HestiaCP yana ba da damar shigar da rubutun Adminer ta atomatik sau ɗaya ta dannawa (gami da tabbatar da Nginx + Fail2Ban dual protection).

Dakatar da shigar da Mai Gudanarwa da hannu! Rubutun rubutu ɗaya zai iya sarrafa dukkan tsarin tsaro.

Kwanaki biyu da suka gabata, wani abokina, wanda shi ma yake aiki a fannin gudanar da tsarin kwamfuta, ya yi min korafi cewa yana ɗaukarsa mafi yawan rana kafin ya shigar da Adminer a sabar sa. Ba wai Adminer da kansa yana da wahalar shigarwa ba; fayil ne kawai na PHP, za ka iya jefa shi kuma zai yi aiki. Amma matsalar ita ce, ba za ka iya jefa fayil ɗin PHP kawai ka kira shi a rana ɗaya ba.

Kana buƙatar saita ƙananan yankuna, loda plugins, saita tantancewar Nginx, da kuma saita Fail2Ban don hana hare-haren brute-force. Kowane mataki ba shi da rikitarwa, amma tare suna haifar da tarin umarni da fayilolin sanyi.

Abin da ya fi ɓata rai shi ne cewa tsare-tsare masu alaƙa da tsaro kamar tantancewa da firewalls suna da saurin samun kurakurai. Ƙaramin sakaci na iya fallasa hanyar sadarwa ta sarrafa bayanai ga intanet na jama'a, wanda hakan zai sa kowa ya sami damar shiga.

Na yi dariya a lokacin domin na taɓa yin irin wannan abu a baya. Daga baya, ban iya jurewa ba, don haka na rubuta rubutun turawa sau ɗaya don sarrafa duk waɗannan matakan ta atomatik.

Me yasa ba za a yi amfani da shi baphpMyAdmin

Za ka iya tambaya, me zai hana ka yi amfani da phpMyAdmin, wanda ya fi shahara?

Hakika, phpMyAdmin yana da ƙarin masu amfani da kuma al'umma mai yawa. Amma ina tsammanin Adminer yana yin aiki mafi kyau a wasu fannoni.

Da farko, yana da sauƙi; Adminer fayil ɗaya ne kawai na PHP, yayin da phpMyAdmin tarin fayiloli ne. Na biyu, yana da aminci; Falsafar ƙirar Admin "ba a amince da ita ta tsohuwa ba," ma'ana kuna buƙatar saita bayanan haɗi a sarari don gudanar da bayanan.

Wani bangare kuma shine aiki; Mai gudanarwa yana da sauri sosai fiye da phpMyAdmin lokacin da yake sarrafa manyan bayanai.

Ba shakka, babu ɗaya daga cikin waɗannan da ya fi muhimmanci. Abu mafi mahimmanci shine wannan rubutun yana nufin ba sai na sake saita waɗannan abubuwan da suka shafi tsaro da hannu ba.

Menene ainihin rubutun ya yi?

Manufar da ke bayan wannan rubutun a zahiri abu ne mai sauƙi: don sarrafa duk matakan da kuke yi da hannu ta atomatik.

Don shigar da bayanai masu hulɗa, rubutun zai yi muku wasu tambayoyi: sunan mai amfani na HestiaCP , sunan yanki, sunan mai amfani na tabbatarwa, da kalmar sirri. Kuna buƙatar shigar da waɗannan kawai, kuma rubutun zai kula da sauran.

Rubutun yana ƙirƙirar tushen tushen yanar gizo ta atomatik, yana duba idan an shigar da apache2-utils (wanda ake amfani da shi don ƙirƙirar fayilolin kalmar sirri) da yanayin PHP, kuma yana sarrafa ƙirƙirar directory da shigarwar dogaro.

Lokacin saukar da Adminer, rubutun yana fara ƙoƙarin saukar da sabon sigar daga ma'ajiyar hukuma. Idan ma'ajiyar hukuma ba ta samuwa, tana canzawa ta atomatik zuwa ma'ajiyar GitHub Releases mai ɗorewa. Ina tsammanin wannan yana da mahimmanci, domin ma'ajiyar hukuma wani lokacin tana iya zama mara ƙarfi; Na taɓa fuskantar lokacin haɗin gwiwa a baya.

