优化逻辑
This commit is contained in:
Yvan
+9
-54
@@ -6,13 +6,12 @@ server:
|
||||
data:
|
||||
database:
|
||||
driver: mysql
|
||||
# Supply production credentials through KRA_DATA_DATABASE_*.
|
||||
source: ""
|
||||
host: 127.0.0.1
|
||||
port: "3306"
|
||||
source: root:+V1veMv3Vv_4VdqtZ1f#L7*+@tcp(47.97.87.141:13306)/yzyz_live?charset=utf8mb4&parseTime=True&loc=Local
|
||||
host: 47.97.87.141
|
||||
port: "13306"
|
||||
user: root
|
||||
password: ""
|
||||
name: yzyzlive
|
||||
password: +V1veMv3Vv_4VdqtZ1f#L7*+
|
||||
name: yzyz_live
|
||||
config: charset=utf8mb4&parseTime=True&loc=Local
|
||||
path: ""
|
||||
alias_name: ""
|
||||
@@ -27,48 +26,15 @@ data:
|
||||
redis:
|
||||
network: tcp
|
||||
name: default
|
||||
addr: 127.0.0.1:6379
|
||||
password: ""
|
||||
addr: live-redis:6379
|
||||
password: '1_S7cwT$hNU7C^y$fALKX99U'
|
||||
db: 0
|
||||
use_cluster: false
|
||||
cluster_addrs: []
|
||||
read_timeout: 0.200s
|
||||
write_timeout: 0.200s
|
||||
# Additional databases use alias_name as the lookup key. Disabled entries
|
||||
# remain available as configuration examples without opening connections.
|
||||
database_list: []
|
||||
# Example:
|
||||
# database_list:
|
||||
# - driver: mysql
|
||||
# source: ""
|
||||
# host: 127.0.0.1
|
||||
# port: "3306"
|
||||
# user: root
|
||||
# password: ""
|
||||
# name: business
|
||||
# config: timeout=5s&parseTime=True&loc=Local&charset=utf8mb4
|
||||
# path: ""
|
||||
# alias_name: business
|
||||
# disable: true
|
||||
# prefix: ""
|
||||
# engine: InnoDB
|
||||
# log_mode: info
|
||||
# max_idle_conns: 10
|
||||
# max_open_conns: 100
|
||||
# conn_max_lifetime: 3600
|
||||
# singular: false
|
||||
redis_list: []
|
||||
# Example:
|
||||
# redis_list:
|
||||
# - network: tcp
|
||||
# name: cache
|
||||
# addr: 127.0.0.1:6379
|
||||
# password: ""
|
||||
# db: 0
|
||||
# use_cluster: false
|
||||
# cluster_addrs: []
|
||||
# read_timeout: 0.2s
|
||||
# write_timeout: 0.2s
|
||||
mongo:
|
||||
coll: ""
|
||||
options: ""
|
||||
@@ -85,11 +51,9 @@ data:
|
||||
- host: ""
|
||||
port: ""
|
||||
admin:
|
||||
# The administration system router prefix maps to this transport prefix.
|
||||
router_prefix: ""
|
||||
jwt:
|
||||
# Generated during first-install, or provide KRA_ADMIN_JWT_SIGNING_KEY locally.
|
||||
signing_key: ""
|
||||
signing_key: 0848966d-b15a-4e4d-a527-7024910ba429
|
||||
expires_time: 604800s
|
||||
buffer_time: 86400s
|
||||
issuer: kra
|
||||
@@ -102,7 +66,6 @@ admin:
|
||||
store_path: uploads/file
|
||||
path_prefix: uploads/file
|
||||
media:
|
||||
# Upload chunks are stored below uploads/chunks in the selected storage backend.
|
||||
session_ttl: 24
|
||||
max_file_size: "0"
|
||||
chunk_dir: uploads/chunks
|
||||
@@ -129,23 +92,15 @@ admin:
|
||||
access_resp_data: true
|
||||
access_req_headers: true
|
||||
access_log_max_bytes: 1024
|
||||
# High-volume request and SQL details remain available in logs/http and logs/sql.
|
||||
file_only_modules:
|
||||
- http
|
||||
- sql
|
||||
cors:
|
||||
mode: allow-all
|
||||
whitelist: []
|
||||
# Example:
|
||||
# whitelist:
|
||||
# - allow_origin: https://admin.example.com
|
||||
# allow_headers: Content-Type,Authorization,X-Token
|
||||
# allow_methods: POST,GET,PUT,DELETE,OPTIONS
|
||||
# expose_headers: Content-Length,Content-Type
|
||||
# allow_credentials: true
|
||||
app:
|
||||
node: ""
|
||||
app_id: kra
|
||||
env: development
|
||||
env: production
|
||||
disk_list:
|
||||
- mount_point: /
|
||||
|
||||
@@ -0,0 +1,122 @@
|
||||
# ============================================================
|
||||
# 本机一键打包脚本（Windows PowerShell）
|
||||
# 流程: go build(linux/amd64) -> web/frontend 两个 vite build
|
||||
# -> 渲染 web/nginx.k8s.conf(去 BOM) -> docker build -> push Harbor
|
||||
#
|
||||
# 用法:
|
||||
# .\deploy\build.ps1 # 打包当前代码并推送 (tag = commit sha + latest)
|
||||
# .\deploy\build.ps1 -Tag v1.0.2 # 使用指定 tag
|
||||
# .\deploy\build.ps1 -NoPush # 只构建不推送
|
||||
#
|
||||
# 依赖: go / node(corepack pnpm) / docker（Harbor 登录态已存于 Docker Desktop 凭据库）
|
||||
# ============================================================
|
||||
param(
|
||||
[string]$Tag = "",
|
||||
[switch]$NoPush
|
||||
)
|
||||
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
# 脚本所在目录的上一级即项目根目录，任何 cwd 下运行都正确
|
||||
$Root = Split-Path -Parent $PSScriptRoot
|
||||
$Registry = 'harbor.fuhua91.com'
|
||||
$Project = 'live'
|
||||
|
||||
function Invoke-Step {
|
||||
param([string]$Name, [scriptblock]$Block)
|
||||
Write-Host "==> $Name" -ForegroundColor Cyan
|
||||
& $Block
|
||||
if ($LASTEXITCODE -and $LASTEXITCODE -ne 0) {
|
||||
Write-Host "错误: $Name 失败 (exit $LASTEXITCODE)" -ForegroundColor Red
|
||||
exit $LASTEXITCODE
|
||||
}
|
||||
}
|
||||
|
||||
# 前端包管理器: 本机 pnpm 通常不在 PATH，回退 corepack pnpm
|
||||
function Invoke-Pnpm {
|
||||
param([string]$Dir, [string[]]$PnpmArgs)
|
||||
Push-Location (Join-Path $Root $Dir)
|
||||
try {
|
||||
if (Get-Command pnpm -ErrorAction SilentlyContinue) {
|
||||
& pnpm @PnpmArgs
|
||||
} else {
|
||||
& corepack pnpm @PnpmArgs
|
||||
}
|
||||
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
||||
} finally {
|
||||
Pop-Location
|
||||
}
|
||||
}
|
||||
|
||||
function Build-Frontend {
|
||||
param([string]$Dir)
|
||||
if (-not (Test-Path (Join-Path $Root "$Dir\node_modules"))) {
