1044 lines
24 KiB
Markdown
1044 lines
24 KiB
Markdown
|
|
|
|
# Production 3
|
|
|
|
### server password
|
|
```password
|
|
8VLtg#ZYA@AJSFJcPM
|
|
```
|
|
|
|
|
|
iptables for internal:
|
|
```bash
|
|
iptables
|
|
```
|
|
|
|
### docker swarm
|
|
```bash
|
|
docker swarm init --advertise-addr 10.209.42.11
|
|
```
|
|
|
|
```bash
|
|
docker swarm join --token SWMTKN-1-1umhpa86hd7yl6xqt3tci8puwpp9v623bqfymsekb5phrq4y9o-7bu7hn2gxsbp63gvijz5iaomp 10.209.42.11:2377
|
|
```
|
|
|
|
## 中间件
|
|
|
|
### docker
|
|
|
|
```docker.service
|
|
|
|
[Unit]
|
|
Description=Docker Application Container Engine
|
|
Documentation=https://docs.docker.com
|
|
After=network-online.target firewalld.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=notify
|
|
# the default is not to use systemd for cgroups because the delegate issues still
|
|
# exists and systemd currently does not support the cgroup feature set required
|
|
# for containers run by docker
|
|
ExecStart=/usr/local/sbin/dockerd
|
|
ExecReload=/usr/bin/kill -s HUP $MAINPID
|
|
# Having non-zero Limit*s causes performance problems due to accounting overhead
|
|
# in the kernel. We recommend using cgroups to do container-local accounting.
|
|
LimitNOFILE=infinity
|
|
LimitNPROC=infinity
|
|
LimitCORE=infinity
|
|
# Uncomment TasksMax if your systemd version supports it.
|
|
# Only systemd 226 and above support this version.
|
|
#TasksMax=infinity
|
|
TimeoutStartSec=0
|
|
# set delegate yes so that systemd does not reset the cgroups of docker containers
|
|
Delegate=yes
|
|
# kill only the docker process, not all processes in the cgroup
|
|
KillMode=process
|
|
# restart the docker process if it exits prematurely
|
|
Restart=on-failure
|
|
StartLimitBurst=3
|
|
StartLimitInterval=60s
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
```
|
|
|
|
|
|
### zookeeper
|
|
|
|
|
|
```
|
|
/data//data/apache-zookeeper-3.9.2-bin
|
|
```
|
|
|
|
service
|
|
```zookeeper.service
|
|
|
|
[Unit]
|
|
Description=Zookeeper Daemon
|
|
Documentation=http://zookeeper.apache.org
|
|
Requires=network.target
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=forking
|
|
WorkingDirectory=/data/zookeeper
|
|
User=root
|
|
Group=root
|
|
Environment=ZKHOME=/data/apache-zookeeper-3.9.2-bin
|
|
Environment=JAVA_HOME=/data/jdk-17.0.11
|
|
ExecStart=/bin/bash -c '${ZKHOME}/bin/zkServer.sh start ${ZKHOME}/conf/zoo.cfg'
|
|
ExecStop=/bin/bash -c '${ZKHOME}/bin/zkServer.sh stop ${ZKHOME}/conf/zoo.cfg'
|
|
ExecReload=/bin/bash -c '${ZKHOME}/bin/zkServer.sh restart ${ZKHOME}/conf/zoo.cfg'
|
|
TimeoutSec=30
|
|
Restart=on-failure
|
|
|
|
[Install]
|
|
WantedBy=default.target
|
|
```
|
|
|
|
### dmdb
|
|
```jdbc
|
|
jdbc:dm://10.201.23.102:35239/FGW_V3
|
|
```
|
|
|
|
|
|
|
|
```ip
|
|
10.201.23.102
|
|
```
|
|
fgw_v3
|
|
```bash
|
|
disql SYSDBA/'"Hn@dameng123"':35239
|
|
```
|
|
|
|
|
|
|
|
```sql
|
|
create tablespace "FGW_V3" datafile 'FGW_V3_01.DBF' size 1024 autoextend on next 1024 maxsize 102400, 'FGW_V3_02.DBF' size 1024 autoextend on next 1024 maxsize 102400 CACHE = NORMAL;
|
|
create user "FGW_V3" identified by "FgwV3@202403" default tablespace "FGW_V3" default index tablespace "FGW_V3";
