UnoPim × Lightsail
效能調校指南

# 給金鑰正確權限（macOS / Linux）
chmod 400 ~/Downloads/LightsailDefaultKey-ap-northeast-1.pem

# 連線（把 IP 換成你的 static IP）
ssh -i ~/Downloads/LightsailDefaultKey-ap-northeast-1.pem ubuntu@13.230.XXX.XXX

# Windows 用戶請用 PuTTY 並把 .pem 轉成 .ppk，
# 或用 Windows Terminal + OpenSSH（內建於 Win10/11）。

# 更新 package list 與已安裝套件
sudo apt update && sudo apt upgrade -y

# 裝基本工具（curl / git / unzip / 等）
sudo apt install -y curl git unzip software-properties-common \
    ca-certificates gnupg lsb-release ufw htop tmux \
    build-essential pkg-config

sudo apt install -y \
    php8.3 php8.3-fpm php8.3-cli \
    php8.3-mysql php8.3-pgsql \
    php8.3-curl php8.3-gd php8.3-mbstring \
    php8.3-xml php8.3-zip php8.3-bcmath \
    php8.3-intl php8.3-soap php8.3-readline \
    php8.3-tokenizer php8.3-imap php8.3-opcache \
    php8.3-redis php8.3-imagick \
    php8.3-calendar

# 確認版本
php -v
# 應該看到 PHP 8.3.x

# 確認 PHP-FPM 在跑
sudo systemctl status php8.3-fpm

# Composer
curl -sS https://getcomposer.org/installer | php
sudo mv composer.phar /usr/local/bin/composer
composer --version

# Node.js 20 LTS（透過 NodeSource）
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs
node -v # 應該是 v20.x
npm -v

sudo apt install -y mysql-server-8.0 redis-server nginx

# 啟動並設為開機自動執行
sudo systemctl enable --now mysql redis-server nginx

# 跑 MySQL 安全設定（設 root 密碼、移除測試資料庫等）
sudo mysql_secure_installation

sudo mysql -u root -p

# 進入 MySQL prompt 後依序執行：
CREATE DATABASE unopim CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'unopim'@'localhost' IDENTIFIED BY '你的安全密碼';
GRANT ALL PRIVILEGES ON unopim.* TO 'unopim'@'localhost';
FLUSH PRIVILEGES;
EXIT;

# 匯入 Elastic 的 GPG key
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | \
    sudo gpg --dearmor -o /usr/share/keyrings/elastic.gpg

# 加入 Elastic 8.x 套件庫
echo "deb [signed-by=/usr/share/keyrings/elastic.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | \
    sudo tee /etc/apt/sources.list.d/elastic-8.x.list

sudo apt update && sudo apt install -y elasticsearch

# 把 ES heap 限制為 1 GB（Lightsail 4GB 規格建議）
sudo tee /etc/elasticsearch/jvm.options.d/heap.options << EOF
-Xms1g
-Xmx1g
EOF

sudo systemctl enable --now elasticsearch

# 建立 web 根目錄
sudo mkdir -p /var/www
cd /var/www

# 用 composer 建立專案（這一步要 5-15 分鐘）
sudo composer create-project unopim/unopim --no-interaction

# 改擁有者給 www-data，這是 PHP-FPM 跟 Nginx 的執行身份
sudo chown -R www-data:www-data /var/www/unopim
sudo chmod -R 755 /var/www/unopim
sudo chmod -R 775 /var/www/unopim/storage
sudo chmod -R 775 /var/www/unopim/bootstrap/cache

cd /var/www/unopim

# 編輯 .env 設好資料庫連線
sudo nano .env

APP_NAME=UnoPim
APP_ENV=production
APP_DEBUG=false
APP_URL=https://pim.yourdomain.com

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=unopim
DB_USERNAME=unopim
DB_PASSWORD=你剛剛設的密碼

