From abf598a250df4b03c4f3888dba6f30c4b31ad3af Mon Sep 17 00:00:00 2001 From: windyboy Date: Fri, 18 Sep 2026 15:35:20 +0800 Subject: [PATCH] fix(deploy): add integration stack with SELinux-compatible mounts --- compose.integration.yaml | 139 ++++++++++++++++++ deploy/integration/README.md | 85 +++++++++++ deploy/integration/admin-api.yml | 62 ++++++++ .../integration/admin-mysql-init/01-auth.sql | 2 + deploy/integration/logback.xml | 6 + deploy/integration/msgexchange.env.sh | 22 +++ .../postgres-init/01-admin-reader.sql | 7 + 7 files changed, 323 insertions(+) create mode 100644 compose.integration.yaml create mode 100644 deploy/integration/README.md create mode 100644 deploy/integration/admin-api.yml create mode 100644 deploy/integration/admin-mysql-init/01-auth.sql create mode 100644 deploy/integration/logback.xml create mode 100644 deploy/integration/msgexchange.env.sh create mode 100644 deploy/integration/postgres-init/01-admin-reader.sql diff --git a/compose.integration.yaml b/compose.integration.yaml new file mode 100644 index 0000000..2b2ef32 --- /dev/null +++ b/compose.integration.yaml @@ -0,0 +1,139 @@ +# 独立联调依赖栈；应用在宿主机运行，固定测试凭据，禁止用于生产。 +name: msgx-integration + +services: + mysql: + image: mysql:8.4 + restart: unless-stopped + environment: + MYSQL_ROOT_PASSWORD: root_dev_pass + MYSQL_DATABASE: cdairport + MYSQL_USER: msgx_dev + MYSQL_PASSWORD: msgx_dev_pass + ports: + - "0.0.0.0:13306:3306" + volumes: + # 与开发栈共用目录，使用共享 SELinux 标签。 + - ./deploy/dev/mysql-init:/docker-entrypoint-initdb.d:ro,z + - mysql_data:/var/lib/mysql + healthcheck: + test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -u$$MYSQL_USER -p$$MYSQL_PASSWORD --silent || exit 1"] + interval: 5s + timeout: 5s + retries: 10 + start_period: 15s + + postgres: + image: postgres:17-alpine + restart: unless-stopped + environment: + POSTGRES_DB: msgx + POSTGRES_USER: msgx_dev + POSTGRES_PASSWORD: msgx_dev_pass + ports: + - "0.0.0.0:15432:5432" + volumes: + - pg_data:/var/lib/postgresql/data + - ./deploy/integration/postgres-init:/docker-entrypoint-initdb.d:ro,Z + healthcheck: + test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB -h 127.0.0.1 || exit 1"] + interval: 5s + timeout: 5s + retries: 10 + start_period: 5s + + redis: + image: valkey/valkey:8-alpine + restart: unless-stopped + command: ["valkey-server", "--appendonly", "yes"] + ports: + - "0.0.0.0:16379:6379" + volumes: + - redis_data:/data + healthcheck: + test: ["CMD-SHELL", "valkey-cli ping | grep PONG || exit 1"] + interval: 5s + timeout: 5s + retries: 10 + start_period: 5s + + kafka: + image: apache/kafka:3.8.0 + restart: unless-stopped + ports: + - "0.0.0.0:19092:9092" + environment: + KAFKA_NODE_ID: 1 + KAFKA_PROCESS_ROLES: broker,controller + KAFKA_CLUSTER_ID: "4L622nShTUiT8tCdRvgqgA" + KAFKA_LISTENERS: EXTERNAL://:9092,INTERNAL://:29092,CONTROLLER://:9093 + KAFKA_ADVERTISED_LISTENERS: EXTERNAL://${TEST_SERVER_HOST:?Set TEST_SERVER_HOST to the server IP or DNS}:19092,INTERNAL://kafka:29092 + KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: EXTERNAL:PLAINTEXT,INTERNAL:PLAINTEXT,CONTROLLER:PLAINTEXT + KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER + KAFKA_CONTROLLER_QUORUM_VOTERS: 1@localhost:9093 + KAFKA_INTER_BROKER_LISTENER_NAME: INTERNAL + KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1 + KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1 + KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1 + KAFKA_DEFAULT_REPLICATION_FACTOR: 1 + KAFKA_NUM_PARTITIONS: 1 + KAFKA_AUTO_CREATE_TOPICS_ENABLE: "true" + KAFKA_LOG_DIRS: /tmp/kraft-combined-logs + healthcheck: + test: ["CMD-SHELL", "/opt/kafka/bin/kafka-topics.sh --bootstrap-server localhost:29092 --list || exit 1"] + interval: 5s + timeout: 5s + retries: 10 + start_period: 10s + + # 独立于共享信箱；兼容 admin-api 旧 MySQL JDBC 的认证方式。 + admin-mysql: + image: mysql:8.4 + restart: unless-stopped + command: ["--mysql-native-password=ON"] + environment: + MYSQL_ROOT_PASSWORD: admin_root_dev_pass + MYSQL_DATABASE: adminapi + MYSQL_USER: admin_dev + MYSQL_PASSWORD: admin_dev_pass + ports: + - "0.0.0.0:13307:3306" + volumes: + - admin_mysql_data:/var/lib/mysql + - ./deploy/integration/admin-mysql-init:/docker-entrypoint-initdb.d:ro,Z + healthcheck: + test: ["CMD-SHELL", "MYSQL_PWD=$$MYSQL_PASSWORD mysql -h 127.0.0.1 -u$$MYSQL_USER -D adminapi -e 'SELECT 1' || exit 1"] + interval: 5s + timeout: 5s + retries: 20 + start_period: 30s + + # admin-api 使用 TransportClient 6.4.2，不可直接改成现代 ES 的 REST 端口。 + # 旧版仅供受控测试网络，Apple Silicon 需要 amd64 模拟运行支持。 + elasticsearch: + image: docker.elastic.co/elasticsearch/elasticsearch:6.4.2 + platform: linux/amd64 + restart: unless-stopped + environment: + discovery.type: single-node + cluster.name: docker-cluster + xpack.security.enabled: "false" + ES_JAVA_OPTS: "-Xms512m -Xmx512m" + ports: + - "0.0.0.0:19200:9200" + - "0.0.0.0:19300:9300" + volumes: + - es_data:/usr/share/elasticsearch/data + healthcheck: + test: ["CMD-SHELL", "curl -fsS 'http://localhost:9200/_cluster/health?wait_for_status=yellow&timeout=3s' | grep -q '\"timed_out\":false'"] + interval: 10s + timeout: 5s + retries: 30 + start_period: 30s + +volumes: + admin_mysql_data: + es_data: + mysql_data: + pg_data: + redis_data: diff --git a/deploy/integration/README.md b/deploy/integration/README.md new file mode 100644 index 0000000..8e86626 --- /dev/null +++ b/deploy/integration/README.md @@ -0,0 +1,85 @@ +# 双项目 PostgreSQL 联调环境 + +## 范围 + +`compose.integration.yaml` 是独立的依赖栈，不与根目录 `compose.yaml` 合并使用；两个应用单独运行，可与中间件分机部署。 +沿用开发栈的 PostgreSQL、信箱 MySQL、Valkey、Kafka 镜像，增加 admin-api 独立 MySQL 和匹配其 TransportClient 的 Elasticsearch。 +所有发布端口监听全部网卡，凭据仅供测试；防火墙只放行测试客户端，禁止直接暴露公网。 + +| 服务 | 用途 | +| --- | --- | +| postgres | msgexchange-v2 自有业务数据库；admin-api 使用只读账号 | +| mysql | 本地共享信箱模拟，复用 `deploy/dev/mysql-init`，不修改外部邮箱结构 | +| admin-mysql | admin-api Primary 数据源，独立空库，不与共享信箱混用 | +| redis | 保留开发栈的 Valkey 服务，不改变当前应用的数据归属 | +| kafka | INTERNAL 用于容器健康检查，EXTERNAL 通告服务器地址 | +| elasticsearch | admin-api 历史查询依赖；未预建索引或导入数据 | + +端口和测试凭据在 `compose.integration.yaml`，应用对应值在本目录配置文件。 +Elasticsearch 旧版本仅用于兼容验证，Apple Silicon 需要 amd64 模拟支持；镜像配置参考 [Elastic Docker 文档](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/docker.html)。 + +## 在中间件服务器启动 + +将仓库复制到服务器，在仓库根目录执行；`TEST_SERVER_HOST` 必须是应用机器能访问的服务器 IP 或域名，不能填写 `0.0.0.0`。 + +```sh +export TEST_SERVER_HOST=你的服务器IP +docker compose -f compose.integration.yaml config --quiet +docker compose -f compose.integration.yaml up -d +docker compose -f compose.integration.yaml ps +``` + +该命令创建独立项目的容器、网络和数据卷，不启动两个 Java 应用。 +首次初始化时创建 PG 只读用户，并为随后由 `msgx_dev` 创建的 public 表和视图授予 SELECT；不授予写入权限。 +初始化脚本只对空数据卷执行，已有卷不会自动补执行或修改密码。 +SELinux 环境下，初始化目录挂载通过 `Z` 设置容器专用标签；与开发栈共用的信箱目录使用 `z` 共享标签，保持只读挂载。 + +## 运行 msgexchange-v2 + +在应用机器的仓库根目录，用项目要求的 JDK 执行： + +```sh +export TEST_SERVER_HOST=你的服务器IP +source deploy/integration/msgexchange.env.sh +./gradlew run +``` + +此配置关闭内存 stub，启用真实 PG、信箱和 Flyway；只能指向本测试栈。 +Flyway 只迁移自有 PG，不为 admin-api 创建业务表，也不迁移共享 MySQL。 + +## 运行 admin-api + +前置条件：使用 Java 8，admin-api 可执行 JAR 必须包含兼容该运行时的 `org.postgresql:postgresql` 驱动，单改 YAML 无法替代驱动依赖。 +在 msgexchange-v2 仓库根目录执行，确保 `$PWD` 指向本仓库而非 admin-api；以下使用测试服务器上的 JAR 路径，其他机器按实际位置替换： + +```sh +export TEST_SERVER_HOST=你的服务器IP +java -jar /home/fengzhiqiang/project/airport/chengdu/admin-api/target/admin-api-1.2.1-SNAPSHOT.jar \ + --spring.profiles.active=localtest \ + --spring.config.location="file:$PWD/deploy/integration/admin-api.yml" \ + --logging.config="file:$PWD/deploy/integration/logback.xml" +``` + +独立 profile 避免加载内置 dev/test/pro 地址，关闭 Eureka 和自动建表，日志只输出控制台。 +两个 JPA 数据源不能全局强设 PG 方言；启动日志需确认 Primary 为 MySQL、Secondary 为 PostgreSQL。 +sys-api 不在本栈，依赖它的操作日志开关接口不可用，不以假响应掩盖缺失依赖。 + +## 数据准备与验收边界 + +本栈提供数据库连接环境，不等于完整业务联调环境；空库上的基础数据、季度计划、字典和历史查询可能报缺表或缺索引。 +admin-api Primary 需导入经确认的测试结构与脱敏数据，仅导入 `admin-mysql`，不得导入信箱实例。 +Secondary 的表与列需匹配 admin-api 实体；参考数据读取契约尚待 `Q22` 定稿，季度计划来源尚待 `Q25` 确认，不根据实体臆造生产迁移或测试数据。 +`G-REF-DATA` 标记的静态数据处理缺口不由 Compose 解决。 + +验收顺序：服务健康 → 应用驱动和方言 → 确认的表结构及数据 → 基础数据查询 → 季度计划日期与经停关联 → 接口返回对比。 +PG 只读账号可以查询当前 public 内部表；这是联调权限范围，不是生产最小权限方案。 + +## 停止与排查 + +```sh +docker compose -f compose.integration.yaml logs --tail=100 +docker compose -f compose.integration.yaml down +``` + +停止命令保留数据卷；不要追加 `-v`，该选项会删除测试数据。 +Elasticsearch 启动失败先检查镜像架构、内存及日志中的内核限制提示，不自动修改服务器内核参数。 diff --git a/deploy/integration/admin-api.yml b/deploy/integration/admin-api.yml new file mode 100644 index 0000000..c6dd0fd --- /dev/null +++ b/deploy/integration/admin-api.yml @@ -0,0 +1,62 @@ +# 宿主机运行 admin-api 的独立配置；不加载内置 dev/test/pro 地址。 +server: + address: 0.0.0.0 + port: 18080 +spring: + application: + name: adminapi-local + jpa: + hibernate: + ddl-auto: none + properties: + hibernate.hbm2ddl.auto: none + datasource: + primary: + url: jdbc:mysql://${TEST_SERVER_HOST}:13307/adminapi?useSSL=false&useUnicode=true&characterEncoding=utf-8 + username: admin_dev + password: admin_dev_pass + driver: com.mysql.jdbc.Driver + initial-size: 1 + min-idle: 1 + max-active: 5 + max-wait: 5000 + time-between-eviction-runs-millis: 60000 + min-evictable-idle-time-millis: 300000 + test-on-borrow: true + validation-query: SELECT 1 + secondary: + url: jdbc:postgresql://${TEST_SERVER_HOST}:15432/msgx + username: admin_reader + password: admin_reader_dev_pass + driver: org.postgresql.Driver + initial-size: 1 + min-idle: 1 + max-active: 5 + max-wait: 5000 + time-between-eviction-runs-millis: 60000 + min-evictable-idle-time-millis: 300000 + test-on-borrow: true + validation-query: SELECT 1 +eureka: + client: + enabled: false + register-with-eureka: false + fetch-registry: false + service-url: + defaultZone: http://127.0.0.1:18761/eureka/ +elasticsearch: + ip: ${TEST_SERVER_HOST} + port: 19300 + pool: 5 + cluster: + name: docker-cluster + nodes: ${TEST_SERVER_HOST}:19300 + maxSize: 10000 +# 本栈不提供 sys-api；相关接口会失败，不伪造成功响应。 +sysApi: + getOpLogSwitchByLevleAndNameUrl: http://127.0.0.1:18093/oplog/getOpLogSwitch/{level}/{name} +logstash: + host: 127.0.0.1:15000 +logging: + level: + root: info diff --git a/deploy/integration/admin-mysql-init/01-auth.sql b/deploy/integration/admin-mysql-init/01-auth.sql new file mode 100644 index 0000000..76bcc8a --- /dev/null +++ b/deploy/integration/admin-mysql-init/01-auth.sql @@ -0,0 +1,2 @@ +-- 仅作用于独立 admin-mysql，绝不挂载到共享信箱 MySQL。 +ALTER USER 'admin_dev'@'%' IDENTIFIED WITH mysql_native_password BY 'admin_dev_pass'; diff --git a/deploy/integration/logback.xml b/deploy/integration/logback.xml new file mode 100644 index 0000000..8b2f47a --- /dev/null +++ b/deploy/integration/logback.xml @@ -0,0 +1,6 @@ + + + %date %-5level %logger{36} - %msg%n + + + diff --git a/deploy/integration/msgexchange.env.sh b/deploy/integration/msgexchange.env.sh new file mode 100644 index 0000000..c6169c4 --- /dev/null +++ b/deploy/integration/msgexchange.env.sh @@ -0,0 +1,22 @@ +# 在 msgexchange-v2 根目录 source 本文件；应用可与中间件分机部署。 +: "${TEST_SERVER_HOST:?请先 export TEST_SERVER_HOST=中间件服务器IP或域名}" +export MICRONAUT_ENVIRONMENTS=dev +export MSGX_STUBS=false +export DATASOURCES_DEFAULT_ENABLED=true +export MAILBOX_SHARED_MYSQL_ENABLED=true +export MSGX_FLYWAY_ENABLED=true +export MSGX_PG_HOST="$TEST_SERVER_HOST" +export MSGX_PG_PORT=15432 +export MSGX_PG_NAME=msgx +export MSGX_PG_URL="jdbc:postgresql://$TEST_SERVER_HOST:$MSGX_PG_PORT/$MSGX_PG_NAME" +export MSGX_PG_USER=msgx_dev +export MSGX_PG_PASSWORD=msgx_dev_pass +export MSGX_MAILBOX_HOST="$TEST_SERVER_HOST" +export MSGX_MAILBOX_PORT=13306 +export MSGX_MAILBOX_NAME=cdairport +export MSGX_MAILBOX_URL="jdbc:mysql://$TEST_SERVER_HOST:$MSGX_MAILBOX_PORT/$MSGX_MAILBOX_NAME?useSSL=false&allowPublicKeyRetrieval=true&serverTimezone=Asia/Shanghai&characterEncoding=utf8mb4" +export MSGX_MAILBOX_USER=msgx_dev +export MSGX_MAILBOX_PASSWORD=msgx_dev_pass +export MSGX_KAFKA_HOST="$TEST_SERVER_HOST" +export MSGX_KAFKA_PORT=19092 +export MSGX_KAFKA_SERVERS="$TEST_SERVER_HOST:$MSGX_KAFKA_PORT" diff --git a/deploy/integration/postgres-init/01-admin-reader.sql b/deploy/integration/postgres-init/01-admin-reader.sql new file mode 100644 index 0000000..aadc6db --- /dev/null +++ b/deploy/integration/postgres-init/01-admin-reader.sql @@ -0,0 +1,7 @@ +-- 仅在新建的本地联调数据库中执行；不生成未定稿的参考数据结构。 +CREATE ROLE admin_reader LOGIN PASSWORD 'admin_reader_dev_pass'; +GRANT CONNECT ON DATABASE msgx TO admin_reader; +GRANT USAGE ON SCHEMA public TO admin_reader; +-- Flyway 使用 msgx_dev 创建对象；只读权限随新表和视图生效。 +ALTER DEFAULT PRIVILEGES FOR ROLE msgx_dev IN SCHEMA public + GRANT SELECT ON TABLES TO admin_reader;