|
|
grant "RESOURCE","PUBLIC","VTI","SOI" to "FGW_V3";
|
|
alter user "FGW_V3" limit failed_login_attemps unlimited, password_lock_time unlimited, password_grace_time unlimited;
|
|
|
|
```
|
|
|
|
```
|
|
./disql SYSDBA/'"Hn@dameng123"':5236
|
|
```
|
|
|
|
```sql
|
|
CREATE USER "FGW_V4" IDENTIFIED BY "WgfV4@202403" ;
|
|
```
|
|
|
|
```sql
|
|
alter user "FGW_V4" limit failed_login_attemps 5 password_lock_time 5 connect_idle_time 30 password_grace_time 365 ;
|
|
```
|
|
|
|
|
|
```sql
|
|
ALTER USER "FGW_V4"
|
|
LIMIT FAILED_LOGIN_ATTEMPTS 5 PASSWORD_LOCK_TIME 5;
|
|
|
|
```
|
|
|
|
|
|
```sql
|
|
SELECT PROFILE, RESOURCE_NAME, LIMIT
|
|
FROM DBA_PROFILES
|
|
WHERE PROFILE='DEFAULT'
|
|
AND RESOURCE_NAME IN (
|
|
'CONNECT_IDLE_TIME',
|
|
'FAILED_LOGIN_ATTEMPS',
|
|
'PASSWORD_LOCK_TIME',
|
|
'PASSWORD_GRACE_TIME'
|
|
);
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
```sql
|
|
select * from dba_users where USERNAME = 'FGW_V4';
|
|
```
|
|
|
|
|
|
```sql
|
|
SELECT *
|
|
FROM DBA_PROFILES
|
|
WHERE PROFILE = (
|
|
SELECT PROFILE FROM DBA_USERS WHERE USERNAME='FGW_V4'
|
|
);
|
|
|
|
```
|
|
|
|
```sql
|
|
create tablespace "FGW_SECURITY" datafile 'FGW_SECURITY_01.DBF' size 1024 autoextend on next 1024 maxsize 102400, 'FGW_SECURITY_02.DBF' size 1024 autoextend on next 1024 maxsize 102400 CACHE = NORMAL;
|
|
create user "FGW_SECURITY" identified by "FgwSECURITY@202403" default tablespace "FGW_SECURITY" default index tablespace "FGW_SECURITY";
|
|
grant "RESOURCE","PUBLIC","VTI","SOI" to "FGW_SECURITY";
|
|
alter user "FGW_SECURITY" limit failed_login_attemps unlimited, password_lock_time unlimited, password_grace_time unlimited;
|
|
```
|
|
|
|
```sql
|
|
create tablespace "FGW_IEJMS" datafile 'FGW_IEJMS_01.DBF' size 1024 autoextend on next 1024 maxsize 102400, 'FGW_IEJMS_02.DBF' size 1024 autoextend on next 1024 maxsize 102400 CACHE = NORMAL;
|
|
create user "FGW_IEJMS" identified by "FgwV3@202403" default tablespace "FGW_IEJMS" default index tablespace "FGW_IEJMS";
|
|
grant "RESOURCE","PUBLIC","VTI","SOI" to "FGW_IEJMS";
|
|
alter user "FGW_IEJMS" limit failed_login_attemps unlimited, password_lock_time unlimited, password_grace_time unlimited;
|
|
```
|
|
|
|
|
|
test
|
|
```bash
|
|
disql FGW_V3/'"FgwV3@202403"':35239
|
|
|
|
```
|
|
|
|
```bash
|
|
disql FGW_SECURITY/'"FgwSECURITY@202403"':35239
|
|
```
|
|
|
|
|
|
|
|
|
|
### redis
|
|
|
|
```ip
|
|
10.209.42.15
|
|
```
|
|
|
|
|
|
create redis user
|
|
```bash
|
|
useradd --system --no-create-home --shell /bin/false redis
|
|
```
|
|
create new directory
|
|
```bash
|
|
mkdir -p /data/lib/redis
|
|
mkdir -p /data/log/redis
|
|
|
|
chown redis:redis /data/lib/redis
|
|
chown redis:redis /data/log/redis
|
|
|
|
```
|
|
|
|
snap shot
|
|
```redis.conf
|
|
save 900 1
|
|
save 300 10
|
|
save 60 10000
|
|
```
|
|
|
|
append only
|
|
```redis.conf
|
|
appendonly yes
|
|
appendfilename "appendonly.aof"
|
|
appendfsync everysec
|
|
|
|
```
|
|
|
|
password
|
|
```redis.conf
|
|
requirepass ADSSZM&Pk3CP
|
|
|
|
```
|
|
|
|
max memory
|
|
```redis.conf
|
|
maxmemory 48gb
|
|
