Debian 12にFlarumコミュニティソフトウェアをインストールする方法

$ sudo ufw status

Status: inactive

$ sudo ufw allow OpenSSH

$ sudo ufw allow http
$ sudo ufw allow https

$ sudo ufw enable
コマンドは既存のssh接続を中断する可能性があります。操作を続行しますか（y|n）？ y
ファイアウォールはアクティブで、システム起動時に有効になります

$ sudo ufw status

Status: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
443                        ALLOW       Anywhere
OpenSSH (v6)               ALLOW       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)
443 (v6)                   ALLOW       Anywhere (v6)

$ curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor \
    | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null

$ echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/debian `lsb_release -cs` nginx" \
    | sudo tee /etc/apt/sources.list.d/nginx.list

$ sudo apt update

$ sudo apt install nginx

$ sudo nginx -v
nginx version: nginx/1.24.0

$ sudo systemctl start nginx

$ sudo systemctl status nginx
? nginx.service - nginx - 高性能ウェブサーバー
     Loaded: loaded (/lib/systemd/system/nginx.service; enabled; preset: enabled)
     Active: active (running) since Thu 2023-11-09 12:08:18 UTC; 1s ago
       Docs: https://nginx.org/en/docs/
    Process: 1957 ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf (code=exited, status=0/SUCCESS)
   Main PID: 1958 (nginx)
      Tasks: 2 (limit: 1107)
     Memory: 1.7M
        CPU: 6ms
     CGroup: /system.slice/nginx.service
             ??1958 "nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf"
             ??1959 "nginx: worker process"

$ sudo apt install php-cli php-fpm php-mysql php-xml php-gd php-json php-mbstring php-zip php-curl -y

$ sudo curl -sSLo /usr/share/keyrings/deb.sury.org-php.gpg https://packages.sury.org/php/apt.gpg

$ sudo sh -c 'echo "deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'

$ sudo apt update

$ sudo apt install php-cli php-fpm php-mysql php-xml php-gd php-json php-mbstring php-zip php-curl -y

$ php --version

PHP 8.2.12 (cli) (built: Oct 27 2023 13:00:10) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.2.12, Copyright (c) Zend Technologies
    with Zend OPcache v8.2.12, Copyright (c), by Zend Technologies

$ php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
$ php -r "if (hash_file('sha384', 'composer-setup.php') === 'e21205b207c3ff031906575712edab6f13eb0b361f2085f1f1237b7126d785e826a450292b6cfd1d64d92e6563bbde02') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
$ php composer-setup.php
$ php -r "unlink('composer-setup.php');"
$ sudo mv composer.phar /usr/local/bin/composer

$ composer --version
Composer version 2.6.5 2023-10-06 10:11:52

$ sudo curl -o /usr/share/keyrings/mariadb-keyring.pgp 'https://mariadb.org/mariadb_release_signing_key.pgp'

$ echo "deb [signed-by=/usr/share/keyrings/mariadb-keyring.pgp] https://deb.mariadb.org/10.11/debian `lsb_release -cs` main" | sudo tee /etc/apt/sources.list.d/mariadb-server.list

$ sudo apt update

$ sudo apt install mariadb-server -y

$ mysql --version

mysql  Ver 15.1 Distrib 10.11.6-MariaDB, for debian-linux-gnu (x86_64) using  EditLine wrapper

$ sudo systemctl status mariadb
? mariadb.service - MariaDB 10.11.6データベースサーバー
     Loaded: loaded (/lib/systemd/system/mariadb.service; enabled; preset: enabled)
    Drop-In: /etc/systemd/system/mariadb.service.d
             ??migrated-from-my.cnf-settings.conf
     Active: active (running) since Tue 2023-11-14 08:42:03 UTC; 4min 1s ago
       Docs: man:mariadbd(8)
             https://mariadb.com/kb/en/library/systemd/
    Process: 74903 ExecStartPre=/usr/bin/install -m 755 -o mysql -g root -d /var/run/mysqld (code=exited, status=0/SUCCESS)
    Process: 74904 ExecStartPre=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUCCESS)
    Process: 74906 ExecStartPre=/bin/sh -c [ ! -e /usr/bin/galera_recovery ] && VAR= ||   VAR=`cd /usr/bin/..; /usr/bin/galera_recovery`; [ $? -eq 0 ]   && systemctl set-environment _WSREP_START_POSITION=$VAR>
    Process: 74946 ExecStartPost=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUCCESS)
    Process: 74948 ExecStartPost=/etc/mysql/debian-start (code=exited, status=0/SUCCESS)
   Main PID: 74935 (mariadbd)
     Status: "SQLリクエストを受け付けています..."
      Tasks: 9 (limit: 1107)
     Memory: 214.9M
        CPU: 627ms
     CGroup: /system.slice/mariadb.service
             ??74935 /usr/sbin/mariadbd

$ sudo mariadb-secure-installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

MariaDBにログインしてセキュリティを確保するには、現在の
rootユーザーのパスワードが必要です。MariaDBをインストールしたばかりで、まだrootパスワードを設定していない場合は、ここでそのままEnterを押してください。

Enter current password for root (enter for none): [PRESS ENTER]
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

You already have your root account protected, so you can safely answer 'n'.

