docs: 更新 MPC-System 部署指南为 Docker Compose 一键部署
根据实际的 mpc-system/docker-compose.yml 更新部署文档: - 更新系统要求 (Docker 24.0+, 4GB RAM) - 添加服务架构说明 (account-service, session-coordinator 等) - 提供一键部署步骤 (clone -> .env -> docker compose up) - 添加 .env 配置模板 - 更新服务端口说明 (仅暴露 4000 端口) - 更新 API 端点说明 - 添加运维命令参考 部署路径: /home/ceshi/rwadurian/backend/mpc-system 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Developer
parent
c63be04322
commit
42735e41ef
|
|
@ -470,161 +470,136 @@ server {
|
||||||
|
|
||||||
## 4. MPC-System 部署 (192.168.1.100)
|
## 4. MPC-System 部署 (192.168.1.100)
|
||||||
|
|
||||||
MPC-System 是一个独立的 Go 服务，负责 TSS (Threshold Signature Scheme) 密钥生成和签名操作。
|
MPC-System 是一组 Go 微服务，负责 TSS (Threshold Signature Scheme) 密钥生成和签名操作。
|
||||||
|
采用 2-of-3 阈值签名方案，包含多个内部服务通过 Docker Compose 一键部署。
|
||||||
|
|
||||||
### 4.1 系统要求
|
### 4.1 系统要求
|
||||||
|
|
||||||
- Go 1.21+
|
- Docker 24.0+
|
||||||
- 最小 2GB RAM
|
- Docker Compose v2.20+
|
||||||
- 10GB 磁盘空间
|
- 最小 4GB RAM
|
||||||
|
- 20GB 磁盘空间
|
||||||
|
|
||||||
### 4.2 部署方式
|
### 4.2 服务架构
|
||||||
|
|
||||||
#### 方式一: 直接运行 (推荐生产环境)
|
```
|
||||||
|
MPC-System (Docker Compose)
|
||||||
|
├── account-service # 对外 API 入口 (端口 4000)
|
||||||
|
├── session-coordinator # 会话协调器
|
||||||
|
├── message-router # 消息路由
|
||||||
|
├── server-party-1 # TSS 参与方 1
|
||||||
|
├── server-party-2 # TSS 参与方 2
|
||||||
|
├── server-party-3 # TSS 参与方 3
|
||||||
|
├── postgres # 数据库
|
||||||
|
├── redis # 缓存
|
||||||
|
└── rabbitmq # 消息队列
|
||||||
|
```
|
||||||
|
|
||||||
|
### 4.3 一键部署 (Docker Compose)
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
# 1. 创建部署目录
|
# ============================================
|
||||||
mkdir -p /opt/mpc-system
|
# 步骤 1: 安装 Docker
|
||||||
cd /opt/mpc-system
|
# ============================================
|
||||||
|
curl -fsSL https://get.docker.com | sh
|
||||||
|
usermod -aG docker $USER
|
||||||
|
# 重新登录以使 docker 组生效
|
||||||
|
|
||||||
# 2. 下载或复制编译好的二进制文件
|
# ============================================
|
||||||
# 从构建服务器复制 mpc-system 可执行文件
|
# 步骤 2: 克隆代码
|
||||||
scp build-server:/path/to/mpc-system .
|
# ============================================
|
||||||
|
cd /home/ceshi
|
||||||
|
git clone https://github.com/your-org/rwadurian.git
|
||||||
|
cd rwadurian/backend/mpc-system
|
||||||
|
|
||||||
# 3. 创建配置文件
|
# ============================================
|
||||||
cat > config.yaml << 'EOF'
|
# 步骤 3: 配置环境变量
|
||||||
server:
|
# ============================================
|
||||||
host: 0.0.0.0
|
cp .env.example .env
|
||||||
port: 4000
|
vim .env # 修改为生产环境配置
|
||||||
|
```
|
||||||
|
|
||||||
# TSS 配置
|
**.env 文件内容:**
|
||||||
tss:
|
|
||||||
threshold: 2 # 签名阈值 (t of n)
|
|
||||||
parties: 3 # 总参与方数量
|
|
||||||
|
|
||||||
# 日志配置
|
```bash
|
||||||
log:
|
# 环境标识
|
||||||
level: info
|
ENVIRONMENT=production
|
||||||
format: json
|
|
||||||
output: /var/log/mpc-system/mpc.log
|
|
||||||
|
|
||||||
# 安全配置
|
# PostgreSQL 数据库
|
||||||
security:
|
POSTGRES_USER=mpc_user
|
||||||
# 只允许后端服务器访问
|
POSTGRES_PASSWORD=your_secure_postgres_password_here
|
||||||
allowed_ips:
|
|
||||||
- 192.168.1.111
|
|
||||||
# API 认证密钥
|
|
||||||
api_key: ${MPC_API_KEY}
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# 4. 创建日志目录
|
# Redis 缓存 (留空表示不需要密码)
|
||||||
mkdir -p /var/log/mpc-system
|
REDIS_PASSWORD=
|
||||||
|
|
||||||
# 5. 创建 systemd 服务
|
# RabbitMQ 消息队列
|
||||||
cat > /etc/systemd/system/mpc-system.service << 'EOF'
|
