diff --git a/backend/api-gateway/README.md b/backend/api-gateway/README.md new file mode 100644 index 00000000..741c53e6 --- /dev/null +++ b/backend/api-gateway/README.md @@ -0,0 +1,151 @@ +# API Gateway - Kong + +RWADurian 项目的 API 网关，基于 Kong 实现。 + +## 架构 + +``` +用户请求 + ↓ +Nginx (SSL/负载均衡) + ↓ rwaapi.szaiai.com:443 +Kong API Gateway + ↓ :8000 +各微服务 + ├── identity-service :3000 + ├── wallet-service :3001 + ├── backup-service :3002 + ├── planting-service :3003 + ├── referral-service :3004 + ├── reward-service :3005 + ├── mpc-service :3006 + ├── leaderboard-service:3007 + ├── reporting-service :3008 + ├── authorization-service:3009 + ├── admin-service :3010 + └── presence-service :3011 +``` + +## 文件结构 + +``` +api-gateway/ +├── kong.yml # Kong 声明式配置 +├── README.md # 本文档 +└── nginx/ + ├── rwaapi.szaiai.com.conf # Nginx 配置 + └── install.sh # 一键安装脚本 +``` + +## API 路由 + +| 路径 | 服务 | 说明 | +|------|------|------| +| `/api/v1/auth/*` | identity-service | 认证相关 | +| `/api/v1/users/*` | identity-service | 用户管理 | +| `/api/v1/wallets/*` | wallet-service | 钱包管理 | +| `/api/v1/backups/*` | backup-service | 备份服务 | +| `/api/v1/plantings/*` | planting-service | 种植管理 | +| `/api/v1/trees/*` | planting-service | 树木管理 | +| `/api/v1/referrals/*` | referral-service | 推荐系统 | +| `/api/v1/rewards/*` | reward-service | 奖励系统 | +| `/api/v1/mpc/*` | mpc-service | 多方计算 | +| `/api/v1/leaderboard/*` | leaderboard-service | 排行榜 | +| `/api/v1/reports/*` | reporting-service | 报表统计 | +| `/api/v1/statistics/*` | reporting-service | 数据统计 | +| `/api/v1/authorization/*` | authorization-service | 授权管理 | +| `/api/v1/permissions/*` | authorization-service | 权限管理 | +| `/api/v1/roles/*` | authorization-service | 角色管理 | +| `/api/v1/versions/*` | admin-service | 版本管理 | +| `/api/v1/admin/*` | admin-service | 后台管理 | +| `/api/v1/presence/*` | presence-service | 在线状态 | + +## 部署 + +### 1. 启动 Kong (包含在 services 的 docker-compose.yml 中) + +```bash +cd backend/services +./deploy.sh up +``` + +### 2. 配置 Nginx + SSL + +```bash +cd backend/api-gateway/nginx +sudo chmod +x install.sh +sudo ./install.sh +``` + +### 3. 验证 + +```bash +# 检查 Kong 状态 +curl http://localhost:8001/status + +# 测试 API 路由 +curl https://rwaapi.szaiai.com/api/v1/versions +``` + +## Kong 管理 + +### 查看配置 + +```bash +# 查看所有服务 +curl http://localhost:8001/services + +# 查看所有路由 +curl http://localhost:8001/routes + +# 查看所有插件 +curl http://localhost:8001/plugins +``` + +### 重新加载配置 + +```bash +# 进入 Kong 容器 +docker exec -it rwa-kong sh + +# 重载配置 +kong reload +``` + +## 插件 + +已启用的全局插件： + +| 插件 | 功能 | +|------|------| +| cors | 跨域支持 | +| rate-limiting | 请求限流 (100/分钟, 5000/小时) | +| file-log | 请求日志 | +| request-size-limiting | 请求大小限制 (50MB) | + +## 故障排除 + +### 1. Kong 无法连接数据库 + +```bash +# 检查 kong-db 状态 +docker logs rwa-kong-db + +# 手动运行迁移 +docker exec -it rwa-kong kong migrations bootstrap +``` + +### 2. 路由不生效 + +```bash +# 检查 kong.yml 语法 +docker exec -it rwa-kong kong config parse /etc/kong/kong.yml + +# 重启 Kong +docker restart rwa-kong +``` + +### 3. 502 Bad Gateway + +- 检查目标服务是否运行: `docker ps` +- 检查服务网络连通性: `docker exec rwa-kong curl http://admin-service:3010/api/v1/health` diff --git a/backend/api-gateway/kong.yml b/backend/api-gateway/kong.yml index e69de29b..9c9e795f 100644 --- a/backend/api-gateway/kong.yml +++ b/backend/api-gateway/kong.yml @@ -0,0 +1,221 @@ +# ============================================================================= +# Kong API Gateway - Mn +# ============================================================================= +# (: +# 1. / Kong: docker compose up -d kong kong-db +# 2. Mnꨠ} +# +# c: https://docs.konghq.com/gateway/latest/ +# ============================================================================= + +_format_version: "3.0" +_transform: true + +# ============================================================================= +# Services -  I +# ============================================================================= +services: + # --------------------------------------------------------------------------- + # Identity Service - + # --------------------------------------------------------------------------- + - name: identity-service + url: http://identity-service:3000 + routes: + - name: identity-auth + paths: + - /api/v1/auth + strip_path: false + - name: identity-users + paths: + - /api/v1/users + strip_path: false + - name: identity-health + paths: + - /api/v1/identity/health + strip_path: true + + # --------------------------------------------------------------------------- + # Wallet Service -  + # --------------------------------------------------------------------------- + - name: wallet-service + url: http://wallet-service:3001 + routes: + - name: wallet-api + paths: + - /api/v1/wallets + strip_path: false + - name: wallet-health + paths: + - /api/v1/wallet/health + strip_path: true + + # --------------------------------------------------------------------------- + # Backup Service -  + # --------------------------------------------------------------------------- + - name: backup-service + url: http://backup-service:3002 + routes: + - name: backup-api + paths: + - /api/v1/backups + strip_path: false + + # --------------------------------------------------------------------------- + # Planting Service - + # --------------------------------------------------------------------------- + - name: planting-service + url: http://planting-service:3003 + routes: + - name: planting-api + paths: + - /api/v1/plantings + - /api/v1/trees + strip_path: false + + # --------------------------------------------------------------------------- + # Referral Service - P + # --------------------------------------------------------------------------- + - name: referral-service + url: http://referral-service:3004 + routes: + - name: referral-api + paths: + - /api/v1/referrals + strip_path: false + + # --------------------------------------------------------------------------- + # Reward Service - V + # --------------------------------------------------------------------------- + - name: reward-service + url: http://reward-service:3005 + routes: + - name: reward-api + paths: + - /api/v1/rewards + strip_path: false + + # --------------------------------------------------------------------------- + # MPC Service -  + # --------------------------------------------------------------------------- + - name: mpc-service + url: http://mpc-service:3006 + routes: + - name: mpc-api + paths: + - /api/v1/mpc + strip_path: false + + # --------------------------------------------------------------------------- + # Leaderboard Service - L + # --------------------------------------------------------------------------- + - name: leaderboard-service + url: http://leaderboard-service:3007 + routes: + - name: leaderboard-api + paths: + - /api/v1/leaderboard + strip_path: false + + # --------------------------------------------------------------------------- + # Reporting Service - h + # --------------------------------------------------------------------------- + - name: reporting-service + url: http://reporting-service:3008 + routes: + - name: reporting-api + paths: + - /api/v1/reports + - /api/v1/statistics + strip_path: false + + # --------------------------------------------------------------------------- + # Authorization Service - C + # --------------------------------------------------------------------------- + - name: authorization-service + url: http://authorization-service:3009 + routes: + - name: authorization-api + paths: + - /api/v1/authorization + - /api/v1/permissions + - /api/v1/roles + strip_path: false + + # --------------------------------------------------------------------------- + # Admin Service -  (+H,) + # --------------------------------------------------------------------------- + - name: admin-service + url: http://admin-service:3010 + routes: + - name: admin-versions + paths: + - /api/v1/versions + strip_path: false + - name: admin-api + paths: + - /api/v1/admin + strip_path: false + + # --------------------------------------------------------------------------- + # Presence Service - ( + # --------------------------------------------------------------------------- + - name: presence-service + url: http://presence-service:3011 + routes: + - name: presence-api + paths: + - /api/v1/presence + strip_path: false + +# ============================================================================= +# Plugins - h@Mn +# ============================================================================= +plugins: + # CORS Mn + - name: cors + config: + origins: + - "https://rwaadmin.szaiai.com" + - "https://update.szaiai.com" + - "https://app.rwadurian.com" + - "http://localhost:3000" + - "http://localhost:3020" + methods: + - GET + - POST + - PUT + - PATCH + - DELETE + - OPTIONS + headers: + - Accept + - Accept-Version + - Content-Length + - Content-MD5 + - Content-Type + - Date + - Authorization + - X-Auth-Token + exposed_headers: + - X-Auth-Token + credentials: true + max_age: 3600 + + # BPA + - name: rate-limiting + config: + minute: 100 + hour: 5000 + policy: local + + # B + - name: file-log + config: + path: /tmp/kong-access.log + reopen: true + + # B/͔'P6 + - name: request-size-limiting + config: + allowed_payload_size: 50 + size_unit: megabytes diff --git a/backend/api-gateway/nginx/install.sh b/backend/api-gateway/nginx/install.sh new file mode 100644 index 00000000..ac82a6a6 --- /dev/null +++ b/backend/api-gateway/nginx/install.sh @@ -0,0 +1,208 @@ +#!/bin/bash +# RWADurian API Gateway - Nginx 完整安装脚本 +# 适用于全新 Ubuntu/Debian 服务器 + +set -e + +DOMAIN="rwaapi.szaiai.com" +EMAIL="admin@szaiai.com" # 修改为你的邮箱 +KONG_PORT=8000 + +# 颜色 +RED='\033[0;31m' +GREEN='\033[0;32m' +YELLOW='\033[1;33m' +BLUE='\033[0;34m' +NC='\033[0m' + +log_info() { echo -e "${BLUE}[INFO]${NC} $1"; } +log_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; } +log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; } +log_error() { echo -e "${RED}[ERROR]${NC} $1"; } + +# 检查 root 权限 +check_root() { + if [ "$EUID" -ne 0 ]; then + log_error "请使用 root 权限运行: sudo ./install.sh" + exit 1 + fi +} + +# 步骤 1: 更新系统 +update_system() { + log_info "步骤 1/6: 更新系统包..." + apt update && apt upgrade -y + log_success "系统更新完成" +} + +# 步骤 2: 安装 Nginx +install_nginx() { + log_info "步骤 2/6: 安装 Nginx..." + apt install -y nginx + systemctl enable nginx + systemctl start nginx + log_success "Nginx 安装完成" +} + +# 步骤 3: 安装 Certbot +install_certbot() { + log_info "步骤 3/6: 安装 Certbot..." + apt install -y certbot python3-certbot-nginx + log_success "Certbot 安装完成" +} + +# 步骤 4: 配置 Nginx (HTTP) +configure_nginx_http() { + log_info "步骤 4/6: 配置 Nginx (HTTP 临时配置用于证书申请)..." + + # 创建 certbot webroot 目录 + mkdir -p /var/www/certbot + + # 创建临时 HTTP 配置 + cat > /etc/nginx/sites-available/$DOMAIN << EOF +# 临时 HTTP 配置 - 用于 Let's Encrypt 验证 +server { + listen 80; + listen [::]:80; + server_name $DOMAIN; + + # Let's Encrypt 验证目录 + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + # 临时代理到 Kong + location / { + proxy_pass http://127.0.0.1:$KONG_PORT; + proxy_http_version 1.1; + proxy_set_header Host \$host; + proxy_set_header X-Real-IP \$remote_addr; + proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto \$scheme; + } +} +EOF + + # 启用站点 + ln -sf /etc/nginx/sites-available/$DOMAIN /etc/nginx/sites-enabled/ + + # 测试并重载 + nginx -t && systemctl reload nginx + log_success "Nginx HTTP 配置完成" +} + +# 步骤 5: 申请 SSL 证书 +obtain_ssl_certificate() { + log_info "步骤 5/6: 申请 Let's Encrypt SSL 证书..." + + # 检查域名解析 + log_info "检查域名 $DOMAIN 解析..." + if ! host $DOMAIN > /dev/null 2>&1; then + log_warn "无法解析域名 $DOMAIN，请确保 DNS 已正确配置" + log_warn "继续尝试申请证书..." + fi + + # 申请证书 + certbot certonly \ + --webroot \ + --webroot-path=/var/www/certbot \ + --email $EMAIL \ + --agree-tos \ + --no-eff-email \ + -d $DOMAIN + + log_success "SSL 证书申请成功" +} + +# 步骤 6: 配置 Nginx (HTTPS) +configure_nginx_https() { + log_info "步骤 6/6: 配置 Nginx (HTTPS)..." + + # 获取脚本所在目录 + SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + + # 复制完整配置 + cp "$SCRIPT_DIR/rwaapi.szaiai.com.conf" /etc/nginx/sites-available/$DOMAIN + + # 测试并重载 + nginx -t && systemctl reload nginx + log_success "Nginx HTTPS 配置完成" +} + +# 配置证书自动续期 +setup_auto_renewal() { + log_info "配置证书自动续期..." + certbot renew --dry-run + log_success "证书自动续期已配置" +} + +# 配置防火墙 +configure_firewall() { + log_info "配置防火墙..." + + if command -v ufw &> /dev/null; then + ufw allow 'Nginx Full' + ufw allow OpenSSH + ufw --force enable + log_success "UFW 防火墙已配置" + else + log_warn "未检测到 UFW，请手动配置防火墙开放 80 和 443 端口" + fi +} + +# 显示完成信息 +show_completion() { + echo "" + echo -e "${GREEN}========================================${NC}" + echo -e "${GREEN} 安装完成!${NC}" + echo -e "${GREEN}========================================${NC}" + echo "" + echo -e "API 网关地址: ${BLUE}https://$DOMAIN${NC}" + echo "" + echo "架构:" + echo " 用户请求 → Nginx (SSL) → Kong (API Gateway) → 微服务" + echo "" + echo "常用命令:" + echo " 查看 Nginx 状态: systemctl status nginx" + echo " 重载 Nginx: systemctl reload nginx" + echo " 查看证书: certbot certificates" + echo " 手动续期: certbot renew" + echo " 查看日志: tail -f /var/log/nginx/$DOMAIN.access.log" + echo "" +} + +# 主函数 +main() { + echo "" + echo "============================================" + echo " RWADurian API Gateway - Nginx 安装脚本" + echo " 域名: $DOMAIN" + echo "============================================" + echo "" + + check_root + update_system + install_nginx + install_certbot + configure_firewall + configure_nginx_http + + echo "" + log_warn "请确保以下条件已满足:" + echo " 1. 域名 $DOMAIN 的 DNS A 记录已指向本服务器 IP" + echo " 2. Kong API Gateway 已在端口 $KONG_PORT 运行" + echo "" + read -p "是否继续申请 SSL 证书? (y/n): " confirm + + if [ "$confirm" = "y" ] || [ "$confirm" = "Y" ]; then + obtain_ssl_certificate + configure_nginx_https + setup_auto_renewal + show_completion + else + log_info "已跳过 SSL 配置，当前为 HTTP 模式" + log_info "稍后可运行: certbot --nginx -d $DOMAIN" + fi +} + +main "$@" diff --git a/backend/api-gateway/nginx/rwaapi.szaiai.com.conf b/backend/api-gateway/nginx/rwaapi.szaiai.com.conf new file mode 100644 index 00000000..6663b2a3 --- /dev/null +++ b/backend/api-gateway/nginx/rwaapi.szaiai.com.conf @@ -0,0 +1,112 @@ +# RWADurian API Gateway Nginx 配置 +# 域名: rwaapi.szaiai.com +# 后端: Kong API Gateway (端口 8000) +# 放置路径: /etc/nginx/sites-available/rwaapi.szaiai.com +# 启用: ln -s /etc/nginx/sites-available/rwaapi.szaiai.com /etc/nginx/sites-enabled/ + +# HTTP 重定向到 HTTPS +server { + listen 80; + listen [::]:80; + server_name rwaapi.szaiai.com; + + # Let's Encrypt 验证目录 + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + # 重定向到 HTTPS + location / { + return 301 https://$host$request_uri; + } +} + +# HTTPS 配置 +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name rwaapi.szaiai.com; + + # SSL 证书 (Let's Encrypt) + ssl_certificate /etc/letsencrypt/live/rwaapi.szaiai.