在腾讯云 Ubuntu Server 上用 MariaDB、PHP、nginx 安装 WordPress 和 B2 PRO 主题

ubuntu@VM-0-123-ubuntu:~$

sudo hostnamectl set-hostname server

sudo vi /etc/hosts

127.0.1.1 localhost.localdomain VM-0-123-ubuntu
127.0.0.1 localhost
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

127.0.1.1 localhost.localdomain server

sudo vi /etc/cloud/cloud.cfg

# This will cause the set+update hostname module to not operate (if true)
preserve_hostname: true
preserve_hostname: false

ubuntu@VM-0-123-ubuntu:~$ exec bash
ubuntu@server:~$

ubuntu@server:~$ sudo passwd -S root
root P 2026-05-22 0 99999 7 -1
ubuntu@server:~$ sudo passwd -S ubuntu
ubuntu P 2026-06-02 0 99999 7 -1

ubuntu@server:~$ su
Password:
su: Authentication failure

ubuntu@server:~$ sudo passwd root
New password:
Retype new password:
passwd: password updated successfully

# Authentication:
#LoginGraceTime 2m
PermitRootLogin no
PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

ubuntu@server:~$ sudo sshd -t
ubuntu@server:~$ sudo systemctl restart ssh
ubuntu@server:~$ sudo systemctl status ssh
● ssh.service - OpenBSD Secure Shell server
     Loaded: loaded (/usr/lib/systemd/system/ssh.service; enabled; preset: enabled)
     Active: active (running) since Wed 2026-06-03 20:08:04 CST; 8s ago
TriggeredBy: ● ssh.socket
       Docs: man:sshd(8)
             man:sshd_config(5)
    Process: 1388918 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)
   Main PID: 1388920 (sshd)
      Tasks: 1 (limit: 2265)
     Memory: 1.2M (peak: 1.5M)
        CPU: 16ms
     CGroup: /system.slice/ssh.service
             └─1388920 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"
Jun 03 20:08:04 server systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Jun 03 20:08:04 server sshd[1388920]: Server listening on 0.0.0.0 port 22.
Jun 03 20:08:04 server systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Jun 03 20:08:04 server sshd[1388920]: Server listening on :: port 22.

ubuntu@server:~$ sudo cat /etc/apt/sources.list.d/ubuntu.sources
# 定义这是二进制包仓库
Types: deb
# 注释掉了默认的官方全球源，保留作为参考
#URIs: http://archive.ubuntu.com/ubuntu/
# 设置为腾讯云内网镜像，提供极速下载
URIs: http://mirrors.tencentyun.com/ubuntu/
# 仅包含常规基础包和升级包，不包含 security 分支
Suites: noble noble-updates noble-backports
# 定义组件，main 到 multiverse 全部涵盖
Components: main restricted universe multiverse
# 校验密钥，确保下载的包来自官方
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

# 再次定义这是二进制包仓库
Types: deb
# 注释掉了默认的官方全球源，保留作为参考
#URIs: http://security.ubuntu.com/ubuntu/
# 设置为腾讯云内网镜像，提供极速下载
URIs: http://mirrors.tencentyun.com/ubuntu/
# 这里只指向 security 分支，实现安全仓库的逻辑隔离
Suites: noble-security
# 定义组件，main 到 multiverse 全部涵盖
Components: main restricted universe multiverse
# 校验密钥，确保下载的包来自官方
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

ubuntu@server:~$ sudo cat /etc/apt/sources.list.d/ubuntu.sources
# 定义这是二进制包仓库
Types: deb

# 设置为腾讯云内网镜像，提供极速下载
URIs: http://mirrors.tencentyun.com/ubuntu/

# 定义发布版本套件 (Suites)
# 系统会从这四个仓库分支中查找软件包：
# - noble: Ubuntu 24.04 的初始核心包
# - noble-updates: 常规更新，包含日常修复和功能增强
# - noble-backports: 从更高版本移植回来的包，通常较新但需谨慎
# - noble-security: 最关键的分支，包含所有安全漏洞修复补丁
Suites: noble noble-updates noble-backports noble-security

# 定义组件类别 (Components)
# Ubuntu 按照许可证和支持策略划分的软件库：
# - main: 官方支持的自由软件（最核心）
# - restricted: 官方支持的专有驱动（如显卡驱动）
# - universe: 社区维护的自由软件（包数量最多）
# - multiverse: 社区维护的非自由软件（版权受限）
Components: main restricted universe multiverse

# 定义验证密钥路径 (Signed-By)
# 为了防止中间人攻击，APT 会使用这里的 GPG 密钥来校验下载的包是否被篡改
# 这里指定了官方存档的公钥位置。
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

# 注释掉的原始地址
# 以 "#" 开头，表示这一行被禁用。这是系统安装时的默认源，被你现在的腾讯云源覆盖了
#URIs: http://archive.ubuntu.com/ubuntu/

# 关停服务
ubuntu@server:~$ sudo systemctl stop unattended-upgrades
# 禁止开机自启
ubuntu@server:~$ sudo systemctl disable unattended-upgrades
Synchronizing state of unattended-upgrades.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install disable unattended-upgrades
Removed "/etc/systemd/system/multi-user.target.wants/unattended-upgrades.service".

ubuntu@server:~$ sudo systemctl status unattended-upgrades
○ unattended-upgrades.service - Unattended Upgrades Shutdown
     Loaded: loaded (/usr/lib/systemd/system/unattended-upgrades.service; disabled; preset: enabled)
     Active: inactive (dead)
       Docs: man:unattended-upgrade(8)
Jun 04 10:42:48 server systemd[1]: Stopping unattended-upgrades.service - Unattended Upgrades Shutdown.
Jun 04 10:42:48 server systemd[1]: unattended-upgrades.service: Deactivated successfully.
Jun 04 10:42:48 server systemd[1]: Stopped unattended-upgrades.service - Unattended Upgrades Shutdown.
lines 1-8/8 (END)

# 是否自动更新软件列表
APT::Periodic::Update-Package-Lists "1"; 
APT::Periodic::Update-Package-Lists "0"; 
# 是否从软件列表中筛选出有对应的安全补丁，然后自动下载更新升级安装
APT::Periodic::Unattended-Upgrade "1"; 
APT::Periodic::Unattended-Upgrade "0"; 

# 自动更新软件列表
APT::Periodic::Update-Package-Lists "1"; 
# 从软件列表中筛选出有对应的安全补丁，然后自动下载更新升级安装
APT::Periodic::Unattended-Upgrade "1"; 

ubuntu@server:~$ sudo systemctl enable unattended-upgrades
Synchronizing state of unattended-upgrades.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable unattended-upgrades
Created symlink /etc/systemd/system/multi-user.target.wants/unattended-upgrades.service → /usr/lib/systemd/system/unattended-upgrades.service.
ubuntu@server:~$ sudo systemctl start unattended-upgrades
ubuntu@server:~$ sudo systemctl status unattended-upgrades
● unattended-upgrades.service - Unattended Upgrades Shutdown
     Loaded: loaded (/usr/lib/systemd/system/unattended-upgrades.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-06-04 19:20:33 CST; 6s ago
       Docs: man:unattended-upgrade(8)
   Main PID: 622549 (unattended-upgr)
      Tasks: 2 (limit: 2263)
     Memory: 9.4M (peak: 9.7M)
        CPU: 55ms
     CGroup: /system.slice/unattended-upgrades.service
             └─622549 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait>
Jun 04 19:20:33 server systemd[1]: Started unattended-upgrades.service - Unattended Upgrades Shutdown.
lines 1-12/12 (END)

# 同步最新软件列表
sudo apt update
# 查看可升级软件清单
apt list --upgradable
# 全部软件升级
sudo apt upgrade
# 指定软件升级
sudo apt install --only-upgrade <包名>

ubuntu@server:~$ sudo cat /etc/update-manager/release-upgrades
# Default behavior for the release upgrader.

[DEFAULT]
# Default prompting and upgrade behavior, valid options:
#
#  never  - Never check for, or allow upgrading to, a new release.
#  normal - Check to see if a new release is available.  If more than one new
#           release is found, the release upgrader will attempt to upgrade to
#           the supported release that immediately succeeds the
#           currently-running release.
#  lts    - Check to see if a new LTS release is available.  The upgrader
#           will attempt to upgrade to the first LTS release available after
#           the currently-running one.  Note that if this option is used and
#           the currently-running release is not itself an LTS release the
#           upgrader will assume prompt was meant to be normal.
Prompt=lts
ubuntu@server:~$ sudo do-release-upgrade
Checking for a new Ubuntu release
There is no development version of an LTS available.
To upgrade to the latest non-LTS development release 
set Prompt=normal in /etc/update-manager/release-upgrades.

ubuntu@server:~$ sudo cat /etc/update-manager/release-upgrades
# Default behavior for the release upgrader.

[DEFAULT]
# Default prompting and upgrade behavior, valid options:
#
#  never  - Never check for, or allow upgrading to, a new release.
#  normal - Check to see if a new release is available.  If more than one new
#           release is found, the release upgrader will attempt to upgrade to
#           the supported release that immediately succeeds the
#           currently-running release.
#  lts    - Check to see if a new LTS release is available.  The upgrader
#           will attempt to upgrade to the first LTS release available after
#           the currently-running one.  Note that if this option is used and
#           the currently-running release is not itself an LTS release the
#           upgrader will assume prompt was meant to be normal.
Prompt=normal
ubuntu@server:~$ sudo do-release-upgrade
Checking for a new Ubuntu release

= Welcome to Ubuntu 25.10 'Questing Quokka' =

The Ubuntu team is proud to announce Ubuntu 25.10 'Questing Quokka'.

To see what's new in this release, visit:
  https://wiki.ubuntu.com/QuestingQuokka/ReleaseNotes

Ubuntu is a Linux distribution for your desktop or server, with a fast
and easy install, regular releases, a tight selection of excellent
applications installed by default, and almost any other software you
can imagine available through the network.

We hope you enjoy Ubuntu.

== Feedback and Helping ==

If you would like to help shape Ubuntu, take a look at the list of
ways you can participate at

  https://ubuntu.com/community/contribute

Your comments, bug reports, patches and suggestions will help ensure
that our next release is the best release of Ubuntu ever.  If you feel
that you have found a bug please read:

  https://help.ubuntu.com/community/ReportingBugs

Then report bugs using apport in Ubuntu.  For example:

  ubuntu-bug linux

will open a bug report in Launchpad regarding the linux package.

If you have a question, or if you think you may have found a bug but aren't
sure, first try to reach out on one of the communication channels. Matrix is the
go-to for instant chatting, while Discourse would be more approriate for long
discussions in a more asynchronous way. Otherwise you can still join the #ubuntu
IRC channel on Libera.Chat, send an email to the Ubuntu Users mailing list, or
find some help on the Ubuntu forums:

  https://ubuntu.com/community/communications/matrix
  https://discourse.ubuntu.com/
  https://help.ubuntu.com/community/InternetRelayChat
  https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
  https://ubuntuforums.org/


== More Information ==

You can find out more about Ubuntu on our website, IRC channel and wiki.
If you're new to Ubuntu, please visit:

  https://ubuntu.com/


To sign up for future Ubuntu announcements, please subscribe to Ubuntu's
very low volume announcement list at:

  https://lists.ubuntu.com/mailman/listinfo/ubuntu-announce


Continue [yN] N 

ubuntu@server:~$ sudo cat /etc/update-manager/release-upgrades
# Default behavior for the release upgrader.

[DEFAULT]
# Default prompting and upgrade behavior, valid options:
#
#  never  - Never check for, or allow upgrading to, a new release.
#  normal - Check to see if a new release is available.  If more than one new
#           release is found, the release upgrader will attempt to upgrade to
#           the supported release that immediately succeeds the
#           currently-running release.
#  lts    - Check to see if a new LTS release is available.  The upgrader
#           will attempt to upgrade to the first LTS release available after
#           the currently-running one.  Note that if this option is used and
#           the currently-running release is not itself an LTS release the
#           upgrader will assume prompt was meant to be normal.
Prompt=never
ubuntu@server:~$ sudo do-release-upgrade
Checking for a new Ubuntu release
In /etc/update-manager/release-upgrades Prompt 
is set to never so upgrading is not possible.

# 
ubuntu@server:~$ dpkg -l | grep linux-generic
ii  linux-generic                         6.8.0-101.101                               amd64        Complete Generic Linux kernel and headers
ubuntu@server:~$ hostnamectl
 Static hostname: server
       Icon name: computer-vm
         Chassis: vm 🖴
      Machine ID: 13a3c49a002f4c2eb827a7b9a6dcd1ca
         Boot ID: 87d4905268704c288e4ffe824211f114
  Virtualization: kvm
Operating System: Ubuntu 24.04.4 LTS              
          Kernel: Linux 6.8.0-101-generic
    Architecture: x86-64
 Hardware Vendor: Tencent Cloud
  Hardware Model: CVM
Firmware Version: seabios-1.9.1-qemu-project.org
   Firmware Date: Tue 2014-04-01
    Firmware Age: 12y 2month 4d      

# 同步最新软件列表
sudo apt update

# 查看可升级软件清单
sudo apt list --upgradable

# 如果对某个软件有疑问？查看这个软件的基础信息：一定要注意版本号的前后变化
sudo apt-cache policy <包名>

# 如果对某个软件有进一步疑问？查看这个软件的详细信息：注意查看各种细节
sudo apt-cache show <包名>

# 如果确认这个软件可以升级，那就指定包名来具体升级
sudo apt install --only-upgrade <包名>

# 同步最新软件列表
ubuntu@server:~$ sudo apt update
Hit:1 http://mirrors.tencentyun.com/ubuntu noble InRelease
Get:2 http://mirrors.tencentyun.com/ubuntu noble-updates InRelease [126 kB]
Get:3 http://mirrors.tencentyun.com/ubuntu noble-backports InRelease [126 kB]
... 中间省略 N 行 ...
Fetched 17.3 MB in 3s (5,421 kB/s)                                  
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
150 packages can be upgraded. Run 'apt list --upgradable' to see them.
# 查看可升级软件清单
ubuntu@server:~$ sudo apt list --upgradable
Listing... Done
... 中间省略 N 行 ...
systemd-dev/noble-updates 255.4-1ubuntu8.15 all [upgradable from: 255.4-1ubuntu8.12]
systemd-resolved/noble-updates 255.4-1ubuntu8.15 amd64 [upgradable from: 255.4-1ubuntu8.12]
vim-common/noble-updates,noble-security 2:9.1.0016-1ubuntu7.14 all [upgradable from: 2:9.1.0016-1ubuntu7.9]
vim-runtime/noble-updates,noble-security 2:9.1.0016-1ubuntu7.14 all [upgradable from: 2:9.1.0016-1ubuntu7.9]
vim-tiny/noble-updates,noble-security 2:9.1.0016-1ubuntu7.14 amd64 [upgradable from: 2:9.1.0016-1ubuntu7.9]
vim/noble-updates,noble-security 2:9.1.0016-1ubuntu7.14 amd64 [upgradable from: 2:9.1.0016-1ubuntu7.9]

# 如果觉得可升级软件清单可以直接全部升级
ubuntu@server:~$ sudo apt upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following packages were automatically installed and are no longer required:
  libslirp0 slirp4netns
Use 'sudo apt autoremove' to remove them.
Get more security updates through Ubuntu Pro with 'esm-apps' enabled:
  libmagickcore-6.q16-7t64 imagemagick-6-common libmagickwand-6.q16-7t64
Learn more about Ubuntu Pro at https://ubuntu.com/pro
The following NEW packages will be installed:
... 中间省略 N 行 ...
The following packages have been kept back:
... 中间省略 N 行 ...
The following packages will be upgraded:
... 中间省略 N 行 ...

135 upgraded, 15 newly installed, 0 to remove and 15 not upgraded.
81 standard LTS security updates
Need to get 1,062 MB of archives.
After this operation, 416 MB of additional disk space will be used.
Do you want to continue? [Y/n] Y 
... 中间省略 N 行 ...
# 如果对某个软件有疑问？查看这个软件的基础信息：一定要注意版本号的前后变化
ubuntu@server:~$ sudo apt-cache policy vim
vim:
  Installed: 2:9.1.0016-1ubuntu7.9
  Candidate: 2:9.1.0016-1ubuntu7.14
  Version table:
     2:9.1.0016-1ubuntu7.14 500
        500 http://mirrors.tencentyun.com/ubuntu noble-updates/main amd64 Packages
        500 http://mirrors.tencentyun.com/ubuntu noble-security/main amd64 Packages
 *** 2:9.1.0016-1ubuntu7.9 100
        100 /var/lib/dpkg/status
     2:9.1.0016-1ubuntu7 500
        500 http://mirrors.tencentyun.com/ubuntu noble/main amd64 Packages
# 如果对某个软件有进一步疑问？查看这个软件的详细信息：注意查看各种细节
ubuntu@server:~$ sudo apt-cache show vim
Package: vim
Priority: optional
Section: editors
Installed-Size: 4132
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Architecture: amd64
Version: 2:9.1.0016-1ubuntu7.14
Suggests: ctags, vim-doc, vim-scripts
Provides: editor
Depends: vim-common (= 2:9.1.0016-1ubuntu7.14), vim-runtime (= 2:9.1.0016-1ubuntu7.14), libacl1 (>= 2.2.23), libc6 (>= 2.38), libgpm2 (>= 1.20.7), libpython3.12t64 (>= 3.12.1), libselinux1 (>= 3.1~), libsodium23 (>= 1.0.14), libtinfo6 (>= 6)
Filename: pool/main/v/vim/vim_9.1.0016-1ubuntu7.14_amd64.deb
Size: 1882614
MD5sum: 733d94f47606afea00a4ce57426bb5fc
SHA1: b2608493fb189b4fe5bcca1c7107a5b73c413322
SHA256: d67f4e4f34700b0fdfd59764a3a090565e44d2fdc51936dbd77a61d4ea655a35
... 中间省略 N 行 ...

