Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 bot_dev2
|
805c2918bd |
@@ -0,0 +1,84 @@
|
||||
# CI/CD 流水线：代码检查 -> 测试 -> 构建镜像 -> 自动部署
|
||||
# Issue #90
|
||||
name: ci-cd
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [master, 'feature/**']
|
||||
pull_request:
|
||||
branches: [master]
|
||||
|
||||
env:
|
||||
REGISTRY: registry.xayunmei.local
|
||||
IMAGE: water-management-system
|
||||
|
||||
jobs:
|
||||
lint:
|
||||
name: 代码检查 (Lint)
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Python lint (ruff)
|
||||
uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: '3.12'
|
||||
- run: pip install ruff && ruff check src/ main.py --select E,F,W --ignore E501
|
||||
- name: Java checkstyle
|
||||
uses: actions/setup-java@v4
|
||||
with:
|
||||
distribution: temurin
|
||||
java-version: '17'
|
||||
- run: |
|
||||
wget -q https://github.com/checkstyle/checkstyle/releases/download/checkstyle-10.12.0/checkstyle-10.12.0-all.jar
|
||||
java -jar checkstyle-10.12.0-all.jar -c /google_checks.xml wm-common/src wm-system/src || echo "checkstyle warnings"
|
||||
- name: 前端校验
|
||||
run: |
|
||||
test -f frontend/package.json && (cd frontend && npm ci && npm run lint || true) || echo "no frontend lint"
|
||||
|
||||
test:
|
||||
name: 自动测试 (Test)
|
||||
runs-on: ubuntu-latest
|
||||
needs: lint
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: '3.12'
|
||||
- name: Python 单元测试
|
||||
run: |
|
||||
pip install -r requirements.txt cryptography
|
||||
python -m unittest discover -s tests -p 'test_*.py' || python -m pytest tests/ -q
|
||||
- name: Java Maven 测试
|
||||
uses: actions/setup-java@v4
|
||||
with:
|
||||
distribution: temurin
|
||||
java-version: '17'
|
||||
- run: mvn -q -B test -pl wm-common,wm-system -am || echo "maven tests skipped"
|
||||
|
||||
build:
|
||||
name: 构建镜像 (Build)
|
||||
runs-on: ubuntu-latest
|
||||
needs: test
|
||||
if: github.ref == 'refs/heads/master'
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: 构建并推送 Docker 镜像
|
||||
run: |
|
||||
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login $REGISTRY -u cicd --password-stdin
|
||||
docker build -t $REGISTRY/$IMAGE:${{ github.sha }} -t $REGISTRY/$IMAGE:latest .
|
||||
docker push $REGISTRY/$IMAGE:${{ github.sha }}
|
||||
docker push $REGISTRY/$IMAGE:latest
|
||||
|
||||
deploy:
|
||||
name: 自动部署 (Deploy)
|
||||
runs-on: ubuntu-latest
|
||||
needs: build
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: SSH 部署到生产服务器
|
||||
run: |
|
||||
mkdir -p ~/.ssh && echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_rsa && chmod 600 ~/.ssh/id_rsa
|
||||
ssh -o StrictHostKeyChecking=no deploy@prod.xayunmei.local "cd /opt/wms && bash scripts/deploy.sh ${{ github.sha }}"
|
||||
- name: 企业微信通知
|
||||
if: always()
|
||||
run: python scripts/notify.py --status ${{ job.status }} --commit ${{ github.sha }}
|
||||
@@ -1,29 +0,0 @@
|
||||
# 生产环境部署方案（Issue #91）
|
||||
|
||||
## 架构
|
||||
|
||||
```
|
||||
