zhaolei
16f134e328
核心功能: - 6 层检测管线: L0 结构分析 → L1 ClamAV → L2 文档深度检测 → L3 关键词匹配 → L4 YARA → L5 PE/二进制 - FastAPI + PostgreSQL + Redis + Docker Compose 架构 - 客户端 HMAC-SHA256 签名鉴权 + 限流 + 幂等性 - 控制台 UI (登录/Dashboard/诊断中心/策略管理/任务列表/测试中心/产品介绍页) - 三层诊断定时器 (error_scan 30s / db_aggregate 30s / container_check 5min) 并发与稳定性修复: - 诊断定时器 Redis 时间槽位锁 (多 worker 同一槽位只有一个执行) - JSONL 存储 fcntl 跨进程排他锁 + 容错解码 + 原子重写 - 移除 SQLite fallback, 统一 PostgreSQL - API_CLIENTS 脱敏为环境变量, .env 已 .gitignore
145 lines
4.3 KiB
Bash
145 lines
4.3 KiB
Bash
#!/usr/bin/env bash
|
||
# =============================================================================
|
||
# MeshSafe 生产一键部署脚本（Debian/Ubuntu/CentOS，需已装好 Docker + docker compose）
|
||
# =============================================================================
|
||
#
|
||
# 用法：
|
||
# bash scripts/deploy_prod.sh # 首次部署（自动建目录 + 起全部服务 + 建表 + 起 Nginx）
|
||
# bash scripts/deploy_prod.sh rebuild # 改了 app/ 代码后重建 api 镜像 + 重启
|
||
# bash scripts/deploy_prod.sh stop # 全部停掉
|
||
# bash scripts/deploy_prod.sh restart # 全部重启
|
||
# bash scripts/deploy_prod.sh status # 看各服务状态
|
||
# bash scripts/deploy_prod.sh logs api # 看 api 日志
|
||
#
|
||
# 前提：
|
||
# 1. 已装 Docker ≥ 24 + docker compose v2
|
||
# 2. .env 文件已准备好（或用 .env.example 复制后填必填项）
|
||
# 3. 有外网权限（拉镜像 + pip install）—— 无外网的话 ClamAV 签名库走光闸离线导入
|
||
# =============================================================================
|
||
set -euo pipefail
|
||
|
||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||
PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||
cd "$PROJECT_DIR"
|
||
|
||
RED='\033[0;31m'
|
||
GRN='\033[0;32m'
|
||
YEL='\033[1;33m'
|
||
NC='\033[0m'
|
||
log() { echo -e "${GRN}[meshsafe]${NC} $*"; }
|
||
warn() { echo -e "${YEL}[meshsafe]${NC} ⚠️ $*"; }
|
||
err() { echo -e "${RED}[meshsafe]${NC} ✗ $*"; exit 1; }
|
||
|
||
# ---------- 子命令 ----------
|
||
ACTION="${1:-deploy}"
|
||
|
||
case "$ACTION" in
|
||
status)
|
||
docker compose ps
|
||
echo
|
||
for svc in postgres redis clamav api nginx; do
|
||
echo -n "$svc: "
|
||
docker inspect --format '{{.State.Health.Status}}' meshsafe-$svc 2>/dev/null \
|
||
|| echo "未运行"
|
||
done
|
||
exit 0
|
||
;;
|
||
stop)
|
||
log "停止所有服务..."
|
||
docker compose down
|
||
log "✓ 已停止"
|
||
exit 0
|
||
;;
|
||
restart)
|
||
log "重启所有服务..."
|
||
docker compose down
|
||
docker compose up -d
|
||
sleep 3
|
||
docker compose ps
|
||
exit 0
|
||
;;
|
||
logs)
|
||
svc="${2:-api}"
|
||
docker compose logs -f --tail 100 "$svc"
|
||
exit 0
|
||
;;
|
||
rebuild)
|
||
log "重建 api 镜像并重启..."
|
||
docker compose build api
|
||
docker compose up -d api
|
||
log "✓ 重建完成"
|
||
exit 0
|
||
;;
|
||
deploy)
|
||
log "首次部署 MeshSafe"
|
||
;;
|
||
*)
|
||
err "未知子命令: $ACTION 可用: deploy|rebuild|restart|stop|status|logs"
|
||
;;
|
||
esac
|
||
|
||
# ---------- 前置检查 ----------
|
||
command -v docker >/dev/null 2>&1 || err "未检测到 docker"
|
||
docker compose version >/dev/null 2>&1 || err "未检测到 docker compose v2"
|
||
[ -f docker-compose.yml ] || err "当前目录没有 docker-compose.yml"
|
||
[ -f .env ] || { warn "没找到 .env，从 .env.example 复制一个"; cp .env.example .env; }
|
||
|
||
# ---------- 准备目录 ----------
|
||
log "准备数据目录..."
|
||
mkdir -p data/{postgres,redis,clamav,logs,temp}
|
||
chmod -R 755 data
|
||
warn "PostgreSQL 数据目录权限首次启动会自动 chown"
|
||
|
||
# ---------- 起基础设施 ----------
|
||
log "起 postgres + redis..."
|
||
docker compose up -d postgres redis
|
||
sleep 5
|
||
|
||
# ---------- 起 ClamAV ----------
|
||
log "起 clamav（首次启动尝试 freshclam，内网会静默降级）..."
|
||
docker compose up -d clamav
|
||
sleep 3
|
||
|
||
# ---------- 起 API ----------
|
||
log "构建 + 起 api..."
|
||
docker compose up -d --build api
|
||
sleep 3
|
||
|
||
# ---------- 建表 + 管理员 + 初始策略 ----------
|
||
log "建表 + admin + 初始策略..."
|
||
docker compose exec api python scripts/init_db.py
|
||
|
||
# ---------- 起 Nginx ----------
|
||
log "起 nginx..."
|
||
docker compose up -d nginx
|
||
sleep 2
|
||
|
||
# ---------- 健康检查 ----------
|
||
log "健康检查..."
|
||
HTTP_OK=0
|
||
for i in $(seq 1 10); do
|
||
if curl -sf http://localhost:8443/api/v1/health >/dev/null 2>&1; then
|
||
HTTP_OK=1
|
||
break
|
||
fi
|
||
sleep 2
|
||
done
|
||
|
||
echo
|
||
echo "============================================"
|
||
if [ "$HTTP_OK" -eq 1 ]; then
|
||
log "✅ 部署成功！"
|
||
echo
|
||
echo " 控制台: http://$(hostname -I | awk '{print $1}'):44380/console/login"
|
||
echo " 用户名: admin"
|
||
echo " 密码: ${MESHSAFE_ADMIN_PASSWORD:-admin123_change_me}"
|
||
echo
|
||
echo " 健康检查: http://$(hostname -I | awk '{print $1}'):44380/health"
|
||
echo "============================================"
|
||
else
|
||
warn "⚠️ API 还没就绪，等一会再查: docker compose logs api"
|
||
echo
|
||
echo " 查看状态: bash scripts/deploy_prod.sh status"
|
||
echo " 查看日志: bash scripts/deploy_prod.sh logs api"
|
||
fi
|