Rocky Linux 9にPrestaShopをインストールする方法

$ sudo firewall-cmd --state
running

$ sudo firewall-cmd --permanent --list-services

cockpit dhcpv6-client ssh

$ sudo firewall-cmd --permanent --add-service=http
$ sudo firewall-cmd --permanent --add-service=https

$ sudo firewall-cmd --permanent --list-services

cockpit dhcpv6-client http https ssh

$ sudo firewall-cmd --reload

$ sudo nano /etc/yum.repos.d/nginx.repo

[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

[nginx-mainline]
name=nginx mainline repo
baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

$ sudo dnf install nginx -y

$ nginx -v
nginx version: nginx/1.24.0

$ sudo systemctl enable nginx --now

$ sudo systemctl status nginx
? nginx.service - nginx - high performance web server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: disabled)
     Active: active (running) since Sat 2023-11-25 10:58:03 UTC; 5s ago
       Docs: http://nginx.org/en/docs/
    Process: 4220 ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf (code=exited, status=0/SUCCESS)
   Main PID: 4222 (nginx)
      Tasks: 2 (limit: 10841)
     Memory: 1.9M
        CPU: 9ms
     CGroup: /system.slice/nginx.service
             ??4222 "nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf"
             ??4223 "nginx: worker process"

$ sudo dnf install epel-release -y

$ sudo dnf install https://rpms.remirepo.net/enterprise/remi-release-9.rpm

$ dnf module list php -y
Name    Stream              Profiles                                      Summary
php     8.1                 common [d], devel, minimal                    PHP scripting language

Remi's Modular repository for Enterprise Linux 9 - x86_64
Name    Stream              Profiles                                      Summary
php     remi-7.4            common [d], devel, minimal                    PHP scripting language
php     remi-8.0            common [d], devel, minimal                    PHP scripting language
php     remi-8.1            common [d], devel, minimal                    PHP scripting language
php     remi-8.2            common [d], devel, minimal                    PHP scripting language
php     remi-8.3            common [d], devel, minimal                    PHP scripting language

Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled

$ sudo dnf module reset php -y
$ sudo dnf module enable php:remi-8.1

$ sudo dnf install php php-bcmath php-cli php-curl php-common \
    php-fpm php-gd php-gmp php-intl php-mbstring \
    php-mysql php-opcache php-xml php-zip -y

$ php --version
PHP 8.1.26 (cli) (built: Nov 21 2023 21:53:48) (NTS gcc x86_64)
Copyright (c) The PHP Group
Zend Engine v4.1.26, Copyright (c) Zend Technologies
    with Zend OPcache v8.1.26, Copyright (c), by Zend Technologies

$ sudo systemctl enable php-fpm --now

$ sudo systemctl status php-fpm
? php-fpm.service - The PHP FastCGI Process Manager
     Loaded: loaded (/usr/lib/systemd/system/php-fpm.service; enabled; preset: disabled)
     Active: active (running) since Sat 2023-11-25 12:54:31 UTC; 2s ago
   Main PID: 6160 (php-fpm)
     Status: "Ready to handle connections"
      Tasks: 6 (limit: 10841)
     Memory: 15.2M
        CPU: 56ms
     CGroup: /system.slice/php-fpm.service
             ??6160 "php-fpm: master process (/etc/php-fpm.conf)"
             ??6161 "php-fpm: pool www"
             ??6162 "php-fpm: pool www"
             ??6163 "php-fpm: pool www"
             ??6164 "php-fpm: pool www"
             ??6165 "php-fpm: pool www"

$ sudo dnf install -y https://repo.percona.com/yum/percona-release-latest.noarch.rpm

error: can't create transaction lock on /var/lib/rpm/.rpm.lock (Resource temporarily unavailable)
error: /etc/pki/rpm-gpg/RPM-GPG-KEY-Percona: key 1 import failed.

