dev_1.0.0_yuyr 完成 log和bind模块开发部署测试 (#8)

- [x] 完成log模块镜像构建、本地端到端写日志——收集——查询流程； - [x] 完成bind模块构建； - [x] 内置域名IP自动更新脚本，使用 /private/argus/etc目录下文件进行同步，容器启动时自动写IP，定时任务刷新更新DNS服务器IP和DNS规则； Co-authored-by: root <root@curious.host.com> Reviewed-on: #8 Reviewed-by: sundapeng <sundp@mail.zgclab.edu.cn>
2025-09-22 16:39:38 +08:00
parent 26e1c964ed
commit 8a38d3d0b2
48 changed files with 2744 additions and 0 deletions
--- a/src/bind/build/Dockerfile
+++ b/src/bind/build/Dockerfile
@@ -0,0 +1,66 @@
+FROM ubuntu:22.04
+
+# Set timezone and avoid interactive prompts
+ENV DEBIAN_FRONTEND=noninteractive
+ENV TZ=Asia/Shanghai
+
+# 设置构建参数
+ARG USE_INTRANET=false
+
+# 配置内网 apt 源 (如果指定了内网选项)
+RUN if [ "$USE_INTRANET" = "true" ]; then \
+        echo "Configuring intranet apt sources..." && \
+        cp /etc/apt/sources.list /etc/apt/sources.list.bak && \
+        echo "deb [trusted=yes] http://10.68.64.1/ubuntu2204/ jammy main" > /etc/apt/sources.list && \
+        echo 'Acquire::https::Verify-Peer "false";' > /etc/apt/apt.conf.d/99disable-ssl-check && \
+        echo 'Acquire::https::Verify-Host "false";' >> /etc/apt/apt.conf.d/99disable-ssl-check; \
+    fi
+
+# Update package list and install required packages
+RUN apt-get update && \
+    apt-get install -y \
+    bind9 \
+    bind9utils \
+    bind9-doc \
+    supervisor \
+    net-tools \
+    inetutils-ping \
+    vim \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# 配置部署时使用的apt源
+RUN if [ "$USE_INTRANET" = "true" ]; then \
+	echo "deb [trusted=yes] https://10.92.132.52/mirrors/ubuntu2204/ jammy main" > /etc/apt/sources.list; \
+    fi
+
+# Create supervisor configuration directory
+RUN mkdir -p /etc/supervisor/conf.d
+
+# Copy supervisor configuration
+COPY src/bind/build/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
+
+# Copy BIND9 configuration files
+COPY src/bind/build/named.conf.local /etc/bind/named.conf.local
+COPY src/bind/build/db.argus.com /etc/bind/db.argus.com
+
+# Copy startup and reload scripts
+COPY src/bind/build/startup.sh /usr/local/bin/startup.sh
+COPY src/bind/build/reload-bind9.sh /usr/local/bin/reload-bind9.sh
+COPY src/bind/build/argus_dns_sync.sh /usr/local/bin/argus_dns_sync.sh
+COPY src/bind/build/update-dns.sh /usr/local/bin/update-dns.sh
+
+# Make scripts executable
+RUN chmod +x /usr/local/bin/startup.sh /usr/local/bin/reload-bind9.sh  /usr/local/bin/argus_dns_sync.sh /usr/local/bin/update-dns.sh
+
+# Set proper ownership for BIND9 files
+RUN chown bind:bind /etc/bind/named.conf.local /etc/bind/db.argus.com
+
+# Expose DNS port
+EXPOSE 53/tcp 53/udp
+
+# Use root user as requested
+USER root
+
+# Start with startup script
+CMD ["/usr/local/bin/startup.sh"]
--- a/src/bind/build/argus_dns_sync.sh
+++ b/src/bind/build/argus_dns_sync.sh
@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+WATCH_DIR="/private/argus/etc"
+ZONE_DB="/private/argus/bind/db.argus.com"
+LOCKFILE="/var/lock/argus_dns_sync.lock"
+BACKUP_DIR="/private/argus/bind/.backup"
+SLEEP_SECONDS=10
+RELOAD_SCRIPT="/usr/local/bin/reload-bind9.sh"   # 这里放你已有脚本的路径
+
+mkdir -p "$(dirname "$LOCKFILE")" "$BACKUP_DIR"
+
+is_ipv4() {
+  local ip="$1"
+  [[ "$ip" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] || return 1
+  IFS='.' read -r a b c d <<<"$ip"
+  for n in "$a" "$b" "$c" "$d"; do
+    (( n >= 0 && n <= 255 )) || return 1
+  done
+  return 0
+}
+
+get_current_ip() {
+  local name="$1"
+  sed -n -E "s/^${name}[[:space:]]+IN[[:space:]]+A[[:space:]]+([0-9.]+)[[:space:]]*$/\1/p" "$ZONE_DB" | head -n1
+}
+
+upsert_record() {
+  local name="$1"
+  local new_ip="$2"
+  local ts
+  ts="$(date +%Y%m%d-%H%M%S)"
+  local changed=0
+
+  cp -a "$ZONE_DB" "$BACKUP_DIR/db.argus.com.$ts.bak"
+
+  local cur_ip
+  cur_ip="$(get_current_ip "$name" || true)"
+
+  if [[ -z "$cur_ip" ]]; then
+    # Ensure the file ends with a newline before adding new record
+    if [[ -s "$ZONE_DB" ]] && [[ $(tail -c1 "$ZONE_DB" | wc -l) -eq 0 ]]; then
+      echo "" >> "$ZONE_DB"
+    fi
+    printf "%-20s IN A %s\n" "$name" "$new_ip" >> "$ZONE_DB"
+    echo "[ADD] ${name} -> ${new_ip}"
+    changed=1
+  elif [[ "$cur_ip" != "$new_ip" ]]; then
+    awk -v n="$name" -v ip="$new_ip" '
+      {
+        if ($1==n && $2=="IN" && $3=="A") {
+          printf "%-20s IN A %s\n", n, ip
+        } else {
+          print
+        }
+      }
+    ' "$ZONE_DB" > "${ZONE_DB}.tmp" && mv "${ZONE_DB}.tmp" "$ZONE_DB"
+    echo "[UPDATE] ${name}: ${cur_ip} -> ${new_ip}"
+    changed=1
+  else
+    echo "[SKIP] ${name} unchanged (${new_ip})"
+  fi
+
+  return $changed
+}
+
+while true; do
+  exec 9>"$LOCKFILE"
+  if flock -n 9; then
+    shopt -s nullglob
+    NEED_RELOAD=0
+
+    for f in "$WATCH_DIR"/*.argus.com; do
+      base="$(basename "$f")"
+      name="${base%.argus.com}"
+      ip="$(grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' "$f" | tail -n1 || true)"
+
+      if [[ -z "$ip" ]] || ! is_ipv4 "$ip"; then
+        echo "[WARN] $f 未找到有效 IPv4，跳过"
+        continue
+      fi
+
+      if upsert_record "$name" "$ip"; then
+        NEED_RELOAD=1
+      fi
+    done
+
+    if [[ $NEED_RELOAD -eq 1 ]]; then
+      echo "[INFO] 检测到 db.argus.com 变更，执行 reload-bind9.sh"
+      bash "$RELOAD_SCRIPT"
+    fi
+
+    flock -u 9
+  else
+    echo "[INFO] 已有同步任务在运行，跳过本轮"
+  fi
+
+  sleep "$SLEEP_SECONDS"
+done
+
--- a/src/bind/build/db.argus.com
+++ b/src/bind/build/db.argus.com
@@ -0,0 +1,16 @@
+$TTL    604800
+@       IN      SOA     ns1.argus.com. admin.argus.com. (
+                              2         ; Serial
+                         604800         ; Refresh
+                          86400         ; Retry
+                        2419200         ; Expire
+                         604800 )       ; Negative Cache TTL
+
+; 定义 DNS 服务器
+@       IN      NS      ns1.argus.com.