Dangane da saukar da plugin, rubutun zai saukar da manyan plugins guda uku: plugin.php shine mai loda plugin, fc-sqlite-connection-without-credentials.php ana amfani da shi don sarrafa haɗin da ba shi da kalmar sirri, kuma login-password-less.php yana goyan bayan shiga kalmar sirri.

Dangane da samar da kalmar sirri ta hash da index.php, akwai ƙaramin bayani: rubutun yana amfani da getenv() don dawo da kalmar sirri maimakon amfani da $_ENV kai tsaye. Wannan yana guje wa matsalar saitin php.ini wanda ke haifar da lissafin hash ya zama babu komai. Ni da kaina na ci karo da wannan matsala kuma na ɗauki lokaci mai tsawo ina gano cewa ba a kunna siffar 'E' a cikin php.ini ba.

Don daidaita tantancewar Nginx, rubutun yana amfani da tsarin include na HestiaCP maimakon gyara fayil ɗin saitin Nginx kai tsaye. Amfanin wannan hanyar ita ce tantancewa ba zai gaza ba ko da kun sake gina saitin yankin.

A cikin tsarin Fail2Ban, rubutun yana ƙirƙirar ƙa'idar tacewa don sa ido kan kurakuran 401. Idan IP ya kasa shiga sau 3 cikin mintuna 10, za a toshe shi na tsawon awa 1.

Dangane da gyaran izini da sake loda sabis, rubutun zai saita izinin fayil ɗin da ya dace ta atomatik kuma ya sake loda PHP-FPM, Nginx, da Fail2Ban.

Ina da gaske game da tsaro.

Gaskiya dai, tsaron kayan aikin sarrafa bayanai shine abin da ya fi damuna.

Ka yi tunani a kai, Admin zai iya sarrafa dukkan bayanan da ke kan sabar ka kai tsaye. Idan an fallasa shi ga intanet na jama'a kuma wani ya duba shi, sakamakon ba zai misaltu ba.

Wannan rubutun yana da kariya sau uku.

Mataki na farko shine HTTP Basic Authentic na Nginx. Lokacin da ka shiga Adminer, burauzarka za ta fito da akwatin tattaunawa tana roƙonka ka shigar da sunan mai amfani da kalmar sirrinka. Sai bayan shigar da bayanai daidai ne za ka iya ganin shafin shiga Adminer.

Mataki na biyu shine shigar da kalmar sirri ta Admin. Na saita kalmar sirri ta hanyar index.php, don haka ko da wani ya ketare tantancewar Nginx, ba za su san kalmar sirri ta Admin ba.

Mataki na uku shine kariyar ƙarfin Fail2Ban. Idan wani ya yi ƙoƙarin tilasta kalmar sirrinka ta brute-force, Fail2Ban zai toshe adireshin IP ɗinsa ta atomatik.

Da waɗannan matakai uku na kariya, za ku iya sanya Administrator a kan intanet na jama'a cikin kwanciyar hankali.

Aiki da dannawa ɗaya, da gaske dannawa ɗaya ne.

Tsarin tura kayan abu ne mai matuƙar sauƙi.

#!/bin/bash
# ==============================================================================
# Adminer + 插件 + Nginx Auth + Fail2Ban 一键自动化部署脚本 (HestiaCP 完美版)
# ==============================================================================

set -e

# 必须以 root 权限运行
if [ "$EUID" -ne 0 ]; then
echo "❌ 错误：请使用 root 或 sudo 运行此脚本！"
exit 1
fi

# ------------------------------------------------------------------------------
# 1. 交互式输入配置参数
# ------------------------------------------------------------------------------
read -p "请输入 HestiaCP 用户名 [默认: admin]: " HESTIA_USER
HESTIA_USER=${HESTIA_USER:-admin}

read -p "请输入 Adminer 部署域名 [例如: adminer.example.com]: " DOMAIN
if [ -z "$DOMAIN" ]; then
echo "❌ 错误：域名不能为空！"
exit 1
fi

read -p "请输入 Nginx 网页认证用户名 [默认: adminuser]: " AUTH_USER
AUTH_USER=${AUTH_USER:-adminuser}

read -sp "请输入防护密码 (用于 Nginx 认证与 Adminer 登录): " AUTH_PASS
echo ""
if [ -z "$AUTH_PASS" ]; then
echo "❌ 错误：密码不能为空！"
exit 1
fi

