# 基础配置

```
#!/bin/bash
docker stop mysql
docker stop redis
docker rm mysql
docker rm redis
systemctl stop mysqld
systemctl disable mysqld
#改主机名
read -p "请输入主机名": x
echo "$x"> /etc/hostname
hostname "$x"
hostnamectl
reboot
#该主机hosts
read -p "请输入hosts1": x
echo "$x">> /etc/hosts
echo "$x">>/data/mysql/etc/hosts
read -p "请输入hosts2": y
echo "$y">> /etc/hosts
echo "$y">>/data/mysql/etc/hosts
#mysql配置
mkdir -p /data/mysql/conf
mkdir -p /data/mysql/etc
mkdir -p /data/mysql/mysql


```

# 数据库配置

```
主机

echo "[client]
default-character-set=utf8
[mysqld]
lower_case_table_names=1
character-set-server=utf8
max_connections=400
default_authentication_plugin=mysql_native_password
sql_mode ='STRICT_TRANS_TABLES'
secure_file_priv=/var/lib/mysql

plugin-load=rpl_semi_sync_master=semisync_master.so 
rpl_semi_sync_master_enabled=1 
plugin-load=rpl_semi_sync_slave=semisync_slave.so 
rpl_semi_sync_slave_enabled=1 

default-storage-engine=INNODB
log-bin=mysql-bin
relay_log=relay-bin
log-error=/var/lib/mysql/error.log
pid-file        = /var/run/mysqld/mysqld.pid
socket          = /var/run/mysqld/mysqld.sock

server-id=1">/data/mysql/conf/my.cnf

docker run -d --name mysql --hostname mysql -v /data/mysql/conf/my.cnf:/etc/mysql/my.cnf:rw -v /data/mysql/etc/hosts:/etc/hosts:rw -v /data/mysql/mysql:/var/lib/mysql  -e MYSQL_ROOT_PASSWORD=qwert123 -p 3306:3306 mysql
docker exec -it mysql bash

sed -i  "11,14s/^/#&/" /data/mysql/conf/my.cnf
#添加免密登录
sed '8 i\'skip-grant-tables'' /data/mysql/conf/my.cnf

自己操作
docker  restart mysql
进入mysql容器：
docker exec -it mysql bash
进入数据库里
mysql -uroot  -p
回车
进入数据库
use mysql;
将密码置空
update user set authentication_string='' where user='root';

sed -i '11,14s/.//' /data/mysql/conf/my.cnf
sed -i '9d' /data/mysql/conf/my.cnf

再进入mysql容器：
docker exec -it mysql bash
进入数据库里
mysql -uroot  -p
回车
进入数据库
use mysql;
alter user 'root'@'localhost' identified by '123456';
更新配置
flush privileges; 
```

```
先删除用户
drop user replicate;
创建复制账号
create user 'replicate'@'%' identified by '123456';
授权给用户
grant replication slave on *.* to 'replicate'@'%';
flush privileges;
更改操作配置
show plugins;
set global rpl_semi_sync_master_enabled=1;
set global rpl_semi_sync_slave_enabled=1;
show variables like '%rpl_semi_sync_master_enabled%';
show variables like '%rpl_semi_sync_slave_enabled%';
set global enforce_gtid_consistency='on';
set global gtid_mode='off_permissive';
set global gtid_mode='on_permissive';
set global gtid_mode='on';
show variables like '%gtid_mode%';

```

```
设置主库：
change master to master_host='主机IP',master_port=3306,master_user='replicate',master_password='123456',master_auto_position=1;

change master to master_host='172.16.0.13',master_port=3306,master_user='replicate',master_password='123456',master_auto_position=1;

ALTER USER 'replicate'@'%' IDENTIFIED WITH mysql_native_password BY "123456";
ALTER USER 'replicate'@'%' IDENTIFIED WITH mysql_native_password BY "o@2M<!>GT3y)7ma1m3!8";

CREATE USER 'replicate'@'%' IDENTIFIED BY '123456';
GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'replicate'@'%';\

set password for 'replicate'@'%' =password('123456'); 

UPDATE mysql.user SET Repl_slave_priv='Y' WHERE User='replicate';

设置从库：
change master to master_host='备机IP',master_port=3306,master_user='replicate',master_password='123456',master_auto_position=1;

