873 lines
29 KiB
Markdown
873 lines
29 KiB
Markdown
# RWA Durian 系统部署指南
|
|
|
|
本文档描述了 RWA Durian 系统的完整部署架构，包括前端 API 调用、Nginx 反向代理配置和后端服务部署。
|
|
|
|
## 1. 系统架构概览
|
|
|
|
```
|
|
┌─────────────────────────────────────────────────────────────────────────────┐
|
|
│ 用户设备 │
|
|
│ (Android/iOS App) │
|
|
└─────────────────────────────────┬───────────────────────────────────────────┘
|
|
│
|
|
▼
|
|
┌─────────────────────────────────────────────────────────────────────────────┐
|
|
│ Nginx 服务器 (公网) │
|
|
│ https://rwaapi.szaiai.com │
|
|
│ │
|
|
│ ┌──────────────────────────────────────────────────────────────────┐ │
|
|
│ │ /etc/nginx/conf.d/rwaapi.conf │ │
|
|
│ │ │ │
|
|
│ │ /api/v1/user/* → 192.168.1.111:3000 (Identity) │ │
|
|
│ │ /api/v1/auth/* → 192.168.1.111:3000 (Identity) │ │
|
|
│ │ /api/v1/wallet/* → 192.168.1.111:3002 (Wallet) │ │
|
|
│ │ /api/v1/trading/* → 192.168.1.111:3002 (Wallet) │ │
|
|
│ │ /api/v1/planting/* → 192.168.1.111:3003 (Planting) │ │
|
|
│ │ /api/v1/referral/* → 192.168.1.111:3004 (Referral) │ │
|
|
│ │ /api/v1/mining/* → 192.168.1.111:3005 (Reward) │ │
|
|
│ │ /api/v1/ranking/* → 192.168.1.111:3007 (Leaderboard) │ │
|
|
│ │ /api/v1/telemetry/*→ 192.168.1.111:3008 (Reporting) │ │
|
|
│ └──────────────────────────────────────────────────────────────────┘ │
|
|
└─────────────────────────────────┬───────────────────────────────────────────┘
|
|
│ 内网
|
|
▼
|
|
┌─────────────────────────────────────────────────────────────────────────────┐
|
|
│ 后端服务器 192.168.1.111 │
|
|
│ │
|
|
│ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ │
|
|
│ │ Identity │ │ MPC │ │ Wallet │ │ Planting │ │
|
|
│ │ :3000 │ │ :3001 │ │ :3002 │ │ :3003 │ │
|
|
│ └───────────────┘ └───────────────┘ └───────────────┘ └───────────────┘ │
|
|
│ │
|
|
│ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ │
|
|
│ │ Referral │ │ Reward │ │ Authorization │ │ Leaderboard │ │
|
|
│ │ :3004 │ │ :3005 │ │ :3006 │ │ :3007 │ │
|
|
│ └───────────────┘ └───────────────┘ └───────────────┘ └───────────────┘ │
|
|
│ │
|
|
│ ┌───────────────┐ ┌───────────────┐ │
|
|
│ │ Reporting │ │ Backup │ │
|
|
│ │ :3008 │ │ :3009 │ │
|
|
│ └───────────────┘ └───────────────┘ │
|
|
│ │
|
|
│ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ │
|
|
│ │ PostgreSQL │ │ Redis │ │ Kafka │ │
|
|
│ │ :5432 │ │ :6379 │ │ :9092 │ │
|
|
│ └───────────────┘ └───────────────┘ └───────────────┘ │
|
|
└─────────────────────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
## 2. 后端服务端口规划
|
|
|
|
所有后端服务部署在 **192.168.1.111** 服务器上：
|
|
|
|
| 服务名称 | 端口 | API 前缀 | 说明 |
|
|
|---------|------|----------|------|
|
|
| Identity Service | 3000 | `/api/v1` | 用户身份、认证、钱包创建 |
|
|
| MPC Service | 3001 | `/api/v1` | MPC 密钥分片管理 (内部) |
|
|
| Wallet Service | 3002 | `/api/v1` | 钱包余额、交易、充值 |
|
|
| Planting Service | 3003 | `/api/v1` | 认种业务 |
|
|
| Referral Service | 3004 | `/api/v1` | 推荐关系、分享链接 |
|
|
| Reward Service | 3005 | `/api/v1` | 挖矿奖励、收益 |
|
|
| Authorization Service | 3006 | `/api/v1` | 权限管理 (内部) |
|
|
| Leaderboard Service | 3007 | `/api` | 排行榜 |
|
|
