Apache, PHP 8.3 (PHP-FPM) の導入

sudo yum -y update

sudo yum -y install epel-release
sudo yum -y install https://rpms.remirepo.net/enterprise/remi-release-9.2.rpm

sudo yum -y install httpd mod_ssl
sudo systemctl enable httpd
sudo systemctl start httpd

sudo yum -y install openssl

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/pki/tls/private/apache-selfsigned.key -out /etc/pki/tls/certs/apache-selfsigned.crt

Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:Shibuya-ku
Organization Name (eg, company) [Default Company Ltd]:Example Company
Organizational Unit Name (eg, section) []:Web Department
Common Name (eg, your name or your server's hostname) []:example.com
Email Address []:email@example.com

sudo vi /etc/httpd/conf.d/ssl.conf

# SSLCertificateFile の設定
SSLCertificateFile /etc/pki/tls/certs/apache-selfsigned.crt

# SSLCertificateKeyFile の設定
SSLCertificateKeyFile /etc/pki/tls/private/apache-selfsigned.key

sudo mkdir -p /home/taro/example.com/logs
sudo mkdir -p /home/taro/example.com/public_html

sudo chmd 0705 /home/taro

<VirtualHost *:80>
    ServerAdmin admin@example.com
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /home/taro/example.com/public_html

    ErrorLog  /home/taro/example.com/logs/error.log
    CustomLog /home/taro/example.com/logs/access.log combined

    Redirect permanent / https://example.com/
</VirtualHost>

<VirtualHost _default_:443>
    ServerAdmin admin@example.com
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /home/taro/example.com/public_html

    ErrorLog  /home/taro/example.com/logs/ssl_error.log
    CustomLog /home/taro/example.com/logs/ssl_access.log combined

    SSLEngine on
    SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH
+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
    SSLHonorCipherOrder on

    SSLCertificateFile /etc/pki/tls/certs/apache-selfsigned.crt
    SSLCertificateKeyFile /etc/pki/tls/private/apache-selfsigned.key
# Let's Encrypt 証明書を使用する場合は、中間証明書(chain.pem)を設定
#   SSLCertificateChainFile /etc/letsencrypt/live/example.com/chain.pem

    Protocols h2 http/1.1

    <Directory /home/taro/example.com/public_html>
        Options -Indexes +FollowSymLinks
        Require all granted
    </Directory>
</VirtualHost>

# Apache2.2以前の設定
Order allow,deny
Allow from all

# Apache2.4以降の設定
Require all granted

sudo yum -y install yum-utils
sudo yum-config-manager --enable remi-safe

sudo dnf module reset php
sudo dnf module enable php:remi-8.3

sudo yum update
sudo yum -y install php php-cli php-fpm php-common php-mysql php-gd php-xml php-mbstring php-json

sudo vi /etc/php-fpm.d/www.conf

; Unix user/group of processes
; Note: The user is mandatory. If the group is not set, the default user's group
;       will be used.
; RPM: apache user chosen to provide access to the same directories as httpd
user = apache
; RPM: Keep a group allowed to write in log dir.
group = apache

sudo systemctl enable php-fpm
sudo systemctl start php-fpm

sudo vi /etc/httpd/conf.d/php.conf

# Redirect to local php-fpm if mod_php (5 or 7) is not available
<IfModule !mod_php5.c>
  <IfModule !mod_php7.c>
    <IfModule !mod_php.c>
      # Enable http authorization headers
      SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1

      <FilesMatch \.(php|phar)$>
          SetHandler "proxy:unix:/run/php-fpm/www.sock|fcgi://localhost"
      </FilesMatch>
    </IfModule>
  </IfModule>
</IfModule>

sudo systemctl restart httpd

sudo setsebool -P httpd_can_network_connect_db 1
sudo setsebool -P httpd_can_network_connect 1

sudo yum install firewalld
sudo systemctl start firewalld
sudo systemctl enable firewalld

sudo firewall-cmd --zone=public --add-service=http --permanent
sudo firewall-cmd --zone=public --add-service=https --permanent
sudo firewall-cmd --reload

sudo certbot --apache -d example.com -d www.example.com

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): email@example.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
Account registered.
Requesting a certificate for example.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/example.com/privkey.pem
This certificate expires on 2023-09-07.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Deploying certificate
Successfully deployed certificate for example.com to /etc/httpd/conf.d/example.com.conf
Congratulations! You have successfully enabled HTTPS on https://example.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

cd /etc/letsencrypt/live/example.com/

sudo vi /etc/httpd/conf.d/example.com.conf

<VirtualHost *:443>
    ServerName example.com
    DocumentRoot /var/www/example.com

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/example.com/chain.pem

    ErrorLog logs/example.com-error_log
    CustomLog logs/example.com-access_log combined
</VirtualHost>

sudo systemctl restart httpd

sudo vi /etc/logrotate.d/httpd

/home/*/logs/*log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    create 0644 root root
    sharedscripts
    postrotate
        if systemctl is-active --quiet httpd.service; then
            systemctl reload httpd.service > /dev/null 2>/dev/null || true
        fi
    endscript
    dateext
    dateformat -%Y%m%d.gz
}