|
||||
Invoke-Step "[$Dir] pnpm install" { Invoke-Pnpm -Dir $Dir -PnpmArgs @('install', '--frozen-lockfile') }
|
||||
}
|
||||
Invoke-Step "[$Dir] vite build" { Invoke-Pnpm -Dir $Dir -PnpmArgs @('build') }
|
||||
}
|
||||
|
||||
Set-Location $Root
|
||||
|
||||
# ---------- 0. 版本号 ----------
|
||||
if (-not $Tag) {
|
||||
$Tag = (& git rev-parse --short=12 HEAD).Trim()
|
||||
if ($LASTEXITCODE -ne 0) { Write-Host '错误: 无法获取 git commit sha' -ForegroundColor Red; exit 1 }
|
||||
}
|
||||
$BackendImage = "$Registry/$Project/backend:$Tag"
|
||||
$FrontendImage = "$Registry/$Project/frontend:$Tag"
|
||||
$LivewebImage = "$Registry/$Project/live-web:$Tag"
|
||||
Write-Host "==> 打包版本: $Tag"
|
||||
|
||||
# ---------- 1. 后端二进制 (必须 linux/amd64，否则容器内 Exec format error) ----------
|
||||
Invoke-Step 'go build (GOOS=linux GOARCH=amd64)' {
|
||||
$env:GOOS = 'linux'; $env:GOARCH = 'amd64'; $env:CGO_ENABLED = '0'
|
||||
go build -ldflags "-X main.Version=$Tag" -o ./bin/kratos-admin ./cmd
|
||||
}
|
||||
|
||||
# ---------- 2. 两个前端 ----------
|
||||
Build-Frontend 'web' # admin 管理后台
|
||||
Build-Frontend 'frontend' # live 用户端(PC 直播页)
|
||||
|
||||
# ---------- 3. 渲染 nginx.k8s.conf ----------
|
||||
# PowerShell Set-Content 会写 UTF-8 BOM，导致 nginx 报 unknown directive；
|
||||
# 必须用 WriteAllBytes 写无 BOM 内容。KRA_APP=live -> proxy_pass http://live-backend:8000
|
||||
Invoke-Step '渲染 web/nginx.k8s.conf (KRA_APP=live, 去 BOM)' {
|
||||
$src = Get-Content -Raw (Join-Path $Root 'web\.docker-compose\nginx\conf.d\my.conf')
|
||||
$rendered = $src -replace '\$\{KRA_APP\}', $Project
|
||||
$dst = Join-Path $Root 'web\nginx.k8s.conf'
|
||||
[System.IO.File]::WriteAllBytes($dst, [System.Text.Encoding]::UTF8.GetBytes($rendered))
|
||||
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
||||
# 校验文件头非 EF BB BF
|
||||
$head = [System.IO.File]::ReadAllBytes($dst)[0..1]
|
||||
if ($head[0] -eq 0xEF -and $head[1] -eq 0xBB) {
|
||||
Write-Host '错误: nginx.k8s.conf 仍含 BOM' -ForegroundColor Red
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
|
||||
# ---------- 4. docker build ----------
|
||||
Invoke-Step "docker build $BackendImage" {
|
||||
docker build -t $BackendImage -t "$Registry/$Project/backend:latest" $Root
|
||||
}
|
||||
Invoke-Step "docker build $FrontendImage" {
|
||||
docker build -t $FrontendImage -t "$Registry/$Project/frontend:latest" (Join-Path $Root 'web')
|
||||
}
|
||||
Invoke-Step "docker build $LivewebImage" {
|
||||
docker build -t $LivewebImage -t "$Registry/$Project/live-web:latest" (Join-Path $Root 'frontend')
|
||||
}
|
||||
|
||||
# ---------- 5. docker push ----------
|
||||
if (-not $NoPush) {
|
||||
foreach ($img in @($BackendImage, $FrontendImage, $LivewebImage)) {
|
||||
Invoke-Step "docker push ${img}:$Tag + latest" {
|
||||
docker push $img
|
||||
docker push ($img -replace ":[^:]+$", ':latest')
|
||||
}
|
||||
}
|
||||
Write-Host ""
|
||||
Write-Host "完成。服务器上执行: ./deploy.sh $Tag (或不带参数拉 latest)" -ForegroundColor Green
|
||||
} else {
|
||||
Write-Host ""
|
||||
Write-Host "构建完成 (-NoPush 未推送)。镜像: $BackendImage / $FrontendImage / $LivewebImage" -ForegroundColor Green
|
||||
}
|
||||
+17
-4
@@ -26,8 +26,8 @@ FRONTEND_PORT=9501 # admin 管理后台 nginx 容器
|
||||
BACKEND_PORT=9502 # 后端 API/WebSocket 容器
|
||||
LIVEWEB_PORT=9503 # live 用户端(PC 直播页) nginx 容器
|
||||
LIVE_UDP_PORT="${KRA_LIVE_UDP_PORT:-9504}" # WebRTC 音视频固定 UDP 端口（与 9501-9503 顺延配套）
|
||||
LIVE_PUBLIC_IP="${KRA_LIVE_PUBLIC_IP:-192.168.2.226}" # 留空时从站点域名解析
|
||||
LIVE_HOST="${KRA_LIVE_HOST:-live.fuhua91.com}"
|
||||
LIVE_PUBLIC_IP="${KRA_LIVE_PUBLIC_IP:-}" # 留空时从站点域名解析
|
||||
LIVE_HOST="${KRA_LIVE_HOST:-live.yuzou99.com}"
|
||||
NETWORK="live-net"
|
||||
BACKEND_NAME="live-backend"
|
||||
FRONTEND_NAME="live-frontend"
|
||||
@@ -39,6 +39,18 @@ BACKEND_IMAGE="$REGISTRY/$PROJECT/backend:$TAG"
|
||||
FRONTEND_IMAGE="$REGISTRY/$PROJECT/frontend:$TAG"
|
||||
LIVEWEB_IMAGE="$REGISTRY/$PROJECT/live-web:$TAG"
|
||||
|
||||
# 基础环境检查（Docker / MySQL / Redis 由 server-init.sh 负责）
|
||||
if ! command -v docker >/dev/null 2>&1; then
|
||||
echo "错误: 服务器未安装 Docker，请先执行基础环境初始化脚本:"
|
||||
echo " bash server-init.sh"
|
||||
exit 1
|
||||
fi
|
||||
if ! docker ps --format '{{.Names}}' | grep -qx 'live-mysql' || \
|
||||
! docker ps --format '{{.Names}}' | grep -qx 'live-redis'; then
|
||||
echo "警告: live-mysql / live-redis 容器未在运行，后端将连不上数据库。"
|
||||
echo " 请先执行基础环境初始化脚本: bash server-init.sh"
|
||||
fi
|
||||
|
||||
echo "==> 部署版本: $TAG"
|
||||
|
||||
# 1. 准备挂载目录
|
||||
@@ -54,8 +66,9 @@ fi
|
||||
|
||||
if [ -z "$LIVE_PUBLIC_IP" ]; then
|
||||
# 1) 域名解析，过滤内网/回环地址（服务器 /etc/hosts 可能指向内网）
|
||||
LIVE_PUBLIC_IP="$(getent ahostsv4 "$LIVE_HOST" | awk '{print $1}' | grep -E '^[0-9]+(\.[0-9]+){3}$' \
|
||||
| grep -vE '^(10\.|127\.|169\.254\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)' | head -n1)"
|
||||
# getent 域名不存在时返回非零且无输出，须吞掉退出码，否则 pipefail+set -e 会静默退出
|
||||
LIVE_PUBLIC_IP="$( { timeout 10 getent ahostsv4 "$LIVE_HOST" 2>/dev/null || true; } | awk '{print $1}' | grep -E '^[0-9]+(\.[0-9]+){3}$' \
|
||||
| grep -vE '^(10\.|127\.|169\.254\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)' | head -n1 || true)"
|
||||
fi
|
||||
if [ -z "$LIVE_PUBLIC_IP" ]; then
|
||||
# 2) 域名取不到公网 IP 时，回退查询公网出口 IP（云主机 EIP 1:1 NAT 场景一致）
|
||||
|
