246 lines
10 KiB
Markdown
246 lines
10 KiB
Markdown
# Deploy Platform
|
||
|
||
项目运维平台。
|
||
|
||
## Scripts
|
||
|
||
```bash
|
||
npm install
|
||
make build
|
||
make up
|
||
npm run dev
|
||
npm run build
|
||
npm run lint
|
||
npm run test
|
||
```
|
||
|
||
## Docs
|
||
|
||
- [UI 设计规范](./docs/liquid-glass-admin-ui-guideline.md)
|
||
- [第一版开发内容](./docs/v1-development-scope.md)
|
||
- [模块化开发规范](./docs/modular-development-guideline.md)
|
||
|
||
## Standalone Deploy
|
||
|
||
构建后可一键运行 `dist` 和 `deploy` API：
|
||
|
||
```bash
|
||
npm run deploy:run
|
||
```
|
||
|
||
已有 `dist` 时直接启动：
|
||
|
||
```bash
|
||
npm run deploy:serve
|
||
```
|
||
|
||
默认地址：`http://127.0.0.1:29200`。
|
||
|
||
也可以用 Makefile 一键运行：
|
||
|
||
```bash
|
||
make up
|
||
```
|
||
|
||
部署模板和 TAT 脚本见 `deploy/README.md`。
|
||
|
||
## 数据资源
|
||
|
||
- API：`GET /deploy/api/hyapp/resources?remote=1`
|
||
- 链路：Tencent TAT -> deploy 机器
|
||
- MySQL、Redis、MQ：腾讯云托管资源
|
||
- 业务服务器配置：优先 SSH，失败后 TAT 兜底
|
||
- 前端状态：TAT 未返回前保持加载
|
||
- 禁止：生产 SQL/Mongo 查询入口
|
||
|
||
## 微服务
|
||
|
||
- 列表：`GET /deploy/api/hyapp/discover?remote=1`
|
||
- 详情 YAML：`GET /deploy/api/hyapp/discover?remote=1&includeConfig=1`
|
||
- 链路：Tencent TAT -> deploy 机器 `43.164.75.199` -> SSH 业务机器
|
||
- 数据来源：SSH 读取 systemd、Docker、镜像、资源、日志和配置
|
||
- YAML 入口：列表右侧三点、详情配置区
|
||
- 禁止：静态假数据兜底展示运行态
|
||
|
||
## CDN 刷新
|
||
|
||
- 页面：`/cdn-refresh`
|
||
- API：`POST /deploy/api/edgeone/purge-url`
|
||
- 类型：当前只开放 EdgeOne URL 刷新
|
||
- 默认站点：`global-interaction.com` / `zone-3qwew52ihaj2`
|
||
- 默认允许域名：`h5.global-interaction.com`、`vivagames.global-interaction.com`、`asset.global-interaction.com`
|
||
- 参数：`urls`、`confirmed=true`
|
||
- 验证：接口等待 EdgeOne 任务结束后返回 `jobId`、`status`、`tasks`
|
||
- 禁止：页面刷新任意未配置域名；需要新增域名时先改 `EDGEONE_ALLOWED_HOSTS`
|
||
|
||
## 生产特殊服务
|
||
|
||
`admin-server` 和 `cron-service` 当前不是标准 `hyapp-services.inventory.prod.example.json` 里的同一种滚动服务，更新前必须先按真实机器确认运行态。
|
||
|
||
### admin-server
|
||
|
||
- 机器：Saudi `admin-platform`，CVM `ins-p11begwe`，公网 `43.164.70.49`，内网 `10.2.1.2`
|
||
- systemd：`hyapp-admin-server`
|
||
- 容器：`hyapp-admin-server`
|
||
- 配置：`/etc/hyapp/admin-server/config.yaml`
|
||
- Docker env：`/etc/hyapp/admin-server/docker.env`
|
||
- migration 目录：`/opt/hyapp/admin-server/migrations`
|
||
- 镜像仓库：`10.2.1.3:18082/hyapp/admin-server:<tag>`
|
||
- 监听：`10.2.1.2:13100`
|
||
- 验证：`systemctl is-active hyapp-admin-server`、`docker ps --filter name=hyapp-admin-server`、`ss -lntp | grep 13100`、`curl http://10.2.1.2:13100/healthz`、`curl http://10.2.1.2:13100/readyz`
|
||
|
||
`admin-server` 更新只允许发布 `origin/main`。deploy 机拉取 Gitea `git@gitea.haiyihy.com:hy/hyapp-server.git` 的 `origin/main`，构建并推送 `10.2.1.3:18082/hyapp/admin-server:<tag>`；然后通过 Tencent TAT 到 `ins-p11begwe` 修改 `/etc/hyapp/admin-server/docker.env` 的 `IMAGE`，执行 `systemctl restart hyapp-admin-server`。`admin-platform` 已配置 Docker 直拉内网 Harbor：`/etc/docker/daemon.json` 包含 insecure registry `10.2.1.3:18082`，`/root/.docker/config.json` 包含 Harbor 登录凭据。
|
||
|
||
发布后必须确认：systemd `active`、容器镜像 tag/digest 正确、`10.2.1.2:13100` 监听、`healthz/readyz` 正常、Caddy 容器 `yumi-admin-caddy` 运行、`https://admin-acc.global-interaction.com/` 返回 `200`、未登录 `https://admin-acc.global-interaction.com/api/v1/auth/me` 返回 `401`。
