#!/bin/bash #用途：双机部署安管平台脚本 #注意：部署完后自行使用检查脚本检查是否部署成功 #作者：叶海淋 #联系方式：13149093270 echo -e "\033[32m *****双机部署安装开始***** \033[0m" cat <>/root/cipher.txt #环境初始化 echo -e "\033[46;37m 环境初始化安装开始 \033[0m\n" sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/sysconfig/selinux setenforce 0 mkdir -p /data/mysql/conf mkdir -p /data/mysql/etc mkdir -p /data/mysql/mysql mkdir -p /data/secureManagement/share cp /root/json.json /data/secureManagement/share #docker安装 tar -zxvf /root/docker-*.tgz>/dev/null 2>&1 mv /root/docker/* /usr/bin/ echo '[Unit] Description=Docker Application Container Engine Documentation=https://docs.docker.com After=network-online.target firewalld.service Wants=network-online.target [Service] Type=notify ExecStart=/usr/bin/dockerd ExecReload=/bin/kill -s HUP $MAINPID LimitNOFILE=infinity LimitNPROC=infinity TimeoutStartSec=0 Delegate=yes KillMode=process Restart=on-failure StartLimitBurst=3 StartLimitInterval=60s [Install] WantedBy=multi-user.target'>/usr/lib/systemd/system/docker.service systemctl daemon-reload >/dev/null 2>&1 systemctl enable docker>/dev/null 2>&1 systemctl start docker>/dev/null 2>&1 docker info>/dev/null 2>&1 #docker-compose安装 cp -r /root/docker-compose-linux-x86_64 /usr/local/bin/docker-compose chmod +x /usr/local/bin/docker-compose docker-compose -v>/dev/null 2>&1 #改主机名 case $state in 1|master) #主机 echo "$hostname"> /etc/hostname hostnamectl set-hostname "$hostname">/dev/null 2>&1 hostname>/dev/null 2>&1 ;; 2|slave) #备机 echo "$standbyname"> /etc/hostname hostnamectl set-hostname "$standbyname">/dev/null 2>&1 hostname>/dev/null 2>&1 ;; *) esac #该主机hosts echo "$Host $hostname"> /etc/hosts echo "$Standby $standbyname"> /etc/hosts docker load -i /root/nginx.tar>/dev/null 2>&1 docker load -i /root/mysql.tar>/dev/null 2>&1 docker load -i /root/redis.tar>/dev/null 2>&1 #mysql8.0.26配置 echo -e "\033[46;37m mysql8.0.26安装开始 \033[0m\n" case $state in 1|master) #主机 echo "[client] default-character-set=utf8 [mysqld] lower_case_table_names=1 character-set-server=utf8 max_connections=400 default_authentication_plugin=mysql_native_password sql_mode ='STRICT_TRANS_TABLES' secure_file_priv=/var/lib/mysql #plugin-load=rpl_semi_sync_master=semisync_master.so #rpl_semi_sync_master_enabled=1 #plugin-load=rpl_semi_sync_slave=semisync_slave.so #rpl_semi_sync_slave_enabled=1 default-storage-engine=INNODB log-bin=mysql-bin relay_log=relay-bin log-error=/var/lib/mysql/error.log pid-file = /var/run/mysqld/mysqld.pid socket = /var/run/mysqld/mysqld.sock server-id=1">/data/mysql/conf/my.cnf ;; 2|slave) #备机 echo "[client] default-character-set=utf8 [mysqld] lower_case_table_names=1 character-set-server=utf8 max_connections=400 default_authentication_plugin=mysql_native_password sql_mode ='STRICT_TRANS_TABLES' secure_file_priv=/var/lib/mysql #plugin-load=rpl_semi_sync_master=semisync_master.so #rpl_semi_sync_master_enabled=1 #plugin-load=rpl_semi_sync_slave=semisync_slave.so #rpl_semi_sync_slave_enabled=1 default-storage-engine=INNODB log-bin=mysql-bin relay_log=relay-bin log-error=/var/lib/mysql/error.log pid-file = /var/run/mysqld/mysqld.pid socket = /var/run/mysqld/mysqld.sock server-id=2">/data/mysql/conf/my.cnf ;; *) esac #创建容器 docker run -d --name mysql --hostname mysql -v /etc/localtime:/etc/localtime -v /data/mysql/conf/my.cnf:/etc/mysql/my.cnf:rw -v /data/mysql/mysql:/var/lib/mysql -e MYSQL_ROOT_PASSWORD=$new -p 3306:3306 mysql:8.0.26 >/dev/null 2>&1 sleep 60s #创建复制账号 docker exec mysql mysql -uroot -p$new 2>/dev/null -e "create user 'replicate'@'%' identified by '$repl';grant replication slave on *.* to 'replicate'@'%';flush privileges;">/dev/null 2>&1 #设置权限 docker exec mysql mysql -uroot -p$new 2>/dev/null -e "install plugin rpl_semi_sync_master soname 'semisync_master.so';" -e "install plugin rpl_semi_sync_slave soname 'semisync_slave.so';">/dev/null 2>&1 docker exec mysql mysql -uroot -p$new -e "set global rpl_semi_sync_master_enabled=1;">/dev/null 2>&1 docker exec mysql mysql -uroot -p$new -e "set global rpl_semi_sync_slave_enabled=1;">/dev/null 2>&1 docker exec mysql mysql -uroot -p$new -e "set global enforce_gtid_consistency='on';">/dev/null 2>&1 docker exec mysql mysql -uroot -p$new -e "set global gtid_mode='off_permissive';">/dev/null 2>&1 docker exec mysql mysql -uroot -p$new -e "set global gtid_mode='on_permissive';">/dev/null 2>&1 docker exec mysql mysql -uroot -p$new -e "set global gtid_mode='on';">/dev/null 2>&1 docker exec mysql mysql -uroot -p$new -e "show variables like '%gtid_mode%';">/dev/null 2>&1 case $state in 1|master) docker exec mysql mysql -uroot -p$new 2>/dev/null -e "change master to master_host='$Standby',master_port=3306,master_user='replicate',master_password='$repl',master_auto_position=1;">/dev/null 2>&1 ;; 2|slave) docker exec mysql mysql -uroot -p$new 2>/dev/null -e "change master to master_host='$Host',master_port=3306,master_user='replicate',master_password='$repl',master_auto_position=1;">/dev/null 2>&1 ;; *) esac echo -e "\033[46;37m 数据库同步开始 \033[0m\n" read -p "请输入yes或no：" answer while true; do if [[ $answer == "yes" ]]; then echo -e "数据库正在开始同步\n" docker exec mysql mysql -uroot -p$new 2>/dev/null -e "start slave;show slave status\G">/dev/null 2>&1 break elif [[ $answer == "no" ]]; then echo -e "\033[41;37m 您拒绝了数据库同步 \033[0m\n" exit 0 else read -p "输入有误，请重新输入yes或no：" answer fi done #redis echo -e "\033[46;37m redis安装开始 \033[0m\n" mkdir -p /data/redis/conf mkdir -p /data/redis/data case $state in 1|master) echo "port 6379 masterauth $redis requirepass $redis protected-mode no daemonize no appendonly yes">/data/redis/conf/redis.conf ;; 2|slave) echo "port 6379 masterauth $redis requirepass $redis protected-mode no daemonize no appendonly yes slaveof $Host 6379">/data/redis/conf/redis.conf ;; *) esac docker run -id --restart=always --name redis -p 6379:6379 -v /data/redis/conf/redis.conf:/usr/local/etc/redis/redis.conf -v /etc/localtime:/etc/localtime -v /data/redis/data:/data redis redis-server /usr/local/etc/redis/redis.conf>/dev/null 2>&1 #keepalived安装 wk=`cat /proc/net/dev | awk '{print $1}' | awk -F ':' '/^e.*:/ {print $1}' | head -n1` echo -e "\033[46;37m keepalived安装开始 \033[0m\n" rpm -ivh --force /root/mypackages/*.rpm>/dev/null 2>&1 #创建服务检测脚本 echo '#!/bin/bash dockerps=`docker ps | grep -e frontend -e securemanagement -e privatecloud | wc -l` if [ ${dockerps} -eq 3 ] ; then status=0 else status=1 fi exit $status'>/etc/keepalived/chk_service.sh #创建服务控制脚本 case $state in 1|master) echo '#!/bin/bash case "$1" in up) docker exec redis redis-cli -a $redis SLAVEOF NO ONE docker-compose -f /data/docker-compose.yml up -d ;; down) docker-compose -f /data/docker-compose.yml down ;; stop) docker-compose -f /data/docker-compose.yml stop docker exec redis redis-cli -a $redis SLAVEOF $Standby 6379 ;; *) echo "Usage:$0 up|down|stop" ;; esac' >/etc/keepalived/service_control.sh ;; 2|slave) echo '#!/bin/bash case "$1" in up) docker exec redis redis-cli -a $redis SLAVEOF NO ONE docker-compose -f /data/docker-compose.yml up -d ;; down) docker-compose -f /data/docker-compose.yml down ;; stop) docker-compose -f /data/docker-compose.yml stop docker exec redis redis-cli -a $redis SLAVEOF $Host 6379 ;; *) echo "Usage:$0 up|down|stop" ;; esac' >/etc/keepalived/service_control.sh ;; *) esac chmod +x /etc/keepalived/service_control.sh chmod +x /etc/keepalived/chk_service.sh sleep 5s case $state in 1|master) echo "! Configuration File for keepalived global_defs { notification_email { acassen@firewall.loc failover@firewall.loc sysadmin@firewall.loc } notification_email_from Alexandre.Cassen@firewall.loc smtp_server 192.168.200.1 smtp_connect_timeout 30 router_id LVS_DEVEL vrrp_skip_check_adv_addr vrrp_strict vrrp_garp_interval 0 vrrp_gna_interval 0 } vrrp_script chk_service { script "/etc/keepalived/chk_service.sh" interval 10 weight -20 } vrrp_instance VI_1 { state MASTER interface $wk virtual_router_id 68 priority 100 advert_int 10 authentication { auth_type PASS auth_pass chinagdn123 } track_script { chk_service } virtual_ipaddress { $vip/24 } notify_master \"/etc/keepalived/service_control.sh up &> /var/log/keepalivedchange.log\" notify_backup \"/etc/keepalived/service_control.sh stop &> /var/log/keepalivedchange.log\" }">/etc/keepalived/keepalived.conf ;; 2|slave) echo "! Configuration File for keepalived global_defs { notification_email { acassen@firewall.loc failover@firewall.loc sysadmin@firewall.loc } notification_email_from Alexandre.Cassen@firewall.loc smtp_server 192.168.200.1 smtp_connect_timeout 30 router_id LVS_DEVEL vrrp_skip_check_adv_addr vrrp_strict vrrp_garp_interval 0 vrrp_gna_interval 0 } #vrrp_script chk_service { # script "/etc/keepalived/chk_service.sh" # interval 10 # weight -20 #} vrrp_instance VI_1 { state BACKUP interface $wk virtual_router_id 68 priority 80 advert_int 10 authentication { auth_type PASS auth_pass chinagdn123 } track_script { chk_service } virtual_ipaddress { $vip/24 } notify_master \"/etc/keepalived/service_control.sh up &> /var/log/keepalivedchange.log\" notify_backup \"/etc/keepalived/service_control.sh stop &> /var/log/keepalivedchange.log\" }">/etc/keepalived/keepalived.conf ;; *) esac service keepalived start>/dev/null 2>&1 service keepalived restart>/dev/null 2>&1 #rsyncd安装 echo -e "\033[46;37m rsyncd安装开始 \033[0m\n" case $state in 1|master) echo "log file = /var/log/rsyncd.log pid file = /var/run/rsyncd.pid lock file = /var/run/rsync.lock port = 873 read only = yes max connections =10 secrets file = /etc/rsyncd.secrets [share] comment = share_data path = /data/secureManagement/share ignore errors auth users = aqzq hosts allow = $Standby hosts deny = * list = false">/etc/rsyncd.conf ;; 2|slave) echo "log file = /var/log/rsyncd.log pid file = /var/run/rsyncd.pid lock file = /var/run/rsync.lock port = 