$ sudo dnf install mariadb-server.x86_64

$ sudo mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user.  If you've just installed MariaDB, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.

Set root password? [Y/n] y
New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
 ... Success!

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] y
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] y
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

MariaDB [(none)]> CREATE DATABASE wordpress;
Query OK, 1 row affected (0.004 sec)


MariaDB [(none)]>


MariaDB [(none)]> GRANT ALL PRIVILEGES ON wordpress.* TO "DBアドミン名"@"localhost" IDENTIFIED BY "パスワード";
Query OK, 0 rows affected (0.004 sec)


MariaDB [(none)]> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.002 sec)

$ sudo mv /etc/my.cnf.d/auth_gssapi.cnf /etc/my.cnf.d/auth_gssapi.cnf.org

$ systemctl enable mariadb
$ systemctl start mariadb

$ sudo dnf install php php-mysqlnd php-mbstring.x86_64 php-json php-gd php-xml php-zip php-dom

; Unix user/group of processes
; Note: The user is mandatory. If the group is not set, the default user's group
;       will be used.
; RPM: apache user chosen to provide access to the same directories as httpd
;user = apache
user = nginx
; RPM: Keep a group allowed to write in log dir.
;group = apache
group = nginx

$ sudo dnf install nginx

$ wget https://ja.wordpress.org/latest-ja.tar.gz
$ tar xvfz latest-ja.tar.gz ./
$ sudo chown -R nginx:nginx /usr/share/nginx/WP
$ sudo mv wordpress/* /usr/share/nginx/WP/

# HTTPSへリダイレクト
server {
        listen 80;
        server_name zassoul.com;
        return 301 https://$host$request_uri;
}
server {
        listen 443 ssl;
        server_name zassoul.com;
        root /usr/share/nginx/WP;
        index index.php;
        charset utf-8;

        ssl_certificate /etc/letsencrypt/live/zassoul.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/zassoul.com/privkey.pem;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;

        location = /favicon.ico {
                log_not_found off;
                access_log off;
        }

        location / {
                try_files $uri $uri/ /index.php?$args;
        }

        # Deny to wp-config.php
        location ~* /wp-config.php {
                deny all;
        }

        #php-fpm
        location ~ \.php$ {
                try_files $uri = 404;
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                include fastcgi_params;
                fastcgi_index index.php;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                fastcgi_pass php-fpm;
        }

        location ~* \.(js|css|png|jpg|jpgeg|gif|ico)$ {
               expires max;
               log_not_found off;
        }
}

// ** MySQL 設定 - この情報はホスティング先から入手してください。 ** //
/** WordPress のためのデータベース名 */
define( 'DB_NAME', 'wordpress' );

/** MySQL データベースのユーザー名 */
define( 'DB_USER', '上で設定したユーザ名' );

/** MySQL データベースのパスワード */
define( 'DB_PASSWORD', '上で設定したパスワード' );

/** MySQL のホスト名 */
define( 'DB_HOST', 'localhost' );

/** データベースのテーブルを作成する際のデータベースの文字セット */
define( 'DB_CHARSET', 'utf8mb4' );

/** データベースの照合順序 (ほとんどの場合変更する必要はありません) */
define( 'DB_COLLATE', '' );

/**#@+
 * 認証用ユニークキー
 */
define( 'AUTH_KEY',         'ジェネレートしたキー' );
define( 'SECURE_AUTH_KEY',  'ジェネレートしたキー' );
define( 'LOGGED_IN_KEY',    'ジェネレートしたキー' );
define( 'NONCE_KEY',        'ジェネレートしたキー' );
define( 'AUTH_SALT',        'ジェネレートしたキー' );
define( 'SECURE_AUTH_SALT', 'ジェネレートしたキー' );
define( 'LOGGED_IN_SALT',   'ジェネレートしたキー' );
define( 'NONCE_SALT',       'ジェネレートしたキー' );

/**#@-*/

$ sudo dnf install epel-release
$ sudo dnf install certbot

$ sudo certbot certonly --dry-run --standalone -w /usr/share/nginx/WP/ -d zassoul.com -m "Email-Address"

$ sudo certbot certonly  --standalone -d zassoul.com -m "Email-Address" --agree-tos
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for zassoul.com
Using the webroot path /usr/share/nginx/WP for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Subscribe to the EFF mailing list (email: "Email-Address").


IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/zassoul.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/zassoul.com/privkey.pem
   Your cert will expire on 2020-12-07. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:


   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

$ sudo systemctl enable nginx
$ sudo systemctl start nginx