feat(deploy): add center host docker compose stack for git, registry and s3 hosting
This commit is contained in:
zetaloop
@@ -0,0 +1,2 @@
|
|||||||
|
GITEA_DOMAIN=git.juwan.xhttp.zip
|
||||||
|
RUNNER_TOKEN=
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
/secrets/
|
||||||
|
/garage/garage.toml
|
||||||
|
/zot/htpasswd
|
||||||
|
/.env
|
||||||
@@ -0,0 +1,100 @@
|
|||||||
|
# 管理机部署
|
||||||
|
|
||||||
|
Zot（容器仓库）、Garage（对象存储）、Gitea（代码 + Actions Runner）、Caddy（HTTPS 反代 + 业务入口），全部在同一台 center 机器上以 Docker Compose 运行。业务服务部署在另一台 k01 机器上，公网流量经由 center 的 Caddy 反代到 k01 上的 envoy-gateway NodePort。
|
||||||
|
|
||||||
|
部署机参考：center（Vultr High Frequency / 1 vCPU / 1 GB RAM / 32 GB NVMe）。
|
||||||
|
|
||||||
|
## 前置条件
|
||||||
|
|
||||||
|
- Docker Engine 与 compose v2
|
||||||
|
- `apache2-utils`（提供 `htpasswd` 命令，用于给 Zot 生成 bcrypt 密码）
|
||||||
|
- DNS：`git` / `registry` / `s3` / `juwan` 四条 A 记录全部指向 66.135.5.101，灰云直连
|
||||||
|
- 防火墙入站规则允许 TCP 80、443、UDP 443
|
||||||
|
|
||||||
|
## 首次部署
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd deploy/center
|
||||||
|
|
||||||
|
# 生成所有随机密码与 token，渲染 garage.toml / zot.htpasswd / .env
|
||||||
|
bash init.sh
|
||||||
|
|
||||||
|
# 启动 Caddy + Zot + Garage + Gitea
|
||||||
|
docker compose up -d caddy zot garage gitea
|
||||||
|
|
||||||
|
# 创建 Gitea 管理员
|
||||||
|
docker compose exec -u git gitea gitea admin user create \
|
||||||
|
--username admin \
|
||||||
|
--email admin@juwan.xhttp.zip \
|
||||||
|
--password "$(cat secrets/gitea-admin-password)" \
|
||||||
|
--admin --must-change-password=false
|
||||||
|
|
||||||
|
# 在浏览器打开 https://git.juwan.xhttp.zip
|
||||||
|
# → Site Administration → Actions → Runners → 生成 runner token
|
||||||
|
# → 把 token 写入 .env 的 RUNNER_TOKEN
|
||||||
|
# → 回到终端执行：
|
||||||
|
docker compose up -d runner
|
||||||
|
|
||||||
|
# 初始化 Garage：创建 layout、两个 bucket、生成 access key
|
||||||
|
bash garage/bootstrap.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
`bootstrap.sh` 最后会打印 S3 连接信息，其中 `S3_ACCESS_KEY` / `S3_SECRET_KEY` 留给 k01 的 `objectstory-rpc` 和 CNPG backup 配置。
|
||||||
|
|
||||||
|
## 访问入口
|
||||||
|
|
||||||
|
| 子域 | 内容 |
|
||||||
|
| -------------------------- | ------------------------------------------------- |
|
||||||
|
| `git.juwan.xhttp.zip` | Gitea 代码仓库 |
|
||||||
|
| `registry.juwan.xhttp.zip` | Zot 镜像仓库 + 内置 zui 浏览器 |
|
||||||
|
| `s3.juwan.xhttp.zip` | Garage S3 API |
|
||||||
|
| `juwan.xhttp.zip` | 业务前端，Caddy 反代至 k01 envoy-gateway NodePort |
|
||||||
|
|
||||||
|
## 凭据与认证
|
||||||
|
|
||||||
|
`init.sh` 会把所有密码写入 `secrets/` 目录（权限 600，`.gitignore` 已排除）。`garage/garage.toml` 和 `zot/htpasswd` 由模板渲染生成，同样不在仓库中跟踪。
|
||||||
|
|
||||||
|
### Zot
|
||||||
|
|
||||||
|
匿名用户可浏览 zui、`docker pull` 镜像。推送或删除需要登录：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker login registry.juwan.xhttp.zip -u admin -p "$(cat secrets/zot-admin-password)"
|
||||||
|
```
|
||||||
|
|
||||||
|
### Gitea
|
||||||
|
|
||||||
|
