comsince / comsince_blog_comment

comsince_blog_comment
0 stars 0 forks source link

即时聊天系统在Centos上单机部署实践 — comsince #55

Open comsince opened 4 years ago

comsince commented 4 years ago

https://www.comsince.cn/2020/04/13/universe-push-start-on-centos/

本文主要说明基于universe-push在centos单机上的部署流程,如果大家购买相关mysql服务,可以选择部署相关服务

comsince commented 4 years ago

目前vue-web验证码资源已经耗尽,请使用13800000000~13800000002 使用验证码556677登录演示帐号

comsince commented 4 years ago
comsince commented 4 years ago

注意centos 部署,需要调整jvm 参数

-Xmx300m
-Xms300m
-Xmn100m
-XX:SurvivorRatio=8
comsince commented 4 years ago

关于minio 使用nginx 反向代码支持https.配置如下

 location ~* /minio-bucket* {
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
              proxy_set_header Host $http_host;

              proxy_connect_timeout 300;
              # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
              proxy_http_version 1.1;
              proxy_set_header Connection "";
              chunked_transfer_encoding off;
              proxy_pass  http://localhost:9000;
            }
# 这里主要是为了支持PUT操作,安全验证,不然会报403权限错误
comsince commented 4 years ago

注意minio使用nginx代理后,注意设置上传大小,不然有可能会上传失败

location ~* /minio-bucket* {
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
              proxy_set_header Host $http_host;  
             #设置消息体大小,防止上传失败
              client_max_body_size  500m;
              proxy_connect_timeout 300;
              # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
              proxy_http_version 1.1;
              proxy_set_header Connection "";
              chunked_transfer_encoding off;
              proxy_pass  http://localhost:9000;
            }
comsince commented 4 years ago

扫描所有的证书文件,校验是否续期

$ certbot-auto renew 

扫描证书名是 www4.example.com 下的所有证书文件,校验是否续期

$ certbot-auto renew --cert-name www4.example.com 

校验某个证书是否续期

$ certbot-auto renew --cert-path /etc/letsencrypt/archive/www4.example.com/cert1.pem
$ certbot renew --post-hook "service nginx restart"
comsince commented 4 years ago

通配符域名证书续期

 certbot certonly  -d *.comsince.cn --manual --preferred-challenges dns --dry-run  --manual-auth-hook "/data/certbot/certbot-letencrypt-wildcardcertificates-alydns-au/au.sh python aly add" --manual-cleanup-hook "/data/certbot/certbot-letencrypt-wildcardcertificates-alydns-au/au.sh python aly clean"

结果如下

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for comsince.cn

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - The dry run was successful.
certbot renew --cert-name comsince.cn  --manual-auth-hook "/data/certbot/certbot-letencrypt-wildcardcertificates-alydns-au/au.sh python aly add" --manual-cleanup-hook "/data/certbot/certbot-letencrypt-wildcardcertificates-alydns-au/au.sh python aly clean"

结果如下

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/comsince.cn.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator manual, Installer None
Renewing an existing certificate
Performing the following challenges:
dns-01 challenge for comsince.cn
Waiting for verification...
Cleaning up challenges

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/comsince.cn/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Congratulations, all renewals succeeded. The following certs have been renewed:
  /etc/letsencrypt/live/comsince.cn/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -