n    php_fastcgi unix\/\/run\/php\/php7.4-fpm.sock\n    encode zstd gzip\n    tls \/etc\/ssl\/caddy\/t.caddy.tk_bundle.crt \/etc\/ssl\/caddy\/t.caddy.tk.key {\n        ciphers TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256\n        alpn h2\n\n    }\n\n    @host {\n        host t.caddy.tk\n    }\n    route @host {\n        header {\n            Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\"\n        }\n    }\n\n    root * \/usr\/share\/caddy\n    file_server\n\n    reverse_proxy \/mywebsocket 127.0.0.1:26457 {\n        transport http {\n            versions h2c\n        }\n    }\n}<\/code><\/pre>\n\n\n\n

\u652f\u6301grpc<\/strong><\/p>\n\n\n\n
{\n    order reverse_proxy before route\n    admin off\n    log {\n        output file \/var\/log\/caddy\/access.log\n    }\n    servers :443 {\n        protocol {\n            experimental_http3\n        }\n    }\n}\n\n:443, www.grpc.com {\n    header Access-Control-Allow-Origin *\n    php_fastcgi unix\/\/run\/php\/php7.4-fpm.sock\n    encode zstd gzip\n\n    tls \/etc\/ssl\/caddy\/www.grpc.com_bundle.crt \/etc\/ssl\/caddy\/www.grpc.com.key {\n        dns cloudflare hGV77cHVZ7u1pQF4uVCoEUPousi6SX0GOA8TDd3o\n        ciphers TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256\n        alpn h2\n    }\n\n    @host {\n        host www.grpc.com\n    }\n    route @host {\n        header {\n            Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\"\n        }\n    }\n\n    root * \/usr\/share\/caddy\n    file_server\n\n    reverse_proxy \/www.grpc.com\/* 127.0.0.1:12345 {\n        transport http {\n            versions h2c\n        }\n        flush_interval -1\n        header_up X-Real-IP {remote_host}\n    }\n}<\/code><\/pre>\n\n\n\n

\u652f\u6301websocket<\/strong><\/p>\n\n\n\n
{\n    order reverse_proxy before route\n    admin off\n    log {\n        output file \/var\/log\/caddy\/access.log\n    }\n    servers :443 {\n        protocol {\n            experimental_http3\n        }\n    }\n}\n\n:443, www.grpc.com {\n    header Access-Control-Allow-Origin *\n    php_fastcgi unix\/\/run\/php\/php7.4-fpm.sock\n    root * \/usr\/share\/caddy\n    file_server\n    encode zstd gzip\n\n    tls \/etc\/ssl\/caddy\/www.grpc.com_bundle.crt \/etc\/ssl\/caddy\/www.grpc.com.key {\n        dns cloudflare hGV77cHVZ7u1pQF4uVCoEUPousi6SX0GOA8TDd3o\n        protocols tls1.2 tls1.3\n        ciphers TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256\n        curves x25519\n    }\n    @host {\n        host www.grpc.com\n    }\n    route @host {\n        header {\n            Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\"\n        }\n    }\n    @mywebsocket {\n        path \/mywebsocket\n        header Connection *Upgrade*\n        header Upgrade websocket\n    }\n    reverse_proxy @mywebsocket localhost:12345\n\n}<\/code><\/pre>\n\n\n\n
forward proxy<\/strong><\/p>\n\n\n\n