873 read only = yes max connections =10 secrets file = /etc/rsyncd.secrets [share] comment = share_data path = /data/secureManagement/share ignore errors auth users = aqzq hosts allow = $Host hosts deny = * list = false">/etc/rsyncd.conf ;; *) esac echo "aqzq:$rsyncd_password">/etc/rsyncd.secrets chmod 600 /etc/rsyncd.secrets echo "$rsyncd_password">/etc/rsyncd.password chmod 600 /etc/rsyncd.password systemctl restart rsyncd>/dev/null 2>&1 case $state in 1|master) echo "*/1 * * * * rsync -av --delete rsync://aqzq@$Standby/share /data/secureManagement/share/ --password-file=/etc/rsyncd.password" >/opt/1.txt && crontab /opt/1.txt && rm -rf /opt/1.txt ;; 2|slave) echo "*/1 * * * * rsync -av --delete rsync://aqzq@$Host/share /data/secureManagement/share/ --password-file=/etc/rsyncd.password" >/opt/1.txt && crontab /opt/1.txt && rm -rf /opt/1.txt ;; *) esac #安全管理中心 echo -e "\033[46;37m 安全管理中心安装开始 \033[0m\n" docker load -i /root/privatesecuremanagement*.tar>/dev/null 2>&1 mkdir -p /data/secureManagement touch /data/secureManagement/nohup.out mkdir -p /data/secureManagement/management-logs case $state in 1|master) echo "SERVER_PORT=8888 JOB=true REDIS_PASSWORD=$redis REDIS_PORT=6379 REDIS_HOST=$Host MYSQL_HOST=$Host MYSQL_PORT=3306 MYSQL_USERNAME=aqzq MYSQL_PASSWORD=$aq FRONT_SERVER_PORT=443 SERVER_IP=$Host IS_SINGLE=true SINGLE_PORT=8888 #CAS_EXTRANET_SERVER_IP= #CAS_EXTRANET_SERVER_PORT= #CAS_INTRANET_SERVER_IP= #CAS_INTRANET_SERVER_PORT= #CLOUD_RESOURCE_IP= #CLOUD_RESOURCE_PORT= #CLOUD_MANAGE_IP= #CLOUD_MANAGE_PORT= #CLOUD_APPID= #CLOUD_APP_SECRET=">/data/secureManagement/env-file ;; 2|slave) echo "SERVER_PORT=8888 JOB=true REDIS_PASSWORD=$redis REDIS_PORT=6379 REDIS_HOST=$Standby MYSQL_HOST=$Standby MYSQL_PORT=3306 MYSQL_USERNAME=aqzq MYSQL_PASSWORD=$aq FRONT_SERVER_PORT=443 SERVER_IP=$Standby IS_SINGLE=true SINGLE_PORT=8888 #CAS_EXTRANET_SERVER_IP= #CAS_EXTRANET_SERVER_PORT= #CAS_INTRANET_SERVER_IP= #CAS_INTRANET_SERVER_PORT= #CLOUD_RESOURCE_IP= #CLOUD_RESOURCE_PORT= #CLOUD_MANAGE_IP= #CLOUD_MANAGE_PORT= #CLOUD_APPID= #CLOUD_APP_SECRET=">/data/secureManagement/env-file ;; *) esac echo -e "\033[46;37m 订购页面安装开始 \033[0m\n" docker load -i /root/privatecloud*.tar>/dev/null 2>&1 mkdir -p /data/privateCloud touch /data/privateCloud/nohup.out mkdir -p /data/privateCloud/management-logs case $state in 1|master) echo "SERVER_PORT=8899 REDIS_PASSWORD=$redis REDIS_NODES_HOST= REDIS_HOST=$Host REDIS_PORT=6379 MYSQL_HOST=$Host MYSQL_PORT=3306 MYSQL_USERNAME=aqzq MYSQL_PASSWORD=$aq MQ_SERVER_IP=10.83.171.42 MQ_SERVER_PORT=5672 MQ_USERNAME=ecscloud MQ_PASSWORD=l2av9pbxUPDuRvnoRhu8VLq MQ_VIRTUAL_HOST=ecscloud BIND_EIP=false CLOUD_RESOURCE_IP=10.83.171.45 CLOUD_RESOURCE_PORT=51181 CLOUD_MANAGE_IP=10.83.171.45 CLOUD_MANAGE_PORT=51181 SECURITY_MANAGE_IP=$Host SECURITY_MANAGE_PORT=8888 CAS_EXTRANET_SERVER_IP=134.178.201.11 CAS_EXTRANET_SERVER_PORT=10091 ZSTACK_OPEN=false ZSTACK_SERVER_IP=10.254.254.10 ZSTACK_SERVER_PORT=8080 ZSTACK_USERNAME=admin ZSTACK_PASSWORD=Feng13622239904 ZSTACK_AK=Pab9qkhXqdaoqthsdEEA ZSTACK_SK=pit3eEh6AQSS3JhB0UMw3kSbXY43RirDsGv16C1X CLOUD_APPID=ff CLOUD_APP_SECRET=dd">/data/privateCloud/env-file ;; 2|slave) echo "SERVER_PORT=8899 REDIS_PASSWORD=$redis REDIS_NODES_HOST= REDIS_HOST=$Standby