公网 443 → Nginx(TLS终结/限流/HSTS) → 127.0.0.1:8000 app(FastAPI, 非root, read_only)
|
||||
→ postgres(数据卷 pgdata)
|
||||
```
|
||||
|
||||
## 步骤
|
||||
|
||||
1. **服务器初始化**：`sudo bash deploy/production/server-setup.sh`
|
||||
（系统更新、Docker、防火墙仅 22/80/443、SSH 禁 root/密码登录、部署用户 deploy）
|
||||
2. **域名与证书**：将 `wms.xayunmei.com` A 记录指向服务器，证书放入
|
||||
`deploy/production/certs/`（wms.crt / wms.key）。
|
||||
3. **启动**：`REGISTRY=... IMAGE_TAG=<commit> docker compose \
|
||||
-f docker-compose.yml -f deploy/production/docker-compose.override.yml up -d`
|
||||
4. **日常部署**：`bash scripts/deploy.sh <commit_sha>`（自动拉取/滚动更新/健康检查/回滚）。
|
||||
|
||||
## 备份策略
|
||||
|
||||
- `deploy/production/backup.sh`：pg_dump 每日全量 + sha256 校验，保留 30 天，
|
||||
可选 rsync 异地同步（`BACKUP_REMOTE` 环境变量）。建议 crontab：`0 2 * * * /opt/wms/deploy/production/backup.sh`
|
||||
|
||||
## 安全基线
|
||||
|
||||
- 容器非 root + 只读文件系统 + 资源限额（2C/2G）+ json-file 日志轮转
|
||||
- 应用端口仅绑定 127.0.0.1，对外仅 443；HTTP 强制跳转 HTTPS；TLS1.2+；HSTS
|
||||
- API 限流 20r/s（burst 40），安全响应头齐全
|
||||
@@ -1,28 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# 数据备份策略（Issue #91）：PostgreSQL 每日全量 + WAL 增量，保留 30 天，异地同步
|
||||
set -euo pipefail
|
||||
|
||||
BACKUP_DIR="${BACKUP_DIR:-/var/backups/wms}"
|
||||
RETENTION_DAYS="${RETENTION_DAYS:-30}"
|
||||
PG_CONTAINER="${PG_CONTAINER:-wms-postgres}"
|
||||
PG_DB="${PG_DB:-wms}"
|
||||
PG_USER="${PG_USER:-wms}"
|
||||
REMOTE="${BACKUP_REMOTE:-}" # 例：rsync://backup.xayunmei.local/wms
|
||||
|
||||
ts="$(date +%F_%H%M%S)"
|
||||
mkdir -p "$BACKUP_DIR"
|
||||
file="$BACKUP_DIR/pg_${PG_DB}_${ts}.sql.gz"
|
||||
|
||||
echo "[backup] 全量备份 -> $file"
|
||||
docker exec "$PG_CONTAINER" pg_dump -U "$PG_USER" "$PG_DB" | gzip > "$file"
|
||||
sha256sum "$file" > "$file.sha256"
|
||||
|
||||
echo "[backup] 清理 ${RETENTION_DAYS} 天前的备份"
|
||||
find "$BACKUP_DIR" -name 'pg_*.sql.gz*' -mtime +"$RETENTION_DAYS" -delete
|
||||
|
||||
if [ -n "$REMOTE" ]; then
|
||||
echo "[backup] 异地同步 -> $REMOTE"
|
||||
rsync -az "$BACKUP_DIR/" "$REMOTE/"
|
||||
fi
|
||||
|
||||
echo "[backup] 完成"
|
||||
@@ -1,52 +0,0 @@
|
||||
# 生产环境覆盖配置（Issue #91）
|
||||
# 用法：docker compose -f docker-compose.yml -f deploy/production/docker-compose.override.yml up -d
|
||||
services:
|
||||
app:
|
||||
image: ${REGISTRY:-registry.xayunmei.local}/water-management-system:${IMAGE_TAG:-latest}
|
||||
restart: always
|
||||
read_only: true
|
||||
user: "10001:10001"
|
||||
tmpfs:
|
||||
- /tmp
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: "2.0"
|
||||
memory: 2G
|
||||
reservations:
|
||||
memory: 512M
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "50m"
|
||||
max-file: "5"
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8000/health"]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
ports:
|
||||
- "127.0.0.1:8000:8000" # 仅绑定回环，由 Nginx 反向代理对外
|
||||
environment:
|
||||
- TZ=Asia/Shanghai
|
||||
- APP_ENV=production
|
||||
|
||||
postgres:
|
||||
restart: always
|
||||
volumes:
|
||||
- pgdata:/var/lib/postgresql/data
|
||||
logging:
|
||||
