feat(infra): 添加 Gitea、Nexus 和 Woodpecker CI/CD 服务部署配置
- 配置 Gitea 代码托管服务，映射端口 3000 和 2222 - 部署 Nexus 私有仓库服务，占用端口 8081-8083 - 集成 Woodpecker CI/CD 服务，配置 Gitea 集成和特权插件支持 - 设置 Nginx 反向代理，为 push.lovestory.cyou 和 registry.lovestory.cyou 提供 HTTPS 支持 - 配置 WebSocket 支持和大文件上传优化参数 - 添加 Gzip 压缩和连接超时优化设置
This commit is contained in:
parent
08dd85c387
commit
266bdd325c
|
|
@ -0,0 +1,20 @@
|
|||
#docker-compose.yml
|
||||
services:
|
||||
gitea:
|
||||
image: gitea/gitea:1.21.7
|
||||
container_name: gitea
|
||||
restart: always
|
||||
environment:
|
||||
- USER_UID=1000
|
||||
- USER_GID=1000
|
||||
- GITEA__server__DOMAIN=gitea.lovestory.cyou
|
||||
- GITEA__server__SSH_DOMAIN=gitea.lovestory.cyou
|
||||
- GITEA__server__ROOT_URL=http://gitea.lovestory.cyou/
|
||||
volumes:
|
||||
# 所有代码、用户数据、自带的 SQLite 数据库文件，全都会存在本地的 ./gitea-data 文件夹里
|
||||
- ./gitea-data:/data
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
ports:
|
||||
- "3000:3000" # 网页访问端口
|
||||
- "2222:22" # SSH 克隆代码端口
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
services:
|
||||
nexus:
|
||||
image: sonatype/nexus3:latest
|
||||
container_name: nexus
|
||||
restart: always
|
||||
ports:
|
||||
- "8081:8081"
|
||||
- "8082:8082"
|
||||
- "8083:8083"
|
||||
volumes:
|
||||
- ./nexus-data:/nexus-data
|
||||
environment:
|
||||
# Nexus 默认比较吃内存，如果服务器配置有限，建议限制其 JVM 内存，1G~2G 即可
|
||||
- INSTALL4J_ADD_VM_PARAMS=-Xms1g -Xmx1g -XX:MaxDirectMemorySize=1g
|
||||
|
|
@ -0,0 +1,47 @@
|
|||
services:
|
||||
woodpecker-server:
|
||||
image: woodpeckerci/woodpecker-server:v3
|
||||
ports:
|
||||
- 8000:8000
|
||||
volumes:
|
||||
- woodpecker-server-data:/var/lib/woodpecker/
|
||||
restart: always
|
||||
environment:
|
||||
- WOODPECKER_OPEN=true
|
||||
- WOODPECKER_HOST=https://lovestory.cyou
|
||||
# 👇 加上这行，把 abhors 换成你真正的 GitHub 用户名（注意大小写敏感）
|
||||
- WOODPECKER_ADMIN=abhors
|
||||
- WOODPECKER_AGENT_SECRET=2f26c6a0e97e00c65a9e89fc39a95be532c19cb600c53fa555eada297c3569cb
|
||||
# - WOODPECKER_GITHUB=true
|
||||
# - WOODPECKER_GITHUB_CLIENT=Ov23liStAMZlR7jk5kiT
|
||||
# - WOODPECKER_GITHUB_SECRET=2157f7be71f2a6c91d6a859c622a29b1e1af3951
|
||||
|
||||
- WOODPECKER_GITEA=true
|
||||
- WOODPECKER_GITEA_URL=http://gitea.lovestory.cyou
|
||||
- WOODPECKER_GITEA_CLIENT=718dc249-2edc-4edd-8bc9-06ba569c2007
|
||||
- WOODPECKER_GITEA_SECRET=gto_zovinkqbrekitnhoiez5376dhzkccvz7253ndyaxqjq2gcb2okdq
|
||||
|
||||
|
||||
# 👇 关键：特权插件白名单环境变量必须配置在 Agent 端，而不是 Server 端
|
||||
- WOODPECKER_PLUGINS_PRIVILEGED=*,plugins/docker,docker.io/plugins/docker,plugins/docker:latest,docker.m.daocloud.io/appleboy/drone-docker-compose
|
||||
|
||||
|
||||
woodpecker-agent:
|
||||
image: woodpeckerci/woodpecker-agent:v3
|
||||
# v3 版本中，通常不需要显式写 command: agent，镜像默认就是 agent 运行
|
||||
restart: always
|
||||
privileged: true
|
||||
depends_on:
|
||||
- woodpecker-server
|
||||
volumes:
|
||||
- woodpecker-agent-config:/etc/woodpecker
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
environment:
|
||||
- WOODPECKER_SERVER=woodpecker-server:9000
|
||||
- WOODPECKER_AGENT_SECRET=2f26c6a0e97e00c65a9e89fc39a95be532c19cb600c53fa555eada297c3569cb
|
||||
# 👇 关键：特权插件白名单环境变量必须配置在 Agent 端，而不是 Server 端
|
||||
- WOODPECKER_PLUGINS_PRIVILEGED=*,plugins/docker,docker.io/plugins/docker,plugins/docker:latest
|
||||
|
||||
volumes:
|
||||
woodpecker-server-data:
|
||||
woodpecker-agent-config:
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
server {
|
||||
listen 80;
|
||||
server_name push.lovestory.cyou; # 👈 走纯 HTTP
|
||||
|
||||
client_max_body_size 0;
|
||||
|
||||
