初始化1
This commit is contained in:
519
DEPLOYMENT.md
Normal file
519
DEPLOYMENT.md
Normal file
@@ -0,0 +1,519 @@
|
||||
# Nginx域名转发管理平台 - 部署文档
|
||||
|
||||
日期: 2026-06-09 | 服务器: Rocky Linux 8.10 (10.1.1.160)
|
||||
|
||||
---
|
||||
|
||||
## 一、服务器环境信息
|
||||
|
||||
### 1.1 10.1.1.160 - Nginx 专用服务器
|
||||
|
||||
| 项目 | 详情 |
|
||||
|------|------|
|
||||
| 操作系统 | Rocky Linux 8.10 (Green Obsidian) |
|
||||
| 内核版本 | 4.18.0-553.el8_10.x86_64 |
|
||||
| 主机名 | linuxNginx |
|
||||
| SSH | root@10.1.1.160:22 |
|
||||
| Nginx | 1.14.1 |
|
||||
| Python | 3.6.8 |
|
||||
| OpenSSL | 1.1.1k FIPS |
|
||||
|
||||
### 1.2 监听端口
|
||||
|
||||
| 端口 | 服务 | 用途 |
|
||||
|------|------|------|
|
||||
| 22 | sshd | SSH远程管理 |
|
||||
| 80 | nginx | HTTP转发入口 |
|
||||
| 443 | nginx | HTTPS转发入口（按需） |
|
||||
| 5000 | gunicorn | Nginx管理API |
|
||||
|
||||
### 1.3 外部依赖
|
||||
|
||||
| 服务 | 地址 | 用途 |
|
||||
|------|------|------|
|
||||
| MySQL | 10.1.1.122:3306 | 数据库 (nginxserver库) |
|
||||
|
||||
---
|
||||
|
||||
## 二、10.1.1.160 上执行的全部命令
|
||||
|
||||
### 2.1 安装系统依赖
|
||||
|
||||
```bash
|
||||
# 安装 Nginx + Python3 + OpenSSL
|
||||
dnf install -y nginx python3 python3-pip openssl
|
||||
|
||||
# 安装 Python 依赖包
|
||||
pip3 install flask gunicorn
|
||||
```
|
||||
|
||||
### 2.2 创建目录结构
|
||||
|
||||
```bash
|
||||
# 项目代码目录
|
||||
mkdir -p /opt/nginx-api/services
|
||||
|
||||
# Nginx 配置与证书目录
|
||||
mkdir -p /etc/nginx/conf.d
|
||||
mkdir -p /etc/nginx/ssl/ca
|
||||
```
|
||||
|
||||
### 2.3 部署代码文件
|
||||
|
||||
将本地 nginx-python-api/ 目录下文件上传到 /opt/nginx-api/：
|
||||
|
||||
| 本地文件 | 服务器路径 | 权限 |
|
||||
|----------|-----------|------|
|
||||
| app.py | /opt/nginx-api/app.py | 755 |
|
||||
| services/__init__.py | /opt/nginx-api/services/__init__.py | 644 |
|
||||
| services/nginx_service.py | /opt/nginx-api/services/nginx_service.py | 644 |
|
||||
| services/ssl_service.py | /opt/nginx-api/services/ssl_service.py | 644 |
|
||||
| requirements.txt | /opt/nginx-api/requirements.txt | 644 |
|
||||
| gunicorn_config.py | /opt/nginx-api/gunicorn_config.py | 755 |
|
||||
| deploy.sh | /opt/nginx-api/deploy.sh | 755 |
|
||||
|
||||
上传方式（使用 Python paramiko SFTP 或 scp）:
|
||||
|
||||
```bash
|
||||
# 方式一: scp
|
||||
scp -r nginx-python-api/* root@10.1.1.160:/opt/nginx-api/
|
||||
|
||||
# 方式二: Python paramiko SFTP
|
||||
# 见项目根目录下 upload_api.py（已执行）
|
||||
```
|
||||
|
||||
### 2.4 创建 systemd 服务文件
|
||||
|
||||
文件路径: /etc/systemd/system/nginx-api.service
|
||||
|
||||
```ini
|
||||
[Unit]
|
||||
Description=Nginx Manager Python API
|
||||
After=network.target nginx.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=root
|
||||
WorkingDirectory=/opt/nginx-api
|
||||
ExecStart=/usr/bin/python3 -m gunicorn -c gunicorn_config.py app:app
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
创建命令:
|
||||
|
||||
```bash
|
||||
cat > /etc/systemd/system/nginx-api.service << 'EOF'
|
||||
[Unit]
|
||||
Description=Nginx Manager Python API
|
||||
After=network.target nginx.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=root
|
||||
WorkingDirectory=/opt/nginx-api
|
||||
ExecStart=/usr/bin/python3 -m gunicorn -c gunicorn_config.py app:app
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
```
|