{\n    order forward_proxy before route\n    admin off\n    log {\n        output file \/var\/log\/caddy\/error.log\n        level ERROR\n    }\n}\n\n:443, www.forwardproxy.com {\n    tls \/etc\/ssl\/caddy\/www.forwardproxy.com.crt \/etc\/ssl\/caddy\/www.forwardproxy.com_key.key {\n        ciphers TLS_AES_256_GCM_SHA384 TLS_AES_128_GCM_SHA256 TLS_CHACHA20_POLY1305_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256\n        curves x25519 secp521r1 secp384r1 secp256r1\n    }\n    root * \/usr\/share\/caddy\/wordpress\n    php_fastcgi unix\/\/run\/php\/php7.4-fpm.sock\n    file_server\n    encode gzip\n\n    @disallowed {\n        path \/xmlrpc.php\n        path *.sql\n        path \/wp-content\/uploads\/*.php\n    }\n\n    rewrite @disallowed '\/index.php'\n    forward_proxy {\n        basic_auth user password\n        hide_ip\n        hide_via\n        probe_resistance\n    }\n    @host {\n        host www.forwardproxy.com\n    }\n    route @host {\n        header {\n            Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\" #\u542f\u7528HSTS\n        }\n    }\n}<\/code><\/pre>\n\n\n\n
\u83b7\u5f97 Cloudflare API token<\/strong><\/p>\n\n\n\n
\u5728 Cloudfalre \u7f51\u7ad9\u70b9\u51fb\u53f3\u4e0a\u89d2 \u4eba\u7269\u56fe\u2014>MY Profile\u2014\u2014> (\u6700\u5de6\u8fb9\u627e\u5230 { } \u8fd9\u4e2a\u6807\u5fd7)API \u9009\u9879 \u6216 https:\/\/dash.cloudflare.com\/profile\/api-tokens<\/strong><\/p>\n\n\n\n
\"\"\/
*<\/figcaption><\/figure>\n\n\n\n
\"\"\/<\/figure>\n\n\n\n
.<\/p>\n\n\n\n
\u521b\u5efacaddy.service<\/strong><\/p>\n\n\n\n
cat >\/etc\/systemd\/system\/caddy.service <<EOF\n[Unit]\nDescription=Caddy\nDocumentation=https:\/\/caddyserver.com\/docs\/\nAfter=network.target network-online.target\nRequires=network-online.target\n\n[Service]\nType=notify\nUser=www-data\nGroup=www-data\nExecStart=\/usr\/bin\/caddy run --environ --config \/etc\/caddy\/Caddyfile\nExecReload=\/usr\/bin\/caddy reload --config \/etc\/caddy\/Caddyfile --force\nTimeoutStopSec=5s\nLimitNOFILE=1048576\nLimitNPROC=512\nPrivateDevices=yes\nPrivateTmp=true\nProtectSystem=full\nAmbientCapabilities=CAP_NET_BIND_SERVICE\n\n[Install]\nWantedBy=multi-user.target\nEOF<\/code><\/pre>\n\n\n\n

\u521b\u5efa<\/strong>caddy-api.service<\/p>\n\n\n\n
cat >\/etc\/systemd\/system\/caddy-api.service <<EOF\n[Unit]\nDescription=Caddy\nDocumentation=https:\/\/caddyserver.com\/docs\/\nAfter=network.target network-online.target\nRequires=network-online.target\n\n[Service]\nType=notify\nUser=www-data\nGroup=www-data\nExecStart=\/usr\/bin\/caddy run --environ --resume\nTimeoutStopSec=5s\nLimitNOFILE=1048576\nLimitNPROC=512\nPrivateTmp=true\nProtectSystem=full\nAmbientCapabilities=CAP_NET_BIND_SERVICE\n\n[Install]\nWantedBy=multi-user.target\nEOF<\/code><\/pre>\n\n\n\n
\u5b89\u88c5MariaDB php\uff1a<\/strong><\/p>\n\n\n\n
apt install php-fpm php-mysql mariadb-server<\/code><\/pre>\n\n\n\n
\u5b89\u88c5php\u63d2\u4ef6\uff1a<\/strong><\/p>\n\n\n\n
apt install php-curl php-gd php-imagick php-intl php-mbstring php-zip php-dom<\/code><\/pre>\n\n\n\n
MariaDB\u5b89\u5168\u52a0\u56fa\uff1a<\/strong>
\u4f1a\u8bbe\u7f6e\u5bc6\u7801\uff0c\u754c\u97621\u76f4\u63a5\u56de\u8f66\uff0c\u5269\u7684\u90fd\u9009Y\uff1a<\/strong><\/p>\n\n\n\n
mysql_secure_installation<\/code><\/pre>\n\n\n\n
root\u767b\u5f55\uff1a<\/strong><\/p>\n\n\n\n
