1507 字

8 分钟

VPS服务器部署与运维完全指南

2025-09-17

运维部署

VPS

/

服务器

/

部署

/

运维

/

Linux

/

Nginx

VPS服务器部署与运维完全指南#

作为一名开发者，掌握VPS服务器的部署和运维是必备技能。本文将从选购VPS开始，全面介绍服务器的部署、配置、优化和维护技巧。

1. VPS选购指南#

主流VPS服务商对比#

服务商	优势	缺点	适用场景
DigitalOcean	简单易用，文档丰富	价格较高	新手学习，小型项目
Vultr	性能稳定，全球节点多	支持不够完善	生产环境，全球部署
Linode	性能优秀，稳定性好	价格偏高	企业级应用
阿里云	国内访问快，服务完善	配置复杂	国内业务
腾讯云	价格优惠，生态丰富	性能一般	初学者，个人项目

配置选择建议#

1
# 入门配置（个人博客、小型网站）
2
CPU: 1核
3
RAM: 1GB
4
存储: 25GB SSD
5
流量: 1TB/月
6

7
# 进阶配置（中型应用）
8
CPU: 2核
9
RAM: 4GB
10
存储: 80GB SSD
11
流量: 4TB/月
12

13
# 高级配置（生产环境）
14
CPU: 4核
15
RAM: 8GB
16
存储: 160GB SSD
17
流量: 5TB/月

2. 服务器初始化配置#

系统更新和基础软件安装#

1
# Ubuntu/Debian 系统
2
sudo apt update && sudo apt upgrade -y
3
sudo apt install -y curl wget git vim htop unzip
4

5
# CentOS/RHEL 系统
6
sudo yum update -y
7
sudo yum install -y curl wget git vim htop unzip epel-release

创建新用户和配置 SSH#

1
# 创建新用户
2
sudo useradd -m -s /bin/bash username
3
sudo usermod -aG sudo username
4
sudo passwd username
5

6
# 配置 SSH 密钥登录
7
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"
8

9
# 将公钥复制到服务器
10
mkdir -p ~/.ssh
11
echo "your_public_key" >> ~/.ssh/authorized_keys
12
chmod 700 ~/.ssh
13
chmod 600 ~/.ssh/authorized_keys

SSH 安全配置#

1
# 编辑 SSH 配置文件
2
sudo vim /etc/ssh/sshd_config
3

4
# 修改以下配置
5
Port 2222                    # 修改默认端口
6
PermitRootLogin no           # 禁止 root 登录
7
PasswordAuthentication no    # 禁用密码登录
8
PubkeyAuthentication yes     # 启用密钥登录
9
MaxAuthTries 3              # 限制登录尝试次数
10

11
# 重启 SSH 服务
12
sudo systemctl restart sshd

防火墙配置#

1
# 使用 UFW （Ubuntu）
2
sudo ufw enable
3
sudo ufw default deny incoming
4
sudo ufw default allow outgoing
5
sudo ufw allow 2222/tcp    # SSH 端口
6
sudo ufw allow 80/tcp      # HTTP
7
sudo ufw allow 443/tcp     # HTTPS
8

9
# 使用 firewalld （CentOS）
10
sudo systemctl enable firewalld
11
sudo systemctl start firewalld
12
sudo firewall-cmd --permanent --add-port=2222/tcp
13
sudo firewall-cmd --permanent --add-service=http
14
sudo firewall-cmd --permanent --add-service=https
15
sudo firewall-cmd --reload

3. Web 服务器部署#

Nginx 安装和配置#

1
# 安装 Nginx
2
sudo apt install nginx -y
3
sudo systemctl enable nginx
4
sudo systemctl start nginx
5

6
# 创建网站配置
7
sudo vim /etc/nginx/sites-available/example.com

Nginx 配置示例：

1
server {
2
    listen 80;
3
    server_name example.com www.example.com;
4
    root /var/www/example.com;
5
    index index.html index.php;
6

7
    # 日志配置
8
    access_log /var/log/nginx/example.com.access.log;
9
    error_log /var/log/nginx/example.com.error.log;
10

11
    # Gzip 压缩
12
    gzip on;
13
    gzip_vary on;
14
    gzip_min_length 1024;
15
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
16

17
    # 静态文件缓存
18
    location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
19
        expires 1y;
20
        add_header Cache-Control "public, immutable";
21
    }
22

23
    # PHP 支持
24
    location ~ \.php$ {
25
        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
26
        fastcgi_index index.php;
27
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
28
        include fastcgi_params;
29
    }
30

31
    # 禁止访问隐藏文件
32
    location ~ /\. {
33
        deny all;
34
    }
35
}

SSL 证书配置（Let’s Encrypt）#

1
# 安装 Certbot
2
sudo apt install certbot python3-certbot-nginx -y
3

4
# 获取证书
5
sudo certbot --nginx -d example.com -d www.example.com
6

7
# 设置自动续签
8
sudo crontab -e
9
# 添加以下内容
10
0 12 * * * /usr/bin/certbot renew --quiet

Docker 安装和使用#

1
# 安装 Docker
2
curl -fsSL https://get.docker.com -o get-docker.sh
3
sudo sh get-docker.sh
4
sudo usermod -aG docker $USER
5

6
# 安装 Docker Compose
7
sudo curl -L "https://github.com/docker/compose/releases/download/v2.20.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
8
sudo chmod +x /usr/local/bin/docker-compose

Docker Compose 示例：

1
version: '3.8'
2
services:
3
  nginx:
4
    image: nginx:alpine
5
    ports:
6
      - "80:80"
7
      - "443:443"
8
    volumes:
9
      - ./nginx.conf:/etc/nginx/nginx.conf
10
      - ./html:/usr/share/nginx/html
11
      - ./ssl:/etc/nginx/ssl
12
    restart: unless-stopped
13

14
  app:
15
    build: .
16
    ports:
17
      - "3000:3000"
18
    environment:
19
      - NODE_ENV=production
20
    volumes:
21
      - ./app:/usr/src/app
22
    restart: unless-stopped
23

24
  database:
25
    image: postgres:13
26
    environment:
27
      POSTGRES_DB: myapp
28
      POSTGRES_USER: user
29
      POSTGRES_PASSWORD: password
30
    volumes:
31
      - postgres_data:/var/lib/postgresql/data
32
    restart: unless-stopped
33

34
volumes:
35
  postgres_data:

4. 数据库部署#

MySQL/MariaDB 安装和配置#

1
# 安装 MySQL
2
sudo apt install mysql-server -y
3
sudo mysql_secure_installation
4

5
# 创建数据库和用户
6
sudo mysql -u root -p
7

8
CREATE DATABASE myapp;
9
CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'strong_password';
10
GRANT ALL PRIVILEGES ON myapp.* TO 'appuser'@'localhost';
11
FLUSH PRIVILEGES;
12
EXIT;

Redis 安装和配置#

1
# 安装 Redis
2
sudo apt install redis-server -y
3

4
# 配置 Redis
5
sudo vim /etc/redis/redis.conf
6

7
# 修改以下配置
8
requirepass your_strong_password
9
maxmemory 256mb
10
maxmemory-policy allkeys-lru
11

12
# 重启 Redis
13
sudo systemctl restart redis-server

5. 监控和日志管理#

系统监控脚本#

1
#!/bin/bash
2
# monitor.sh - 系统监控脚本
3

4
LOGFILE="/var/log/system-monitor.log"
5
DATE=$(date '+%Y-%m-%d %H:%M:%S')
6

7
# CPU 使用率
8
CPU_USAGE=$(top -bn1 | grep "Cpu(s)" | awk '{print $2}' | cut -d'%' -f1)
9

10
# 内存使用率
11
MEM_USAGE=$(free | grep Mem | awk '{printf("%.2f", $3/$2 * 100.0)}')
12

13
# 磁盘使用率
14
DISK_USAGE=$(df -h / | awk 'NR==2 {print $5}' | cut -d'%' -f1)
15

16
# 记录日志
17
echo "$DATE - CPU: ${CPU_USAGE}%, Memory: ${MEM_USAGE}%, Disk: ${DISK_USAGE}%" >> $LOGFILE
18

19
# 报警检查
20
if (( $(echo "$CPU_USAGE > 80" | bc -l) )); then
21
    echo "$DATE - WARNING: High CPU usage: ${CPU_USAGE}%" >> $LOGFILE
22
fi
23