maxmemory-policy allkeys-lru
|
|
|
|
```
|
|
|
|
disable dangous command
|
|
```redis.conf
|
|
rename-command FLUSHDB ""
|
|
rename-command FLUSHALL ""
|
|
rename-command KEYS ""
|
|
|
|
```
|
|
|
|
network:
|
|
```redis.conf
|
|
tcp-backlog 511
|
|
tcp-keepalive 300
|
|
|
|
```
|
|
|
|
client timout
|
|
```redis.conf
|
|
timeout 300
|
|
|
|
```
|
|
|
|
sysctl.conf
|
|
```sysctl.conf
|
|
vm.overcommit_memory = 1
|
|
net.core.somaxconn = 1024
|
|
```
|
|
|
|
redis.service
|
|
```service
|
|
[Unit]
|
|
Description=Redis In-Memory Data Store
|
|
After=network.target
|
|
|
|
[Service]
|
|
User=redis
|
|
Group=redis
|
|
ExecStart=/usr/local/bin/redis-server /etc/redis/redis.conf
|
|
ExecStop=/usr/local/bin/redis-cli -a ADSSZM&Pk3CP shutdown
|
|
Restart=always
|
|
LimitNOFILE=65536
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|
|
```
|
|
|
|
|
|
### mongodb
|
|
|
|
```ip
|
|
10.209.42.20
|
|
```
|
|
|
|
/data/app/mongodb
|
|
```docker-run
|
|
MONGODB_VERSION=7.0.9-ubi9
|
|
docker run --name mongodb -p 27017:27017 -d --restart unless-stopped \
|
|
-v /data/app/mongodb/log:/var/log/mongodb:rw \
|
|
-v /data/app/mongodb/data:/var/lib/mongo:rw \
|
|
-v /data/app/mongodb/etc/mongod.conf:/etc/mongod.conf \
|
|
mongodb/mongodb-community-server:$MONGODB_VERSION
|
|
|
|
```
|
|
|
|
|
|
|
|
```start
|
|
cd /data/app/mongodb
|
|
bash docker-run
|
|
```
|
|
|
|
```bash
|
|
docker exec -it mongodb mongosh
|
|
```
|
|
|
|
```script
|
|
use admin
|
|
db.createUser({
|
|
user: 'admin',
|
|
pwd: 'Admin@@20240306',
|
|
roles:[{
|
|
role: 'root',
|
|
db: 'admin'
|
|
}]
|
|
})
|
|
|
|
```
|
|
|
|
```script
|
|
use fgw_v3
|
|
db.createUser({
|
|
user: 'fgw_v3',
|
|
pwd: 'FgwV3@202403',
|
|
roles:[{
|
|
role: 'readWrite',
|
|
db: 'fgw_v3'
|
|
}]
|
|
})
|
|
```
|
|
|
|
|
|
```
|
|
db.auth()
|
|
```
|
|
### minio
|
|
|
|
```ip
|
|
10.209.42.14
|
|
```
|
|
|
|
#### root user:
|
|
```MINIO_ACCESS_KEY
|
|
494f7af356c2a8877337e4533a0bb030
|
|
```
|
|
|
|
```MINIO_SECRET_KEY
|
|
c449aec9cd091cc4d3707c8daa661216932c7e7d37b8b13df48c2e2d5885f8bd
|
|
```
|
|
|
|
#### 配置帐号：
|
|
config mc
|
|
```config
|
|
mc alias set fgw http://10.209.42.14:9000 494f7af356c2a8877337e4533a0bb030 c449aec9cd091cc4d3707c8daa661216932c7e7d37b8b13df48c2e2d5885f8bd --api S3v4
|
|
```
|
|
|
|
full-access.json
|
|
```full-access.json
|
|
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"s3:*"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:s3:::*"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
|
|
```
|
|
|
|
|
|
```bash
|
|
mc admin policy create fgw full-access full-access.json
|
|
```
|
|
|
|
create user secrect
|
|
```bash
|
|
SECRET_KEY=$(openssl rand -hex 16)
|
|
echo "Secret Key: $SECRET_KEY"
|
|
```
|
|
|
|
```access
|
|
minio
|
|
```
|
|
|
|
```secrect
|
|
cb38ff1cbcb882f0735eb8c54342e997
|
|
```
|
|
|
|
|
|
add user
|
|
```policy
|
|
mc admin user add fgw minio cb38ff1cbcb882f0735eb8c54342e997
|
|
mc admin policy attach fgw full-access --user minio
|
|
|
|
```
|
|
|
|
|
|
test user
|
|
```bash
|
|
mc alias set test http://10.209.42.14:9000 minio cb38ff1cbcb882f0735eb8c54342e997 --api S3v4
|
|
```
|
|
|
|