mysql -u root -p<\/code><\/pre>\n\n\n\n
\u67e5\u770b\u5f53\u524d\u7684\u6570\u636e\u5e93\uff1a<\/strong><\/p>\n\n\n\n
show databases;<\/code><\/pre>\n\n\n\n
\u521b\u5efa\u6570\u636e\u5e93\u975eroot\u7528\u6237\u540d\u5bc6\u7801\uff1a<\/strong>
**wordpress \u6570\u636e\u5e93\u540d\uff0c name \u7528\u6237\u540d\uff0cpassword \u5bc6\u7801 **
create database wordpress; create user name@localhost identified by \u2018password\u2019;
\u6388\u4e88\u6743\u9650\uff1a<\/strong><\/p>\n\n\n\n
grant all privileges on wordpress.* to name@localhost; flush privileges;<\/code><\/pre>\n\n\n\n
\u9000\u51fa\uff1a<\/strong><\/p>\n\n\n\n
exit<\/code><\/pre>\n\n\n\n
\u535a\u5ba2\u4e0b\u8f7d\u5730\u5740 https:\/\/typecho.org\/ \u89e3\u538b\u653e\u5728\/usr\/share\/caddy\/\u6587\u4ef6\u5939\u4e0b\uff0c<\/strong><\/p>\n\n\n\n
\u7528\u7684\u975eroot\u8d26\u6237\u8981\u7ed9html\u6587\u4ef6\u5939\u8d4b\u7ed9\u6743\u9650\uff1a<\/strong><\/p>\n\n\n\n
chown -R www-data:www-data caddy<\/code><\/pre>\n\n\n\n
\u5f00\u542fBBR\u52a0\u901f\uff08\u53ef\u8df3\u8fc7\uff09<\/strong><\/p>\n\n\n\n
echo \"net.core.default_qdisc=fq\" >> \/etc\/sysctl.conf && echo \"net.ipv4.tcp_congestion_control=bbr\" >> \/etc\/sysctl.conf && sysctl -p && lsmod | grep bbr<\/code><\/pre>\n\n\n\n
====\u51fa\u73b0\u7f13\u51b2\u8fc7\u5c0f\u9519\u8bef\u65f6====<\/strong><\/p>\n\n\n\n
\u5efa\u8bae\u901a\u8fc7\u8fd0\u884c\u6765\u589e\u52a0\u6700\u5927\u7f13\u51b2\u533a\u5927\u5c0f\uff1a<\/strong><\/p>\n\n\n\n
sysctl -w net.core.rmem_max=2500000<\/code><\/pre>\n\n\n\n
\u91cd\u8f7dsystemctl\u670d\u52a1<\/strong><\/p>\n\n\n\n
systemctl daemon-reload<\/code><\/pre>\n\n\n\n
\u5f00\u542fcaddy2<\/strong><\/p>\n\n\n\n
systemctl start caddy && systemctl status caddy<\/code><\/pre>\n\n\n\n
\u8bbe\u7f6e\u4e3a\u5f00\u673a\u81ea\u52a8\u542f\u52a8<\/strong><\/p>\n\n\n\n
systemctl enable caddy<\/code><\/pre>\n\n\n\n
\u6bcf\u6b21\u4fee\u6539\u540e\u90fd\u8981\u6267\u884c\u4e00\u6b21\u91cd\u542f<\/strong><\/p>\n\n\n\n
systemctl restart caddy<\/code><\/pre>\n\n\n\n
\u505c\u6b62caddy<\/strong><\/p>\n\n\n\n
service caddy stop<\/code><\/pre>\n\n\n\n
\u5f00\u542fphp7.4-fpm\uff1a<\/strong><\/p>\n\n\n\n
systemctl start php7.4-fpm<\/code><\/pre>\n\n\n\n
\u5f00\u542f\u72b6\u6001\uff1a<\/strong><\/p>\n\n\n\n
systemctl status php7.4-fpm<\/code><\/pre>\n\n\n\n
\u5f00\u673a\u81ea\u52a8\u542f\u52a8\uff1a<\/strong><\/p>\n\n\n\n
systemctl enable php7.4-fpm<\/code><\/pre>\n\n\n\n
\u91cd\u65b0\u542f\u52a8\uff1a<\/strong><\/p>\n\n\n\n
systemctl restart php7.4-fpm<\/code><\/pre>\n\n\n\n
\u5f00\u542fmysql\uff1a<\/strong><\/p>\n\n\n\n
systemctl start mariadb.service<\/code><\/pre>\n\n\n\n
\u5f00\u542f\u72b6\u6001\uff1a<\/strong><\/p>\n\n\n\n
systemctl status mariadb.service<\/code><\/pre>\n\n\n\n
\u5f00\u673a\u81ea\u52a8\u542f\u52a8\uff1a<\/strong><\/p>\n\n\n\n
systemctl enable mariadb.service<\/code><\/pre>\n\n\n\n
\u91cd\u65b0\u542f\u52a8\uff1a<\/strong><\/p>\n\n\n\n
systemctl restart mariadb.service<\/code><\/pre>\n\n\n\n
\u4ece Caddyfile \u751f\u6210 JSON \u914d\u7f6e<\/strong><\/p>\n\n\n\n
.\/caddy adapt --config .\/Caddyfile --pretty<\/code><\/pre>\n\n\n\n
