381 lines
11 KiB
Bash
381 lines
11 KiB
Bash
#!/bin/bash
|
|
# =============================================================================
|
|
# Kong 监控栈一键安装脚本
|
|
# =============================================================================
|
|
# 功能:
|
|
# - 自动配置 Nginx 反向代理
|
|
# - 自动申请 Let's Encrypt SSL 证书
|
|
# - 启动 Prometheus + Grafana 监控服务
|
|
#
|
|
# 用法:
|
|
# ./install-monitor.sh # 使用默认域名 monitor.szaiai.com
|
|
# ./install-monitor.sh mydomain.com # 使用自定义域名
|
|
# =============================================================================
|
|
|
|
set -e
|
|
|
|
# 颜色定义
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
BLUE='\033[0;34m'
|
|
CYAN='\033[0;36m'
|
|
NC='\033[0m'
|
|
|
|
# 日志函数
|
|
log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
|
|
log_success() { echo -e "${GREEN}[OK]${NC} $1"; }
|
|
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
|
|
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
|
|
log_step() { echo -e "${CYAN}[STEP]${NC} $1"; }
|
|
|
|
# 默认配置
|
|
DOMAIN="${1:-monitor.szaiai.com}"
|
|
GRAFANA_PORT=3030
|
|
PROMETHEUS_PORT=9099
|
|
GRAFANA_USER="admin"
|
|
GRAFANA_PASS="admin123"
|
|
|
|
# 获取脚本目录
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
|
|
|
|
# 显示 Banner
|
|
show_banner() {
|
|
echo -e "${CYAN}"
|
|
echo "╔═══════════════════════════════════════════════════════════════╗"
|
|
echo "║ Kong 监控栈一键安装脚本 ║"
|
|
echo "║ Prometheus + Grafana ║"
|
|
echo "╚═══════════════════════════════════════════════════════════════╝"
|
|
echo -e "${NC}"
|
|
echo "域名: $DOMAIN"
|
|
echo "Grafana 端口: $GRAFANA_PORT"
|
|
echo "Prometheus 端口: $PROMETHEUS_PORT"
|
|
echo ""
|
|
}
|
|
|
|
# 检查 root 权限
|
|
check_root() {
|
|
if [ "$EUID" -ne 0 ]; then
|
|
log_error "请使用 root 权限运行此脚本"
|
|
echo "用法: sudo $0 [domain]"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# 检查依赖
|
|
check_dependencies() {
|
|
log_step "检查依赖..."
|
|
|
|
local missing=()
|
|
|
|
if ! command -v docker &> /dev/null; then
|
|
missing+=("docker")
|
|
fi
|
|
|
|
if ! command -v nginx &> /dev/null; then
|
|
missing+=("nginx")
|
|
fi
|
|
|
|
if ! command -v certbot &> /dev/null; then
|
|
missing+=("certbot")
|
|
fi
|
|
|
|
if [ ${#missing[@]} -gt 0 ]; then
|
|
log_error "缺少依赖: ${missing[*]}"
|
|
echo ""
|
|
echo "请先安装:"
|
|
echo " apt update && apt install -y docker.io nginx certbot python3-certbot-nginx"
|
|
exit 1
|
|
fi
|
|
|
|
log_success "依赖检查通过"
|
|
}
|
|
|
|
# 检查 DNS 解析
|
|
check_dns() {
|
|
log_step "检查 DNS 解析..."
|
|
|
|
local resolved_ip=$(dig +short $DOMAIN 2>/dev/null | head -1)
|
|
local server_ip=$(curl -s ifconfig.me 2>/dev/null || curl -s icanhazip.com 2>/dev/null)
|
|
|
|
if [ -z "$resolved_ip" ]; then
|
|
log_error "无法解析域名 $DOMAIN"
|
|
echo "请先在 DNS 管理面板添加 A 记录:"
|
|
echo " $DOMAIN -> $server_ip"
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$resolved_ip" != "$server_ip" ]; then
|
|
log_warn "DNS 解析的 IP ($resolved_ip) 与本机公网 IP ($server_ip) 不匹配"
|
|
read -p "是否继续? [y/N] " -n 1 -r
|
|
echo
|
|
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
log_success "DNS 解析正确: $DOMAIN -> $resolved_ip"
|
|
}
|
|
|
|
# 生成 Nginx 配置
|
|
generate_nginx_config() {
|
|
log_step "生成 Nginx 配置..."
|
|
|
|
cat > /etc/nginx/sites-available/$DOMAIN.conf << EOF
|
|
# Kong 监控面板 Nginx 配置
|
|
# 自动生成于 $(date)
|
|
|
|
# HTTP -> HTTPS 重定向
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name $DOMAIN;
|
|
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/certbot;
|
|
}
|
|
|
|
location / {
|
|
return 301 https://\$host\$request_uri;
|
|
}
|
|
}
|
|
|
|
# HTTPS 配置
|
|
server {
|
|
listen 443 ssl http2;
|
|
listen [::]:443 ssl http2;
|
|
server_name $DOMAIN;
|
|
|
|
# SSL 证书 (Let's Encrypt)
|
|
ssl_certificate /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem;
|
|
|
|
# SSL 优化
|
|
ssl_session_timeout 1d;
|
|
ssl_session_cache shared:SSL:50m;
|
|
ssl_session_tickets off;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers off;
|
|
|
|
# HSTS
|
|
add_header Strict-Transport-Security "max-age=63072000" always;
|
|
|
|
# 日志
|
|
access_log /var/log/nginx/$DOMAIN.access.log;
|
|
error_log /var/log/nginx/$DOMAIN.error.log;
|
|
|
|
# Grafana
|
|
location / {
|
|
proxy_pass http://127.0.0.1:$GRAFANA_PORT;
|
|
proxy_http_version 1.1;
|
|
|
|
# WebSocket support
|
|
proxy_set_header Upgrade \$http_upgrade;
|
|
proxy_set_header Connection 'upgrade';
|
|
|
|
# Standard proxy headers
|
|
proxy_set_header Host \$http_host;
|
|
proxy_set_header X-Real-IP \$remote_addr;
|
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
|
proxy_set_header X-Forwarded-Host \$host;
|
|
proxy_set_header X-Forwarded-Port \$server_port;
|
|
|
|
# Grafana 10+ 反向代理支持
|
|
proxy_set_header Origin \$scheme://\$host;
|
|
|
|
# 缓存和超时
|
|
proxy_cache_bypass \$http_upgrade;
|
|
proxy_read_timeout 86400;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
# Prometheus (仅内网)
|
|
location /prometheus/ {
|
|
allow 127.0.0.1;
|
|
allow 10.0.0.0/8;
|
|
allow 172.16.0.0/12;
|
|
allow 192.168.0.0/16;
|
|
deny all;
|
|
|
|
proxy_pass http://127.0.0.1:$PROMETHEUS_PORT/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host \$host;
|
|
proxy_set_header X-Real-IP \$remote_addr;
|
|
}
|
|
|
|
# 健康检查
|
|
location = /health {
|
|
access_log off;
|
|
return 200 '{"status":"ok","service":"monitor-nginx"}';
|
|
add_header Content-Type application/json;
|
|
}
|
|
}
|
|
EOF
|
|
|
|
log_success "Nginx 配置已生成: /etc/nginx/sites-available/$DOMAIN.conf"
|
|
}
|
|
|
|
# 申请 SSL 证书
|
|
obtain_ssl_cert() {
|
|
log_step "申请 SSL 证书..."
|
|
|
|
# 检查证书是否已存在
|
|
if [ -f "/etc/letsencrypt/live/$DOMAIN/fullchain.pem" ]; then
|
|
log_success "SSL 证书已存在"
|
|
return 0
|
|
fi
|
|
|
|
# 创建 certbot webroot 目录
|
|
mkdir -p /var/www/certbot
|
|
|
|
# 临时启用 HTTP 配置用于验证
|
|
cat > /etc/nginx/sites-available/$DOMAIN-temp.conf << EOF
|
|
server {
|
|
listen 80;
|
|
server_name $DOMAIN;
|
|
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/certbot;
|
|
}
|
|
|
|
location / {
|
|
return 200 'Waiting for SSL...';
|
|
add_header Content-Type text/plain;
|
|
}
|
|
}
|
|
EOF
|
|
|
|
ln -sf /etc/nginx/sites-available/$DOMAIN-temp.conf /etc/nginx/sites-enabled/
|
|
nginx -t && systemctl reload nginx
|
|
|
|
# 申请证书
|
|
certbot certonly --webroot -w /var/www/certbot -d $DOMAIN --non-interactive --agree-tos --email admin@$DOMAIN || {
|
|
log_error "SSL 证书申请失败"
|
|
rm -f /etc/nginx/sites-enabled/$DOMAIN-temp.conf
|
|
rm -f /etc/nginx/sites-available/$DOMAIN-temp.conf
|
|
exit 1
|
|
}
|
|
|
|
# 清理临时配置
|
|
rm -f /etc/nginx/sites-enabled/$DOMAIN-temp.conf
|
|
rm -f /etc/nginx/sites-available/$DOMAIN-temp.conf
|
|
|
|
log_success "SSL 证书申请成功"
|
|
}
|
|
|
|
# 启用 Nginx 配置
|
|
enable_nginx_config() {
|
|
log_step "启用 Nginx 配置..."
