[#50] 完成arm服务器单台机器上部署 server & client，没有使用docker swarm

2025-12-05 11:51:56 +08:00
parent a6e1bf7fe7
commit debe91fc8b
11 changed files with 452 additions and 97 deletions
--- a/src/alert/alertmanager/build/alertmanager-0.28.1.linux-arm64.tar.gz
+++ b/src/alert/alertmanager/build/alertmanager-0.28.1.linux-arm64.tar.gz
--- a/src/alert/alertmanager/build/fetch-dist.sh
+++ b/src/alert/alertmanager/build/fetch-dist.sh
--- a/src/web/build_tools/proxy/Dockerfile.arm64
+++ b/src/web/build_tools/proxy/Dockerfile.arm64
@@ -0,0 +1,79 @@
+FROM ubuntu:24.04
+
+USER root
+
+# 安装 nginx 和 supervisor
+RUN apt-get update && \
+    apt-get install -y nginx supervisor curl vim net-tools inetutils-ping ca-certificates passwd && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
+
+ENV FRONTEND_BASE_PATH=/private/argus/web/proxy
+ARG ARGUS_BUILD_UID=2133
+ARG ARGUS_BUILD_GID=2015
+ENV ARGUS_BUILD_UID=${ARGUS_BUILD_UID}
+ENV ARGUS_BUILD_GID=${ARGUS_BUILD_GID}
+
+RUN mkdir -p ${FRONTEND_BASE_PATH} && \
+    mkdir -p /private/argus/etc
+
+# 创建 proxy 用户（可自定义 UID/GID）
+RUN set -eux; \
+    if ! getent group "${ARGUS_BUILD_GID}" >/dev/null; then \
+        groupadd -g "${ARGUS_BUILD_GID}" web_proxy || true; \
+    fi; \
+    if id web_proxy >/dev/null 2>&1; then \
+        current_uid="$(id -u web_proxy)"; \
+        if [ "$current_uid" != "${ARGUS_BUILD_UID}" ] && ! getent passwd "${ARGUS_BUILD_UID}" >/dev/null; then \
+            usermod -u "${ARGUS_BUILD_UID}" web_proxy; \
+        fi; \
+        usermod -g "${ARGUS_BUILD_GID}" web_proxy || true; \
+    else \
+        if ! getent passwd "${ARGUS_BUILD_UID}" >/dev/null; then \
+            useradd -M -s /usr/sbin/nologin -u "${ARGUS_BUILD_UID}" -g "${ARGUS_BUILD_GID}" web_proxy; \
+        else \
+            echo "UID ${ARGUS_BUILD_UID} already exists; skip creating user 'web_proxy'"; \
+        fi; \
+    fi; \
+    chown -R "${ARGUS_BUILD_UID}:${ARGUS_BUILD_GID}" ${FRONTEND_BASE_PATH} /private/argus/etc /usr/local/bin || true
+
+# 配置内网 apt 源 (如果指定了内网选项)
+RUN if [ "$USE_INTRANET" = "true" ]; then \
+        echo "Configuring intranet apt sources..." && \
+        cp /etc/apt/sources.list /etc/apt/sources.list.bak && \
+        echo "deb [trusted=yes] http://10.68.64.1/ubuntu2204/ jammy main" > /etc/apt/sources.list && \
+        echo 'Acquire::https::Verify-Peer "false";' > /etc/apt/apt.conf.d/99disable-ssl-check && \
+        echo 'Acquire::https::Verify-Host "false";' >> /etc/apt/apt.conf.d/99disable-ssl-check; \
+    fi
+
+RUN if [ "$USE_INTRANET" = "true" ]; then \
+    echo "deb [trusted=yes] https://10.92.132.52/mirrors/ubuntu2204/ jammy main" > /etc/apt/sources.list; \
+    fi
+
+# 复制 nginx 配置模板
+COPY src/web/build_tools/proxy/nginx.conf.template /etc/nginx/nginx.conf.template
+
+# ARM minimal profile：使用不包含 Kibana/ES 的端口配置
+COPY src/web/build_tools/proxy/conf.d/ports.arm.conf /etc/nginx/conf.d/ports.conf
+
+# 复制 supervisor 配置
+COPY src/web/build_tools/proxy/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
+
+# 创建 supervisor 日志目录
+RUN mkdir -p /var/log/supervisor
+
+# 复制 ARM 专用启动脚本
+COPY src/web/build_tools/proxy/start-proxy-supervised.arm.sh /usr/local/bin/start-proxy-supervised.sh
+RUN chmod +x /usr/local/bin/start-proxy-supervised.sh
+COPY src/web/build_tools/proxy/start-proxy-retry.sh /usr/local/bin/start-proxy-retry.sh
+RUN chmod +x /usr/local/bin/start-proxy-retry.sh
+
+# 复制 DNS 监控脚本（复用 bind 模块脚本）
+COPY src/bind/build/dns-monitor.sh /usr/local/bin/dns-monitor.sh
+RUN chmod +x /usr/local/bin/dns-monitor.sh
+
+EXPOSE 80 8080 8081 8082 8083 8084 8085
+
+USER root
+
+CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]
+
--- a/src/web/build_tools/proxy/conf.d/ports.arm.conf
+++ b/src/web/build_tools/proxy/conf.d/ports.arm.conf
@@ -0,0 +1,84 @@
+map $http_upgrade $connection_upgrade { default upgrade; "" close; }
+
+# 允许的跨域来源（仅用于 8084/8085）
+# 放开为任意来源：将来端口/域名变更均无需调整。
+# 注意：若前端需要携带凭证（cookies/Authorization），这种“回显 Origin”的方式比 "*" 更通用。
+map $http_origin $cors_allow {
+    default $http_origin;
+}
+
+# 8080 - Portal
+server {
+  listen 8080;
+  server_name _;
+  proxy_set_header Host $host;
+  proxy_set_header X-Real-IP $remote_addr;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  proxy_set_header X-Forwarded-Proto $scheme;
+  proxy_set_header Upgrade $http_upgrade;
+  proxy_set_header Connection $connection_upgrade;
+  proxy_http_version 1.1;
+  location / { proxy_pass http://web.argus.com:8080/; }
+}
+
+# 8081 - Grafana
+server {
+  listen 8081;
+  server_name _;
+  proxy_set_header Host $host;
+  proxy_set_header X-Real-IP $remote_addr;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  proxy_set_header X-Forwarded-Proto $scheme;
+  proxy_set_header Upgrade $http_upgrade;
+  proxy_set_header Connection $connection_upgrade;
+  proxy_http_version 1.1;
+  location / { proxy_pass http://grafana.metric.argus.com:3000/; }
+}
+
+# 8082 - Prometheus
+server {
+  listen 8082;
+  server_name _;
+  proxy_set_header Host $host;
+  proxy_set_header X-Real-IP $remote_addr;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  proxy_set_header X-Forwarded-Proto $scheme;
+  proxy_set_header Upgrade $http_upgrade;
+  proxy_set_header Connection $connection_upgrade;
+  proxy_http_version 1.1;
+  location / { proxy_pass http://prom.metric.argus.com:9090/; }
+}
+
+# 8084 - Alertmanager（含 CORS）
+server {
+  listen 8084;
+  server_name _;
+  proxy_set_header Host $host;
+  proxy_set_header X-Real-IP $remote_addr;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  proxy_set_header X-Forwarded-Proto $scheme;
+  proxy_hide_header Access-Control-Allow-Origin;
+  add_header 'Access-Control-Allow-Origin' $cors_allow always;
+  add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
+  add_header 'Access-Control-Allow-Headers' 'Origin, Content-Type, Accept, Authorization' always;
+  if ($request_method = OPTIONS) { return 204; }
+  proxy_http_version 1.1;
+  location / { proxy_pass http://alertmanager.alert.argus.com:9093/; }
+}
+
+# 8085 - Master（含 CORS）
+server {
+  listen 8085;
+  server_name _;
+  proxy_set_header Host $host;
+  proxy_set_header X-Real-IP $remote_addr;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  proxy_set_header X-Forwarded-Proto $scheme;
+  add_header 'Access-Control-Allow-Origin' $cors_allow always;
+  add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
+  add_header 'Access-Control-Allow-Headers' 'Origin, Content-Type, Accept, Authorization' always;
+  if ($request_method = OPTIONS) { return 204; }
+  proxy_http_version 1.1;
+  location / { proxy_pass http://master.argus.com:3000/; }
+}
+
--- a/src/web/build_tools/proxy/start-proxy-supervised.arm.sh
+++ b/src/web/build_tools/proxy/start-proxy-supervised.arm.sh
@@ -0,0 +1,102 @@
+#!/bin/bash
+set -euo pipefail
+
+echo "[INFO] Starting proxy under supervisor (ARM minimal profile)..."
+
+TEMPLATE="/etc/nginx/nginx.conf.template"
+TARGET="/etc/nginx/nginx.conf"
+DNS_CONF_PRIVATE="/private/argus/etc/dns.conf"
+DNS_CONF_SYSTEM="/etc/resolv.conf"
+DNS_DIR="/private/argus/etc"
+DNS_SCRIPT="${DNS_DIR}/update-dns.sh"
+RUNTIME_UID="${ARGUS_BUILD_UID:-2133}"
+RUNTIME_GID="${ARGUS_BUILD_GID:-2015}"
+
+mkdir -p "$DNS_DIR"
+chown -R "$RUNTIME_UID:$RUNTIME_GID" "$DNS_DIR" 2>/dev/null || true
+
+if [[ -x "$DNS_SCRIPT" ]]; then
+  echo "[INFO] Running update-dns.sh before proxy starts"
+  "$DNS_SCRIPT" || echo "[WARN] update-dns.sh execution failed"
+else
+  echo "[WARN] DNS update script not found or not executable: $DNS_SCRIPT"
+fi
+
+# ========== 读取 DNS ==========
+RESOLVERS=""
+for i in $(seq 1 10); do
+  if [ -f "$DNS_CONF_PRIVATE" ]; then
+    RESOLVERS=$(awk '/^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/{print $1}' "$DNS_CONF_PRIVATE" | tr '\n' ' ')
+  fi
+  [ -n "$RESOLVERS" ] && break
+  sleep 1
+done
+
+if [ -z "$RESOLVERS" ]; then
+  echo "未在 $DNS_CONF_PRIVATE 中找到有效 DNS，使用系统 /etc/resolv.conf"
+  RESOLVERS=$(awk '/^nameserver/ {print $2}' "$DNS_CONF_SYSTEM" | tr '\n' ' ')
+fi
+
+if [ -z "$RESOLVERS" ]; then
+  echo "警告: 未找到任何 DNS，使用默认 8.8.8.8"
+  RESOLVERS="8.8.8.8"
+fi
+
+echo "检测到 DNS 服务器列表: $RESOLVERS"
+
+# ========== 生成 nginx.conf ==========
+if [ -f "$TEMPLATE" ]; then
+  echo "从模板生成 nginx.conf ..."
+  if ! echo " $RESOLVERS " | grep -q " 127.0.0.11 "; then
+    RESOLVERS="${RESOLVERS} 127.0.0.11"
+  fi
+  sed "s|__RESOLVERS__|$RESOLVERS|" "$TEMPLATE" > "$TARGET"
+else
+  echo "错误: 找不到 nginx.conf.template ($TEMPLATE)"
+  exit 1
+fi
+
+grep resolver "$TARGET" || true
+
+# ========== 等待上游域名准备（ARM 最小服务集：无 Kibana/ES） ==========
+UPSTREAM_DOMAINS=(
+  web.argus.com
+  grafana.metric.argus.com
+  prom.metric.argus.com
+  alertmanager.alert.argus.com
+  master.argus.com
+)
+WAIT_MAX=15
+WAITED=0
+MISSING=()
+while :; do
+  MISSING=()
+  for d in "${UPSTREAM_DOMAINS[@]}"; do
+    if [ ! -s "/private/argus/etc/${d}" ]; then
+      MISSING+=("$d")
+    fi
+  done
+  if [ ${#MISSING[@]} -eq 0 ] || [ "$WAITED" -ge "$WAIT_MAX" ]; then
+    break
+  fi
+  echo "[INFO] 等待上游域名记录生成(${WAITED}/${WAIT_MAX}) 缺失: ${MISSING[*]}"
+  sleep 1
+  WAITED=$((WAITED+1))
+done
+
+# Quick upstream reachability snapshot（ARM 下仅检查存在的服务）
+declare -a _UPSTREAMS=(
+  "http://web.argus.com:8080/"
+  "http://grafana.metric.argus.com:3000/api/health"
+  "http://prom.metric.argus.com:9090/-/ready"
+  "http://alertmanager.alert.argus.com:9093/api/v2/status"
+  "http://master.argus.com:3000/readyz"
+)
+for u in "${_UPSTREAMS[@]}"; do
+  code=$(curl -4 -s -o /dev/null -w "%{http_code}" "$u" || echo 000)
+  echo "[INFO] upstream check: $u -> $code"
+done
+
+echo "[INFO] Launching nginx..."
+exec /usr/sbin/nginx -g "daemon off;"
+