REDIS_PORT=6379 MYSQL_HOST=$Standby MYSQL_PORT=3306 MYSQL_USERNAME=aqzq MYSQL_PASSWORD=$aq MQ_SERVER_IP=10.83.171.42 MQ_SERVER_PORT=5672 MQ_USERNAME=ecscloud MQ_PASSWORD=l2av9pbxUPDuRvnoRhu8VLq MQ_VIRTUAL_HOST=ecscloud BIND_EIP=false CLOUD_RESOURCE_IP=10.83.171.45 CLOUD_RESOURCE_PORT=51181 CLOUD_MANAGE_IP=10.83.171.45 CLOUD_MANAGE_PORT=51181 SECURITY_MANAGE_IP=$Standby SECURITY_MANAGE_PORT=8888 CAS_EXTRANET_SERVER_IP=134.178.201.11 CAS_EXTRANET_SERVER_PORT=10091 ZSTACK_OPEN=false ZSTACK_SERVER_IP=10.254.254.10 ZSTACK_SERVER_PORT=8080 ZSTACK_USERNAME=admin ZSTACK_PASSWORD=Feng13622239904 ZSTACK_AK=Pab9qkhXqdaoqthsdEEA ZSTACK_SK=pit3eEh6AQSS3JhB0UMw3kSbXY43RirDsGv16C1X CLOUD_APPID=ff CLOUD_APP_SECRET=dd">/data/privateCloud/env-file ;; *) esac #nginx安装 echo -e "\033[46;37m nginx安装开始 \033[0m\n" mkdir -p /data/nginx/conf mkdir -p /data/nginx/html/ssl mkdir -p /data/nginx/log mkdir -p /data/nginx/html/secureManagement/ cp -r /root/dist/* /data/nginx/html/secureManagement/>/dev/null 2>&1 cp -r /root/*.key /data/nginx/html/ssl cp -r /root/*.pem /data/nginx/html/ssl cp -r /root/nginx.conf /data/nginx/conf/ case $state in 1|master) sed -i "s/.*8888.*/server ${Host}:8888;/g" /data/nginx/conf/nginx.conf ;; 2|slave) sed -i "s/.*8888.*/server ${Standby}:8888;/g" /data/nginx/conf/nginx.conf ;; *) esac #创建docker-compose echo "version: '3' services: frontend: image: nginx ports: - "443:443" volumes: - /data/nginx/conf/nginx.conf:/etc/nginx/nginx.conf:rw - /data/nginx/html:/usr/share/nginx/html:rw - /data/nginx/log:/etc/nginx/logs:rw - /etc/localtime:/etc/localtime:rw depends_on: - securemanagement securemanagement: image: privatesecuremanagement:3.0.12 ports: - "8888:8888" volumes: - /data/secureManagement/nohup.out:/data/package/nohup.out - /data/secureManagement/management-logs:/data/package/management-logs:rw - /data/secureManagement/share:/data/package/share - /etc/localtime:/etc/localtime:rw env_file: /data/secureManagement/env-file privatecloud: image: privatecloud:3.0.11 ports: - "8899:8899" volumes: - /etc/localtime:/etc/localtime:rw - /data/privateCloud/nohup.out:/data/package/nohup.out env_file: /data/privateCloud/env-file">/data/docker-compose.yml sleep 60s #导入业务数据 case $state in 1|master) echo -e "\033[36m 开始导入业务数据 \033[0m\n" docker cp privatecloud-2023.sql mysql:/root docker cp management-2023.sql mysql:/root docker cp t_permission.sql mysql:/root docker cp t_role.sql mysql:/root docker cp t_role_permission.sql mysql:/root docker exec mysql mysql -uroot -p$new 2>/dev/null -e "create database management;" -e "create database privatecloud;" -e "create user 'aqzq'@'%' identified by '$aq';" -e "grant all on management.* to 'aqzq'@'%';" -e "grant all on privatecloud.* to 'aqzq'@'%';" -e "flush privileges;">/dev/null docker exec mysql mysql -uroot -p$new 2>/dev/null -e "use management;source /root/management-2023.sql;source /root/t_permission.sql;source /root/t_role.sql;source /root/t_role_permission.sql;use privatecloud;source /root/privatecloud-2023.sql;">/dev/null ;; 2|slave) echo -e "\033[36m 备机不需导入业务数据 \033[0m\n" ;; *) esac sleep 30s echo -e "\033[36m 安管服务启动 \033[0m\n" case $state in 1|master) docker-compose -f /data/docker-compose.yml up -d ;; 2|slave) echo -e "\033[36m 主机正在启动服务 \033[0m\n" ;; *) esac