From 266bdd325c14bb0be284bb82d2eea2f3ffbc88c6 Mon Sep 17 00:00:00 2001 From: gxl Date: Wed, 3 Jun 2026 20:47:18 +0800 Subject: [PATCH] =?UTF-8?q?feat(infra):=20=E6=B7=BB=E5=8A=A0=20Gitea?= =?UTF-8?q?=E3=80=81Nexus=20=E5=92=8C=20Woodpecker=20CI/CD=20=E6=9C=8D?= =?UTF-8?q?=E5=8A=A1=E9=83=A8=E7=BD=B2=E9=85=8D=E7=BD=AE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 配置 Gitea 代码托管服务，映射端口 3000 和 2222 - 部署 Nexus 私有仓库服务，占用端口 8081-8083 - 集成 Woodpecker CI/CD 服务，配置 Gitea 集成和特权插件支持 - 设置 Nginx 反向代理，为 push.lovestory.cyou 和 registry.lovestory.cyou 提供 HTTPS 支持 - 配置 WebSocket 支持和大文件上传优化参数 - 添加 Gzip 压缩和连接超时优化设置 --- dockercompose/gitea/docker-compose.yml | 20 +++++++ dockercompose/nexus/docker-compose.yml | 14 +++++ dockercompose/woodpecker/docker-compose.yml | 47 ++++++++++++++++ .../conf/conf.d/push.lovestory.cyou.conf-http | 17 ++++++ .../conf.d/push.lovestory.cyou.conf-https | 32 +++++++++++ .../conf/conf.d/registry.lovestory.cyou-http | 15 +++++ .../conf.d/registry.lovestory.cyou.conf-https | 24 ++++++++ nginx/conf/nginx.conf | 56 +++++++++++++++++++ 8 files changed, 225 insertions(+) create mode 100644 dockercompose/gitea/docker-compose.yml create mode 100644 dockercompose/nexus/docker-compose.yml create mode 100644 dockercompose/woodpecker/docker-compose.yml create mode 100644 nginx/conf/conf.d/push.lovestory.cyou.conf-http create mode 100644 nginx/conf/conf.d/push.lovestory.cyou.conf-https create mode 100644 nginx/conf/conf.d/registry.lovestory.cyou-http create mode 100644 nginx/conf/conf.d/registry.lovestory.cyou.conf-https create mode 100644 nginx/conf/nginx.conf diff --git a/dockercompose/gitea/docker-compose.yml b/dockercompose/gitea/docker-compose.yml new file mode 100644 index 0000000..350aefa --- /dev/null +++ b/dockercompose/gitea/docker-compose.yml @@ -0,0 +1,20 @@ +#docker-compose.yml +services: + gitea: + image: gitea/gitea:1.21.7 + container_name: gitea + restart: always + environment: + - USER_UID=1000 + - USER_GID=1000 + - GITEA__server__DOMAIN=gitea.lovestory.cyou + - GITEA__server__SSH_DOMAIN=gitea.lovestory.cyou + - GITEA__server__ROOT_URL=http://gitea.lovestory.cyou/ + volumes: + # 所有代码、用户数据、自带的 SQLite 数据库文件，全都会存在本地的 ./gitea-data 文件夹里 + - ./gitea-data:/data + - /etc/timezone:/etc/timezone:ro + - /etc/localtime:/etc/localtime:ro + ports: + - "3000:3000" # 网页访问端口 + - "2222:22" # SSH 克隆代码端口 \ No newline at end of file diff --git a/dockercompose/nexus/docker-compose.yml b/dockercompose/nexus/docker-compose.yml new file mode 100644 index 0000000..73baab7 --- /dev/null +++ b/dockercompose/nexus/docker-compose.yml @@ -0,0 +1,14 @@ +services: + nexus: + image: sonatype/nexus3:latest + container_name: nexus + restart: always + ports: + - "8081:8081" + - "8082:8082" + - "8083:8083" + volumes: + - ./nexus-data:/nexus-data + environment: + # Nexus 默认比较吃内存，如果服务器配置有限，建议限制其 JVM 内存，1G~2G 即可 + - INSTALL4J_ADD_VM_PARAMS=-Xms1g -Xmx1g -XX:MaxDirectMemorySize=1g \ No newline at end of file diff --git a/dockercompose/woodpecker/docker-compose.yml b/dockercompose/woodpecker/docker-compose.yml new file mode 100644 index 0000000..a1693a4 --- /dev/null +++ b/dockercompose/woodpecker/docker-compose.yml @@ -0,0 +1,47 @@ +services: + woodpecker-server: + image: woodpeckerci/woodpecker-server:v3 + ports: + - 8000:8000 + volumes: + - woodpecker-server-data:/var/lib/woodpecker/ + restart: always + environment: + - WOODPECKER_OPEN=true + - WOODPECKER_HOST=https://lovestory.cyou + # 👇 加上这行，把 abhors 换成你真正的 GitHub 用户名（注意大小写敏感） + - WOODPECKER_ADMIN=abhors + - WOODPECKER_AGENT_SECRET=2f26c6a0e97e00c65a9e89fc39a95be532c19cb600c53fa555eada297c3569cb + # - WOODPECKER_GITHUB=true + # - WOODPECKER_GITHUB_CLIENT=Ov23liStAMZlR7jk5kiT + # - WOODPECKER_GITHUB_SECRET=2157f7be71f2a6c91d6a859c622a29b1e1af3951 + + - WOODPECKER_GITEA=true + - WOODPECKER_GITEA_URL=http://gitea.lovestory.cyou + - WOODPECKER_GITEA_CLIENT=718dc249-2edc-4edd-8bc9-06ba569c2007 + - WOODPECKER_GITEA_SECRET=gto_zovinkqbrekitnhoiez5376dhzkccvz7253ndyaxqjq2gcb2okdq + + + # 👇 关键：特权插件白名单环境变量必须配置在 Agent 端，而不是 Server 端 + - WOODPECKER_PLUGINS_PRIVILEGED=*,plugins/docker,docker.io/plugins/docker,plugins/docker:latest,docker.m.daocloud.io/appleboy/drone-docker-compose + + + woodpecker-agent: + image: woodpeckerci/woodpecker-agent:v3 + # v3 版本中，通常不需要显式写 command: agent，镜像默认就是 agent 运行 + restart: always + privileged: true + depends_on: + - woodpecker-server + volumes: + - woodpecker-agent-config:/etc/woodpecker + - /var/run/docker.sock:/var/run/docker.sock + environment: + - WOODPECKER_SERVER=woodpecker-server:9000 + - WOODPECKER_AGENT_SECRET=2f26c6a0e97e00c65a9e89fc39a95be532c19cb600c53fa555eada297c3569cb + # 👇 关键：特权插件白名单环境变量必须配置在 Agent 端，而不是 Server 端 + - WOODPECKER_PLUGINS_PRIVILEGED=*,plugins/docker,docker.io/plugins/docker,plugins/docker:latest + +volumes: + woodpecker-server-data: + woodpecker-agent-config: \ No newline at end of file diff --git a/nginx/conf/conf.d/push.lovestory.cyou.conf-http b/nginx/conf/conf.d/push.lovestory.cyou.conf-http new file mode 100644 index 0000000..8f9fd64 --- /dev/null +++ b/nginx/conf/conf.d/push.lovestory.cyou.conf-http @@ -0,0 +1,17 @@ +server { + listen 80; + server_name push.lovestory.cyou; # 👈 走纯 HTTP + + client_max_body_size 0; + + location / { + proxy_pass http://10.2.0.14:8083; # 转发到 Nexus 宿主私有仓端口 + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_set_header Authorization $http_authorization; + proxy_pass_header Authorization; + } +} \ No newline at end of file diff --git a/nginx/conf/conf.d/push.lovestory.cyou.conf-https b/nginx/conf/conf.d/push.lovestory.cyou.conf-https new file mode 100644 index 0000000..7956317 --- /dev/null +++ b/nginx/conf/conf.d/push.lovestory.cyou.conf-https @@ -0,0 +1,32 @@ +server { + listen 80; + server_name push.lovestory.cyou; + + # 💡 顺手把所有的 80 纯 HTTP 流量全部强转到 443 HTTPS，彻底顺了 BuildKit 的心愿 + return 301 https://$host$request_uri; +} + +server { + listen 443 ssl; # 👈 开启正规的 SSL 监听，满足它的 HTTPS 强迫症 + server_name push.lovestory.cyou; + + # 💡 挂载刚才生成的自签名证书 + ssl_certificate /etc/nginx/cert/push.lovestory.cyou.pem; + ssl_certificate_key /etc/nginx/cert/push.lovestory.cyou.key; + + # 优化配置，防止大镜像层上传超时或被拦截 + client_max_body_size 0; + chunked_transfer_encoding