| Reporting Service | 3008 | `/api/v1` | 遥测统计、报表 |
|
|
| Backup Service | 3009 | - | MPC 备份 (内部服务) |
|
|
|
|
## 3. Nginx 配置文件
|
|
|
|
### 3.1 目录结构
|
|
|
|
在 Nginx 服务器上创建以下目录结构：
|
|
|
|
```
|
|
/etc/nginx/
|
|
├── nginx.conf # 主配置文件
|
|
├── conf.d/
|
|
│ ├── rwaapi.conf # API 网关配置
|
|
│ └── proxy_params.conf # 代理参数配置
|
|
└── ssl/
|
|
├── rwaapi.szaiai.com.pem # SSL 证书
|
|
└── rwaapi.szaiai.com.key # SSL 私钥
|
|
```
|
|
|
|
### 3.2 主配置文件 `/etc/nginx/nginx.conf`
|
|
|
|
```nginx
|
|
user nginx;
|
|
worker_processes auto;
|
|
error_log /var/log/nginx/error.log warn;
|
|
pid /var/run/nginx.pid;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
use epoll;
|
|
multi_accept on;
|
|
}
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent" "$http_x_forwarded_for" '
|
|
'rt=$request_time uct="$upstream_connect_time" '
|
|
'uht="$upstream_header_time" urt="$upstream_response_time"';
|
|
|
|
access_log /var/log/nginx/access.log main;
|
|
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
keepalive_timeout 65;
|
|
types_hash_max_size 2048;
|
|
client_max_body_size 10m;
|
|
|
|
# Gzip 压缩
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_proxied any;
|
|
gzip_comp_level 6;
|
|
gzip_types text/plain text/css text/xml application/json application/javascript
|
|
application/xml application/xml+rss text/javascript;
|
|
|
|
# 限流配置
|
|
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
|
|
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
|
|
|
|
include /etc/nginx/conf.d/*.conf;
|
|
}
|
|
```
|
|
|
|
### 3.3 代理参数配置 `/etc/nginx/conf.d/proxy_params.conf`
|
|
|
|
```nginx
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Connection "";
|
|
|
|
proxy_connect_timeout 60s;
|
|
proxy_send_timeout 60s;
|
|
proxy_read_timeout 60s;
|
|
|
|
proxy_buffering on;
|
|
proxy_buffer_size 4k;
|
|
proxy_buffers 8 4k;
|
|
proxy_busy_buffers_size 8k;
|
|
```
|
|
|
|
### 3.4 API 网关配置 `/etc/nginx/conf.d/rwaapi.conf`
|
|
|
|
```nginx
|
|
# ============================================
|
|
# 后端服务器地址 (192.168.1.111)
|
|
# ============================================
|
|
upstream identity_service {
|
|
server 192.168.1.111:3000;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream wallet_service {
|
|
server 192.168.1.111:3002;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream planting_service {
|
|
server 192.168.1.111:3003;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream referral_service {
|
|
server 192.168.1.111:3004;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream reward_service {
|
|
server 192.168.1.111:3005;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream leaderboard_service {
|
|
server 192.168.1.111:3007;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream reporting_service {
|
|
server 192.168.1.111:3008;
|
|
keepalive 32;
|
|
}
|
|
|
|
# ============================================
|
|
# HTTP -> HTTPS 重定向
|
|
# ============================================
|
|
server {
|
|
listen 80;
|
|
server_name rwaapi.szaiai.com;
|
|
return 301 https://$server_name$request_uri;
|
|
}
|
|