test env 3
|
|
```bash
|
|
|
|
mc alias set fgw-test http://10.209.246.118:9000 minio 8Xd5FLBuX2yH --api S3v4
|
|
|
|
```
|
|
|
|
|
|
|
|
elastice search
|
|
```ipables
|
|
iptables -A INPUT -s 10.209.42.0/24 -j ACCEPT
|
|
```
|
|
|
|
```reset
|
|
Changed password for user apm_system
|
|
PASSWORD apm_system = Cph4L3T6IU1fDJTKILay
|
|
|
|
Changed password for user kibana_system
|
|
PASSWORD kibana_system = iYJUeCxZ78oGnZIyRKUS
|
|
|
|
Changed password for user kibana
|
|
PASSWORD kibana = iYJUeCxZ78oGnZIyRKUS
|
|
|
|
Changed password for user logstash_system
|
|
PASSWORD logstash_system = nySYr3h7QRY6FpxGD0Hu
|
|
|
|
Changed password for user beats_system
|
|
PASSWORD beats_system = uWj7wPbdxXKfoaqmc1Yp
|
|
|
|
Changed password for user remote_monitoring_user
|
|
PASSWORD remote_monitoring_user = jb3B1dmfOjrW76v7JPb1
|
|
|
|
Changed password for user elastic
|
|
PASSWORD elastic = dcGiglCxv9XN8hxItjQ0
|
|
```
|
|
|
|
root user
|
|
```username
|
|
elastic
|
|
```
|
|
|
|
```pasword
|
|
dcGiglCxv9XN8hxItjQ0
|
|
```
|
|
|
|
|
|
```bash
|
|
bin/elasticsearch-setup-passwords auto
|
|
```
|
|
|
|
```20241031
|
|
Changed password for user apm_system
|
|
PASSWORD apm_system = 3Hyygwx4xMpZWtil5NSA
|
|
|
|
Changed password for user kibana_system
|
|
PASSWORD kibana_system = 78ioryvC8zME8dykEyVs
|
|
|
|
Changed password for user kibana
|
|
PASSWORD kibana = 78ioryvC8zME8dykEyVs
|
|
|
|
Changed password for user logstash_system
|
|
PASSWORD logstash_system = Amo1dQtGca1iFJ8oqTah
|
|
|
|
Changed password for user beats_system
|
|
PASSWORD beats_system = YwwS60H73d8IgNHoDPAR
|
|
|
|
Changed password for user remote_monitoring_user
|
|
PASSWORD remote_monitoring_user = AHkrfaE8gV3x7ESJJynq
|
|
|
|
Changed password for user elastic
|
|
PASSWORD elastic = qHnQ4lHtBpidVqdn9L8r
|
|
```
|
|
|
|
```new elastic password
|
|
qHnQ4lHtBpidVqdn9L8r
|
|
```
|
|
|
|
|
|
|
|
```auth
|
|
curl -X GET --user elastic:kL7@fJ5-wN3+ "http://10.209.42.22:9200/_cluster/health?pretty"
|
|
```
|
|
|
|
### docker install
|
|
|
|
```sysctl.conf
|
|
# Set vm.max_map_count to increase memory map areas
|
|
vm.max_map_count=262144
|
|
```
|
|
|
|
|
|
for .env
|
|
```env
|
|
# Password for the 'elastic' user (at least 6 characters)
|
|
ELASTIC_PASSWORD=dcGiglCxv9XN8hxItjQ0
|
|
|
|
# Password for the 'kibana_system' user (at least 6 characters)
|
|
KIBANA_PASSWORD=dcGiglCxv9XN8hxItjQ0
|
|
|
|
# Version of Elastic products
|
|
STACK_VERSION=8.15.2
|
|
|
|
# Set the cluster name
|
|
CLUSTER_NAME=fgw-es
|
|
|
|
# Set to 'basic' or 'trial' to automatically start the 30-day trial
|
|
LICENSE=basic
|
|
|
|
# Port to expose Elasticsearch HTTP API to the host
|
|
ES_PORT=9200
|
|
|
|
# Port to expose Kibana to the host
|
|
KIBANA_PORT=5601
|
|
|
|
# Increase or decrease based on the available host memory (in bytes)
|
|
MEM_LIMIT=2147483648
|
|
```
|
|
|
|
```compose.yml
|
|
services:
|
|
setup:
|
|
image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
|
|
volumes:
|
|
- certs:/usr/share/elasticsearch/config/certs
|
|
user: "0"
|
|
command: >
|
|
bash -c '
|
|
if [ x${ELASTIC_PASSWORD} == x ]; then
|
|
