feat: configure customer api and web ports
This commit is contained in:
root committed
1 parent
0fda3af4c3
commit
31c96f2632
1 file changed
+75
-351
+75
-351
@@ -1,396 +1,120 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
umask 077
|
||||
|
||||
# Standalone public customer bootstrap. It never checks out application source
|
||||
# and it never pulls an Auth image.
|
||||
REGISTRY=${OVERCOOKED_REGISTRY:-git.leee.xin/overcooked}
|
||||
VERSION=${OVERCOOKED_VERSION:-latest}
|
||||
ROOT=${OVERCOOKED_ROOT:-/opt/overcooked}
|
||||
SERVER_IP=${OVERCOOKED_SERVER_IP:-}
|
||||
ACTIVATION_CODE=${OVERCOOKED_ACTIVATION_CODE:-}
|
||||
AUTH_URL=${OVERCOOKED_AUTH_URL:-http://148.135.97.10:18091}
|
||||
AUTH_PUBLIC_KEYS=${OVERCOOKED_AUTH_PUBLIC_KEYS:-}
|
||||
INSTALLER_BASE_URL=${OVERCOOKED_INSTALLER_BASE_URL:-https://git.leee.xin/OverCooked/OverCooked-Installer/raw/branch/main}
|
||||
S_COMPOSE=$ROOT/compose/s.yml
|
||||
E_COMPOSE=$ROOT/compose/e.yml
|
||||
ENV_FILE=$ROOT/production.env
|
||||
S_PROJECT=overcooked-s
|
||||
E_PROJECT=overcooked-e
|
||||
FAILURE_REPORTED=0
|
||||
S_POSTGRES_PASSWORD=not-generated
|
||||
S_VALKEY_PASSWORD=not-generated
|
||||
S_INTERNAL_SHARED_SECRET=not-generated
|
||||
S_ACCESS_TOKEN_SECRET=not-generated
|
||||
S_SETUP_TOKEN=not-generated
|
||||
E_POSTGRES_PASSWORD=not-generated
|
||||
E_PLAYBACK_TICKET_SECRET=not-generated
|
||||
E_PLAYBACK_LEASE_KEY=not-generated
|
||||
E_STORAGE_CREDENTIAL_KEY=not-generated
|
||||
E_PLUGIN_SECRET_KEY=not-generated
|
||||
# Public customer bootstrap. Auth is an external service; no Auth image or
|
||||
# private source is downloaded by this script.
|
||||
REGISTRY="${OVERCOOKED_REGISTRY:-git.leee.xin/overcooked}"
|
||||
VERSION="${OVERCOOKED_VERSION:-latest}"
|
||||
ROOT="${OVERCOOKED_ROOT:-/opt/overcooked}"
|
||||
SERVER_IP="${OVERCOOKED_SERVER_IP:-}"
|
||||
API_PORT="${OVERCOOKED_API_PORT:-8100}"
|
||||
WEB_PORT="${OVERCOOKED_WEB_PORT:-8111}"
|
||||
ACTIVATION_CODE="${OVERCOOKED_ACTIVATION_CODE:-}"
|
||||
# Central OverCooked Auth gateway. Override for private deployments.
|
||||
AUTH_URL="${OVERCOOKED_AUTH_URL:-http://148.135.97.10:18091}"
|
||||
AUTH_PUBLIC_KEYS="${OVERCOOKED_AUTH_PUBLIC_KEYS:-}"
|
||||
|
||||
die() { echo "overcooked-install: $*" >&2; exit 1; }
|
||||
|
||||
is_ipv4() {
|
||||
old_ifs=$IFS; IFS=.; set -- $1; IFS=$old_ifs
|
||||
[ "$#" = 4 ] || return 1
|
||||
for octet in "$@"; do
|
||||
case "$octet" in ''|*[!0-9]*) return 1 ;; esac
|
||||
[ "$octet" -le 255 ] 2>/dev/null || return 1
|
||||
done
|
||||
}
|
||||
is_private_ipv4() {
|
||||
second=$(printf '%s\n' "$1" | cut -d. -f2)
|
||||
case "$1" in
|
||||
0.*|10.*|127.*|169.254.*|192.168.*|100.64.*|100.65.*|100.66.*|100.67.*|100.68.*|100.69.*|100.70.*|100.71.*|100.72.*|100.73.*|100.74.*|100.75.*|100.76.*|100.77.*|100.78.*|100.79.*|100.8*.*|100.9*.*) return 0 ;;
|
||||
172.*) [ "$second" -ge 16 ] 2>/dev/null && [ "$second" -le 31 ] 2>/dev/null; return ;;
|
||||