# --- 這四行是效能關鍵 ---
CACHE_DRIVER=redis
SESSION_DRIVER=redis
QUEUE_CONNECTION=redis
BROADCAST_DRIVER=redis

REDIS_HOST=127.0.0.1
REDIS_PORT=6379

ELASTICSEARCH_HOST=127.0.0.1
ELASTICSEARCH_PORT=9200

# 跑安裝指令（建表、塞種子資料、建立管理員帳號）
sudo -u www-data php artisan unopim:install

# 建前端資產
sudo -u www-data npm install
sudo -u www-data npm run build

# 看當前有沒有 swap
free -h

# 建立一個 4GB 的 swap file
sudo fallocate -l 4G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

# 寫入 fstab 讓重開機後自動啟用
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

# 確認
free -h

# 即時生效
sudo sysctl vm.swappiness=10

# 寫入永久設定
sudo tee -a /etc/sysctl.conf << EOF

# --- Performance tuning for Laravel ---
vm.swappiness=10
vm.vfs_cache_pressure=50
net.core.somaxconn=4096
net.ipv4.tcp_max_syn_backlog=4096
net.ipv4.ip_local_port_range=10000 65535
fs.file-max=2097152
EOF

sudo sysctl -p

sudo tee -a /etc/security/limits.conf << EOF
www-data soft nofile 65535
www-data hard nofile 65535
root     soft nofile 65535
root     hard nofile 65535
EOF

# 同時加進 systemd 限制
sudo mkdir -p /etc/systemd/system/php8.3-fpm.service.d
sudo tee /etc/systemd/system/php8.3-fpm.service.d/limits.conf << EOF
[Service]
LimitNOFILE=65535
EOF

sudo systemctl daemon-reload

sudo nano /etc/php/8.3/fpm/php.ini

; ===== 基本記憶體與執行時間 =====
memory_limit = 512M
upload_max_filesize = 128M
post_max_size = 128M
max_execution_time = 300
max_input_vars = 5000

; ===== OPcache（效能關鍵） =====
opcache.enable = 1
opcache.enable_cli = 1
opcache.memory_consumption = 256
opcache.interned_strings_buffer = 32
opcache.max_accelerated_files = 20000
opcache.validate_timestamps = 0      ; 正式環境設 0
opcache.save_comments = 1             ; Laravel 註解驅動的功能需要
opcache.fast_shutdown = 1
opcache.jit_buffer_size = 128M
opcache.jit = tracing

; ===== Realpath cache =====
realpath_cache_size = 4096K
realpath_cache_ttl = 600

sudo nano /etc/php/8.3/cli/php.ini
# 同樣的 memory_limit、opcache.* 都加進去

# 重啟 PHP-FPM
sudo systemctl restart php8.3-fpm

# 確認 OPcache 真的啟用了
php -i | grep "opcache.enable"
# 應該看到 opcache.enable => On => On

sudo nano /etc/php/8.3/fpm/pool.d/www.conf

; ===== Pool 進程管理（4GB Lightsail 建議值） =====
user = www-data
group = www-data
listen = /run/php/php8.3-fpm.sock
listen.owner = www-data
listen.group = www-data

; 動態進程管理 — 對於變動流量最合適
pm = dynamic
pm.max_children = 20             ; 同時最多 20 個 worker
pm.start_servers = 4             ; 開機時起 4 個
pm.min_spare_servers = 2         ; 閒置時保留 2 個
pm.max_spare_servers = 8         ; 閒置時最多 8 個
pm.max_requests = 500           ; 處理 500 個 request 後重啟（防記憶體洩漏）

; ===== 慢請求 log =====
request_slowlog_timeout = 5s
slowlog = /var/log/php-fpm/slow.log

