docs: 更新 MPC-System 部署指南为 Docker Compose 一键部署
根据实际的 mpc-system/docker-compose.yml 更新部署文档: - 更新系统要求 (Docker 24.0+, 4GB RAM) - 添加服务架构说明 (account-service, session-coordinator 等) - 提供一键部署步骤 (clone -> .env -> docker compose up) - 添加 .env 配置模板 - 更新服务端口说明 (仅暴露 4000 端口) - 更新 API 端点说明 - 添加运维命令参考 部署路径: /home/ceshi/rwadurian/backend/mpc-system 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Developer
parent
c63be04322
commit
42735e41ef
|
|
@ -470,161 +470,136 @@ server {
|
|||
|
||||
## 4. MPC-System 部署 (192.168.1.100)
|
||||
|
||||
MPC-System 是一个独立的 Go 服务，负责 TSS (Threshold Signature Scheme) 密钥生成和签名操作。
|
||||
MPC-System 是一组 Go 微服务，负责 TSS (Threshold Signature Scheme) 密钥生成和签名操作。
|
||||
采用 2-of-3 阈值签名方案，包含多个内部服务通过 Docker Compose 一键部署。
|
||||
|
||||
### 4.1 系统要求
|
||||
|
||||
- Go 1.21+
|
||||
- 最小 2GB RAM
|
||||
- 10GB 磁盘空间
|
||||
- Docker 24.0+
|
||||
- Docker Compose v2.20+
|
||||
- 最小 4GB RAM
|
||||
- 20GB 磁盘空间
|
||||
|
||||
### 4.2 部署方式
|
||||
### 4.2 服务架构
|
||||
|
||||
#### 方式一: 直接运行 (推荐生产环境)
|
||||
```
|
||||
MPC-System (Docker Compose)
|
||||
├── account-service # 对外 API 入口 (端口 4000)
|
||||
├── session-coordinator # 会话协调器
|
||||
├── message-router # 消息路由
|
||||
├── server-party-1 # TSS 参与方 1
|
||||
├── server-party-2 # TSS 参与方 2
|
||||
├── server-party-3 # TSS 参与方 3
|
||||
├── postgres # 数据库
|
||||
├── redis # 缓存
|
||||
└── rabbitmq # 消息队列
|
||||
```
|
||||
|
||||
### 4.3 一键部署 (Docker Compose)
|
||||
|
||||
```bash
|
||||
# 1. 创建部署目录
|
||||
mkdir -p /opt/mpc-system
|
||||
cd /opt/mpc-system
|
||||
# ============================================
|
||||
# 步骤 1: 安装 Docker
|
||||
# ============================================
|
||||
curl -fsSL https://get.docker.com | sh
|
||||
usermod -aG docker $USER
|
||||
# 重新登录以使 docker 组生效
|
||||
|
||||
# 2. 下载或复制编译好的二进制文件
|
||||
# 从构建服务器复制 mpc-system 可执行文件
|
||||
scp build-server:/path/to/mpc-system .
|
||||
# ============================================
|
||||
# 步骤 2: 克隆代码
|
||||
# ============================================
|
||||
cd /home/ceshi
|
||||
git clone https://github.com/your-org/rwadurian.git
|
||||
cd rwadurian/backend/mpc-system
|
||||
|
||||
# 3. 创建配置文件
|
||||
cat > config.yaml << 'EOF'
|
||||
server:
|
||||
host: 0.0.0.0
|
||||
port: 4000
|
||||
# ============================================
|
||||
# 步骤 3: 配置环境变量
|
||||
# ============================================
|
||||
cp .env.example .env
|
||||
vim .env # 修改为生产环境配置
|
||||
```
|
||||
|
||||
# TSS 配置
|
||||
tss:
|
||||
threshold: 2 # 签名阈值 (t of n)
|
||||
parties: 3 # 总参与方数量
|
||||
**.env 文件内容:**
|
||||
|
||||
# 日志配置
|
||||
log:
|
||||
level: info
|
||||
format: json
|
||||
output: /var/log/mpc-system/mpc.log
|
||||
```bash
|
||||
# 环境标识
|
||||
ENVIRONMENT=production
|
||||
|
||||
# 安全配置
|
||||
security:
|
||||
# 只允许后端服务器访问
|
||||
allowed_ips:
|
||||
- 192.168.1.111
|
||||
# API 认证密钥
|
||||
api_key: ${MPC_API_KEY}
|
||||
EOF
|
||||
# PostgreSQL 数据库
|
||||
POSTGRES_USER=mpc_user
|
||||
POSTGRES_PASSWORD=your_secure_postgres_password_here
|
||||
|
||||
# 4. 创建日志目录
|
||||
mkdir -p /var/log/mpc-system
|
||||
# Redis 缓存 (留空表示不需要密码)
|
||||
REDIS_PASSWORD=
|
||||
|
||||
# 5. 创建 systemd 服务
|
||||
cat > /etc/systemd/system/mpc-system.service << 'EOF'
|
||||
[Unit]
|