||||
|
||||
### 2.5 Gunicorn 配置文件
|
||||
|
||||
文件路径: /opt/nginx-api/gunicorn_config.py
|
||||
|
||||
```python
|
||||
import os
|
||||
|
||||
# 监听地址和端口
|
||||
bind = "0.0.0.0:5000"
|
||||
|
||||
# Worker 进程数
|
||||
workers = int(os.environ.get('GUNICORN_WORKERS', 2))
|
||||
|
||||
# Worker 类型
|
||||
worker_class = "sync"
|
||||
|
||||
# 超时设置
|
||||
timeout = 60
|
||||
graceful_timeout = 10
|
||||
|
||||
# 日志
|
||||
accesslog = "-" # 标准输出
|
||||
errorlog = "-" # 标准错误
|
||||
loglevel = "info"
|
||||
|
||||
# 进程名称
|
||||
proc_name = "nginx-manager-api"
|
||||
|
||||
# 前台运行（由 systemd 管理）
|
||||
daemon = False
|
||||
```
|
||||
|
||||
### 2.6 防火墙配置
|
||||
|
||||
```bash
|
||||
# 开放端口和服务
|
||||
firewall-cmd --permanent --add-port=5000/tcp
|
||||
firewall-cmd --permanent --add-service=http
|
||||
firewall-cmd --permanent --add-service=https
|
||||
firewall-cmd --reload
|
||||
|
||||
# 查看防火墙规则
|
||||
firewall-cmd --list-all
|
||||
```
|
||||
|
||||
当前防火墙状态:
|
||||
|
||||
```
|
||||
public (active)
|
||||
target: default
|
||||
interfaces: ens160
|
||||
services: cockpit dhcpv6-client http https ssh
|
||||
ports: 5000/tcp
|
||||
```
|
||||
|
||||
### 2.7 启动服务并设置开机自启
|
||||
|
||||
```bash
|
||||
# 启动 Nginx
|
||||
systemctl start nginx
|
||||
systemctl enable nginx
|
||||
|
||||
# 重载 systemd 配置
|
||||
systemctl daemon-reload
|
||||
|
||||
# 启动 Python API
|
||||
systemctl start nginx-api
|
||||
systemctl enable nginx-api
|
||||
|
||||
# 验证服务状态
|
||||
systemctl status nginx
|
||||
systemctl status nginx-api
|
||||
```
|
||||
|
||||
### 2.8 验证部署
|
||||
|
||||
```bash
|
||||
# Python API 健康检查
|
||||
curl http://127.0.0.1:5000/api/nginx/health
|
||||
|
||||
# 预期返回:
|
||||
# {"code":0,"data":{"conf_dir":"/etc/nginx/conf.d","nginx_installed":true,"ssl_dir":"/etc/nginx/ssl"},"message":"Nginx Manager API is running"}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 三、开机自启状态确认
|
||||
|
||||
| 服务 | systemd unit | 状态 |
|
||||
|------|-------------|------|
|
||||
| Nginx | nginx.service | enabled |
|
||||
| Python API | nginx-api.service | enabled |
|
||||
| SSHD | sshd.service | enabled |
|
||||
| Firewalld | firewalld.service | enabled |
|
||||
|
||||
查看命令:
|
||||
|
||||
```bash
|
||||
systemctl list-unit-files --state=enabled | grep -E "nginx|sshd|firewalld"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 四、服务器目录结构
|
||||
|
||||
```
|
||||
/etc/nginx/
|
||||
├── nginx.conf # Nginx 主配置文件（系统默认）
|
||||
├── conf.d/ # 转发规则配置目录
|
||||
│ └── <domain>.conf # 各域名的转发配置（由API自动生成）
|
||||
├── ssl/ # SSL证书目录
|
||||
│ ├── ca/ # 内部根CA
|
||||
│ │ ├── ca.crt # CA证书（有效期10年）
|
||||
│ │ ├── ca.key # CA私钥（权限600）
|
||||
│ │ └── ca.srl # 序列号文件
|
||||
│ ├── <domain>.pem # 域名SSL证书
|
||||
│ └── <domain>.key # 域名SSL私钥
|
||||
|
||||
/opt/nginx-api/ # Python API项目目录
|
||||
├── app.py # Flask主入口（7个API端点）
|
||||
├── gunicorn_config.py # WSGI配置
|
||||
├── requirements.txt # Python依赖
|
||||
├── deploy.sh # 一键部署脚本
|
||||
└── services/
|
||||
├── __init__.py
|
||||
├── nginx_service.py # Nginx配置读写 + reload
|
||||
└── ssl_service.py # 内部CA + 证书签发
|
||||
|
||||
/etc/systemd/system/
|
||||
└── nginx-api.service # Python API 服务定义
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 五、Python API 端点
|
||||