注册链接默认关闭。管理员登录后通过以下方式创建新用户：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker compose exec -u git gitea gitea admin user create \
|
||||||
|
--username NAME --email MAIL --password PASS
|
||||||
|
```
|
||||||
|
|
||||||
|
## Runner
|
||||||
|
|
||||||
|
通过宿主 `/var/run/docker.sock` 启动 job 容器。Workflow 里写 `runs-on: ubuntu-latest` 时，runner 会拉取 `gitea/runner-images:ubuntu-latest-slim` 作为临时工作环境。`docker build` 命令在此容器内调用宿主的 dockerd，生成的镜像可直接推送到本机 Zot。
|
||||||
|
|
||||||
|
## 日常维护
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker compose restart # 全部重启
|
||||||
|
docker compose logs -f caddy # 查看 Caddy 日志（含 ACME 信息）
|
||||||
|
docker compose logs -f runner # 查看 Runner 日志（含 job 输出）
|
||||||
|
|
||||||
|
# 彻底重置：删除所有 Compose 卷与 init.sh 生成的本地文件
|
||||||
|
docker compose down -v
|
||||||
|
rm -rf secrets garage/garage.toml zot/htpasswd
|
||||||
|
```
|
||||||
|
|
||||||
|
持久化数据所在的 Docker 卷：
|
||||||
|
|
||||||
|
| 卷 | 内容 |
|
||||||
|
| -------------------- | ------------------------ |
|
||||||
|
| `juwan-caddy-data` | ACME 证书 |
|
||||||
|
| `juwan-caddy-config` | Caddy 自动配置 |
|
||||||
|
| `juwan-zot-data` | 容器镜像层 |
|
||||||
|
| `juwan-garage-meta` | Garage 元数据 |
|
||||||
|
| `juwan-garage-data` | S3 对象数据 |
|
||||||
|
| `juwan-gitea-data` | Git 仓库与 SQLite 数据库 |
|
||||||
|
| `juwan-runner-data` | Runner 注册信息 |
|
||||||
@@ -0,0 +1,63 @@
|
|||||||
|
{
|
||||||
|
email admin@juwan.xhttp.zip
|
||||||
|
}
|
||||||
|
|
||||||
|
(common_log) {
|
||||||
|
log {
|
||||||
|
output stdout
|
||||||
|
format console {
|
||||||
|
time_format common_log
|
||||||
|
time_local
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
(stream_proxy) {
|
||||||
|
flush_interval -1
|
||||||
|
transport http {
|
||||||
|
read_timeout 0
|
||||||
|
write_timeout 0
|
||||||
|
response_header_timeout 0
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
git.juwan.xhttp.zip {
|
||||||
|
import common_log
|
||||||
|
request_body {
|
||||||
|
max_size 2GB
|
||||||
|
}
|
||||||
|
reverse_proxy http://gitea:3000 {
|
||||||
|
import stream_proxy
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
registry.juwan.xhttp.zip {
|
||||||
|
import common_log
|
||||||
|
request_body {
|
||||||
|
max_size 2GB
|
||||||
|
}
|
||||||
|
reverse_proxy http://zot:5000 {
|
||||||
|
import stream_proxy
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
s3.juwan.xhttp.zip {
|
||||||
|
import common_log
|
||||||
|
request_body {
|
||||||
|
max_size 5GB
|
||||||
|
}
|
||||||
|
reverse_proxy http://garage:3900 {
|
||||||
|
import stream_proxy
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
juwan.xhttp.zip {
|
||||||
|
import common_log
|
||||||
|
reverse_proxy http://140.82.15.92:30080 {
|
||||||
|
lb_policy round_robin
|
||||||
|
health_uri /healthz
|
||||||
|
health_interval 10s
|
||||||
|
fail_duration 30s
|
||||||
|
import stream_proxy
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,117 @@
|
|||||||
|
services:
|
||||||
|
# ==================== 反代 ====================
|
||||||
|
caddy:
|
||||||
|
image: caddy:2.11.2-alpine