||||
Description=MPC System - TSS Key Generation and Signing Service
|
||||
After=network.target
|
||||
# RabbitMQ 消息队列
|
||||
RABBITMQ_USER=mpc_user
|
||||
RABBITMQ_PASSWORD=your_secure_rabbitmq_password_here
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=mpc
|
||||
Group=mpc
|
||||
WorkingDirectory=/opt/mpc-system
|
||||
ExecStart=/opt/mpc-system/mpc-system -config /opt/mpc-system/config.yaml
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
Environment=MPC_API_KEY=your_secure_api_key_here
|
||||
# JWT 配置 (至少 32 字符)
|
||||
JWT_SECRET_KEY=your_super_secure_jwt_secret_key_at_least_32_characters
|
||||
|
||||
# 安全限制
|
||||
NoNewPrivileges=true
|
||||
PrivateTmp=true
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
ReadWritePaths=/var/log/mpc-system /opt/mpc-system/data
|
||||
# 主加密密钥 (64 位十六进制 = 256 位密钥，用于加密密钥分片)
|
||||
CRYPTO_MASTER_KEY=your_64_hex_characters_master_key_here
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
# API 认证密钥 (与 mpc-service 配置的 MPC_API_KEY 一致)
|
||||
MPC_API_KEY=your_very_secure_api_key_at_least_32_characters
|
||||
|
||||
# 6. 创建专用用户
|
||||
useradd -r -s /bin/false mpc
|
||||
chown -R mpc:mpc /opt/mpc-system /var/log/mpc-system
|
||||
# 允许访问的 IP 地址 (后端服务器)
|
||||
ALLOWED_IPS=192.168.1.111
|
||||
```
|
||||
|
||||
# 7. 启动服务
|
||||
systemctl daemon-reload
|
||||
systemctl enable mpc-system
|
||||
systemctl start mpc-system
|
||||
```bash
|
||||
# ============================================
|
||||
# 步骤 4: 构建并启动服务
|
||||
# ============================================
|
||||
docker compose up -d --build
|
||||
|
||||
# 8. 检查状态
|
||||
systemctl status mpc-system
|
||||
# 查看服务状态
|
||||
docker compose ps
|
||||
|
||||
# 查看日志
|
||||
docker compose logs -f
|
||||
|
||||
# ============================================
|
||||
# 步骤 5: 验证部署
|
||||
# ============================================
|
||||
# 健康检查
|
||||
curl http://localhost:4000/health
|
||||
|
||||
# 查看所有容器状态
|
||||
docker compose ps
|
||||
```
|
||||
|
||||
#### 方式二: Docker 部署
|
||||
### 4.4 服务端口说明
|
||||
|
||||
```bash
|
||||
# 1. 创建 Dockerfile (如果需要)
|
||||
cat > /opt/mpc-system/Dockerfile << 'EOF'
|
||||
FROM golang:1.21-alpine AS builder
|
||||
WORKDIR /app
|
||||
COPY . .
|
||||
RUN go build -o mpc-system ./cmd/main.go
|
||||
| 服务 | 容器内端口 | 主机端口 | 说明 |
|
||||
|------|-----------|---------|------|
|
||||
| account-service | 8080 | **4000** | 对外 API 入口，供 mpc-service 调用 |
|
||||
| session-coordinator | 8080, 50051 | - | 会话协调 (内部) |
|
||||
| message-router | 8080, 50051 | - | 消息路由 (内部) |
|
||||
| server-party-1/2/3 | 8080, 50051 | - | TSS 参与方 (内部) |
|
||||
| postgres | 5432 | - | 数据库 (内部) |
|
||||
| redis | 6379 | - | 缓存 (内部) |
|
||||
| rabbitmq | 5672, 15672 | - | 消息队列 (内部) |
|
||||
|
||||
FROM alpine:3.19
|
||||
RUN apk add --no-cache ca-certificates
|
||||
COPY --from=builder /app/mpc-system /usr/local/bin/
|
||||
COPY --from=builder /app/config.yaml /etc/mpc-system/
|
||||
EXPOSE 4000
|
||||
CMD ["mpc-system", "-config", "/etc/mpc-system/config.yaml"]
|
||||
EOF
|
||||
> **注意**: 生产环境仅暴露端口 4000，其他服务仅在 Docker 内部网络可访问。
|
||||
|
||||
# 2. 使用 docker-compose
|
||||
cat > /opt/mpc-system/docker-compose.yml << 'EOF'
|
||||
services:
|
||||
mpc-system:
|
||||
build: .
|
||||
ports:
|
||||
- "4000:4000"
|
||||
environment:
|
||||
- MPC_API_KEY=${MPC_API_KEY}
|
||||
volumes:
|
||||
- ./config.yaml:/etc/mpc-system/config.yaml:ro
|
||||
- mpc_data:/opt/mpc-system/data
|
||||
- mpc_logs:/var/log/mpc-system
|
||||
restart: unless-stopped
|
||||
# 网络隔离 - 只允许内网访问
|
||||
networks:
|
||||
- internal
|
||||
### 4.5 MPC-System API 端点
|
||||
|
||||
networks:
|
||||
internal:
|
||||
driver: bridge
|
||||
internal: true
|
||||
|
||||
volumes:
|
||||
mpc_data:
|
||||
mpc_logs:
|
||||
EOF
|
||||
|
||||
# 3. 启动
|
||||
cd /opt/mpc-system
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
### 4.3 MPC-System API 端点
|
||||
Account Service (端口 4000) 对外提供以下 API:
|
||||
|
||||
| 端点 | 方法 | 说明 |
|
||||
|------|------|------|
|
||||
| `/health` | GET | 健康检查 |
|
||||
| `/api/v1/keygen` | POST | TSS 密钥生成 |
|
||||
| `/api/v1/sign` | POST | TSS 签名 |
|
||||
| `/api/v1/reshare` | POST | 密钥重新分片 |
|
||||
| `/api/v1/account/create` | POST | 创建 MPC 账户 (触发密钥生成) |
|
||||
| `/api/v1/account/sign` | POST | 请求签名 |
|
||||
| `/api/v1/account/recovery` | POST | 账户恢复 |
|
||||
|
||||
### 4.4 防火墙配置
|
||||
### 4.6 防火墙配置
|
||||
|
||||
```bash
|
||||
# 只允许后端服务器 (192.168.1.111) 访问 MPC-System
|
||||
# 只允许后端服务器 (192.168.1.111) 访问 MPC-System 端口 4000
|
||||
iptables -A INPUT -p tcp --dport 4000 -s 192.168.1.111 -j ACCEPT
|
||||
iptables -A INPUT -p tcp --dport 4000 -j DROP
|
||||
|
||||
|
|
@ -632,16 +607,31 @@ iptables -A INPUT -p tcp --dport 4000 -j DROP
|
|||
iptables-save > /etc/iptables/rules.v4
|
||||
```
|
||||
|
||||
### 4.5 环境变量
|
||||
|
||||
在 192.168.1.100 服务器上创建 `/opt/mpc-system/.env`:
|
||||
### 4.7 运维命令
|
||||
|
||||
```bash
|
||||
# MPC API 认证密钥 (与 mpc-service 配置一致)
|
||||
MPC_API_KEY=your_very_secure_api_key_at_least_32_characters
|
||||
cd /home/ceshi/rwadurian/backend/mpc-system
|
||||
|
||||
# 日志级别
|
||||
LOG_LEVEL=info
|
||||
# 查看服务状态
|
||||
docker compose ps
|
||||
|
||||
# 查看日志
|
||||
docker compose logs -f # 所有服务
|
||||
docker compose logs -f account-service # 单个服务
|
||||
docker compose logs --tail=100 account-service # 最近 100 行
|
||||
|
||||
# 重启服务
|
||||
docker compose restart # 重启所有
|
||||
docker compose restart account-service # 重启单个
|
||||
|
||||
# 停止服务
|
||||
docker compose down
|
||||
|
||||
# 重新构建并启动
|
||||
docker compose up -d --build
|
||||
|
||||
# 清理数据 (危险! 会删除所有数据)
|
||||
docker compose down -v
|
||||
```
|
||||
|
||||
## 5. 后端服务器配置 (192.168.1.111)
|
||||
|
|
|
|||
Loading…
Reference in New Issue