```

```
检查半同步复制规则， 默认为`AFTER_SYNC`为无损半同步复制并且启动slave  
show variables like "%rpl_semi_sync_master_wait_point%";
start slave;
show slave status\G


binlog或者gtid报错
reset master;
```

![image-20230207161034108](https://ye5201314-1312898079.cos.ap-guangzhou.myqcloud.com/image-20230207161034108.png)

```
docker  restart mysql
以下报错
```

![image-20230207161142615](https://ye5201314-1312898079.cos.ap-guangzhou.myqcloud.com/image-20230207161142615.png)

```
设置业务数据（仅需在一台主库操作）    （一般已经操作过了）
创建安全管理中心库：
create database management;
创建订购页面库：
create database privatecloud;
创建业务账号：
create user 'aqzq'@'%' identified by 'qwert123';
业务账号授权：
grant all on management.* to 'aqzq'@'%';
grant all on privatecloud.* to 'aqzq'@'%';
刷新权限： 
flush privileges;
上传结构文件到mysql容器中，
docker cp management.sql mysql:/root
docker cp privatecloud0329.sl mysql:/root

查找.sql文件
find / -name  *.sql
use management;
source /root/managementxxx.sql;
use privatecloud;
source /root/privatecloudxxx.sql;
```

# 安装redis

1. 创建安装目录：

```
mkdir -p /data/redis/conf
mkdir -p /data/redis/data
```

2. 编辑redis配置文件：

   ```
   vi /data/redis/conf/redis.conf
   ```

   * 主节点

```
port 6379
masterauth qwert123
requirepass qwert123
protected-mode no
daemonize no
appendonly yes
```

* 从节点

```
port 6379
masterauth qwert123
requirepass qwert123
protected-mode no
daemonize no
appendonly yes
slaveof 192.168.54.134 6379   
           （主机IP）
```

3. 运行redis：

```
docker run -id --restart=always --name redis -p 6379:6379 -v /data/redis/conf/redis.conf:/usr/local/etc/redis/redis.conf -v /data/redis/data:/data redis redis-server /usr/local/etc/redis/redis.conf
```

* 进入redis：

  ```
  docker exec -it redis bash
  
  redis-cli -a qwert123
  
  info replication
  
  ```
  

# 设置keepalived双机主备

1. 关闭selinux

   `setenforce 0`

2. 编辑selinux配置

   ```
   vi /etc/selinux/config
   
   改参数：SELINUX=disabled
   ```

3. 编辑keepalived配置文件

   ```
   vi /etc/keepalived/keepalived.conf
   ```

   ```
   主：
   ! Configuration File for keepalived
   
   global_defs {
      notification_email {
        acassen@firewall.loc
        failover@firewall.loc
        sysadmin@firewall.loc
      }
      notification_email_from Alexandre.Cassen@firewall.loc
      smtp_server 192.168.200.1  #邮箱IP随便写
      smtp_connect_timeout 30
      router_id LVS_DEVEL
      vrrp_skip_check_adv_addr
      vrrp_strict
      vrrp_garp_interval 0
      vrrp_gna_interval 0
   }
   
   vrrp_script chk_service {
       script "/etc/keepalived/chk_service.sh"
       interval 10
       weight -20
   }
   
   vrrp_instance VI_1 {
       state MASTER
       interface eth0
       virtual_router_id 51
       priority 100
       advert_int 10
       authentication {
           auth_type PASS
           auth_pass chinagdn123
       }
       track_script {
           chk_service
       }
       virtual_ipaddress {
           192.168.54.138/24   #（虚拟IP）
       }
       notify_master "/etc/keepalived/service_control.sh up &> /var/log/keepalivedchange.log"
       notify_backup "/etc/keepalived/service_control.sh stop &> /var/log/keepalivedchange.log "
   }
   ```

```
备：
! Configuration File for keepalived

global_defs {
   notification_email {
     acassen@firewall.loc
     failover@firewall.loc
     sysadmin@firewall.loc
   }
   notification_email_from Alexandre.Cassen@firewall.loc
   smtp_server 192.168.200.1     #邮箱IP
   smtp_connect_timeout 30
   router_id LVS_DEVEL
   vrrp_skip_check_adv_addr
   vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
}

#vrrp_script chk_service {
#    script "/etc/keepalived/chk_service.sh"
#    interval 10
#    weight -20
#}

vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 51
    priority 90
    advert_int 10
    authentication {
        auth_type PASS
        auth_pass chinagdn123
    }
    track_script {
        chk_service
    }
    virtual_ipaddress {
        192.168.54.138/24    #虚拟IP
    }
    notify_master "/etc/keepalived/service_control.sh up &> /var/log/keepalivedchange.log"
    notify_backup "/etc/keepalived/service_control.sh stop &> /var/log/keepalivedchange.log"
}
```

5. 创建服务检测脚本：

   ```
   cat /etc/keepalived/chk_service.sh
   ```

   

   ```
   #!/bin/bash
   dockerps=`docker ps | grep -e frontend -e securemanagement -e privatecloud | wc -l`
   if [ ${dockerps} -eq 3 ] ; then
     status=0
   else
     status=1
   fi
   exit $status
   ```

6. 创建服务控制脚本：

   ```
   cat /etc/keepalived/service_control.sh
   ```

```
#!/bin/bash
case "$1" in
    up)
        docker exec redis redis-cli -a qwert123 SLAVEOF NO ONE
        docker-compose -f /data/docker-compose.yml up -d
    ;;
    down)
        docker-compose -f /data/docker-compose.yml down
    ;;
    stop)
        docker-compose -f /data/docker-compose.yml stop
        docker exec redis redis-cli -a qwert123 SLAVEOF 192.168.54.136 6379
    ;;
    *)
        echo "Usage:$0 up|down|stop"
    ;;
esac
```

7. 增加运行权限

   ```
   chmod +x /etc/keepalived/service_control.sh
   chmod +x /etc/keepalived/chk_service.sh
   ```

# 设置主备文件同步

1. 编辑rsyncd配置文件，在最后加入：

```
log file = /var/log/rsyncd.log
pid file = /var/run/rsyncd.pid
lock file = /var/run/rsync.lock
port = 873
read only = yes
max connections =10
secrets file = /etc/rsyncd.secrets
[share]
comment = share_data
path = /data/secureManagement/share
ignore errors
auth users = aqzq
hosts allow = 192.168.54.136
hosts deny = *
list = false
```

3. 主备服务器创建同步文件夹：`mkdir /data/secureManagement/share`
4. 创建同步认证文件，填写账号密码信息：`cat /etc/rsyncd.secrets`

```
aqzq:qwert123
```

5. 修改rsync服务端认证文件权限：`chmod 600 /etc/rsyncd.secrets`
6. 启动服务：`systemctl restart rsyncd`
7. 创建同步认证文件,只需填密码：`cat /etc/rsyncd.password`

```
qwert123
```

7. 修改客户端密码文件权限：`chmod 600 /etc/rsyncd.password`
8. 测试客户端同步：`rsync -av --delete rsync://aqzq@192.168.54.134/share /data/secureManagement/share/ --password-file=/etc/rsyncd.password`
9. 将同步命令加入定时任务,1分钟同步一次：`crontab -e`

```
备机：
*/1 * * * * rsync -av --delete rsync://aqzq@192.168.54.134/share /data/secureManagement/share/ --password-file=/etc/rsyncd.password
主机：
*/1 * * * * rsync -av --delete rsync://aqzq@192.168.54.136/share /data/secureManagement/share/ --password-file=/etc/rsyncd.password
```

# 运行安全管理中心容器

```
在运行主机导入镜像文件：
docker load < privatesecuremanagement2.0.95.tar
mkdir -p /data/secureManagement
创建运行输出文件
touch /data/secureManagement/nohup.out
创建日志映射目录
mkdir /data/secureManagement/management-logs
创建容器环境变量文件
vi /data/secureManagement/env-file
```



```
注意修改ip
SERVER_PORT=8888
JOB=true
REDIS_PASSWORD=qwert123
REDIS_PORT=6379
REDIS_HOST=192.168.54.134
MYSQL_HOST=192.168.54.134
MYSQL_PORT=3306
MYSQL_USERNAME=aqzq
MYSQL_PASSWORD=qwert123

FRONT_SERVER_PORT=443
SERVER_IP=192.168.54.134
IS_SINGLE=true
SINGLE_PORT=8888

#CAS_EXTRANET_SERVER_IP=
#CAS_EXTRANET_SERVER_PORT=
#CAS_INTRANET_SERVER_IP=
#CAS_INTRANET_SERVER_PORT=
#CLOUD_RESOURCE_IP=
#CLOUD_RESOURCE_PORT=
#CLOUD_MANAGE_IP=
#CLOUD_MANAGE_PORT=
#CLOUD_APPID=
#CLOUD_APP_SECRET=
```

# 运行订购页面容器

* ```
  在运行主机导入镜像文件：
  docker load < privatecloud:2.0.8p1b6.tar
  mkdir -p /data/privateCloud
  创建运行输出文件
  touch /data/privateCloud/nohup.out
  创建日志映射目录
  mkdir /data/privateCloud/management-logs
  创建容器环境变量文件
  vi /data/privateCloud/env-file
  ```

  

  ```
  SERVER_PORT=8899
  REDIS_PASSWORD=qwert123
  REDIS_NODES_HOST=
  REDIS_HOST=本机
  REDIS_PORT=6379
  MYSQL_HOST=本机
  MYSQL_PORT=3306
  MYSQL_USERNAME=aqzq
  MYSQL_PASSWORD=qwert123
  MQ_SERVER_IP=10.83.171.42
  MQ_SERVER_PORT=5672
  MQ_USERNAME=ecscloud
  MQ_PASSWORD=l2av9pbxUPDuRvnoRhu8VLq
  MQ_VIRTUAL_HOST=ecscloud
  
  BIND_EIP=false
  CLOUD_RESOURCE_IP=10.83.171.45
  CLOUD_RESOURCE_PORT=51181
  CLOUD_MANAGE_IP=10.83.171.45
  CLOUD_MANAGE_PORT=51181
  SECURITY_MANAGE_IP=本机
  SECURITY_MANAGE_PORT=8888
  CAS_EXTRANET_SERVER_IP=134.178.201.11
  CAS_EXTRANET_SERVER_PORT=10091
  
  ZSTACK_OPEN=false
  ZSTACK_SERVER_IP=10.254.254.10
  ZSTACK_SERVER_PORT=8080
  ZSTACK_USERNAME=admin
  ZSTACK_PASSWORD=Feng13622239904
  ZSTACK_AK=Pab9qkhXqdaoqthsdEEA
  ZSTACK_SK=pit3eEh6AQSS3JhB0UMw3kSbXY43RirDsGv16C1X
  CLOUD_APPID=ff
  CLOUD_APP_SECRET=dd
  ```

# 安装Nginx

1. 创建目录

```
mkdir -p /data/nginx/conf
mkdir -p /data/nginx/html
mkdir -p /data/nginx/log
```

2. 将前端文件复制到/data/nginx/html/secureManagement
3. 将ssl文件复制到/data/nginx/html/ssl
4. 将配置文件nginx.conf复制到/data/nginx/conf，配置文件内容：

```
worker_processes  1;
events {
    worker_connections  1024;
}
http {
     include       mime.types;
     default_type  application/octet-stream;
     sendfile        on; 
     keepalive_timeout  65;
     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                          '$status $body_bytes_sent "$http_referer" '
                          '"$http_user_agent" "$http_x_forwarded_for"';
     access_log  logs/access.log  main;
     gzip on;
     gzip_min_length 1k;
     gzip_comp_level 1;
     gzip_types text/plain application/javascript application/x-javascript text/css application/xml text/javascript application/x-httpd-php image/jpeg image/gif image/png application/vnd.ms-fontobject font/ttf font/opentype font/x-woff image/svg+xml;
     gzip_vary on;
     gzip_disable "MSIE [1-6]\.";
     gzip_buffers 32 4k;
     gzip_http_version 1.0;

     upstream management{
         server 本机:8888;
     }

     server {
        listen       443 ssl;
        server_name  localhost;
        proxy_set_header Accept-Encoding "";
        ssl_certificate  /usr/share/nginx/html/ssl/server.crt;
        ssl_certificate_key /usr/share/nginx/html/ssl/server.key; 
	#ssl_certificate /etc/ssl/server.crt;
	#ssl_certificate_key /etc/ssl/server.key;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1.1 TLSv1.2;
        add_header 'Access-Control-Allow-Origin' $http_origin;
	add_header 'Access-Control-Allow-Credentials' 'true';
	add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        # Vue路由模式为history需添加的配置
        location / {
            if (!-e $request_filename) {
                rewrite ^(.*)$ /index.html?s=$1 last;
                break;
            }
	   proxy_read_timeout 300;  # 秒
            root  /usr/share/nginx/html/secureManagement;
            index  index.html;
        }

        location /management/ {
	   proxy_read_timeout 300;  # 秒
            proxy_pass https://management;
        }
        location /swagger-ui.html {
            proxy_pass https://management;
        }
        location /swagger-resources {
            proxy_pass https://management;
        }
        location /swagger {
            proxy_pass https://management;
        }
        location /webjars {
            proxy_pass https://management;
        }
        location /v2 {
            proxy_pass https://management;
        }
        location /druid {
            proxy_pass https://management;
        }
        # 完整版使用到Activiti工作流设计器需加入以下配置
        location /modeler.html {
            proxy_pass https://management;
         }
        location /editor-app {
            proxy_pass https://management;
        }
        # 以上为完整版需要加的反向代理转发路径规则

        # 获取真实IP以及Websocket需添加的配置
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header REMOTE-HOST $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        
        # 客户端Body大小限制（文件上传大小限制配置）
        client_max_body_size 5m;
	error_log  logs/error.log  error;
        error_page   500 502 503 504 404  /50x.html;
        location = /50x.html {
            root   html;
        }

    }
}

```

# 运行服务

1. 创建docker-compose:

   ```
   vi /data/docker-compose.yml
   ```

2. 

   ```
   version: '3'
   services:
     frontend:
       image: nginx
       ports: 
           - "443:443"
       volumes:
           - /data/nginx/conf/nginx.conf:/etc/nginx/nginx.conf:rw
           - /data/nginx/html:/usr/share/nginx/html:rw
           - /data/nginx/log:/etc/nginx/logs:rw
       depends_on: 
         - securemanagement
     securemanagement:
       image: securemanagement:2.0.4p1b2
       ports:
           - "8888:8888"
       volumes:
           - /data/secureManagement/nohup.out:/data/package/nohup.out
           - /data/secureManagement/management-logs:/data/package/management-logs:rw
           - /data/secureManagement/share:/data/package/share
       env_file: /data/secureManagement/env-file
     privatecloud:
       image: privatecloud:2.0.4p1b2
       ports:
           - "8899:8899"
       volumes:
           - /data/privateCloud/nohup.out:/data/package/nohup.out
       env_file: /data/privateCloud/env-file
   ```

3. 仅在主服务器运行：

   ```
   docker-compose -f /data/docker-compose.yml up -d
   重启
   docker-compose -f /data/docker-compose.yml restart
   
   ```

4. 运行keepalived：

   ```
   service keepalived restart
   ```

5. 打开keepalivdVIP的https443服务查看运行状态，确保页面能够加载验证码