Compare commits
10 Commits
e851b54296
...
8af1a70535
| Author | SHA1 | Date |
|---|---|---|
 gxl
|
8af1a70535 | |
|
gxl
|
41ea20c7d7 | |
|
gxl
|
9da42bbb2b | |
|
gxl
|
8a610320c4 | |
|
gxl
|
e446d1c692 | |
|
gxl
|
266bdd325c | |
|
gxl
|
08dd85c387 | |
|
gxl
|
322266d8bc | |
|
gxl
|
ab4c54278c | |
|
gxl
|
a5689c49d0 |
|
|
@ -1,9 +1,14 @@
|
|||
# 第 89 次部署
|
||||
# 💡 全局变量块
|
||||
# 第 95 次部署
|
||||
variables:
|
||||
- &APP_REGISTRY "push.lovestory.cyou"
|
||||
- &APP_PULL_REGISTRY "registry.lovestory.cyou"
|
||||
- &PROJECT_NAME "abhors/demo"
|
||||
# --- 仓库与私服配置 ---
|
||||
- &APP_REGISTRY "push.lovestory.cyou" # 推送镜像的私服域名
|
||||
- &APP_PULL_REGISTRY "registry.lovestory.cyou" # 拉取基础镜像的私服域名
|
||||
- &PROJECT_NAME "abhors/demo" # 项目镜像路径与名称
|
||||
- &PROJECT_PORT "8080" # 运行及映射端口
|
||||
- &FULL_PUSH_REPO "push.lovestory.cyou/abhors/demo" # 拼接后的完整推送地址
|
||||
- &FULL_PULL_REPO "push.lovestory.cyou/abhors/demo:latest" # 远程部署拉取的目标地址
|
||||
|
||||
# --- 部署目标机配置 ---
|
||||
- &CONTAINER_NAME "demo-container"
|
||||
- &DEPLOY_HOST "43.143.243.136"
|
||||
- &DEPLOY_PORT "22"
|
||||
|
|
@ -23,34 +28,34 @@ steps:
|
|||
branch: master
|
||||
|
||||
- name: 官方标准构建与推送 (宿主机物理硬缓存版)
|
||||
image: woodpeckerci/plugin-docker-buildx:latest-insecure
|
||||
image: docker.m.daocloud.io/woodpeckerci/plugin-docker-buildx:latest-insecure
|
||||
privileged: true
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
privileged: true
|
||||
settings:
|
||||
insecure: true
|
||||
repo: push.lovestory.cyou/abhors/demo
|
||||
registry: push.lovestory.cyou
|
||||
repo: *FULL_PUSH_REPO
|
||||
registry: *APP_REGISTRY
|
||||
username:
|
||||
from_secret: nexus_docker_username
|
||||
password:
|
||||
from_secret: nexus_docker_password
|
||||
mirror: http://registry.lovestory.cyou
|
||||
buildkit_config: |
|
||||
[registry."docker.io"]
|
||||
mirrors = ["docker.1ms.run", "dockerpull.org", "1ms.run"]
|
||||
[registry."push.lovestory.cyou"]
|
||||
http = true
|
||||
insecure = true
|
||||
[registry."registry.lovestory.cyou"]
|
||||
http = true
|
||||
insecure = true
|
||||
mirror: https://registry.lovestory.cyou
|
||||
when:
|
||||
event: push
|
||||
branch: master
|
||||
|
||||
- name: 远程终端部署
|
||||
image: push.lovestory.cyou/appleboy/drone-ssh:latest
|
||||
image: registry.lovestory.cyou/appleboy/drone-ssh:latest
|
||||
|
||||
# 💡 遵循官方文档指引 Step 1：必须在最外层写 environment 块，且必须全部大写！
|
||||
# 把我们顶部的 YAML 锚点变量，在这里全部转化为系统大写环境变量
|
||||
environment:
|
||||
REMOTE_HOST: *DEPLOY_HOST
|
||||
CONTAINER_NAME: *CONTAINER_NAME
|
||||
FULL_PULL_REPO: *FULL_PULL_REPO
|
||||
APP_REGISTRY: *APP_REGISTRY
|
||||
PROJECT_PORT: *PROJECT_PORT
|
||||
|
||||
settings:
|
||||
host: *DEPLOY_HOST
|
||||
port: *DEPLOY_PORT
|
||||
|
|
@ -58,17 +63,31 @@ steps:
|
|||
from_secret: *DEPLOY_USER_SECRET
|
||||
password:
|
||||
from_secret: *DEPLOY_PASS_SECRET
|
||||
secrets: [ nexus_docker_username, nexus_docker_password ]
|
||||
envs: [ nexus_docker_username, nexus_docker_password ]
|
||||
secrets: [ nexus_docker_username, nexus_docker_password ] # 这俩属于私密Secret，直接进通道
|
||||
|
||||
# 💡 遵循官方文档指引 Step 2：在 envs 里声明上面这些变量的名字（不区分大小写，插件会自动大写）
|
||||
# 这样插件就会把这些变量强行同步到远程主机的 SSH 终端进程里
|
||||
envs:
|
||||