# 如果确认这个软件可以升级，那就指定包名来具体升级
ubuntu@server:~$ sudo apt install --only-upgrade vim
... 中间省略 N 行 ...

ubuntu@server:~$ sudo ufw status
Status: inactive

# 允许 22 TCP 端口，用于 SSH 和 SFTP，非常重要！如果不放行便启用防火墙，当前 SSH 和 SFTP 会立即中断，就只能通过腾讯云 VNC（网页控制台）来登录修改配置
ubuntu@server:~$ sudo ufw allow 22/tcp
Rules updated
Rules updated (v6)
# 允许 80 TCP 端口，用于 HTTP
ubuntu@server:~$ sudo ufw allow 80/tcp
Rules updated
Rules updated (v6)
# 允许 443 TCP 端口，用于 HTTPS
ubuntu@server:~$ sudo ufw allow 443/tcp
Rules updated
Rules updated (v6)

# 查看防火墙的默认配置文件
ubuntu@server:~$ sudo cat /etc/ufw/before.rules
#
# rules.before
#
# Rules that should be run before the ufw command line added rules. Custom
# rules should be added to one of these chains:
#   ufw-before-input
#   ufw-before-output
#   ufw-before-forward
... 中间省略 N 行 ...
# ok icmp codes for INPUT 
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
... 中间省略 N 行 ...

# 放行局域网 10 段
ubuntu@server:~$ sudo ufw allow from 10.0.0.0/8
Rules updated
# 放行局域网 172.16 段
ubuntu@server:~$ sudo ufw allow from 172.16.0.0/12
Rules updated
# 放行局域网 192.168 段
ubuntu@server:~$ sudo ufw allow from 192.168.0.0/16
Rules updated
# 启用防火墙
ubuntu@server:~$ sudo ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y 
Firewall is active and enabled on system startup
# 查看防火墙状态
ubuntu@server:~$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere                  
80/tcp                     ALLOW       Anywhere                  
443/tcp                    ALLOW       Anywhere                  
Anywhere                   ALLOW       10.0.0.0/8                
Anywhere                   ALLOW       172.16.0.0/12             
Anywhere                   ALLOW       192.168.0.0/16            
22/tcp (v6)                ALLOW       Anywhere (v6)             
80/tcp (v6)                ALLOW       Anywhere (v6)             
443/tcp (v6)               ALLOW       Anywhere (v6)      

# 更新软件列表
ubuntu@server:~$ sudo apt update
Hit:1 http://mirrors.tencentyun.com/ubuntu noble InRelease
Get:2 http://mirrors.tencentyun.com/ubuntu noble-updates InRelease [126 kB]
Hit:3 http://mirrors.tencentyun.com/ubuntu noble-backports InRelease
Hit:4 http://mirrors.tencentyun.com/ubuntu noble-security InRelease
Get:5 http://mirrors.tencentyun.com/ubuntu noble-updates/main amd64 Packages [2,064 kB]
Fetched 2,190 kB in 1s (4,372 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up to date.

# 安装 MariaDB 数据库服务端和客户端
ubuntu@server:~$ sudo apt install -y mariadb-server mariadb-client
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  galera-4 libcgi-fast-perl libcgi-pm-perl libclone-perl libconfig-inifiles-perl libdbd-mysql-perl
  libdbi-perl libencode-locale-perl libfcgi-bin libfcgi-perl libfcgi0t64 libhtml-parser-perl
  libhtml-tagset-perl libhtml-template-perl libhttp-date-perl libhttp-message-perl libio-html-perl
  liblwp-mediatypes-perl libmariadb3 libmysqlclient21 libtimedate-perl liburi-perl liburing2
  mariadb-client-core mariadb-common mariadb-plugin-provider-bzip2 mariadb-plugin-provider-lz4
  mariadb-plugin-provider-lzma mariadb-plugin-provider-lzo mariadb-plugin-provider-snappy
  mariadb-server-core mysql-common pv socat
Suggested packages:
  libmldbm-perl libnet-daemon-perl libsql-statement-perl libdata-dump-perl libipc-sharedcache-perl
  libio-compress-brotli-perl libbusiness-isbn-perl libregexp-ipv6-perl libwww-perl mailx mariadb-test
  doc-base
The following NEW packages will be installed:
  galera-4 libcgi-fast-perl libcgi-pm-perl libclone-perl libconfig-inifiles-perl libdbd-mysql-perl
  libdbi-perl libencode-locale-perl libfcgi-bin libfcgi-perl libfcgi0t64 libhtml-parser-perl
  libhtml-tagset-perl libhtml-template-perl libhttp-date-perl libhttp-message-perl libio-html-perl
  liblwp-mediatypes-perl libmariadb3 libmysqlclient21 libtimedate-perl liburi-perl liburing2
  mariadb-client mariadb-client-core mariadb-common mariadb-plugin-provider-bzip2
  mariadb-plugin-provider-lz4 mariadb-plugin-provider-lzma mariadb-plugin-provider-lzo
  mariadb-plugin-provider-snappy mariadb-server mariadb-server-core mysql-common pv socat
0 upgraded, 36 newly installed, 0 to remove and 0 not upgraded.
Need to get 19.7 MB of archives.
... 中间省略 N 行 ...

# 查询 MariaDB 数据库安装状态
ubuntu@server:~$ mariadb --version
mariadb  Ver 15.1 Distrib 10.11.14-MariaDB, for debian-linux-gnu (x86_64) using  EditLine wrapper 
ubuntu@server:~$ sudo systemctl status mariadb
● mariadb.service - MariaDB 10.11.14 database server
     Loaded: loaded (/usr/lib/systemd/system/mariadb.service; enabled; preset: enabled) 
     Active: active (running) since Sun 2026-06-07 22:41:21 CST; 8min ago
       Docs: man:mariadbd(8)
             https://mariadb.com/kb/en/library/systemd/
   Main PID: 1025733 (mariadbd)
     Status: "Taking your SQL requests now..."
      Tasks: 9 (limit: 14937)
     Memory: 78.6M (peak: 81.8M)
        CPU: 344ms
     CGroup: /system.slice/mariadb.service
             └─1025733 /usr/sbin/mariadbd

... 中间省略 N 行 ...

# 启动 MariaDB 数据库向导设置
ubuntu@server:~$ sudo mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

# 输入当前数据库 root 密码，当前还未设置 root 密码，直接回车
Enter current password for root (enter for none): 
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

You already have your root account protected, so you can safely answer 'n'.

# 是否切换到 Unix 套接字认证？就是用 Linux 服务器 root 用户直接登录数据库，选择 n，单独设置密码登录比较安全
Switch to unix_socket authentication [Y/n] n 
 ... skipping.

You already have your root account protected, so you can safely answer 'n'.

# 设置数据库 root 密码，输入 Y 进行设置
Change the root password? [Y/n] Y             
New password: 
Re-enter new password: 
Password updated successfully!
Reloading privilege tables..
 ... Success!


By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

# 是否移除匿名用户？（选择 Y，移除匿名用户）
Remove anonymous users? [Y/n] Y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

# 禁止 root 账户远程登录？（选择 Y，禁止 root 账户远程登录）
Disallow root login remotely? [Y/n] Y   
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

# 是否移除测试数据库及其访问权限？（选择 Y，移除）
Remove test database and access to it? [Y/n] Y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

# 是否重载特权数据表？（选择 Y，重载）
Reload privilege tables now? [Y/n] Y
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

-- 登录 MariaDB 数据库 
ubuntu@server:~$ sudo mariadb -u root -p 
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or g.
Your MariaDB connection id is 40
Server version: 10.11.14-MariaDB-0ubuntu0.24.04.1 Ubuntu 24.04

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or 'h' for help. Type 'c' to clear the current input statement.

-- 给 WordPress 创建的空白数据库，名字叫 wp_flygoly
MariaDB [(none)]> CREATE DATABASE wp_flygoly DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
Query OK, 1 row affected (0.001 sec) 

-- 查询数据库是否创建
MariaDB [(none)]> SHOW DATABASES;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| sys                |
| wp_flygoly         |
+--------------------+
5 rows in set (0.000 sec)

-- 创建一个专属的数据库用户叫 u_flygoly，并设置专属密码（把下面你的密码改成你自己的）
MariaDB [(none)]> CREATE USER 'u_flygoly'@'localhost' IDENTIFIED BY '你的密码'; 
Query OK, 0 rows affected (0.001 sec)

-- 查询用户是否创建
MariaDB [(none)]> SELECT User, Host, Plugin FROM mysql.user WHERE User = 'u_flygoly';
+-----------+-----------+-----------------------+
| User      | Host      | plugin                |
+-----------+-----------+-----------------------+
| u_flygoly | localhost | mysql_native_password |
+-----------+-----------+-----------------------+
1 row in set (0.001 sec)

-- 把 wp_database 这个库的所有管理权限，全权赋给这个 u_flygoly 用户
MariaDB [(none)]> GRANT ALL PRIVILEGES ON wp_flygoly.* TO 'u_flygoly'@'localhost';
Query OK, 0 rows affected (0.001 sec)

