LNMP 一鍵部署與優化指南 2026

🚀 LNMP 是最流行的 Web 服務器環境。 Linux + Nginx + MySQL + PHP 的組合以其高性能、高穩定性和豐富的生態，成為搭建網站的首選方案。本文從安裝到優化，從安全到性能，帶你打造一個生產級的 LNMP 環境。

本文將帶你係統掌握：

• ✅ LNMP 環境一鍵部署腳本
• ✅ Nginx 配置與優化
• ✅ MySQL 性能調優
• ✅ PHP 配置與優化
• ✅ SSL 證書配置
• ✅ 緩存策略與 CDN
• ✅ 安全加固
• ✅ 監控與日誌

---

一、環境準備

1.1 系統要求

項目	最低配置	推薦配置
CPU	1 核	2 核以上
內存	1GB	2GB 以上
存儲	20GB	50GB SSD
系統	Ubuntu 22.04+ / CentOS 8+	Ubuntu 24.04 / CentOS 9

1.2 更新系統

# Ubuntu/Debian
apt update && apt upgrade -y

# CentOS/RHEL
yum update -y

---

二、一鍵部署腳本

2.1 完整部署腳本

#!/bin/bash
# lnmp-install.sh - LNMP 一鍵部署腳本

set -e

echo "開始安裝 LNMP 環境..."

DOMAIN="your-domain.com"
DB_ROOT_PASSWORD="your-secure-password"
DB_USER="appuser"
DB_PASSWORD="app-password"
DB_NAME="appdb"

# 安裝依賴
echo "安裝基礎依賴..."
if command -v apt &> /dev/null; then
    apt install -y wget curl git build-essential
elif command -v yum &> /dev/null; then
    yum install -y wget curl git gcc gcc-c++ make
fi

# 安裝 Nginx
echo "安裝 Nginx..."
if command -v apt &> /dev/null; then
    apt install -y nginx
elif command -v yum &> /dev/null; then
    yum install -y nginx
fi
systemctl enable nginx
systemctl start nginx

# 安裝 MySQL 8.0
echo "安裝 MySQL..."
if command -v apt &> /dev/null; then
    apt install -y mysql-server
elif command -v yum &> /dev/null; then
    dnf install -y mysql-community-server
fi
systemctl enable mysqld
systemctl start mysqld

# 配置 MySQL
echo "配置 MySQL..."
mysql -u root -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '$DB_ROOT_PASSWORD';"
mysql -u root -p$DB_ROOT_PASSWORD -e "CREATE DATABASE IF NOT EXISTS $DB_NAME CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
mysql -u root -p$DB_ROOT_PASSWORD -e "CREATE USER IF NOT EXISTS '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASSWORD';"
mysql -u root -p$DB_ROOT_PASSWORD -e "GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost';"
mysql -u root -p$DB_ROOT_PASSWORD -e "FLUSH PRIVILEGES;"

# 安裝 PHP 8.3
echo "安裝 PHP..."
if command -v apt &> /dev/null; then
    apt install -y software-properties-common
    add-apt-repository ppa:ondrej/php -y
    apt update
    apt install -y php8.3 php8.3-fpm php8.3-mysql php8.3-mbstring php8.3-xml php8.3-curl php8.3-gd php8.3-zip php8.3-intl
elif command -v yum &> /dev/null; then
    dnf install -y https://rpms.remirepo.net/enterprise/remi-release-9.rpm
    dnf module enable php:remi-8.3 -y
    dnf install -y php php-fpm php-mysqlnd php-mbstring php-xml php-curl php-gd php-zip php-intl
fi
systemctl enable php-fpm
systemctl start php-fpm

# 配置 Nginx
echo "配置 Nginx..."
cat > /etc/nginx/sites-available/$DOMAIN <<EOF
server {
    listen 80;
    server_name $DOMAIN www.$DOMAIN;
    root /var/www/$DOMAIN;
    index index.php index.html;

    location / {
        try_files \$uri \$uri/ /index.php?\$query_string;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }

    location ~ /\.ht {
        deny all;
    }
}
EOF

ln -sf /etc/nginx/sites-available/$DOMAIN /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx

# 創建網站目錄
echo "創建網站目錄..."
mkdir -p /var/www/$DOMAIN
cat > /var/www/$DOMAIN/index.php <<EOF
<?php phpinfo(); ?>
EOF
chown -R www-data:www-data /var/www/$DOMAIN

# 安裝 Certbot
echo "安裝 Certbot..."
if command -v apt &> /dev/null; then
    apt install -y certbot python3-certbot-nginx
elif command -v yum &> /dev/null; then
    dnf install -y certbot python3-certbot-nginx
fi

echo ""
echo "LNMP 安裝完成！"
echo ""
echo "配置信息："
echo "  域名: $DOMAIN"
echo "  MySQL 用戶名: $DB_USER"
echo "  MySQL 密碼: $DB_PASSWORD"
echo "  MySQL 數據庫: $DB_NAME"
echo ""
echo "訪問地址: http://$DOMAIN"
echo ""
echo "下一步："
echo "  1. 配置 DNS 指向服務器 IP"
echo "  2. 運行: certbot --nginx -d $DOMAIN -d www.$DOMAIN"
echo "  3. 上傳網站代碼到 /var/www/$DOMAIN"

2.2 使用方式

# 保存為 lnmp-install.sh
chmod +x lnmp-install.sh

# 修改配置
nano lnmp-install.sh

# 運行
./lnmp-install.sh

---

三、Nginx 配置與優化

3.1 基礎配置

# /etc/nginx/nginx.conf

user www-data;
worker_processes auto;
worker_cpu_affinity auto;

error_log /var/log/nginx/error.log warn;
pid /run/nginx.pid;

events {
    worker_connections 10240;
    use epoll;
    multi_accept on;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;

    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

3.2 站點配置

# /etc/nginx/sites-available/example.com

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options DENY always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options nosniff always;

    root /var/www/example.com;
    index index.php index.html;

    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_read_timeout 300;
        fastcgi_send_timeout 300;
    }

    location ~ /\.ht {
        deny all;
    }

    location ~ /\.git {
        deny all;
    }

    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;

    access_log /var/log/nginx/example.com.access.log main;
    error_log /var/log/nginx/example.com.error.log warn;
}

3.3 Nginx 性能優化

worker_processes auto;
worker_cpu_affinity auto;
worker_connections 10240;

events {
    use epoll;
    multi_accept on;
}

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    keepalive_requests 1000;

    client_body_buffer_size 16k;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 16k;
    client_max_body_size 100m;

    proxy_buffer_size 4k;
    proxy_buffers 8 4k;
    proxy_busy_buffers_size 8k;
}

---

四、MySQL 性能調優

4.1 配置文件

# /etc/mysql/my.cnf

[mysqld]
user            = mysql
pid-file        = /var/run/mysqld/mysqld.pid
socket          = /var/run/mysqld/mysqld.sock
port            = 3306
basedir         = /usr
datadir         = /var/lib/mysql
tmpdir          = /tmp

character-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci

# 根據內存調整
innodb_buffer_pool_size = 2G
innodb_log_file_size = 256M
innodb_log_buffer_size = 64M
innodb_flush_log_at_trx_commit = 2
innodb_flush_method = O_DIRECT

max_connections = 150
wait_timeout = 60
interactive_timeout = 60

slow_query_log = 1
slow_query_log_file = /var/log/mysql/slow.log
long_query_time = 2
log_queries_not_using_indexes = 1

4.2 調優建議

參數	說明	建議值
innodb_buffer_pool_size	InnoDB 緩衝池	內存的 50-70%
innodb_log_file_size	日誌文件大小	256M-1G
innodb_log_buffer_size	日誌緩衝	64M-256M
max_connections	最大連接數	100-500
wait_timeout	連接超時	60-300