\u76f4\u63a5\u5185\u5bb9\u8f93\u51fa\u5230\u6587\u672c<\/strong><\/p>\n\n\n\n
.\/caddy adapt --config .\/Caddyfile > .\/config.json<\/code><\/pre>\n\n\n\n
\u9a8c\u8bc1 Caddyfile \u6709\u6548\u6027<\/strong><\/p>\n\n\n\n
.\/caddy adapt --config .\/Caddyfile --validate<\/code><\/pre>\n\n\n\n
** grpc**<\/p>\n\n\n\n
{\n  \"log\": {\n    \"loglevel\": \"warning\",\n    \"error\": \"\/var\/log\/\u67d0x\/error.log\",\n    \"access\": \"\/var\/log\/\u67d0x\/access.log\"\n  },\n  \"inbounds\": [\n    {\n      \"listen\": \"127.0.0.1\",\n      \"port\": 12345,\n      \"protocol\": \"vless\",\n      \"settings\": {\n        \"clients\": [\n          {\n            \"id\": \"a6f4466a-d7a2-92fc-9ec6-8e098eed78c9\",\n            \"alterId\": 0\n          },\n          {\n            \"id\": \"b6f4466a-d7a2-92fc-9ec6-8e098eed78c9\",\n            \"alterId\": 0\n          },\n          {\n            \"id\": \"c6f4466a-d7a2-92fc-9ec6-8e098eed78c9\",\n            \"alterId\": 0\n          }\n        ],\n        \"decryption\": \"none\"\n      },\n      \"streamSettings\": {\n        \"network\": \"grpc\",\n        \"security\": \"none\",\n        \"grpcSettings\": {\n          \"serviceName\": \"www.grpc.com\"\n        }\n      },\n      \"sniffing\": {\n        \"enabled\": true,\n        \"destOverride\": [\n          \"http\",\n          \"tls\"\n        ]\n      }\n    }\n  ],\n  \"routing\": {\n    \"rules\": [\n      {\n        \"type\": \"field\",\n        \"protocol\": [\n          \"bittorrent\"\n        ],\n        \"outboundTag\": \"blocked\"\n      }\n    ]\n  },\n  \"outbounds\": [\n    {\n      \"protocol\": \"freedom\",\n      \"settings\": {}\n    },\n    {\n      \"tag\": \"blocked\",\n      \"protocol\": \"blackhole\",\n      \"settings\": {}\n    }\n  ]\n}<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
\u66f4\u65b0\u7cfb\u7edf \u57fa\u7840\u5de5\u5177\u4e0b\u8f7d\u5b89\u88c5 \u6821\u51c6\u65f6\u95f4 \u4e0b\u8f7d\u5b89\u88c5GO\u7f16\u7a0b\u8bed\u8a00 \u89e3\u538b\u81f3\/usr\/local\/ \u5728\/etc\/prof…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-18","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/txt.book2020.top\/index.php?rest_route=\/wp\/v2\/posts\/18","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/txt.book2020.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/txt.book2020.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/txt.book2020.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/txt.book2020.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=18"}],"version-history":[{"count":0,"href":"https:\/\/txt.book2020.top\/index.php?rest_route=\/wp\/v2\/posts\/18\/revisions"}],"wp:attachment":[{"href":"https:\/\/txt.book2020.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=18"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/txt.book2020.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=18"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/txt.book2020.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=18"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}