diff --git a/Dockerfile b/Dockerfile index d043b1c..f320667 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,14 +1,14 @@ -FROM openresty/openresty:1.15.8.1-1-centos - -MAINTAINER "shenshuo<191715030@qq.com>" - -ENV LANG en_US.UTF-8 -# 同步时间 +FROM openresty/openresty:1.15.8.3-2-centos +ENV LANG=en_US.UTF-8 ENV TZ=Asia/Shanghai RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone +RUN yum install epel-release -y && yum install -y supervisor && yum clean all -y + COPY . /usr/local/openresty/nginx/ -VOLUME /var/log/ -VOLUME /usr/local/openresty/nginx/logs/ -EXPOSE 80 -CMD ["/usr/bin/openresty", "-g", "daemon off;"] \ No newline at end of file +RUN mv /usr/local/openresty/nginx/supervisor_ops.conf /etc/supervisord.conf + +EXPOSE 80 443 + +CMD ["/usr/bin/supervisord"] +#CMD ["/usr/bin/openresty", "-g", "daemon off;"] \ No newline at end of file diff --git a/README.md b/README.md index 85e22f2..d0615c6 100644 --- a/README.md +++ b/README.md @@ -11,8 +11,13 @@ API网关系统,是基于openresty + Lua开发的一套API网关系统,主要功 - 熔断 （未完成） -# 一、服务部署 -#### openresty 编译安装 + + +# 一、部署 + +## 传统部署 + +#### 1. openresty 编译安装 ``` wget https://openresty.org/download/openresty-1.13.6.2.tar.gz tar zxf openresty-1.13.6.2.tar.gz && cd openresty-1.13.6.2 @@ -24,40 +29,40 @@ ln -s /usr/local/openresty-1.13.6.2/ /usr/local/openresty ln -s /usr/local/openresty/bin/resty /usr/bin/resty ``` -#### yum安装 +**或者yum安装openresty** + ```bash -# yum部署 yum install yum-utils yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo yum install openresty yum install openresty-resty ``` -##### 代码部署 +#### 2. 代码部署 ```bash -\cp -arp api-gateway/* /usr/local/openresty/nginx/ +cp -arp api-gateway/* /usr/local/openresty/nginx/ ``` -# 二、 修改配置 - ##### 文件 /usr/local/openresty/nginx/conf/nginx.conf - - 修改 resolver 172.16.0.21; 为resolver DNS服务器。 - ##### 文件 /usr/local/openresty/nginx/conf/conf.d/gw.conf - - 修改 lua_code_cache on; 线上环境设置为on - - 修改 server_name 为你的网关域名 - ##### 文件 /usr/local/openresty/nginx/lua/configs.lua - - token_secret 为你的令牌的密钥 和登录JWT 服务的key一致 - - rewrite_cache_url 刷新权限到redis接口 - - rewrite_cache_token 为获取权限的令牌 - #### - login_url 当token 无效或者过期 跳转的登录页面 - - limit_conf 并发 限制默认即可 如有需求下面有详细介绍 - - rewrite_conf 注册API 下面有详解 - - - -# 三、使用配置,注册API -> 要接入API网关系统，则要先进行注册，注册方式如下： +#### 3.修改配置文件 -​ a、配置文件configs.lua中的rewrite_conf +**文件 /usr/local/openresty/nginx/conf/nginx.conf** + - 修改 resolver 172.16.0.21; 为resolver DNS服务器。 + +**文件 /usr/local/openresty/nginx/conf/conf.d/gw.conf** + - 修改 lua_code_cache on; 线上环境设置为on + - 修改 server_name 为你的网关域名 + +**文件 /usr/local/openresty/nginx/lua/configs.lua** + - token_secret 为你的令牌的密钥 和登录JWT 服务的key一致 + - rewrite_cache_url 刷新权限到redis接口 + - rewrite_cache_token 为获取权限的令牌 + - login_url 当token 无效或者过期 跳转的登录页面 + - limit_conf 并发 限制默认即可 如有需求下面有详细介绍 + - rewrite_conf 注册API 下面有详解 + +#### 4. 