|
||||||
|
container_name: juwan-caddy
|
||||||
|
restart: unless-stopped
|
||||||
|
ports:
|
||||||
|
- "80:80"
|
||||||
|
- "443:443"
|
||||||
|
- "443:443/udp"
|
||||||
|
volumes:
|
||||||
|
- ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
|
||||||
|
- caddy-data:/data
|
||||||
|
- caddy-config:/config
|
||||||
|
depends_on:
|
||||||
|
- gitea
|
||||||
|
- zot
|
||||||
|
- garage
|
||||||
|
|
||||||
|
# ==================== 容器仓库 ====================
|
||||||
|
zot:
|
||||||
|
image: ghcr.io/project-zot/zot:v2.1.16
|
||||||
|
container_name: juwan-zot
|
||||||
|
restart: unless-stopped
|
||||||
|
command: ["serve", "/etc/zot/config.json"]
|
||||||
|
volumes:
|
||||||
|
- ./zot/config.json:/etc/zot/config.json:ro
|
||||||
|
- ./zot/htpasswd:/etc/zot/htpasswd:ro
|
||||||
|
- zot-data:/var/lib/registry
|
||||||
|
expose:
|
||||||
|
- "5000"
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:5000/v2/ >/dev/null || exit 1"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 5
|
||||||
|
start_period: 20s
|
||||||
|
|
||||||
|
# ==================== S3 对象存储 ====================
|
||||||
|
garage:
|
||||||
|
image: dxflrs/garage:v2.3.0
|
||||||
|
container_name: juwan-garage
|
||||||
|
restart: unless-stopped
|
||||||
|
command: ["/garage", "server"]
|
||||||
|
volumes:
|
||||||
|
- ./garage/garage.toml:/etc/garage.toml:ro
|
||||||
|
- garage-meta:/var/lib/garage/meta
|
||||||
|
- garage-data:/var/lib/garage/data
|
||||||
|
expose:
|
||||||
|
- "3900"
|
||||||
|
- "3901"
|
||||||
|
- "3902"
|
||||||
|
- "3903"
|
||||||
|
|
||||||
|
# ==================== Git 服务 ====================
|
||||||
|
gitea:
|
||||||
|
image: docker.gitea.com/gitea:1.26.1
|
||||||
|
container_name: juwan-gitea
|
||||||
|
restart: unless-stopped
|
||||||
|
environment:
|
||||||
|
USER_UID: "1000"
|
||||||
|
USER_GID: "1000"
|
||||||
|
GITEA__database__DB_TYPE: sqlite3
|
||||||
|
GITEA__server__DOMAIN: ${GITEA_DOMAIN}
|
||||||
|
GITEA__server__ROOT_URL: https://${GITEA_DOMAIN}/
|
||||||
|
GITEA__server__PROTOCOL: http
|
||||||
|
GITEA__server__HTTP_PORT: "3000"
|
||||||
|
GITEA__server__DISABLE_SSH: "true"
|
||||||
|
GITEA__service__DISABLE_REGISTRATION: "true"
|
||||||
|
GITEA__security__INSTALL_LOCK: "true"
|
||||||
|
GITEA__actions__ENABLED: "true"
|
||||||
|
volumes:
|
||||||
|
- gitea-data:/data
|
||||||
|
- /etc/timezone:/etc/timezone:ro
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
expose:
|
||||||
|
- "3000"
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3000/api/healthz >/dev/null || exit 1"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 5
|
||||||
|
start_period: 30s
|
||||||
|
|
||||||
|
# ==================== CI/CD 执行器 ====================
|
||||||
|
runner:
|
||||||
|
image: gitea/act_runner:0.6.1
|
||||||
|
container_name: juwan-runner
|
||||||
|
restart: unless-stopped
|
||||||
|
environment:
|
||||||
|
GITEA_INSTANCE_URL: http://gitea:3000
|
||||||
|
GITEA_RUNNER_REGISTRATION_TOKEN: ${RUNNER_TOKEN}
|
||||||
|