|
|
# ============================================
|
|
# HTTPS 服务器
|
|
# ============================================
|
|
server {
|
|
listen 443 ssl http2;
|
|
server_name rwaapi.szaiai.com;
|
|
|
|
# SSL 证书配置
|
|
ssl_certificate /etc/nginx/ssl/rwaapi.szaiai.com.pem;
|
|
ssl_certificate_key /etc/nginx/ssl/rwaapi.szaiai.com.key;
|
|
ssl_session_timeout 1d;
|
|
ssl_session_cache shared:SSL:50m;
|
|
ssl_session_tickets off;
|
|
|
|
# 现代 SSL 配置
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
|
|
ssl_prefer_server_ciphers off;
|
|
|
|
# HSTS
|
|
add_header Strict-Transport-Security "max-age=63072000" always;
|
|
|
|
# 安全头
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
|
|
# CORS 配置
|
|
add_header 'Access-Control-Allow-Origin' '*' always;
|
|
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
|
|
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
|
|
add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;
|
|
|
|
# 处理 OPTIONS 预检请求
|
|
if ($request_method = 'OPTIONS') {
|
|
add_header 'Access-Control-Allow-Origin' '*';
|
|
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
|
|
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
|
|
add_header 'Access-Control-Max-Age' 1728000;
|
|
add_header 'Content-Type' 'text/plain; charset=utf-8';
|
|
add_header 'Content-Length' 0;
|
|
return 204;
|
|
}
|
|
|
|
# 限流
|
|
limit_req zone=api_limit burst=20 nodelay;
|
|
limit_conn conn_limit 10;
|
|
|
|
# ============================================
|
|
# 健康检查端点
|
|
# ============================================
|
|
location /health {
|
|
access_log off;
|
|
return 200 '{"status":"ok","timestamp":"$time_iso8601"}';
|
|
add_header Content-Type application/json;
|
|
}
|
|
|
|
# ============================================
|
|
# Identity Service - 用户身份认证
|
|
# POST /api/v1/user/auto-create - 自动创建用户
|
|
# POST /api/v1/user/login - 用户登录
|
|
# GET /api/v1/user/profile - 获取用户信息
|
|
# ============================================
|
|
location /api/v1/user {
|
|
proxy_pass http://identity_service/api/v1/user;
|
|
include /etc/nginx/conf.d/proxy_params.conf;
|
|
}
|
|
|
|
location /api/v1/auth {
|
|
proxy_pass http://identity_service/api/v1/auth;
|
|
include /etc/nginx/conf.d/proxy_params.conf;
|
|
}
|
|
|
|
# ============================================
|
|
# Wallet Service - 钱包操作
|
|
# GET /api/v1/wallet/balance - 查询余额
|
|
# POST /api/v1/wallet/create - 创建钱包
|
|
# ============================================
|
|
location /api/v1/wallet {
|
|
proxy_pass http://wallet_service/api/v1/wallet;
|
|
include /etc/nginx/conf.d/proxy_params.conf;
|
|
}
|
|
|
|
# Trading - 交易
|
|
location /api/v1/trading {
|
|
proxy_pass http://wallet_service/api/v1/trading;
|
|
include /etc/nginx/conf.d/proxy_params.conf;
|
|
}
|
|
|
|
# Deposit - 充值
|
|
location /api/v1/deposit {
|
|
proxy_pass http://wallet_service/api/v1/deposit;
|
|
include /etc/nginx/conf.d/proxy_params.conf;
|
|
}
|
|
|
|
# ============================================
|
|
# Planting Service - 认种业务
|
|
# GET /api/v1/planting/price - 认种价格
|
|