|
||
|
||
### Saudi admin-platform 前端
|
||
|
||
- 机器：公网 `43.164.70.49`，内网 `10.2.1.2`
|
||
- CVM：`ins-p11begwe`
|
||
- 区域：`me-saudi-arabia`
|
||
- Caddy 容器：`yumi-admin-caddy`
|
||
- Caddy 宿主机目录：`/opt/yumi-admin/frontend-admin`
|
||
- 静态根目录：`/opt/yumi-admin/frontend-admin/site`
|
||
- Node 运行时：`/opt/node-v22.18.0-linux-x64`
|
||
|
||
这台机器承接两个加速后台前端，都是本机拉 Gitea、构建、替换 Caddy 静态目录：
|
||
|
||
| 入口 | watcher | 仓库 | 静态目录 | API 回源 |
|
||
| --- | --- | --- | --- | --- |
|
||
| `https://yumiadmin-acc.global-interaction.com` | `chatapp3-admin-watch.service` | `git@gitea.haiyihy.com:hy/chatapp3-admin.git` `main` | `/opt/yumi-admin/frontend-admin/site/yumiadmin-acc` | `/console/*` -> Saudi 内网 CLB `https://10.2.1.12`，Host/SNI `jvapi.haiyihy.com` |
|
||
| `https://admin-acc.global-interaction.com` | `hyapp-admin-platform-watch.service` | `https://gitea.haiyihy.com/hy/hyapp-admin-platform.git` `main` | `/opt/yumi-admin/frontend-admin/site/hyapp-admin-platform` | `/api/*` -> `http://10.2.1.2:13100` |
|
||
|
||
两个 watcher 都是 5 秒循环，入口脚本分别是：
|
||
|
||
```bash
|
||
/opt/chatapp3-admin/bin/watch-build.sh
|
||
/opt/hyapp-admin-platform/bin/watch-build.sh
|
||
```
|
||
|
||
实际部署脚本分别是：
|
||
|
||
```bash
|
||
/opt/chatapp3-admin/bin/deploy-once.sh
|
||
/opt/hyapp-admin-platform/bin/deploy-once.sh
|
||
```
|
||
|
||
部署完成标记：
|
||
|
||
```bash
|
||
/opt/chatapp3-admin/.last_built_commit
|
||
/opt/hyapp-admin-platform/.deployed_commit
|
||
```
|
||
|
||
排查或变更后必须验证：
|
||
|
||
```bash
|
||
systemctl is-active chatapp3-admin-watch.service hyapp-admin-platform-watch.service
|
||
tail -n 100 /opt/chatapp3-admin/logs/deploy.log
|
||
tail -n 100 /opt/hyapp-admin-platform/logs/deploy.log
|
||
curl -I https://yumiadmin-acc.global-interaction.com/
|
||
curl -I https://admin-acc.global-interaction.com/
|
||
```
|
||
|
||
未登录 API 返回 `401` 是正常结果，用来证明反代已经打到后端鉴权层：
|
||
|
||
```bash
|
||
curl -sS https://yumiadmin-acc.global-interaction.com/console/
|
||
curl -sS https://admin-acc.global-interaction.com/api/v1/admin/apps
|
||
```
|
||
|
||
### cron-service
|
||
|
||
- 当前线上 HyApp `cron-service` 部署在 Saudi 主服务机器 `new-app-1`
|
||
- 区域：`me-saudi-arabia`
|
||
- 实例：`ins-fi5zufpk`
|
||
- 内网：`10.2.1.4`
|
||
- systemd：`hyapp-cron-service`
|
||
- 容器：`hyapp-cron-service`
|
||
- 配置：`/etc/hyapp/cron-service/config.yaml`
|
||
- Docker env：`/etc/hyapp/cron-service/docker.env`
|
||
- 监听：`:13007`
|
||
- 验证：`systemctl is-active hyapp-cron-service`、`docker ps -a | grep hyapp-cron-service`、`ss -lntp | grep 13007`
|
||
|
||
`cron-service` 当前不在标准 prod inventory 的 `services` 清单里。更新时先构建并推送 `10.2.1.3:18082/hyapp/cron-service:<tag>`，再通过 Tencent TAT 到 `new-app-1` 修改 `/etc/hyapp/cron-service/docker.env` 中的 `IMAGE` 并重启 `hyapp-cron-service`。发布后必须确认容器镜像 tag、Docker health、systemd `active` 和 `13007` 监听。
|
||
|
||
腾讯云 `ap-singapore` 有一台实例名为 `cron` 的机器：
|
||
|
||
- 实例：`ins-nt6bsay0`
|
||
- 内网：`10.3.1.14`
|
||
|
||
这台新加坡 `cron` 机器当前没有 HyApp 的 `hyapp-cron-service`。最近一次核实时 `hyapp-cron-service` 为 `inactive`，Docker 里只有 `likei-cron-sg-1-week-star-job`。
|
||
|
||
## 测试 Server
|
||
|
||