使用配置,注册API +> 要接入API网关系统，则要先进行注册，注册方式如下： +​ a、配置文件configs.lua中的rewrite_conf ​ b、POST注册接口(暂无) 注册示例如下： @@ -130,7 +135,24 @@ accounts 做过处理 不用经过鉴权 -# 四、API鉴权权限 +## docker 部署 + +**配置修改参考上述内容** + +``` +#bulid镜像 +docker build -t gateway_image . + +#启动 +#注意：环境变量文件env.sh 请从opendevops项目里获取 +docker run -it -d --name codo-gateway --env-file env.sh -p 8888:80 +``` + +**使用docker部署启动之后端口为8888，防止单机部署造成端口冲突。你可以改为任意一个与本机不冲突的端口** + +> 环境变量文件包含了所有项目启动所需要的变量，单启动该容器只为测试该应用是否正常，若您想使用和测试完整的项目，建议通过opendevops项目的docker-compose文件来启动一个完整的项目。 + +# 二、API鉴权权限 在configs.lua文件中配置redis信息和刷新redis权限接口信息，此信息由【权限系统】提供 @@ -154,27 +176,27 @@ accounts 做过处理 不用经过鉴权 测试： ​ 首次访问 http://gw.opendevops.cn/mg/xxxx/ 会返回 401错误，表示未登路 - http://gw.opendevops.cn/accounts/login/ - 使用post 模拟登录 - ``` - { - "username":"ss", - "password":"shenshuo", - "dynamic":"010073" - } - ``` +​ http://gw.opendevops.cn/accounts/login/ +​ 使用post 模拟登录 +​ ``` +​ { +​ "username":"ss", +​ "password":"shenshuo", +​ "dynamic":"010073" +​ } +​ ``` ​ 登录成功,再次访问进行uri鉴权,鉴权成功则如下: - http://gw.opendevops.cn/mg/v2/sysconfig/settings/STORAGE/ - ``` - { - "code": 0, - "msg": "获取配置成功", - "data": {} - } - ``` +​ http://gw.opendevops.cn/mg/v2/sysconfig/settings/STORAGE/ +​ ``` +​ { +​ "code": 0, +​ "msg": "获取配置成功", +​ "data": {} +​ } +​ ``` -# 四、API限速 +# 三、API限速 在configs.lua文件中配置limit,配置示例如下 @@ -220,7 +242,7 @@ Write errors: 0 -# 五、日志记录 +# 四、日志记录 在configs.lua文件中配置log地址及redis channel @@ -247,23 +269,7 @@ Reading messages... (press Ctrl-C to quit) 3) "{\"time\":\"2018-09-19 10:48:52\",\"uri\":\"\\/devops\\/api\\/v1.0\\/job\\/\",\"login_ip\":\"172.16.80.12\",\"method\":\"POST\"}" ``` -# docker 部署 - -**配置修改参考上述内容** - -``` -#删除前端的配置文件 -mv conf/conf.d/demo.conf conf/conf.d/demo.conf-bak - -#bulid镜像 -docker build . -t gateway_image - -#启动 -docker-compose up -d -``` -**使用docker部署启动之后端口为8888，防止单机部署造成端口冲突，如果想修改端口请修改`docker-compose.yml`文件。** -**默认域名：`http://gw.opendevops.cn:8888` 如果需要修改域名请修改`conf/conf.d/gw.conf`文件。** ## License diff --git a/conf/conf.d/demo.conf b/conf/conf.d/demo.conf deleted file mode 100644 index ee28e78..0000000 --- a/conf/conf.d/demo.conf +++ /dev/null @@ -1,28 +0,0 @@ -server { - listen 80; - server_name demo.opendevops.cn; - access_log /var/log/nginx/f_access.log; - error_log /var/log/nginx/f_error.log; - root /var/www/codo; - - location / { - root /var/www/codo; - index index.html index.htm; - try_files $uri $uri/ /index.html; - } - - location /api { - ### ws 支持 - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - - add_header 'Access-Control-Allow-Origin' '*'; - proxy_pass http://gw.opendevops.cn; - } - - location ~ /(.svn|.git|admin|manage|.sh|.bash)$ { - return 