-- 查看指定用户的权限清单
MariaDB [(none)]> SHOW GRANTS FOR 'u_flygoly'@'localhost';
+----------------------------------------------------------------------------------------------+
| Grants for u_flygoly@localhost                                                                                   |
+----------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO `u_flygoly`@`localhost` IDENTIFIED BY PASSWORD '*A9BFF655D21' |
| GRANT ALL PRIVILEGES ON `wp_flygoly`.* TO `u_flygoly`@`localhost`                                                |
+----------------------------------------------------------------------------------------------+
2 rows in set (0.000 sec)

-- 让数据库重新加载权限表
MariaDB [(none)]> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.000 sec)

-- 退出
MariaDB [(none)]> exit
Bye

# PHP 默认源版本确认：查询是否有 PHP 8.4 版本
ubuntu@server:~$ sudo apt list -a php8.4
Listing... Done

# PHP 默认源版本确认：查询是否有 PHP 8.3 版本
ubuntu@server:~$ sudo apt list -a php8.3
Listing... Done
php8.3/noble-updates,noble-security 8.3.6-0ubuntu0.24.04.9 all
php8.3/noble 8.3.6-0maysync1 all

# 追加第三方 PHP 软件源：ppa:ondrej/php 由 Debian 官方 PHP 核心维护者 Ondřej Surý 长期维护
ubuntu@server:~$ sudo add-apt-repository -y ppa:ondrej/php
PPA publishes dbgsym, you may need to include 'main/debug' component
Repository: 'Types: deb
URIs: https://ppa.launchpadcontent.net/ondrej/php/ubuntu/
Suites: noble
Components: main
'
Description:
Co-installable PHP versions: PHP 5.6, PHP 7.x, PHP 8.x and most requested extensions are included. Packages are provided for *Current* Ubuntu *LTS* releases (https://wiki.ubuntu.com/Releases).  Expanded Security Maintenance releases ARE NOT supported.

Debian stable, oldstable and Debian LTS packages are provided from a separate repository: https://deb.sury.org/#debian-dpa

You can get more information about the packages at https://deb.sury.org

BUGS&FEATURES: This PPA has a issue tracker:
https://deb.sury.org/#bug-reporting

Issues reported in a private email don't scale and most likely will be ignored.  I simply don't have capacity to answer questions privately.

DONATION AND COMMERCIAL SUPPORT: Support for PHP packages for older Debian and Ubuntu release can be bought from https://www.freexian.com/lts/php/
More info: https://launchpad.net/~ondrej/+archive/ubuntu/php
Adding repository.
Hit:1 http://mirrors.tencentyun.com/ubuntu noble InRelease
Hit:2 http://mirrors.tencentyun.com/ubuntu noble-updates InRelease
Hit:3 http://mirrors.tencentyun.com/ubuntu noble-backports InRelease
Hit:4 http://mirrors.tencentyun.com/ubuntu noble-security InRelease
Get:5 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble InRelease [24.3 kB]
Get:6 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 Packages [143 kB]
Get:7 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main Translation-en [43.7 kB]
Fetched 211 kB in 4s (56.2 kB/s)          
Reading package lists... Done

# 更新下软件列表
ubuntu@server:~$ sudo apt update
Hit:1 http://mirrors.tencentyun.com/ubuntu noble InRelease
Hit:2 http://mirrors.tencentyun.com/ubuntu noble-updates InRelease
Hit:3 http://mirrors.tencentyun.com/ubuntu noble-backports InRelease
Hit:4 http://mirrors.tencentyun.com/ubuntu noble-security InRelease
Hit:5 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble InRelease
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
1 package can be upgraded. Run 'apt list --upgradable' to see it.
Listing... Done

# 安装各种 PHP 组件及服务
ubuntu@server:~$ sudo apt install -y php8.4-fpm php8.4-mysql php8.4-redis php8.4-opcache php8.4-curl php8.4-xml php8.4-xmlrpc php8.4-zip php8.4-intl php8.4-soap php8.4-gd php8.4-imagick php8.4-mbstring
... 中间省略 N 行 ...

# 查看 PHP 版本
ubuntu@server:~$ php -v
PHP 8.4.22 (cli) (built: Jun  6 2026 06:34:49) (NTS)
Copyright (c) The PHP Group
Built by Ubuntu
Zend Engine v4.4.22, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.22, Copyright (c), by Zend Technologies

# 查看 PHP 服务状态
ubuntu@server:~$ sudo systemctl status php8.4-fpm
● php8.4-fpm.service - The PHP 8.4 FastCGI Process Manager
     Loaded: loaded (/usr/lib/systemd/system/php8.4-fpm.service; enabled; preset: enabled)
     Active: active (running) since Mon 2026-06-08 17:02:28 CST; 4min 4s ago
       Docs: man:php-fpm8.4(8)
    Process: 1291044 ExecStartPost=/usr/lib/php/php-fpm-socket-helper install /run/php/php-fpm.sock /et>
   Main PID: 1291041 (php-fpm8.4)
     Status: "Processes active: 0, idle: 2, Requests: 0, slow: 0, Traffic: 0.00req/sec"
      Tasks: 3 (limit: 2263)
     Memory: 13.4M (peak: 14.2M)
        CPU: 81ms
     CGroup: /system.slice/php8.4-fpm.service
             ├─1291041 "php-fpm: master process (/etc/php/8.4/fpm/php-fpm.conf)"
             ├─1291042 "php-fpm: pool www"
             └─1291043 "php-fpm: pool www"

Jun 08 17:02:28 server systemd[1]: Starting php8.4-fpm.service - The PHP 8.4 FastCGI Process Manager...
Jun 08 17:02:28 server systemd[1]: Started php8.4-fpm.service - The PHP 8.4 FastCGI Process Manager.

# 安装 nginx
ubuntu@server:~$ sudo apt install -y nginx
... 中间省略 N 行 ...

# 查看 nginx 版本
ubuntu@server:~$ nginx -v
nginx version: nginx/1.24.0 (Ubuntu)
# 查看 nginx 状态
ubuntu@server:~$ sudo systemctl status nginx
● nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled)
     Active: active (running) since Mon 2026-06-08 17:37:51 CST; 1min 59s ago
       Docs: man:nginx(8)
    Process: 1299427 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, >
    Process: 1299429 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/>
   Main PID: 1299459 (nginx)
      Tasks: 3 (limit: 2263)
     Memory: 2.4M (peak: 5.2M)
        CPU: 22ms
     CGroup: /system.slice/nginx.service
             ├─1299459 "nginx: master process /usr/sbin/nginx -g daemon on; master_process on;"
             ├─1299460 "nginx: worker process"
             └─1299461 "nginx: worker process"

Jun 08 17:37:51 server systemd[1]: Starting nginx.service - A high performance web server and a reverse>
Jun 08 17:37:51 server systemd[1]: Started nginx.service - A high performance web server and a reverse >
lines 1-17/17 (END)

# 安装 unzip 解压工具
ubuntu@server:~$ sudo apt install -y unzip
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
unzip is already the newest version (6.0-28ubuntu4.1).
0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.

# 创建 WordPress 安装目录
ubuntu@server:~$ sudo mkdir -p /var/www/flygoly.com/www
# 进入 WordPress 安装目录
ubuntu@server:~$ cd /var/www/flygoly.com/www
# 下载 WordPress 安装包
ubuntu@server:/var/www/flygoly.com/www$ sudo sudo wget https://cn.wordpress.org/latest-zh_CN.zip
--2026-06-08 19:55:20--  https://cn.wordpress.org/latest-zh_CN.zip
Resolving cn.wordpress.org (cn.wordpress.org)... 198.143.164.252, 2607:f978:5:8002::c68f:a4fc
Connecting to cn.wordpress.org (cn.wordpress.org)|198.143.164.252|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 39064518 (37M) [application/zip]
Saving to: ‘latest-zh_CN.zip’

latest-zh_CN.zip   100%   [===============>]  37.25M  2.33MB/s    in 21s     

2026-06-08 19:55:42 (1.75 MB/s) - ‘latest-zh_CN.zip’ saved [39064518/39064518]

ubuntu@server:/var/www/flygoly.com/www$ ls
latest-zh_CN.zip

# 解压 WordPress 并将中文核心源码“脱壳”平移到 www 根目录
ubuntu@server:/var/www/flygoly.com/www$ sudo unzip latest-zh_CN.zip && sudo mv wordpress/* . 2>/dev/null || true && sudo mv wordpress/.* . 2>/dev/null || true
Archive:  latest-zh_CN.zip
   creating: wordpress/
  inflating: wordpress/wp-login.php  
  inflating: wordpress/wp-cron.php   

# 删除 wordpress 空目录和 .zip 安装包
ubuntu@server:/var/www/flygoly.com/www$ sudo rm -rf wordpress latest-zh_CN.zip

# 执行权限侦察命令
ubuntu@server:/var/www/flygoly.com/www$ ps -eo user,group,comm | grep -E 'nginx|php-fpm' | grep -v 'root'
www-data www-data php-fpm8.4
www-data www-data php-fpm8.4
www-data www-data nginx
www-data www-data nginx

# 查看 WordPress 网站目录的归属权
ubuntu@server:/var/www/flygoly.com/www$ ls -ld /var/www/flygoly.com/www
drwxr-xr-x 5 root root 4096 Jun  8 19:57 /var/www/flygoly.com/www