|
||||
| 方法 | 路径 | 说明 |
|
||||
|------|------|------|
|
||||
| GET | /api/nginx/health | 健康检查 |
|
||||
| GET | /api/nginx/rules | 获取所有规则 |
|
||||
| GET | /api/nginx/rules/<domain> | 获取单个规则 |
|
||||
| POST | /api/nginx/rules | 新增规则 |
|
||||
| PUT | /api/nginx/rules/<domain> | 修改规则 |
|
||||
| DELETE | /api/nginx/rules/<domain> | 删除规则 |
|
||||
| POST | /api/nginx/reload | 重载Nginx |
|
||||
|
||||
### 新增规则请求示例
|
||||
|
||||
```json
|
||||
POST /api/nginx/rules
|
||||
Content-Type: application/json
|
||||
|
||||
{
|
||||
"domain": "test.mokee.com",
|
||||
"protocol": "https",
|
||||
"target": "http://10.1.1.11:8080"
|
||||
}
|
||||
```
|
||||
|
||||
### 成功响应
|
||||
|
||||
```json
|
||||
{
|
||||
"code": 0,
|
||||
"message": "规则创建成功",
|
||||
"data": {
|
||||
"domain": "test.mokee.com",
|
||||
"protocol": "https",
|
||||
"target": "http://10.1.1.11:8080",
|
||||
"config_file": "/etc/nginx/conf.d/test.mokee.com.conf",
|
||||
"ssl_cert": "/etc/nginx/ssl/test.mokee.com.pem",
|
||||
"ssl_key": "/etc/nginx/ssl/test.mokee.com.key"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 六、Nginx 配置模板（由 API 自动生成）
|
||||
|
||||
### HTTP 转发
|
||||
|
||||
```nginx
|
||||
# /etc/nginx/conf.d/<domain>.conf
|
||||
server {
|
||||
listen 80;
|
||||
server_name <domain>;
|
||||
|
||||
location / {
|
||||
proxy_pass <target>;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_read_timeout 60s;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### HTTPS 转发
|
||||
|
||||
```nginx
|
||||
# /etc/nginx/conf.d/<domain>.conf
|
||||
server {
|
||||
listen 80;
|
||||
server_name <domain>;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name <domain>;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/<domain>.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/<domain>.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
location / {
|
||||
proxy_pass <target>;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_read_timeout 60s;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 七、MySQL 数据库初始化
|
||||
|
||||
连接信息:
|
||||
|
||||
| 项目 | 值 |
|
||||
|------|-----|
|
||||
| 地址 | 10.1.1.122:3306 |
|
||||
| 数据库 | nginxserver |
|
||||
| 用户 | nginxserver |
|
||||
|
||||
初始化脚本:
|
||||
|
||||
```bash
|
||||
mysql -h 10.1.1.122 -u root -p < sql/init.sql
|
||||
```
|
||||
|
||||
表结构:
|
||||
|
||||
```sql
|
||||
-- forwarding_rules 表
|
||||
CREATE TABLE forwarding_rules (
|
||||
id BIGINT AUTO_INCREMENT PRIMARY KEY COMMENT '主键ID',
|
||||
domain VARCHAR(255) NOT NULL COMMENT '域名',
|
||||
protocol VARCHAR(10) NOT NULL COMMENT '协议类型: http / https',
|
||||
target VARCHAR(500) NOT NULL COMMENT '转发目标地址',
|
||||
config_file VARCHAR(500) COMMENT 'Nginx配置文件路径',
|
||||
ssl_cert VARCHAR(500) COMMENT 'SSL证书文件路径',
|
||||
ssl_key VARCHAR(500) COMMENT 'SSL私钥文件路径',
|
||||
status TINYINT DEFAULT 1 COMMENT '状态: 0-已删除, 1-正常',
|
||||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP COMMENT '创建时间',
|
||||
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP COMMENT '更新时间',
|
||||
UNIQUE KEY uk_domain (domain),
|
||||
INDEX idx_status (status)
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='Nginx转发规则表';
|
||||
|
||||
-- certificates 表
|
||||
CREATE TABLE certificates (
|
||||
