主要更新: 1. FRP服务器诊断与修复 - 发现并修复文件描述符耗尽问题(65,536 → 1,048,576) - 分析并解决用户上传失败问题 - 确认SSH服务器安全未被攻破 2. 安全防护系统部署 - 部署IP黑名单防火墙(封禁20+攻击者) - 设置SSH端口速率限制 - 配置自动化定时任务(每小时更新) - 安装Fail2ban实时防护系统 - 添加白名单保护机制 3. 内网访问优化 - 改进内网检测逻辑 - 添加网络状态API - 优化钉钉登录流程 - 完善信息补充功能 4. 文档完善 - FRP服务器诊断修复报告 - SSH安全评估报告 - Fail2ban使用指南 - 文件描述符详解 - 用户上传失败原因分析 - 防火墙配置说明 - 内网检测改进报告 修复的问题: - ✅ 文件描述符耗尽导致的服务异常 - ✅ 用户上传失败(影响9.5小时) - ✅ SSH暴力破解攻击(91,299+次) - ✅ 第三方项目攻击影响 - ✅ 127.0.0.1误封禁问题 部署的安全措施: - 三重防护体系(Fail2ban + 防火墙 + 强密码) - 自动化监控和封禁 - 实时攻击拦截(秒级响应) - 完整的管理和监控工具 测试环境:开发环境 影响范围:服务器安全、用户上传、系统稳定性 当前状态:✅ 所有问题已修复,系统运行正常
149 lines
5.1 KiB
Bash
Executable File
149 lines
5.1 KiB
Bash
Executable File
#!/bin/bash
|
||
|
||
# 配置更新部署脚本
|
||
# 用途:将10GB上传配置更新部署到服务器
|
||
# 日期:2025-11-05
|
||
|
||
set -e # 遇到错误立即退出
|
||
|
||
# 颜色定义
|
||
RED='\033[0;31m'
|
||
GREEN='\033[0;32m'
|
||
YELLOW='\033[1;33m'
|
||
BLUE='\033[0;34m'
|
||
NC='\033[0m' # No Color
|
||
|
||
# 服务器配置
|
||
SERVER_HOST="192.168.58.20"
|
||
SERVER_USER="root"
|
||
SERVER_PASSWORD="jsjj8888"
|
||
SERVER_PATH="/mnt/PoolOne/apps/youyidian-3d"
|
||
LOCAL_PROJECT_PATH="/Users/lanmu/Desktop/gongxiangp2"
|
||
|
||
echo -e "${BLUE}========================================${NC}"
|
||
echo -e "${BLUE}配置更新部署脚本${NC}"
|
||
echo -e "${BLUE}更新内容:10GB上传限制 + 2小时超时${NC}"
|
||
echo -e "${BLUE}========================================${NC}"
|
||
echo ""
|
||
|
||
# 步骤1:验证本地配置
|
||
echo -e "${YELLOW}[1/7] 验证本地配置文件...${NC}"
|
||
if [ ! -f "$LOCAL_PROJECT_PATH/next.config.js" ]; then
|
||
echo -e "${RED}错误: next.config.js 文件不存在${NC}"
|
||
exit 1
|
||
fi
|
||
|
||
if grep -q "bodySizeLimit: '10gb'" "$LOCAL_PROJECT_PATH/next.config.js"; then
|
||
echo -e "${GREEN}✓ Next.js配置已更新为10GB${NC}"
|
||
else
|
||
echo -e "${RED}警告: next.config.js 中的bodySizeLimit未设置为10gb${NC}"
|
||
echo -e "${YELLOW}请确认配置是否正确${NC}"
|
||
fi
|
||
echo ""
|
||
|
||
# 步骤2:构建Docker镜像
|
||
echo -e "${YELLOW}[2/7] 构建Docker镜像...${NC}"
|
||
cd "$LOCAL_PROJECT_PATH"
|
||
docker build -t youyidian-3d-app . || {
|
||
echo -e "${RED}错误: Docker镜像构建失败${NC}"
|
||
exit 1
|
||
}
|
||
echo -e "${GREEN}✓ Docker镜像构建成功${NC}"
|
||
echo ""
|
||
|
||
# 步骤3:保存镜像为tar文件
|
||
echo -e "${YELLOW}[3/7] 保存Docker镜像...${NC}"
|
||
docker save youyidian-3d-app > youyidian-3d-app.tar || {
|
||
echo -e "${RED}错误: Docker镜像保存失败${NC}"
|
||
exit 1
|
||
}
|
||
IMAGE_SIZE=$(du -h youyidian-3d-app.tar | cut -f1)
|
||
echo -e "${GREEN}✓ 镜像已保存 (大小: $IMAGE_SIZE)${NC}"
|
||
echo ""
|
||
|
||
# 步骤4:上传镜像到服务器
|
||
echo -e "${YELLOW}[4/7] 上传镜像到服务器...${NC}"
|
||
echo -e "${BLUE}这可能需要几分钟,请耐心等待...${NC}"
|
||
sshpass -p "$SERVER_PASSWORD" scp -o StrictHostKeyChecking=no \
|
||
youyidian-3d-app.tar ${SERVER_USER}@${SERVER_HOST}:${SERVER_PATH}/ || {
|
||
echo -e "${RED}错误: 镜像上传失败${NC}"
|