# 切换 WordPress 网站目录的归属权和修改读写权限
ubuntu@server:/var/www/flygoly.com/www$ sudo chown -R www-data:www-data /var/www/flygoly.com/www
ubuntu@server:/var/www/flygoly.com/www$ sudo chmod -R 755 /var/www/flygoly.com/www
# 查看 WordPress 网站目录的归属权和修改读写权限
ubuntu@server:/var/www/flygoly.com/www$ ls -ld /var/www/flygoly.com/www
drwxr-xr-x 5 www-data www-data 4096 Jun  8 19:57 /var/www/flygoly.com/www

# -----------------------------------------------------------------------
# Nginx 核心全局通用配置文件
# -----------------------------------------------------------------------

# 核心运行用户：必须与 PHP 8.4 及网站目录所有者 (www-data) 严格对齐，彻底根治 403 权限拒绝报错
user www-data;

# 工作进程数：设置为 auto，系统会自动根据你的腾讯云服务器 CPU 核心数启动对等数量的进程，性能压榨干净
worker_processes auto;

# 错误日志存放路径：设置为 warn 级别，既能捕捉关键错误和警告，又不会因为狂刷无用信息把硬盘塞满
error_log /var/log/nginx/error.log warn;

# Nginx 主进程的 PID (进程标识号) 文件存放位置，系统管理 Nginx 服务时的标准锚点
pid /run/nginx.pid;

events {
    # 每个工作进程允许的最大同时连接数。auto 模式下，总并发能力 = CPU核心数 * 1024
    worker_connections 1024;
}

http {
    # 引入系统标准的 MIME 类型映射表，让 nginx 认得什么是 CSS、JavaScript、图片等，防止浏览器把网页下载下来
    include       /etc/nginx/mime.types;
    
    # 遇到不认识的文件类型时的默认处理方式：设置为二进制流，提示浏览器下载
    default_type  application/octet-stream;

    # 定义标准的日志打印格式，命名为 main，包含：客户端IP、访问时间、请求内容、状态码、浏览器标识等
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    # 全局访问日志开关：将所有成功的访问记录到 access.log 中，采用刚才定义的 main 格式
    access_log  /var/log/nginx/access.log  main;

    # 开启高效文件传输模式：直接在内核空间完成文件投递，不经过用户空间缓冲区，大幅提升静态文件吞吐量
    sendfile            on;
    
    # 配合 sendfile 使用：在一条数据包里发送所有 HTTP 响应头，减少网络报头碎片，提高传输效率
    tcp_nopush          on;
    
    # 禁用 Nagle 算法：只要有数据就立刻发送，不进行等待延时，对实时性要求高的动态网页极度友好
    tcp_nodelay         on;
    
    # 保持连接超时时间：客户端连接在服务器上最多空闲 65 秒，既保证复用，又防止恶意占用连接资源
    keepalive_timeout   65;
    
    # 类型哈希表的最大大小：增大到 4096，防止以后引入超长自定义扩展名时 Nginx 自检报表溢出错误
    types_hash_max_size 4096;

    # 允许客户端上传的最大文件限制：放大到 128M，完美解决 WordPress 无法上传大视频、大型 B2Pro 主题包的限制
    client_max_body_size 128M;
    
    # 极其重要的安全防线：彻底关闭在报错页面显示 Nginx 的具体版本号，防止黑客针对特定版本漏洞发起盲测攻击
    server_tokens off;

    # -------------------------------------------------------------------
    # Gzip 网页智能动态压缩优化 (让前端加载速度飙升 3 倍的杀手锏)
    # -------------------------------------------------------------------
    gzip on;             # 开启 Gzip 压缩功能
    gzip_vary on;        # 让 Nginx 告诉前端浏览器，强制根据支持情况缓存压缩版本，避免老旧浏览器乱码
    gzip_proxied any;    # 无论什么类型的代理请求，通通允许压缩
    gzip_comp_level 4;   # 压缩级别设置为 4（1-9可选），这是 CPU 消耗与压缩比之间的最佳黄金平衡点
    # 明确指定哪些类型的文件需要压缩（文本、样式、脚本、JSON、矢量图），图片本身已被压缩，故排除
    gzip_types
        text/plain text/css text/xml text/javascript application/json
        application/javascript application/xml+rss application/rss+xml
        image/svg+xml;

    # -------------------------------------------------------------------
    # FastCGI (PHP 翻译官) 核心高速缓存与超时防御
    # -------------------------------------------------------------------
    fastcgi_buffers 8 16k;         # 分配 8 个 16k 的缓冲区来接收 PHP 返回的大网页，防止大页面直接写硬盘
    fastcgi_buffer_size 32k;       # 设置响应头缓冲区大小为 32k，完美容纳 B2Pro 主题复杂的动态 HTTP 头
    fastcgi_connect_timeout 300;   # Nginx 连接 PHP 的超时时间拉长到 300 秒，防止后台跑耗时任务时超时
    fastcgi_send_timeout 300;      # Nginx 向 PHP 发送请求的超时时间，同样拉长到 300 秒防断流
    fastcgi_read_timeout 300;      # Nginx 等待 PHP 吐出数据的超时时间，拉长到 300 秒彻底告别 504 Gateway Timeout

    # -------------------------------------------------------------------
    # 模块化包含：保持主配置纯净，把具体的站点配置文件挪到外部管理
    # -------------------------------------------------------------------
    include /etc/nginx/conf.d/*.conf;
}

# 验证配置
ubuntu@server:/var/www/flygoly.com/www$ sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# 平滑重载
ubuntu@server:/var/www/flygoly.com/www$ sudo nginx -s reload
2026/06/08 21:14:59 [notice] 1349247#1349247: signal process started

# -----------------------------------------------------------------------
# flygoly.com 专属虚拟主机配置文件 (多站点、强制 HTTPS、大厂规范完全体)
# -----------------------------------------------------------------------

# -------------------------------------------------------------------
# 防线 1：所有 HTTP (80端口) 流量全量拦截，强制 301 重定向到 HTTPS 纯净主域名
# -------------------------------------------------------------------
server {
    listen 80;                           # 监听 IPv4 的 80 标准 HTTP 端口
    listen [::]:80;                      # 监听 IPv6 的 80 标准 HTTP 端口
    server_name flygoly.com www.flygoly.com; # 同时捕捉不带 www 和带 www 的两种访问形态
    
    # 甩出 301 永久重定向，把所有流量无缝导向标准的 https://flygoly.com，顺便带上用户原本要访问的路径 ($request_uri)
    return 301 https://flygoly.com$request_uri;
}

# -------------------------------------------------------------------
# 防线 2：HTTPS www 镜像站点拦截，全量 301 重定向到无 www 的极致纯净主域名
# -------------------------------------------------------------------
server {
    listen 443 ssl;                      # 监听 IPv4 的 443 加密 HTTPS 端口
    listen [::]:443 ssl;                 # 监听 IPv6 的 443 加密 HTTPS 端口
    server_name www.flygoly.com;         # 只精准捕捉带 www 的加密访问

    # 【完美对齐新名字新路径】腾讯云公钥证书束 (包含根证书与中间证书)
    ssl_certificate            /etc/nginx/ssl/flygoly.com/flygoly.com.bundle.crt;
    # 【完美对齐新名字新路径】腾讯云私钥 (网站的最高加密机密)
    ssl_certificate_key        /etc/nginx/ssl/flygoly.com/flygoly.com.key;
    # 【完美对齐新名字新路径】咱们自己搓出来的 2048 位 Diffie-Hellman 前向安全性黄金盾牌
    ssl_dhparam                /etc/nginx/ssl/flygoly.com/flygoly.com.dhparam.pem;

    # 握手协议锁死：只允许现代绝对安全的 TLSv1.2 和 TLSv1.3，直接废除已经诞生漏洞的古董级 TLSv1.0/1.1
    ssl_protocols              TLSv1.2 TLSv1.3;
    # 加密算法套件：只挑国际顶级、防监听性能最强悍的高强度算法组合
    ssl_ciphers                EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;
    # 强制让客户端（浏览器）听从我们服务器定下的高强度加密算法顺序，不向低安全浏览器妥协
    ssl_prefer_server_ciphers  on;
    # SSL 会话缓存：在所有工作进程间共享 10 兆的会话缓存（大约能缓存 4 万个用户的握手状态，大幅减少 CPU 重复计算）
    ssl_session_cache          shared:SSL:10m;
    # 会话超时时间：允许客户端免握手复用连接的时间为 10 分钟
    ssl_session_timeout        10m;

    # 完成验明正身后，同样 301 永久平移给无 www 的顶级主域名，确保全站权重集中在一处
    return 301 https://flygoly.com$request_uri;
}

# -------------------------------------------------------------------
# 防线 3：核心主站正式核心点火配置 (纯净无 www 顶级大本营)
# -------------------------------------------------------------------
server {
    listen 443 ssl;                      # 监听 IPv4 的 443 加密端口
    listen [::]:443 ssl;                 # 监听 IPv6 的 443 加密端口
    server_name flygoly.com;             # 独家名正言顺的主域名大本营
    
    # 【完美对齐高端目录结构】指向你指定的、具备高度扩展性的主站 www 源码根目录
    root /var/www/flygoly.com/www;
    
    # 默认首页加载顺序：优先寻找 index.php 动态脚本，找不到再退化去读 index.html 静态页
    index index.php index.html;

    # ---------------------------------------------------------------
    # 金融级 SSL 顶级安全防线 (主站镜像对齐)
    # ---------------------------------------------------------------
    ssl_certificate            /etc/nginx/ssl/flygoly.com/flygoly.com.bundle.crt;
    ssl_certificate_key        /etc/nginx/ssl/flygoly.com/flygoly.com.key;
    ssl_dhparam                /etc/nginx/ssl/flygoly.com/flygoly.com.dhparam.pem;
    ssl_protocols              TLSv1.2 TLSv1.3;
    ssl_ciphers                EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;
    ssl_prefer_server_ciphers  on;
    ssl_session_cache          shared:SSL:10m;
    ssl_session_timeout        10m;

    # ---------------------------------------------------------------
    # 国际标准：三大高端安全响应头 (给浏览器下的死命令，防劫持)
    # ---------------------------------------------------------------
    # HSTS 强效盾牌：强制让访问过一次的浏览器在未来 1 年内 (31536000秒) 哪怕手动敲 http 也必须用 https 访问，包含子域名
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    # 防嗅探：严禁浏览器自作聪明去猜测检测响应的文件类型，必须严格按照 Nginx 宣告的 MIME 运行，封杀恶意脚本伪装成图片
    add_header X-Content-Type-Options nosniff;
    # XSS 防御栏杆：开启浏览器自带的跨站脚本攻击 (XSS) 过滤器，一旦发现恶意代码注入直接死锁并停止渲染网页
    add_header X-XSS-Protection "1; mode=block";

    # ---------------------------------------------------------------
    # 静态资源 30 天超长期浏览器本地缓存 (大幅缩减服务器公网带宽消耗)
    # ---------------------------------------------------------------
    # 正则匹配常见的图片、样式、脚本、字体和矢量图文件
    location ~* .(jpg|jpeg|png|gif|ico|css|js|woff2|svg)$ {
        expires 30d; # 强令浏览器本地缓存 30 天，30天内用户二次进站不需要重复向服务器下载这些静态件
        add_header Cache-Control "public, max-age=2592000"; # 宣告此缓存为公共资源，最大生命期 2592000 秒
        log_not_found off; # 遇到某些小图标缺失时（如 favicon.ico），不要在后台错误日志里大惊小怪，保持日志干净
        access_log off;    # 极其核心：图片和 CSS/JS 的成功访问不要记录进访问日志，减少服务器频繁写硬盘的 I/O 负载
    }

    # ---------------------------------------------------------------
    # WordPress 标准前端路由伪静态 (完美支持 B2Pro 的各种高级动态页面)
    # ---------------------------------------------------------------
    location / {
        # 核心逻辑：先看文件在不在 ($uri)，再看文件夹在不在 ($uri/)，都不在的话，全部交由 WordPress 核心大总管 index.php 去解析处理
        try_files $uri $uri/ /index.php?$args;
    }

    # ---------------------------------------------------------------
    # PHP-FPM 8.4 专用 Unix Socket 高速公路管道解析块
    # ---------------------------------------------------------------
    location ~ .php$ {
        # 引入 Ubuntu 系统为 PHP 预设的、经过健壮性测试的标准 FastCGI 参数片段
        include       snippets/fastcgi-php.conf;
        
        # 【核心对齐】将 PHP 请求通过 Linux 本地内存级套接字套管道直接怼给正在轰鸣的 PHP 8.4 翻译官，性能秒杀网络端口
        fastcgi_pass  unix:/run/php/php8.4-fpm.sock;
        
        # 告知 PHP 当前要执行的脚本在硬盘上的绝对物理路径
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        
        # 引入通用的 FastCGI 核心参数变量表
        include       fastcgi_params;
    }

    # ---------------------------------------------------------------
    # 全局特工防线：严禁任何人窥探服务器里的隐藏配置文件
    # ---------------------------------------------------------------
    # 正则匹配以点 (.) 开头的隐藏文件（如 Apache 残留的 .htaccess，或者 Git 的配置）
    location ~ /.ht {
        deny all; # 全量拒绝访问，直接弹 403，让黑客扫描器无功而返
    }
}

ubuntu@server:/etc/nginx/ssl/flygoly.com$ ls
flygoly.com.bundle.crt flygoly.com.key

ubuntu@server:/etc/nginx/ssl/flygoly.com$ sudo openssl dhparam -out flygoly.com.dhparam.pem 2048
Generating DH parameters, 2048 bit long safe prime
.......................................................................................+................................................................................................................................++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*
ubuntu@server:/etc/nginx/ssl/flygoly.com$ ls
flygoly.com.bundle.crt  flygoly.com.dhparam.pem  flygoly.com.key

ubuntu@server:/etc/nginx/ssl/flygoly.com$ ls
flygoly.com.bundle.crt  flygoly.com.dhparam.pem  flygoly.com.key
ubuntu@server:/etc/nginx/ssl/flygoly.com$ sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
ubuntu@server:/etc/nginx/ssl/flygoly.com$ sudo nginx -s reload
2026/06/09 12:21:03 [notice] 914383#914383: signal process started

# 查看哪些软件被锁定
ubuntu@server:~$ apt-mark showhold
# 一键锁定三大服务组件版本
ubuntu@server:~$ sudo apt-mark hold mariadb-server mariadb-client nginx php8.4*
mariadb-server set on hold.
mariadb-client set on hold.
nginx set on hold.
php8.4-cli set on hold.
php8.4-common set on hold.
php8.4-opcache set on hold.
php8.4 set on hold.
php8.4-dev set on hold.
php8.4-mbstring set on hold.
php8.4-xml set on hold.
php8.4-amqp set on hold.
php8.4-apcu set on hold.
php8.4-ast set on hold.
php8.4-bcmath set on hold.
php8.4-bz2 set on hold.
php8.4-cgi set on hold.
php8.4-curl set on hold.
php8.4-decimal set on hold.
php8.4-dio set on hold.
php8.4-ds set on hold.
php8.4-enchant set on hold.
php8.4-excimer set on hold.
php8.4-fpm set on hold.
php8.4-gd set on hold.
php8.4-gearman set on hold.
php8.4-gmagick set on hold.
php8.4-gmp set on hold.
php8.4-gnupg set on hold.
php8.4-grpc set on hold.
php8.4-http set on hold.
php8.4-igbinary set on hold.
php8.4-imagick set on hold.
php8.4-inotify set on hold.
php8.4-interbase set on hold.
php8.4-intl set on hold.
php8.4-ldap set on hold.
php8.4-litespeed set on hold.
php8.4-lz4 set on hold.
php8.4-mailparse set on hold.
php8.4-maxminddb set on hold.
php8.4-mcrypt set on hold.
php8.4-memcache set on hold.
php8.4-memcached set on hold.
php8.4-mongodb set on hold.
php8.4-msgpack set on hold.
php8.4-mysql set on hold.
php8.4-oauth set on hold.
php8.4-odbc set on hold.
php8.4-openswoole set on hold.
php8.4-opentelemetry set on hold.
php8.4-pcov set on hold.
php8.4-pgsql set on hold.
php8.4-phalcon set on hold.
php8.4-phpdbg set on hold.
php8.4-pq set on hold.
php8.4-protobuf set on hold.
php8.4-ps set on hold.
php8.4-psr set on hold.
php8.4-raphf set on hold.
php8.4-rdkafka set on hold.
php8.4-readline set on hold.
php8.4-redis set on hold.
php8.4-rrd set on hold.
php8.4-smbclient set on hold.
php8.4-snmp set on hold.
php8.4-soap set on hold.
php8.4-solr set on hold.
php8.4-sqlite3 set on hold.
php8.4-sqlsrv set on hold.
php8.4-ssh2 set on hold.
php8.4-stomp set on hold.
php8.4-swoole set on hold.
php8.4-sybase set on hold.
php8.4-tidy set on hold.
php8.4-uopz set on hold.
php8.4-uploadprogress set on hold.
php8.4-uuid set on hold.
php8.4-vips set on hold.
php8.4-xdebug set on hold.
php8.4-xhprof set on hold.
php8.4-xlswriter set on hold.
php8.4-xmlrpc set on hold.
php8.4-yac set on hold.
php8.4-yaml set on hold.
php8.4-zip set on hold.
php8.4-zmq set on hold.
php8.4-zstd set on hold.
php8.4-dba set on hold.
php8.4-imap set on hold.
php8.4-libvirt-php set on hold.
php8.4-pspell set on hold.
php8.4-xsl set on hold.