403; - } -} \ No newline at end of file diff --git a/conf/conf.d/gw.conf b/conf/conf.d/gateway.conf similarity index 86% rename from conf/conf.d/gw.conf rename to conf/conf.d/gateway.conf index a30c665..642721a 100644 --- a/conf/conf.d/gw.conf +++ b/conf/conf.d/gateway.conf @@ -1,8 +1,9 @@ server { listen 80; - server_name gw.opendevops.cn; + server_name gateway.opendevops.cn; lua_need_request_body on; # 开启获取body数据记录日志 - + access_log /usr/local/openresty/nginx/logs/gateway-access.log; + error_log /usr/local/openresty/nginx/logs/gateway-error.log; location / { ### ws 支持 proxy_http_version 1.1; diff --git a/conf/nginx.conf b/conf/nginx.conf index c774c34..50552b5 100644 --- a/conf/nginx.conf +++ b/conf/nginx.conf @@ -1,7 +1,6 @@ user root; worker_processes auto; worker_rlimit_nofile 51200; -error_log logs/error.log; events { use epoll; worker_connections 51024; @@ -9,23 +8,15 @@ events { http { #设置默认lua搜索路径 lua_package_path '$prefix/lua/?.lua;/blah/?.lua;;'; - lua_code_cache on; #线上环境设置为on, off时可以热加载lua文件 + lua_code_cache off; #线上环境设置为on, off时可以热加载lua文件 lua_shared_dict user_info 1m; lua_shared_dict my_limit_conn_store 100m; #100M可以放1.6M个键值对 include mime.types; #代理静态文件 client_header_buffer_size 64k; large_client_header_buffers 4 64k; - - gzip on; - gzip_min_length 1k; - gzip_comp_level 2; - gzip_types text/plain application/x-javascript text/css application/xml text/javascript; - gzip_vary on; - gzip_buffers 4 16k; - gzip_http_version 1.1; init_by_lua_file lua/init_by_lua.lua; # nginx启动时就会执行 include ./conf.d/*.conf; # lua生成upstream - resolver 172.16.0.21; # 内部DNS + resolver 127.0.0.11; # 内部DNS服务器地址,这里设置的是容器里的地址,如果你不是使用的容器请修改 } diff --git a/docker-compose.yml b/docker-compose.yml deleted file mode 100644 index 21f385c..0000000 --- a/docker-compose.yml +++ /dev/null @@ -1,9 +0,0 @@ -gateway: - restart: unless-stopped - image: gateway_image - volumes: - - /var/log/:/var/log/ - - /usr/local/openresty/nginx/logs/:/usr/local/openresty/nginx/logs/ - - /sys/fs/cgroup:/sys/fs/cgroup - ports: - - "8888:80" \ No newline at end of file diff --git a/lua/access_check.lua b/lua/access_check.lua index f28edbf..9a44801 100644 --- a/lua/access_check.lua +++ b/lua/access_check.lua @@ -8,7 +8,7 @@ limit_req.incoming() --限速,限制每秒请求数 -- 获取访问URI local url_path_list = tools.split(ngx.var.request_uri, '/') -local svc_code = url_path_list[2] -- 去第二位 +local svc_code = url_path_list[2] -- 取第二位 -- table.remove(url_path_list,1) local real_new_uri = tools.list_to_str(url_path_list,'/') diff --git a/lua/configs.lua b/lua/configs.lua index b858e24..e8950f5 100644 --- a/lua/configs.lua +++ b/lua/configs.lua @@ -1,7 +1,7 @@ json = require("cjson") --mysql_config = { --- host = "127.0.0.1", +-- host = "codo-mysql;", -- port = 3306, -- database = "lua", -- user = "root", @@ -9,29 +9,31 @@ json = require("cjson") -- max_packet_size = 1024 * 1024 --} +-- redis配置，一定要修改,并且和codo-admin保持一致 redis_config = { - host = '172.16.0.223', - --host = '172.16.0.121', + host = 'codo-redis', port = 6379, - auth_pwd = '123456', + auth_pwd = 'cWCVKJ7ZHUK12mVbivUf', db = 8, alive_time = 3600 * 24 * 7, channel = 'gw' } --mq_conf = { --- host = '172.16.0.121', +-- host = 'codo-mq', -- port = 5672, -- username = 'sz', -- password = '123456', -- vhost = '/' --} -token_secret = "pXFb4i%*834gfdh96(3df&%18iodGq4ODQyMzc4lz7yI6ImF1dG" -logs_file = '/var/log/gw.log' +-- 注意：这里的token_secret必须要和codo-admin里面的token_secret保持一致 +token_secret = "pXFb4i%*834gfdh963df718iodGq4dsafsdadg7yI6ImF1999aaG7" +logs_file = '/usr/local/openresty/nginx/logs/gateway-lua.log' --刷新权限到redis接口 -rewrite_cache_url = 'http://mg.opendevops.cn:8010/v2/accounts/verify/' +rewrite_cache_url = 'http://codo-admin/v2/accounts/verify/' +-- 注意：rewrite_cache_token要和codo-admin里面的secret_key = '8b888a62-3edb-4920-b446-697a472b4001'保持一致 rewrite_cache_token = '8b888a62-3edb-4920-b446-697a472b4001' --并发限流配置 @@ -40,51 +42,52 @@ limit_conf = { burst = 10, --桶容量,用于平滑处理,最大接收请求次数 } ---upstream匹配规则 -gw_domain_name = 'gw.opendevops.cn' +--upstream匹配规则,API网关域名 +gw_domain_name = 'codo-gateway' +--下面的转发一定要修改，根据自己实际数据修改 rewrite_conf = { [gw_domain_name] = { rewrite_urls = { { uri = "/dns", - rewrite_upstream = "dns.opendevops.cn:8060" + rewrite_upstream = "codo-dns" }, { uri = "/cmdb2", - rewrite_upstream = "cmdb2.opendevops.cn:8050" + rewrite_upstream = "codo-cmdb" }, { uri = "/tools", - rewrite_upstream = "tools.opendevops.cn:8040" + rewrite_upstream = "codo-tools" }, { uri = "/kerrigan", - rewrite_upstream = "kerrigan.opendevops.cn:8030" + rewrite_upstream = "codo-kerrigan" }, { uri = "/cmdb", - rewrite_upstream = "cmdb.opendevops.cn:8002" + rewrite_upstream = "codo-cmdb" }, { uri = "/k8s", - rewrite_upstream = "k8s.opendevops.cn:8001" + rewrite_upstream = "codo-k8s" }, { uri = "/task", - rewrite_upstream = "task.opendevops.cn:8020" + rewrite_upstream = "codo-task" }, { uri = "/cron", - rewrite_upstream = "cron.opendevops.cn:9900" + rewrite_upstream = "codo-cron" }, { uri = "/mg", - rewrite_upstream = "mg.opendevops.cn:8010" + rewrite_upstream = "codo-admin" }, { uri = "/accounts", - rewrite_upstream = "mg.opendevops.cn:8010" + rewrite_upstream = "codo-admin" }, } } diff --git a/prestart.sh b/prestart.sh new file mode 100644 index 0000000..ee434c1 --- /dev/null +++ b/prestart.sh @@ -0,0 +1,105 @@ +#!