on; + + location / { + # 💡 这里填写你 Nexus 服务的真实本地内网地址和端口（比如 8081） + proxy_pass http://10.2.0.14:8083; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # 💡 极其重要：告诉后端的 Nexus，现在前端套了 HTTPS，让 Nexus 别乱报异常 + proxy_set_header X-Forwarded-Proto https; + } +} \ No newline at end of file diff --git a/nginx/conf/conf.d/registry.lovestory.cyou-http b/nginx/conf/conf.d/registry.lovestory.cyou-http new file mode 100644 index 0000000..f925095 --- /dev/null +++ b/nginx/conf/conf.d/registry.lovestory.cyou-http @@ -0,0 +1,15 @@ +server { + listen 80; + server_name registry.lovestory.cyou; # 👈 走纯 HTTP + + # 🚨 极其重要：解除 Nginx 默认的 1M 上传限制 + client_max_body_size 0; + + location / { + proxy_pass http://10.2.0.14:8082; # 转发到 Nexus 组仓库端口 + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; # 自动适配当前协议 + } +} \ No newline at end of file diff --git a/nginx/conf/conf.d/registry.lovestory.cyou.conf-https b/nginx/conf/conf.d/registry.lovestory.cyou.conf-https new file mode 100644 index 0000000..539e3bd --- /dev/null +++ b/nginx/conf/conf.d/registry.lovestory.cyou.conf-https @@ -0,0 +1,24 @@ +server { + listen 443 ssl; # 👈 开启正规的 SSL 监听，满足它的 HTTPS 强迫症 + server_name registry.lovestory.cyou; + + # 💡 挂载刚才生成的自签名证书 + ssl_certificate /etc/nginx/cert/registry.lovestory.cyou.pem; + ssl_certificate_key /etc/nginx/cert/registry.lovestory.cyou.key; + + # 优化配置，防止大镜像层上传超时或被拦截 + client_max_body_size 0; + chunked_transfer_encoding on; + + location / { + # 💡 这里填写你 Nexus 服务的真实本地内网地址和端口（比如 8081） + proxy_pass http://10.2.0.14:8082; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # 💡 极其重要：告诉后端的 Nexus，现在前端套了 HTTPS，让 Nexus 别乱报异常 + proxy_set_header X-Forwarded-Proto https; + } +} \ No newline at end of file diff --git a/nginx/conf/nginx.conf b/nginx/conf/nginx.conf new file mode 100644 index 0000000..98c4c38 --- /dev/null +++ b/nginx/conf/nginx.conf @@ -0,0 +1,56 @@ +worker_processes auto; + +events { + + # worker_connections 1024; + worker_connections 20480; + +} + +http { + include mime.types; + default_type application/octet-stream; + sendfile on; + keepalive_timeout 65; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + # 建议改用绝对路径，防止容器找不到 logs 目录 + access_log /etc/nginx/logs/access.log main; + + # 💡 关键：WebSocket 支持 + map $http_upgrade $connection_upgrade { + default upgrade; + '' close; + } + + server_names_hash_bucket_size 128; + client_header_buffer_size 32k; + large_client_header_buffers 4 32k; + client_max_body_size 1024m; + proxy_connect_timeout 60; + proxy_read_timeout 300; + proxy_send_timeout 300; + + fastcgi_buffers 8 128k; + send_timeout 300; + client_header_timeout 300; + client_body_timeout 300; + reset_timedout_connection on; + + # --- Gzip 配置开始 --- + gzip on; + gzip_min_length 1k; + gzip_buffers 4 16k; + gzip_http_version 1.1; + gzip_comp_level 2; + gzip_types text/plain application/x-javascript text/css application/xml image/png application/zip application/x-shockwave-flash application/javascript application/json; + gzip_disable "MSIE [1-6]\."; + gzip_vary on; + # --- Gzip 配置结束 --- + + # 引入子配置文件 + include /etc/nginx/conf/conf.d/*.conf; +} \ No newline at end of file