echo "Set the ELASTIC_PASSWORD environment variable in the .env file";
|
|
exit 1;
|
|
elif [ x${KIBANA_PASSWORD} == x ]; then
|
|
echo "Set the KIBANA_PASSWORD environment variable in the .env file";
|
|
exit 1;
|
|
fi;
|
|
if [ ! -f config/certs/ca.zip ]; then
|
|
echo "Creating CA";
|
|
bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
|
|
unzip config/certs/ca.zip -d config/certs;
|
|
fi;
|
|
if [ ! -f config/certs/certs.zip ]; then
|
|
echo "Creating certs";
|
|
echo -ne \
|
|
"instances:\n"\
|
|
" - name: es01\n"\
|
|
" dns:\n"\
|
|
" - es01\n"\
|
|
" - localhost\n"\
|
|
" ip:\n"\
|
|
" - 127.0.0.1\n"\
|
|
> config/certs/instances.yml;
|
|
bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key;
|
|
unzip config/certs/certs.zip -d config/certs;
|
|
fi;
|
|
echo "Setting file permissions"
|
|
chown -R root:root config/certs;
|
|
find . -type d -exec chmod 750 \{\} \;;
|
|
find . -type f -exec chmod 640 \{\} \;;
|
|
echo "Waiting for Elasticsearch availability";
|
|
until curl -s --cacert config/certs/ca/ca.crt https://es01:9200 | grep -q "missing authentication credentials"; do sleep 30; done;
|
|
echo "Setting kibana_system password";
|
|
until curl -s -X POST --cacert config/certs/ca/ca.crt -u "elastic:${ELASTIC_PASSWORD}" -H "Content-Type: application/json" https://es01:9200/_security/user/kibana_system/_password -d "{\"password\":\"${KIBANA_PASSWORD}\"}" | grep -q "^{}"; do sleep 10; done;
|
|
echo "All done!";
|
|
'
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "[ -f config/certs/es01/es01.crt ]"]
|
|
interval: 1s
|
|
timeout: 5s
|
|
retries: 120
|
|
|
|
es01:
|
|
image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
|
|
volumes:
|
|
- certs:/usr/share/elasticsearch/config/certs
|
|
- esdata:/usr/share/elasticsearch/data
|
|
ports:
|
|
- ${ES_PORT}:9200
|
|
environment:
|
|
- node.name=es01
|
|
- cluster.name=${CLUSTER_NAME}
|
|
- discovery.type=single-node
|
|
- ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
|
|
- bootstrap.memory_lock=true
|
|
- xpack.security.enabled=true
|
|
- xpack.security.http.ssl.enabled=true
|
|
- xpack.security.http.ssl.key=certs/es01/es01.key
|
|
- xpack.security.http.ssl.certificate=certs/es01/es01.crt
|
|
- xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
|
|
- xpack.security.transport.ssl.enabled=true
|
|
- xpack.security.transport.ssl.key=certs/es01/es01.key
|
|
- xpack.security.transport.ssl.certificate=certs/es01/es01.crt
|
|
- xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
|
|
- xpack.security.transport.ssl.verification_mode=certificate
|
|
- xpack.license.self_generated.type=${LICENSE}
|
|
mem_limit: ${MEM_LIMIT}
|
|
ulimits:
|
|
memlock:
|
|
soft: -1
|
|
hard: -1
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
|
|
]
|
|
interval: 10s
|
|
timeout: 10s
|
|
retries: 120
|
|
|
|
kibana:
|
|
depends_on:
|
|
es01:
|
|
condition: service_healthy
|
|
image: docker.elastic.co/kibana/kibana:${STACK_VERSION}
|
|
volumes:
|
|
- certs:/usr/share/kibana/config/certs
|
|
- kibanadata:/usr/share/kibana/data
|
|
ports:
|
|
- ${KIBANA_PORT}:5601
|
|
environment:
|
|
- SERVERNAME=kibana
|
|
- ELASTICSEARCH_HOSTS=https://es01:9200