/bin/bash +sleep 10 + +echo "备份/usr/local/openresty/nginx/lua/configs.lua完成" +mv /usr/local/openresty/nginx/lua/configs.lua /usr/local/openresty/nginx/lua/configs.lua.bak + + +echo "注意,下面将开始生成网关中lua的配置文件!!!!!!" + +cat > /usr/local/openresty/nginx/lua/configs.lua << EOF +json = require("cjson") + +--mysql_config = { +-- host = "${DEFAULT_DB_DBHOST}", +-- port = "${DEFAULT_DB_DBPORT}", +-- database = "lua", +-- user = "${DEFAULT_DB_DBUSER}", +-- password = "${DEFAULT_DB_DBPWD}", +-- max_packet_size = 1024 * 1024 +--} + +-- redis配置，一定要修改,并且和codo-admin保持一致 +redis_config = { + host = '${DEFAULT_REDIS_HOST}', + port = '${DEFAULT_REDIS_PORT}', + auth_pwd = '${DEFAULT_REDIS_PASSWORD}', + db = 8, + alive_time = 3600 * 24 * 7, + channel = 'gw' +} + + +-- 注意：这里的token_secret必须要和codo-admin里面的token_secret保持一致 +token_secret = '${token_secret}' +logs_file = '/usr/local/openresty/nginx/logs/gateway-lua.log' + +--刷新权限到redis接口 +rewrite_cache_url = 'http://${mg_domain}/v2/accounts/verify/' +-- 注意：rewrite_cache_token要和codo-admin里面的secret_key保持一致 +rewrite_cache_token = '${secret_key}' + + +--并发限流配置 +limit_conf = { + rate = 10, --限制ip每分钟只能调用n*60次接口 + burst = 10, --桶容量,用于平滑处理,最大接收请求次数 +} + +--upstream匹配规则,API网关域名 +gw_domain_name = '"${api_gw_url}"' + +--下面的转发一定要修改，根据自己实际数据修改 +rewrite_conf = { + [gw_domain_name] = { + rewrite_urls = { + { + uri = "/dns", + rewrite_upstream = "${dns_domain}" + }, + { + uri = "/cmdb2", + rewrite_upstream = "${cmdb_domain}" + }, + { + uri = "/tools", + rewrite_upstream = "${tools_domain}" + }, + { + uri = "/kerrigan", + rewrite_upstream = "${kerrigan_domain}" + }, + { + uri = "/cmdb", + rewrite_upstream = "${cmdb_domain}" + }, + { + uri = "/k8s", + rewrite_upstream = "${k8s_domain}" + }, + { + uri = "/task", + rewrite_upstream = "${task_domain}" + }, + { + uri = "/cron", + rewrite_upstream = "${cron_domain}" + }, + { + uri = "/mg", + rewrite_upstream = "${mg_domain}" + }, + { + uri = "/accounts", + rewrite_upstream = "${mg_domain}" + }, + } + } +} +EOF + +echo "请取人lua配置文件是否正确" +cat /usr/local/openresty/nginx/lua/configs.lua + +echo "为了避免lua配置的是不能热加载配置文件,这里手动停止nginx,后面nginx的启动将会由supervisor服务来负责启动" +/usr/local/openresty/nginx/sbin/nginx -s stop \ No newline at end of file diff --git a/supervisor_ops.conf b/supervisor_ops.conf new file mode 100644 index 0000000..5d4eca1 --- /dev/null +++ b/supervisor_ops.conf @@ -0,0 +1,24 @@ +[supervisord] +nodaemon=true + + +[group:do_gateway,] +programs=gateway-prestart,openresty + +[program:gateway-prestart] +command=sh prestart.sh +directory=/usr/local/openresty/nginx/ +user=root +autostart = true +autorestart=false +redirect_stderr=true +stdout_logfile=/var/log/supervisor/codo-gateway-prestart.log +loglevel=info +logfile_maxbytes=10MB +logfile_backups=1 + + +[program:openresty] +command=/usr/bin/openresty -g "daemon off;" +autostart=true +autorestart=true \ No newline at end of file