# 一键解锁三大服务组件版本
ubuntu@server:~$ sudo apt-mark unhold mariadb-server mariadb-client nginx php8.4*
Canceled hold on mariadb-server.
Canceled hold on mariadb-client.
Canceled hold on nginx.
Canceled hold on php8.4-cli.
Canceled hold on php8.4-common.
Canceled hold on php8.4-opcache.
Canceled hold on php8.4.
Canceled hold on php8.4-dev.
Canceled hold on php8.4-mbstring.
Canceled hold on php8.4-xml.
Canceled hold on php8.4-amqp.
Canceled hold on php8.4-apcu.
Canceled hold on php8.4-ast.
Canceled hold on php8.4-bcmath.
Canceled hold on php8.4-bz2.
Canceled hold on php8.4-cgi.
Canceled hold on php8.4-curl.
Canceled hold on php8.4-decimal.
Canceled hold on php8.4-dio.
Canceled hold on php8.4-ds.
Canceled hold on php8.4-enchant.
Canceled hold on php8.4-excimer.
Canceled hold on php8.4-fpm.
Canceled hold on php8.4-gd.
Canceled hold on php8.4-gearman.
Canceled hold on php8.4-gmagick.
Canceled hold on php8.4-gmp.
Canceled hold on php8.4-gnupg.
Canceled hold on php8.4-grpc.
Canceled hold on php8.4-http.
Canceled hold on php8.4-igbinary.
Canceled hold on php8.4-imagick.
Canceled hold on php8.4-inotify.
Canceled hold on php8.4-interbase.
Canceled hold on php8.4-intl.
Canceled hold on php8.4-ldap.
Canceled hold on php8.4-litespeed.
Canceled hold on php8.4-lz4.
Canceled hold on php8.4-mailparse.
Canceled hold on php8.4-maxminddb.
Canceled hold on php8.4-mcrypt.
Canceled hold on php8.4-memcache.
Canceled hold on php8.4-memcached.
Canceled hold on php8.4-mongodb.
Canceled hold on php8.4-msgpack.
Canceled hold on php8.4-mysql.
Canceled hold on php8.4-oauth.
Canceled hold on php8.4-odbc.
Canceled hold on php8.4-openswoole.
Canceled hold on php8.4-opentelemetry.
Canceled hold on php8.4-pcov.
Canceled hold on php8.4-pgsql.
Canceled hold on php8.4-phalcon.
Canceled hold on php8.4-phpdbg.
Canceled hold on php8.4-pq.
Canceled hold on php8.4-protobuf.
Canceled hold on php8.4-ps.
Canceled hold on php8.4-psr.
Canceled hold on php8.4-raphf.
Canceled hold on php8.4-rdkafka.
Canceled hold on php8.4-readline.
Canceled hold on php8.4-redis.
Canceled hold on php8.4-rrd.
Canceled hold on php8.4-smbclient.
Canceled hold on php8.4-snmp.
Canceled hold on php8.4-soap.
Canceled hold on php8.4-solr.
Canceled hold on php8.4-sqlite3.
Canceled hold on php8.4-sqlsrv.
Canceled hold on php8.4-ssh2.
Canceled hold on php8.4-stomp.
Canceled hold on php8.4-swoole.
Canceled hold on php8.4-sybase.
Canceled hold on php8.4-tidy.
Canceled hold on php8.4-uopz.
Canceled hold on php8.4-uploadprogress.
Canceled hold on php8.4-uuid.
Canceled hold on php8.4-vips.
Canceled hold on php8.4-xdebug.
Canceled hold on php8.4-xhprof.
Canceled hold on php8.4-xlswriter.
Canceled hold on php8.4-xmlrpc.
Canceled hold on php8.4-yac.
Canceled hold on php8.4-yaml.
Canceled hold on php8.4-zip.
Canceled hold on php8.4-zmq.
Canceled hold on php8.4-zstd.
Canceled hold on php8.4-dba.
Canceled hold on php8.4-imap.
Canceled hold on php8.4-libvirt-php.
Canceled hold on php8.4-pspell.
Canceled hold on php8.4-xsl.

[PHP]
; 允许上传的单个文件最大尺寸 (需覆盖你的大型插件包或主题包)
upload_max_filesize = 128M

; 允许通过 POST 请求提交的最大数据量 (建议设置值需 >= upload_max_filesize)
post_max_size = 128M

; 单个 PHP 脚本允许运行的最长秒数 (防止复杂的插件处理任务中途被切断)
max_execution_time = 300

; PHP 接收数据解析的最长超时时间 (针对大文件上传场景增加容错)
max_input_time = 300

; 单个 PHP 进程可使用的最大内存限额 (512M 可从容应对 WordPress 后台高负载场景)
memory_limit = 512M

; 增加单次表单提交的最大变量数，防止长文章或复杂页面因变量过多导致数据被截断丢失
max_input_vars = 5000

; 增加单次请求允许的最大多部分主体部件数，需配合 max_input_vars 设置，确保包含图片上传在内的复杂请求能够完整处理
max_multipart_body_parts = 5020

ubuntu@server:~$ sudo systemctl restart php8.4-fpm

; ==========================================
; WordPress + B2Pro 黄金狂飙参数
; ==========================================
; 开启 OPcache 总开关
opcache.enable=1
opcache.enable_cli=1

; 分配给 OPcache 的共享内存大小
opcache.memory_consumption=256

; 用于存储预编译类名和文件名的内存大小
opcache.interned_strings_buffer=16

; 最大缓存的 PHP 文件数量
opcache.max_accelerated_files=10000

; 检查文件是否有更新的周期
opcache.revalidate_freq=60

; 开启快速关闭序列，加速内存回收
opcache.fast_shutdown=1

; 动态调整 PHP 进程池参数以优化并发处理能力
pm.max_children = 10
pm.start_servers = 4
pm.min_spare_servers = 3
pm.max_spare_servers = 6

# 测试 PHP 配置文件的正确性
ubuntu@server:~$ sudo php-fpm8.4 -t
[09-Jun-2026 21:42:30] NOTICE: configuration file /etc/php/8.4/fpm/php-fpm.conf test is successful
# 重启 PHP 服务
ubuntu@server:~$ sudo systemctl restart php8.4-fpm

# 安装 Redis 服务
ubuntu@server:~$ sudo apt install -y redis-server
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  libjemalloc2 liblzf1 redis-tools
... 中间省略 N 行 ...
# 查看 Redis 服务状态
ubuntu@server:~$ sudo systemctl status redis-server
● redis-server.service - Advanced key-value store
     Loaded: loaded (/usr/lib/systemd/system/redis-server.service; enabled; preset: enabled)
     Active: active (running) since Tue 2026-06-09 20:53:20 CST; 11min ago
       Docs: http://redis.io/documentation,
             man:redis-server(1)
   Main PID: 1680070 (redis-server)
     Status: "Ready to accept connections"
      Tasks: 5 (limit: 2263)
     Memory: 3.3M (peak: 3.8M)
        CPU: 798ms
     CGroup: /system.slice/redis-server.service
             └─1680070 "/usr/bin/redis-server 127.0.0.1:6379"

Jun 09 20:53:20 server systemd[1]: Starting redis-server.service - Advanced key-value store...
Jun 09 20:53:20 server systemd[1]: Started redis-server.service - Advanced key-value store.
# 测试 Redis 心跳
ubuntu@server:~$ redis-cli ping
PONG
# 查询 PHP 驱动是否识别 Redis
ubuntu@server:~$ php -m | grep redis
redis

[client]
user=u_flygoly
password="你的数据库密码"

sudo chmod 600 /root/.my.cnf

sudo chmod +x /data/backup/www/flygoly.com/www/backup.sh

# 每天凌晨 2 点执行数据备份脚本（配合前面提到的每天凌晨 3 点的磁盘快照备份）
0 2 * * * /bin/bash /data/backup/www/flygoly.com/www/backup.sh

# 同步最新软件列表
sudo apt update

# 查看可升级软件清单
sudo apt list --upgradable
注意：虽然之前通过 sudo apt-mark hold <包名> 的方式来冻结了三大组件服务 MariaDB、PHP、nginx 的版本更新，但是在可升级软件清单中依然会看到可升级的版本，只是会提醒你被跳过的包：The following packages have been kept back: **** 

# 升级全部软件
sudo apt upgrade
注意：一般没有什么大问题的情况下，建议直接就执行此操作，升级除了 MariaDB、PHP、nginx 的全部软件，方便快速。

# 如果对某个软件有疑问？查看这个软件的基础信息：一定要注意版本号的前后变化
sudo apt-cache policy <包名>

# 如果对某个软件有进一步疑问？查看这个软件的详细信息：注意查看各种细节
sudo apt-cache show <包名>

# 如果确认这个软件可以升级，那就指定包名来具体升级
sudo apt install --only-upgrade <包名>

# 更新软件列表
ubuntu@server:~$ sudo apt update
Hit:1 http://mirrors.tencentyun.com/ubuntu noble InRelease
Get:2 http://mirrors.tencentyun.com/ubuntu noble-updates InRelease [126 kB]                   
Hit:3 http://mirrors.tencentyun.com/ubuntu noble-backports InRelease                          
Get:4 http://mirrors.tencentyun.com/ubuntu noble-security InRelease [126 kB]                  
Get:5 http://mirrors.tencentyun.com/ubuntu noble-updates/main amd64 Packages [2,067 kB]                
Get:6 http://mirrors.tencentyun.com/ubuntu noble-updates/main Translation-en [363 kB]                  
Get:7 http://mirrors.tencentyun.com/ubuntu noble-updates/universe amd64 Packages [1,699 kB]            
Get:8 http://mirrors.tencentyun.com/ubuntu noble-security/main amd64 Packages [1,763 kB]               
Get:9 http://mirrors.tencentyun.com/ubuntu noble-security/main Translation-en [276 kB]                 
Hit:10 https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/ubuntu noble InRelease                     
Hit:11 https://deb.nodesource.com/node_20.x nodistro InRelease                                         
Hit:12 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble InRelease                              
Fetched 6,420 kB in 3s (2,379 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
157 packages can be upgraded. Run 'apt list --upgradable' to see them.