GITEA_RUNNER_NAME: juwan-center
|
||||||
|
GITEA_RUNNER_LABELS: ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest-slim
|
||||||
|
CONFIG_FILE: /data/config.yaml
|
||||||
|
volumes:
|
||||||
|
- runner-data:/data
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
|
depends_on:
|
||||||
|
gitea:
|
||||||
|
condition: service_healthy
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
caddy-data:
|
||||||
|
name: juwan-caddy-data
|
||||||
|
caddy-config:
|
||||||
|
name: juwan-caddy-config
|
||||||
|
zot-data:
|
||||||
|
name: juwan-zot-data
|
||||||
|
garage-meta:
|
||||||
|
name: juwan-garage-meta
|
||||||
|
garage-data:
|
||||||
|
name: juwan-garage-data
|
||||||
|
gitea-data:
|
||||||
|
name: juwan-gitea-data
|
||||||
|
runner-data:
|
||||||
|
name: juwan-runner-data
|
||||||
Executable
+31
@@ -0,0 +1,31 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
GARAGE="docker compose exec -T garage /garage"
|
||||||
|
|
||||||
|
NODE_ID="$($GARAGE node id -q | cut -d@ -f1 | tr -d '\r')"
|
||||||
|
echo "node id: $NODE_ID"
|
||||||
|
|
||||||
|
$GARAGE layout assign -z dc1 -c 10G "$NODE_ID"
|
||||||
|
$GARAGE layout apply --version 1
|
||||||
|
|
||||||
|
$GARAGE bucket create juwan-objectstory
|
||||||
|
$GARAGE bucket create juwan-pg-backup
|
||||||
|
|
||||||
|
KEY_INFO="$($GARAGE key create juwan-app)"
|
||||||
|
echo "$KEY_INFO"
|
||||||
|
|
||||||
|
ACCESS_KEY="$(echo "$KEY_INFO" | awk '/Key ID:/ {print $3}')"
|
||||||
|
SECRET_KEY="$(echo "$KEY_INFO" | awk '/Secret key:/ {print $3}')"
|
||||||
|
|
||||||
|
$GARAGE bucket allow --read --write --owner juwan-objectstory --key juwan-app
|
||||||
|
$GARAGE bucket allow --read --write --owner juwan-pg-backup --key juwan-app
|
||||||
|
|
||||||
|
cat <<EOF
|
||||||
|
|
||||||
|
S3_ENDPOINT=https://s3.juwan.xhttp.zip
|
||||||
|
S3_REGION=garage
|
||||||
|
S3_ACCESS_KEY=$ACCESS_KEY
|
||||||
|
S3_SECRET_KEY=$SECRET_KEY
|
||||||
|
S3_BUCKET_NAME=juwan-objectstory
|
||||||
|
EOF
|
||||||
@@ -0,0 +1,26 @@
|
|||||||
|
metadata_dir = "/var/lib/garage/meta"
|
||||||
|
data_dir = "/var/lib/garage/data"
|
||||||
|
db_engine = "sqlite"
|
||||||
|
|
||||||
|
replication_factor = 1
|
||||||
|
consistency_mode = "consistent"
|
||||||
|
|
||||||
|
rpc_bind_addr = "[::]:3901"
|
||||||
|
rpc_public_addr = "garage:3901"
|
||||||
|
rpc_secret = "@RPC_SECRET@"
|
||||||
|
|
||||||
|
[s3_api]
|
||||||
|
api_bind_addr = "[::]:3900"
|
||||||
|
s3_region = "garage"
|
||||||
|
root_domain = ".s3.juwan.xhttp.zip"
|
||||||
|
|
||||||
|
[s3_web]
|
||||||
|
bind_addr = "[::]:3902"
|
||||||
|
root_domain = ".web.juwan.xhttp.zip"
|
||||||
|
index = "index.html"
|
||||||
|
|
||||||
|
[admin]
|
||||||
|
api_bind_addr = "[::]:3903"
|
||||||
|
admin_token = "@ADMIN_TOKEN@"
|
||||||
|
metrics_token = "@METRICS_TOKEN@"
|
||||||
|
metrics_require_token = true
|
||||||
Executable
+50
@@ -0,0 +1,50 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
CENTER_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
cd "$CENTER_DIR"
