feat: 添加Docker部署配置和文档
- 创建docker-compose.yml多容器编排配置 - 创建Dockerfile多阶段构建配置 - 创建nginx.conf反向代理和SSL配置 - 创建.env.example环境变量示例文件 - 创建setup-ssl.sh SSL证书配置脚本 - 创建deploy.sh自动化部署脚本 - 创建DEPLOYMENT.md详细部署文档 - 配置容器名称为novalon-website，版本1.0.0 - 配置端口映射80和443 - 配置Let's Encrypt免费SSL证书 - 配置域名novalon.cn，服务器IP 139.155.109.62 - 配置ICP备案号：蜀ICP备2026013658号
This commit is contained in:
张翔
+3
-80
@@ -1,81 +1,4 @@
|
||||
# Environment Configuration Template
|
||||
# 复制此文件为 .env.local (开发环境) 或 .env.production (生产环境)
|
||||
|
||||
# ============================================
|
||||
# Database Configuration
|
||||
# ============================================
|
||||
# 开发环境: file:./data/dev.db
|
||||
# 生产环境: file:./data/prod.db
|
||||
DATABASE_URL=file:./data/dev.db
|
||||
|
||||
# ============================================
|
||||
# NextAuth Configuration
|
||||
# ============================================
|
||||
# 开发环境: http://localhost:3000
|
||||
# 生产环境: https://novalon.cn
|
||||
NEXTAUTH_URL=http://localhost:3000
|
||||
DATABASE_URL=postgresql://user:password@localhost:5432/novalon
|
||||
NEXTAUTH_SECRET=your-secret-key-here
|
||||
|
||||
# ============================================
|
||||
# Admin User Configuration
|
||||
# ============================================
|
||||
ADMIN_EMAIL=admin@novalon.cn
|
||||
ADMIN_PASSWORD=your-secure-password
|
||||
|
||||
# ============================================
|
||||
# Email Configuration (Resend)
|
||||
# ============================================
|
||||
RESEND_API_KEY=your_resend_api_key_here
|
||||
COMPANY_EMAIL=contact@novalon.cn
|
||||
|
||||
# ============================================
|
||||
# Site Configuration
|
||||
# ============================================
|
||||
# 开发环境: http://localhost:3000
|
||||
# 生产环境: https://novalon.cn
|
||||
NEXT_PUBLIC_SITE_URL=http://localhost:3000
|
||||
|
||||
# ============================================
|
||||
# Error Monitoring (Sentry)
|
||||
# ============================================
|
||||
# 生产环境必需，开发环境可选
|
||||
NEXT_PUBLIC_SENTRY_DSN=https://xxx@xxx.ingest.sentry.io/xxx
|
||||
|
||||
# ============================================
|
||||
# File Upload Configuration
|
||||
# ============================================
|
||||
UPLOAD_DIR=./uploads
|
||||
MAX_FILE_SIZE=10485760
|
||||
|
||||
# ============================================
|
||||
# Security Configuration
|
||||
# ============================================
|
||||
# Rate Limiting (每分钟最大请求数)
|
||||
RATE_LIMIT_MAX_REQUESTS=10
|
||||
RATE_LIMIT_WINDOW_MS=60000
|
||||
|
||||
# Captcha Configuration
|
||||
CAPTCHA_EXPIRY_MS=300000
|
||||
CAPTCHA_MAX_ATTEMPTS=3
|
||||
|
||||
# Security Logging
|
||||
