阿里云 ECS 部署 Ubuntu

更新系统

1
sudo apt update
2
sudo apt full-upgrade

配置防火墙

1
# 关闭防火墙
2
sudo ufw disable
3

4
# 设置默认规则
5
sudo ufw default deny incoming
6
sudo ufw default allow outgoing
7

8
# 允许 22、80、443 端口访问
9
sudo ufw allow 22/tcp
10
sudo ufw allow 80/tcp
11
sudo ufw allow 443/tcp
12

13
# 开启防火墙
14
sudo ufw enable

安装 fail2ban

安装：

1
sudo apt install fail2ban

删除自带配置：

1
sudo rm /etc/fail2ban/jail.d/defaults-debian.conf

添加默认封禁配置：

1
sudo tee /etc/fail2ban/jail.d/01-defaults.conf <<EOF
2
[DEFAULT]
3
bantime = 12h
4
findtime = 30m
5
maxretry = 3
6

7
ignoreip = 127.0.0.1/8 ::1/128 172.16.95.102/20
8

9
banaction = ufw
10
banaction_allports = ufw
11
EOF

添加 sshd 封禁配置：

1
sudo tee /etc/fail2ban/jail.d/10-sshd.conf <<EOF
2
[sshd]
3
enabled = true
4
port = 22
5
filter = sshd
6
backend = systemd
7
findtime = 5m
8
maxretry = 3
9
bantime = 1h
10

11
[sshd-slow]
12
enabled = true
13
port = 22
14
filter = sshd
15
backend = systemd
16
findtime = 6h
17
maxretry = 5
18
bantime = 24h
19
EOF

添加“累犯”封禁配置：

1
sudo tee /etc/fail2ban/jail.d/99-recidive.conf <<EOF
2
[recidive]
3
enabled = true
4
filter = recidive
5
logpath = /var/log/fail2ban.log
6
findtime = 1w
7
maxretry = 3
8
bantime = -1
9
EOF

检查：

1
sudo fail2ban-client -t
2
sudo fail2ban-client -d

启动：

1
sudo systemctl enable --now fail2ban

加固 SSH

配置：

1
sudo tee /etc/ssh/sshd_config.d/99-hardening.conf <<EOF
2
# 禁用 root 登录
3
PermitRootLogin no
4

5
# 禁用密码认证，仅允许密钥
6
PasswordAuthentication no
7
PubkeyAuthentication yes
8

9
# 限制算法
10
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
11
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
12
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
13

14
# 限制尝试次数
15
MaxAuthTries 3
16
MaxSessions 5
17
ClientAliveInterval 300
18
ClientAliveCountMax 3
19

20
# 仅允许特定用户
21
AllowUsers ecs-user
22
EOF

检查：

1
sudo sshd -t && echo "Syntax OK"

重载 sshd 配置：

1
sudo systemctl reload sshd

安装 Podman

修改系统配置：

1
echo "net.ipv4.ip_unprivileged_port_start=80" | sudo tee /etc/sysctl.d/99-unprivileged-ports.conf
2
sudo sysctl --system

配置 Linger：

1
sudo loginctl enable-linger $USER

安装 podman：

1
sudo apt install podman

配置镜像加速器：

1
sudo tee /etc/containers/registries.conf <<EOF
2
unqualified-search-registries = ["docker.io"]
3

4
[[registry]]
5
prefix = "docker.io"
6
location = "docker.io"
7
blocked = false
8
insecure = false
9

10
[[registry.mirror]]
11
location = "xxx.mirror.aliyuncs.com"
12
EOF

检查用户权限：

1
grep ecs-user /etc/subuid /etc/subgid
2

3
# 预期输出：
4
# /etc/subuid:ecs-user:100000:65536
5
# /etc/subgid:ecs-user:100000:65536
6
#
7
# 配置命令：
8
# sudo usermod --add-subuids 100000-165535 ecs-user
9
# sudo usermod --add-subgids 100000-165535 ecs-user

安装 Nginx

拉取镜像：

1
podman pull docker.io/library/nginx:alpine

准备目录：

1
mkdir -p ~/nginx-gateway/logs
2
cd ~/nginx-gateway

生成 nginx.conf 配置文件：

1
tee ~/nginx-gateway/nginx.conf <<EOF
2
user nginx;
3
worker_processes auto;      # 自动识别
4
worker_cpu_affinity auto;   # 绑定 CPU 核心
5
worker_rlimit_nofile 65535; # 单个 worker 最大文件描述符
6

7
pid /var/run/nginx.pid;
8
error_log /var/log/nginx/error.log warn;
9

10
events {
11
    use epoll;                  # Linux 最高效事件模型
12
    multi_accept on;            # 一次性接受所有新连接
13
    worker_connections 2048;    # 单 worker 2048 连接
14
}
15

16
http {
17
    # 基础设置
18
    include /etc/nginx/mime.types;
19
    default_type application/octet-stream;
20

21
    # 日志格式
22
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
23
                    '$status $body_bytes_sent "$http_referer" '
24
                    '"$http_user_agent" "$http_x_forwarded_for"'
25
    # 设置访问日志
26
    access_log /var/log/nginx/access.log main buffer=32k flush=5s;
27

28
    # 网络传输优化
29
    sendfile on;        # 零拷贝发送静态文件
30
    tcp_nopush on;      # 累积数据包再发送
31
    tcp_nodelay on;     # 小数据包立即发送
32

33
    # 连接超时管理
34
    keepalive_timeout 60;           # 连接复用 60 秒
35
    keepalive_requests 10000;       # 单连接最大请求数
36
    client_header_timeout 10;       # 读取请求头超时
37
    client_body_timeout 10;         # 读取请求体超时
38
    send_timeout 10;                # 发送响应超时
39
    reset_timedout_connection on;   # 超时后主动关闭连接
40

41
    # 客户端缓冲区限制
42
    client_header_buffer_size 4k;
43
    large_client_header_buffers 4 8k;
44
    client_body_buffer_size 128k;
45
    client_max_body_size 50m;       # 按需调整上传限制
46

47
    # 代理缓冲区
48
    proxy_buffering on;
49
    proxy_buffer_size 4k;
50
    proxy_buffers 8 4k;
51
    proxy_busy_buffers_size 8k;
52
    proxy_temp_file_write_size 64k;
53

54
    # 静态文件缓存
55
    open_file_cache max=2000 inactive=180s;
56
    open_file_cache_min_uses 2;
57
    open_file_cache_valid 300s;
58
    open_file_cache_errors off;
59

60
    # Gzip 压缩
61
    gzip on;
62
    gzip_vary on;
63
    gzip_proxied any;
64
    gzip_buffers 4 16k;
65
    gzip_min_length 1024;
66
    gzip_comp_level 6;
67
    gzip_types text/plain text/css application/javascript application/json text/xml application/xml image/svg+xml;
68

69
    # 隐藏版本号
70
    server_tokens off;
71

72
    server {
73
        listen 80 default_server;
74
        listen [::]:80 default_server;
75
        server_name _;
76

77
        return 444;     # 直接关闭连接
78
    }
79

80
    # 引入站点配置
81
    include /etc/nginx/conf.d/*.conf;
82
}
83
EOF

运行容器：

1
podman run -d --replace \
2
    --name nginx-gateway \
3
    --security-opt=no-new-privileges:true \
4
    --cap-drop=ALL \
5
    --cap-add=CHOWN \
6
    --cap-add=SETUID \
7
    --cap-add=SETGID \
8
    --cap-add=NET_BIND_SERVICE \
9
    -p 80:80 -p 443:443 \
10
    -v ~/nginx-gateway/logs:/var/log/nginx:Z \
11
    -v ~/nginx-gateway/nginx.conf:/etc/nginx/nginx.conf:ro \
12
    --tmpfs /tmp:noexec,nosuid,size=64m \
13
    --tmpfs /var/tmp:noexec,nosuid,size=64m \
14
    --tmpfs /var/run:noexec,nosuid,size=1m \
15
    --tmpfs /var/cache/nginx:noexec,nosuid,size=128m \
16
    --cpus=1.0 \
17
    --cpu-shares=2048 \
18
    --memory=512m \
19
    --memory-swap=512m \
20
    --pids-limit=100 \
21
    --restart=always \
22
    docker.io/library/nginx:alpine