# POST /api/v1/planting/submit - 提交认种
|
|
# ============================================
|
|
location /api/v1/planting {
|
|
proxy_pass http://planting_service/api/v1/planting;
|
|
include /etc/nginx/conf.d/proxy_params.conf;
|
|
}
|
|
|
|
# ============================================
|
|
# Referral Service - 推荐系统
|
|
# GET /api/v1/referral/generate-link - 生成推荐链接
|
|
# GET /api/v1/community/referrals - 获取推荐列表
|
|
# ============================================
|
|
location /api/v1/referral {
|
|
proxy_pass http://referral_service/api/v1/referral;
|
|
include /etc/nginx/conf.d/proxy_params.conf;
|
|
}
|
|
|
|
location /api/v1/community {
|
|
proxy_pass http://referral_service/api/v1/community;
|
|
include /etc/nginx/conf.d/proxy_params.conf;
|
|
}
|
|
|
|
# ============================================
|
|
# Reward Service - 挖矿奖励
|
|
# GET /api/v1/mining/status - 挖矿状态
|
|
# POST /api/v1/mining/start - 开始挖矿
|
|
# POST /api/v1/mining/claim - 领取奖励
|
|
# ============================================
|
|
location /api/v1/mining {
|
|
proxy_pass http://reward_service/api/v1/mining;
|
|
include /etc/nginx/conf.d/proxy_params.conf;
|
|
}
|
|
|
|
location /api/v1/reward {
|
|
proxy_pass http://reward_service/api/v1/reward;
|
|
include /etc/nginx/conf.d/proxy_params.conf;
|
|
}
|
|
|
|
# ============================================
|
|
# Leaderboard Service - 排行榜
|
|
# GET /api/v1/ranking/daily - 日榜
|
|
# GET /api/v1/ranking/weekly - 周榜
|
|
# ============================================
|
|
location /api/v1/ranking {
|
|
proxy_pass http://leaderboard_service/api/ranking;
|
|
include /etc/nginx/conf.d/proxy_params.conf;
|
|
}
|
|
|
|
location /api/v1/leaderboard {
|
|
proxy_pass http://leaderboard_service/api/leaderboard;
|
|
include /etc/nginx/conf.d/proxy_params.conf;
|
|
}
|
|
|
|
# ============================================
|
|
# Reporting Service - 遥测统计
|
|
# POST /api/v1/telemetry/session - 上报会话
|
|
# POST /api/v1/telemetry/heartbeat - 心跳
|
|
# POST /api/v1/telemetry/events - 事件上报
|
|
# ============================================
|
|
location /api/v1/telemetry {
|
|
proxy_pass http://reporting_service/api/v1/telemetry;
|
|
include /etc/nginx/conf.d/proxy_params.conf;
|
|
}
|
|
|
|
location /api/v1/report {
|
|
proxy_pass http://reporting_service/api/v1/report;
|
|
include /etc/nginx/conf.d/proxy_params.conf;
|
|
}
|
|
|
|
# ============================================
|
|
# 默认 404
|
|
# ============================================
|
|
location / {
|
|
return 404 '{"error":"Not Found","message":"API endpoint not found"}';
|
|
add_header Content-Type application/json;
|
|
}
|
|
}
|
|
```
|
|
|
|
## 4. 后端服务器配置 (192.168.1.111)
|
|
|
|
### 4.1 Docker Compose 部署文件
|
|
|
|
在 192.168.1.111 服务器上创建 `/opt/rwadurian/docker-compose.yml`:
|
|
|
|
```yaml
|
|
services:
|
|
# ============================================
|
|
# 微服务
|
|
# ============================================
|
|
identity-service:
|
|
build: ./services/identity-service
|
|
ports:
|
|
- "3000:3000"
|
|
environment:
|
|
- DATABASE_URL=postgresql://postgres:${DB_PASSWORD}@postgres:5432/rwa_identity
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- REDIS_HOST=redis
|
|
- KAFKA_BROKERS=kafka:29092
|
|
- MPC_SERVICE_URL=http://mpc-service:3001
|
|
- BACKUP_SERVICE_URL=http://backup-service:3009
|
|
- APP_ENV=production
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
networks:
|
|
- rwa-network
|
|
restart: unless-stopped
|
|
|
|
mpc-service:
|
|
build: ./services/mpc-service
|
|
ports:
|
|
- "3001:3001"
|
|
environment:
|
|
- DATABASE_URL=postgresql://postgres:${DB_PASSWORD}@postgres:5432/rwa_mpc
|
|
- REDIS_HOST=redis
|
|
- APP_ENV=production
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
networks:
|
|
- rwa-network
|
|
restart: unless-stopped
|
|
|
|
wallet-service:
|
|
build: ./services/wallet-service
|
|
ports:
|
|
- "3002:3002"
|
|
environment:
|
|
- DATABASE_URL=postgresql://postgres:${DB_PASSWORD}@postgres:5432/rwa_wallet
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- REDIS_HOST=redis
|
|
- KAFKA_BROKERS=kafka:29092
|
|
- IDENTITY_SERVICE_URL=http://identity-service:3000
|
|
- APP_ENV=production
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
networks:
|
|
- rwa-network
|
|
restart: unless-stopped
|
|
|
|
planting-service:
|
|
build: ./services/planting-service
|
|
ports:
|
|
- "3003:3003"
|
|
environment:
|
|
- DATABASE_URL=postgresql://postgres:${DB_PASSWORD}@postgres:5432/rwa_planting
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- REDIS_HOST=redis
|
|
- KAFKA_BROKERS=kafka:29092
|
|
- WALLET_SERVICE_URL=http://wallet-service:3002
|
|
- IDENTITY_SERVICE_URL=http://identity-service:3000
|
|
- APP_ENV=production
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
networks:
|
|
- rwa-network
|
|
restart: unless-stopped
|
|
|
|
referral-service:
|
|
build: ./services/referral-service
|
|
ports:
|
|
- "3004:3004"
|
|
environment:
|
|
- DATABASE_URL=postgresql://postgres:${DB_PASSWORD}@postgres:5432/rwa_referral
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- REDIS_HOST=redis
|
|
- KAFKA_BROKERS=kafka:29092
|
|
- IDENTITY_SERVICE_URL=http://identity-service:3000
|
|
- PLANTING_SERVICE_URL=http://planting-service:3003
|
|
- APP_ENV=production
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
networks:
|
|
- rwa-network
|
|
restart: unless-stopped
|
|
|
|
reward-service:
|
|
build: ./services/reward-service
|
|
ports:
|
|
- "3005:3005"
|
|
environment:
|
|
- DATABASE_URL=postgresql://postgres:${DB_PASSWORD}@postgres:5432/rwa_reward
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- REDIS_HOST=redis
|
|
- KAFKA_BROKERS=kafka:29092
|
|
- IDENTITY_SERVICE_URL=http://identity-service:3000
|
|
- WALLET_SERVICE_URL=http://wallet-service:3002
|
|
- REFERRAL_SERVICE_URL=http://referral-service:3004
|
|
- APP_ENV=production
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
networks:
|
|
- rwa-network
|
|
restart: unless-stopped
|
|
|
|
authorization-service:
|
|
build: ./services/authorization-service
|
|
ports:
|
|
- "3006:3006"
|
|
environment:
|
|
- DATABASE_URL=postgresql://postgres:${DB_PASSWORD}@postgres:5432/rwa_authorization
