feat: MeshSafe 文件摆渡安全卫士 v1.0 初始提交
核心功能: - 6 层检测管线: L0 结构分析 → L1 ClamAV → L2 文档深度检测 → L3 关键词匹配 → L4 YARA → L5 PE/二进制 - FastAPI + PostgreSQL + Redis + Docker Compose 架构 - 客户端 HMAC-SHA256 签名鉴权 + 限流 + 幂等性 - 控制台 UI (登录/Dashboard/诊断中心/策略管理/任务列表/测试中心/产品介绍页) - 三层诊断定时器 (error_scan 30s / db_aggregate 30s / container_check 5min) 并发与稳定性修复: - 诊断定时器 Redis 时间槽位锁 (多 worker 同一槽位只有一个执行) - JSONL 存储 fcntl 跨进程排他锁 + 容错解码 + 原子重写 - 移除 SQLite fallback, 统一 PostgreSQL - API_CLIENTS 脱敏为环境变量, .env 已 .gitignore
This commit is contained in:
144
scripts/deploy_prod.sh
Normal file
144
scripts/deploy_prod.sh
Normal file
@@ -0,0 +1,144 @@
|
||||
#!/usr/bin/env bash
|
||||
# =============================================================================
|
||||
# MeshSafe 生产一键部署脚本（Debian/Ubuntu/CentOS，需已装好 Docker + docker compose）
|
||||
# =============================================================================
|
||||
#
|
||||
# 用法：
|
||||
# bash scripts/deploy_prod.sh # 首次部署（自动建目录 + 起全部服务 + 建表 + 起 Nginx）
|
||||
# bash scripts/deploy_prod.sh rebuild # 改了 app/ 代码后重建 api 镜像 + 重启
|
||||
# bash scripts/deploy_prod.sh stop # 全部停掉
|
||||
# bash scripts/deploy_prod.sh restart # 全部重启
|
||||
# bash scripts/deploy_prod.sh status # 看各服务状态
|
||||
# bash scripts/deploy_prod.sh logs api # 看 api 日志
|
||||
#
|
||||
# 前提：
|
||||
# 1. 已装 Docker ≥ 24 + docker compose v2
|
||||
# 2. .env 文件已准备好（或用 .env.example 复制后填必填项）
|
||||
# 3. 有外网权限（拉镜像 + pip install）—— 无外网的话 ClamAV 签名库走光闸离线导入
|
||||
# =============================================================================
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||
PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||||
cd "$PROJECT_DIR"
|
||||
|
||||
RED='\033[0;31m'
|
||||
GRN='\033[0;32m'
|
||||
YEL='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
log() { echo -e "${GRN}[meshsafe]${NC} $*"; }
|
||||
warn() { echo -e "${YEL}[meshsafe]${NC} ⚠️ $*"; }
|
||||
err() { echo -e "${RED}[meshsafe]${NC} ✗ $*"; exit 1; }
|
||||
|
||||
# ---------- 子命令 ----------
|
||||
ACTION="${1:-deploy}"
|
||||
|
||||
case "$ACTION" in
|
||||
status)
|
||||
docker compose ps
|
||||
echo
|
||||
for svc in postgres redis clamav api nginx; do
|
||||
echo -n "$svc: "
|
||||
docker inspect --format '{{.State.Health.Status}}' meshsafe-$svc 2>/dev/null \
|
||||
|| echo "未运行"
|
||||
done
|
||||
exit 0
|
||||
;;
|
||||
stop)
|
||||
log "停止所有服务..."
|
||||
docker compose down
|
||||
log "✓ 已停止"
|
||||
exit 0
|
||||
;;
|
||||
restart)
|
||||
log "重启所有服务..."
|
||||
docker compose down
|
||||
docker compose up -d
|
||||
sleep 3
|
||||
docker compose ps
|
||||
exit 0
|
||||
;;
|
||||
logs)
|
||||
svc="${2:-api}"
|
||||
docker compose logs -f --tail 100 "$svc"
|
||||
exit 0
|
||||
;;
|
||||
rebuild)
|
||||
log "重建 api 镜像并重启..."
|
||||
docker compose build api
|
||||
docker compose up -d api
|
||||
log "✓ 重建完成"
|
||||
exit 0
|
||||
;;
|
||||
deploy)
|
||||
log "首次部署 MeshSafe"
|
||||
;;
|
||||
*)
|
||||
err "未知子命令: $ACTION 可用: deploy|rebuild|restart|stop|status|logs"
|
||||
;;
|
||||
esac
|
||||
|
||||
# ---------- 前置检查 ----------
|
||||
command -v docker >/dev/null 2>&1 || err "未检测到 docker"
|
||||
docker compose version >/dev/null 2>&1 || err "未检测到 docker compose v2"
|
||||
[ -f docker-compose.yml ] || err "当前目录没有 docker-compose.yml"
|
||||
[ -f .env ] || { warn "没找到 .env，从 .env.example 复制一个"; cp .env.example .env; }
|
||||
|
||||
# ---------- 准备目录 ----------
|
||||
log "准备数据目录..."
|
||||
mkdir -p data/{postgres,redis,clamav,logs,temp}
|
||||
chmod -R 755 data
|
||||
warn "PostgreSQL 数据目录权限首次启动会自动 chown"
|
||||
|
||||
# ---------- 起基础设施 ----------
|
||||
log "起 postgres + redis..."
|
||||
docker compose up -d postgres redis
|
||||
sleep 5
|
||||
|
||||
# ---------- 起 ClamAV ----------
|
||||
log "起 clamav（首次启动尝试 freshclam，内网会静默降级）..."
|
||||
docker compose up -d clamav
|
||||
sleep 3
|
||||
|
||||
# ---------- 起 API ----------
|
||||
log "构建 + 起 api..."
|
||||
docker compose up -d --build api
|
||||
sleep 3
|
||||
|
||||
# ---------- 建表 + 管理员 + 初始策略 ----------
|
||||
log "建表 + admin + 初始策略..."
|
||||
docker compose exec api python scripts/init_db.py
|
||||
|
||||
# ---------- 起 Nginx ----------
|
||||
log "起 nginx..."
|
||||
docker compose up -d nginx
|
||||
sleep 2
|
||||
|
||||
# ---------- 健康检查 ----------
|
||||
log "健康检查..."
|
||||
HTTP_OK=0
|
||||
for i in $(seq 1 10); do
|
||||
if curl -sf http://localhost:8443/api/v1/health >/dev/null 2>&1; then
|
||||
HTTP_OK=1
|
||||
break
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
|
||||
echo
|
||||
echo "============================================"
|
||||
if [ "$HTTP_OK" -eq 1 ]; then
|
||||
log "✅ 部署成功！"
|
||||
echo
|
||||
echo " 控制台: http://$(hostname -I | awk '{print $1}'):44380/console/login"
|
||||
echo " 用户名: admin"
|
||||
echo " 密码: ${MESHSAFE_ADMIN_PASSWORD:-admin123_change_me}"
|
||||
echo
|
||||
echo " 健康检查: http://$(hostname -I | awk '{print $1}'):44380/health"
|
||||
echo "============================================"
|
||||
else
|
||||
warn "⚠️ API 还没就绪，等一会再查: docker compose logs api"
|
||||
echo
|
||||
echo " 查看状态: bash scripts/deploy_prod.sh status"
|
||||
echo " 查看日志: bash scripts/deploy_prod.sh logs api"
|
||||
fi
|
||||
Reference in New Issue
Block a user