40 lines
1.1 KiB
Bash
40 lines
1.1 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# 生产服务器初始化（Issue #91）：系统更新 / Docker / 防火墙 / SSH 加固 / 部署用户
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
log() { echo "[setup] $*"; }
|
||
|
|
|
||
|
|
log "系统更新"
|
||
|
|
apt-get update && apt-get -y upgrade
|
||
|
|
|
||
|
|
log "安装 Docker 与 compose 插件"
|
||
|
|
if ! command -v docker >/dev/null; then
|
||
|
|
curl -fsSL https://get.docker.com | sh
|
||
|
|
systemctl enable --now docker
|
||
|
|
fi
|
||
|
|
|
||
|
|
log "创建部署用户 deploy（非 root 运行）"
|
||
|
|
id -u deploy >/dev/null 2>&1 || useradd -m -s /bin/bash deploy
|
||
|
|
usermod -aG docker deploy
|
||
|
|
mkdir -p /opt/wms && chown deploy:deploy /opt/wms
|
||
|
|
|
||
|
|
log "防火墙：仅放行 22/80/443"
|
||
|
|
if command -v ufw >/dev/null; then
|
||
|
|
ufw default deny incoming
|
||
|
|
ufw default allow outgoing
|
||
|
|
ufw allow 22/tcp
|
||
|
|
ufw allow 80/tcp
|
||
|
|
ufw allow 443/tcp
|
||
|
|
ufw --force enable
|
||
|
|
fi
|
||
|
|
|
||
|
|
log "SSH 加固"
|
||
|
|
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||
|
|
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||
|
|
systemctl reload sshd || true
|
||
|
|
|
||
|
|
log "时间同步"
|
||
|
|
timedatectl set-timezone Asia/Shanghai
|
||
|
|
|
||
|
|
log "完成。请将 TLS 证书放入 /opt/wms/deploy/production/certs/ 后执行 scripts/deploy.sh"
|