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- REDIS_HOST=redis
|
|
- IDENTITY_SERVICE_URL=http://identity-service:3000
|
|
- APP_ENV=production
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
networks:
|
|
- rwa-network
|
|
restart: unless-stopped
|
|
|
|
leaderboard-service:
|
|
build: ./services/leaderboard-service
|
|
ports:
|
|
- "3007:3007"
|
|
environment:
|
|
- DATABASE_URL=postgresql://postgres:${DB_PASSWORD}@postgres:5432/rwa_leaderboard
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- REDIS_HOST=redis
|
|
- KAFKA_BROKERS=kafka:29092
|
|
- IDENTITY_SERVICE_URL=http://identity-service:3000
|
|
- REFERRAL_SERVICE_URL=http://referral-service:3004
|
|
- APP_ENV=production
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
networks:
|
|
- rwa-network
|
|
restart: unless-stopped
|
|
|
|
reporting-service:
|
|
build: ./services/reporting-service
|
|
ports:
|
|
- "3008:3008"
|
|
environment:
|
|
- DATABASE_URL=postgresql://postgres:${DB_PASSWORD}@postgres:5432/rwa_reporting
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- REDIS_HOST=redis
|
|
- KAFKA_BROKERS=kafka:29092
|
|
- APP_ENV=production
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
networks:
|
|
- rwa-network
|
|
restart: unless-stopped
|
|
|
|
backup-service:
|
|
build: ./services/backup-service
|
|
ports:
|
|
- "3009:3009"
|
|
environment:
|
|
- DATABASE_URL=postgresql://postgres:${DB_PASSWORD}@postgres-backup:5432/rwa_backup
|
|
- SERVICE_JWT_SECRET=${SERVICE_JWT_SECRET}
|
|
- APP_ENV=production
|
|
networks:
|
|
- rwa-network
|
|
restart: unless-stopped
|
|
|
|
# ============================================
|
|
# 基础设施
|
|
# ============================================
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
- POSTGRES_USER=postgres
|
|
- POSTGRES_PASSWORD=${DB_PASSWORD}
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
- ./scripts/init-databases.sql:/docker-entrypoint-initdb.d/init.sql
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U postgres"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
networks:
|
|
- rwa-network
|
|
restart: unless-stopped
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
command: redis-server --requirepass ${REDIS_PASSWORD}
|
|
volumes:
|
|
- redis_data:/data
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
networks:
|
|
- rwa-network
|
|
restart: unless-stopped
|
|
|
|
zookeeper:
|
|
image: confluentinc/cp-zookeeper:7.5.0
|
|
environment:
|
|
ZOOKEEPER_CLIENT_PORT: 2181
|
|
networks:
|
|
- rwa-network
|
|
restart: unless-stopped
|
|
|
|
kafka:
|
|
image: confluentinc/cp-kafka:7.5.0
|
|
depends_on:
|
|
- zookeeper
|
|
environment:
|
|
KAFKA_BROKER_ID: 1
|
|
KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
|
|
KAFKA_ADVERTISED_LISTENERS: PLAINTEXT_INTERNAL://kafka:29092
|
|
KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT_INTERNAL:PLAINTEXT
|
|
KAFKA_LISTENERS: PLAINTEXT_INTERNAL://0.0.0.0:29092
|
|
KAFKA_INTER_BROKER_LISTENER_NAME: PLAINTEXT_INTERNAL
|
|
KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
|
|
