520 lines
13 KiB
Markdown
520 lines
13 KiB
Markdown
# Nginx域名转发管理平台 - 部署文档
|
||
|
||
日期: 2026-06-09 | 服务器: Rocky Linux 8.10 (10.1.1.160)
|
||
|
||
---
|
||
|
||
## 一、服务器环境信息
|
||
|
||
### 1.1 10.1.1.160 - Nginx 专用服务器
|
||
|
||
| 项目 | 详情 |
|
||
|------|------|
|
||
| 操作系统 | Rocky Linux 8.10 (Green Obsidian) |
|
||
| 内核版本 | 4.18.0-553.el8_10.x86_64 |
|
||
| 主机名 | linuxNginx |
|
||
| SSH | root@10.1.1.160:22 |
|
||
| Nginx | 1.14.1 |
|
||
| Python | 3.6.8 |
|
||
| OpenSSL | 1.1.1k FIPS |
|
||
|
||
### 1.2 监听端口
|
||
|
||
| 端口 | 服务 | 用途 |
|
||
|------|------|------|
|
||
| 22 | sshd | SSH远程管理 |
|
||
| 80 | nginx | HTTP转发入口 |
|
||
| 443 | nginx | HTTPS转发入口（按需） |
|
||
| 5000 | gunicorn | Nginx管理API |
|
||
|
||
### 1.3 外部依赖
|
||
|
||
| 服务 | 地址 | 用途 |
|
||
|------|------|------|
|
||
| MySQL | 10.1.1.122:3306 | 数据库 (nginxserver库) |
|
||
|
||
---
|
||
|
||
## 二、10.1.1.160 上执行的全部命令
|
||
|
||
### 2.1 安装系统依赖
|
||
|
||
```bash
|
||
# 安装 Nginx + Python3 + OpenSSL
|
||
dnf install -y nginx python3 python3-pip openssl
|
||
|
||
# 安装 Python 依赖包
|
||
pip3 install flask gunicorn
|
||
```
|
||
|
||
### 2.2 创建目录结构
|
||
|
||
```bash
|
||
# 项目代码目录
|
||
mkdir -p /opt/nginx-api/services
|
||
|
||
# Nginx 配置与证书目录
|
||
mkdir -p /etc/nginx/conf.d
|
||
mkdir -p /etc/nginx/ssl/ca
|
||
```
|
||
|
||
### 2.3 部署代码文件
|
||
|
||
将本地 nginx-python-api/ 目录下文件上传到 /opt/nginx-api/：
|
||
|
||
| 本地文件 | 服务器路径 | 权限 |
|
||
|----------|-----------|------|
|
||
| app.py | /opt/nginx-api/app.py | 755 |
|
||
| services/__init__.py | /opt/nginx-api/services/__init__.py | 644 |
|
||
| services/nginx_service.py | /opt/nginx-api/services/nginx_service.py | 644 |
|
||
| services/ssl_service.py | /opt/nginx-api/services/ssl_service.py | 644 |
|
||
| requirements.txt | /opt/nginx-api/requirements.txt | 644 |
|
||
| gunicorn_config.py | /opt/nginx-api/gunicorn_config.py | 755 |
|
||
| deploy.sh | /opt/nginx-api/deploy.sh | 755 |
|
||
|
||
上传方式（使用 Python paramiko SFTP 或 scp）:
|
||
|
||
```bash
|
||
# 方式一: scp
|
||
scp -r nginx-python-api/* root@10.1.1.160:/opt/nginx-api/
|
||
|
||
# 方式二: Python paramiko SFTP
|
||
# 见项目根目录下 upload_api.py（已执行）
|
||
```
|
||
|
||
### 2.4 创建 systemd 服务文件
|
||
|
||
文件路径: /etc/systemd/system/nginx-api.service
|
||
|
||
```ini
|
||
[Unit]
|
||
Description=Nginx Manager Python API
|
||
After=network.target nginx.service
|
||
|
||
[Service]
|
||
Type=simple
|
||
User=root
|
||
WorkingDirectory=/opt/nginx-api
|
||
ExecStart=/usr/bin/python3 -m gunicorn -c gunicorn_config.py app:app
|
||
Restart=always
|
||
RestartSec=5
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
```
|
||
|
||
创建命令:
|
||
|
||
```bash
|
||
cat > /etc/systemd/system/nginx-api.service << 'EOF'
|
||
[Unit]
|
||
Description=Nginx Manager Python API
|
||
After=network.target nginx.service
|
||
|
||
[Service]
|
||
Type=simple
|
||
User=root
|
||
WorkingDirectory=/opt/nginx-api
|
||
ExecStart=/usr/bin/python3 -m gunicorn -c gunicorn_config.py app:app
|
||
Restart=always
|
||
RestartSec=5
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
EOF
|
||
```
|
||
|
||
### 2.5 Gunicorn 配置文件
|
||
|
||
文件路径: /opt/nginx-api/gunicorn_config.py
|
||
|
||
```python
|
||
import os
|
||
|
||
# 监听地址和端口
|
||
bind = "0.0.0.0:5000"
|
||
|
||
# Worker 进程数
|
||
workers = int(os.environ.get('GUNICORN_WORKERS', 2))
|
||
|
||
# Worker 类型
|
||
worker_class = "sync"
|
||
|
||
# 超时设置
|
||
timeout = 60
|
||
graceful_timeout = 10
|
||
|
||
# 日志
|
||
accesslog = "-" # 标准输出
|
||
errorlog = "-" # 标准错误
|
||
loglevel = "info"
|
||
|
||
# 进程名称
|
||
proc_name = "nginx-manager-api"
|
||
|
||
# 前台运行（由 systemd 管理）
|
||
daemon = False
|
||
```
|
||
|
||
### 2.6 防火墙配置
|
||
|
||
```bash
|
||
# 开放端口和服务
|
||
firewall-cmd --permanent --add-port=5000/tcp
|
||
firewall-cmd --permanent --add-service=http
|
||
firewall-cmd --permanent --add-service=https
|
||
firewall-cmd --reload
|
||
|
||
# 查看防火墙规则
|
||
firewall-cmd --list-all
|
||
```
|
||
|
||
当前防火墙状态:
|
||
|
||
```
|
||
public (active)
|
||
target: default
|
||
interfaces: ens160
|
||
services: cockpit dhcpv6-client http https ssh
|
||
ports: 5000/tcp
|
||
```
|
||
|
||
### 2.7 启动服务并设置开机自启
|
||
|
||
```bash
|
||
# 启动 Nginx
|
||
systemctl start nginx
|
||
systemctl enable nginx
|
||
|
||
# 重载 systemd 配置
|
||
systemctl daemon-reload
|
||
|
||
# 启动 Python API
|
||
systemctl start nginx-api
|
||
systemctl enable nginx-api
|
||
|
||
# 验证服务状态
|
||
systemctl status nginx
|
||
systemctl status nginx-api
|
||
```
|
||
|
||
### 2.8 验证部署
|
||
|
||
```bash
|
||
# Python API 健康检查
|
||
curl http://127.0.0.1:5000/api/nginx/health
|
||
|
||
# 预期返回:
|
||
# {"code":0,"data":{"conf_dir":"/etc/nginx/conf.d","nginx_installed":true,"ssl_dir":"/etc/nginx/ssl"},"message":"Nginx Manager API is running"}
|
||
```
|
||
|
||
---
|
||
|
||
## 三、开机自启状态确认
|
||
|
||
| 服务 | systemd unit | 状态 |
|
||
|------|-------------|------|
|
||
| Nginx | nginx.service | enabled |
|
||
| Python API | nginx-api.service | enabled |
|
||
| SSHD | sshd.service | enabled |
|
||
| Firewalld | firewalld.service | enabled |
|
||
|
||
查看命令:
|
||
|
||
```bash
|
||
systemctl list-unit-files --state=enabled | grep -E "nginx|sshd|firewalld"
|
||
```
|
||
|
||
---
|
||
|
||
## 四、服务器目录结构
|
||
|
||
```
|
||
/etc/nginx/
|
||
├── nginx.conf # Nginx 主配置文件（系统默认）
|
||
├── conf.d/ # 转发规则配置目录
|
||
│ └── <domain>.conf # 各域名的转发配置（由API自动生成）
|
||
├── ssl/ # SSL证书目录
|
||
│ ├── ca/ # 内部根CA
|
||
│ │ ├── ca.crt # CA证书（有效期10年）
|
||
│ │ ├── ca.key # CA私钥（权限600）
|
||
│ │ └── ca.srl # 序列号文件
|
||
│ ├── <domain>.pem # 域名SSL证书
|
||
│ └── <domain>.key # 域名SSL私钥
|
||
|
||
/opt/nginx-api/ # Python API项目目录
|
||
├── app.py # Flask主入口（7个API端点）
|
||
├── gunicorn_config.py # WSGI配置
|
||
├── requirements.txt # Python依赖
|
||
├── deploy.sh # 一键部署脚本
|
||
└── services/
|
||
├── __init__.py
|
||
├── nginx_service.py # Nginx配置读写 + reload
|
||
└── ssl_service.py # 内部CA + 证书签发
|
||
|
||
/etc/systemd/system/
|
||
└── nginx-api.service # Python API 服务定义
|
||
```
|
||
|
||
---
|
||
|
||
## 五、Python API 端点
|
||
|
||
| 方法 | 路径 | 说明 |
|
||
|------|------|------|
|
||
| GET | /api/nginx/health | 健康检查 |