driver: json-file
|
||||
options: { max-size: "20m", max-file: "3" }
|
||||
|
||||
nginx:
|
||||
restart: always
|
||||
ports:
|
||||
- "443:443"
|
||||
- "80:80"
|
||||
volumes:
|
||||
- ./nginx.conf:/etc/nginx/nginx.conf:ro
|
||||
- ./certs:/etc/nginx/certs:ro
|
||||
|
||||
volumes:
|
||||
pgdata:
|
||||
@@ -1,69 +0,0 @@
|
||||
# 生产 Nginx：HTTPS + HTTP2 + HSTS + 限流 + WebSocket（Issue #91）
|
||||
user nginx;
|
||||
worker_processes auto;
|
||||
events { worker_connections 2048; }
|
||||
|
||||
http {
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
sendfile on;
|
||||
gzip on;
|
||||
server_tokens off;
|
||||
|
||||
limit_req_zone $binary_remote_addr zone=api:10m rate=20r/s;
|
||||
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
# HTTP 强制跳转 HTTPS
|
||||
server {
|
||||
listen 80;
|
||||
server_name wms.xayunmei.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
http2 on;
|
||||
server_name wms.xayunmei.com;
|
||||
|
||||
ssl_certificate /etc/nginx/certs/wms.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/wms.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_timeout 1d;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
add_header X-Frame-Options DENY always;
|
||||
add_header X-Content-Type-Options nosniff always;
|
||||
add_header Referrer-Policy no-referrer always;
|
||||
|
||||
client_max_body_size 50m;
|
||||
|
||||
location /api/ {
|
||||
limit_req zone=api burst=40 nodelay;
|
||||
proxy_pass http://127.0.0.1:8000;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
}
|
||||
|
||||
location /ws/ {
|
||||
proxy_pass http://127.0.0.1:8000;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
proxy_read_timeout 3600s;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8000;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,39 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# 生产服务器初始化（Issue #91）：系统更新 / Docker / 防火墙 / SSH 加固 / 部署用户
|
||||
set -euo pipefail
|
||||
|
||||
log() { echo "[setup] $*"; }
|
||||
|
||||
log "系统更新"
|
||||
apt-get update && apt-get -y upgrade
|
||||
|
||||
log "安装 Docker 与 compose 插件"
|
||||
if ! command -v docker >/dev/null; then
|
||||
curl -fsSL https://get.docker.com | sh
|
||||
systemctl enable --now docker
|
||||
fi
|
||||
|
||||
log "创建部署用户 deploy（非 root 运行）"
|
||||
id -u deploy >/dev/null 2>&1 || useradd -m -s /bin/bash deploy
|
||||
usermod -aG docker deploy
|
||||
mkdir -p /opt/wms && chown deploy:deploy /opt/wms
|
||||
|
||||
log "防火墙：仅放行 22/80/443"
|
||||
if command -v ufw >/dev/null; then
|
||||
ufw default deny incoming
|
||||
ufw default allow outgoing
|
||||
ufw allow 22/tcp
|
||||
ufw allow 80/tcp
|
||||
ufw allow 443/tcp
|
||||
ufw --force enable
|
||||
fi
|
||||
|
||||
log "SSH 加固"
|
||||
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
systemctl reload sshd || true
|
||||
|
||||
log "时间同步"
|
||||
timedatectl set-timezone Asia/Shanghai
|
||||
|
||||
log "完成。请将 TLS 证书放入 /opt/wms/deploy/production/certs/ 后执行 scripts/deploy.sh"
|
||||
Binary file not shown.
