+
+
Congratulations, OneinStack installed successfully!
+
OneinStack Linux+Nginx/Tengine+MySQL/MariaDB/Percona+PHP+Pureftpd+phpMyAdmin+redis+memcached+jemalloc.
+
Check environment: Proberv phpinfo Opcache phpMyAdmin
+
Create Web virtual running script: ./vhost.sh
+
Create FTP virtual running script: ./pureftpd_vhost.sh
+
For feedback, questions, and to follow the progress of the project: https://oneinstack.com
+
Author email: lj2007331@gmail.com
+
Donate:

+
Paypal: lj2007331@gmail.com Alipay: lj2007331@gmail.com
+
+
+
-
diff --git a/config/index_cn.html b/config/index_cn.html
new file mode 100644
index 00000000..7dde0d4f
--- /dev/null
+++ b/config/index_cn.html
@@ -0,0 +1,38 @@
+
+
+
+
+
+
恭喜您,OneinStack 安装成功!
+
OneinStack Linux+Nginx/Tengine+MySQL/MariaDB/Percona+PHP+Pureftpd+phpMyAdmin+redis+memcached+jemalloc脚本中用到的软件包大多最新稳定版本,修复了一些安全性问题。
+
查看本地环境: 探针 phpinfo Opcache phpMyAdmin(为了更安全,建议重命名 phpMyAdmin 目录!)
+
创建 WEB 虚拟主机执行脚本: ./vhost.sh
+
创建 FTP 虚拟账号执行脚本: ./pureftpd_vhost.sh
+
Github 项目地址: https://github.com/lj2007331/oneinstack
+
OneinStack 官网: https://oneinstack.com
+
QQ 群: 558540514(付费千人群) 262601796(新)
+
赞助我们:

+
Paypal: lj2007331@gmail.com 支付宝: lj2007331@gmail.com
+
+
+
+
+
diff --git a/config/magento2.conf b/config/magento2.conf
index ed3615c7..5b3708bb 100644
--- a/config/magento2.conf
+++ b/config/magento2.conf
@@ -1,14 +1,14 @@
server {
listen 80;
- server_name linuxeye.com;
- set $MAGE_ROOT /data/wwwroot/default;
+ server_name oneinstack.com;
+ set $MAGE_ROOT /data/wwwroot/default;
root $MAGE_ROOT/pub;
index index.php;
autoindex off;
charset UTF-8;
error_page 404 403 /errors/404.php;
#add_header "X-UA-Compatible" "IE=Edge";
-
+
# PHP entry point for setup application
location ~* ^/setup($|/) {
root $MAGE_ROOT;
@@ -19,16 +19,16 @@ server {
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
-
+
location ~ ^/setup/(?!pub/). {
deny all;
}
-
+
location ~ ^/setup/pub/ {
add_header X-Frame-Options "SAMEORIGIN";
}
}
-
+
# PHP entry point for update application
location ~* ^/update($|/) {
root $MAGE_ROOT;
@@ -40,21 +40,21 @@ server {
fastcgi_param PATH_INFO $fastcgi_path_info;
include fastcgi_params;
}
-
+
# Deny everything but index.php
location ~ ^/update/(?!pub/). {
deny all;
}
-
+
location ~ ^/update/pub/ {
add_header X-Frame-Options "SAMEORIGIN";
}
}
-
+
location / {
try_files $uri $uri/ /index.php?$args;
}
-
+
location /pub/ {
location ~ ^/pub/media/(downloadable|customer|import|theme_customization/.*\.xml) {
deny all;
@@ -62,7 +62,7 @@ server {
alias $MAGE_ROOT/pub/;
add_header X-Frame-Options "SAMEORIGIN";
}
-
+
location /static/ {
# Uncomment the following line in production mode
# expires max;
@@ -70,7 +70,7 @@ server {
location ~ ^/static/version {
rewrite ^/static/(version\d*/)?(.*)$ /static/$2 last;
}
-
+
location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
add_header Cache-Control "public";
add_header X-Frame-Options "SAMEORIGIN";
@@ -94,13 +94,13 @@ server {
}
add_header X-Frame-Options "SAMEORIGIN";
}
-
+
location /media/ {
try_files $uri $uri/ /get.php?$args;
location ~ ^/media/theme_customization/.*\.xml {
deny all;
}
-
+
location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
add_header Cache-Control "public";
add_header X-Frame-Options "SAMEORIGIN";
@@ -115,35 +115,35 @@ server {
}
add_header X-Frame-Options "SAMEORIGIN";
}
-
+
location /media/customer/ {
deny all;
}
-
+
location /media/downloadable/ {
deny all;
}
-
+
location /media/import/ {
deny all;
}
-
+
# PHP entry point for main application
location ~ (index|get|static|report|404|503)\.php$ {
try_files $uri =404;
fastcgi_pass unix:/dev/shm/php-cgi.sock;
fastcgi_buffers 1024 4k;
-
+
fastcgi_param PHP_FLAG "session.auto_start=off \n suhosin.session.cryptua=off";
fastcgi_param PHP_VALUE "memory_limit=768M \n max_execution_time=600";
fastcgi_read_timeout 600s;
fastcgi_connect_timeout 600s;
-
+
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
-
+
gzip on;
gzip_disable "msie6";
gzip_comp_level 6;
@@ -163,7 +163,7 @@ server {
application/xml+rss
image/svg+xml;
gzip_vary on;
-
+
# Banned locations (only reached if the earlier PHP entry point regexes don't match)
location ~* (\.php$|\.htaccess$|\.git) {
deny all;
diff --git a/config/nextcloud.conf b/config/nextcloud.conf
deleted file mode 100644
index ca6eed84..00000000
--- a/config/nextcloud.conf
+++ /dev/null
@@ -1,82 +0,0 @@
-#(可选)添加如下header主要为了安全
-add_header X-Content-Type-Options nosniff;
-add_header X-XSS-Protection "1; mode=block";
-add_header X-Robots-Tag none;
-add_header X-Download-Options noopen;
-add_header X-Permitted-Cross-Domain-Policies none;
-
-#(可选)为了支持user_webfinger app
-rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
-
-#这儿是为了支持日历和联系人,建议加上
-location = /.well-known/carddav {
- return 301 $scheme://$host/remote.php/dav;
-}
-location = /.well-known/caldav {
- return 301 $scheme://$host/remote.php/dav;
-}
-
-#设置上传文件的最大大小(还和php里的那个设置有关)
-client_max_body_size 512M;
-fastcgi_buffers 64 4K;
-
-#最主要的,将所有请求转发到index.php上
-location / {
- rewrite ^ /index.php$uri;
-}
-
-#安全设置,禁止访问部分敏感内容
-location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
- deny all;
-}
-location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
- deny all;
-}
-
-#这部分吧,默认就有,不过有所不同,所以我合并了下,替换原来的就行
-location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
- fastcgi_split_path_info ^(.+\.php)(/.*)$;
- fastcgi_param PATH_INFO $fastcgi_path_info;
- fastcgi_param modHeadersAvailable true;
- fastcgi_param front_controller_active true;
- fastcgi_pass unix:/dev/shm/php-cgi.sock;
- fastcgi_intercept_errors on;
- fastcgi_request_buffering off;
- include fastcgi.conf;
-}
-
-#安全设置,禁止访问部分敏感内容
-location ~ ^/(?:updater|ocs-provider)(?:$|/) {
- try_files $uri/ =404;
- index index.php;
-}
-
-location ~ \.(?:css|js|woff|svg|gif)$ {
- try_files $uri /index.php$uri$is_args$args;
- add_header Cache-Control "public, max-age=15778463";
- add_header X-Content-Type-Options nosniff;
- add_header X-XSS-Protection "1; mode=block";
- add_header X-Robots-Tag none;
- add_header X-Download-Options noopen;
- add_header X-Permitted-Cross-Domain-Policies none;
- access_log off;
-}
-
-location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
- try_files $uri /index.php$uri$is_args$args;
- access_log off;
-}
-
-location = /robots.txt {
- allow all;
- log_not_found off;
- access_log off;
-}
-
-gzip on;
-gzip_vary on;
-gzip_comp_level 4;
-gzip_min_length 256;
-gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
-gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
diff --git a/config/nginx.conf b/config/nginx.conf
index 8e722075..c0af2d92 100644
--- a/config/nginx.conf
+++ b/config/nginx.conf
@@ -51,36 +51,11 @@ http {
image/x-icon;
gzip_disable "MSIE [1-6]\.(?!.*SV1)";
- ##Brotli Compression
- #brotli on;
- #brotli_comp_level 6;
- #brotli_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;
-
- ##If you have a lot of static files to serve through Nginx then caching of the files' metadata (not the actual files' contents) can save some latency.
- #open_file_cache max=1000 inactive=20s;
- #open_file_cache_valid 30s;
- #open_file_cache_min_uses 2;
- #open_file_cache_errors on;
-
- log_format json escape=json '{"@timestamp":"$time_iso8601",'
- '"server_addr":"$server_addr",'
- '"remote_addr":"$remote_addr",'
- '"scheme":"$scheme",'
- '"request_method":"$request_method",'
- '"request_uri": "$request_uri",'
- '"request_length": "$request_length",'
- '"uri": "$uri", '
- '"request_time":$request_time,'
- '"body_bytes_sent":$body_bytes_sent,'
- '"bytes_sent":$bytes_sent,'
- '"status":"$status",'
- '"upstream_time":"$upstream_response_time",'
- '"upstream_host":"$upstream_addr",'
- '"upstream_status":"$upstream_status",'
- '"host":"$host",'
- '"http_referer":"$http_referer",'
- '"http_user_agent":"$http_user_agent"'
- '}';
+ #If you have a lot of static files to serve through Nginx then caching of the files' metadata (not the actual files' contents) can save some latency.