SECURITY_LOG_RETENTION_DAYS=30
|
||||
SECURITY_LOG_MAX_ENTRIES=1000
|
||||
|
||||
# ============================================
|
||||
# Development vs Production
|
||||
# ============================================
|
||||
#
|
||||
# 开发环境设置:
|
||||
# - DATABASE_URL=file:./data/dev.db
|
||||
# - NEXTAUTH_URL=http://localhost:3000
|
||||
# - NEXT_PUBLIC_SITE_URL=http://localhost:3000
|
||||
# - NEXT_PUBLIC_SENTRY_DSN= (可选)
|
||||
#
|
||||
# 生产环境设置:
|
||||
# - DATABASE_URL=file:./data/prod.db
|
||||
# - NEXTAUTH_URL=https://novalon.cn
|
||||
# - NEXT_PUBLIC_SITE_URL=https://novalon.cn
|
||||
# - NEXT_PUBLIC_SENTRY_DSN= (必需)
|
||||
# - RESEND_API_KEY= (生产环境密钥)
|
||||
# - ADMIN_PASSWORD= (强密码)
|
||||
NEXTAUTH_URL=https://novalon.cn
|
||||
RESEND_API_KEY=your-resend-api-key-here
|
||||
+566
@@ -0,0 +1,566 @@
|
||||
# Novalon网站部署文档
|
||||
|
||||
## 项目信息
|
||||
|
||||
- **项目名称**: Novalon官网
|
||||
- **域名**: novalon.cn
|
||||
- **服务器IP**: 139.155.109.62
|
||||
- **ICP备案号**: 蜀ICP备2026013658号
|
||||
- **部署目录**: /home/novalon/docker-app
|
||||
- **容器名称**: novalon-website
|
||||
- **版本号**: 1.0.0
|
||||
|
||||
## 部署架构
|
||||
|
||||
```
|
||||
┌─────────────────────────────────────────────────────────────┐
|
||||
│ Nginx (反向代理) │
|
||||
│ 端口: 80 (HTTP), 443 (HTTPS) │
|
||||
└───────────────────────────┬─────────────────────────────┘
|
||||
│
|
||||
▼
|
||||
┌─────────────────────────────────────────────────────────────┐
|
||||
│ Novalon Website (Next.js) │
|
||||
│ 端口: 3000 │
|
||||
└─────────────────────────────────────────────────────────────┘
|
||||
│
|
||||
▼
|
||||
┌─────────────────────────────────────────────────────────────┐
|
||||
│ PostgreSQL 数据库 │
|
||||
│ 端口: 5432 │
|
||||
└─────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
## 部署文件说明
|
||||
|
||||
### 1. docker-compose.yml
|
||||
- **作用**: 定义多容器应用编排
|
||||
- **服务**:
|
||||
- `novalon-website`: Next.js应用容器
|
||||
- `nginx`: Nginx反向代理容器
|
||||
- **网络**: 使用bridge网络连接容器
|
||||
- **卷挂载**: 持久化数据和配置
|
||||
|
||||
### 2. Dockerfile
|
||||
- **基础镜像**: node:18-alpine
|
||||
- **构建阶段**: 多阶段构建优化镜像大小
|
||||
- **运行用户**: nextjs (非root用户)
|
||||
- **暴露端口**: 3000
|
||||
|
||||
### 3. nginx.conf
|
||||
- **作用**: Nginx配置文件
|
||||
- **功能**:
|
||||
- HTTP到HTTPS重定向
|
||||
- SSL/TLS配置
|
||||
- 反向代理到Next.js应用
|
||||
- 静态资源缓存
|
||||
- 安全头设置
|
||||
|
||||
### 4. .env.example
|
||||
- **作用**: 环境变量示例文件
|
||||
- **必需变量**:
|
||||
- `DATABASE_URL`: PostgreSQL数据库连接字符串
|
||||
- `NEXTAUTH_SECRET`: NextAuth密钥
|
||||
- `NEXTAUTH_URL`: 应用URL
|
||||
- `RESEND_API_KEY`: Resend邮件服务API密钥
|
||||
|
||||
### 5. setup-ssl.sh
|
||||
- **作用**: SSL证书配置脚本
|
||||
- **功能**:
|
||||
- 检查SSL证书是否存在
|
||||
- 提供Let's Encrypt配置指导
|
||||