RABBITMQ_USER=mpc_user
|
||||||
[Unit]
|
RABBITMQ_PASSWORD=your_secure_rabbitmq_password_here
|
||||||
Description=MPC System - TSS Key Generation and Signing Service
|
|
||||||
After=network.target
|
|
||||||
|
|
||||||
[Service]
|
# JWT 配置 (至少 32 字符)
|
||||||
Type=simple
|
JWT_SECRET_KEY=your_super_secure_jwt_secret_key_at_least_32_characters
|
||||||
User=mpc
|
|
||||||
Group=mpc
|
|
||||||
WorkingDirectory=/opt/mpc-system
|
|
||||||
ExecStart=/opt/mpc-system/mpc-system -config /opt/mpc-system/config.yaml
|
|
||||||
Restart=always
|
|
||||||
RestartSec=5
|
|
||||||
Environment=MPC_API_KEY=your_secure_api_key_here
|
|
||||||
|
|
||||||
# 安全限制
|
# 主加密密钥 (64 位十六进制 = 256 位密钥，用于加密密钥分片)
|
||||||
NoNewPrivileges=true
|
CRYPTO_MASTER_KEY=your_64_hex_characters_master_key_here
|
||||||
PrivateTmp=true
|
|
||||||
ProtectSystem=strict
|
|
||||||
ProtectHome=true
|
|
||||||
ReadWritePaths=/var/log/mpc-system /opt/mpc-system/data
|
|
||||||
|
|
||||||
[Install]
|
# API 认证密钥 (与 mpc-service 配置的 MPC_API_KEY 一致)
|
||||||
WantedBy=multi-user.target
|
MPC_API_KEY=your_very_secure_api_key_at_least_32_characters
|
||||||
EOF
|
|
||||||
|
|
||||||
# 6. 创建专用用户
|
# 允许访问的 IP 地址 (后端服务器)
|
||||||
useradd -r -s /bin/false mpc
|
ALLOWED_IPS=192.168.1.111
|
||||||
chown -R mpc:mpc /opt/mpc-system /var/log/mpc-system
|
```
|
||||||
|
|
||||||
# 7. 启动服务
|
```bash
|
||||||
systemctl daemon-reload
|
# ============================================
|
||||||
systemctl enable mpc-system
|
# 步骤 4: 构建并启动服务
|
||||||
systemctl start mpc-system
|
# ============================================
|
||||||
|
docker compose up -d --build
|
||||||
|
|
||||||
# 8. 检查状态
|
# 查看服务状态
|
||||||
systemctl status mpc-system
|
docker compose ps
|
||||||
|
|
||||||
|
# 查看日志
|
||||||
|
docker compose logs -f
|
||||||
|
|
||||||
|
# ============================================
|
||||||
|
# 步骤 5: 验证部署
|
||||||
|
# ============================================
|
||||||
|
# 健康检查
|
||||||
curl http://localhost:4000/health
|
curl http://localhost:4000/health
|
||||||
|
|
||||||
|
# 查看所有容器状态
|
||||||
|
docker compose ps
|
||||||
```
|
```
|
||||||
|
|
||||||
#### 方式二: Docker 部署
|
### 4.4 服务端口说明
|
||||||
|
|
||||||
```bash
|
| 服务 | 容器内端口 | 主机端口 | 说明 |
|
||||||
# 1. 创建 Dockerfile (如果需要)
|
|------|-----------|---------|------|
|
||||||
cat > /opt/mpc-system/Dockerfile << 'EOF'
|
| account-service | 8080 | **4000** | 对外 API 入口，供 mpc-service 调用 |
|
||||||
FROM golang:1.21-alpine AS builder
|
| session-coordinator | 8080, 50051 | - | 会话协调 (内部) |
|
||||||
WORKDIR /app
|
| message-router | 8080, 50051 | - | 消息路由 (内部) |
|
||||||
COPY . .
|
| server-party-1/2/3 | 8080, 50051 | - | TSS 参与方 (内部) |
|
||||||
RUN go build -o mpc-system ./cmd/main.go
|
| postgres | 5432 | - | 数据库 (内部) |
|
||||||
|
| redis | 6379 | - | 缓存 (内部) |
|
||||||
|
| rabbitmq | 5672, 15672 | - | 消息队列 (内部) |
|
||||||
|
|
||||||
FROM alpine:3.19
|
> **注意**: 生产环境仅暴露端口 4000，其他服务仅在 Docker 内部网络可访问。
|
||||||
RUN apk add --no-cache ca-certificates
|
|
||||||
COPY --from=builder /app/mpc-system /usr/local/bin/
|
|
||||||
COPY --from=builder /app/config.yaml /etc/mpc-system/
|
|
||||||
EXPOSE 4000
|
|
||||||
CMD ["mpc-system", "-config", "/etc/mpc-system/config.yaml"]
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# 2. 使用 docker-compose
|
### 4.5 MPC-System API 端点
|
||||||
cat > /opt/mpc-system/docker-compose.yml << 'EOF'
|
|
||||||
services:
|
|
||||||
mpc-system:
|
|
||||||
build: .