esac
|
||||
return 1
|
||||
}
|
||||
check_port() {
|
||||
port=$1
|
||||
command -v ss >/dev/null 2>&1 || die "未找到 ss，无法安全检测端口 $port；请安装 iproute2 后重试"
|
||||
if ss -H -ltn 2>/dev/null | awk -v p=":$port" '$4 ~ p "$" || $4 ~ p "\\]$" { found=1 } END { exit !found }'; then
|
||||
die "端口 $port 已被占用，请停止占用进程或调整部署端口"
|
||||
fi
|
||||
}
|
||||
redact_logs() {
|
||||
sed -e "s|$S_POSTGRES_PASSWORD|[REDACTED]|g" \
|
||||
-e "s|$S_VALKEY_PASSWORD|[REDACTED]|g" \
|
||||
-e "s|$S_INTERNAL_SHARED_SECRET|[REDACTED]|g" \
|
||||
-e "s|$S_ACCESS_TOKEN_SECRET|[REDACTED]|g" \
|
||||
-e "s|$S_SETUP_TOKEN|[REDACTED]|g" \
|
||||
-e "s|$E_POSTGRES_PASSWORD|[REDACTED]|g" \
|
||||
-e "s|$E_PLAYBACK_TICKET_SECRET|[REDACTED]|g" \
|
||||
-e "s|$E_PLAYBACK_LEASE_KEY|[REDACTED]|g" \
|
||||
-e "s|$E_STORAGE_CREDENTIAL_KEY|[REDACTED]|g" \
|
||||
-e "s|$E_PLUGIN_SECRET_KEY|[REDACTED]|g"
|
||||
}
|
||||
show_failure() {
|
||||
[ "$FAILURE_REPORTED" = 1 ] && return 0
|
||||
FAILURE_REPORTED=1
|
||||
[ -f "$ENV_FILE" ] || return 0
|
||||
echo "安装失败，以下是脱敏后的容器状态和最近日志：" >&2
|
||||
docker compose --env-file "$ENV_FILE" -f "$E_COMPOSE" -p "$E_PROJECT" ps >&2 || true
|
||||
docker compose --env-file "$ENV_FILE" -f "$S_COMPOSE" -p "$S_PROJECT" ps >&2 || true
|
||||
docker compose --env-file "$ENV_FILE" -f "$E_COMPOSE" -p "$E_PROJECT" logs --tail=100 2>&1 | redact_logs >&2 || true
|
||||
docker compose --env-file "$ENV_FILE" -f "$S_COMPOSE" -p "$S_PROJECT" logs --tail=100 2>&1 | redact_logs >&2 || true
|
||||
}
|
||||
on_exit() { rc=$?; [ "$rc" -eq 0 ] || show_failure; exit "$rc"; }
|
||||
trap on_exit EXIT
|
||||
|
||||
[ "$(id -u)" = 0 ] || die "请使用 sudo/root 执行"
|
||||
command -v docker >/dev/null 2>&1 || die "未找到 Docker Engine"
|
||||
docker compose version >/dev/null 2>&1 || die "未找到 Docker Compose v2"
|
||||
command -v curl >/dev/null 2>&1 || die "未找到 curl"
|
||||
command -v openssl >/dev/null 2>&1 || die "未找到 openssl"
|
||||
command -v tar >/dev/null 2>&1 || die "未找到 tar"
|
||||
command -v mktemp >/dev/null 2>&1 || die "未找到 mktemp"
|
||||
for pair in "OVERCOOKED_REGISTRY:$REGISTRY" "OVERCOOKED_VERSION:$VERSION" "OVERCOOKED_ROOT:$ROOT" "OVERCOOKED_AUTH_URL:$AUTH_URL" "OVERCOOKED_INSTALLER_BASE_URL:$INSTALLER_BASE_URL"; do
|
||||
name=${pair%%:*}; value=${pair#*:}; [ -n "$value" ] || die "$name 不能为空"
|
||||
case "$value" in *' '*|*' '*|*'\r'*|*'\n'*) die "$name 包含非法空白字符" ;; esac
|
||||
done
|
||||
case "$REGISTRY" in *://*|*/|*//*|*=*) die "OVERCOOKED_REGISTRY 必须是镜像 Registry 路径" ;; esac
|
||||
case "$VERSION" in */*|*:*|*[!A-Za-z0-9._-]*) die "OVERCOOKED_VERSION 格式无效" ;; esac
|
||||
case "$ROOT" in /*) ;; *) die "OVERCOOKED_ROOT 必须是绝对路径" ;; esac
|
||||
case "$INSTALLER_BASE_URL" in *://*) ;; *) die "Installer 地址必须是 HTTP(S) URL" ;; esac
|
||||
|
||||
if [ -z "$SERVER_IP" ]; then
|
||||
command -v ip >/dev/null 2>&1 || die "未找到 ip，请设置 OVERCOOKED_SERVER_IP"
|
||||
SERVER_IP=$(ip -4 route get 1.1.1.1 2>/dev/null | awk '{for (i=1;i<=NF;i++) if ($i=="src") {print $(i+1); exit}}')
|
||||
[ -n "$SERVER_IP" ] || die "无法识别服务器公网 IPv4，请设置 OVERCOOKED_SERVER_IP"
|
||||
EXPLICIT_SERVER_IP=0
|
||||
else
|
||||
EXPLICIT_SERVER_IP=1
|
||||
fi
|
||||
is_ipv4 "$SERVER_IP" || die "仅支持有效 IPv4 地址：$SERVER_IP"
|
||||
if [ "$EXPLICIT_SERVER_IP" = 0 ] && is_private_ipv4 "$SERVER_IP"; then
|
||||
die "检测到私有地址，请设置 OVERCOOKED_SERVER_IP=公网IPv4"
|
||||
fi
|
||||
command -v git >/dev/null 2>&1 || die "未找到 git"
|
||||
[ -n "$SERVER_IP" ] || SERVER_IP=$(ip -4 route get 1.1.1.1 2>/dev/null | awk '{for (i=1;i<=NF;i++) if ($i=="src") {print $(i+1); exit}}')
|
||||
[ -n "$SERVER_IP" ] || SERVER_IP=$(hostname -I 2>/dev/null | awk '{print $1}')
|
||||
[ -n "$SERVER_IP" ] || die "无法识别服务器 IP，请设置 OVERCOOKED_SERVER_IP"
|
||||
case "$SERVER_IP" in *[!0-9.]*|*[!0-9]*) die "仅支持 IPv4 地址：$SERVER_IP";; esac
|
||||
[ -n "$AUTH_PUBLIC_KEYS" ] || die "请设置 OVERCOOKED_AUTH_PUBLIC_KEYS（Auth 公钥 JSON）"
|
||||
case "$AUTH_PUBLIC_KEYS" in \{*\}) ;; *) die "OVERCOOKED_AUTH_PUBLIC_KEYS 必须是 JSON 对象" ;; esac
|
||||
case "$AUTH_PUBLIC_KEYS" in *'\n'*|*'\r'*) die "OVERCOOKED_AUTH_PUBLIC_KEYS 不得包含换行" ;; esac
|
||||
if [ -z "$ACTIVATION_CODE" ]; then
|
||||
[ -t 0 ] || die "授权码不能为空，请设置 OVERCOOKED_ACTIVATION_CODE"
|
||||
printf '请输入授权码: ' >&2; IFS= read -r ACTIVATION_CODE
|
||||
fi
|
||||
[ -n "$ACTIVATION_CODE" ] || printf '请输入授权码: '; [ -n "$ACTIVATION_CODE" ] || read -r ACTIVATION_CODE
|
||||
[ -n "$ACTIVATION_CODE" ] || die "授权码不能为空"
|
||||
check_port 18080; check_port 18083; check_port 8096
|
||||
|
||||
install -d -m 700 "$ROOT" "$ROOT/config" "$ROOT/compose" "$ROOT/migrations" "$ROOT/node-images" "$ROOT/control-plane"
|
||||
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
|
||||
fetch_asset() {
|
||||
relative=$1; destination=$2; source="$SCRIPT_DIR/$relative"
|
||||
if [ -f "$source" ]; then install -m 600 "$source" "$destination"; return; fi
|
||||
temporary=$(mktemp "$destination.download.XXXXXX")
|
||||
curl -fsSL --retry 3 --connect-timeout 10 --max-time 120 "$INSTALLER_BASE_URL/$relative" -o "$temporary" || die "下载公开 Installer 资产失败：$relative"
|
||||
[ -s "$temporary" ] || die "公开 Installer 资产为空：$relative"
|
||||
install -m 600 "$temporary" "$destination"; rm -f "$temporary"
|
||||
}
|
||||
fetch_asset compose/s.yml "$S_COMPOSE"
|
||||
fetch_asset compose/e.yml "$E_COMPOSE"
|
||||
fetch_asset s-migrate.sh "$ROOT/s-migrate.sh"
|
||||
chmod 644 "$ROOT/s-migrate.sh"
|
||||
fetch_asset config/e-server.production.yaml "$ROOT/config/e-server.production.yaml"
|
||||
chmod 644 "$ROOT/config/e-server.production.yaml"
|
||||
fetch_asset s-migrations.tar.gz "$ROOT/s-migrations.tar.gz"
|
||||
tar -xzf "$ROOT/s-migrations.tar.gz" -C "$ROOT/migrations"; rm -f "$ROOT/s-migrations.tar.gz"
|
||||
find "$ROOT/migrations" -type f ! -name '*.up.sql' -delete
|
||||
find "$ROOT/migrations" -type f -name '*.up.sql' -exec chmod 644 {} \;
|
||||
chmod 755 "$ROOT/migrations" "$ROOT/node-images"
|
||||
|
||||
# E requires an HTTPS control-plane origin in production. Generate a local
|
||||
# CA and service/client certificates for the restricted proxy sidecar. The
|
||||
# proxy is generated locally and runs from the already-approved S WebUI image;
|
||||
# no additional image or source checkout is needed.
|
||||
CONTROL_PLANE_DIR="$ROOT/control-plane"
|
||||
cat > "$CONTROL_PLANE_DIR/control-proxy.mjs" <<'NODE_PROXY'
|
||||
import fs from "node:fs";
|
||||
import http from "node:http";
|
||||
import https from "node:https";
|
||||
|
||||
const listenPort = 8443;
|
||||
const options = {
|
||||
key: fs.readFileSync("/run/overcooked-control-plane/server.key"),
|
||||
cert: fs.readFileSync("/run/overcooked-control-plane/server.crt"),
|
||||
ca: fs.readFileSync("/run/overcooked-control-plane/ca.crt"),
|
||||
requestCert: true,
|
||||
rejectUnauthorized: true,
|
||||
minVersion: "TLSv1.2",
|
||||
};
|
||||
|
||||
function reject(response, status, message) {
|
||||
response.writeHead(status, {"content-type": "text/plain; charset=utf-8"});
|
||||
response.end(message);
|
||||
}
|
||||
|
||||
const server = https.createServer(options, (request, response) => {
|
||||
let target;
|
||||
let decodedPath;
|
||||
try {
|
||||
target = new URL(request.url ?? "/", "https://control-proxy");
|
||||
decodedPath = decodeURIComponent(target.pathname);
|
||||
} catch {
|
||||
reject(response, 400, "invalid request target");
|
||||
return;
|
||||
}
|
||||
if (target.origin !== "https://control-proxy" || target.username || target.password ||
|
||||
decodedPath.includes("..") || decodedPath.includes("\u0000") ||
|
||||
decodedPath !== "/health/live" && !decodedPath.startsWith("/internal/v1/")) {
|
||||
reject(response, 404, "not found");
|
||||
return;
|
||||
}
|
||||
if (decodedPath === "/health/live") {
|
||||
response.writeHead(200, {"content-type": "application/json"});
|
||||
response.end('{"status":"live"}');
|
||||
return;
|
||||
}
|
||||
|
||||
const headers = {...request.headers};
|
||||
delete headers.host;
|
||||
delete headers.connection;
|
||||
delete headers["x-forwarded-for"];
|
||||
delete headers["x-forwarded-host"];
|
||||
delete headers["x-forwarded-proto"];
|
||||
headers.host = "s-control:8080";
|
||||
const upstream = http.request({hostname: "s-control", port: 8080, method: request.method, path: `${target.pathname}${target.search}`, headers, timeout: 10000}, (upstreamResponse) => {
|
||||
response.writeHead(upstreamResponse.statusCode ?? 502, upstreamResponse.headers);
|
||||
upstreamResponse.pipe(response);
|
||||
});
|
||||
upstream.on("timeout", () => upstream.destroy(new Error("upstream timeout")));
|
||||
upstream.on("error", () => {
|
||||
if (!response.headersSent) reject(response, 502, "control plane unavailable");
|
||||
else response.destroy();
|
||||
});
|
||||
request.pipe(upstream);
|
||||
});
|
||||
|
||||
server.listen(listenPort, "0.0.0.0");
|
||||
NODE_PROXY
|
||||
chmod 644 "$CONTROL_PLANE_DIR/control-proxy.mjs"
|
||||
chown 1000:1000 "$CONTROL_PLANE_DIR/control-proxy.mjs"
|
||||
openssl genrsa -out "$CONTROL_PLANE_DIR/ca.key" 3072
|
||||
openssl req -x509 -new -nodes -key "$CONTROL_PLANE_DIR/ca.key" -sha256 -days 3650 -subj "/CN=OverCooked customer control plane CA" -out "$CONTROL_PLANE_DIR/ca.crt"
|
||||
openssl genrsa -out "$CONTROL_PLANE_DIR/server.key" 2048
|
||||
openssl req -new -key "$CONTROL_PLANE_DIR/server.key" -subj "/CN=control-proxy" -out "$CONTROL_PLANE_DIR/server.csr"
|
||||
printf '%s\n' 'subjectAltName=DNS:control-proxy,DNS:product-e' 'extendedKeyUsage=serverAuth' > "$CONTROL_PLANE_DIR/server.ext"
|
||||
openssl x509 -req -in "$CONTROL_PLANE_DIR/server.csr" -CA "$CONTROL_PLANE_DIR/ca.crt" -CAkey "$CONTROL_PLANE_DIR/ca.key" -CAcreateserial -out "$CONTROL_PLANE_DIR/server.crt" -days 825 -sha256 -extfile "$CONTROL_PLANE_DIR/server.ext"
|
||||
openssl genrsa -out "$CONTROL_PLANE_DIR/client.key" 2048
|
||||
openssl req -new -key "$CONTROL_PLANE_DIR/client.key" -subj "/CN=overcooked-e" -out "$CONTROL_PLANE_DIR/client.csr"
|
||||
printf '%s\n' 'extendedKeyUsage=clientAuth' > "$CONTROL_PLANE_DIR/client.ext"
|
||||
openssl x509 -req -in "$CONTROL_PLANE_DIR/client.csr" -CA "$CONTROL_PLANE_DIR/ca.crt" -CAkey "$CONTROL_PLANE_DIR/ca.key" -CAcreateserial -out "$CONTROL_PLANE_DIR/client.crt" -days 825 -sha256 -extfile "$CONTROL_PLANE_DIR/client.ext"
|
||||
rm -f "$CONTROL_PLANE_DIR/ca.key" "$CONTROL_PLANE_DIR/server.csr" "$CONTROL_PLANE_DIR/server.ext" "$CONTROL_PLANE_DIR/client.csr" "$CONTROL_PLANE_DIR/client.ext" "$CONTROL_PLANE_DIR/ca.srl"
|
||||
chmod 644 "$CONTROL_PLANE_DIR/ca.crt" "$CONTROL_PLANE_DIR/server.crt" "$CONTROL_PLANE_DIR/client.crt"
|
||||
chmod 640 "$CONTROL_PLANE_DIR/server.key" "$CONTROL_PLANE_DIR/client.key"
|
||||
chown 1000:1000 "$CONTROL_PLANE_DIR/server.key"
|
||||
# The proxy healthcheck (uid 1000) and E (uid 10001) both need the client key;
|
||||
# a shared group keeps it unreadable to other container users.
|
||||
chown 1000:10001 "$CONTROL_PLANE_DIR/client.key"
|
||||
chmod 755 "$CONTROL_PLANE_DIR"
|
||||
|
||||
install -d -m 700 "$ROOT"
|
||||
for repo in OverCooked-S Overcooked-E; do
|
||||
if [ ! -d "$ROOT/$repo/.git" ]; then
|
||||
git clone --depth 1 "https://git.leee.xin/OverCooked/$repo.git" "$ROOT/$repo"
|
||||
else
|
||||
git -C "$ROOT/$repo" fetch --depth 1 origin && git -C "$ROOT/$repo" reset --hard FETCH_HEAD
|
||||
fi
|
||||
done
|
||||
install -d -m 700 "$ROOT/config"
|
||||
command -v openssl >/dev/null 2>&1 || die "未找到 openssl"
|
||||
secret() { openssl rand -hex 32; }
|
||||
S_POSTGRES_PASSWORD=$(secret); S_VALKEY_PASSWORD=$(secret)
|
||||
S_INTERNAL_SHARED_SECRET=$(secret); S_ACCESS_TOKEN_SECRET=$(secret); S_SETUP_TOKEN=$(secret)
|
||||
E_POSTGRES_PASSWORD=$(secret); E_PLAYBACK_TICKET_SECRET=$(secret); E_PLAYBACK_LEASE_KEY=$(secret)
|
||||
E_STORAGE_CREDENTIAL_KEY=$(secret); E_PLUGIN_SECRET_KEY=$(secret)
|
||||
INSTANCE_SUFFIX=$(hostname 2>/dev/null | tr -cd '[:alnum:]' | cut -c1-24); [ -n "$INSTANCE_SUFFIX" ] || INSTANCE_SUFFIX=customer
|
||||
|
||||
cat > "$ENV_FILE" <<EOF
|
||||
OVERCOOKED_ROOT=$ROOT
|
||||
s_db=$(secret); s_valkey=$(secret); internal=$(secret); access=$(secret); setup=$(secret)
|
||||
e_db=$(secret); ticket=$(secret); lease=$(secret); storage=$(secret); plugin=$(secret)
|
||||
cat >"$ROOT/production.env" <<EOF
|
||||
S_CONTROL_IMAGE=$REGISTRY/overcooked-s-control:$VERSION
|
||||
S_WEBUI_IMAGE=$REGISTRY/overcooked-s-webui:$VERSION
|
||||
S_POSTGRES_PASSWORD=$S_POSTGRES_PASSWORD
|
||||
S_VALKEY_PASSWORD=$S_VALKEY_PASSWORD
|
||||
S_POSTGRES_PASSWORD=$s_db
|
||||
S_VALKEY_PASSWORD=$s_valkey
|
||||
S_INTERNAL_KEY_ID=customer-s
|
||||
S_INTERNAL_SHARED_SECRET=$S_INTERNAL_SHARED_SECRET
|
||||
S_ACCESS_TOKEN_SECRET=$S_ACCESS_TOKEN_SECRET
|
||||
S_SETUP_TOKEN=$S_SETUP_TOKEN
|
||||
S_INTERNAL_SHARED_SECRET=$internal
|
||||
S_ACCESS_TOKEN_SECRET=$access
|
||||
S_SETUP_TOKEN=$setup
|
||||
S_E_BASE_URL=http://e-server:8096
|
||||
S_E_PUBLIC_URL=http://$SERVER_IP:8096
|
||||
S_E_KEY_ID=customer-e
|
||||
S_E_INTERNAL_SECRET=$S_INTERNAL_SHARED_SECRET
|
||||
# S's private backend client talks to E on the internal Docker network. This
|
||||
# does not weaken E's production mTLS control-plane connection below.
|
||||
S_E_INTERNAL_SECRET=$internal
|
||||
S_E_ALLOW_INSECURE_HTTP=true
|
||||
S_AUTH_BASE_URL=$AUTH_URL
|
||||
S_AUTH_ALLOW_INSECURE_HTTP=$(case "$AUTH_URL" in http://*) echo true ;; *) echo false ;; esac)
|
||||
S_AUTH_ALLOW_INSECURE_HTTP=$(case "$AUTH_URL" in http://*) echo true;; *) echo false;; esac)
|
||||
S_AUTH_PUBLIC_KEYS=$AUTH_PUBLIC_KEYS
|
||||
S_INSTANCE_ID=s-$INSTANCE_SUFFIX
|
||||
S_PLATFORM=linux-amd64
|
||||
S_VERSION=$VERSION
|
||||
S_INSTANCE_ID=s-$(hostname | tr -cd '[:alnum:]' | cut -c1-24)
|
||||
S_PUBLIC_HOST=$SERVER_IP
|
||||
S_PORTAL_SERVER_URL=http://$SERVER_IP:18080
|
||||
S_PORTAL_WEB_CLIENT_URL=http://$SERVER_IP:18083/login
|
||||
S_API_PORT_MAPPING=0.0.0.0:18080:8080
|
||||
S_WEB_PORT_MAPPING=0.0.0.0:18083:3000
|
||||
S_TURNSTILE_SITE_KEY=${OVERCOOKED_TURNSTILE_SITE_KEY:-}
|
||||
S_TURNSTILE_SECRET_KEY=${OVERCOOKED_TURNSTILE_SECRET_KEY:-}
|
||||
S_NODE_IMAGE_NAME=$REGISTRY/overcooked-media-node:$VERSION
|
||||
S_PORTAL_SERVER_URL=http://$SERVER_IP:$API_PORT
|
||||
S_PORTAL_WEB_CLIENT_URL=http://$SERVER_IP:$WEB_PORT/login
|
||||
S_API_PORT_MAPPING=0.0.0.0:$API_PORT:8080
|
||||
S_WEB_PORT_MAPPING=0.0.0.0:$WEB_PORT:3000
|
||||
PRODUCT_E_IMAGE=$REGISTRY/overcooked-e:$VERSION
|
||||
PRODUCT_E_INSTANCE_ID=e-$INSTANCE_SUFFIX
|
||||
PRODUCT_E_DATABASE_URL=postgres://product_e:$E_POSTGRES_PASSWORD@postgres:5432/product_e?sslmode=disable
|
||||
PRODUCT_E_POSTGRES_PASSWORD=$E_POSTGRES_PASSWORD
|
||||
PRODUCT_E_VALKEY_PASSWORD=$S_VALKEY_PASSWORD
|
||||
PRODUCT_E_CONTROL_PLANE_URL=https://control-proxy:8443
|
||||
PRODUCT_E_INSTANCE_ID=e-$(hostname | tr -cd '[:alnum:]' | cut -c1-24)
|
||||
PRODUCT_E_DATABASE_URL=postgres://product_e:$e_db@postgres:5432/product_e?sslmode=disable
|
||||
PRODUCT_E_POSTGRES_PASSWORD=$e_db
|
||||
PRODUCT_E_VALKEY_PASSWORD=$s_valkey
|
||||
PRODUCT_E_CONTROL_PLANE_URL=http://s-control:8080
|
||||
PRODUCT_E_CONTROL_PLANE_KEY_ID=customer-s
|
||||
PRODUCT_E_CONTROL_PLANE_SHARED_SECRET=$S_INTERNAL_SHARED_SECRET
|
||||
PRODUCT_E_CONTROL_PLANE_TLS_CERT_FILE=/run/overcooked-control-plane/client.crt
|
||||
PRODUCT_E_CONTROL_PLANE_TLS_KEY_FILE=/run/overcooked-control-plane/client.key
|
||||
PRODUCT_E_CONTROL_PLANE_TLS_CA_FILE=/run/overcooked-control-plane/ca.crt
|
||||
PRODUCT_E_CONTROL_PLANE_SHARED_SECRET=$internal
|
||||
PRODUCT_E_LICENSE_ENABLED=true
|
||||
PRODUCT_E_AUTH_URL=$AUTH_URL
|
||||
PRODUCT_E_AUTH_ALLOW_INSECURE_HTTP=$(case "$AUTH_URL" in http://*) echo true ;; *) echo false ;; esac)
|
||||
PRODUCT_E_AUTH_ACTIVATION_CODE=$ACTIVATION_CODE