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/rwaapi.szaiai.com/privkey.pem; + + # SSL 配置优化 + ssl_session_timeout 1d; + ssl_session_cache shared:SSL:50m; + ssl_session_tickets off; + + # 现代加密套件 + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; + + # HSTS + add_header Strict-Transport-Security "max-age=63072000" always; + + # 日志 + access_log /var/log/nginx/rwaapi.szaiai.com.access.log; + error_log /var/log/nginx/rwaapi.szaiai.com.error.log; + + # Gzip 压缩 + gzip on; + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml; + + # 安全头 + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + add_header Referrer-Policy "strict-origin-when-cross-origin" always; + + # 客户端请求大小限制 (用于文件上传) + client_max_body_size 100M; + + # 反向代理到 Kong API Gateway + location / { + proxy_pass http://127.0.0.1:8000; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Port $server_port; + proxy_cache_bypass $http_upgrade; + + # 超时设置 (适配大文件上传) + proxy_connect_timeout 60s; + proxy_send_timeout 300s; + proxy_read_timeout 300s; + + # 缓冲设置 + proxy_buffering on; + proxy_buffer_size 128k; + proxy_buffers 4 256k; + proxy_busy_buffers_size 256k; + } + + # Kong Admin API (可选，仅内网访问) + # location /kong-admin/ { + # allow 127.0.0.1; + # allow 10.0.0.0/8; + # allow 172.16.0.0/12; + # allow 192.168.0.0/16; + # deny all; + # proxy_pass http://127.0.0.1:8001/; + # proxy_http_version 1.1; + # proxy_set_header Host $host; + # proxy_set_header X-Real-IP $remote_addr; + # } + + # 健康检查端点 (直接返回) + location = /health { + access_log off; + return 200 '{"status":"ok","service":"rwaapi-nginx"}'; + add_header Content-Type application/json; + } +} diff --git a/backend/services/docker-compose.yml b/backend/services/docker-compose.yml index 7a50b79a..77c54f45 100644 --- a/backend/services/docker-compose.yml +++ b/backend/services/docker-compose.yml @@ -93,6 +93,83 @@ services: networks: - rwa-network + # =========================================================================== + # API Gateway - Kong + # =========================================================================== + + kong-db: + image: postgres:16-alpine + container_name: rwa-kong-db + environment: + POSTGRES_USER: kong + POSTGRES_PASSWORD: ${KONG_PG_PASSWORD:-kong_password} + POSTGRES_DB: kong + volumes: + - kong_db_data:/var/lib/postgresql/data + healthcheck: + test: ["CMD-SHELL", "pg_isready -U kong"] + interval: 5s + timeout: 5s + retries: 10 + restart: unless-stopped + networks: + - rwa-network + + kong-migrations: + image: kong:3.5-alpine + container_name: rwa-kong-migrations + command: kong migrations bootstrap + environment: + KONG_DATABASE: postgres + KONG_PG_HOST: kong-db + KONG_PG_USER: kong + KONG_PG_PASSWORD: ${KONG_PG_PASSWORD:-kong_password} + KONG_PG_DATABASE: kong + depends_on: + kong-db: + condition: service_healthy + restart: on-failure + networks: + - rwa-network + + kong: + image: kong:3.5-alpine + container_name: rwa-kong + environment: + KONG_DATABASE: postgres + KONG_PG_HOST: kong-db + KONG_PG_USER: kong + KONG_PG_PASSWORD: ${KONG_PG_PASSWORD:-kong_password} + KONG_PG_DATABASE: kong + KONG_PROXY_ACCESS_LOG: /dev/stdout + KONG_ADMIN_ACCESS_LOG: /dev/stdout + KONG_PROXY_ERROR_LOG: /dev/stderr + KONG_ADMIN_ERROR_LOG: /dev/stderr + KONG_ADMIN_LISTEN: 0.0.0.0:8001 + KONG_ADMIN_GUI_URL: http://localhost:8002 + KONG_DECLARATIVE_CONFIG: /etc/kong/kong.yml + ports: + - "8000:8000" # Proxy HTTP + - "8443:8443" # Proxy HTTPS + - "8001:8001" # Admin API + - "8002:8002" # Admin GUI + volumes: + - ../api-gateway/kong.yml:/etc/kong/kong.yml:ro + depends_on: + kong-db: + condition: service_healthy + kong-migrations: + condition: service_completed_successfully + healthcheck: + test: ["CMD", "kong", "health"] + interval: 30s + timeout: 10s + retries: 5 + start_period: 30s + restart: unless-stopped + networks: + - rwa-network + # =========================================================================== # Application Services # =========================================================================== @@ -542,6 +619,8 @@ volumes: driver: local redis_data: driver: local + kong_db_data: + driver: local # =========================================================================== # Networks