||
exit 1
|
||
}
|
||
echo -e "${GREEN}✓ 镜像上传成功${NC}"
|
||
echo ""
|
||
|
||
# 步骤5:在服务器上加载镜像
|
||
echo -e "${YELLOW}[5/7] 加载Docker镜像...${NC}"
|
||
sshpass -p "$SERVER_PASSWORD" ssh -o StrictHostKeyChecking=no \
|
||
${SERVER_USER}@${SERVER_HOST} "cd ${SERVER_PATH} && docker load < youyidian-3d-app.tar" || {
|
||
echo -e "${RED}错误: 镜像加载失败${NC}"
|
||
exit 1
|
||
}
|
||
echo -e "${GREEN}✓ 镜像加载成功${NC}"
|
||
echo ""
|
||
|
||
# 步骤6:重启Docker容器
|
||
echo -e "${YELLOW}[6/7] 重启Docker容器...${NC}"
|
||
echo -e "${BLUE}服务将短暂中断(约1-2分钟)${NC}"
|
||
sshpass -p "$SERVER_PASSWORD" ssh -o StrictHostKeyChecking=no \
|
||
${SERVER_USER}@${SERVER_HOST} "cd ${SERVER_PATH} && docker-compose down && docker-compose up -d" || {
|
||
echo -e "${RED}错误: 容器重启失败${NC}"
|
||
exit 1
|
||
}
|
||
echo -e "${GREEN}✓ 容器重启成功${NC}"
|
||
echo ""
|
||
|
||
# 步骤7:验证服务状态
|
||
echo -e "${YELLOW}[7/7] 验证服务状态...${NC}"
|
||
sleep 5 # 等待服务启动
|
||
|
||
# 检查容器是否运行
|
||
CONTAINER_STATUS=$(sshpass -p "$SERVER_PASSWORD" ssh -o StrictHostKeyChecking=no \
|
||
${SERVER_USER}@${SERVER_HOST} "docker ps | grep youyidian-3d-material | wc -l")
|
||
|
||
if [ "$CONTAINER_STATUS" -ge "1" ]; then
|
||
echo -e "${GREEN}✓ 容器运行正常${NC}"
|
||
else
|
||
echo -e "${RED}警告: 容器可能未正常启动${NC}"
|
||
echo -e "${YELLOW}请检查日志: docker logs youyidian-3d-material${NC}"
|
||
fi
|
||
|
||
# 检查应用是否响应
|
||
echo -e "${BLUE}检查应用响应...${NC}"
|
||
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" http://${SERVER_HOST}:4320/ || echo "000")
|
||
if [ "$HTTP_STATUS" = "200" ] || [ "$HTTP_STATUS" = "302" ] || [ "$HTTP_STATUS" = "307" ]; then
|
||
echo -e "${GREEN}✓ 应用响应正常 (HTTP $HTTP_STATUS)${NC}"
|
||
else
|
||
echo -e "${YELLOW}警告: 应用响应异常 (HTTP $HTTP_STATUS)${NC}"
|
||
echo -e "${YELLOW}应用可能还在启动中,请稍后再试${NC}"
|
||
fi
|
||
echo ""
|
||
|
||
# 清理本地临时文件
|
||
echo -e "${YELLOW}清理临时文件...${NC}"
|
||
rm -f youyidian-3d-app.tar
|
||
echo -e "${GREEN}✓ 临时文件已清理${NC}"
|
||
echo ""
|
||
|
||
# 显示最终结果
|
||
echo -e "${GREEN}========================================${NC}"
|
||
echo -e "${GREEN}部署完成!${NC}"
|
||
echo -e "${GREEN}========================================${NC}"
|
||
echo ""
|
||
echo -e "${BLUE}配置更新总结:${NC}"
|
||
echo -e " • Nginx 最大上传: ${GREEN}10GB${NC} (已生效)"
|
||
echo -e " • Nginx 超时时间: ${GREEN}2小时${NC} (已生效)"
|
||
echo -e " • Next.js 最大体积: ${GREEN}10GB${NC} (已部署)"
|
||
echo -e " • API 超时时间: ${GREEN}3小时${NC} (已配置)"
|
||
echo ""
|
||
echo -e "${YELLOW}建议测试:${NC}"
|
||
echo -e " 1. 访问: ${BLUE}http://${SERVER_HOST}:4320${NC}"
|
||
echo -e " 2. 尝试上传一个大文件(建议5-8GB)"
|
||
echo -e " 3. 监控上传进度和日志"
|
||
echo ""
|
||
echo -e "${YELLOW}查看日志命令:${NC}"
|
||
echo -e " ${BLUE}ssh root@${SERVER_HOST}${NC}"
|
||
echo -e " ${BLUE}docker logs -f youyidian-3d-material${NC}"
|
||
echo ""
|
||
|