$ percona-release setup ps80

$ sudo dnf -y install percona-server-server

$ mysql --version
mysql  Ver 8.0.34-26 for Linux on x86_64 (Percona Server (GPL), Release 26, Revision 0fe62c85)

$ sudo systemctl start mysqld

$ sudo systemctl status mysqld
? mysqld.service - MySQL Server
     Loaded: loaded (/usr/lib/systemd/system/mysqld.service; enabled; preset: disabled)
     Active: active (running) since Sun 2023-11-26 06:25:37 UTC; 7s ago
       Docs: man:mysqld(8)
             http://dev.mysql.com/doc/refman/en/using-systemd.html
    Process: 6522 ExecStartPre=/usr/bin/mysqld_pre_systemd (code=exited, status=0/SUCCESS)
   Main PID: 6598 (mysqld)
     Status: "Server is operational"
      Tasks: 39 (limit: 10841)
     Memory: 486.8M
        CPU: 8.131s
     CGroup: /system.slice/mysqld.service
             ??6598 /usr/sbin/mysqld

Nov 26 06:25:28 prestashop.example.com systemd[1]: Starting MySQL Server...
Nov 26 06:25:37 prestashop.example.com systemd[1]: Started MySQL Server.

$ sudo grep "temporary password" /var/log/mysqld.log
2023-11-26T06:25:33.316696Z 6 [Note] [MY-010454] [Server] A temporary password is generated for root@localhost: (sDeLSgjs7pI

$ sudo mysql -u root -p

$ sudo mysql_secure_installation

Securing the MySQL server deployment.

Enter password for user root:

The existing password for the user account root has expired. Please set a new password.

New password:

Re-enter new password:

The 'validate_password' component is installed on the server.
The subsequent steps will run with the existing configuration
of the component.
Using existing password for root.

Estimated strength of the password: 100
Change the password for root ? ((Press y|Y for Yes, any other key for No) : N
 ... skipping.

By default, a MySQL installation has an anonymous user,
allowing anyone to log into MySQL without having to have
a user account created for them. This is intended only for
testing, and to make the installation go a bit smoother.
You should remove them before moving into a production
environment.

Remove anonymous users? (Press y|Y for Yes, any other key for No) : Y
Success.

Normally, root should only be allowed to connect from
'localhost'. This ensures that someone cannot guess at
the root password from the network.

Disallow root login remotely? (Press y|Y for Yes, any other key for No) : Y
Success.

By default, MySQL comes with a database named 'test' that
anyone can access. This is also intended only for testing,
and should be removed before moving into a production
environment.

Remove test database and access to it? (Press y|Y for Yes, any other key for No) : Y
 - Dropping test database...
Success.

 - Removing privileges on test database...
Success.

Reloading the privilege tables will ensure that all changes
made so far will take effect immediately.

Reload privilege tables now? (Press y|Y for Yes, any other key for No) : Y
Success.

All done!

$ sudo mysql -u root -p

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 16
Server version: 8.0.34-26 Percona Server (GPL), Release 26, Revision 0fe62c85

Copyright (c) 2009-2023 Percona LLC and/or its affiliates
Copyright (c) 2000, 2023, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>

$ sudo mysql -u root -p

mysql> CREATE DATABASE prestashop COLLATE utf8mb4_general_ci;
mysql> CREATE USER 'prestauser'@'localhost' IDENTIFIED BY 'Your_password2';
mysql> GRANT ALL PRIVILEGES ON prestashop.* TO 'prestauser'@'localhost';

mysql> FLUSH PRIVILEGES;

mysql> exit

$ sudo mkdir /var/www/html/prestashop -p

$ cd /tmp
$ wget https://assets.prestashop3.com/dst/edition/corporate/8.1.1/prestashop_edition_basic_version_8.1.1.zip

$ unzip prestashop_*.zip

$ sudo unzip prestashop.zip -d /var/www/html/prestashop

$ sudo chown -R nginx: /var/www/html/prestashop

$ sudo dnf install -y snapd

$ sudo systemctl enable snapd --now

$ sudo snap install core && sudo snap refresh core

$ sudo ln -s /var/lib/snapd/snap /snap
$ echo 'export PATH=$PATH:/var/lib/snapd/snap/bin' | sudo tee -a /etc/profile.d/snapd.sh

$ sudo snap install --classic certbot

$ sudo ln -s /snap/bin/certbot /usr/bin/certbot

$ certbot --version
certbot 2.7.4

$ sudo certbot certonly --nginx --agree-tos --no-eff-email --staple-ocsp --preferred-challenges http -m [email protected] -d prestashop.example.com

$ sudo openssl dhparam -dsaparam -out /etc/ssl/certs/dhparam.pem 4096

$ sudo systemctl list-timers

NEXT                        LEFT           LAST                        PASSED      UNIT                      ACTIVATES     
---------------------------------------------------------------------------------------------------------------------------               
Sun 2023-11-26 17:12:40 UTC 1h 34min left Sun 2023-11-26 15:25:36 UTC 12min ago    dnf-makecache.timer       dnf-makecache.service
Sun 2023-11-26 17:48:00 UTC 2h 10min left -                           -            snap.certbot.renew.timer  snap.certbot.renew.service
Mon 2023-11-27 00:00:00 UTC 8h left       Sun 2023-11-26 00:00:00 UTC 15h ago      logrotate.timer           logrotate.service

$ sudo certbot renew --dry-run

$ sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/prestashop(/.*)?"

$ sudo restorecon -Rv /var/www/html/prestashop/

$ sudo setsebool -P httpd_can_network_connect_db 1

$ sudo setsebool -P httpd_can_network_connect 1

$ cd ~
$ nano my-phpfpm.te

module my-phpfpm 1.0;

require {
        type unconfined_service_t;
        type httpd_t;
        type httpd_sys_content_t;
        class dir write;
        class unix_stream_socket connectto;
}

#============= httpd_t ============== 

#!!!! This avc is allowed in the current policy
allow httpd_t httpd_sys_content_t:dir write;

#!!!! This avc is allowed in the current policy
allow httpd_t unconfined_service_t:unix_stream_socket connectto;

$ sudo checkmodule -M -m -o my-phpfpm.mod my-phpfpm.te

$ sudo semodule_package -o my-phpfpm.pp -m my-phpfpm.mod

$ sudo semodule -i my-phpfpm.pp

$ sudo nano /etc/php.ini

$ sudo sed -i 's/upload_max_filesize = 2M/upload_max_filesize = 16M/' /etc/php.ini
$ sudo sed -i 's/post_max_size = 8M/post_max_size = 16M/' /etc/php.ini

$ sudo sed -i 's/memory_limit = 128M/memory_limit = 256M/' /etc/php.ini

$ sudo nano /etc/php-fpm.d/www.conf

...
; Unix user/group of processes
; Note: The user is mandatory. If the group is not set, the default user's group
;       will be used.
; RPM: apache user chosen to provide access to the same directories as httpd
user = nginx
; RPM: Keep a group allowed to write in log dir.
group = nginx
...

; Set permissions for unix socket, if one is used. In Linux, read/write
; permissions must be set in order to allow connections from a web server. Many
; BSD-derived systems allow connections regardless of permissions. The owner
; and group can be specified either by name or by their numeric IDs.
; Default Values: user and group are set as the running user
;                 mode is set to 0660
listen.owner = nginx
listen.group = nginx
listen.mode = 0660

$ sudo systemctl restart php-fpm

$ sudo chgrp -R nginx /var/lib/php/session

$ sudo nano /etc/nginx/nginx.conf

server_names_hash_bucket_size 64;

$ sudo nano /etc/nginx/conf.d/prestashop.conf

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    # [EDIT] Your domain name(s) go here.
    server_name prestashop.example.com;

    # [EDIT] Path to your domain Nginx logs.
    access_log /var/log/nginx/prestashop.access.log;
    error_log /var/log/nginx/prestashop.error.log;

    # [EDIT] Path to your SSL certificates (take a look at Certbot https://certbot.eff.org).
    ssl_certificate      /etc/letsencrypt/live/prestashop.example.com/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/prestashop.example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/prestashop.example.com/chain.pem;

    ssl_session_timeout  5m;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;

    # [EDIT] Path to your PrestaShop directory.
    root /var/www/html/prestashop;

    index index.php;

    # This should match the `post_max_size` and/or `upload_max_filesize` settings
    # in your php.ini.
    client_max_body_size 16M;

    # Redirect 404 errors to PrestaShop.
    error_page 404 /index.php?controller=404;

    # HSTS (Force clients to interact with your website using HTTPS only).
    # For enhanced security, register your site here: https://hstspreload.org/.
    # WARNING: Don't use this if your site is not fully on HTTPS!
    # add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" preload; always;

    # [EDIT] If you are using multiple languages.
    # rewrite ^/fr$ /fr/ redirect;
    # rewrite ^/fr/(.*) /$1;

    # Images.
    rewrite ^/(
    # ...
}

$ sudo nginx -t

$ sudo systemctl restart nginx

$ sudo rm -rf /var/www/html/petrashop/install