Switch to unix_socket authentication [Y/n] n
 ... skipping.

You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n] n
 ... skipping.

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] y
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] y
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

$ sudo mysql

Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 39
Server version: 10.11.6-MariaDB-1:10.11.6+maria~deb12 mariadb.org binary distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>

$ sudo mysql

MariaDB> CREATE DATABASE flarum;
MariaDB> CREATE USER 'flarumuser'@'localhost' IDENTIFIED BY 'yourpassword';
MariaDB> GRANT ALL PRIVILEGES ON flarum.* TO 'flarumuser'@'localhost';

MariaDB> GRANT ALL ON *.* TO 'admin'@'localhost' IDENTIFIED BY 'password' WITH GRANT OPTION;

MariaDB> FLUSH PRIVILEGES;

MariaDB> exit

$ sudo mkdir /var/www/flarum -p

$ sudo chown -R $USER:$USER /var/www/flarum

$ cd /var/www/flarum

$ composer create-project flarum/flarum .

$ sudo chown -R nginx:nginx /var/www/flarum

$ sudo chmod 775 -R /var/www/flarum

$ sudo usermod -a -G nginx $USER

su - ${USER}

$ sudo apt install snapd

$ sudo snap install core && sudo snap refresh core

$ sudo snap install --classic certbot

$ sudo ln -s /snap/bin/certbot /usr/bin/certbot

$ certbot --version
certbot 2.7.4

$ sudo certbot certonly --nginx --agree-tos --no-eff-email --staple-ocsp --preferred-challenges http -m [email protected] -d flarum.example.com

$ sudo openssl dhparam -dsaparam -out /etc/ssl/certs/dhparam.pem 4096

$ sudo systemctl list-timers

NEXT                        LEFT           LAST                        PASSED      UNIT                      ACTIVATES     
---------------------------------------------------------------------------------------------------------------------------               
Tue 2023-11-14 15:39:00 UTC 24min left    Tue 2023-11-14 15:09:02 UTC 5min ago     phpsessionclean.timer       phpsessionclean.service
Tue 2023-11-14 17:33:00 UTC 2h 18min left -                           -            snap.certbot.renew.timer    snap.certbot.renew.service
Tue 2023-11-14 19:03:30 UTC 3h 49min left Tue 2023-11-14 15:12:10 UTC 1min 58s ago apt-daily.timer             apt-daily.service

$ sudo certbot renew --dry-run

$ sudo nano /etc/php/8.2/fpm/pool.d/www.conf

; Unix user/group of the child processes. This can be used only if the master
; process running user is root. It is set after the child process is created.
; The user and group can be specified either by their name or by their numeric
; IDs.
; Note: If the user is root, the executable needs to be started with
;       --allow-to-run-as-root option to work.
; Default Values: The user is set to master process running user by default.
;                 If the group is not set, the user's group is used.
user = nginx
group = nginx
...

; Set permissions for unix socket, if one is used. In Linux, read/write
; permissions must be set in order to allow connections from a web server. Many
; BSD-derived systems allow connections regardless of permissions. The owner
; and group can be specified either by name or by their numeric IDs.
; Default Values: Owner is set to the master process running user. If the group
;                 is not set, the owner's group is used. Mode is set to 0660.
listen.owner = nginx
listen.group = nginx

$ sudo sed -i 's/upload_max_filesize = 2M/upload_max_filesize = 8M/' /etc/php/8.2/fpm/php.ini

$ sudo systemctl restart php8.2-fpm

$ sudo chgrp -R nginx /var/lib/php/sessions

$ sudo nano /etc/nginx/conf.d/flarum.conf

server {
    listen [::]:80;
    listen 80;

    server_name flarum.example.com;

    # httpをhttpsにリダイレクト
    return 301 https://flarum.example.com$request_uri;
}

server {
    listen [::]:443 ssl http2;
    listen 443 ssl http2;

    server_name flarum.example.com;

    access_log /var/log/nginx/flarum.access.log;
    error_log  /var/log/nginx/flarum.error.log;

    root /var/www/flarum/public;
    index index.php;

    include /var/www/flarum/.nginx.conf;

    client_max_body_size 8M;

    if ($host != "flarum.example.com") {
        return 301 $scheme://flarum.example.com$request_uri;
    }

    # SSLコード
    ssl_certificate /etc/letsencrypt/live/flarum.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/flarum.example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/flarum.example.com/chain.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;
    ssl_prefer_server_ciphers off;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001] 8.8.8.8 8.8.4.4 [2001:4860:4860::8888] [2001:4860:4860::8844] valid=60s;
    resolver_timeout 2s;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

    tcp_nopush on;
    types_hash_max_size 2048;

    location ~ \.php$ {
        fastcgi_pass  unix:/run/php/php-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_index index.php;
        include  fastcgi_params;
    }
}

$ sudo nano /etc/nginx/nginx.conf   

server_names_hash_bucket_size 64;

$ sudo nginx -t

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

$ sudo systemctl reload nginx

$ cd /var/www/flarum

$ composer require ianm/twofactor:"*"

$ cd /var/www/flarum

$ composer require guzzlehttp/guzzle:^7.0