Ubuntu 手把手部署 Nginx + PHP-FPM + MySQL (LEMP) 完整教學

從套件安裝到生產環境調優，一站式 LEMP 架構部署指南

LEMP (Linux, Nginx, MySQL, PHP) 是現代 PHP 應用主流部署架構。本文以 Ubuntu 為例，涵蓋套件安裝、Nginx 虛擬主機、PHP-FPM 池配置、MySQL 安全強化、服務管理與常見問題排查。

1. 系統更新與基礎套件

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl wget gnupg2 software-properties-common

2. 安裝 Nginx

sudo apt install -y nginx
sudo systemctl enable nginx
sudo systemctl start nginx

# 驗證
curl -I https://localhost
# HTTP/1.1 200 OK

重要目錄結構

• 配置：`/etc/nginx/`、`/etc/nginx/sites-available/`、`/etc/nginx/sites-enabled/`
• 執行檔：`/usr/sbin/nginx`
• 日誌：`/var/log/nginx/`
• 預設根目錄：`/var/www/html`
• 啟動腳本：`/etc/init.d/nginx` / `systemctl`

3. 安裝 PHP 7.4/8.x + PHP-FPM

# Ubuntu 20.04+ 內建 PHP 7.4，需新版可加 PPA
sudo add-apt-repository -y ppa:ondrej/php
sudo apt update
sudo apt install -y php8.1 php8.1-fpm php8.1-mysql php8.1-curl php8.1-gd php8.1-mbstring php8.1-xml php8.1-zip php8.1-bcmath php8.1-redis php8.1-opcache

sudo systemctl enable php8.1-fpm
sudo systemctl start php8.1-fpm

關鍵 PHP-FPM 配置

# /etc/php/8.1/fpm/pool.d/www.conf
user = www-data
group = www-data
listen = /run/php/php8.1-fpm.sock  # Unix Socket 效能優於 TCP
listen.owner = www-data
listen.group = www-data
pm = dynamic
pm.max_children = 50
pm.start_servers = 5
pm.min_spare_servers = 5
pm.max_spare_servers = 10
pm.max_requests = 500

# php.ini 安全設定
cgi.fix_pathinfo = 0
expose_php = Off
max_execution_time = 30
memory_limit = 128M
upload_max_filesize = 20M
post_max_size = 20M

4. 安裝 MySQL 8.0

sudo apt install -y mysql-server
sudo systemctl enable mysql
sudo systemctl start mysql

# 安全初始化（設定 root 密碼、移除匿名用戶、禁止 root 遠程登入等）
sudo mysql_secure_installation

建立應用資料庫與用戶

sudo mysql -u root -p
CREATE DATABASE myapp CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'myapp'@'localhost' IDENTIFIED BY 'strong_password';
GRANT ALL PRIVILEGES ON myapp.* TO 'myapp'@'localhost';
FLUSH PRIVILEGES;
EXIT;

5. Nginx 虛擬主機配置

# /etc/nginx/sites-available/myapp.conf
server {
    listen 80;
    server_name myapp.example.com;
    root /var/www/myapp/public;
    index index.php index.html;

    # 安全標頭
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";

    # 靜態檔案快取
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    # PHP 處理
    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.1-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_intercept_errors on;
        fastcgi_buffer_size 16k;
        fastcgi_buffers 4 16k;
    }

    # 隱藏版本資訊
    server_tokens off;

    # 禁止存取隱藏檔案
    location ~ /\.(?!well-known) {
        deny all;
    }
}

啟用站點

sudo ln -s /etc/nginx/sites-available/myapp.conf /etc/nginx/sites-enabled/
sudo nginx -t  # 測試配置語法
sudo systemctl reload nginx

6. 部署測試

# 建立測試檔案
sudo mkdir -p /var/www/myapp/public
echo '

7. 常見問題排查

    
現象
原因與解決
    

        
No input file specified
`SCRIPT_FILENAME` 路徑錯誤，確認 `root` 指令在 `server` 區塊而非 `location`
        
502 Bad Gateway
PHP-FPM 未啟動、Socket 路徑不符、權限問題
        
403 Forbidden
目錄權限、index 指令缺少 index.php
        
檔案上傳失敗
`client_max_body_size`、`upload_max_filesize`、`post_max_size` 太小
    


8. 生產環境優化清單

    
啟用 HTTPS（Let's Encrypt + Certbot）
    
Nginx 開啟 Gzip/Brotli 壓縮
    
PHP OPcache + JIT（PHP 8+）完整啟用
    
MySQL `innodb_buffer_pool_size` 設為記憶體 70%
    
設定 logrotate 管理日誌輪轉
    
配置 fail2ban 防暴力破解
    
定期備份資料庫與程式碼