# 核心路径变量定义
WEBROOT="/home/$HESTIA_USER/web/$DOMAIN/public_html"
ADMINER_FILE="$WEBROOT/adminer.php"
PLUGIN_DIR="$WEBROOT/plugins"
HTPASSWD_FILE="/etc/nginx/.htpasswd-$DOMAIN"

echo -e "\n🚀 开始部署 Adminer 到域名: $DOMAIN ..."

# ------------------------------------------------------------------------------
# 2. 创建目录与安装基础依赖
# ------------------------------------------------------------------------------
if [ ! -d "$WEBROOT" ]; then
echo "📁 创建 Web 根目录: $WEBROOT"
mkdir -p "$WEBROOT"
fi
mkdir -p "$PLUGIN_DIR"

echo "🔍 检查基础依赖环境..."
if ! command -v htpasswd >/dev/null 2>&1; then
echo "📦 安装 apache2-utils 工具包..."
apt-get update -qq && apt-get install -y -qq apache2-utils
fi

if ! command -v php >/dev/null 2>&1; then
echo "❌ 错误：未检测到系统的 PHP 环境！"
exit 1
fi

# ------------------------------------------------------------------------------
# 3. 安全下载 Adminer 核心程序
# ------------------------------------------------------------------------------
echo "📥 正在下载最新版 Adminer..."
curl -sL -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
-o "$ADMINER_FILE" "https://www.adminer.org/latest.php"

# 校验下载有效性
if ! grep -q "<?php" "$ADMINER_FILE"; then
echo "⚠️ 官方源连接异常，正在切换至 GitHub Releases 稳定源..."
curl -sL -o "$ADMINER_FILE" \
"https://github.com/vrana/adminer/releases/download/v4.8.1/adminer-4.8.1.php"
fi

# ------------------------------------------------------------------------------
# 4. 下载官方核心插件与加载器
# ------------------------------------------------------------------------------
echo "🧩 正在下载插件组件..."
curl -sL -o "$PLUGIN_DIR/plugin.php" \
https://raw.githubusercontent.com/vrana/adminer/master/plugins/plugin.php

curl -sL -o "$PLUGIN_DIR/fc-sqlite-connection-without-credentials.php" \
https://raw.githubusercontent.com/vrana/adminer/master/plugins/fc-sqlite-connection-without-credentials.php

curl -sL -o "$PLUGIN_DIR/login-password-less.php" \
https://raw.githubusercontent.com/vrana/adminer/master/plugins/login-password-less.php

# ------------------------------------------------------------------------------
# 5. 安全生成密码 Hash 并构建入口文件 index.php
# ------------------------------------------------------------------------------
echo "⚙️ 生成密码 Hash 与 index.php 配置..."
# 使用 getenv() 替代 $_ENV，防止 php.ini 未开启 E 作用域导致 Hash 计算为空
HASHED_PASSWORD=$(AUTH_PASS="$AUTH_PASS" php -r 'echo password_hash(getenv("AUTH_PASS"), PASSWORD_DEFAULT);')

cat > "$WEBROOT/index.php" <<EOF
<?php
function adminer_object() {
include_once "./plugins/plugin.php";
include_once "./plugins/fc-sqlite-connection-without-credentials.php";
include_once "./plugins/login-password-less.php";

return new AdminerPlugin([
new AdminerFCSqliteConnectionWithoutCredentials(),
new AdminerLoginPasswordLess('$HASHED_PASSWORD'),
]);
}
include "./adminer.php";
EOF