|
|
||||||
ports:
|
|
||||||
- "4000:4000"
|
|
||||||
environment:
|
|
||||||
- MPC_API_KEY=${MPC_API_KEY}
|
|
||||||
volumes:
|
|
||||||
- ./config.yaml:/etc/mpc-system/config.yaml:ro
|
|
||||||
- mpc_data:/opt/mpc-system/data
|
|
||||||
- mpc_logs:/var/log/mpc-system
|
|
||||||
restart: unless-stopped
|
|
||||||
# 网络隔离 - 只允许内网访问
|
|
||||||
networks:
|
|
||||||
- internal
|
|
||||||
|
|
||||||
networks:
|
Account Service (端口 4000) 对外提供以下 API:
|
||||||
internal:
|
|
||||||
driver: bridge
|
|
||||||
internal: true
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
mpc_data:
|
|
||||||
mpc_logs:
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# 3. 启动
|
|
||||||
cd /opt/mpc-system
|
|
||||||
docker compose up -d
|
|
||||||
```
|
|
||||||
|
|
||||||
### 4.3 MPC-System API 端点
|
|
||||||
|
|
||||||
| 端点 | 方法 | 说明 |
|
| 端点 | 方法 | 说明 |
|
||||||
|------|------|------|
|
|------|------|------|
|
||||||
| `/health` | GET | 健康检查 |
|
| `/health` | GET | 健康检查 |
|
||||||
| `/api/v1/keygen` | POST | TSS 密钥生成 |
|
| `/api/v1/account/create` | POST | 创建 MPC 账户 (触发密钥生成) |
|
||||||
| `/api/v1/sign` | POST | TSS 签名 |
|
| `/api/v1/account/sign` | POST | 请求签名 |
|
||||||
| `/api/v1/reshare` | POST | 密钥重新分片 |
|
| `/api/v1/account/recovery` | POST | 账户恢复 |
|
||||||
|
|
||||||
### 4.4 防火墙配置
|
### 4.6 防火墙配置
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
# 只允许后端服务器 (192.168.1.111) 访问 MPC-System
|
# 只允许后端服务器 (192.168.1.111) 访问 MPC-System 端口 4000
|
||||||
iptables -A INPUT -p tcp --dport 4000 -s 192.168.1.111 -j ACCEPT
|
iptables -A INPUT -p tcp --dport 4000 -s 192.168.1.111 -j ACCEPT
|
||||||
iptables -A INPUT -p tcp --dport 4000 -j DROP
|
iptables -A INPUT -p tcp --dport 4000 -j DROP
|
||||||
|
|
||||||
|
|
@ -632,16 +607,31 @@ iptables -A INPUT -p tcp --dport 4000 -j DROP
|
||||||
iptables-save > /etc/iptables/rules.v4
|
iptables-save > /etc/iptables/rules.v4
|
||||||
```
|
```
|
||||||
|
|
||||||
### 4.5 环境变量
|
### 4.7 运维命令
|
||||||
|
|
||||||
在 192.168.1.100 服务器上创建 `/opt/mpc-system/.env`:
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
# MPC API 认证密钥 (与 mpc-service 配置一致)
|
cd /home/ceshi/rwadurian/backend/mpc-system
|
||||||
MPC_API_KEY=your_very_secure_api_key_at_least_32_characters
|
|
||||||
|
|
||||||
# 日志级别
|
# 查看服务状态
|
||||||
LOG_LEVEL=info
|
docker compose ps
|
||||||
|
|
||||||
|
# 查看日志
|
||||||
|
docker compose logs -f # 所有服务
|
||||||
|
docker compose logs -f account-service # 单个服务
|
||||||
|
docker compose logs --tail=100 account-service # 最近 100 行
|
||||||
|
|
||||||
|
# 重启服务
|
||||||
|
docker compose restart # 重启所有
|
||||||
|
docker compose restart account-service # 重启单个
|
||||||
|
|
||||||
|
# 停止服务
|
||||||
|
docker compose down
|
||||||
|
|
||||||
|
# 重新构建并启动
|
||||||
|
docker compose up -d --build
|
||||||
|
|
||||||
|
# 清理数据 (危险! 会删除所有数据)
|
||||||
|
docker compose down -v
|
||||||
```
|
```
|
||||||
|
|
||||||
## 5. 后端服务器配置 (192.168.1.111)
|
## 5. 后端服务器配置 (192.168.1.111)
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue