Yadda ake saita Ubuntu VPS don shafin HTTPS

Shirya sabar, domain da hanyar dawo da shiga

Wannan jagorar na sabuwar Ubuntu 24.04 VPS ce mai public IPv4, SSH a port 22, asusun farko mai sudo da domain da kake iya sarrafawa. Ƙirƙiri SSH key kafin provisioning. Idan an riga an ƙirƙiri sabar amma ba a fara amfani da ita ba, ƙara key ta hanyar shiga da ke aiki. Umarni na kwamfutarka suna amfani da Bash a Linux, macOS ko WSL; na sabar kuma a cikin SSH. Dakata idan wani aikin da ke sabar ya riga ya yi amfani da paths ɗin misalin.

Maye gurbin 203.0.113.10 da IP ɗinka, da app.example.com da hostname ɗinka. Waɗannan adiresoshin misali ne kawai. A nan asusun farko shi ne ubuntu; yi amfani da sunan da kamfanin hosting ya bayar idan ya bambanta. Buɗe recovery console kafin gyara shiga ko firewall. Ubuntu image na Oracle yana buƙatar hanyar firewall ta musamman.

Ƙirƙiri key kafin sabar, ko ƙara shi ta hanyar shiga mai aiki

A kwamfutarka, ƙirƙiri key na wannan sabar tare da passphrase. Idan fayil mai wannan suna yana nan, zaɓi wani suna ka canza shi a duk matakan. Fayil ɗin .pub public key ne; private key ya zauna a kwamfutarka.

mkdir -p ~/.ssh
ssh-keygen -t ed25519 -f ~/.ssh/ubuntu_vps
cat ~/.ssh/ubuntu_vps.pub

Sabuwar VPS: yanzu ƙirƙiri Ubuntu 24.04, saka public key a filin SSH key na kamfanin hosting. Tabbatar da sunan asusun farko, sannan je zuwa tabbatar da host fingerprint. Tsallake umarnin sabar da aka riga aka ƙirƙira.

Sabar da aka riga aka ƙirƙira amma ba ta da aiki: bar SSH mai aiki a buɗe. Daga wani terminal na kwamfutarka, kwafi public key da hanyar shiga ta yanzu. Sauya existing_vps_key da sunan private key na yanzu. Idan ana shiga da password ko SSH agent, cire -i ~/.ssh/existing_vps_key; kada ka sauya tsarin tantance shiga a sabar.

scp -i ~/.ssh/existing_vps_key ~/.ssh/ubuntu_vps.pub ubuntu@203.0.113.10:ubuntu-vps-admin.pub

A cikin zaman sabar na yanzu, tabbatar da fayil ɗin public key, sannan ƙara shi zuwa authorized_keys na asusun farko. Ƙarawa a ƙarshe tana kiyaye keys da suke nan; sabon layi yana raba su ko da layin ƙarshe bai ƙare da newline ba. Wannan don asusunka na farko ne. Idan babu hanyar shiga mai aiki, fara da hanyar recovery ta kamfanin.

if ssh-keygen -lf ~/ubuntu-vps-admin.pub; then
    mkdir -p ~/.ssh
    chmod 700 ~/.ssh
    printf '\n' >> ~/.ssh/authorized_keys
    cat ~/ubuntu-vps-admin.pub >> ~/.ssh/authorized_keys
    chmod 600 ~/.ssh/authorized_keys
fi

Ko wace hanya ka bi, kafin karɓar haɗin farko kwatanta host fingerprint da public host key mai dacewa a recovery console da ka amince da shi. Don host key na Ed25519, gudanar da wannan a console:

sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

A kwamfutarka, buɗe sabon haɗin SSH da sabon key. Kada ka rufe tsohon haɗin har sai wannan ya yi aiki.

ssh -i ~/.ssh/ubuntu_vps ubuntu@203.0.113.10

Daga wani terminal na kwamfutarka, kwafi public key domin admin daban da za ka ƙirƙira. Maimaita kwafin wannan public key na ɗan lokaci ba ya canza private key.

scp -i ~/.ssh/ubuntu_vps ~/.ssh/ubuntu_vps.pub ubuntu@203.0.113.10:ubuntu-vps-admin.pub

Ƙirƙiri admin, sannan gwada shiga daban

A sabar, fara da getent passwd deploy. Kada a sami asusu mai wannan suna. Idan deploy yana nan, zaɓi sunan da ba a yi amfani da shi ba, ka sauya sunan asusu, group da home paths a duk misalin. Hakan yana kauce wa maye gurbin keys na wani.

Bincika image da albarkatu, duba jerin updates, sannan ƙirƙiri admin. Sanya password mai ƙarfi don sudo. Umarnin install suna ba asusun mallakar fayil ɗin key da izinin da ya dace.

cat /etc/os-release
free -h
df -h /
sudo apt update
sudo apt upgrade
sudo adduser deploy
sudo usermod -aG sudo deploy
sudo install -d -m 700 -o deploy -g deploy /home/deploy/.ssh
sudo install -m 600 -o deploy -g deploy ~/ubuntu-vps-admin.pub /home/deploy/.ssh/authorized_keys

Buɗe sabon terminal a kwamfutarka ka shiga da sabon admin:

ssh -i ~/.ssh/ubuntu_vps deploy@203.0.113.10

A sabon zaman sabar, gwada sudo. Ya kamata ya nuna root bayan karɓar password na deploy. Ci gaba a wannan zaman idan shiga da sudo sun yi aiki; bar hanyar farko a samuwa.

sudo whoami

Sanya Nginx, ka bi firewall da image ɗin ke tallafawa

Sanya Nginx a sabar. Firewall na kamfanin da na Ubuntu duk suna shafar haɗi. Bar recovery console da SSH mai aiki a buɗe yayin gyare-gyare.

sudo apt install nginx
sudo systemctl enable --now nginx

A firewall na kamfanin, ba TCP 22 izini daga wurin admin, da TCP 80/443 ga masu ziyartar shafi. Idan SSH yana wani port, kiyaye dokarsa. Dokar network ba ta buɗe port da firewall na guest ya hana ba.

Ubuntu a Oracle Cloud: tsallake dukan umarnin UFW da ke ƙasa. Oracle ya yi gargaɗi cewa UFW na iya lalata muhimman dokokin firewall na image har sabar ta kasa boot. Kiyaye iptables da aka bayar, har da dokokin iSCSI na boot da block volumes. Saita OCI security lists ko NSG da dokokin guest na HTTP/HTTPS bisa takardun Oracle. Kada ka goge dokoki gaba ɗaya ko musanya packages na firewall.

UFW don wasu sabbin Ubuntu images: yi amfani da wannan kawai idan kamfanin yana tallafa wa UFW kuma image ba ya buƙatar wani tsarin daban. Ba port ɗin SSH na gaske izini kafin kunna firewall; wannan misalin yana amfani da 22.

sudo apt install ufw
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

Bayan kowace hanya, gwada sabon shiga ta SSH. Zaman da ya riga ya buɗe ba ya tabbatar da sabon haɗi. Gwajin HTTP daga waje a mataki na gaba ma dole ya yi aiki kafin neman certificate.

Wallafa shafi a tsarin Nginx na kansa

A sabar, ƙirƙiri sabon document root da configuration. Sauya hostname a cikin wannan umarni. Bar alamomin EOF cikin quotes: suna hana shell faɗaɗa Nginx variables kamar $uri.

sudo install -d -m 755 /var/www/first-site
printf '%s\n' '<!doctype html><html lang="en"><title>First deployment</title><h1>Ubuntu VPS is serving this page</h1></html>' | sudo tee /var/www/first-site/index.html
sudo tee /etc/nginx/sites-available/first-site >/dev/null <<'EOF'
server {
    listen 80;
    listen [::]:80;
    server_name app.example.com;
    root /var/www/first-site;
    index index.html;
    location / {
        try_files $uri $uri/ =404;
    }
}
EOF
sudo ln -s /etc/nginx/sites-available/first-site /etc/nginx/sites-enabled/first-site
sudo nginx -t

Yi reload ne kawai idan gwajin configuration ya yi nasara:

sudo systemctl reload nginx

Daga kwamfutarka, gwada hostname a IP na sabar kafin canza DNS. Ka tabbatar amsar ita ce taken shafinka, ba shafin maraba na Nginx ba.

curl --resolve app.example.com:80:203.0.113.10 http://app.example.com/

Haɗa DNS, sannan kunna HTTPS

Ƙirƙiri DNS A record da ke nuni zuwa IPv4 na VPS. Sanya AAAA kawai idan IPv6 na wannan sabar yana aiki. Tsohon AAAA na iya tura baƙi da gwajin certificate zuwa wani wuri. Misalin yana ɗauka DNS yana kai tsaye zuwa VPS, ba ta proxy ba.

A kwamfutarka, buɗe http://app.example.com/ ba tare da --resolve ba. Idan shafinka ya bayyana, sanya Certbot da Nginx plugin daga Ubuntu archive a sabar. Packages suna buƙatar Universe repository; warware package-not-found kafin ci gaba.

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d app.example.com --redirect
sudo nginx -t
sudo certbot renew --dry-run
systemctl list-timers --all certbot.timer

Bi tambayoyin email da sharuɗɗa. Certbot yana gyara configuration, ya sa HTTP ya koma HTTPS. Tabbatar da renewal timer; idan ba ya aiki, kunna shi da sudo systemctl enable --now certbot.timer. Bar port 80 a samuwa don tabbatarwa da sabunta certificate.

Gwada daga waje da bayan reboot

A kwamfutarka, gudanar da wannan. Kada ka ƙara -k: hakan zai ɓoye matsalar tabbatar da certificate.

curl -I http://app.example.com/
curl -I https://app.example.com/
curl -fsS https://app.example.com/

Ka tabbatar shafin da certificate sun dace, sannan yi reboot yayin da kake gwajin sabuwar sabar kuma recovery console yana samuwa. Sake haɗa SSH, bincika Nginx, sannan maimaita gwajin HTTPS daga kwamfuta ta waje. Idan ya gaza, bincika DNS, IPv6, firewall, logs da certificate maimakon wuce kuskuren.

Shirya kula da sabar da dawo da aiki

Wannan misalin shafin static ne, ba runtime na manhaja ko database a kowace buƙata ba. CMS da API suna buƙatar tsarin deployment, updates, data da tsaro nasu.

Ajiye fayilolin shafi, configuration da bayanan DNS a waje da VPS. Rubuta yadda ake sake gina sabar, kare private keys na certificate idan ana backup ɗinsu, kuma gwada restore. Saita sanarwar cikar disk, gazawar sabis da certificate. Gwajin backup da restore yana taimaka wa fayilolin static; jagorar SSH tana raba nauʼukan matsalar shiga.

Tambayoyi da amsoshi

Takardu da madogarai

• Madogara: Ubuntu OpenSSH documentation
• Madogara: Ubuntu firewall documentation
• Madogara: Ubuntu Nginx installation
• Madogara: Certbot Nginx and renewal documentation
• Madogara: Ubuntu Certbot package availability
• Madogara: Oracle platform-image firewall requirements