+ open_file_cache max=1000 inactive=20s;
+ open_file_cache_valid 30s;
+ open_file_cache_min_uses 2;
+ open_file_cache_errors on;
######################## default ############################
server {
@@ -111,12 +86,9 @@ http {
expires 7d;
access_log off;
}
- location ~ ^/(\.user.ini|\.ht|\.git|\.svn|\.project|LICENSE|README.md) {
+ location ~ /\.ht {
deny all;
}
- location /.well-known {
- allow all;
- }
}
########################## vhost #############################
include vhost/*.conf;
diff --git a/config/nginx_apache.conf b/config/nginx_apache.conf
index ee6399b4..8ae472f0 100644
--- a/config/nginx_apache.conf
+++ b/config/nginx_apache.conf
@@ -51,36 +51,11 @@ http {
image/x-icon;
gzip_disable "MSIE [1-6]\.(?!.*SV1)";
- ##Brotli Compression
- #brotli on;
- #brotli_comp_level 6;
- #brotli_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;
-
- ##If you have a lot of static files to serve through Nginx then caching of the files' metadata (not the actual files' contents) can save some latency.
- #open_file_cache max=1000 inactive=20s;
- #open_file_cache_valid 30s;
- #open_file_cache_min_uses 2;
- #open_file_cache_errors on;
-
- log_format json escape=json '{"@timestamp":"$time_iso8601",'
- '"server_addr":"$server_addr",'
- '"remote_addr":"$remote_addr",'
- '"scheme":"$scheme",'
- '"request_method":"$request_method",'
- '"request_uri": "$request_uri",'
- '"request_length": "$request_length",'
- '"uri": "$uri", '
- '"request_time":$request_time,'
- '"body_bytes_sent":$body_bytes_sent,'
- '"bytes_sent":$bytes_sent,'
- '"status":"$status",'
- '"upstream_time":"$upstream_response_time",'
- '"upstream_host":"$upstream_addr",'
- '"upstream_status":"$upstream_status",'
- '"host":"$host",'
- '"http_referer":"$http_referer",'
- '"http_user_agent":"$http_user_agent"'
- '}';
+ #If you have a lot of static files to serve through Nginx then caching of the files' metadata (not the actual files' contents) can save some latency.
+ open_file_cache max=1000 inactive=20s;
+ open_file_cache_valid 30s;
+ open_file_cache_min_uses 2;
+ open_file_cache_errors on;
######################## default ############################
server {
@@ -116,12 +91,9 @@ http {
expires 7d;
access_log off;
}
- location ~ ^/(\.user.ini|\.ht|\.git|\.svn|\.project|LICENSE|README.md) {
+ location ~ /\.ht {
deny all;
}
- location /.well-known {
- allow all;
- }
}
########################## vhost #############################
include vhost/*.conf;
diff --git a/config/nginx_tomcat.conf b/config/nginx_tomcat.conf
index 710c68ee..090acaa9 100644
--- a/config/nginx_tomcat.conf
+++ b/config/nginx_tomcat.conf
@@ -51,36 +51,11 @@ http {
image/x-icon;
gzip_disable "MSIE [1-6]\.(?!.*SV1)";
- ##Brotli Compression
- #brotli on;
- #brotli_comp_level 6;
- #brotli_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;
-
- ##If you have a lot of static files to serve through Nginx then caching of the files' metadata (not the actual files' contents) can save some latency.
- #open_file_cache max=1000 inactive=20s;
- #open_file_cache_valid 30s;
- #open_file_cache_min_uses 2;
- #open_file_cache_errors on;
-
- log_format json escape=json '{"@timestamp":"$time_iso8601",'
- '"server_addr":"$server_addr",'
- '"remote_addr":"$remote_addr",'
- '"scheme":"$scheme",'
- '"request_method":"$request_method",'
- '"request_uri": "$request_uri",'
- '"request_length": "$request_length",'
- '"uri": "$uri", '
- '"request_time":$request_time,'
- '"body_bytes_sent":$body_bytes_sent,'
- '"bytes_sent":$bytes_sent,'
- '"status":"$status",'
- '"upstream_time":"$upstream_response_time",'
- '"upstream_host":"$upstream_addr",'
- '"upstream_status":"$upstream_status",'
- '"host":"$host",'
- '"http_referer":"$http_referer",'
- '"http_user_agent":"$http_user_agent"'
- '}';
+ #If you have a lot of static files to serve through Nginx then caching of the files' metadata (not the actual files' contents) can save some latency.
+ open_file_cache max=1000 inactive=20s;
+ open_file_cache_valid 30s;
+ open_file_cache_min_uses 2;
+ open_file_cache_errors on;
######################## default ############################
server {
@@ -109,12 +84,9 @@ http {
proxy_pass http://127.0.0.1:8080;
include proxy.conf;
}
- location ~ ^/(\.user.ini|\.ht|\.git|\.svn|\.project|LICENSE|README.md) {
+ location ~ /\.ht {
deny all;
}
- location /.well-known {
- allow all;
- }
}
########################## vhost #############################
include vhost/*.conf;
diff --git a/config/server.xml b/config/server.xml
index f328f932..1ba0a989 100644
--- a/config/server.xml
+++ b/config/server.xml
@@ -20,6 +20,7 @@