|
|
- ELASTICSEARCH_USERNAME=kibana_system
|
|
- ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
|
|
- ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/ca/ca.crt
|
|
- SERVER_PUBLICBASEURL=http://localhost:5601
|
|
mem_limit: ${MEM_LIMIT}
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"curl -s -I http://localhost:5601 | grep -q 'HTTP/1.1 302 Found'",
|
|
]
|
|
interval: 10s
|
|
timeout: 10s
|
|
retries: 120
|
|
|
|
volumes:
|
|
certs:
|
|
driver: local
|
|
esdata:
|
|
driver: local
|
|
kibanadata:
|
|
driver: local
|
|
```
|
|
|
|
|
|
without ssl bitnami
|
|
```compose.yml
|
|
services:
|
|
es01:
|
|
image: bitnami/elasticsearch:${STACK_VERSION}
|
|
volumes:
|
|
- ./data:/bitnami/elasticsearch/data
|
|
ports:
|
|
- ${ES_PORT}:9200
|
|
environment:
|
|
- node.name=es01
|
|
- cluster.name=${CLUSTER_NAME}
|
|
- discovery.type=single-node
|
|
- ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
|
|
- bootstrap.memory_lock=true
|
|
- xpack.security.enabled=false
|
|
- xpack.security.http.ssl.enabled=false
|
|
mem_limit: ${MEM_LIMIT}
|
|
ulimits:
|
|
memlock:
|
|
soft: -1
|
|
hard: -1
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"curl -s http://localhost:9200 | grep -q 'missing authentication credentials'",
|
|
]
|
|
interval: 10s
|
|
timeout: 10s
|
|
retries: 120
|
|
kibana:
|
|
depends_on:
|
|
es01:
|
|
condition: service_healthy
|
|
image: docker.elastic.co/kibana/kibana:${STACK_VERSION}
|
|
volumes:
|
|
- certs:/usr/share/kibana/config/certs
|
|
- ./kibanadata:/usr/share/kibana/data
|
|
ports:
|
|
- ${KIBANA_PORT}:5601
|
|
environment:
|
|
- SERVERNAME=kibana
|
|
- ELASTICSEARCH_HOSTS=http://es01:9200
|
|
- ELASTICSEARCH_USERNAME=kibana_system
|
|
- ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
|
|
- SERVER_PUBLICBASEURL=http://localhost:5601
|
|
mem_limit: ${MEM_LIMIT}
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"curl -s -I http://localhost:5601 | grep -q 'HTTP/1.1 302 Found'",
|
|
]
|
|
interval: 10s
|
|
timeout: 10s
|
|
retries: 120
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
docker stack
|
|
|
|
```docker-stack.yml
|
|
version: '3.3'
|
|
services:
|
|
fgw-gateway:
|
|
image: "10.209.42.16/fgw/fgw3-gateway:v1.0.1"
|
|
environment:
|
|
JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-gateway -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms256m -Xmx512m"
|
|
TZ: Asia/Shanghai
|
|
networks:
|
|
- fgw
|
|
ports:
|
|
- "8080:8080"
|
|
deploy:
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: on-failure
|
|
fgw-manage:
|
|
image: "10.209.42.16/fgw/fgw-manage:v1.0.1"
|
|
environment:
|
|
JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-manage -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms256m -Xmx512m"
|
|
TZ: Asia/Shanghai
|
|
working_dir: /usr/local
|
|
networks:
|
|
- fgw
|
|
deploy:
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: on-failure
|
|
fgw-review:
|
|
image: "10.209.42.16/fgw/fgw-review:v1.0.2"
|
|
environment:
|
|
JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-review -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms512m -Xmx1024m"
|
|
TZ: Asia/Shanghai
|