+
+; 定义 ns1 主机
+ns1     IN      A       127.0.0.1
+
+; 定义 web 指向 12.4.5.6
+web     IN      A       12.4.5.6
--- a/src/bind/build/dns-monitor.sh
+++ b/src/bind/build/dns-monitor.sh
@@ -0,0 +1,68 @@
+#!/bin/bash
+
+# DNS监控脚本 - 每10秒检查dns.conf是否有变化
+# 如果有变化则执行update-dns.sh脚本
+
+DNS_CONF="/private/argus/etc/dns.conf"
+DNS_BACKUP="/tmp/dns.conf.backup"
+UPDATE_SCRIPT="/private/argus/etc/update-dns.sh"
+LOG_FILE="/var/log/supervisor/dns-monitor.log"
+
+# 确保日志文件存在
+touch "$LOG_FILE"
+
+log_message() {
+    echo "$(date '+%Y-%m-%d %H:%M:%S') [DNS-Monitor] $1" >> "$LOG_FILE"
+}
+
+log_message "DNS监控脚本启动"
+
+while true; do
+    if [ -f "$DNS_CONF" ]; then
+        if [ -f "$DNS_BACKUP" ]; then
+            # 比较文件内容
+            if ! cmp -s "$DNS_CONF" "$DNS_BACKUP"; then
+                log_message "检测到DNS配置变化"
+
+                # 更新备份文件
+                cp "$DNS_CONF" "$DNS_BACKUP"
+
+                # 执行更新脚本
+                if [ -x "$UPDATE_SCRIPT" ]; then
+                    log_message "执行DNS更新脚本: $UPDATE_SCRIPT"
+                    "$UPDATE_SCRIPT" >> "$LOG_FILE" 2>&1
+                    if [ $? -eq 0 ]; then
+                        log_message "DNS更新脚本执行成功"
+                    else
+                        log_message "DNS更新脚本执行失败"
+                    fi
+                else
+                    log_message "警告: 更新脚本不存在或不可执行: $UPDATE_SCRIPT"
+                fi
+            fi
+        else
+
+            # 第一次检测到配置文件，执行更新脚本
+            if [ -x "$UPDATE_SCRIPT" ]; then
+                log_message "执行DNS更新脚本: $UPDATE_SCRIPT"
+                "$UPDATE_SCRIPT" >> "$LOG_FILE" 2>&1
+                if [ $? -eq 0 ]; then
+                    log_message "DNS更新脚本执行成功"
+
+		    # 第一次运行，创建备份并执行更新
+		    cp "$DNS_CONF" "$DNS_BACKUP"
+		    log_message "创建DNS配置备份文件"
+
+                else
+                    log_message "DNS更新脚本执行失败"
+                fi
+            else
+                log_message "警告: 更新脚本不存在或不可执行: $UPDATE_SCRIPT"
+            fi
+        fi
+    else
+        log_message "警告: DNS配置文件不存在: $DNS_CONF"
+    fi
+
+    sleep 10
+done
--- a/src/bind/build/named.conf.local
+++ b/src/bind/build/named.conf.local
@@ -0,0 +1,4 @@
+zone "argus.com" {
+    type master;
+    file "/etc/bind/db.argus.com";
+};
--- a/src/bind/build/reload-bind9.sh
+++ b/src/bind/build/reload-bind9.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+echo "Reloading BIND9 configuration..."
+
+# Check if configuration files are valid
+echo "Checking named.conf.local syntax..."
+if ! named-checkconf /etc/bind/named.conf.local; then
+    echo "ERROR: named.conf.local has syntax errors!"
+    exit 1
+fi
+
+echo "Checking zone file syntax..."
+if ! named-checkzone argus.com /etc/bind/db.argus.com; then
+    echo "ERROR: db.argus.com has syntax errors!"
+    exit 1
+fi
+
+# Reload BIND9 via supervisor
+echo "Reloading BIND9 service..."
+supervisorctl restart bind9
+
+if [ $? -eq 0 ]; then
+    echo "BIND9 reloaded successfully!"
+else
+    echo "ERROR: Failed to reload BIND9!"