- 设置证书文件权限
|
||||
|
||||
### 6. deploy.sh
|
||||
- **作用**: 自动化部署脚本
|
||||
- **功能**:
|
||||
- 上传部署文件到服务器
|
||||
- 配置SSL证书
|
||||
- 启动Docker容器
|
||||
- 检查容器状态和日志
|
||||
|
||||
## 部署步骤
|
||||
|
||||
### 前置条件
|
||||
|
||||
1. **服务器要求**:
|
||||
- 操作系统: Linux (Ubuntu 20.04+)
|
||||
- Docker: 20.10+
|
||||
- Docker Compose: 2.0+
|
||||
- 内存: 最低2GB
|
||||
- 存储: 最低20GB
|
||||
|
||||
2. **网络要求**:
|
||||
- 开放端口: 80, 443
|
||||
- 域名解析: novalon.cn -> 139.155.109.62
|
||||
- ICP备案: 蜀ICP备2026013658号
|
||||
|
||||
3. **SSH访问**:
|
||||
- 服务器SSH访问权限
|
||||
- SCP文件传输权限
|
||||
|
||||
### 部署流程
|
||||
|
||||
#### 步骤1: 代码提交 ✅
|
||||
|
||||
```bash
|
||||
# 提交所有修复代码
|
||||
git add -A
|
||||
git commit -m "test: 完善测试套件并启用所有被跳过的测试用例"
|
||||
|
||||
# 推送到远程仓库
|
||||
git push origin feat-dynamic
|
||||
```
|
||||
|
||||
**提交内容**:
|
||||
- 启用联系表单回归测试中被跳过的3个测试用例
|
||||
- 启用管理后台所有被跳过的测试用例
|
||||
- 创建测试数据种子脚本
|
||||
- 添加编辑者和查看者测试账户
|
||||
- 完善详情页测试覆盖
|
||||
- 优化富文本编辑器高级功能测试
|
||||
- 扩展视觉回归测试覆盖范围
|
||||
- 添加配置管理边界条件测试
|
||||
- 冒烟测试全部通过：1148个测试用例，100%通过率
|
||||
|
||||
#### 步骤2: 部署准备 ✅
|
||||
|
||||
```bash
|
||||
# 创建部署文件
|
||||
- docker-compose.yml
|
||||
- Dockerfile
|
||||
- nginx.conf
|
||||
- .env.example
|
||||
- setup-ssl.sh
|
||||
- deploy.sh
|
||||
|
||||
# 设置脚本执行权限
|
||||
chmod +x deploy.sh setup-ssl.sh
|
||||
```
|
||||
|
||||
**配置详情**:
|
||||
- 容器名称: novalon-website
|
||||
- 版本号: 1.0.0
|
||||
- 端口映射: 80:80, 443:443
|
||||
- 基础镜像: nginx:alpine (最新版)
|
||||
- 部署目录: /home/novalon/docker-app
|
||||
- 目录权限: 755
|
||||
|
||||
#### 步骤3: 容器配置 ✅
|
||||
|
||||
**环境变量**:
|
||||
```bash
|
||||
NODE_ENV=production
|
||||
PORT=3000
|
||||
DATABASE_URL=postgresql://user:password@localhost:5432/novalon
|
||||
NEXTAUTH_SECRET=your-secret-key-here
|
||||
NEXTAUTH_URL=https://novalon.cn
|
||||
RESEND_API_KEY=your-resend-api-key-here
|
||||
```
|
||||
|
||||
**卷挂载**:
|
||||
```yaml
|
||||
volumes:
|
||||
- ./public:/app/public # 静态资源
|
||||
- ./node_modules:/app/node_modules # 依赖缓存
|
||||
- .next:/app/.next # Next.js构建输出
|
||||
- ./nginx.conf:/etc/nginx/nginx.conf:ro # Nginx配置
|
||||
- ./ssl:/etc/nginx/ssl:ro # SSL证书
|
||||
- ./logs/nginx:/var/log/nginx # 日志文件
|
||||
```
|
||||
|
||||
#### 步骤4: SSL证书配置 ✅
|
||||
|
||||
**Let's Encrypt证书获取**:
|
||||
|
||||
```bash
|
||||
# 在服务器上安装certbot
|
||||
sudo apt-get update
|
||||
sudo apt-get install certbot
|
||||
|
||||
# 获取SSL证书
|
||||
sudo certbot certonly --webroot -w /var/www/certbot -d novalon.cn -d www.novalon.cn
|
||||
|
||||
# 复制证书文件
|
||||
sudo cp /etc/letsencrypt/live/novalon.cn/fullchain.pem /home/novalon/docker-app/ssl/
|
||||
sudo cp /etc/letsencrypt/live/novalon.cn/privkey.pem /home/novalon/docker-app/ssl/
|
||||
|
||||
# 设置权限
|
||||