这里的测试 server 指 HyApp 后端测试机 testbox，不是生产业务机。
|
||
|
||
- 测试机：`43.165.195.39` / `10.11.0.2`
|
||
- CVM 实例：`lhins-q0m38zc6`
|
||
- 区域：`ap-jakarta`
|
||
- 根目录：`/opt/hyapp-server-test`
|
||
- 代码目录：`/opt/hyapp-server-test/source`
|
||
- 部署脚本：`/opt/hyapp-server-test/bin/deploy.sh`
|
||
- 自动更新 timer：`hyapp-server-test-deploy.timer`
|
||
- 部署完成标记：`/opt/hyapp-server-test/.deployed_commit`
|
||
- 后台前端：`http://1.14.164.2:7001/`
|
||
|
||
当前测试机不走生产镜像仓库，也不摘 CLB。部署模式是测试机自己拉取远端 `test` 分支，`hyapp-server-test-deploy.timer` 每分钟触发一次部署检查；部署成功且 Compose 服务全部 healthy 后，才写入 `.deployed_commit`。
|
||
|
||
平台里的“测试服务”页面通过 deploy-platform API 调用 `deploy/tencent_tat/hyapp_testbox_config.py`，再通过 Tencent TAT 到测试机执行固定动作。页面不开放任意 shell：
|
||
|
||
- `GET /deploy/api/hyapp/testbox/status`：读取 test 分支、远端 test commit、已部署 commit、timer 和服务状态。
|
||
- `GET /deploy/api/hyapp/testbox/configs`：读取测试机服务 YAML，默认脱敏密钥字段。
|
||
- `POST /deploy/api/hyapp/testbox/service`：固定服务操作 `update/start/stop/restart`。
|
||
- `POST /deploy/api/hyapp/testbox/timer`：固定 timer 操作 `start/stop/restart/status`。
|
||
- `POST /deploy/api/hyapp/testbox/config`：写入单个服务配置，先备份旧文件，可选保存后重启。
|
||
- `GET /deploy/api/hyapp/testbox/migrations`：只列出 `source/server/admin/migrations/*.sql`。
|
||
- `POST /deploy/api/hyapp/testbox/migrations/apply`：只执行测试机仓库里的 migration 文件。
|
||
|
||
本地或 deploy-platform 机器上确认状态：
|
||
|
||
```bash
|
||
curl -fsS "http://127.0.0.1:29200/deploy/api/hyapp/testbox/status?services=gateway-service,room-service,admin-server"
|
||
```
|
||
|
||
直接走脚本确认状态：
|
||
|
||
```bash
|
||
python3 deploy/tencent_tat/hyapp_testbox_config.py status \
|
||
--env-file /opt/hy-app-monitor/.env \
|
||
--services gateway-service,room-service,admin-server
|
||
```
|
||
|
||
## 测试 Server 日志 Debug
|
||
|
||
先看平台状态，再看测试机日志。
|
||
|
||
1. 在“测试服务”页面刷新，确认 `test 分支`、`已部署 commit`、`远端 commit`、`timerState`、服务 `state/health/restartCount`。
|
||
2. 如果页面或 API 报错，先看 deploy-platform 自身日志：
|
||
|
||
```bash
|
||
journalctl -u hyapp-deploy-platform -n 200 --no-pager
|
||
docker logs --tail=200 -f hyapp-deploy-platform
|
||
```
|
||
|
||
3. 如果 TAT 到测试机成功但服务异常，登录测试机或通过腾讯云 TAT 执行同等只读命令：
|
||
|
||
```bash
|
||
ssh root@43.165.195.39
|
||
|
||
systemctl status hyapp-server-test-deploy.timer --no-pager
|
||
journalctl -u hyapp-server-test-deploy.timer -n 100 --no-pager
|
||
journalctl -u hyapp-server-test-deploy.service -n 200 --no-pager
|
||
|
||
cd /opt/hyapp-server-test/source
|
||
docker compose -p hyapp-test -f docker-compose.yml -f /opt/hyapp-server-test/docker-compose.testbox.yml ps
|
||
docker compose -p hyapp-test -f docker-compose.yml -f /opt/hyapp-server-test/docker-compose.testbox.yml logs --tail=200 -f gateway-service
|
||
docker inspect gateway-service
|
||
|
||
git -C /opt/hyapp-server-test/source status
|
||
git -C /opt/hyapp-server-test/source rev-parse HEAD
|
||
git -C /opt/hyapp-server-test/source ls-remote origin refs/heads/test
|
||
cat /opt/hyapp-server-test/.deployed_commit
|
||
```
|
||
|
||
如果 `/opt/hyapp-server-test/docker-compose.testbox.yml` 不存在，去掉第二个 `-f`。Debug 时优先查具体异常服务的 Compose 日志，例如 `room-service`、`wallet-service`、`admin-server`。配置问题先通过页面查看脱敏 YAML；需要保存配置时必须补齐真实密钥，包含 `***` 的配置禁止保存。
|