location / {
|
||||
proxy_pass http://10.2.0.14:8083; # 转发到 Nexus 宿主私有仓端口
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_set_header Authorization $http_authorization;
|
||||
proxy_pass_header Authorization;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
server {
|
||||
listen 80;
|
||||
server_name push.lovestory.cyou;
|
||||
|
||||
# 💡 顺手把所有的 80 纯 HTTP 流量全部强转到 443 HTTPS，彻底顺了 BuildKit 的心愿
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl; # 👈 开启正规的 SSL 监听，满足它的 HTTPS 强迫症
|
||||
server_name push.lovestory.cyou;
|
||||
|
||||
# 💡 挂载刚才生成的自签名证书
|
||||
ssl_certificate /etc/nginx/cert/push.lovestory.cyou.pem;
|
||||
ssl_certificate_key /etc/nginx/cert/push.lovestory.cyou.key;
|
||||
|
||||
# 优化配置，防止大镜像层上传超时或被拦截
|
||||
client_max_body_size 0;
|
||||
chunked_transfer_encoding on;
|
||||
|
||||
location / {
|
||||
# 💡 这里填写你 Nexus 服务的真实本地内网地址和端口（比如 8081）
|
||||
proxy_pass http://10.2.0.14:8083;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# 💡 极其重要：告诉后端的 Nexus，现在前端套了 HTTPS，让 Nexus 别乱报异常
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
server {
|
||||
listen 80;
|
||||
server_name registry.lovestory.cyou; # 👈 走纯 HTTP
|
||||
|
||||
# 🚨 极其重要：解除 Nginx 默认的 1M 上传限制
|
||||
client_max_body_size 0;
|
||||
|
||||
location / {
|
||||
proxy_pass http://10.2.0.14:8082; # 转发到 Nexus 组仓库端口
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme; # 自动适配当前协议
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
server {
|
||||
listen 443 ssl; # 👈 开启正规的 SSL 监听，满足它的 HTTPS 强迫症
|
||||
server_name registry.lovestory.cyou;
|
||||
|
||||
# 💡 挂载刚才生成的自签名证书
|
||||
ssl_certificate /etc/nginx/cert/registry.lovestory.cyou.pem;
|
||||
ssl_certificate_key /etc/nginx/cert/registry.lovestory.cyou.key;
|
||||
|
||||
# 优化配置，防止大镜像层上传超时或被拦截
|
||||
client_max_body_size 0;
|
||||
chunked_transfer_encoding on;
|
||||
|
||||
location / {
|
||||
# 💡 这里填写你 Nexus 服务的真实本地内网地址和端口（比如 8081）
|
||||
proxy_pass http://10.2.0.14:8082;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# 💡 极其重要：告诉后端的 Nexus，现在前端套了 HTTPS，让 Nexus 别乱报异常
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
worker_processes auto;
|
||||
|
||||
events {
|
||||
|
||||
# worker_connections 1024;
|
||||
worker_connections 20480;
|
||||
|
||||
}
|
||||
|
||||
http {
|
||||
include mime.types;
|
||||
default_type application/octet-stream;
|
||||
sendfile on;
|
||||
keepalive_timeout 65;
|
||||
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
# 建议改用绝对路径，防止容器找不到 logs 目录
|
||||
access_log /etc/nginx/logs/access.log main;
|
||||
|
||||
# 💡 关键：WebSocket 支持
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
server_names_hash_bucket_size 128;
|
||||
client_header_buffer_size 32k;
|
||||
large_client_header_buffers 4 32k;
|
||||
client_max_body_size 1024m;
|
||||
proxy_connect_timeout 60;
|
||||
proxy_read_timeout 300;
|
||||
proxy_send_timeout 300;
|
||||
|
||||
fastcgi_buffers 8 128k;
|
||||
send_timeout 300;
|
||||
client_header_timeout 300;
|
||||
client_body_timeout 300;
|
||||
reset_timedout_connection on;
|
||||
|
||||
# --- Gzip 配置开始 ---
|
||||
gzip on;
|
||||
gzip_min_length 1k;
|
||||
gzip_buffers 4 16k;
|
||||
gzip_http_version 1.1;
|
||||
gzip_comp_level 2;
|
||||
gzip_types text/plain application/x-javascript text/css application/xml image/png application/zip application/x-shockwave-flash application/javascript application/json;
|
||||
gzip_disable "MSIE [1-6]\.";
|
||||
gzip_vary on;
|
||||
# --- Gzip 配置结束 ---
|
||||
|
||||
# 引入子配置文件
|
||||
include /etc/nginx/conf/conf.d/*.conf;
|
||||
}
|
||||
Loading…
Reference in New Issue