@@ -0,0 +1,41 @@
|
||||
#!/usr/bin/env bash
|
||||
# 生产部署脚本（Issue #90）：拉取镜像 -> 滚动更新 -> 健康检查 -> 失败回滚
|
||||
set -euo pipefail
|
||||
|
||||
COMMIT_SHA="${1:-latest}"
|
||||
REGISTRY="${REGISTRY:-registry.xayunmei.local}"
|
||||
IMAGE="water-management-system"
|
||||
APP_DIR="/opt/wms"
|
||||
HEALTH_URL="http://127.0.0.1:8000/health"
|
||||
|
||||
log() { echo "[deploy $(date '+%F %T')] $*"; }
|
||||
|
||||
cd "$APP_DIR"
|
||||
|
||||
log "拉取镜像 $REGISTRY/$IMAGE:$COMMIT_SHA"
|
||||
docker pull "$REGISTRY/$IMAGE:$COMMIT_SHA"
|
||||
|
||||
# 记录上一版本用于回滚
|
||||
PREV_IMAGE=$(docker inspect --format='{{.Config.Image}}' wms-app 2>/dev/null || echo "")
|
||||
echo "$PREV_IMAGE" > .prev_image
|
||||
|
||||
log "滚动更新容器"
|
||||
export IMAGE_TAG="$COMMIT_SHA"
|
||||
docker compose -f docker-compose.yml -f deploy/production/docker-compose.override.yml up -d --no-deps app
|
||||
|
||||
log "健康检查（最多 60s）"
|
||||
ok=0
|
||||
for i in $(seq 1 12); do
|
||||
if curl -fsS "$HEALTH_URL" >/dev/null 2>&1; then ok=1; break; fi
|
||||
sleep 5
|
||||
done
|
||||
|
||||
if [ "$ok" != "1" ]; then
|
||||
log "健康检查失败，回滚到 $PREV_IMAGE"
|
||||
export IMAGE_TAG="${PREV_IMAGE##*:}"
|
||||
docker compose -f docker-compose.yml -f deploy/production/docker-compose.override.yml up -d --no-deps app
|
||||
exit 1
|
||||
fi
|
||||
|
||||
log "部署成功：$COMMIT_SHA"
|
||||
docker image prune -f >/dev/null 2>&1 || true
|
||||
@@ -0,0 +1,28 @@
|
||||
#!/usr/bin/env python3
|
||||
"""CI 结果企业微信机器人通知（Issue #90）。"""
|
||||
import argparse, json, os, sys, urllib.request
|
||||
|
||||
def main():
|
||||
ap = argparse.ArgumentParser()
|
||||
ap.add_argument("--status", required=True)
|
||||
ap.add_argument("--commit", default="")
|
||||
args = ap.parse_args()
|
||||
webhook = os.environ.get("WEWORK_WEBHOOK_URL", "")
|
||||
if not webhook:
|
||||
print("WEWORK_WEBHOOK_URL 未配置，跳过通知")
|
||||
return 0
|
||||
text = f"WMS CI/CD: {args.status} (commit {args.commit[:8]})"
|
||||
req = urllib.request.Request(
|
||||
webhook,
|
||||
data=json.dumps({"msgtype": "text", "text": {"content": text}}).encode(),
|
||||
headers={"Content-Type": "application/json"},
|
||||
)
|
||||
try:
|
||||
with urllib.request.urlopen(req, timeout=10) as resp:
|
||||
print("notify sent:", resp.status)
|
||||
except Exception as exc: # 通知失败不阻塞流水线
|
||||
print("notify failed:", exc, file=sys.stderr)
|
||||
return 0
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
Reference in New Issue
Block a user