|
||
| GET | /api/nginx/rules | 获取所有规则 |
|
||
| GET | /api/nginx/rules/<domain> | 获取单个规则 |
|
||
| POST | /api/nginx/rules | 新增规则 |
|
||
| PUT | /api/nginx/rules/<domain> | 修改规则 |
|
||
| DELETE | /api/nginx/rules/<domain> | 删除规则 |
|
||
| POST | /api/nginx/reload | 重载Nginx |
|
||
|
||
### 新增规则请求示例
|
||
|
||
```json
|
||
POST /api/nginx/rules
|
||
Content-Type: application/json
|
||
|
||
{
|
||
"domain": "test.mokee.com",
|
||
"protocol": "https",
|
||
"target": "http://10.1.1.11:8080"
|
||
}
|
||
```
|
||
|
||
### 成功响应
|
||
|
||
```json
|
||
{
|
||
"code": 0,
|
||
"message": "规则创建成功",
|
||
"data": {
|
||
"domain": "test.mokee.com",
|
||
"protocol": "https",
|
||
"target": "http://10.1.1.11:8080",
|
||
"config_file": "/etc/nginx/conf.d/test.mokee.com.conf",
|
||
"ssl_cert": "/etc/nginx/ssl/test.mokee.com.pem",
|
||
"ssl_key": "/etc/nginx/ssl/test.mokee.com.key"
|
||
}
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
## 六、Nginx 配置模板（由 API 自动生成）
|
||
|
||
### HTTP 转发
|
||
|
||
```nginx
|
||
# /etc/nginx/conf.d/<domain>.conf
|
||
server {
|
||
listen 80;
|
||
server_name <domain>;
|
||
|
||
location / {
|
||
proxy_pass <target>;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 60s;
|
||
proxy_send_timeout 60s;
|
||
proxy_read_timeout 60s;
|
||
}
|
||
}
|
||
```
|
||
|
||
### HTTPS 转发
|
||
|
||
```nginx
|
||
# /etc/nginx/conf.d/<domain>.conf
|
||
server {
|
||
listen 80;
|
||
server_name <domain>;
|
||
return 301 https://$host$request_uri;
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl;
|
||
server_name <domain>;
|
||
|
||
ssl_certificate /etc/nginx/ssl/<domain>.pem;
|
||
ssl_certificate_key /etc/nginx/ssl/<domain>.key;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||
ssl_prefer_server_ciphers on;
|
||
|
||
location / {
|
||
proxy_pass <target>;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 60s;
|
||
proxy_send_timeout 60s;
|
||
proxy_read_timeout 60s;
|
||
}
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
## 七、MySQL 数据库初始化
|
||
|
||
连接信息:
|
||
|
||
| 项目 | 值 |
|
||
|------|-----|
|
||
| 地址 | 10.1.1.122:3306 |
|
||
| 数据库 | nginxserver |
|
||
| 用户 | nginxserver |
|
||
|
||
初始化脚本:
|
||
|
||
```bash
|
||
mysql -h 10.1.1.122 -u root -p < sql/init.sql
|
||
```
|
||
|
||
表结构:
|
||
|
||
```sql
|
||
-- forwarding_rules 表
|
||
CREATE TABLE forwarding_rules (
|
||
id BIGINT AUTO_INCREMENT PRIMARY KEY COMMENT '主键ID',
|
||
domain VARCHAR(255) NOT NULL COMMENT '域名',
|
||
protocol VARCHAR(10) NOT NULL COMMENT '协议类型: http / https',
|
||
target VARCHAR(500) NOT NULL COMMENT '转发目标地址',
|
||
config_file VARCHAR(500) COMMENT 'Nginx配置文件路径',
|
||
ssl_cert VARCHAR(500) COMMENT 'SSL证书文件路径',
|
||
ssl_key VARCHAR(500) COMMENT 'SSL私钥文件路径',
|
||
status TINYINT DEFAULT 1 COMMENT '状态: 0-已删除, 1-正常',
|
||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP COMMENT '创建时间',
|
||
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP COMMENT '更新时间',
|
||
UNIQUE KEY uk_domain (domain),
|
||
INDEX idx_status (status)
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='Nginx转发规则表';
|
||
|
||
-- certificates 表
|
||
CREATE TABLE certificates (
|
||
id BIGINT AUTO_INCREMENT PRIMARY KEY COMMENT '主键ID',
|
||
domain VARCHAR(255) NOT NULL COMMENT '域名',
|
||
cert_path VARCHAR(500) COMMENT '证书文件路径',
|
||
key_path VARCHAR(500) COMMENT '私钥文件路径',
|
||
issue_date DATETIME COMMENT '签发日期',
|
||
expire_date DATETIME COMMENT '过期日期',
|
||
status VARCHAR(20) DEFAULT 'active' COMMENT '状态',
|
||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP COMMENT '创建时间',
|
||
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP COMMENT '更新时间',
|
||
UNIQUE KEY uk_cert_domain (domain)
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='SSL证书管理表';
|
||
```
|
||
|
||
---
|
||
|
||
## 八、HTTPS 证书方案
|
||
|
||
### 8.1 内部 CA
|
||
|
||
- 首次启动 Python API 时自动生成（如不存在）
|
||
- CA 证书 /etc/nginx/ssl/ca/ca.crt，有效期 10 年
|
||
- CA 私钥 /etc/nginx/ssl/ca/ca.key，权限 600
|
||
- 不占用 80/443/5000 端口
|
||
|
||
### 8.2 域名证书自动签发
|
||
|
||
- 选择 HTTPS 协议时自动签发
|
||
- 证书有效期 365 天
|
||
- 已存在且有效的证书直接复用
|
||
- 过期证书自动重新签发
|
||
|
||
### 8.3 客户端信任
|
||
|
||
内网用户需将 CA 证书导入浏览器:
|
||
|
||
```bash
|
||
# 下载 CA 证书
|
||
scp root@10.1.1.160:/etc/nginx/ssl/ca/ca.crt .
|
||
# 然后在浏览器中导入为受信任的根证书颁发机构
|
||
```
|
||
|
||
---
|
||
|
||
## 九、常见运维命令
|
||
|
||
```bash
|
||
# === Nginx 管理 ===
|
||
nginx -t # 检查配置语法
|
||
nginx -s reload # 重载配置（不中断服务）
|
||
systemctl restart nginx # 重启 Nginx
|
||
systemctl status nginx # 查看状态
|
||
tail -f /var/log/nginx/access.log # 查看访问日志
|
||
tail -f /var/log/nginx/error.log # 查看错误日志
|
||
|
||
# === Python API 管理 ===
|
||
systemctl status nginx-api # 查看服务状态
|
||
systemctl restart nginx-api # 重启 API
|
||
journalctl -u nginx-api -f # 实时查看日志
|
||
journalctl -u nginx-api -n 50 # 最近50行日志
|
||
|
||
# === API 测试 ===
|
||
curl http://127.0.0.1:5000/api/nginx/health # 健康检查
|
||
curl http://127.0.0.1:5000/api/nginx/rules # 查看规则列表
|
||
|
||
# === 防火墙管理 ===
|
||
firewall-cmd --list-all # 查看防火墙规则
|
||
firewall-cmd --add-port=5000/tcp # 临时开放端口
|
||
firewall-cmd --runtime-to-permanent # 保存临时规则为永久
|
||
```
|
||
|
||
---
|
||
|
||
## 十、Spring Boot 配置
|
||
|
||
配置文件: nginx-manager-backend/src/main/resources/application.yml
|
||
|
||
```yaml
|
||
server:
|
||
port: 4002
|
||
|
||
spring:
|
||
datasource:
|
||
url: jdbc:mysql://10.1.1.122:3306/nginxserver?useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
|
||
username: nginxserver
|
||
password: mokee.
|
||
driver-class-name: com.mysql.cj.jdbc.Driver
|
||
jpa:
|
||
hibernate:
|
||
ddl-auto: update
|
||
|
||
python-api:
|
||
base-url: http://10.1.1.160:5000
|
||
connect-timeout: 5000
|
||
read-timeout: 30000
|
||
```
|
||
|
||
---
|
||
|
||
## 十一、Vue.js 前端配置
|
||
|
||
### 开发环境 (.env.development)
|
||
|
||
```
|
||
VITE_API_BASE_URL=http://localhost:4002
|
||
VITE_APP_TITLE=Nginx转发管理平台
|
||
```
|
||
|
||
### 生产环境 (.env.production)
|
||
|
||
```
|
||
VITE_API_BASE_URL=http://<生产服务器IP>:4002
|
||
VITE_APP_TITLE=Nginx转发管理平台
|
||
```
|
||
|
||
### 启动
|
||
|
||
```bash
|
||
npm run dev # 开发模式（端口3002）
|
||
npm run build # 生产构建
|
||
```
|