配置容器持久化：

1
tee ~/.config/containers/systemd/nginx-gateway.container <<EOF
2
[Container]
3
Image=docker.io/library/nginx:alpine
4
ContainerName=nginx-gateway
5
NoNewPrivileges=true
6
DropCapability=ALL
7
AddCapability=CHOWN
8
AddCapability=SETUID
9
AddCapability=SETGID
10
AddCapability=NET_BIND_SERVICE
11
PublishPort=80:80
12
PublishPort=443:443
13
Volume=%h/nginx-gateway/logs:/var/log/nginx:Z
14
Volume=%h/nginx-gateway/nginx.conf:/etc/nginx/nginx.conf:ro
15
Tmpfs=/tmp:noexec,nosuid,size=64m
16
Tmpfs=/var/tmp:noexec,nosuid,size=64m
17
Tmpfs=/var/run:noexec,nosuid,size=1m
18
Tmpfs=/var/cache/nginx:noexec,nosuid,size=128m
19
PodmanArgs=--cpus=1.0
20
PodmanArgs=--cpu-shares=2048
21
PodmanArgs=--memory=512m
22
PodmanArgs=--memory-swap=512m
23
PodmanArgs=--pids-limit=100
24

25
[Service]
26
Restart=always
27
RestartSec=10
28
ExecReload=podman kill -s HUP nginx-gateway
29

30
[Install]
31
WantedBy=default.target
32
EOF

重载 systemd 配置并启动 nginx-gateway.service 服务：

1
systemctl --user daemon-reload
2
systemctl --user start nginx-gateway.service

验证状态：

1
systemctl --user status nginx-gateway.service
2
podman ps | grep nginx-gateway

部署个人博客

使用 fnm 管理 node.js

安装依赖：

1
sudo apt install unzip

安装 fnm：

1
curl -fsSL https://fnm.vercel.app/install | bash

安装 node.js：

1
fnm install --lts

安装 pnpm：

1
npm install -g pnpm

构建项目

生成 SSH 密钥：

1
ssh-keygen -t ed25519 -C "deploy@github" -f ~/.ssh/github

将公钥添加到 Github：

1
cat ~/.ssh/github.pub

添加 Github 服务器的公钥指纹：

1
ssh-keyscan github.com >> ~/.ssh/known_hosts

配置 SSH 客户端：

1
tee ~/.ssh/config <<EOF
2
Host github
3
    HostName github.com
4
    User git
5
    IdentityFile ~/.ssh/github
6
    IdentitiesOnly yes
7
EOF

拉取项目文件：

1
git clone git@github:justyycrazy/my-notes.git
2
git clone git@github:justyycrazy/my-vault.git

将代码仓库和笔记仓库关联：

1
cd ~/nginx-gateway/my-notes
2

3
git switch -c build
4
rm -rf ~/nginx-gateway/my-notes/src/content
5
ln -s ~/nginx-gateway/my-vault/src-content ~/nginx-gateway/my-notes/src/content
6
ln -s ~/nginx-gateway/my-vault/src-assets-images/etl-workflow-design-with-kettle ~/nginx-gateway/my-notes/src/assets/images/
7
cp -r ~/nginx-gateway/my-vault/public-uploads ~/nginx-gateway/my-notes/public/uploads

安装依赖并构建项目：

1
pnpm install
2
pnpm build

获取 SSL 证书

安装 acme.sh 并立即生效：

1
curl https://get.acme.sh | bash
2
source ~/.bashrc

设置默认证书服务器：

1
acme.sh --set-default-ca --server letsencrypt

获取 SSL 证书：

1
export Ali_Key=""
2
export Ali_Secret=""
3
acme.sh --issue --dns dns_ali \
4
    -d yycrazy.net \
5
    -d *.yycrazy.net

安装 SSL 证书：

1
mkdir -p ~/.local/share/certs
2
acme.sh --install-cert -d *.yycrazy.net \
3
    --key-file       ~/.local/share/certs/yycrazy.net.key \
4
    --fullchain-file ~/.local/share/certs/yycrazy.net.cer \
5
    --reloadcmd "systemctl --user reload nginx-gateway.service"

配置 Nginx 站点

1
tee ~/nginx-gateway/yycrazy.net.conf <<EOF
2
server {
3
    listen 80;
4
    server_name yycrazy.net www.yycrazy.net;
5

6
    return 301 https://\$host\$request_uri;
7
}
8

9
server {
10
    listen 443 ssl http2;
11
    server_name yycrazy.net www.yycrazy.net;
12

13
    ssl_certificate     /etc/nginx/ssl/yycrazy.net.cer;
14
    ssl_certificate_key /etc/nginx/ssl/yycrazy.net.key;
15

16
    ssl_session_timeout 1d;
17
    ssl_session_cache shared:SSL:50m;
18
    ssl_protocols TLSv1.2 TLSv1.3;
19
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
20
    ssl_prefer_server_ciphers off;
21

22
    root /usr/share/nginx/html;
23
    index index.html;
24

25
    # 静态资源长期缓存
26
    location ~* \.(css|js|ico|svg|png|webp|jpeg|jpg|gif)$ {
27
        expires 1y;
28
        add_header Cache-Control "public, immutable";
29
    }
30

31
    location ^~ /uploads/php5-examples/ {
32
        types {
33
            text/plain php;
34
        }
35
        charset utf-8;
36
        add_header Content-Disposition inline;
37
        add_header X-Content-Type-Options nosniff;
38
    }
39
}
40
EOF

添加挂载点

修改 nginx-gateway 的配置文件：

1
tee ~/.config/containers/systemd/nginx-gateway.container <<EOF
2
[Container]
3
Image=docker.io/library/nginx:alpine
4
ContainerName=nginx-gateway
5
NoNewPrivileges=true
6
DropCapability=ALL
7
AddCapability=CHOWN
8
AddCapability=SETUID
9
AddCapability=SETGID
10
AddCapability=NET_BIND_SERVICE
11
PublishPort=80:80
12
PublishPort=443:443
13
Volume=%h/nginx-gateway/logs:/var/log/nginx:Z
14
Volume=%h/nginx-gateway/nginx.conf:/etc/nginx/nginx.conf:ro
15
Volume=%h/nginx-gateway/yycrazy.net.conf:/etc/nginx/conf.d/yycrazy.net.conf:ro
16
Volume=%h/nginx-gateway/my-notes/dist:/usr/share/nginx/html:ro
17
Volume=%h/.local/share/certs:/etc/nginx/ssl:ro
18
Tmpfs=/tmp:noexec,nosuid,size=64m
19
Tmpfs=/var/tmp:noexec,nosuid,size=64m
20
Tmpfs=/var/run:noexec,nosuid,size=1m
21
Tmpfs=/var/cache/nginx:noexec,nosuid,size=128m
22
PodmanArgs=--cpus=1.0
23
PodmanArgs=--cpu-shares=2048
24
PodmanArgs=--memory=512m
25
PodmanArgs=--memory-swap=512m
26
PodmanArgs=--pids-limit=100
27

28
[Service]
29
Restart=always
30
RestartSec=10
31
ExecReload=podman kill -s HUP nginx-gateway
32

33
[Install]
34
WantedBy=default.target
35
EOF

重载 systemd 配置并重启 nginx-gateway.service 服务：

1
systemctl --user daemon-reload
2
systemctl --user restart nginx-gateway.service

验证状态：

1
systemctl --user status nginx-gateway.service
2
podman ps | grep nginx-gateway
3
``