|
|
|
|
ln -sf /etc/nginx/sites-available/$DOMAIN.conf /etc/nginx/sites-enabled/
|
|
|
|
nginx -t || {
|
|
log_error "Nginx 配置测试失败"
|
|
exit 1
|
|
}
|
|
|
|
systemctl reload nginx
|
|
log_success "Nginx 配置已启用"
|
|
}
|
|
|
|
# 启动监控服务
|
|
start_monitoring_services() {
|
|
log_step "启动监控服务..."
|
|
|
|
cd "$PROJECT_DIR"
|
|
|
|
# 检查 Kong 是否运行
|
|
if ! docker ps | grep -q rwa-kong; then
|
|
log_warn "Kong 未运行，先启动 Kong..."
|
|
docker compose up -d
|
|
sleep 10
|
|
fi
|
|
|
|
# 同步 Kong 配置 (启用 prometheus 插件)
|
|
log_info "同步 Kong 配置..."
|
|
docker compose run --rm kong-config || log_warn "配置同步失败，可能已是最新"
|
|
|
|
# 启动监控栈
|
|
log_info "启动 Prometheus + Grafana..."
|
|
docker compose -f docker-compose.yml -f docker-compose.monitoring.yml up -d prometheus grafana
|
|
|
|
# 等待服务启动
|
|
sleep 5
|
|
|
|
# 检查服务状态
|
|
if docker ps | grep -q rwa-grafana && docker ps | grep -q rwa-prometheus; then
|
|
log_success "监控服务启动成功"
|
|
else
|
|
log_error "监控服务启动失败"
|
|
docker compose -f docker-compose.yml -f docker-compose.monitoring.yml logs --tail=50
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# 显示安装结果
|
|
show_result() {
|
|
echo ""
|
|
echo -e "${GREEN}╔═══════════════════════════════════════════════════════════════╗${NC}"
|
|
echo -e "${GREEN}║ 安装完成! ║${NC}"
|
|
echo -e "${GREEN}╚═══════════════════════════════════════════════════════════════╝${NC}"
|
|
echo ""
|
|
echo "访问地址:"
|
|
echo -e " Grafana: ${CYAN}https://$DOMAIN${NC}"
|
|
echo -e " 用户名: ${YELLOW}$GRAFANA_USER${NC}"
|
|
echo -e " 密码: ${YELLOW}$GRAFANA_PASS${NC}"
|
|
echo ""
|
|
echo "Prometheus (仅内网可访问):"
|
|
echo -e " 地址: ${CYAN}https://$DOMAIN/prometheus/${NC}"
|
|
echo ""
|
|
echo "Kong 指标端点:"
|
|
echo -e " 地址: ${CYAN}http://localhost:8001/metrics${NC}"
|
|
echo ""
|
|
echo "管理命令:"
|
|
echo " ./deploy.sh monitoring up # 启动监控"
|
|
echo " ./deploy.sh monitoring down # 停止监控"
|
|
echo " ./deploy.sh metrics # 查看指标"
|
|
echo ""
|
|
}
|
|
|
|
# 卸载函数
|
|
uninstall() {
|
|
log_warn "正在卸载监控栈..."
|
|
|
|
# 停止服务
|
|
cd "$PROJECT_DIR"
|
|
docker stop rwa-prometheus rwa-grafana 2>/dev/null || true
|
|
docker rm rwa-prometheus rwa-grafana 2>/dev/null || true
|
|
|
|
# 删除 Nginx 配置
|
|
rm -f /etc/nginx/sites-enabled/$DOMAIN.conf
|
|
rm -f /etc/nginx/sites-available/$DOMAIN.conf
|
|
systemctl reload nginx 2>/dev/null || true
|
|
|
|
log_success "监控栈已卸载"
|
|
echo "注意: SSL 证书未删除，如需删除请运行: certbot delete --cert-name $DOMAIN"
|
|
}
|
|
|
|
# 主函数
|
|
main() {
|
|
show_banner
|
|
|
|
# 检查是否卸载
|
|
if [ "$1" = "uninstall" ] || [ "$1" = "--uninstall" ]; then
|
|
uninstall
|
|
exit 0
|
|
fi
|
|
|
|
check_root
|
|
check_dependencies
|
|
check_dns
|
|
generate_nginx_config
|
|
obtain_ssl_cert
|
|
enable_nginx_config
|
|
start_monitoring_services
|
|
show_result
|
|
}
|
|
|
|
main "$@"
|