# Production 3 ### server password ```password 8VLtg#ZYA@AJSFJcPM ``` iptables for internal: ```bash iptables ``` ### docker swarm ```bash docker swarm init --advertise-addr 10.209.42.11 ``` ```bash docker swarm join --token SWMTKN-1-1umhpa86hd7yl6xqt3tci8puwpp9v623bqfymsekb5phrq4y9o-7bu7hn2gxsbp63gvijz5iaomp 10.209.42.11:2377 ``` ## 中间件 ### docker ```docker.service [Unit] Description=Docker Application Container Engine Documentation=https://docs.docker.com After=network-online.target firewalld.service Wants=network-online.target [Service] Type=notify # the default is not to use systemd for cgroups because the delegate issues still # exists and systemd currently does not support the cgroup feature set required # for containers run by docker ExecStart=/usr/local/sbin/dockerd ExecReload=/usr/bin/kill -s HUP $MAINPID # Having non-zero Limit*s causes performance problems due to accounting overhead # in the kernel. We recommend using cgroups to do container-local accounting. LimitNOFILE=infinity LimitNPROC=infinity LimitCORE=infinity # Uncomment TasksMax if your systemd version supports it. # Only systemd 226 and above support this version. #TasksMax=infinity TimeoutStartSec=0 # set delegate yes so that systemd does not reset the cgroups of docker containers Delegate=yes # kill only the docker process, not all processes in the cgroup KillMode=process # restart the docker process if it exits prematurely Restart=on-failure StartLimitBurst=3 StartLimitInterval=60s [Install] WantedBy=multi-user.target ``` ### zookeeper ``` /data//data/apache-zookeeper-3.9.2-bin ``` service ```zookeeper.service [Unit] Description=Zookeeper Daemon Documentation=http://zookeeper.apache.org Requires=network.target After=network.target [Service] Type=forking WorkingDirectory=/data/zookeeper User=root Group=root Environment=ZKHOME=/data/apache-zookeeper-3.9.2-bin Environment=JAVA_HOME=/data/jdk-17.0.11 ExecStart=/bin/bash -c '${ZKHOME}/bin/zkServer.sh start ${ZKHOME}/conf/zoo.cfg' ExecStop=/bin/bash -c '${ZKHOME}/bin/zkServer.sh stop ${ZKHOME}/conf/zoo.cfg' ExecReload=/bin/bash -c '${ZKHOME}/bin/zkServer.sh restart ${ZKHOME}/conf/zoo.cfg' TimeoutSec=30 Restart=on-failure [Install] WantedBy=default.target ``` ### dmdb ```jdbc jdbc:dm://10.201.23.102:35239/FGW_V3 ``` ```ip 10.201.23.102 ``` fgw_v3 ```bash disql SYSDBA/'"Hn@dameng123"':35239 ``` ```sql create tablespace "FGW_V3" datafile 'FGW_V3_01.DBF' size 1024 autoextend on next 1024 maxsize 102400, 'FGW_V3_02.DBF' size 1024 autoextend on next 1024 maxsize 102400 CACHE = NORMAL; create user "FGW_V3" identified by "FgwV3@202403" default tablespace "FGW_V3" default index tablespace "FGW_V3"; grant "RESOURCE","PUBLIC","VTI","SOI" to "FGW_V3"; alter user "FGW_V3" limit failed_login_attemps unlimited, password_lock_time unlimited, password_grace_time unlimited; ``` ``` ./disql SYSDBA/'"Hn@dameng123"':5236 ``` ```sql CREATE USER "FGW_V4" IDENTIFIED BY "WgfV4@202403" ; ``` ```sql alter user "FGW_V4" limit failed_login_attemps 5 password_lock_time 5 connect_idle_time 30 password_grace_time 365 ; ``` ```sql ALTER USER "FGW_V4" LIMIT FAILED_LOGIN_ATTEMPTS 5 PASSWORD_LOCK_TIME 5; ``` ```sql SELECT PROFILE, RESOURCE_NAME, LIMIT FROM DBA_PROFILES WHERE PROFILE='DEFAULT' AND RESOURCE_NAME IN ( 'CONNECT_IDLE_TIME', 'FAILED_LOGIN_ATTEMPS', 'PASSWORD_LOCK_TIME', 'PASSWORD_GRACE_TIME' ); ``` ```sql select * from dba_users where USERNAME = 'FGW_V4'; ``` ```sql SELECT * FROM DBA_PROFILES WHERE PROFILE = ( SELECT PROFILE FROM DBA_USERS WHERE USERNAME='FGW_V4' ); ``` ```sql create tablespace "FGW_SECURITY" datafile 'FGW_SECURITY_01.DBF' size 1024 autoextend on next 1024 maxsize 102400, 'FGW_SECURITY_02.DBF' size 1024 autoextend on next 1024 maxsize 102400 CACHE = NORMAL; create user "FGW_SECURITY" identified by "FgwSECURITY@202403" default tablespace "FGW_SECURITY" default index tablespace "FGW_SECURITY"; grant "RESOURCE","PUBLIC","VTI","SOI" to "FGW_SECURITY"; alter user "FGW_SECURITY" limit failed_login_attemps unlimited, password_lock_time unlimited, password_grace_time unlimited; ``` ```sql create tablespace "FGW_IEJMS" datafile 'FGW_IEJMS_01.DBF' size 1024 autoextend on next 1024 maxsize 102400, 'FGW_IEJMS_02.DBF' size 1024 autoextend on next 1024 maxsize 102400 CACHE = NORMAL; create user "FGW_IEJMS" identified by "FgwV3@202403" default tablespace "FGW_IEJMS" default index tablespace "FGW_IEJMS"; grant "RESOURCE","PUBLIC","VTI","SOI" to "FGW_IEJMS"; alter user "FGW_IEJMS" limit failed_login_attemps unlimited, password_lock_time unlimited, password_grace_time unlimited; ``` test ```bash disql FGW_V3/'"FgwV3@202403"':35239 ``` ```bash disql FGW_SECURITY/'"FgwSECURITY@202403"':35239 ``` ### redis ```ip 10.209.42.15 ``` create redis user ```bash useradd --system --no-create-home --shell /bin/false redis ``` create new directory ```bash mkdir -p /data/lib/redis mkdir -p /data/log/redis chown redis:redis /data/lib/redis chown redis:redis /data/log/redis ``` snap shot ```redis.conf save 900 1 save 300 10 save 60 10000 ``` append only ```redis.conf appendonly yes appendfilename "appendonly.aof" appendfsync everysec ``` password ```redis.conf requirepass ADSSZM&Pk3CP ``` max memory ```redis.conf maxmemory 48gb maxmemory-policy allkeys-lru ``` disable dangous command ```redis.conf rename-command FLUSHDB "" rename-command FLUSHALL "" rename-command KEYS "" ``` network: ```redis.conf tcp-backlog 511 tcp-keepalive 300 ``` client timout ```redis.conf timeout 300 ``` sysctl.conf ```sysctl.conf vm.overcommit_memory = 1 net.core.somaxconn = 1024 ``` redis.service ```service [Unit] Description=Redis In-Memory Data Store After=network.target [Service] User=redis Group=redis ExecStart=/usr/local/bin/redis-server /etc/redis/redis.conf ExecStop=/usr/local/bin/redis-cli -a ADSSZM&Pk3CP shutdown Restart=always LimitNOFILE=65536 [Install] WantedBy=multi-user.target ``` ### mongodb ```ip 10.209.42.20 ``` /data/app/mongodb ```docker-run MONGODB_VERSION=7.0.9-ubi9 docker run --name mongodb -p 27017:27017 -d --restart unless-stopped \ -v /data/app/mongodb/log:/var/log/mongodb:rw \ -v /data/app/mongodb/data:/var/lib/mongo:rw \ -v /data/app/mongodb/etc/mongod.conf:/etc/mongod.conf \ mongodb/mongodb-community-server:$MONGODB_VERSION ``` ```start cd /data/app/mongodb bash docker-run ``` ```bash docker exec -it mongodb mongosh ``` ```script use admin db.createUser({ user: 'admin', pwd: 'Admin@@20240306', roles:[{ role: 'root', db: 'admin' }] }) ``` ```script use fgw_v3 db.createUser({ user: 'fgw_v3', pwd: 'FgwV3@202403', roles:[{ role: 'readWrite', db: 'fgw_v3' }] }) ``` ``` db.auth() ``` ### minio ```ip 10.209.42.14 ``` #### root user: ```MINIO_ACCESS_KEY 494f7af356c2a8877337e4533a0bb030 ``` ```MINIO_SECRET_KEY c449aec9cd091cc4d3707c8daa661216932c7e7d37b8b13df48c2e2d5885f8bd ``` #### 配置帐号： config mc ```config mc alias set fgw http://10.209.42.14:9000 494f7af356c2a8877337e4533a0bb030 c449aec9cd091cc4d3707c8daa661216932c7e7d37b8b13df48c2e2d5885f8bd --api S3v4 ``` full-access.json ```full-access.json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::*" ] } ] } ``` ```bash mc admin policy create fgw full-access full-access.json ``` create user secrect ```bash SECRET_KEY=$(openssl rand -hex 16) echo "Secret Key: $SECRET_KEY" ``` ```access minio ``` ```secrect cb38ff1cbcb882f0735eb8c54342e997 ``` add user ```policy mc admin user add fgw minio cb38ff1cbcb882f0735eb8c54342e997 mc admin policy attach fgw full-access --user minio ``` test user ```bash mc alias set test http://10.209.42.14:9000 minio cb38ff1cbcb882f0735eb8c54342e997 --api S3v4 ``` test env 3 ```bash mc alias set fgw-test http://10.209.246.118:9000 minio 8Xd5FLBuX2yH --api S3v4 ``` elastice search ```ipables iptables -A INPUT -s 10.209.42.0/24 -j ACCEPT ``` ```reset Changed password for user apm_system PASSWORD apm_system = Cph4L3T6IU1fDJTKILay Changed password for user kibana_system PASSWORD kibana_system = iYJUeCxZ78oGnZIyRKUS Changed password for user kibana PASSWORD kibana = iYJUeCxZ78oGnZIyRKUS Changed password for user logstash_system PASSWORD logstash_system = nySYr3h7QRY6FpxGD0Hu Changed password for user beats_system PASSWORD beats_system = uWj7wPbdxXKfoaqmc1Yp Changed password for user remote_monitoring_user PASSWORD remote_monitoring_user = jb3B1dmfOjrW76v7JPb1 Changed password for user elastic PASSWORD elastic = dcGiglCxv9XN8hxItjQ0 ``` root user ```username elastic ``` ```pasword dcGiglCxv9XN8hxItjQ0 ``` ```bash bin/elasticsearch-setup-passwords auto ``` ```20241031 Changed password for user apm_system PASSWORD apm_system = 3Hyygwx4xMpZWtil5NSA Changed password for user kibana_system PASSWORD kibana_system = 78ioryvC8zME8dykEyVs Changed password for user kibana PASSWORD kibana = 78ioryvC8zME8dykEyVs Changed password for user logstash_system PASSWORD logstash_system = Amo1dQtGca1iFJ8oqTah Changed password for user beats_system PASSWORD beats_system = YwwS60H73d8IgNHoDPAR Changed password for user remote_monitoring_user PASSWORD remote_monitoring_user = AHkrfaE8gV3x7ESJJynq Changed password for user elastic PASSWORD elastic = qHnQ4lHtBpidVqdn9L8r ``` ```new elastic password qHnQ4lHtBpidVqdn9L8r ``` ```auth curl -X GET --user elastic:kL7@fJ5-wN3+ "http://10.209.42.22:9200/_cluster/health?pretty" ``` ### docker install ```sysctl.conf # Set vm.max_map_count to increase memory map areas vm.max_map_count=262144 ``` for .env ```env # Password for the 'elastic' user (at least 6 characters) ELASTIC_PASSWORD=dcGiglCxv9XN8hxItjQ0 # Password for the 'kibana_system' user (at least 6 characters) KIBANA_PASSWORD=dcGiglCxv9XN8hxItjQ0 # Version of Elastic products STACK_VERSION=8.15.2 # Set the cluster name CLUSTER_NAME=fgw-es # Set to 'basic' or 'trial' to automatically start the 30-day trial LICENSE=basic # Port to expose Elasticsearch HTTP API to the host ES_PORT=9200 # Port to expose Kibana to the host KIBANA_PORT=5601 # Increase or decrease based on the available host memory (in bytes) MEM_LIMIT=2147483648 ``` ```compose.yml services: setup: image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION} volumes: - certs:/usr/share/elasticsearch/config/certs user: "0" command: > bash -c ' if [ x${ELASTIC_PASSWORD} == x ]; then echo "Set the ELASTIC_PASSWORD environment variable in the .env file"; exit 1; elif [ x${KIBANA_PASSWORD} == x ]; then echo "Set the KIBANA_PASSWORD environment variable in the .env file"; exit 1; fi; if [ ! -f config/certs/ca.zip ]; then echo "Creating CA"; bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip; unzip config/certs/ca.zip -d config/certs; fi; if [ ! -f config/certs/certs.zip ]; then echo "Creating certs"; echo -ne \ "instances:\n"\ " - name: es01\n"\ " dns:\n"\ " - es01\n"\ " - localhost\n"\ " ip:\n"\ " - 127.0.0.1\n"\ > config/certs/instances.yml; bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key; unzip config/certs/certs.zip -d config/certs; fi; echo "Setting file permissions" chown -R root:root config/certs; find . -type d -exec chmod 750 \{\} \;; find . -type f -exec chmod 640 \{\} \;; echo "Waiting for Elasticsearch availability"; until curl -s --cacert config/certs/ca/ca.crt https://es01:9200 | grep -q "missing authentication credentials"; do sleep 30; done; echo "Setting kibana_system password"; until curl -s -X POST --cacert config/certs/ca/ca.crt -u "elastic:${ELASTIC_PASSWORD}" -H "Content-Type: application/json" https://es01:9200/_security/user/kibana_system/_password -d "{\"password\":\"${KIBANA_PASSWORD}\"}" | grep -q "^{}"; do sleep 10; done; echo "All done!"; ' healthcheck: test: ["CMD-SHELL", "[ -f config/certs/es01/es01.crt ]"] interval: 1s timeout: 5s retries: 120 es01: image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION} volumes: - certs:/usr/share/elasticsearch/config/certs - esdata:/usr/share/elasticsearch/data ports: - ${ES_PORT}:9200 environment: - node.name=es01 - cluster.name=${CLUSTER_NAME} - discovery.type=single-node - ELASTIC_PASSWORD=${ELASTIC_PASSWORD} - bootstrap.memory_lock=true - xpack.security.enabled=true - xpack.security.http.ssl.enabled=true - xpack.security.http.ssl.key=certs/es01/es01.key - xpack.security.http.ssl.certificate=certs/es01/es01.crt - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt - xpack.security.transport.ssl.enabled=true - xpack.security.transport.ssl.key=certs/es01/es01.key - xpack.security.transport.ssl.certificate=certs/es01/es01.crt - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt - xpack.security.transport.ssl.verification_mode=certificate - xpack.license.self_generated.type=${LICENSE} mem_limit: ${MEM_LIMIT} ulimits: memlock: soft: -1 hard: -1 healthcheck: test: [ "CMD-SHELL", "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'", ] interval: 10s timeout: 10s retries: 120 kibana: depends_on: es01: condition: service_healthy image: docker.elastic.co/kibana/kibana:${STACK_VERSION} volumes: - certs:/usr/share/kibana/config/certs - kibanadata:/usr/share/kibana/data ports: - ${KIBANA_PORT}:5601 environment: - SERVERNAME=kibana - ELASTICSEARCH_HOSTS=https://es01:9200 - ELASTICSEARCH_USERNAME=kibana_system - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD} - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/ca/ca.crt - SERVER_PUBLICBASEURL=http://localhost:5601 mem_limit: ${MEM_LIMIT} healthcheck: test: [ "CMD-SHELL", "curl -s -I http://localhost:5601 | grep -q 'HTTP/1.1 302 Found'", ] interval: 10s timeout: 10s retries: 120 volumes: certs: driver: local esdata: driver: local kibanadata: driver: local ``` without ssl bitnami ```compose.yml services: es01: image: bitnami/elasticsearch:${STACK_VERSION} volumes: - ./data:/bitnami/elasticsearch/data ports: - ${ES_PORT}:9200 environment: - node.name=es01 - cluster.name=${CLUSTER_NAME} - discovery.type=single-node - ELASTIC_PASSWORD=${ELASTIC_PASSWORD} - bootstrap.memory_lock=true - xpack.security.enabled=false - xpack.security.http.ssl.enabled=false mem_limit: ${MEM_LIMIT} ulimits: memlock: soft: -1 hard: -1 healthcheck: test: [ "CMD-SHELL", "curl -s http://localhost:9200 | grep -q 'missing authentication credentials'", ] interval: 10s timeout: 10s retries: 120 kibana: depends_on: es01: condition: service_healthy image: docker.elastic.co/kibana/kibana:${STACK_VERSION} volumes: - certs:/usr/share/kibana/config/certs - ./kibanadata:/usr/share/kibana/data ports: - ${KIBANA_PORT}:5601 environment: - SERVERNAME=kibana - ELASTICSEARCH_HOSTS=http://es01:9200 - ELASTICSEARCH_USERNAME=kibana_system - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD} - SERVER_PUBLICBASEURL=http://localhost:5601 mem_limit: ${MEM_LIMIT} healthcheck: test: [ "CMD-SHELL", "curl -s -I http://localhost:5601 | grep -q 'HTTP/1.1 302 Found'", ] interval: 10s timeout: 10s retries: 120 ``` docker stack ```docker-stack.yml version: '3.3' services: fgw-gateway: image: "10.209.42.16/fgw/fgw3-gateway:v1.0.1" environment: JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-gateway -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms256m -Xmx512m" TZ: Asia/Shanghai networks: - fgw ports: - "8080:8080" deploy: replicas: 1 restart_policy: condition: on-failure fgw-manage: image: "10.209.42.16/fgw/fgw-manage:v1.0.1" environment: JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-manage -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms256m -Xmx512m" TZ: Asia/Shanghai working_dir: /usr/local networks: - fgw deploy: replicas: 1 restart_policy: condition: on-failure fgw-review: image: "10.209.42.16/fgw/fgw-review:v1.0.2" environment: JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-review -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms512m -Xmx1024m" TZ: Asia/Shanghai working_dir: /usr/local networks: - fgw deploy: replicas: 1 restart_policy: condition: on-failure fgw-knowbase: image: "10.209.42.16/fgw/fgw-knowbase:v1.0.1" environment: JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-knowbase.yaml -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms256m -Xmx512m" TZ: Asia/Shanghai working_dir: /usr/local networks: - fgw deploy: replicas: 1 restart_policy: condition: on-failure fgw-portal: image: "10.209.42.16/fgw/mbp-portal:v1.0.1" environment: JAVA_OPTS: "-Dfile.encoding=UTF-8 -Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-portal -Dspring.cloud.nacos.config.file-extension=Properties -XX:PermSize=64m -XX:MaxPermSize=128m -Xms512m -Xmx1024m" TZ: Asia/Shanghai working_dir: /usr/local volumes: - /etc/dm_svc.conf:/etc/dm_svc.conf:rw networks: - fgw deploy: replicas: 1 restart_policy: condition: on-failure #fgw-knowledge-base: # image: "10.209.42.16/fgw/gq-knowledge-base:v1.0.1" # environment: # JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-knowledge-base.yaml -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms256m -Xmx512m" # TZ: Asia/Shanghai # working_dir: /usr/local # networks: # - fgw # deploy: # replicas: 1 # restart_policy: # condition: on-failure fgw-ibls-server: image: "10.209.42.16/fgw/ibls:v1.0.1" environment: JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-ibls-server -Dspring.cloud.nacos.config.file-extension=Properties -XX:PermSize=64m -XX:MaxPermSize=128m -Xms256m -Xmx512m" TZ: Asia/Shanghai working_dir: /usr/local networks: - fgw deploy: replicas: 1 restart_policy: condition: on-failure fgw-gdal: image: "10.209.42.16/fgw/fgw-gdal:v1.0.1" environment: JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-gdal -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms256m -Xmx512m" TZ: Asia/Shanghai working_dir: /usr/local networks: - fgw deploy: replicas: 1 restart_policy: condition: on-failure fgw-stat: image: "10.209.42.16/fgw/fgw-stat:v1.0.1" environment: JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-stat -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms256m -Xmx512m" TZ: Asia/Shanghai working_dir: /usr/local networks: - fgw deploy: replicas: 1 restart_policy: condition: on-failure fgw-interf: image: "10.209.42.16/fgw/fgw-interf:v1.0.1" environment: JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-interf -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms512m -Xmx1024m" TZ: Asia/Shanghai working_dir: /usr/local networks: - fgw deploy: replicas: 1 restart_policy: condition: on-failure networks: fgw: ``` deploy: ```bash #/bin/bash docker stack deploy -c docker-stack.yml fgw ``` network debug ```bash docker run -it --net container: nicolaka/netshoot ``` docker swarm init ```console docker swarm init --advertise-addr 10.209.42.11 ``` ```console docker swarm join --token SWMTKN-1-4435npmxyxw2tm53qxlgxqdgizzodncymybjgbs0twi304cn81-enkjvrmapt8jhmyyudiums564 10.209.42.11:2377 ``` ```lookbusy lookbusy -c 70 -n 2 占用两个 CPU 核心各 70% lookbusy -c 60-70 -r curve 占用所有 CPU 核心在 60%-70% 上下浮动 lookbusy -c 60-70 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu以60分钟为周期，30分钟是峰值，使用率在60%-70%上下浮动 ``` 新要求： cpu 平均>8 峰值>60 ```bash #!/bin/bash /usr/local/bin/lookbusy -c 20-70 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu & ``` 每 3000 毫秒，循环释放并分配 1024MB 内存 ``` /usr/local/bin/lookbusy -m 1024MB -M 3000 & ``` ``` fallocate -l 240G /data/dmdata/tmp/data.zip ``` ``` curl -X PUT -u elastic:WdH7XbbpModi6FAWdP99 "localhost:9200/my-index?pretty" -H 'Content-Type: application/json' -d' { "settings": { "analysis": { "filter": { "jieba_stop": { "type": "stop", "stopwords_path": "stopwords/stopwords.txt" }, "jieba_synonym": { "type": "synonym", "synonyms_path": "synonyms/synonyms.txt" } }, "analyzer": { "my_ana": { "tokenizer": "jieba_index", "filter": [ "lowercase", "jieba_stop", "jieba_synonym" ] } } } } } ' curl -X PUT -u elastic:WdH7XbbpModi6FAWdP99 "localhost:9200/my-index/_analyze?pretty" -H 'Content-Type: application/json' -d' PUT jieba_index/_analyze { "analyzer" : "my_ana", "text" : "黄河之水天上来" } ' ``` 二期 mysql root账号恢复 ``` sudo -u mysql mysqld --skip-grant-tables & ``` ``` mysql -u root ``` ``` INSERT INTO mysql.user (Host, User, authentication_string, plugin, ssl_cipher, x509_issuer, x509_subject) VALUES ('localhost', 'root', '', 'mysql_native_password', '', '', ''); ``` ``` ALTER USER 'root'@'localhost' IDENTIFIED BY 'dei