4.3 常用優化命令

# 查看當前配置
SHOW VARIABLES LIKE '%innodb%';

# 查看狀態
SHOW STATUS LIKE '%innodb%';

# 查看慢查詢日誌
mysqldumpslow /var/log/mysql/slow.log

# 分析查詢
EXPLAIN SELECT * FROM users WHERE id = 1;

# 優化表
OPTIMIZE TABLE users;

# 查看連接數
SHOW PROCESSLIST;

---

五、PHP 配置與優化

5.1 PHP-FPM 配置

# /etc/php/8.3/fpm/php.ini

memory_limit = 256M
upload_max_filesize = 100M
post_max_size = 100M
max_execution_time = 300
max_input_time = 300

date.timezone = Asia/Shanghai
default_charset = "UTF-8"

opcache.enable = 1
opcache.memory_consumption = 256
opcache.interned_strings_buffer = 8
opcache.max_accelerated_files = 10000
opcache.revalidate_freq = 2
opcache.save_comments = 1
opcache.fast_shutdown = 1

5.2 PHP-FPM Pool 配置

# /etc/php/8.3/fpm/pool.d/www.conf

[www]
user = www-data
group = www-data

listen = /run/php/php8.3-fpm.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660

pm = dynamic
pm.max_children = 50
pm.start_servers = 10
pm.min_spare_servers = 5
pm.max_spare_servers = 20
pm.max_requests = 500

request_terminate_timeout = 300
request_slowlog_timeout = 5
slowlog = /var/log/php8.3-fpm-slow.log

---

六、SSL 證書配置

6.1 使用 Let's Encrypt

# 安裝 Certbot
apt install certbot python3-certbot-nginx

# 獲取證書
certbot --nginx -d example.com -d www.example.com

# 自動續期
certbot renew --dry-run

6.2 自動續期配置

echo "0 3 * * * certbot renew --quiet" | crontab -

---

七、緩存策略

7.1 瀏覽器緩存

location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
}

location ~* \.(html|htm)$ {
    expires 1h;
    add_header Cache-Control "public, must-revalidate";
}

7.2 Nginx 反向代理緩存

http {
    proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=10g inactive=60m;

    server {
        location / {
            proxy_cache my_cache;
            proxy_cache_valid 200 302 10m;
            proxy_cache_valid 404 1m;
            add_header X-Cache-Status $upstream_cache_status;
            proxy_pass http://backend;
        }
    }
}

---

八、安全加固

8.1 禁用危險函數

# php.ini
disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source

8.2 禁用遠程 URL 包含

allow_url_fopen = Off
allow_url_include = Off

8.3 隱藏 PHP 版本

expose_php = Off

8.4 防火牆配置

ufw allow 80/tcp
ufw allow 443/tcp
ufw allow from 你的IP to any port 22
ufw enable

---

九、監控與日誌

9.1 Nginx 日誌分析

# 統計訪問量
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head -10

# 統計狀態碼
awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -nr

# 統計請求最多的頁面
awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head -10

9.2 MySQL 日誌

# 慢查詢日誌
mysqldumpslow /var/log/mysql/slow.log

# 錯誤日誌
tail -f /var/log/mysql/error.log

---

十、總結

LNMP 環境搭建的關鍵在於：

1. 一鍵部署：腳本化安裝，避免手動配置錯誤
2. 性能調優：根據硬件配置調整參數
3. 安全加固：禁用危險函數、配置防火牆、SSL 證書
4. 緩存策略：瀏覽器緩存 + OPCache + 反向代理緩存
5. 監控日誌：定期分析日誌，及時發現問題

🚀 一個優化良好的 LNMP 環境可以支撐上萬級併發訪問。

---

相關文章推薦：

• Linux 系統監控與性能調優實戰
• Let's Encrypt SSL 證書自動化管理
• Linux 網絡排查與故障診斷實戰