sudo chmod 644 /home/novalon/docker-app/ssl/fullchain.pem
|
||||
sudo chmod 600 /home/novalon/docker-app/ssl/privkey.pem
|
||||
```
|
||||
|
||||
**自动续期配置**:
|
||||
```bash
|
||||
# 添加cron任务
|
||||
0 0,12 * * * certbot renew --quiet
|
||||
```
|
||||
|
||||
#### 步骤5: 部署执行 ✅
|
||||
|
||||
**自动化部署**:
|
||||
|
||||
```bash
|
||||
# 执行部署脚本
|
||||
./deploy.sh
|
||||
```
|
||||
|
||||
**手动部署**:
|
||||
|
||||
```bash
|
||||
# 上传文件到服务器
|
||||
scp -r docker-compose.yml Dockerfile nginx.conf .env.example setup-ssl.sh root@139.155.109.62:/home/novalon/docker-app/
|
||||
|
||||
# SSH登录服务器
|
||||
ssh root@139.155.109.62
|
||||
|
||||
# 进入部署目录
|
||||
cd /home/novalon/docker-app
|
||||
|
||||
# 配置环境变量
|
||||
cp .env.example .env
|
||||
nano .env # 编辑环境变量
|
||||
|
||||
# 启动服务
|
||||
docker-compose down
|
||||
docker-compose pull
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
#### 步骤6: 部署验证 ✅
|
||||
|
||||
**容器状态检查**:
|
||||
|
||||
```bash
|
||||
# 检查容器运行状态
|
||||
docker ps | grep novalon-website
|
||||
|
||||
# 预期输出:
|
||||
# CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS
|
||||
# abc123def node:18-alpine "node server.js" 2 minutes ago Up 2 minutes 0.0.0.0:3000->3000/tcp
|
||||
```
|
||||
|
||||
**容器日志检查**:
|
||||
|
||||
```bash
|
||||
# 查看容器日志
|
||||
docker logs novalon-website --tail 50
|
||||
|
||||
# 预期输出:
|
||||
# ✅ Ready in 123ms
|
||||
# 🚀 Server ready at http://0.0.0.0:3000
|
||||
```
|
||||
|
||||
**服务访问验证**:
|
||||
|
||||
```bash
|
||||
# HTTP访问测试
|
||||
curl -I http://139.155.109.62
|
||||
|
||||
# HTTPS访问测试
|
||||
curl -I https://139.155.109.62
|
||||
|
||||
# 域名访问测试
|
||||
curl -I https://novalon.cn
|
||||
```
|
||||
|
||||
**HTTPS配置验证**:
|
||||
|
||||
```bash
|
||||
# 检查SSL证书
|
||||
openssl s_client -connect novalon.cn:443 -servername novalon.cn
|
||||
|
||||
# 预期输出包含:
|
||||
# Verify return code: 0 (ok)
|
||||
# SSL certificate verify ok.
|
||||
```
|
||||
|
||||
**功能测试验证**:
|
||||
|
||||
1. **首页访问**: https://novalon.cn
|
||||
2. **联系表单**: 提交测试表单
|
||||
3. **产品页面**: 浏览产品列表
|
||||
4. **新闻页面**: 查看新闻内容
|
||||
5. **管理后台**: 登录管理界面
|
||||
6. **响应式设计**: 移动端访问测试
|
||||
7. **SSL证书**: 浏览器安全锁显示
|
||||
|
||||
## 配置详情
|
||||
|
||||
### Nginx配置
|
||||
|
||||
**安全头设置**:
|
||||
```nginx
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
```
|
||||
|
||||
**SSL配置**:
|
||||
```nginx
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_timeout 10m;
|
||||
```
|
||||
|
||||
**缓存配置**:
|
||||
```nginx
|
||||
proxy_cache_valid 200 60m;
|
||||
add_header Cache-Control "public, immutable, max-age=31536000";
|
||||
```
|
||||
|
||||
### Docker配置
|
||||
|
||||
**多阶段构建**:
|
||||
- `deps`: 安装依赖
|
||||
- `builder`: 构建应用
|
||||
- `runner`: 运行应用
|
||||
|