id BIGINT AUTO_INCREMENT PRIMARY KEY COMMENT '主键ID',
|
||||
domain VARCHAR(255) NOT NULL COMMENT '域名',
|
||||
cert_path VARCHAR(500) COMMENT '证书文件路径',
|
||||
key_path VARCHAR(500) COMMENT '私钥文件路径',
|
||||
issue_date DATETIME COMMENT '签发日期',
|
||||
expire_date DATETIME COMMENT '过期日期',
|
||||
status VARCHAR(20) DEFAULT 'active' COMMENT '状态',
|
||||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP COMMENT '创建时间',
|
||||
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP COMMENT '更新时间',
|
||||
UNIQUE KEY uk_cert_domain (domain)
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='SSL证书管理表';
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 八、HTTPS 证书方案
|
||||
|
||||
### 8.1 内部 CA
|
||||
|
||||
- 首次启动 Python API 时自动生成（如不存在）
|
||||
- CA 证书 /etc/nginx/ssl/ca/ca.crt，有效期 10 年
|
||||
- CA 私钥 /etc/nginx/ssl/ca/ca.key，权限 600
|
||||
- 不占用 80/443/5000 端口
|
||||
|
||||
### 8.2 域名证书自动签发
|
||||
|
||||
- 选择 HTTPS 协议时自动签发
|
||||
- 证书有效期 365 天
|
||||
- 已存在且有效的证书直接复用
|
||||
- 过期证书自动重新签发
|
||||
|
||||
### 8.3 客户端信任
|
||||
|
||||
内网用户需将 CA 证书导入浏览器:
|
||||
|
||||
```bash
|
||||
# 下载 CA 证书
|
||||
scp root@10.1.1.160:/etc/nginx/ssl/ca/ca.crt .
|
||||
# 然后在浏览器中导入为受信任的根证书颁发机构
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 九、常见运维命令
|
||||
|
||||
```bash
|
||||
# === Nginx 管理 ===
|
||||
nginx -t # 检查配置语法
|
||||
nginx -s reload # 重载配置（不中断服务）
|
||||
systemctl restart nginx # 重启 Nginx
|
||||
systemctl status nginx # 查看状态
|
||||
tail -f /var/log/nginx/access.log # 查看访问日志
|
||||
tail -f /var/log/nginx/error.log # 查看错误日志
|
||||
|
||||
# === Python API 管理 ===
|
||||
systemctl status nginx-api # 查看服务状态
|
||||
systemctl restart nginx-api # 重启 API
|
||||
journalctl -u nginx-api -f # 实时查看日志
|
||||
journalctl -u nginx-api -n 50 # 最近50行日志
|
||||
|
||||
# === API 测试 ===
|
||||
curl http://127.0.0.1:5000/api/nginx/health # 健康检查
|
||||
curl http://127.0.0.1:5000/api/nginx/rules # 查看规则列表
|
||||
|
||||
# === 防火墙管理 ===
|
||||
firewall-cmd --list-all # 查看防火墙规则
|
||||
firewall-cmd --add-port=5000/tcp # 临时开放端口
|
||||
firewall-cmd --runtime-to-permanent # 保存临时规则为永久
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 十、Spring Boot 配置
|
||||
|
||||
配置文件: nginx-manager-backend/src/main/resources/application.yml
|
||||
|
||||
```yaml
|
||||
server:
|
||||
port: 4002
|
||||
|
||||
spring:
|
||||
datasource:
|
||||
url: jdbc:mysql://10.1.1.122:3306/nginxserver?useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
|
||||
username: nginxserver
|
||||
password: mokee.
|
||||
driver-class-name: com.mysql.cj.jdbc.Driver
|
||||
jpa:
|
||||
hibernate:
|
||||
ddl-auto: update
|
||||
|
||||
python-api:
|
||||
base-url: http://10.1.1.160:5000
|
||||
connect-timeout: 5000
|
||||
read-timeout: 30000
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 十一、Vue.js 前端配置
|
||||
|
||||
### 开发环境 (.env.development)
|
||||
|
||||
```
|
||||
VITE_API_BASE_URL=http://localhost:4002
|
||||
VITE_APP_TITLE=Nginx转发管理平台
|
||||
```
|
||||
|
||||
### 生产环境 (.env.production)
|
||||
|
||||
```
|
||||
VITE_API_BASE_URL=http://<生产服务器IP>:4002
|
||||
VITE_APP_TITLE=Nginx转发管理平台
|
||||
```
|
||||
|
||||
### 启动
|
||||
|
||||
```bash
|
||||
npm run dev # 开发模式（端口3002）
|
||||
npm run build # 生产构建
|
||||
```
|
||||
Reference in New Issue
Block a user