SSL 证书申请与配置

sudo dnf install certbot python3-certbot-nginx -y

#使用 DNS 验证域名 ( 根据提示会在您的 dns供应商 填写 txt 记录做验证 )

#证书默认位置会放在 /etc/letsencrypt/live/xxx.coolwe.us.kg

#有效期限 90 Day
sudo certbot -d xxx.coolwe.us.kg --manual --preferred-challenges dns certonly

#编辑 Nginx 添加 SSL 证书与反向代理

vi /etc/nginx/conf.d/bookstack.conf

# HTTPS 配置
server {
    listen 443 ssl http2;
    server_name xxx.coolwe.us.kg;

    ssl_certificate /etc/letsencrypt/live/wiki.coolwe.us.kg/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/wiki.coolwe.us.kg/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers HIGH:!aNULL:!MD5;

    root /var/www/BookStack/public;

    access_log  /var/log/nginx/bookstack_access.log;
    error_log  /var/log/nginx/bookstack_error.log;

    client_max_body_size 1G;
    fastcgi_buffers 64 4K;

    index  index.php;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ ^/(?:\.htaccess|data|config|db_structure\.xml|README) {
        deny all;
    }

    location ~ \.php(?:$|/) {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_pass unix:/var/run/php-fpm.sock;
    }

    location ~* \.(?:jpg|jpeg|gif|bmp|ico|png|css|js|swf)$ {
        expires 30d;
        access_log off;
    }
}

#=测试 Nginx 能否正常运行 & 并重启

sudo nginx -t
sudo systemctl reload nginx

#=修改 BookStack.env 访问地址也要修改成域名

vi /var/www/BookStack/.env

#可以使用域名或IP地址方式 (如果您防火墙有做外网映射也需要填上外网+端口)

APP_URL=https://xxx.coolwe.us.kg:10663

#清理缓存

cd /var/www/BookStack

php artisan config:clear

php artisan cache:clear

#重启Nginx

systemctl restart nginx