|
||||
PRODUCT_E_AUTH_PUBLIC_KEYS=$AUTH_PUBLIC_KEYS
|
||||
PRODUCT_E_PLAYBACK_TICKET_KEY_ID=customer-playback
|
||||
PRODUCT_E_PLAYBACK_TICKET_SECRET=$E_PLAYBACK_TICKET_SECRET
|
||||
PRODUCT_E_PLAYBACK_LEASE_KEY=$E_PLAYBACK_LEASE_KEY
|
||||
PRODUCT_E_PLAYBACK_TICKET_SECRET=$ticket
|
||||
PRODUCT_E_PLAYBACK_LEASE_KEY=$lease
|
||||
PRODUCT_E_STORAGE_CREDENTIAL_KEY_ID=customer-storage
|
||||
PRODUCT_E_STORAGE_CREDENTIAL_KEY=$E_STORAGE_CREDENTIAL_KEY
|
||||
PRODUCT_E_STORAGE_CREDENTIAL_KEY=$storage
|
||||
PRODUCT_E_PLUGIN_SECRET_KEY_ID=customer-plugin
|
||||
PRODUCT_E_PLUGIN_SECRET_KEY=$E_PLUGIN_SECRET_KEY
|
||||
PRODUCT_E_PLUGIN_SECRET_KEY=$plugin
|
||||
PRODUCT_E_PLUGIN_TRUSTED_PUBLISHERS={}
|
||||
EOF
|
||||
chmod 600 "$ENV_FILE"
|
||||
chmod 600 "$ROOT/production.env"
|
||||
|
||||
cat > "$ROOT/config/e-server.production.yaml" <<EOF
|
||||
cat >"$ROOT/config/e-server.production.yaml" <<EOF
|
||||
service:
|
||||
name: overcooked-e
|
||||
instance_id: e-$INSTANCE_SUFFIX
|
||||
environment: production
|
||||
emby:
|
||||
server_name: OverCooked
|
||||
server_id: 10000000-0000-4000-8000-000000000001
|
||||
compatibility_version: 4.8.0.80
|
||||
control_plane:
|
||||
base_url: https://s-control.invalid
|
||||
key_id: customer-s
|
||||
shared_secret: replace-by-environment
|
||||
timeout: 10s
|
||||
server:
|
||||
address: 0.0.0.0:8096
|
||||
database:
|
||||
url: postgres://product_e:replace-by-environment@postgres:5432/product_e?sslmode=disable
|
||||
url: postgres://product_e:$(grep '^PRODUCT_E_POSTGRES_PASSWORD=' "$ROOT/production.env" | cut -d= -f2)@postgres:5432/product_e?sslmode=disable
|
||||
valkey:
|
||||
address: valkey:6379
|
||||
observability:
|
||||
log_level: info
|
||||
trace_sample_ratio: 0.05
|
||||
control_plane:
|
||||
base_url: http://s-control:8080
|
||||
playback:
|
||||
node_id: 10000000-0000-4000-8000-000000000001
|
||||
plugins:
|
||||
enabled: true
|
||||
root: /data/plugins
|
||||
sdk_socket: unix:///data/plugins/runtime/core.sock
|
||||
core_version: 0.1.0
|
||||
unsigned_policy: require-signature
|
||||
trusted_publishers: {}
|
||||
secret_key_id: customer-plugin
|
||||
previous_secret_keys: {}
|
||||
network_allowed_domains: []
|
||||
network_allowed_cidrs: []
|
||||
node_id: e-$(hostname | tr -cd '[:alnum:]' | cut -c1-24)
|
||||
EOF
|
||||
chmod 600 "$ROOT/config/e-server.production.yaml"
|
||||
cp "$ROOT/config/e-server.production.yaml" "$ROOT/Overcooked-E/deploy/compose/config/e-server.production.yaml"
|
||||
cat >"$ROOT/config/e-public.override.yml" <<'EOF'
|
||||
services:
|
||||
e-server:
|
||||
ports:
|
||||
- "0.0.0.0:8096:8096"
|
||||
EOF
|
||||
chmod 644 "$ROOT/config/e-server.production.yaml"
|
||||
|
||||
docker network inspect overcooked-control >/dev/null 2>&1 || docker network create overcooked-control >/dev/null
|
||||
docker compose --env-file "$ENV_FILE" -f "$E_COMPOSE" -p "$E_PROJECT" config >/dev/null
|
||||
docker compose --env-file "$ENV_FILE" -f "$S_COMPOSE" -p "$S_PROJECT" config >/dev/null
|
||||
|
||||
MEDIA_NODE_IMAGE="$REGISTRY/overcooked-media-node:$VERSION"
|
||||
for image in "$REGISTRY/overcooked-e:$VERSION" "$REGISTRY/overcooked-s-control:$VERSION" "$REGISTRY/overcooked-s-webui:$VERSION" "$MEDIA_NODE_IMAGE"; do
|
||||
docker pull "$image"
|
||||
docker image inspect "$image" >/dev/null 2>&1 || die "镜像校验失败：$image"
|
||||
done
|
||||
image_tar=$(mktemp "$ROOT/node-images/media-node.tar.XXXXXX")
|
||||
image_archive=$(mktemp "$ROOT/node-images/media-node.tar.gz.XXXXXX")