24
if (( $(echo "$MEM_USAGE > 80" | bc -l) )); then
25
    echo "$DATE - WARNING: High Memory usage: ${MEM_USAGE}%" >> $LOGFILE
26
fi
27

28
if [ $DISK_USAGE -gt 80 ]; then
29
    echo "$DATE - WARNING: High Disk usage: ${DISK_USAGE}%" >> $LOGFILE
30
fi

日志轮转配置#

1
/var/log/system-monitor.log {
2
    daily
3
    rotate 30
4
    compress
5
    delaycompress
6
    missingok
7
    notifempty
8
    create 644 root root
9
}

使用 Grafana + Prometheus 监控#

1
version: '3.8'
2
services:
3
  prometheus:
4
    image: prom/prometheus
5
    ports:
6
      - "9090:9090"
7
    volumes:
8
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
9
      - prometheus_data:/prometheus
10
    command:
11
      - '--config.file=/etc/prometheus/prometheus.yml'
12
      - '--storage.tsdb.path=/prometheus'
13
      - '--web.console.libraries=/etc/prometheus/console_libraries'
14
      - '--web.console.templates=/etc/prometheus/consoles'
15

16
  grafana:
17
    image: grafana/grafana
18
    ports:
19
      - "3000:3000"
20
    environment:
21
      - GF_SECURITY_ADMIN_PASSWORD=admin123
22
    volumes:
23
      - grafana_data:/var/lib/grafana
24

25
  node_exporter:
26
    image: prom/node-exporter
27
    ports:
28
      - "9100:9100"
29
    volumes:
30
      - /proc:/host/proc:ro
31
      - /sys:/host/sys:ro
32
      - /:/rootfs:ro
33
    command:
34
      - '--path.procfs=/host/proc'
35
      - '--path.sysfs=/host/sys'
36
      - '--collector.filesystem.ignored-mount-points=^/(sys|proc|dev|host|etc)($$|/)'
37

38
volumes:
39
  prometheus_data:
40
  grafana_data:

6. 安全加固#

Fail2ban 配置#

1
# 安装 Fail2ban
2
sudo apt install fail2ban -y
3

4
# 配置 Fail2ban
5
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
6
sudo vim /etc/fail2ban/jail.local
7

8
# 修改配置
9
[DEFAULT]
10
bantime = 3600
11
findtime = 600
12
maxretry = 3
13

14
[sshd]
15
enabled = true
16
port = 2222
17

18
[nginx-http-auth]
19
enabled = true
20

21
# 启动服务
22
sudo systemctl enable fail2ban
23
sudo systemctl start fail2ban

定期安全更新#

1
# 创建自动更新脚本
2
#!/bin/bash
3
echo "Starting system update at $(date)"
4

5
# 更新系统
6
apt update && apt upgrade -y
7

8
# 清理旧包
9
apt autoremove -y
10
apt autoclean
11

12
# 检查是否需要重启
13
if [ -f /var/run/reboot-required ]; then
14
    echo "Reboot required, scheduling reboot in 2 minutes"
15
    shutdown -r +2
16
fi
17

18
echo "System update completed at $(date)"

7. 性能优化#

系统参数优化#

1
# /etc/sysctl.conf 优化
2
vm.swappiness=10
3
net.core.rmem_max=16777216
4
net.core.wmem_max=16777216
5
net.ipv4.tcp_rmem=4096 65536 16777216
6
net.ipv4.tcp_wmem=4096 65536 16777216
7
net.ipv4.tcp_congestion_control=bbr
8

9
# 应用配置
10
sudo sysctl -p

Nginx 性能优化#

1
worker_processes auto;
2
worker_connections 1024;
3

4
http {
5
    sendfile on;
6
    tcp_nopush on;
7
    tcp_nodelay on;
8
    keepalive_timeout 65;
9
    types_hash_max_size 2048;
10

11
    # 缓存配置
12
    open_file_cache max=1000 inactive=20s;
13
    open_file_cache_valid 30s;
14
    open_file_cache_min_uses 2;
15
    open_file_cache_errors on;
16

17
    # Gzip 压缩
18
    gzip on;
19
    gzip_vary on;
20
    gzip_min_length 1024;
21
    gzip_types
22
        text/plain
23
        text/css
24
        text/xml
25
        text/javascript
26
        application/javascript
27
        application/xml+rss
28
        application/json;
29
}