KAFKA_AUTO_CREATE_TOPICS_ENABLE: "true"
|
|
networks:
|
|
- rwa-network
|
|
restart: unless-stopped
|
|
|
|
networks:
|
|
rwa-network:
|
|
driver: bridge
|
|
|
|
volumes:
|
|
postgres_data:
|
|
redis_data:
|
|
```
|
|
|
|
### 4.2 数据库初始化脚本
|
|
|
|
在 192.168.1.111 服务器上创建 `/opt/rwadurian/scripts/init-databases.sql`:
|
|
|
|
```sql
|
|
-- 创建所有微服务数据库
|
|
CREATE DATABASE rwa_identity;
|
|
CREATE DATABASE rwa_mpc;
|
|
CREATE DATABASE rwa_wallet;
|
|
CREATE DATABASE rwa_planting;
|
|
CREATE DATABASE rwa_referral;
|
|
CREATE DATABASE rwa_reward;
|
|
CREATE DATABASE rwa_authorization;
|
|
CREATE DATABASE rwa_leaderboard;
|
|
CREATE DATABASE rwa_reporting;
|
|
CREATE DATABASE rwa_backup;
|
|
```
|
|
|
|
### 4.3 环境变量文件
|
|
|
|
在 192.168.1.111 服务器上创建 `/opt/rwadurian/.env`:
|
|
|
|
```bash
|
|
# Database
|
|
DB_PASSWORD=your_secure_database_password_here
|
|
|
|
# JWT (所有服务共享)
|
|
JWT_SECRET=your_super_secure_jwt_secret_at_least_32_characters
|
|
|
|
# Redis
|
|
REDIS_PASSWORD=your_secure_redis_password
|
|
|
|
# Service JWT (服务间通信)
|
|
SERVICE_JWT_SECRET=your_service_jwt_secret_for_internal_calls
|
|
|
|
# Wallet Encryption
|
|
WALLET_ENCRYPTION_SALT=your_wallet_encryption_salt
|
|
```
|
|
|
|
## 5. 部署步骤
|
|
|
|
### 5.1 Nginx 服务器配置
|
|
|
|
```bash
|
|
# 1. 安装 Nginx
|
|
apt update && apt install -y nginx
|
|
|
|
# 2. 创建配置目录
|
|
mkdir -p /etc/nginx/ssl
|
|
|
|
# 3. 复制配置文件
|
|
# 将上面的 nginx.conf, proxy_params.conf, rwaapi.conf 复制到对应目录
|
|
|
|
# 4. 安装 SSL 证书 (Let's Encrypt 示例)
|
|
apt install -y certbot python3-certbot-nginx
|
|
certbot --nginx -d rwaapi.szaiai.com
|
|
|
|
# 5. 测试配置
|
|
nginx -t
|
|
|
|
# 6. 重启 Nginx
|
|
systemctl restart nginx
|
|
systemctl enable nginx
|
|
```
|
|
|
|
### 5.2 后端服务器 (192.168.1.111) 配置
|
|
|
|
```bash
|
|
# 1. 安装 Docker
|
|
curl -fsSL https://get.docker.com | sh
|
|
usermod -aG docker $USER
|
|
|
|
# 2. 安装 Docker Compose
|
|
apt install -y docker-compose-plugin
|
|
|
|
# 3. 创建部署目录
|
|
mkdir -p /opt/rwadurian
|
|
cd /opt/rwadurian
|
|
|
|
# 4. 克隆代码
|
|
git clone https://github.com/your-org/rwadurian.git .
|
|
|
|
# 5. 配置环境变量
|
|
cp .env.example .env
|
|
vim .env # 修改为生产环境配置
|
|
|
|
# 6. 创建数据库初始化脚本
|
|
mkdir -p scripts
|
|
# 将上面的 init-databases.sql 复制到 scripts/
|
|
|
|
# 7. 启动所有服务
|
|
docker compose up -d
|
|
|
|
# 8. 查看服务状态
|
|
docker compose ps
|
|
|
|
# 9. 运行数据库迁移
|
|
docker compose exec identity-service npx prisma migrate deploy
|
|
docker compose exec wallet-service npx prisma migrate deploy
|
|
docker compose exec planting-service npx prisma migrate deploy
|
|
docker compose exec referral-service npx prisma migrate deploy
|
|
docker compose exec reward-service npx prisma migrate deploy
|
|
docker compose exec leaderboard-service npx prisma migrate deploy
|
|
docker compose exec reporting-service npx prisma migrate deploy
|
|
```
|
|
|
|
### 5.3 验证部署
|
|
|
|
```bash
|
|
# 从 Nginx 服务器测试
|
|
curl -k https://rwaapi.szaiai.com/health
|
|
|
|
# 测试 API 端点
|
|
curl -k https://rwaapi.szaiai.com/api/v1/user/auto-create \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"deviceId": "test-device-123"}'