# ------------------------------------------------------------------------------
# 6. 配置 Nginx 基础认证 (完全依赖 HestiaCP 原生 Include 机制)
# ------------------------------------------------------------------------------
echo "🔒 配置 Nginx HTTP Basic Auth..."
htpasswd -b -c "$HTPASSWD_FILE" "$AUTH_USER" "$AUTH_PASS"
chmod 644 "$HTPASSWD_FILE"

HESTIA_CONF_DIR="/home/$HESTIA_USER/conf/web/$DOMAIN"
if [ -d "$HESTIA_CONF_DIR" ]; then
# HestiaCP 原生包含文件名格式：nginx.conf_* 与 nginx.ssl.conf_*
# 这样无需 sed 修改主配置文件，重建域名配置时也不会失效
cat > "$HESTIA_CONF_DIR/nginx.conf_adminer" <<EOF
auth_basic "Restricted Adminer Access";
auth_basic_user_file $HTPASSWD_FILE;
EOF

cat > "$HESTIA_CONF_DIR/nginx.ssl.conf_adminer" <<EOF
auth_basic "Restricted Adminer Access";
auth_basic_user_file $HTPASSWD_FILE;
EOF
fi

# ------------------------------------------------------------------------------
# 7. 配置 Fail2Ban 防护规则
# ------------------------------------------------------------------------------
echo "🛡️ 配置 Fail2Ban 规则..."
cat > /etc/fail2ban/filter.d/nginx-adminer.conf <<'EOF'
[Definition]
failregex = ^<HOST> - .* "GET /.* HTTP/.*" 401
ignoreregex =
EOF

cat > /etc/fail2ban/jail.d/nginx-adminer.conf <<EOF
[nginx-adminer]
enabled = true
filter = nginx-adminer
port = http,https
logpath = /var/log/nginx/domains/$DOMAIN.log
maxretry = 3
findtime = 600
bantime = 3600
EOF

# ------------------------------------------------------------------------------
# 8. 修复权限、刷新缓存与重载服务
# ------------------------------------------------------------------------------
echo "🧹 修复权限并重载服务..."
chown -R $HESTIA_USER:$HESTIA_USER "$WEBROOT"
find "$WEBROOT" -type d -exec chmod 755 {} +
find "$WEBROOT" -type f -exec chmod 644 {} +

# 平滑重载 PHP-FPM（兼容多版本 PHP 环境）
for service in $(systemctl list-units --type=service --state=running --no-legend | awk '{print $1}' | grep -E 'php.*fpm'); do
systemctl reload "$service" || true
done

# 重载 Web 与防护服务
nginx -t && systemctl reload nginx
if systemctl is-active --quiet fail2ban; then
systemctl restart fail2ban
fi

echo -e "\n=================================================="
echo -e "✅ Adminer 一键部署成功！"
echo -e "--------------------------------------------------"
echo -e "🌐 访问地址 : https://$DOMAIN/index.php"
echo -e "👤 Nginx 认证账号 : $AUTH_USER"
echo -e "🔑 Nginx 认证密码 : [你输入的防护密码]"
echo -e "--------------------------------------------------"
echo -e "💡 Adminer 登录说明："
echo -e " 数据库用户名填写：root（或你的数据库账号）"
echo -e " 数据库密码填写：[你输入的防护密码]"
echo -e "=================================================="

Yadda ake gudanar da rubutun: Ba da izinin aiwatar da rubutun:

sudo chmod +x /usr/local/bin/deploy-adminer.sh 

Gudanar da rubutun ta amfani da sudo:

sudo /usr/local/bin/deploy-adminer.sh 

Shigar da bayanin sanyi kamar yadda aka umarta:

• Shigar da sunan mai amfani na HestiaCP (misali, admin).
• Shigar da cikakken yanki na ƙasa da aka shirya (misali, adminer.example.com).
• Shigar da kalmar sirri ta tsaro (misali, MySuperPassword123)

Rubutun zai kammala dukkan tsarin daidaitawa ta atomatik ba tare da barin komai ba.