; ===== 狀態端點（給 monitoring 用） =====
pm.status_path = /fpm-status
ping.path = /fpm-ping

pm.max_children = (總記憶體 - 系統保留 - MySQL - Redis - ES) ÷ 單個 worker 平均記憶體

4 GB Lightsail 範例：
  總記憶體 = 4096 MB
  系統保留 = 400 MB
  MySQL 8 = 800 MB
  Redis = 256 MB
  Elasticsearch = 1024 MB
  → 給 PHP-FPM = 1616 MB
  單個 Laravel worker ≈ 80 MB
  → pm.max_children ≈ 1616 / 80 = 20

ps -ylC php-fpm8.3 --sort:rss | awk '!/RSS/ { s+=$8 } END { printf "%d KB total / %d procs\n", s, NR-1 }'

sudo mkdir -p /var/log/php-fpm
sudo chown www-data:www-data /var/log/php-fpm

sudo php-fpm8.3 -t   # 檢查設定有沒有錯
sudo systemctl restart php8.3-fpm
sudo systemctl status php8.3-fpm

sudo nano /etc/nginx/nginx.conf

user www-data;
worker_processes auto;
worker_rlimit_nofile 65535;
pid /run/nginx.pid;

events {
    worker_connections 4096;
    multi_accept on;
    use epoll;
}

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    keepalive_requests 1000;
    types_hash_max_size 2048;
    server_tokens off;

    client_max_body_size 128M;
    client_body_buffer_size 256k;
    client_body_timeout 60;

    # ===== Gzip 壓縮 =====
    gzip on;
    gzip_vary on;
    gzip_comp_level 6;
    gzip_min_length 1000;
    gzip_types text/plain text/css text/xml application/json
               application/javascript application/xml+rss
               application/atom+xml image/svg+xml;

    # ===== FastCGI 快取 =====
    fastcgi_cache_path /var/cache/nginx levels=1:2
        keys_zone=UNOPIM_CACHE:100m max_size=1g inactive=60m
        use_temp_path=off;
    fastcgi_cache_key "$scheme$request_method$host$request_uri";

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

sudo nano /etc/nginx/sites-available/unopim

server {
    listen 80;
    listen [::]:80;
    server_name pim.yourdomain.com;
    root /var/www/unopim/public;
    index index.php;

    charset utf-8;

    # Laravel 標準 rewrite
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # 靜態資產：1 年快取 + immutable
    location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2|ttf|webp|avif)$ {
        expires 365d;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    # PHP 處理
    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
        fastcgi_read_timeout 300;
    }

    # 鎖死敏感檔
    location ~ /\.(?!well-known).* { deny all; }
    location ~ /\.env { deny all; }

    # 日誌
    access_log /var/log/nginx/unopim_access.log;
    error_log /var/log/nginx/unopim_error.log;
}

# 啟用站點、移除預設、測試、reload
sudo ln -sf /etc/nginx/sites-available/unopim /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx

sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d pim.yourdomain.com

# 自動續約已經是 default 設好的，但驗證一下
sudo certbot renew --dry-run

sudo nano /etc/mysql/mysql.conf.d/unopim.cnf

[mysqld]

# ===== InnoDB 緩衝池（最重要） =====
# 4GB 機器：分 1.5GB 給 InnoDB
innodb_buffer_pool_size = 1536M
innodb_buffer_pool_instances = 2
innodb_log_file_size = 512M
innodb_flush_log_at_trx_commit = 2
innodb_flush_method = O_DIRECT
innodb_file_per_table = 1
innodb_io_capacity = 2000
innodb_io_capacity_max = 4000

# ===== 連線設定 =====
max_connections = 150
thread_cache_size = 32
wait_timeout = 600
interactive_timeout = 600

# ===== Query Cache（MySQL 8 已移除，這裡不用設） =====

# ===== 暫存檔與排序 =====
tmp_table_size = 64M
max_heap_table_size = 64M
sort_buffer_size = 2M
join_buffer_size = 2M

# ===== 慢查詢 log =====
slow_query_log = 1
slow_query_log_file = /var/log/mysql/slow.log
long_query_time = 2
log_queries_not_using_indexes = 1

# ===== 字元編碼 =====
character-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci

sudo mkdir -p /var/log/mysql
sudo chown mysql:mysql /var/log/mysql

sudo systemctl restart mysql
sudo systemctl status mysql

# 用內建 mysqldumpslow 看 top 10 慢 query
sudo mysqldumpslow -t 10 /var/log/mysql/slow.log

# 進階：用 pt-query-digest（Percona Toolkit）
sudo apt install -y percona-toolkit
sudo pt-query-digest /var/log/mysql/slow.log | less

SHOW STATUS LIKE 'Innodb_buffer_pool%';

-- 命中率公式：
-- hit_rate = (1 - reads / read_requests) * 100

sudo nano /etc/redis/redis.conf

# ===== 網路 =====
bind 127.0.0.1            # 只接受 localhost 連線
port 6379
protected-mode yes

# ===== 認證（強烈建議設密碼） =====
requirepass 你的安全 redis 密碼

# ===== 記憶體管理 =====
maxmemory 512mb
maxmemory-policy allkeys-lru
                # 當記憶體滿時，刪除最少用到的 key

# ===== 持久化（cache 不需要太頻繁存檔） =====
save 900 1
save 300 10
save 60 10000

# ===== AOF（Queue 數據用） =====
appendonly yes
appendfsync everysec

# ===== 性能 =====
tcp-keepalive 300
timeout 0
tcp-backlog 511

sudo systemctl restart redis-server

# 測試連線
redis-cli -a 你的密碼 ping
# 應該回應 PONG

CACHE_DRIVER=redis
SESSION_DRIVER=redis
QUEUE_CONNECTION=redis
BROADCAST_DRIVER=redis

REDIS_HOST=127.0.0.1
REDIS_PASSWORD=你的密碼
REDIS_PORT=6379
REDIS_DB=0
REDIS_CACHE_DB=1
REDIS_CLIENT=phpredis

cd /var/www/unopim

# ===== 部署前清空舊快取 =====
sudo -u www-data php artisan optimize:clear

# ===== 啟用 production mode =====
sudo -u www-data php artisan optimize

# 上面這條相當於以下個別指令：
sudo -u www-data php artisan config:cache
sudo -u www-data php artisan route:cache
sudo -u www-data php artisan view:cache
sudo -u www-data php artisan event:cache

# ===== 重啟 PHP-FPM 以套用新 bytecode =====
sudo systemctl reload php8.3-fpm

# Composer 的 autoloader 優化（重要！）
sudo -u www-data composer install --no-dev --optimize-autoloader

# 建立 storage symlink（首次部署需要）
sudo -u www-data php artisan storage:link

# 重新建立 Elasticsearch 索引（如果有跑 ES）
sudo -u www-data php artisan search:reindex

sudo nano /var/www/unopim/deploy.sh

#!/bin/bash
# /var/www/unopim/deploy.sh

set -e

cd /var/www/unopim

echo "→ 進入 maintenance mode"
sudo -u www-data php artisan down

echo "→ 拉新 code"
sudo -u www-data git pull origin main

echo "→ 更新 composer"
sudo -u www-data composer install --no-dev --optimize-autoloader

echo "→ 跑 migration"
sudo -u www-data php artisan migrate --force

echo "→ 編譯前端"
sudo -u www-data npm install
sudo -u www-data npm run build

echo "→ 重建快取"
sudo -u www-data php artisan optimize:clear
sudo -u www-data php artisan optimize

echo "→ 重啟 services"
sudo systemctl reload php8.3-fpm
sudo supervisorctl restart unopim-worker:*

echo "→ 解除 maintenance mode"
sudo -u www-data php artisan up

echo "✓ Deploy 完成"

sudo chmod +x /var/www/unopim/deploy.sh

# 之後每次部署只需跑：
sudo /var/www/unopim/deploy.sh

# 安裝 Swoole PHP extension
sudo apt install -y php8.3-swoole

# 確認 Swoole 已載入
php -m | grep swoole

# 在 UnoPim 啟用 Octane
cd /var/www/unopim
sudo -u www-data php artisan octane:install --server=swoole

# 啟動 Octane（測試用）
sudo -u www-data php artisan octane:start \
    --server=swoole \
    --host=127.0.0.1 \
    --port=8000 \
    --workers=4 \
    --task-workers=2 \
    --max-requests=500

upstream octane {
    server 127.0.0.1:8000;
}

server {
    # ... 同前 ...

    location / {
        try_files $uri $uri/ @octane;
    }

    location @octane {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://octane;
        proxy_http_version 1.1;
        proxy_buffering off;
    }
}

sudo apt install -y supervisor
sudo nano /etc/supervisor/conf.d/octane.conf

[program:unopim-octane]
process_name=%(program_name)s
command=php /var/www/unopim/artisan octane:start --server=swoole --host=127.0.0.1 --port=8000 --workers=4
autostart=true
autorestart=true
user=www-data
redirect_stderr=true
stdout_logfile=/var/log/octane.log
stopwaitsecs=60

sudo supervisorctl reread
sudo supervisorctl update
sudo supervisorctl start unopim-octane

cat /etc/elasticsearch/jvm.options.d/heap.options
# 應該看到：
# -Xms1g
# -Xmx1g

# Heap 與 max 必須一樣，否則 JVM 動態調整很消耗

sudo nano /etc/elasticsearch/elasticsearch.yml

cluster.name: unopim-cluster
node.name: unopim-node-1

# 單機 cluster：禁止它去找其他 node
discovery.type: single-node

# 只接受本機連線
network.host: 127.0.0.1
http.port: 9200

# 關閉安全模組（內部網路才這樣設！）
xpack.security.enabled: false
xpack.security.enrollment.enabled: false

# 關閉 ML（除非你要用）
xpack.ml.enabled: false

# Bootstrap memory lock（防止被 swap）
bootstrap.memory_lock: true

# 加上 systemd 的 mlockall 權限
sudo mkdir -p /etc/systemd/system/elasticsearch.service.d
sudo tee /etc/systemd/system/elasticsearch.service.d/override.conf << EOF
[Service]
LimitMEMLOCK=infinity
EOF

sudo systemctl daemon-reload
sudo systemctl restart elasticsearch

# 確認跑得起來
curl -X GET "localhost:9200/?pretty"

sudo nano /etc/supervisor/conf.d/unopim-worker.conf

[program:unopim-worker]
process_name=%(program_name)s_%(process_num)02d
command=php /var/www/unopim/artisan queue:work redis \
    --queue=webhooks,system,default,completeness \
    --sleep=3 --tries=3 --max-time=3600 --max-jobs=1000

autostart=true
autorestart=true
stopasgroup=true
killasgroup=true
user=www-data
numprocs=4
redirect_stderr=true
stdout_logfile=/var/log/unopim-worker.log
stopwaitsecs=3600

sudo supervisorctl reread
sudo supervisorctl update
sudo supervisorctl start unopim-worker:*

# 確認 4 個 process 都在跑
sudo supervisorctl status

# .env 增加：
ASSET_URL=https://d12345abcde.cloudfront.net
APP_URL=https://pim.yourdomain.com

sudo -u www-data php artisan optimize:clear
sudo -u www-data php artisan optimize

sudo apt install -y htop atop iotop

# 即時 process / CPU / 記憶體
htop

# 歷史 process（系統會背景紀錄）
atop

# 磁碟 I/O 熱點
sudo iotop -o

# 測試健康端點
curl https://pim.yourdomain.com/up
# 應該回 200 + 一個簡單 HTML

cd /var/www/unopim
sudo -u www-data composer require laravel/horizon
sudo -u www-data php artisan horizon:install

# 修改 supervisor 跑 horizon 取代原本 queue worker
sudo nano /etc/supervisor/conf.d/horizon.conf