|
|
|
|
# 从后端服务器直接测试
|
|
curl http://localhost:3000/api/v1/user/auto-create \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"deviceId": "test-device-123"}'
|
|
```
|
|
|
|
## 6. API 端点对照表
|
|
|
|
| 前端调用路径 | Nginx 转发 | 后端服务 | 端口 |
|
|
|-------------|-----------|---------|------|
|
|
| `/api/v1/user/*` | → | Identity Service | 3000 |
|
|
| `/api/v1/auth/*` | → | Identity Service | 3000 |
|
|
| `/api/v1/wallet/*` | → | Wallet Service | 3002 |
|
|
| `/api/v1/trading/*` | → | Wallet Service | 3002 |
|
|
| `/api/v1/deposit/*` | → | Wallet Service | 3002 |
|
|
| `/api/v1/mining/*` | → | Reward Service | 3005 |
|
|
| `/api/v1/reward/*` | → | Reward Service | 3005 |
|
|
| `/api/v1/ranking/*` | → | Leaderboard Service | 3007 |
|
|
| `/api/v1/leaderboard/*` | → | Leaderboard Service | 3007 |
|
|
| `/api/v1/planting/*` | → | Planting Service | 3003 |
|
|
| `/api/v1/referral/*` | → | Referral Service | 3004 |
|
|
| `/api/v1/community/*` | → | Referral Service | 3004 |
|
|
| `/api/v1/telemetry/*` | → | Reporting Service | 3008 |
|
|
| `/api/v1/report/*` | → | Reporting Service | 3008 |
|
|
|
|
## 7. 监控与运维
|
|
|
|
### 7.1 查看 Nginx 日志
|
|
|
|
```bash
|
|
# 访问日志
|
|
tail -f /var/log/nginx/access.log
|
|
|
|
# 错误日志
|
|
tail -f /var/log/nginx/error.log
|
|
|
|
# 过滤特定服务请求
|
|
grep "/api/v1/user" /var/log/nginx/access.log | tail -100
|
|
```
|
|
|
|
### 7.2 查看服务日志
|
|
|
|
```bash
|
|
# 在 192.168.1.111 上执行
|
|
|
|
# 查看所有服务日志
|
|
docker compose logs -f
|
|
|
|
# 查看特定服务日志
|
|
docker compose logs -f identity-service
|
|
docker compose logs -f wallet-service
|
|
|
|
# 查看最近 100 行
|
|
docker compose logs --tail=100 identity-service
|
|
```
|
|
|
|
### 7.3 服务健康检查
|
|
|
|
```bash
|
|
# 检查所有服务状态
|
|
docker compose ps
|
|
|
|
# 检查特定服务健康
|
|
curl http://192.168.1.111:3000/health # Identity
|
|
curl http://192.168.1.111:3002/health # Wallet
|
|
curl http://192.168.1.111:3003/health # Planting
|
|
curl http://192.168.1.111:3004/health # Referral
|
|
curl http://192.168.1.111:3005/health # Reward
|
|
curl http://192.168.1.111:3007/health # Leaderboard
|
|
curl http://192.168.1.111:3008/health # Reporting
|
|
```
|
|
|
|
### 7.4 重启服务
|
|
|
|
```bash
|
|
# 重启单个服务
|
|
docker compose restart identity-service
|
|
|
|
# 重启所有服务
|
|
docker compose restart
|
|
|
|
# 重建并重启
|
|
docker compose up -d --build identity-service
|
|
```
|
|
|
|
## 8. 常见问题
|
|
|
|
### Q1: 502 Bad Gateway
|
|
- 检查后端服务是否运行: `docker compose ps`
|
|
- 检查 Nginx 到 192.168.1.111 网络是否通: `ping 192.168.1.111`
|
|
- 检查端口是否开放: `telnet 192.168.1.111 3000`
|
|
|
|
### Q2: CORS 错误
|
|
- 确认 Nginx 配置中 CORS 头已正确设置
|
|
- 检查 OPTIONS 预检请求是否返回 204
|
|
|
|
### Q3: SSL 证书问题
|
|
- 检查证书路径: `ls -la /etc/nginx/ssl/`
|
|
- 测试 SSL: `openssl s_client -connect rwaapi.szaiai.com:443`
|
|
- 检查证书有效期: `openssl x509 -in /etc/nginx/ssl/rwaapi.szaiai.com.pem -noout -dates`
|
|
|
|
### Q4: 服务间通信失败
|
|
- 检查 Docker 网络: `docker network inspect rwa-network`
|
|
- 检查服务名解析: `docker compose exec identity-service ping wallet-service`
|
|
|
|
---
|
|
|
|
**最后更新**: 2025-12-01
|
|
**维护者**: RWA Team
|