||||
@@ -0,0 +1,770 @@
|
||||
#!/bin/bash
|
||||
# ============================================================
|
||||
# live.fuhua91.com 生产服务器基础环境初始化脚本（幂等，可重复执行）
|
||||
#
|
||||
# 功能:
|
||||
# 1. 安装 Docker（自动识别 CentOS/Rocky/Alma/Ubuntu/Debian）
|
||||
# 2. 启动 MySQL 8 容器（root 强密码，外部端口 13306，数据落盘 /www/live-data/mysql）
|
||||
# 3. 启动 Redis 7 容器（强密码，仅容器网络内可访问 + 本机 127.0.0.1:16379 调试口）
|
||||
# 4. 生成宿主机 nginx 站点配置（80/443 -> 容器端口 9501/9502/9503，自签证书启用 https，
|
||||
# 并清理 nginx.conf / conf.d 中旧 live 站点的反代配置）
|
||||
# 5. 自动生成后端配置 /www/wwwroot/live.fuhua91.com/config/config.yaml（写入生成的密码）
|
||||
# 6. 凭据保存到 /root/live-credentials.txt（chmod 600）
|
||||
#
|
||||
# 用法:
|
||||
# bash server-init.sh 仅初始化基础环境
|
||||
# bash server-init.sh latest 初始化完成后立即用 deploy.sh 部署 latest 版本
|
||||
# HARBOR_PASSWORD='xxx' bash server-init.sh latest 连 Harbor 密码一起传给 deploy.sh
|
||||
#
|
||||
# 建议: 放到 /root/server-init.sh，执行 chmod 700 /root/server-init.sh
|
||||
# ============================================================
|
||||
set -euo pipefail
|
||||
|
||||
# ---------- 可按需调整的参数 ----------
|
||||
MYSQL_CONTAINER="live-mysql"
|
||||
REDIS_CONTAINER="live-redis"
|
||||
NETWORK="live-net"
|
||||
|
||||
MYSQL_IMAGE="mysql:8.0"
|
||||
REDIS_IMAGE="redis:7-alpine"
|
||||
|
||||
DATA_DIR="/www/live-data" # MySQL/Redis/网关配置/证书等落盘目录
|
||||
|
||||
MYSQL_EXTERNAL_PORT=13306 # MySQL 对外端口
|
||||
REDIS_LOCAL_PORT=16379 # Redis 仅绑定 127.0.0.1 的调试端口，不对公网开放
|
||||
|
||||
LIVE_HOST="${KRA_LIVE_HOST:-live.yuzou99.com}"
|
||||
HOST_NGINX_CONF="/etc/nginx/conf.d/live.fuhua91.com.conf" # 宿主机 nginx 站点配置
|
||||
SSL_WEBROOT="$DATA_DIR/ssl/webroot" # acme.sh http-01 验证目录
|
||||
SSL_CERT_DIR="$DATA_DIR/ssl/certs" # HTTPS 证书目录
|
||||
|
||||
BASE_DIR="/www/wwwroot/live.fuhua91.com"
|
||||
CONFIG_DIR="$BASE_DIR/config" # 后端配置目录 -> 容器内 /data/conf
|
||||
CRED_FILE="/root/live-credentials.txt"
|
||||
# Docker Hub 镜像加速（拉不动 mysql/redis 时 docker 会自动回退官方源；
|
||||
# 如你的服务器可直接访问 Docker Hub，可清空此数组）
|
||||
DOCKER_MIRRORS=("https://docker.1ms.run" "https://docker.m.daocloud.io")
|
||||
# --------------------------------------
|
||||
|
||||
TAG="${1:-}"
|
||||
|
||||
# ---------- 通用 ----------
|
||||
if [ "$(id -u)" -ne 0 ]; then
|
||||
echo "错误: 请用 root 执行本脚本"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 生成 24 位强密码（字符集避开 MySQL DSN 分隔符 @ : / ? 以及 shell/YAML 敏感字符）
|
||||
gen_pass() {
|
||||
local pass=""
|
||||
while [ "${#pass}" -lt 24 ]; do
|
||||
pass="${pass}$(tr -dc 'A-Za-z0-9#$%^*+_-' < /dev/urandom | head -c 32 || true)"
|
||||
done
|
||||
printf '%s' "${pass:0:24}"
|
||||
}
|
||||
|
||||
# ---------- 1. 安装 Docker ----------
|
||||
if [ -r /etc/os-release ]; then
|
||||
. /etc/os-release
|
||||
OS_ID="${ID:-unknown}"
|
||||
OS_MAJOR="${VERSION_ID%%.*}"
|
||||
else
|
||||
OS_ID="unknown"
|
||||
OS_MAJOR=""
|
||||
fi
|
||||
|
||||
fix_centos7_repos() {
|
||||
echo "==> 检测到 CentOS 7（已 EOL），切换 yum 源到 vault"
|
||||
mkdir -p /etc/yum.repos.d/backup
|
||||
for f in /etc/yum.repos.d/CentOS-*.repo; do
|
||||
[ -e "$f" ] || return 0
|
||||
mv "$f" /etc/yum.repos.d/backup/ 2>/dev/null || true
|
||||
done
|
||||
curl -fsSL -o /etc/yum.repos.d/CentOS-Base.repo \
|
||||
https://mirrors.aliyun.com/repo/Centos-7.repo 2>/dev/null || true
|
||||
yum clean all >/dev/null 2>&1 || true
|
||||
}
|
||||
|
||||
install_docker_rhel() {
|
||||
yum install -y yum-utils 2>/dev/null || yum install -y --allowerasing yum-utils
|
||||
if ! yum-config-manager --add-repo \
|
||||
https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo; then
|
||||
yum-config-manager --add-repo \
|
||||
https://download.docker.com/linux/centos/docker-ce.repo
|
||||
fi
|
||||
yum makecache fast >/dev/null 2>&1 || yum makecache >/dev/null 2>&1 || true
|
||||
yum install -y docker-ce docker-ce-cli containerd.io \
|
||||
|| yum install -y --allowerasing docker-ce docker-ce-cli containerd.io
|
||||
}
|
||||
|
||||
install_docker_deb() {
|
||||
local distro="$1" codename
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-get update -y
|
||||
apt-get install -y ca-certificates curl gnupg lsb-release
|
||||
codename="$(lsb_release -cs 2>/dev/null || echo stable)"
|
||||
install -m 0755 -d /etc/apt/keyrings
|
||||
curl -fsSL "https://mirrors.aliyun.com/docker-ce/linux/${distro}/gpg" \
|
||||
| gpg --dearmor --yes -o /etc/apt/keyrings/docker.gpg
|
||||
chmod a+r /etc/apt/keyrings/docker.gpg
|
||||
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
|
||||
https://mirrors.aliyun.com/docker-ce/linux/${distro} ${codename} stable" \
|
||||
> /etc/apt/sources.list.d/docker.list
|
||||
apt-get update -y
|
||||
apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
|
||||
}
|
||||
|
||||
configure_docker() {
|
||||
# 日志轮转 + 镜像加速，避免容器日志撑爆磁盘
|
||||
[ -f /etc/docker/daemon.json ] && cp /etc/docker/daemon.json "/etc/docker/daemon.json.bak.$(date +%s)" || true
|
||||
local mirrors_json="[]"
|
||||
if [ "${#DOCKER_MIRRORS[@]}" -gt 0 ]; then
|
||||
mirrors_json=$(printf '"%s",' "${DOCKER_MIRRORS[@]}")
|
||||
mirrors_json="[${mirrors_json%,}]"
|
||||
fi
|
||||
cat > /etc/docker/daemon.json <<EOF
|
||||
{
|
||||
"log-driver": "json-file",
|
||||
"log-opts": { "max-size": "50m", "max-file": "3" },
|
||||
"registry-mirrors": ${mirrors_json}
|
||||
}
|
||||
EOF
|
||||
systemctl daemon-reload
|
||||
systemctl restart docker