+    exit 1
+fi
--- a/src/bind/build/startup.sh
+++ b/src/bind/build/startup.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+
+# Set /private permissions to 777 as requested
+chmod 777 /private 2>/dev/null || true
+
+# Create persistent directories for BIND9 configs and DNS sync
+mkdir -p /private/argus/bind
+mkdir -p /private/argus/etc
+
+# Copy configuration files to persistent storage if they don't exist
+if [ ! -f /private/argus/bind/named.conf.local ]; then
+    cp /etc/bind/named.conf.local /private/argus/bind/named.conf.local
+fi
+
+if [ ! -f /private/argus/bind/db.argus.com ]; then
+    cp /etc/bind/db.argus.com /private/argus/bind/db.argus.com
+fi
+
+# Copy update-dns.sh to /private/argus/etc/
+cp /usr/local/bin/update-dns.sh /private/argus/etc/update-dns.sh
+chown bind:bind /private/argus/etc/update-dns.sh
+chmod a+x /private/argus/etc/update-dns.sh
+
+# Create symlinks to use persistent configs
+ln -sf /private/argus/bind/named.conf.local /etc/bind/named.conf.local
+ln -sf /private/argus/bind/db.argus.com /etc/bind/db.argus.com
+
+# Set proper ownership
+chown bind:bind /private/argus/bind/named.conf.local /private/argus/bind/db.argus.com
+
+# 记录容器ip地址更新到dns.conf
+IP=`ifconfig | grep -A 1 eth0 | grep inet | awk '{print $2}'`
+echo current IP: ${IP}
+echo ${IP} > /private/argus/etc/dns.conf
+
+# Create supervisor log directory
+mkdir -p /var/log/supervisor
+
+# Start supervisor
+exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf
--- a/src/bind/build/supervisord.conf
+++ b/src/bind/build/supervisord.conf
@@ -0,0 +1,37 @@
+[unix_http_server]
+file=/var/run/supervisor.sock
+chmod=0700
+
+[supervisord]
+nodaemon=true
+user=root
+logfile=/var/log/supervisor/supervisord.log
+pidfile=/var/run/supervisord.pid
+
+[rpcinterface:supervisor]
+supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
+
+[supervisorctl]
+serverurl=unix:///var/run/supervisor.sock
+
+[program:bind9]
+command=/usr/sbin/named -g -c /etc/bind/named.conf -u bind
+user=bind
+autostart=true
+autorestart=true
+stderr_logfile=/var/log/supervisor/bind9.err.log
+stdout_logfile=/var/log/supervisor/bind9.out.log
+priority=10
+
+[program:argus-dns-sync]
+command=/usr/local/bin/argus_dns_sync.sh
+autostart=true
+autorestart=true
+startsecs=3
+stopsignal=TERM
+user=root
+stdout_logfile=/var/log/argus_dns_sync.out.log
+stderr_logfile=/var/log/argus_dns_sync.err.log
+; 根据环境调整环境变量（可选）
+; environment=RNDC_RELOAD="yes"
+
--- a/src/bind/build/update-dns.sh
+++ b/src/bind/build/update-dns.sh
@@ -0,0 +1,31 @@
+#!/bin/sh
+# update-dns.sh
+# 从 /private/argus/etc/dns.conf 读取 IP，写入 /etc/resolv.conf
+
+DNS_CONF="/private/argus/etc/dns.conf"
+RESOLV_CONF="/etc/resolv.conf"
+
+# 检查配置文件是否存在
+if [ ! -f "$DNS_CONF" ]; then
+  echo "配置文件不存在: $DNS_CONF" >&2
+  exit 1
+fi
+
+# 生成 resolv.conf 内容
+{
+  while IFS= read -r ip; do
+    # 跳过空行和注释
+    case "$ip" in
+      \#*) continue ;;
+      "") continue ;;
+    esac
+    echo "nameserver $ip"
+  done < "$DNS_CONF"
+} > "$RESOLV_CONF".tmp
+
+# 替换写入 /etc/resolv.conf
+cat "$RESOLV_CONF".tmp > "$RESOLV_CONF"
+rm -f "$RESOLV_CONF".tmp
+
+echo "已更新 $RESOLV_CONF"
+