|
working_dir: /usr/local
|
|
networks:
|
|
- fgw
|
|
deploy:
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: on-failure
|
|
fgw-knowbase:
|
|
image: "10.209.42.16/fgw/fgw-knowbase:v1.0.1"
|
|
environment:
|
|
JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-knowbase.yaml -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms256m -Xmx512m"
|
|
TZ: Asia/Shanghai
|
|
working_dir: /usr/local
|
|
networks:
|
|
- fgw
|
|
deploy:
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: on-failure
|
|
fgw-portal:
|
|
image: "10.209.42.16/fgw/mbp-portal:v1.0.1"
|
|
environment:
|
|
JAVA_OPTS: "-Dfile.encoding=UTF-8 -Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-portal -Dspring.cloud.nacos.config.file-extension=Properties -XX:PermSize=64m -XX:MaxPermSize=128m -Xms512m -Xmx1024m"
|
|
TZ: Asia/Shanghai
|
|
working_dir: /usr/local
|
|
volumes:
|
|
- /etc/dm_svc.conf:/etc/dm_svc.conf:rw
|
|
networks:
|
|
- fgw
|
|
deploy:
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: on-failure
|
|
#fgw-knowledge-base:
|
|
# image: "10.209.42.16/fgw/gq-knowledge-base:v1.0.1"
|
|
# environment:
|
|
# JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-knowledge-base.yaml -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms256m -Xmx512m"
|
|
# TZ: Asia/Shanghai
|
|
# working_dir: /usr/local
|
|
# networks:
|
|
# - fgw
|
|
# deploy:
|
|
# replicas: 1
|
|
# restart_policy:
|
|
# condition: on-failure
|
|
|
|
fgw-ibls-server:
|
|
image: "10.209.42.16/fgw/ibls:v1.0.1"
|
|
environment:
|
|
JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-ibls-server -Dspring.cloud.nacos.config.file-extension=Properties -XX:PermSize=64m -XX:MaxPermSize=128m -Xms256m -Xmx512m"
|
|
TZ: Asia/Shanghai
|
|
working_dir: /usr/local
|
|
networks:
|
|
- fgw
|
|
deploy:
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: on-failure
|
|
fgw-gdal:
|
|
image: "10.209.42.16/fgw/fgw-gdal:v1.0.1"
|
|
environment:
|
|
JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-gdal -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms256m -Xmx512m"
|
|
TZ: Asia/Shanghai
|
|
working_dir: /usr/local
|
|
networks:
|
|
- fgw
|
|
deploy:
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: on-failure
|
|
fgw-stat:
|
|
image: "10.209.42.16/fgw/fgw-stat:v1.0.1"
|
|
environment:
|
|
JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-stat -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms256m -Xmx512m"
|
|
TZ: Asia/Shanghai
|
|
working_dir: /usr/local
|
|
networks:
|
|
- fgw
|
|
deploy:
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: on-failure
|
|
fgw-interf:
|
|
image: "10.209.42.16/fgw/fgw-interf:v1.0.1"
|
|
environment:
|
|
JAVA_OPTS: "-Dspring.cloud.nacos.config.server-addr=10.209.42.21:8848 -Dspring.cloud.nacos.username=nacos -Dspring.cloud.nacos.password=HU#5Zzf7AtReUF3Hg -Dspring.application.name=fgw-interf -Dspring.cloud.nacos.config.file-extension=yaml -XX:PermSize=64m -XX:MaxPermSize=128m -Xms512m -Xmx1024m"
|
|
TZ: Asia/Shanghai
|
|
working_dir: /usr/local
|
|
networks:
|
|
- fgw
|
|
deploy:
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: on-failure
|
|
networks:
|
|
fgw:
|
|
|
|
```
|
|
|
|
deploy:
|
|
```bash
|
|
#/bin/bash
|
|
docker stack deploy -c docker-stack.yml fgw
|
|
```
|
|
network debug
|
|
```bash
|
|
docker run -it --net container:<container_name> nicolaka/netshoot
|
|
```
|
|
|
|
|
|
docker swarm init
|
|
|
|
```console
|
|
docker swarm init --advertise-addr 10.209.42.11
|
|
```
|
|
|
|
```console
|
|
docker swarm join --token SWMTKN-1-4435npmxyxw2tm53qxlgxqdgizzodncymybjgbs0twi304cn81-enkjvrmapt8jhmyyudiums564 10.209.42.11:2377
|
|
```
|
|
|
|
|
|
```lookbusy
|
|
|
|
lookbusy -c 70 -n 2 占用两个 CPU 核心各 70%
|
|
lookbusy -c 60-70 -r curve 占用所有 CPU 核心在 60%-70% 上下浮动
|
|
lookbusy -c 60-70 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu以60分钟为周期，30分钟是峰值，使用率在60%-70%上下浮动
|
|
```
|
|
|
|
新要求：
|
|
cpu 平均>8 峰值>60
|
|
|
|
|
|
```bash
|
|
#!/bin/bash
|
|
/usr/local/bin/lookbusy -c 20-70 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu &
|
|
```
|
|
|
|
|
|
每 3000 毫秒，循环释放并分配 1024MB 内存
|
|
```
|
|
/usr/local/bin/lookbusy -m 1024MB -M 3000 &
|
|
```
|
|
|
|
|
|
|
|
```
|
|
fallocate -l 240G /data/dmdata/tmp/data.zip
|
|
```
|
|
|
|
|
|
```
|
|
curl -X PUT -u elastic:WdH7XbbpModi6FAWdP99 "localhost:9200/my-index?pretty" -H 'Content-Type: application/json' -d'
|
|
{
|
|
"settings": {
|
|
"analysis": {
|
|
"filter": {
|
|
"jieba_stop": {
|
|
"type": "stop",
|
|
"stopwords_path": "stopwords/stopwords.txt"
|
|
},
|
|
"jieba_synonym": {
|
|
"type": "synonym",
|
|
"synonyms_path": "synonyms/synonyms.txt"
|
|
}
|
|
},
|
|
"analyzer": {
|
|
"my_ana": {
|
|
"tokenizer": "jieba_index",
|
|
"filter": [
|
|
"lowercase",
|
|
"jieba_stop",
|
|
"jieba_synonym"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
'
|
|
|
|
|
|
|
|
|
|
|
|
|
|
curl -X PUT -u elastic:WdH7XbbpModi6FAWdP99 "localhost:9200/my-index/_analyze?pretty" -H 'Content-Type: application/json' -d'
|
|
PUT jieba_index/_analyze
|
|
{
|
|
"analyzer" : "my_ana",
|
|
"text" : "黄河之水天上来"
|
|
}
|
|
'
|
|
```
|
|
|
|
|
|
二期 mysql root账号恢复
|
|
|
|
```
|
|
sudo -u mysql mysqld --skip-grant-tables &
|
|
```
|
|
|
|
```
|
|
mysql -u root
|
|
```
|
|
|
|
|
|
```
|
|
INSERT INTO mysql.user (Host, User, authentication_string, plugin, ssl_cipher, x509_issuer, x509_subject)
|
|
VALUES ('localhost', 'root', '', 'mysql_native_password', '', '', '');
|
|
|
|
```
|
|
|
|
```
|
|
ALTER USER 'root'@'localhost' IDENTIFIED BY 'dei<xee7eefuo)Ch';
|
|
GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION;
|
|
FLUSH PRIVILEGES;
|
|
```
|
|
|
|
new root password for mysql:
|
|
|
|
```
|
|
dei<xee7eefuo)Ch
|
|
```
|
|
|
|
|
|
硬盘使用：
|
|
|
|
```
|
|
[[ -d /data/tmp ]] || mkdir /data/tmp
|
|
fallocate -l 60G /data/tmp/data.zip
|
|
```
|
|
|
|
|
|
内存：
|
|
```
|
|
/usr/local/bin/lookbusy -m 4096MB -M 3000 &
|
|
```
|
|
|
|
|
|
root:
|
|
```
|
|
8VLtg#ZYA@AJSFJcPM
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
```bash
|
|
curl -s -L 'http://10.196.165.48:8001/agent/download?k=167921544e17b7a554bfc40d1fdf7bb26293f962&group=166&protocol=0&root=true&runAccount=root&userAdd=false&app=0&container=0' | bash
|
|
```
|
|
|
|
|
|
|
|
不能安装：
|
|
|
|
14
|
|
15
|
|
16
|
|
18
|
|
19
|
|
20
|
|
21
|
|
22
|
|
|
|
|
|
|
|
|