Duk aikin yana ɗaukar kimanin minti ɗaya ko biyu. Rubutun zai sarrafa komai ta atomatik, kuma ba kwa buƙatar aiwatar da kowace umarni da hannu.

Bayan ka gama, zaka iya shiga Admin ta hanyar https://yourdomain/index.php

Wasu tambayoyi da za ku iya damuwa da su

Wasu abokai na iya tambaya, shin wannan rubutun yana goyan bayan nau'ikan PHP da yawa?

Eh, ana tallafawa. Rubutun zai gano duk ayyukan PHP-FPM da ke gudana akan tsarin ta atomatik kuma ya sake loda su ɗaya bayan ɗaya. Don haka yana aiki lafiya ko kuna amfani da PHP 7.4 ko PHP 8.2.

Wasu abokai na iya tambaya, idan ina son canza kalmar sirri ta fa?

Yana da sauƙi ƙwarai; kawai sake kunna rubutun. Rubutun zai sake sabunta kalmar sirri, sake saita tantancewar Nginx, sannan ya sake saita Fail2Ban. Za a sake rubuta tsohon tsarin.

Me zai faru idan ina son cire shi?

Za ka iya share babban fayil ɗin tushen yanar gizo, fayil ɗin kalmar sirri, da kuma tsarin Fail2Ban da hannu kawai. Rubutun ba zai bar wasu alamomi a kan tsarin ba.

Rubuta a karshen

Kullum ina jin cewa ayyuka da gyare-gyare ba za su yi rikitarwa ba.

Ana iya sarrafa ayyuka da yawa na hannu ta amfani da rubutun. Wannan yana ba ku damar yin amfani da lokacinku akan abubuwa mafi mahimmanci, kamar inganta aikin sabar, sa ido kan matsayin aikace-aikace, da kuma bincika sabbin fasahohi.

Wannan ya tunatar da ni wani labari na tarihi. A shekarun 1880, wutar lantarki ta fara yaduwa a Amurka. Masu masana'antu da yawa sun kashe kuɗi mai yawa don siyan janareto da injinan lantarki kuma suka sanya su a masana'antar su. Duk da haka, bayan shigarwa, mutane da yawa sun gano cewa ingancin samarwa bai inganta sosai ba. Wannan ya faru ne saboda sun maye gurbin injinan tururi kawai da injinan lantarki, amma tsarin gabaɗaya, hanyoyin aiki, da hanyoyin gudanarwa na masana'antar ba su canza ba.

Waɗanda suka ci gajiyar haɓakar wutar lantarki su ne suka fara fahimtar ainihin ma'anar wutar lantarki. Sun sake fasalin layukan samarwa, sun sake tsara tarurrukan bita, sannan suka sake tsara yadda ma'aikata ke aiki.

Haka nan ya shafi ayyuka da gyaran atomatik. Mutane da yawa sun san cewa ana iya amfani da rubutun, amma har yanzu sun fi son yin amfani da hannu, kamar waɗancan masu masana'antu a baya waɗanda suka san game da injinan lantarki amma har yanzu suna amfani da tunanin injunan tururi don amfani da su. Ba a yi nufin rubutun don maye gurbin tunanin ku ba, amma don yin ayyukan da ke maimaitawa, na inji, da kuma waɗanda ke da saurin kuskure, wanda ke ba ku damar mai da hankali kan abin da ke buƙatar tunani da gaske.

Ga yadda wannan rubutun ya samo asali. Ya magance min wata matsala mai wahala, kuma ina fatan zai iya taimaka muku ma.

Idan kana amfani da HestiaCP da Adminer, za ka iya gwada wannan rubutun. Zai iya ceton maka lokaci mai yawa.

Tunda ka karanta wannan labarin, idan ka ga yana da amfani, don Allah ka yi like sannan ka raba shi. Idan kana son samun sabbin bayanai da farko, za ka iya bi na!

Na gode da karanta labarina. Sai mun haɗu a karo na gaba.