|
||||
docker save "$MEDIA_NODE_IMAGE" -o "$image_tar" || die "无法导出 Media Node 镜像归档"
|
||||
gzip -c "$image_tar" > "$image_archive" || die "无法压缩 Media Node 镜像归档"
|
||||
rm -f "$image_tar"
|
||||
mv "$image_archive" "$ROOT/node-images/media-node.tar.gz"
|
||||
chmod 644 "$ROOT/node-images/media-node.tar.gz"
|
||||
|
||||
wait_for_compose_health() {
|
||||
compose_file=$1; project=$2; service=$3; attempt=1
|
||||
while [ "$attempt" -le 60 ]; do
|
||||
container=$(docker compose --env-file "$ENV_FILE" -f "$compose_file" -p "$project" ps -q "$service" 2>/dev/null || true)
|
||||
status=''
|
||||
if [ -n "$container" ]; then
|
||||
status=$(docker inspect -f '{{.State.Health.Status}}' "$container" 2>/dev/null || true)
|
||||
fi
|
||||
[ "$status" = healthy ] && return 0
|
||||
[ "$status" = unhealthy ] && die "$service 容器健康检查失败"
|
||||
sleep 2
|
||||
attempt=$((attempt + 1))
|
||||
done
|
||||
die "$service 容器健康检查超时"
|
||||
}
|
||||
|
||||
docker compose --env-file "$ENV_FILE" -f "$E_COMPOSE" -p "$E_PROJECT" up -d postgres valkey
|
||||
docker compose --env-file "$ENV_FILE" -f "$E_COMPOSE" -p "$E_PROJECT" run --rm --no-deps e-server migrate -config /etc/overcooked-e/config.yaml
|
||||
docker compose --env-file "$ENV_FILE" -f "$S_COMPOSE" -p "$S_PROJECT" up -d postgres valkey
|
||||
docker compose --env-file "$ENV_FILE" -f "$S_COMPOSE" -p "$S_PROJECT" run --rm --no-deps s-migrate
|
||||
docker compose --env-file "$ENV_FILE" -f "$S_COMPOSE" -p "$S_PROJECT" up -d s-control control-proxy webui
|
||||
wait_for_compose_health "$S_COMPOSE" "$S_PROJECT" control-proxy
|
||||
docker compose --env-file "$ENV_FILE" -f "$E_COMPOSE" -p "$E_PROJECT" up -d e-server
|
||||
|
||||
wait_for() {
|
||||
label=$1; url=$2; attempt=1
|
||||
while [ "$attempt" -le 60 ]; do
|
||||
curl -fsS --max-time 5 "$url" >/dev/null 2>&1 && return 0
|
||||
sleep 2; attempt=$((attempt + 1))
|
||||
done
|
||||
die "$label 健康检查失败：$url"
|
||||
}
|
||||
wait_for "S live" http://127.0.0.1:18080/health/live
|
||||
wait_for "S ready" http://127.0.0.1:18080/health/ready
|
||||
wait_for "E live" http://127.0.0.1:8096/health/live
|
||||
wait_for "WebUI" http://127.0.0.1:18083/
|
||||
wait_for "Setup" http://127.0.0.1:18083/setup
|
||||
|
||||
echo "OverCooked 客户部署已通过容器健康检查。"
|
||||
echo "WebUI: http://$SERVER_IP:18083/"
|
||||
echo "API: http://$SERVER_IP:18080/"
|
||||
docker compose -p overcooked-e --env-file "$ROOT/production.env" -f "$ROOT/Overcooked-E/deploy/compose/production.yml" run --rm e-server migrate
|
||||
docker compose -p overcooked-e --env-file "$ROOT/production.env" -f "$ROOT/Overcooked-E/deploy/compose/production.yml" -f "$ROOT/Overcooked-E/deploy/compose/control-plane-network.yml" -f "$ROOT/config/e-public.override.yml" up -d --no-build
|
||||
docker compose -p overcooked-s --env-file "$ROOT/production.env" -f "$ROOT/OverCooked-S/deploy/s/docker-compose.production.yml" up -d --no-build
|
||||
echo "配置已写入 $ROOT/production.env"
|
||||
echo "WebUI: http://$SERVER_IP:$WEB_PORT/"
|
||||
echo "API: http://$SERVER_IP:$API_PORT/"
|
||||
echo "E: http://$SERVER_IP:8096/"
|
||||
echo "首次初始化: http://$SERVER_IP:18083/setup"
|
||||
echo "Setup Token 已保存于 $ENV_FILE（不会在终端显示，请限制文件访问权限）。"
|
||||
echo "镜像来源：$REGISTRY（仅公开 E、S Control、S WebUI、Media Node；不包含 Auth 镜像）"
|
||||
echo "首次启动后打开 http://$SERVER_IP:18083/setup 输入授权码和页面显示的 Setup Token。"
|
||||
echo "镜像来源：$REGISTRY（不包含 Auth 镜像）"
|
||||
Reference in new issue
Block a user