|
||||
}
|
||||
|
||||
install_docker() {
|
||||
if command -v docker >/dev/null 2>&1; then
|
||||
echo "==> Docker 已安装: $(docker --version)，跳过安装"
|
||||
configure_docker
|
||||
return 0
|
||||
fi
|
||||
echo "==> 安装 Docker（系统: ${OS_ID} ${OS_MAJOR:-}）"
|
||||
case "$OS_ID" in
|
||||
centos|rhel|rocky|almalinux|anolis|opencloudos|tencentos)
|
||||
[ "$OS_MAJOR" = "7" ] && fix_centos7_repos
|
||||
install_docker_rhel
|
||||
;;
|
||||
ubuntu|debian)
|
||||
install_docker_deb "$OS_ID"
|
||||
;;
|
||||
*)
|
||||
echo "错误: 未识别的系统 ${OS_ID}，请手动安装 Docker 后重新执行本脚本"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
systemctl enable --now docker
|
||||
configure_docker
|
||||
echo "==> Docker 安装完成: $(docker --version)"
|
||||
}
|
||||
|
||||
# ---------- 2. 读取/生成凭据 ----------
|
||||
MYSQL_ROOT_PASSWORD=""
|
||||
REDIS_PASSWORD=""
|
||||
if [ -f "$CRED_FILE" ]; then
|
||||
MYSQL_ROOT_PASSWORD="$(sed -n "s/^MYSQL_ROOT_PASSWORD='\(.*\)'$/\1/p" "$CRED_FILE")"
|
||||
REDIS_PASSWORD="$(sed -n "s/^REDIS_PASSWORD='\(.*\)'$/\1/p" "$CRED_FILE")"
|
||||
fi
|
||||
if [ -z "$MYSQL_ROOT_PASSWORD" ]; then
|
||||
MYSQL_ROOT_PASSWORD="$(gen_pass)"
|
||||
fi
|
||||
if [ -z "$REDIS_PASSWORD" ]; then
|
||||
REDIS_PASSWORD="$(gen_pass)"
|
||||
fi
|
||||
|
||||
save_credentials() {
|
||||
cat > "$CRED_FILE" <<EOF
|
||||
# ============================================================
|
||||
# live.fuhua91.com 生产环境凭据（生成于 $(date '+%F %T')）
|
||||
# 请妥善保管，勿提交到代码仓库
|
||||
# ============================================================
|
||||
MYSQL_ROOT_PASSWORD='${MYSQL_ROOT_PASSWORD}'
|
||||
MYSQL_EXTERNAL_PORT='${MYSQL_EXTERNAL_PORT}'
|
||||
REDIS_PASSWORD='${REDIS_PASSWORD}'
|
||||
BACKEND_CONFIG='${CONFIG_DIR}/config.yaml'
|
||||
EOF
|
||||
chmod 600 "$CRED_FILE"
|
||||
}
|
||||
|
||||
# ---------- 3. MySQL ----------
|
||||
run_mysql() {
|
||||
docker network create "$NETWORK" >/dev/null 2>&1 || true
|
||||
|
||||
if docker ps --format '{{.Names}}' | grep -qx "$MYSQL_CONTAINER"; then
|
||||
echo "==> $MYSQL_CONTAINER 已在运行，跳过"
|
||||
return 0
|
||||
fi
|
||||
# 容器存在但停止：直接启动（数据卷里已有旧密码，不能重置环境变量）
|
||||
if docker ps -a --format '{{.Names}}' | grep -qx "$MYSQL_CONTAINER"; then
|
||||
echo "==> 启动已存在的 $MYSQL_CONTAINER"
|
||||
docker start "$MYSQL_CONTAINER"
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo "==> 首次启动 $MYSQL_CONTAINER（$MYSQL_IMAGE，外部端口 $MYSQL_EXTERNAL_PORT）"
|
||||
mkdir -p "$DATA_DIR/mysql"
|
||||
docker run -d --name "$MYSQL_CONTAINER" \
|
||||
--restart always \
|
||||
--network "$NETWORK" \
|
||||
-p "${MYSQL_EXTERNAL_PORT}:3306" \
|
||||
-e TZ=Asia/Shanghai \
|
||||
-e MYSQL_ROOT_PASSWORD="$MYSQL_ROOT_PASSWORD" \
|
||||
-e MYSQL_DATABASE=yzyzlive \
|
||||
-v "$DATA_DIR/mysql:/var/lib/mysql" \
|
||||
"$MYSQL_IMAGE" \
|
||||
--character-set-server=utf8mb4 \
|
||||
--collation-server=utf8mb4_general_ci \
|
||||
--default-authentication-plugin=mysql_native_password
|
||||
|
||||
echo "==> 等待 MySQL 就绪（首次启动约 20-60 秒）"
|
||||
local i ready=0
|
||||
for i in $(seq 1 60); do
|
||||
if docker exec "$MYSQL_CONTAINER" mysqladmin ping -uroot -p"$MYSQL_ROOT_PASSWORD" --silent >/dev/null 2>&1; then
|
||||
ready=1
|
||||
break
|
||||
fi
|
||||
sleep 3
|
||||
done
|
||||
if [ "$ready" -ne 1 ]; then
|
||||
echo "错误: MySQL 未就绪，请执行 docker logs $MYSQL_CONTAINER 排查"
|
||||
exit 1
|
||||
fi
|
||||
echo "==> MySQL 就绪（数据库 yzyzlive 已创建）"
|
||||
}
|
||||
|
||||
# ---------- 4. Redis ----------
|
||||
run_redis() {
|
||||
if docker ps --format '{{.Names}}' | grep -qx "$REDIS_CONTAINER"; then
|
||||
echo "==> $REDIS_CONTAINER 已在运行，跳过"
|
||||
return 0
|
||||
fi
|
||||
if docker ps -a --format '{{.Names}}' | grep -qx "$REDIS_CONTAINER"; then
|
||||
echo "==> 启动已存在的 $REDIS_CONTAINER"
|
||||
docker start "$REDIS_CONTAINER"
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo "==> 首次启动 $REDIS_CONTAINER（$REDIS_IMAGE，不对公网开放）"
|
||||
mkdir -p "$DATA_DIR/redis"
|
||||
docker run -d --name "$REDIS_CONTAINER" \
|
||||
--restart always \
|
||||
--network "$NETWORK" \
|
||||
-p "127.0.0.1:${REDIS_LOCAL_PORT}:6379" \
|
||||
-e TZ=Asia/Shanghai \
|
||||
-v "$DATA_DIR/redis:/data" \
|
||||
"$REDIS_IMAGE" \
|
||||
redis-server --requirepass "$REDIS_PASSWORD" --appendonly yes
|
||||
|
||||
local i
|
||||
for i in $(seq 1 10); do
|
||||
if docker exec "$REDIS_CONTAINER" redis-cli -a "$REDIS_PASSWORD" --no-auth-warning ping \
|
||||
2>/dev/null | grep -q PONG; then
|
||||
echo "==> Redis 就绪（本机调试口 127.0.0.1:${REDIS_LOCAL_PORT}）"
|
||||
return 0
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
echo "错误: Redis 启动异常，请执行 docker logs $REDIS_CONTAINER 排查"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# ---------- 4.5 宿主机 nginx 站点配置（80/443 -> 容器端口 9501/9502/9503） ----------
|
||||
# 清理 nginx.conf 及 conf.d 中旧站点（live.fuhua91.com / live.yuzhou99.com / live.yuzou99.com / test-zb.yzyzzb.com）的反代配置（整块删除含目标域名的 server 块）
|
||||
clean_old_nginx_proxy() {
|
||||
local f=/etc/nginx/nginx.conf
|
||||
if [ -f "$f" ] && grep -qE 'live\.(fuhua91|yuzhou99|yuzou99)\.com|test-zb\.yzyzzb\.com' "$f"; then
|
||||
cp "$f" "$f.bak.$(date +%s)"
|
||||
awk '
|
||||
BEGIN { in_server=0; depth=0 }
|
||||
!in_server {
|
||||
if ($0 ~ /^[[:space:]]*server[[:space:]]*\{/) {
|
||||
in_server=1; depth=1; buf=$0 "\n"; next
|
||||
}
|
||||
print; next
|
||||
}
|
||||
in_server {
|
||||
buf = buf $0 "\n"
|
||||
o = gsub(/\{/, "{"); c = gsub(/\}/, "}")
|
||||
depth += o - c
|
||||
if (depth <= 0) {
|
||||
if (buf !~ /live\.(fuhua91|yuzhou99|yuzou99)\.com|test-zb\.yzyzzb\.com/) printf "%s", buf
|
||||
in_server=0; buf=""
|
||||
}
|
||||
}
|
||||
' "$f" > "$f.tmp" && mv "$f.tmp" "$f"
|
||||
echo "==> 已从 nginx.conf 移除旧 live 站点反代配置（备份: $f.bak.*）"
|
||||
fi
|
||||
local cf my_conf my_ssl_conf
|
||||
my_conf="$HOST_NGINX_CONF"
|
||||
my_ssl_conf="${HOST_NGINX_CONF%.conf}.ssl.conf"
|
||||
for cf in /etc/nginx/conf.d/*.conf; do
|
||||
[ -e "$cf" ] || continue
|
||||
[ "$cf" = "$my_conf" ] && continue
|
||||
[ "$cf" = "$my_ssl_conf" ] && continue
|
||||
if grep -qE 'live\.(fuhua91|yuzhou99|yuzou99)\.com|test-zb\.yzyzzb\.com' "$cf"; then
|
||||
mv "$cf" "$cf.bak.$(date +%s)"
|
||||
echo "==> 已移除旧站点配置: $cf（备份为 .bak.*）"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
write_host_nginx_conf() {
|
||||
# 清理旧方案的网关容器（如曾创建）
|
||||
docker rm -f live-gateway >/dev/null 2>&1 || true
|
||||
mkdir -p "$SSL_WEBROOT" "$SSL_CERT_DIR"
|
||||
|
||||
if ! command -v nginx >/dev/null 2>&1; then
|
||||
echo "警告: 宿主机未安装 nginx，跳过站点配置。请安装后重新执行本脚本:"
|
||||
if command -v apt-get >/dev/null 2>&1; then
|
||||
echo " apt-get install -y nginx"
|
||||
else
|
||||
echo " yum install -y nginx && systemctl enable --now nginx"
|
||||
fi
|
||||
return 0
|
||||
fi
|
||||
|
||||
# 移除 nginx.conf / conf.d 中旧 live 站点的反代配置，避免冲突
|
||||
clean_old_nginx_proxy
|
||||
|
||||
# 确保 nginx.conf include 了 conf.d/*.conf（旧反代直接写在 nginx.conf 的机器常缺这条）
|
||||
if ! grep -Eq 'include[[:space:]]+.*conf\.d/\*\.conf' /etc/nginx/nginx.conf; then
|
||||
mkdir -p /etc/nginx/conf.d
|
||||
if grep -qE '^[[:space:]]*http[[:space:]]*\{' /etc/nginx/nginx.conf; then
|
||||
cp /etc/nginx/nginx.conf "/etc/nginx/nginx.conf.bak.$(date +%s)"
|
||||
sed -i '/^[[:space:]]*http[[:space:]]*\{/a\ include /etc/nginx/conf.d/*.conf;' /etc/nginx/nginx.conf
|
||||
echo "==> 已在 nginx.conf 的 http {} 中加入 include /etc/nginx/conf.d/*.conf"
|
||||
else
|
||||
echo "警告: nginx.conf 中未找到 http {} 块，请手动加入 include conf.d/*.conf 后重载"
|
||||
fi
|
||||
fi
|
||||
|
||||
[ -f "$HOST_NGINX_CONF" ] && cp "$HOST_NGINX_CONF" "$HOST_NGINX_CONF.bak.$(date +%s)"
|
||||
|
||||
echo "==> 写入宿主机 nginx 站点配置: $HOST_NGINX_CONF"
|
||||
cat > "$HOST_NGINX_CONF" <<'NGINXCONF'
|
||||
# live.fuhua91.com 站点配置（server-init.sh 生成；HTTPS 模板见 live.fuhua91.com.ssl.conf.example）
|
||||
# 应用容器端口（deploy.sh 映射）: admin=9501, 后端=9502, 主站=9503
|
||||
|
||||
# 变量名带 live_ 前缀，避免与宿主机 nginx 其他配置中的 map 重名冲突
|
||||
map $http_upgrade $live_connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80 default_server;
|
||||
server_name live.fuhua91.com;
|
||||
|
||||
# 启用 HTTPS 后取消下行注释（acme 续期会经 301 走 https 验证，仍可用）
|
||||
#return 301 https://$host$request_uri;
|
||||
|
||||
# admin 媒体上传，默认 1m 会挡上传
|
||||
client_max_body_size 512m;
|
||||
|
||||
# CORS 全放行：反射 Origin（兼容带 cookie 的请求，* 与 credentials 不兼容）
|
||||
add_header Access-Control-Allow-Origin $http_origin always;
|
||||
add_header Access-Control-Allow-Credentials true always;
|
||||
add_header Access-Control-Allow-Methods 'GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS' always;
|
||||
add_header Access-Control-Allow-Headers $http_access_control_request_headers always;
|
||||
add_header Vary Origin always;
|
||||
|
||||
# 隐藏后端自带的 CORS header，避免与上面重复导致浏览器报错
|
||||
proxy_hide_header Access-Control-Allow-Origin;
|
||||
proxy_hide_header Access-Control-Allow-Credentials;
|
||||
proxy_hide_header Access-Control-Allow-Methods;
|
||||
proxy_hide_header Access-Control-Allow-Headers;
|
||||
proxy_hide_header Access-Control-Expose-Headers;
|
||||
proxy_hide_header Access-Control-Max-Age;
|
||||
|
||||
# 预检请求直接响应，不转发后端（if 块的 add_header 会覆盖上面的，需写全）
|
||||
if ($request_method = OPTIONS) {
|
||||
add_header Access-Control-Allow-Origin $http_origin always;
|
||||
add_header Access-Control-Allow-Credentials true always;
|
||||
add_header Access-Control-Allow-Methods 'GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS' always;
|
||||
add_header Access-Control-Allow-Headers $http_access_control_request_headers always;
|
||||
add_header Access-Control-Max-Age 86400 always;
|
||||
add_header Vary Origin always;
|
||||
return 204;
|
||||
}
|
||||
|
||||
# acme.sh http-01 验证
|
||||
location ^~ /.well-known/acme-challenge/ {
|
||||
root /www/live-data/ssl/webroot;
|
||||
}
|
||||
|
||||
# 后端 API / WebSocket（去掉 /api 前缀转给后端容器 9502）
|
||||
location = /api {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $live_connection_upgrade;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_pass http://127.0.0.1:9502;
|
||||
}
|
||||
location ^~ /api/ {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $live_connection_upgrade;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 600s;
|
||||
proxy_send_timeout 600s;
|
||||
rewrite ^/api/(.*)$ /$1 break;
|
||||
proxy_pass http://127.0.0.1:9502;
|
||||
}
|
||||
|
||||
# admin 管理后台（去掉 /admin 前缀转给 admin 前端容器 9501）
|
||||
location = /admin {
|
||||
return 301 /admin/;
|
||||
}
|
||||
location ^~ /admin/ {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
rewrite ^/admin/(.*)$ /$1 break;
|
||||
proxy_pass http://127.0.0.1:9501;
|
||||
}
|
||||
|
||||
# 主站直播页（live-web 容器 9503）
|
||||
location / {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_pass http://127.0.0.1:9503;
|
||||
}
|
||||
}
|
||||
NGINXCONF
|
||||
|
||||
# HTTPS 模板（.ssl.conf.example 后缀不会被 *.conf include，复制为 .ssl.conf 后生效）
|
||||
echo "==> 写入 HTTPS 配置模板: ${HOST_NGINX_CONF%.conf}.ssl.conf.example"
|
||||
cat > "${HOST_NGINX_CONF%.conf}.ssl.conf.example" <<'SSLEX'
|
||||
# 启用 HTTPS 三步:
|
||||
# 1. 证书安装到 /www/live-data/ssl/certs/{fullchain.pem,privkey.pem}
|
||||
# 2. cp live.fuhua91.com.ssl.conf.example live.fuhua91.com.ssl.conf
|
||||
# 3. nginx -t && systemctl reload nginx
|
||||
# 4. 在 live.fuhua91.com.conf 打开 return 301 注释后再 reload 一次
|
||||
|
||||
server {
|
||||
listen 443 ssl http2 default_server;
|
||||
server_name live.fuhua91.com;
|
||||
|
||||
ssl_certificate /www/live-data/ssl/certs/fullchain.pem;
|
||||
ssl_certificate_key /www/live-data/ssl/certs/privkey.pem;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
|
||||
client_max_body_size 512m;
|
||||
|
||||
# CORS 全放行（同 80 端口 server 块）
|
||||
add_header Access-Control-Allow-Origin $http_origin always;
|
||||
add_header Access-Control-Allow-Credentials true always;
|
||||
add_header Access-Control-Allow-Methods 'GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS' always;
|
||||
add_header Access-Control-Allow-Headers $http_access_control_request_headers always;
|
||||
add_header Vary Origin always;
|
||||
|
||||
proxy_hide_header Access-Control-Allow-Origin;
|
||||
proxy_hide_header Access-Control-Allow-Credentials;
|
||||
proxy_hide_header Access-Control-Allow-Methods;
|
||||
proxy_hide_header Access-Control-Allow-Headers;
|
||||
proxy_hide_header Access-Control-Expose-Headers;
|
||||
proxy_hide_header Access-Control-Max-Age;
|
||||
|
||||
if ($request_method = OPTIONS) {
|
||||
add_header Access-Control-Allow-Origin $http_origin always;
|
||||
add_header Access-Control-Allow-Credentials true always;
|
||||
add_header Access-Control-Allow-Methods 'GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS' always;
|
||||
add_header Access-Control-Allow-Headers $http_access_control_request_headers always;
|
||||
add_header Access-Control-Max-Age 86400 always;
|
||||
add_header Vary Origin always;
|
||||
return 204;
|
||||
}
|
||||
|
||||
# acme.sh http-01 验证（续期会经 301 走 https 验证，仍可用）
|
||||
location ^~ /.well-known/acme-challenge/ {
|
||||
root /www/live-data/ssl/webroot;
|
||||
}
|
||||
|
||||
location = /api {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $live_connection_upgrade;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_pass http://127.0.0.1:9502;
|
||||
}
|
||||
location ^~ /api/ {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $live_connection_upgrade;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 600s;
|
||||
proxy_send_timeout 600s;
|
||||
rewrite ^/api/(.*)$ /$1 break;
|
||||
proxy_pass http://127.0.0.1:9502;
|
||||
}
|
||||
|
||||
location = /admin {
|
||||
return 301 /admin/;
|
||||
}
|
||||
location ^~ /admin/ {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
rewrite ^/admin/(.*)$ /$1 break;
|
||||
proxy_pass http://127.0.0.1:9501;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_pass http://127.0.0.1:9503;
|
||||
}
|
||||
}
|
||||
SSLEX
|
||||
|
||||
# 域名统一替换（默认 live.yuzou99.com，可用 KRA_LIVE_HOST 覆盖）
|
||||
sed -i "s/live\.fuhua91\.com/${LIVE_HOST}/g" "$HOST_NGINX_CONF"
|
||||
sed -i "s/live\.fuhua91\.com/${LIVE_HOST}/g" "${HOST_NGINX_CONF%.conf}.ssl.conf.example"
|
||||
|
||||
# 自签证书（已存在则复用；浏览器提示不安全属正常，正式证书可后补）
|
||||
if [ ! -f "$SSL_CERT_DIR/fullchain.pem" ]; then
|
||||
echo "==> 生成自签证书: $LIVE_HOST（10 年有效期）"
|
||||
openssl req -x509 -nodes -newkey rsa:2048 -days 3650 \
|
||||
-keyout "$SSL_CERT_DIR/privkey.pem" -out "$SSL_CERT_DIR/fullchain.pem" \
|
||||
-subj "/CN=${LIVE_HOST}" \
|
||||
-addext "subjectAltName=DNS:${LIVE_HOST}" 2>/dev/null \
|
||||
|| openssl req -x509 -nodes -newkey rsa:2048 -days 3650 \
|
||||
-keyout "$SSL_CERT_DIR/privkey.pem" -out "$SSL_CERT_DIR/fullchain.pem" \
|
||||
-subj "/CN=${LIVE_HOST}"
|
||||
chmod 600 "$SSL_CERT_DIR/privkey.pem"
|
||||
fi
|
||||
|
||||
# 启用 443（自签证书）+ 80 强跳 https
|
||||
cp -f "${HOST_NGINX_CONF%.conf}.ssl.conf.example" "${HOST_NGINX_CONF%.conf}.ssl.conf"
|
||||
sed -i 's|^ #return 301 https://| return 301 https://|' "$HOST_NGINX_CONF"
|
||||
|
||||
# SELinux 开启时允许 nginx 反代网络端口（CentOS/Rocky 常见 502 原因）
|
||||
if command -v getenforce >/dev/null 2>&1 && [ "$(getenforce 2>/dev/null)" = "Enforcing" ]; then
|
||||
setsebool -P httpd_can_network_connect 1 2>/dev/null \
|
||||
|| echo "警告: setsebool 失败，nginx 反代容器端口可能 502"
|
||||
fi
|
||||
|
||||
if nginx -t 2>/dev/null; then
|
||||
systemctl enable nginx >/dev/null 2>&1 || true
|
||||
if systemctl is-active --quiet nginx; then
|
||||
systemctl reload nginx 2>/dev/null || nginx -s reload 2>/dev/null || true
|
||||
else
|
||||
systemctl start nginx 2>/dev/null || true
|
||||
fi
|
||||
echo "==> nginx 配置已生效（80/443 -> 9503 主站 / 9501 admin / 9502 api，https 为自签证书）"
|
||||
else
|
||||
echo "警告: nginx -t 校验未通过，请手动检查后重载:"
|
||||
nginx -t || true
|
||||
echo " nginx -t && systemctl reload nginx"
|
||||
fi
|
||||
}
|
||||
# ---------- 5. 生成后端配置 ----------
|
||||
write_backend_config() {
|
||||
mkdir -p "$CONFIG_DIR"
|
||||
if [ ! -f "$CONFIG_DIR/config.yaml" ]; then
|
||||
echo "==> 生成后端配置: $CONFIG_DIR/config.yaml"
|
||||
cat > "$CONFIG_DIR/config.yaml" <<'CONF'
|
||||
server:
|
||||
http:
|
||||
network: tcp
|
||||
addr: 0.0.0.0:8000
|
||||
timeout: 600s
|
||||
data:
|
||||
database:
|
||||
driver: mysql
|
||||
source: ""
|
||||
host: live-mysql
|
||||
port: "3306"
|
||||
user: root
|
||||
password: '__MYSQL_ROOT_PASSWORD__'
|
||||
name: yzyzlive
|
||||
config: charset=utf8mb4&parseTime=True&loc=Local
|
||||
path: ""
|
||||
alias_name: ""
|
||||
disable: false
|
||||
prefix: ""
|
||||
engine: InnoDB
|
||||
log_mode: info
|
||||
max_idle_conns: 10
|
||||
max_open_conns: 100
|
||||
conn_max_lifetime: 3600
|
||||
singular: false
|
||||
redis:
|
||||
network: tcp
|
||||
name: default
|
||||
addr: live-redis:6379
|
||||
password: '__REDIS_PASSWORD__'
|
||||
db: 0
|
||||
use_cluster: false
|
||||
cluster_addrs: []
|
||||
read_timeout: 0.200s
|
||||
write_timeout: 0.200s
|
||||
database_list: []
|
||||
redis_list: []
|
||||
mongo:
|
||||
coll: ""
|
||||
options: ""
|
||||
database: ""
|
||||
username: ""
|
||||
password: ""
|
||||
auth_source: ""
|
||||
min_pool_size: "0"
|
||||
max_pool_size: "100"
|
||||
socket_timeout_ms: "0"
|
||||
connect_timeout_ms: "0"
|
||||
is_zap: false
|
||||
hosts:
|
||||
- host: ""
|
||||
port: ""
|
||||
admin:
|
||||
router_prefix: ""
|
||||
jwt:
|
||||
signing_key: '__JWT_SIGNING_KEY__'
|
||||
expires_time: 604800s
|
||||
buffer_time: 86400s
|
||||
issuer: kra
|
||||
captcha:
|
||||
key_long: 6
|
||||
img_width: 240
|
||||
img_height: 80
|
||||
store_expiration: 180s
|
||||
local:
|
||||
store_path: uploads/file
|
||||
path_prefix: uploads/file
|
||||
media:
|
||||
session_ttl: 24
|
||||
max_file_size: "0"
|
||||
chunk_dir: uploads/chunks
|
||||
system:
|
||||
use_redis: false
|
||||
use_multipoint: false
|
||||
use_strict_auth: false
|
||||
disable_auto_migrate: false
|
||||
use_mongo: false
|
||||
addr: 8000
|
||||
iplimit_count: 0
|
||||
iplimit_time: 0
|
||||
zap:
|
||||
level: info
|
||||
prefix: '[kra] '
|
||||
format: json
|
||||
director: logs
|
||||
encode_level: LowercaseLevelEncoder
|
||||
stacktrace_key: stacktrace
|
||||
show_line: true
|
||||
log_in_console: true
|
||||
retention_day: 7
|
||||
access_req_body: true
|
||||
access_resp_data: true
|
||||
access_req_headers: true
|
||||
access_log_max_bytes: 1024
|
||||
file_only_modules:
|
||||
- http
|
||||
- sql
|
||||
cors:
|
||||
mode: allow-all
|
||||
whitelist: []
|
||||
app:
|
||||
node: ""
|
||||
app_id: kra
|
||||
env: production
|
||||
disk_list:
|
||||
- mount_point: /
|
||||
CONF
|
||||
sed -i "s|__MYSQL_ROOT_PASSWORD__|${MYSQL_ROOT_PASSWORD}|; s|__REDIS_PASSWORD__|${REDIS_PASSWORD}|; s|__JWT_SIGNING_KEY__|$(gen_pass)|" \
|
||||
"$CONFIG_DIR/config.yaml"
|
||||
else
|
||||
echo "==> 后端配置已存在，跳过生成: $CONFIG_DIR/config.yaml"
|
||||
fi
|
||||
# 容器内进程以 uid 1000 (kra) 运行：
|
||||
# - 配置文件必须对其可读，否则 panic: permission denied
|
||||
# - 配置目录必须对其可写，否则首装向导无法把生成的 JWT signing_key 写回文件
|
||||
chown -R 1000:1000 "$CONFIG_DIR"
|
||||
chmod 600 "$CONFIG_DIR/config.yaml"
|
||||
}
|
||||
|
||||
# ---------- 6. 放行防火墙端口（尽力而为） ----------
|
||||
open_firewall() {
|
||||
local ports=("13306/tcp" "80/tcp" "443/tcp" "9504/udp")
|
||||
echo "==> 尝试放行防火墙端口 ${ports[*]}（云安全组需自行放行）"
|
||||
local p
|
||||
for p in "${ports[@]}"; do
|
||||
if command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then
|
||||
firewall-cmd --permanent --add-port="${p}" >/dev/null 2>&1 || true
|
||||
firewall-cmd --reload >/dev/null 2>&1 || true
|
||||
fi
|
||||
if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active"; then
|
||||
ufw allow "${p}" >/dev/null 2>&1 || true
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
# ---------- 主流程 ----------
|
||||
install_docker
|
||||
save_credentials
|
||||
run_mysql
|
||||
run_redis
|
||||
write_backend_config
|
||||
write_host_nginx_conf
|
||||
open_firewall
|
||||
|
||||
echo ""
|
||||
echo "============================================================"
|
||||
echo " 基础环境初始化完成"
|
||||
echo "============================================================"
|
||||
echo " MySQL: live-mysql 容器, 外部端口 $MYSQL_EXTERNAL_PORT, 数据目录 $DATA_DIR/mysql"
|
||||
echo " Redis: live-redis 容器, 仅容器网络 + 127.0.0.1:$REDIS_LOCAL_PORT"
|
||||
echo " nginx: 宿主机 nginx 站点配置 -> 主站(9503)/admin(9501)/api(9502)"
|
||||
echo " HTTPS: 已用自签证书启用（$LIVE_HOST），浏览器提示不安全属正常"
|
||||
echo " 后端配置: $CONFIG_DIR/config.yaml"
|
||||
echo " 凭据文件: $CRED_FILE （MySQL root / Redis 密码都在里面）"
|
||||
echo ""
|
||||
echo " 云服务器安全组请放行: $MYSQL_EXTERNAL_PORT/tcp, 80/tcp, 443/tcp, 9504/udp(WebRTC)"
|
||||
echo " 请确认 DNS: $LIVE_HOST 已解析到本机公网 IP"
|
||||
echo ""
|
||||
echo " 换正式证书（可选，替换自签证书，同路径自动 reload）:"
|
||||
echo " curl https://get.acme.sh | sh -s email=you@example.com"
|
||||
echo " ~/.acme.sh/acme.sh --issue -d $LIVE_HOST -w $SSL_WEBROOT --server letsencrypt"
|
||||
echo " ~/.acme.sh/acme.sh --install-cert -d $LIVE_HOST \\"
|
||||
echo " --fullchain-file $SSL_CERT_DIR/fullchain.pem \\"
|
||||
echo " --key-file $SSL_CERT_DIR/privkey.pem \\"
|
||||
echo " --reloadcmd 'nginx -s reload'"
|
||||
echo ""
|
||||
if [ -n "$TAG" ]; then
|
||||
echo "==> 继续部署应用版本: $TAG"
|
||||
DEPLOY_SH="$(cd "$(dirname "$0")" && pwd)/deploy.sh"
|
||||
[ -f "$DEPLOY_SH" ] || DEPLOY_SH="/root/deploy.sh"
|
||||
if [ -f "$DEPLOY_SH" ]; then
|
||||
bash "$DEPLOY_SH" "$TAG"
|
||||
else
|
||||
