# BNMP配置
**升级系统和打补丁**
**# freebsd-update fetch**\
**# freebsd-update install**
**如果升级失败**
**# freebsd-update rollback**
**升级后重启服务器**
**# shutdown -r now**
**夜间自动获取补丁**
**# ee /etc/crontab**
**@daily root freebsd-update cron**
**新系统安装软件前先升级ports树**
**获取port树更新**
**# portsnap fetch**
**第一次使用portsnap请extract**
**# portsnap extract**
**更新port树**
**# portsnap update**
**安装port**
**寻找port目录**
**# whereis nginx**
**nginx: /usr/ports/www**
**安装nginx**
**# cd /usr/ports/www/nginx**
**# make install clean**
**安装mysql**
**# cd /usr/ports/databases/mysql57-server**
**# make install clean**
**安装php**
**# cd /usr/ports/lang/php56-extensions**
**# make install clean**
**添加自启动**
**# ee /etc/rc.conf**
**php\_fpm\_enable="YES"**
**nginx\_enable="YES"**
**mysql\_enable="YES"**
**启动nginx**
**# nginx**
**关闭nginx**
**# nginx -s stop**
**热升级,部署,模块替换重载**
**# nginx -s reload**
**升级已安装port**
**安装portmaster**
**# cd /usr/ports/ports-mgmt/portmaster**\
**# make install clean**
**获取需要更新的所有port**
**# portmaster -L**
**自动更新所有port**
**# portmaster -a**
**卸载port**
**# make deinstall**
**Nginx 配置**\
**# ee /usr/local/etc/nginx/nginx.conf**
**load\_module /usr/local/libexec/nginx/ngx\_mail\_module.so;**
**load\_module /usr/local/libexec/nginx/ngx\_stream\_module.so;**
**worker\_processes 8; //指定nginx所用cpu核心数量**
**events {**
**worker\_connections 1024; //每核心用户链接最大数量**
**use kqueue; // 用于BSD内核,Linux用use epoll**
**}**\
**http {**
**include mime.types;**
**default\_type application/octet-stream;**
**sendfile on;**
**keepalive\_timeout 65;**
**server {**
**listen 80;**
**server\_name localhost;**
**location / {**
**root /usr/local/www;**
**index index.html index.htm index.php;**
**if (!-e $request\_filename) {**
**rewrite "^/(.\*)$" /index.php last;**
**}**
**rewrite ^/$/index.php last;**
**}**
**error\_page 404 /404.html;**
**error\_page 500 502 503 504 /50x.html;**
**location = /50x.html {**
**root /usr/local/www/nginx-dist;**
**}**
**location \~ \\.php($|/) {**
**root /usr/local/www;**
**fastcgi\_pass 127.0.0.1:9000;**
**fastcgi\_index index.php;**
**fastcgi\_split\_path\_info ^(.+\\.php)(.\*)$;**
**fastcgi\_param PATH\_INFO $fastcgi\_path\_info;**
**fastcgi\_param SCRIPT\_FILENAME $document\_root$fastcgi\_script\_name;**
**fastcgi\_param PATH\_TRANSLATED $document\_root$fastcgi\_path\_info;**
**include fastcgi\_params;**
**}**
**}**
**}**\
\
**FreeBSD 安装mySql**
**配置文件**
**# ee /usr/local/etc/mysql/my.cnf**\
\
**\[mysqld]**
**socket = /tmp/mysql.sock**
**# Don't listen on a TCP/IP port at all.**
**skip-networking**
**skip-name-resolve**
**#Expire binary logs after one day:**
**expire\_logs\_days = 1**\
**启动服务**
**# service mysql-server start**
**安全配置**
**# mysql\_secure\_installation**
**更换root密码**
**# mysql> ALTER USER 'root'@'localhost' IDENTIFIED BY 'psw', 'root'@'localhost' PASSWORD EXPIRE NEVER;**
**# mysqladmin -u root -p password 'psw'**
**更换数据库位置**
**# cd /var/db**\
**# mv mysql /usr/local/**\
**# ln -s /usr/local/mysql mysql**\
**# cd /usr/local**\
**# chown -R mysql:mysql mysql**
**安装ssl**
**# cd /usr/ports/security/py-certbot**
**# make install clean**
**# certbot certonly --webroot -w /usr/local/www/ -d xxx.com -d** [**www.xxx.com**](http://www.xxx.com/)
**nginx https配置**
**server {**
**listen 80;**
**listen 443 ssl http2;**
**server\_name xxx.com;**
**server\_name [www.xxx.com](http://www.xxx.com);**
**if ($scheme = http) {**
**return 301 https\://$host$request\_uri;**
**}**
**ssl\_certificate /usr/local/etc/letsencrypt/live/xxx.com/fullchain.pem;**
**ssl\_certificate\_key /usr/local/etc/letsencrypt/live/xxx.com/privkey.pem;**
**ssl\_trusted\_certificate /usr/local/etc/letsencrypt/live/xxx.com/chain.pem;**\
**ssl\_protocols TLSv1 TLSv1.1 TLSv1.2;**
**ssl\_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA";**
**ssl\_prefer\_server\_ciphers on;**
**ssl\_ecdh\_curve secp384r1;**
**ssl\_session\_cache shared:SSL:10m;**
**ssl\_session\_timeout 10m;**
**ssl\_session\_tickets off;**
**add\_header Strict-Transport-Security "max-age=31536000";**
**add\_header X-Frame-Options SAMEORIGIN;**
**add\_header X-Content-Type-Options nosniff;**
**resolver 8.8.8.8 8.8.4.4 valid=300s;**
**resolver\_timeout 10s;**
**ssl\_stapling on;**
**ssl\_stapling\_verify on;**
**ssl\_buffer\_size 8k;**
**;…...**
**}**\
**更新证书**
**# certbot renew**\
\
\
\
\