# 查询可以升级的软件
ubuntu@server:~$ sudo apt list --upgradable
Listing... Done
... 中间省略 N 行 ...
bsdutils/noble-updates,noble-security 1:2.39.3-9ubuntu6.5 amd64 [upgradable from: 1:2.39.3-9ubuntu6.4]
... 中间省略 N 行 ...
python3.12/noble-updates,noble-security 3.12.3-1ubuntu0.13 amd64 [upgradable from: 3.12.3-1ubuntu0.11]
... 中间省略 N 行 ...

# 查询特定软件包升级潜在升级情况
ubuntu@server:~$ sudo apt-cache policy python3.12
python3.12:
  Installed: 3.12.3-1ubuntu0.11
  Candidate: 3.12.3-1ubuntu0.13
  Version table:
     3.12.3-1ubuntu0.13 500
        500 http://mirrors.tencentyun.com/ubuntu noble-updates/main amd64 Packages
        500 http://mirrors.tencentyun.com/ubuntu noble-security/main amd64 Packages
 *** 3.12.3-1ubuntu0.11 100
        100 /var/lib/dpkg/status
     3.12.3-1 500
        500 http://mirrors.tencentyun.com/ubuntu noble/main amd64 Packages

# 查询软件包详细信息
ubuntu@server:~$ sudo apt-cache show python3.12
Package: python3.12
Priority: important
Section: python
Installed-Size: 738
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Architecture: amd64
Version: 3.12.3-1ubuntu0.13
Recommends: ca-certificates
Suggests: python3.12-venv, python3.12-doc, binutils
Depends: python3.12-minimal (= 3.12.3-1ubuntu0.13), libpython3.12-stdlib (= 3.12.3-1ubuntu0.13), media-types | mime-support, tzdata
... 中间省略 N 行 ...
Description-en: Interactive high-level object-oriented language (version 3.12)
 Python is a high-level, interactive, object-oriented language. Its 3.12 version
 includes an extensive class library with lots of goodies for
 network programming, system administration, sounds and graphics.
Description-md5: af6e3d533670d7c2547d79718a4e35f4
Task: cloud-minimal, minimal, server-minimal

# 指定软件包升级
ubuntu@server:~$ sudo apt install --only-upgrade python3.12
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  libpython3.12-minimal libpython3.12-stdlib libpython3.12t64 python3.12-minimal
Suggested packages:
  python3.12-venv python3.12-doc binfmt-support
The following packages will be upgraded:
  libpython3.12-minimal libpython3.12-stdlib libpython3.12t64 python3.12 python3.12-minimal
5 upgraded, 0 newly installed, 0 to remove and 152 not upgraded.
Need to get 8,252 kB of archives.
After this operation, 4,096 B of additional disk space will be used.
Do you want to continue? [Y/n] Y
Get:1 http://mirrors.tencentyun.com/ubuntu noble-updates/main amd64 libpython3.12t64 amd64 3.12.3-1ubuntu0.13 [2,338 kB]
... 中间省略 N 行 ...

# 再次尝试针对 python3.12 升级，就没有可升级的版本了，说明已经升级过了
ubuntu@server:~$ sudo apt install --only-upgrade python3.12
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
python3.12 is already the newest version (3.12.3-1ubuntu0.13).
0 upgraded, 0 newly installed, 0 to remove and 152 not upgraded.

# 更新软件列表
ubuntu@server:~$ sudo apt update
Hit:1 http://mirrors.tencentyun.com/ubuntu noble InRelease
Get:2 http://mirrors.tencentyun.com/ubuntu noble-updates InRelease [126 kB]                   
Hit:3 http://mirrors.tencentyun.com/ubuntu noble-backports InRelease                          
Get:4 http://mirrors.tencentyun.com/ubuntu noble-security InRelease [126 kB]                  
Get:5 http://mirrors.tencentyun.com/ubuntu noble-updates/main amd64 Packages [2,067 kB]                
Get:6 http://mirrors.tencentyun.com/ubuntu noble-updates/main Translation-en [363 kB]                  
Get:7 http://mirrors.tencentyun.com/ubuntu noble-updates/universe amd64 Packages [1,699 kB]            
Get:8 http://mirrors.tencentyun.com/ubuntu noble-security/main amd64 Packages [1,763 kB]               
Get:9 http://mirrors.tencentyun.com/ubuntu noble-security/main Translation-en [276 kB]                 
Hit:10 https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/ubuntu noble InRelease                     
Hit:11 https://deb.nodesource.com/node_20.x nodistro InRelease                                         
Hit:12 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble InRelease                              
Fetched 6,420 kB in 3s (2,379 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
157 packages can be upgraded. Run 'apt list --upgradable' to see them.

# 查询可以升级的软件
ubuntu@server:~$ sudo apt list --upgradable
Listing... Done
... 中间省略 N 行 ...
dpkg/noble-updates,noble-security 1.22.6ubuntu6.6 amd64 [upgradable from: 1.22.6ubuntu6.5]
eject/noble-updates,noble-security 2.39.3-9ubuntu6.5 amd64 [upgradable from: 2.39.3-9ubuntu6.4]
fdisk/noble-updates,noble-security 2.39.3-9ubuntu6.5 amd64 [upgradable from: 2.39.3-9ubuntu6.4]
firmware-sof-signed/noble-updates 2023.12.1-1ubuntu1.11 all [upgradable from: 2023.12.1-1ubuntu1.10]
fwupd/noble-updates 2.0.20-1ubuntu2~24.04.1 amd64 [upgradable from: 1.9.33-0ubuntu1~24.04.1ubuntu1]
... 中间省略 N 行 ...
nginx-common/noble-updates,noble-security 1.24.0-2ubuntu7.11 all [upgradable from: 1.24.0-2ubuntu7.8]
nginx/noble-updates,noble-security 1.24.0-2ubuntu7.11 amd64 [upgradable from: 1.24.0-2ubuntu7.8]
... 中间省略 N 行 ...
php8.4-cli/noble 8.4.22-1+ubuntu24.04.1+deb.sury.org+1 amd64 [upgradable from: 8.4.21-3+ubuntu24.04.1+deb.sury.org+1]
php8.4-common/noble 8.4.22-1+ubuntu24.04.1+deb.sury.org+1 amd64 [upgradable from: 8.4.21-3+ubuntu24.04.1+deb.sury.org+1]
php8.4-curl/noble 8.4.22-1+ubuntu24.04.1+deb.sury.org+1 amd64 [upgradable from: 8.4.21-3+ubuntu24.04.1+deb.sury.org+1]
php8.4-fpm/noble 8.4.22-1+ubuntu24.04.1+deb.sury.org+1 amd64 [upgradable from: 8.4.21-3+ubuntu24.04.1+deb.sury.org+1]
php8.4-gd/noble 8.4.22-1+ubuntu24.04.1+deb.sury.org+1 amd64 [upgradable from: 8.4.21-3+ubuntu24.04.1+deb.sury.org+1]
php8.4-intl/noble 8.4.22-1+ubuntu24.04.1+deb.sury.org+1 amd64 [upgradable from: 8.4.21-3+ubuntu24.04.1+deb.sury.org+1]
php8.4-mbstring/noble 8.4.22-1+ubuntu24.04.1+deb.sury.org+1 amd64 [upgradable from: 8.4.21-3+ubuntu24.04.1+deb.sury.org+1]
php8.4-mysql/noble 8.4.22-1+ubuntu24.04.1+deb.sury.org+1 amd64 [upgradable from: 8.4.21-3+ubuntu24.04.1+deb.sury.org+1]
php8.4-opcache/noble 8.4.22-1+ubuntu24.04.1+deb.sury.org+1 amd64 [upgradable from: 8.4.21-3+ubuntu24.04.1+deb.sury.org+1]
php8.4-readline/noble 8.4.22-1+ubuntu24.04.1+deb.sury.org+1 amd64 [upgradable from: 8.4.21-3+ubuntu24.04.1+deb.sury.org+1]
php8.4-soap/noble 8.4.22-1+ubuntu24.04.1+deb.sury.org+1 amd64 [upgradable from: 8.4.21-3+ubuntu24.04.1+deb.sury.org+1]
php8.4-xml/noble 8.4.22-1+ubuntu24.04.1+deb.sury.org+1 amd64 [upgradable from: 8.4.21-3+ubuntu24.04.1+deb.sury.org+1]
php8.4-zip/noble 8.4.22-1+ubuntu24.04.1+deb.sury.org+1 amd64 [upgradable from: 8.4.21-3+ubuntu24.04.1+deb.sury.org+1]
... 中间省略 N 行 ...