echo "错误: 找不到 deploy.sh（与 server-init.sh 同目录或 /root/deploy.sh），请手动执行部署"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo " 下一步: 上传 deploy.sh 到服务器后执行（Harbor 需先登录）:"
|
||||
echo " docker login harbor.fuhua91.com -u 'robot\$live+live'"
|
||||
echo " bash /root/deploy.sh <tag>"
|
||||
fi
|
||||
@@ -39,15 +39,23 @@ func (a *wechatV3Adapter) Create(ctx context.Context, req *bizpayment.PaymentReq
|
||||
bm.SetBodyMap("amount", func(amount gopay.BodyMap) {
|
||||
amount.Set("total", req.Amount).Set("currency", strings.ToUpper(req.Currency))
|
||||
})
|
||||
mergeGoPayExtras(bm, req.Extra,
|
||||
"appid", "mchid", "description", "out_trade_no", "notify_url", "amount", "payer",
|
||||
"trade_type", "pay_type", "method", "openid", "open_id", "auth_code", "authcode", "barcode",
|
||||
)
|
||||
|
||||
tradeType := normalizeWechatV3TradeType(firstAny(req.Extra, "trade_type", "pay_type", "method"))
|
||||
if tradeType == "" {
|
||||
tradeType = normalizeWechatV3TradeType(firstAny(c, "trade_type", "pay_type", "method"))
|
||||
}
|
||||
if tradeType == "native" || tradeType == "qr" || tradeType == "qrcode" {
|
||||
// Native orders only accept the fields defined by the WeChat transaction API.
|
||||
for _, key := range []string{"time_expire", "attach", "goods_tag", "support_fapiao", "detail", "scene_info", "settle_info"} {
|
||||
if value, ok := req.Extra[key]; ok {
|
||||
bm[key] = value
|
||||
}
|
||||
}
|
||||
} else {
|
||||
mergeGoPayExtras(bm, req.Extra,
|
||||
"appid", "mchid", "description", "out_trade_no", "notify_url", "amount", "payer",
|
||||
"trade_type", "pay_type", "method", "openid", "open_id", "auth_code", "authcode", "barcode",
|
||||
)
|
||||
}
|
||||
switch tradeType {
|
||||
case "", "jsapi", "js_api", "mini", "miniapp", "mini_app", "miniprogram", "mini_program", "applet":
|
||||
if openID := firstAny(req.Extra, "openid", "open_id"); openID != "" {
|
||||
|
||||
@@ -0,0 +1,87 @@
|
||||
package payment
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"io"
|
||||
bizpayment "kra/internal/biz/payment"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"reflect"
|
||||
"testing"
|
||||
|
||||
gopayWechatV3 "github.com/go-pay/gopay/wechat/v3"
|
||||
)
|
||||
|
||||
func TestWechatV3NativeOnlySendsDocumentedFields(t *testing.T) {
|
||||
platformKey, _, platformPublicPEM := testRSAKeyPair(t)
|
||||
_, merchantPrivatePEM, _ := testRSAKeyPair(t)
|
||||
const (
|
||||
platformSerial = "PLATFORM-SERIAL"
|
||||
timestamp = "1787068800"
|
||||
nonce = "native-response-nonce"
|
||||
)
|
||||
response := []byte(`{"code_url":"weixin://wxpay/bizpayurl?pr=test"}`)
|
||||
signature := testRSA2Sign(t, platformKey, []byte(timestamp+"\n"+nonce+"\n"+string(response)+"\n"))
|
||||
|
||||
var requestBody map[string]any
|
||||
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Method != http.MethodPost || r.URL.Path != "/v3/pay/transactions/native" {
|
||||
t.Errorf("request = %s %s", r.Method, r.URL.Path)
|
||||
}
|
||||
body, err := io.ReadAll(r.Body)
|
||||
if err != nil {
|
||||
t.Errorf("read request: %v", err)
|
||||
return
|
||||
}
|
||||
if err = json.Unmarshal(body, &requestBody); err != nil {
|
||||
t.Errorf("decode request: %v", err)
|
||||
return
|
||||
}
|
||||
w.Header().Set(gopayWechatV3.HeaderTimestamp, timestamp)
|
||||
w.Header().Set(gopayWechatV3.HeaderNonce, nonce)
|
||||
w.Header().Set(gopayWechatV3.HeaderSerial, platformSerial)
|
||||
w.Header().Set(gopayWechatV3.HeaderSignature, signature)
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_, _ = w.Write(response)
|
||||
}))
|
||||
defer server.Close()
|
||||
|
||||
result, err := (&wechatV3Adapter{}).Create(context.Background(), &bizpayment.PaymentRequest{
|
||||
Provider: bizpayment.PaymentWechatV3,
|
||||
TradeNo: "T-WECHAT-NATIVE",
|
||||
Subject: "subject",
|
||||
Amount: 123,
|
||||
Currency: "CNY",
|
||||
NotifyURL: "https://merchant.test/payment/callback",
|
||||
Extra: map[string]any{
|
||||
"method": "qrcode", "pay_method": "native", "product_id": "item-1",
|
||||
"payer": map[string]any{"openid": "not-for-native"},
|
||||
"attach": "order-meta", "scene_info": map[string]any{"payer_client_ip": "127.0.0.1"},
|
||||
},
|
||||
}, map[string]any{
|
||||
"app_id": "wx-test",
|
||||
"merchant_id": "mch-test",
|
||||
"serial_no": "merchant-serial",
|
||||
"private_key": merchantPrivatePEM,
|
||||
"api_v3_key": "01234567890123456789012345678901",
|
||||
"platform_cert": platformPublicPEM,
|
||||
"platform_serial_no": platformSerial,
|
||||
"create_url": server.URL,
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
want := map[string]any{
|
||||
"appid": "wx-test", "mchid": "mch-test", "description": "subject",
|
||||
"out_trade_no": "T-WECHAT-NATIVE", "notify_url": "https://merchant.test/payment/callback",
|
||||
"amount": map[string]any{"total": float64(123), "currency": "CNY"},
|
||||
"attach": "order-meta", "scene_info": map[string]any{"payer_client_ip": "127.0.0.1"},
|
||||
}
|
||||
if !reflect.DeepEqual(requestBody, want) {
|
||||
t.Fatalf("native request = %#v, want %#v", requestBody, want)
|
||||
}
|
||||
if result.Status != "created" || result.TradeNo != "T-WECHAT-NATIVE" || string(result.Payload) != string(response) {
|
||||
t.Fatalf("native result = %+v", result)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user