- remote_host
|
||||
- container_name
|
||||
- full_pull_repo
|
||||
- app_registry
|
||||
- project_port
|
||||
- nexus_docker_username
|
||||
- nexus_docker_password
|
||||
|
||||
# 💡 遵循官方文档指引 Step 3：在脚本里统一改用标准的 $大写 符号来吃环境变量
|
||||
script:
|
||||
- echo "========================================="
|
||||
- echo "🚀 开始部署节点：*DEPLOY_HOST"
|
||||
- echo "🚀 开始部署节点：$REMOTE_HOST" # 👈 严格按文档走，100% 能打印出 IP
|
||||
- echo "========================================="
|
||||
- docker login --username "$nexus_docker_username" --password "$nexus_docker_password" "push.lovestory.cyou"
|
||||
- docker stop "demo-container" || true
|
||||
- docker rm "demo-container" || true
|
||||
- docker pull "push.lovestory.cyou/abhors/demo:latest"
|
||||
- docker run -d --name "demo-container" -p 8080:8080 --restart always "push.lovestory.cyou/abhors/demo:latest"
|
||||
|
||||
# 所有的参数均在远程机器通过系统大写变量精准传参
|
||||
- docker login --username "$nexus_docker_username" --password "$nexus_docker_password" "$APP_REGISTRY"
|
||||
- docker stop "$CONTAINER_NAME" || true
|
||||
- docker rm "$CONTAINER_NAME" || true
|
||||
- docker pull "$FULL_PULL_REPO"
|
||||
- docker run -d --name "$CONTAINER_NAME" -p "$PROJECT_PORT":"$PROJECT_PORT" --restart always "$FULL_PULL_REPO"
|
||||
when:
|
||||
event: push
|
||||
branch: master
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
#docker-compose.yml
|
||||
services:
|
||||
gitea:
|
||||
image: gitea/gitea:1.21.7
|
||||
container_name: gitea
|
||||
restart: always
|
||||
environment:
|
||||
- USER_UID=1000
|
||||
- USER_GID=1000
|
||||
- GITEA__server__DOMAIN=gitea.lovestory.cyou
|
||||
- GITEA__server__SSH_DOMAIN=gitea.lovestory.cyou
|
||||
- GITEA__server__ROOT_URL=http://gitea.lovestory.cyou/
|
||||
volumes:
|
||||
# 所有代码、用户数据、自带的 SQLite 数据库文件，全都会存在本地的 ./gitea-data 文件夹里
|
||||
- ./gitea-data:/data
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
ports:
|
||||
- "3000:3000" # 网页访问端口
|
||||
- "2222:22" # SSH 克隆代码端口
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
#!/bin/bash
|
||||
# 启动nexus需要先给目录权限否则启动不了
|
||||
mkdir nexus-data
|
||||
chown -R 200:200 nexus-data
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
services:
|
||||
nexus:
|
||||
image: sonatype/nexus3:latest
|
||||
container_name: nexus
|
||||
restart: always
|
||||
ports:
|
||||
- "8081:8081"
|
||||
- "8082:8082"
|
||||
- "8083:8083"
|
||||
volumes:
|
||||
- ./nexus-data:/nexus-data
|
||||
environment:
|
||||
# Nexus 默认比较吃内存，如果服务器配置有限，建议限制其 JVM 内存，1G~2G 即可
|
||||
- INSTALL4J_ADD_VM_PARAMS=-Xms1g -Xmx1g -XX:MaxDirectMemorySize=1g
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
services:
|
||||
nginx:
|
||||
image: nginx:latest
|
||||
container_name: nginx
|
||||
restart: always
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
volumes:
|
||||
# 完全按照你的原版物理路径映射
|
||||
- /opt/docker/nginx/logs:/etc/nginx/logs
|
||||
- /opt/docker/nginx/html:/etc/nginx/html
|
||||
- /opt/docker/nginx/cert:/etc/nginx/cert
|
||||
- /opt/docker/nginx/conf:/etc/nginx/conf
|
||||
|
||||
# 核心主配置文件（确保执行过刚才的拷贝，宿主机上有这个文件）
|
||||
- /opt/docker/nginx/conf/nginx.conf:/etc/nginx/nginx.conf
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
services:
|
||||
woodpecker-server:
|
||||
image: woodpeckerci/woodpecker-server:v3
|
||||
ports:
|
||||
- 8000:8000
|
||||
volumes:
|
||||
- woodpecker-server-data:/var/lib/woodpecker/
|
||||
restart: always
|
||||
environment:
|
||||
- WOODPECKER_OPEN=true
|
||||
- WOODPECKER_HOST=https://lovestory.cyou
|
||||
# 👇 加上这行，把 abhors 换成你真正的 GitHub 用户名（注意大小写敏感）
|
||||
- WOODPECKER_ADMIN=abhors
|
||||
- WOODPECKER_AGENT_SECRET=2f26c6a0e97e00c65a9e89fc39a95be532c19cb600c53fa555eada297c3569cb
|
||||
# - WOODPECKER_GITHUB=true
|
||||
# - WOODPECKER_GITHUB_CLIENT=Ov23liStAMZlR7jk5kiT
|
||||
# - WOODPECKER_GITHUB_SECRET=2157f7be71f2a6c91d6a859c622a29b1e1af3951
|
||||
|
||||
- WOODPECKER_GITEA=true
|
||||
- WOODPECKER_GITEA_URL=https://gitea.lovestory.cyou
|
||||
- WOODPECKER_GITEA_CLIENT=718dc249-2edc-4edd-8bc9-06ba569c2007
|
||||
- WOODPECKER_GITEA_SECRET=gto_zovinkqbrekitnhoiez5376dhzkccvz7253ndyaxqjq2gcb2okdq
|
||||
|
||||
woodpecker-agent:
|
||||
image: woodpeckerci/woodpecker-agent:v3
|
||||
# v3 版本中，通常不需要显式写 command: agent，镜像默认就是 agent 运行
|
||||
restart: always
|
||||
privileged: true
|
||||
depends_on:
|
||||
- woodpecker-server
|
||||
volumes:
|
||||
- woodpecker-agent-config:/etc/woodpecker
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
environment:
|
||||
- WOODPECKER_SERVER=woodpecker-server:9000
|
||||
- WOODPECKER_AGENT_SECRET=2f26c6a0e97e00c65a9e89fc39a95be532c19cb600c53fa555eada297c3569cb
|
||||
# 👇 关键：特权插件白名单环境变量必须配置在 Agent 端，而不是 Server 端
|
||||
- WOODPECKER_PLUGINS_PRIVILEGED=*,plugins/docker,docker.io/plugins/docker,plugins/docker:latest
|
||||
|
||||
volumes:
|
||||
woodpecker-server-data:
|
||||
woodpecker-agent-config:
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
server {
|
||||
listen 443 ssl;
|
||||
server_name gitea.lovestory.cyou;
|
||||
|
||||
ssl_certificate /etc/nginx/cert/gitea.lovestory.cyou.pem;
|
||||
ssl_certificate_key /etc/nginx/cert/gitea.lovestory.cyou.key;
|
||||
|
||||
client_max_body_size 0;
|
||||
chunked_transfer_encoding on;
|
||||
|
||||
location / {
|
||||
proxy_pass http://172.29.114.102:3000;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header REMOTE-HOST $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
server {
|
||||
listen 80;
|
||||
server_name push.lovestory.cyou; # 👈 走纯 HTTP
|
||||
|
||||
client_max_body_size 0;
|
||||
|
||||
location / {
|
||||
proxy_pass http://10.2.0.14:8083; # 转发到 Nexus 宿主私有仓端口
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_set_header Authorization $http_authorization;
|
||||
proxy_pass_header Authorization;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
server {
|
||||
listen 80;
|
||||
server_name push.lovestory.cyou;
|
||||
|
||||
# 💡 顺手把所有的 80 纯 HTTP 流量全部强转到 443 HTTPS，彻底顺了 BuildKit 的心愿
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl; # 👈 开启正规的 SSL 监听，满足它的 HTTPS 强迫症
|
||||
server_name push.lovestory.cyou;
|
||||
|
||||
# 💡 挂载刚才生成的自签名证书
|
||||
ssl_certificate /etc/nginx/cert/push.lovestory.cyou.pem;
|
||||
ssl_certificate_key /etc/nginx/cert/push.lovestory.cyou.key;
|
||||
|
||||
# 优化配置，防止大镜像层上传超时或被拦截
|
||||
client_max_body_size 0;
|
||||
chunked_transfer_encoding on;
|
||||
|
||||
location / {
|
||||
# 💡 这里填写你 Nexus 服务的真实本地内网地址和端口（比如 8081）
|
||||
proxy_pass http://10.2.0.14:8083;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# 💡 极其重要：告诉后端的 Nexus，现在前端套了 HTTPS，让 Nexus 别乱报异常
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
server {
|
||||
listen 80;
|
||||
server_name registry.lovestory.cyou; # 👈 走纯 HTTP
|
||||
|
||||
# 🚨 极其重要：解除 Nginx 默认的 1M 上传限制
|
||||
client_max_body_size 0;
|
||||
|
||||
location / {
|
||||
proxy_pass http://10.2.0.14:8082; # 转发到 Nexus 组仓库端口
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme; # 自动适配当前协议
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
server {
|
||||
listen 443 ssl; # 👈 开启正规的 SSL 监听，满足它的 HTTPS 强迫症
|
||||
server_name registry.lovestory.cyou;
|
||||
|
||||
# 💡 挂载刚才生成的自签名证书
|
||||
ssl_certificate /etc/nginx/cert/registry.lovestory.cyou.pem;
|
||||
ssl_certificate_key /etc/nginx/cert/registry.lovestory.cyou.key;
|
||||
|
||||
# 优化配置，防止大镜像层上传超时或被拦截
|
||||
client_max_body_size 0;
|
||||
chunked_transfer_encoding on;
|
||||
|
||||
location / {
|
||||
# 💡 这里填写你 Nexus 服务的真实本地内网地址和端口（比如 8081）
|
||||
proxy_pass http://10.2.0.14:8082;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# 💡 极其重要：告诉后端的 Nexus，现在前端套了 HTTPS，让 Nexus 别乱报异常
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
server {
|
||||
listen 443 ssl;
|
||||
server_name woodpecker.lovestory.cyou;
|
||||
|
||||
ssl_certificate /etc/nginx/cert/woodpecker.lovestory.cyou.pem;
|
||||
ssl_certificate_key /etc/nginx/cert/woodpecker.lovestory.cyou.key;
|
||||
|
||||
client_max_body_size 0;
|
||||
chunked_transfer_encoding on;
|
||||
|
||||
location / {
|
||||
proxy_pass http://172.29.114.102:8000;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header REMOTE-HOST $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
worker_processes auto;
|
||||
|
||||
events {
|
||||
|
||||
# worker_connections 1024;
|
||||
worker_connections 20480;
|
||||
|
||||
}
|
||||
|
||||
http {
|
||||
include mime.types;
|
||||
default_type application/octet-stream;
|
||||
sendfile on;
|
||||
keepalive_timeout 65;
|
||||
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
# 建议改用绝对路径，防止容器找不到 logs 目录
|
||||
access_log /etc/nginx/logs/access.log main;
|
||||
|
||||
# 💡 关键：WebSocket 支持
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
server_names_hash_bucket_size 128;
|
||||
client_header_buffer_size 32k;
|
||||
large_client_header_buffers 4 32k;
|
||||
client_max_body_size 1024m;
|
||||
proxy_connect_timeout 60;
|
||||
proxy_read_timeout 300;
|
||||
proxy_send_timeout 300;
|
||||
|
||||
fastcgi_buffers 8 128k;
|
||||
send_timeout 300;
|
||||
client_header_timeout 300;
|
||||
client_body_timeout 300;
|
||||
reset_timedout_connection on;
|
||||
|
||||
# --- Gzip 配置开始 ---
|
||||
gzip on;
|
||||
gzip_min_length 1k;
|
||||
gzip_buffers 4 16k;
|
||||
gzip_http_version 1.1;
|
||||
gzip_comp_level 2;
|
||||
gzip_types text/plain application/x-javascript text/css application/xml image/png application/zip application/x-shockwave-flash application/javascript application/json;
|
||||
gzip_disable "MSIE [1-6]\.";
|
||||
gzip_vary on;
|
||||
# --- Gzip 配置结束 ---
|
||||
|
||||
# 引入子配置文件
|
||||
include /etc/nginx/conf/conf.d/*.conf;
|
||||
}
|
||||
Loading…
Reference in New Issue