|
||||||
|
|
||||||
|
mkdir -p secrets
|
||||||
|
chmod 700 secrets
|
||||||
|
|
||||||
|
write_secret() {
|
||||||
|
local name="$1" value="$2"
|
||||||
|
printf '%s\n' "$value" > "secrets/$name"
|
||||||
|
chmod 600 "secrets/$name"
|
||||||
|
}
|
||||||
|
|
||||||
|
RPC_SECRET="$(openssl rand -hex 32)"
|
||||||
|
ADMIN_TOKEN="$(openssl rand -base64 32 | tr -d '\n')"
|
||||||
|
METRICS_TOKEN="$(openssl rand -base64 32 | tr -d '\n')"
|
||||||
|
ZOT_PASSWORD="$(openssl rand -hex 16)"
|
||||||
|
GITEA_PASSWORD="$(openssl rand -hex 16)"
|
||||||
|
|
||||||
|
write_secret garage-rpc-secret "$RPC_SECRET"
|
||||||
|
write_secret garage-admin-token "$ADMIN_TOKEN"
|
||||||
|
write_secret garage-metrics-token "$METRICS_TOKEN"
|
||||||
|
write_secret zot-admin-password "$ZOT_PASSWORD"
|
||||||
|
write_secret gitea-admin-password "$GITEA_PASSWORD"
|
||||||
|
|
||||||
|
if [ ! -f .env ]; then
|
||||||
|
cp .env.example .env
|
||||||
|
fi
|
||||||
|
|
||||||
|
python3 - "$RPC_SECRET" "$ADMIN_TOKEN" "$METRICS_TOKEN" <<'PY'
|
||||||
|
import sys, pathlib
|
||||||
|
rpc, admin, metrics = sys.argv[1:4]
|
||||||
|
src = pathlib.Path("garage/garage.toml.template").read_text()
|
||||||
|
out = (src
|
||||||
|
.replace("@RPC_SECRET@", rpc)
|
||||||
|
.replace("@ADMIN_TOKEN@", admin)
|
||||||
|
.replace("@METRICS_TOKEN@", metrics))
|
||||||
|
pathlib.Path("garage/garage.toml").write_text(out)
|
||||||
|
PY
|
||||||
|
|
||||||
|
htpasswd -bBn admin "$ZOT_PASSWORD" > zot/htpasswd
|
||||||
|
chmod 600 zot/htpasswd
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "secrets/ 写入完成，garage/garage.toml、zot/htpasswd 已渲染"
|
||||||
|
echo
|
||||||
|
echo "Zot: admin / $ZOT_PASSWORD"
|
||||||
|
echo "Gitea: admin / $GITEA_PASSWORD"
|
||||||
@@ -0,0 +1,50 @@
|
|||||||
|
{
|
||||||
|
"distSpecVersion": "1.1.1",
|
||||||
|
"storage": {
|
||||||
|
"rootDirectory": "/var/lib/registry",
|
||||||
|
"dedupe": true,
|
||||||
|
"gc": true,
|
||||||
|
"gcDelay": "1h",
|
||||||
|
"gcInterval": "24h"
|
||||||
|
},
|
||||||
|
"http": {
|
||||||
|
"address": "0.0.0.0",
|
||||||
|
"port": "5000",
|
||||||
|
"realm": "zot",
|
||||||
|
"compat": ["docker2s2"],
|
||||||
|
"auth": {
|
||||||
|
"htpasswd": {
|
||||||
|
"path": "/etc/zot/htpasswd"
|
||||||
|
},
|
||||||
|
"failDelay": 5
|
||||||
|
},
|
||||||
|
"accessControl": {
|
||||||
|
"repositories": {
|
||||||
|
"**": {
|
||||||
|
"anonymousPolicy": ["read"],
|
||||||
|
"defaultPolicy": ["read", "create", "update", "delete"]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"metrics": {
|
||||||
|
"users": ["admin"]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"log": {
|
||||||
|
"level": "info"
|
||||||
|
},
|
||||||
|
"extensions": {
|
||||||
|
"search": {
|
||||||
|
"enable": true
|
||||||
|
},
|
||||||
|
"ui": {
|
||||||
|
"enable": true
|
||||||
|
},
|
||||||
|
"metrics": {
|
||||||
|
"enable": true,
|
||||||
|
"prometheus": {
|
||||||
|
"path": "/metrics"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user