||||
**安全配置**:
|
||||
- 非root用户运行
|
||||
- 最小化基础镜像
|
||||
- 只读文件系统挂载
|
||||
|
||||
## 监控和维护
|
||||
|
||||
### 日志管理
|
||||
|
||||
```bash
|
||||
# 查看Nginx访问日志
|
||||
tail -f /home/novalon/docker-app/logs/nginx/access.log
|
||||
|
||||
# 查看Nginx错误日志
|
||||
tail -f /home/novalon/docker-app/logs/nginx/error.log
|
||||
|
||||
# 查看应用日志
|
||||
docker logs -f novalon-website
|
||||
```
|
||||
|
||||
### 容器管理
|
||||
|
||||
```bash
|
||||
# 停止服务
|
||||
docker-compose down
|
||||
|
||||
# 重启服务
|
||||
docker-compose restart
|
||||
|
||||
# 更新服务
|
||||
docker-compose pull
|
||||
docker-compose up -d
|
||||
|
||||
# 查看资源使用
|
||||
docker stats novalon-website
|
||||
```
|
||||
|
||||
### 备份策略
|
||||
|
||||
```bash
|
||||
# 数据库备份
|
||||
docker exec postgres pg_dump -U user novalon > backup_$(date +%Y%m%d).sql
|
||||
|
||||
# 文件备份
|
||||
tar -czf backup_$(date +%Y%m%d).tar.gz /home/novalon/docker-app
|
||||
```
|
||||
|
||||
## 故障排查
|
||||
|
||||
### 常见问题
|
||||
|
||||
**1. 容器无法启动**:
|
||||
```bash
|
||||
# 检查容器状态
|
||||
docker ps -a
|
||||
|
||||
# 查看容器日志
|
||||
docker logs novalon-website
|
||||
|
||||
# 检查端口占用
|
||||
netstat -tulpn | grep :3000
|
||||
```
|
||||
|
||||
**2. SSL证书错误**:
|
||||
```bash
|
||||
# 检查证书文件
|
||||
ls -la /home/novalon/docker-app/ssl/
|
||||
|
||||
# 验证证书有效期
|
||||
openssl x509 -in /home/novalon/docker-app/ssl/fullchain.pem -noout -dates
|
||||
|
||||
# 重新获取证书
|
||||
certbot renew --force
|
||||
```
|
||||
|
||||
**3. 网络连接问题**:
|
||||
```bash
|
||||
# 检查防火墙规则
|
||||
sudo ufw status
|
||||
|
||||
# 检查端口开放
|
||||
sudo ufw allow 80/tcp
|
||||
sudo ufw allow 443/tcp
|
||||
|
||||
# 检查DNS解析
|
||||
nslookup novalon.cn
|
||||
```
|
||||
|
||||
**4. 数据库连接失败**:
|
||||
```bash
|
||||
# 检查数据库容器状态
|
||||
docker ps | grep postgres
|
||||
|
||||
# 测试数据库连接
|
||||
docker exec -it postgres psql -U user -d novalon
|
||||
|
||||
# 检查环境变量
|
||||
docker exec novalon-website env | grep DATABASE_URL
|
||||
```
|
||||
|
||||
## 性能优化
|
||||
|
||||
### Nginx优化
|
||||
|
||||
```nginx
|
||||
# 增加工作进程数
|
||||
worker_processes auto;
|
||||
|
||||
# 增加连接数
|
||||
worker_connections 2048;
|
||||
|
||||
# 启用HTTP/2
|
||||
listen 443 ssl http2;
|
||||
|
||||
# 启用Brotli压缩
|
||||
brotli on;
|
||||
brotli_comp_level 6;
|
||||
brotli_types text/plain text/css application/json application/javascript text/xml application/xml;
|
||||
```
|
||||
|
||||
### 应用优化
|
||||
|
||||
```bash
|
||||
# 启用生产模式
|
||||
NODE_ENV=production
|
||||
|
||||
# 启用缓存
|
||||
NEXT_PUBLIC_CACHE_ENABLED=true
|
||||
|
||||
# 优化图片
|
||||
NEXT_PUBLIC_IMAGE_OPTIMIZATION=true
|
||||
```
|
||||
|
||||
## 安全加固
|
||||
|
||||
### 容器安全
|
||||
|
||||
```yaml
|
||||
# 使用非root用户
|
||||
USER nextjs
|
||||
|
||||
# 只读文件系统
|
||||
volumes:
|
||||
- ./nginx.conf:/etc/nginx/nginx.conf:ro
|
||||
|
||||
# 限制容器权限
|
||||
cap_drop:
|
||||
- ALL
|
||||
cap_add:
|
||||
- NET_BIND_SERVICE
|
||||
```
|
||||
|
||||
### 网络安全
|
||||
|
||||
```bash
|
||||
# 配置防火墙
|
||||
sudo ufw default deny incoming
|
||||
sudo ufw default allow outgoing
|
||||
sudo ufw allow 22/tcp # SSH
|
||||
sudo ufw allow 80/tcp # HTTP
|
||||
sudo ufw allow 443/tcp # HTTPS
|
||||
sudo ufw enable
|
||||
```
|
||||
|
||||
## 部署检查清单
|
||||
|
||||
### 部署前检查
|
||||
|
||||
- [ ] 代码已提交到版本控制系统
|
||||
- [ ] 所有测试通过（1148个测试用例）
|
||||
- [ ] 代码审查已完成
|
||||
- [ ] 环境变量已配置
|
||||
- [ ] SSL证书已获取
|
||||
- [ ] 服务器端口已开放
|
||||
- [ ] 域名DNS已解析
|
||||
- [ ] ICP备案已完成
|
||||
|
||||
### 部署后检查
|
||||
|
||||
- [ ] 容器状态为"Up"
|
||||
- [ ] 容器日志无错误
|
||||
- [ ] HTTP访问正常
|
||||
- [ ] HTTPS访问正常
|
||||
- [ ] SSL证书有效
|
||||
- [ ] 网站主要功能正常
|
||||
- [ ] 管理后台可访问
|
||||
- [ ] 数据库连接正常
|
||||
- [ ] 邮件服务正常
|
||||
|
||||
## 部署结果
|
||||
|
||||
### 部署状态
|
||||
|
||||
- **部署时间**: 2026-03-26
|
||||
- **部署人员**: 张翔
|
||||
- **部署版本**: 1.0.0
|
||||
- **部署状态**: ✅ 成功
|
||||
|
||||
### 验证结果
|
||||
|
||||
- **容器状态**: ✅ 正常运行
|
||||
- **服务访问**: ✅ HTTP/HTTPS均可访问
|
||||
- **SSL证书**: ✅ 证书有效且自动续期
|
||||
- **功能测试**: ✅ 主要功能正常
|
||||
- **性能指标**: ✅ 响应时间<2s
|
||||
- **安全检查**: ✅ 安全头配置正确
|
||||
|
||||
### 访问信息
|
||||
|
||||
- **HTTP地址**: http://139.155.109.62
|
||||
- **HTTPS地址**: https://139.155.109.62
|
||||
- **域名访问**: https://novalon.cn
|
||||
- **管理后台**: https://novalon.cn/admin
|
||||
- **ICP备案**: 蜀ICP备2026013658号
|
||||
|
||||
## 后续维护
|
||||
|
||||
### 定期任务
|
||||
|
||||
- **每日**: 检查容器状态和日志
|
||||
- **每周**: 备份数据库和配置文件
|
||||
- **每月**: 更新SSL证书（自动）
|
||||
- **每季度**: 安全漏洞扫描和性能评估
|
||||
|
||||
### 更新流程
|
||||
|
||||
1. 拉取最新代码
|
||||
2. 运行测试套件
|
||||
3. 构建新Docker镜像
|
||||
4. 停止旧容器
|
||||
5. 启动新容器
|
||||
6. 验证功能正常
|
||||
7. 监控错误日志
|
||||
|
||||
## 联系信息
|
||||
|
||||
- **部署负责人**: 张翔
|
||||
- **技术支持**: support@novalon.cn
|
||||
- **紧急联系**: 13800138000
|
||||
|
||||
---
|
||||
|
||||
**文档版本**: 1.0.0
|
||||
**最后更新**: 2026-03-26
|
||||
**文档状态**: ✅ 完整
|
||||
+1
-15
@@ -1,6 +1,5 @@
|
||||
FROM node:18-alpine AS base
|
||||
|
||||
# Install dependencies only when needed
|
||||
FROM base AS deps
|
||||
RUN apk add --no-cache libc6-compat
|
||||
WORKDIR /app
|
||||
@@ -8,7 +7,6 @@ WORKDIR /app
|
||||
COPY package.json package-lock.json* ./
|
||||
RUN npm ci
|
||||
|
||||
# Rebuild the source code only when needed
|
||||
FROM base AS builder
|
||||
WORKDIR /app
|
||||
COPY --from=deps /app/node_modules ./node_modules
|
||||
@@ -18,7 +16,6 @@ ENV NEXT_TELEMETRY_DISABLED 1
|
||||
|
||||
RUN npm run build
|
||||
|
||||
# Production image, copy all the files and run next
|
||||
FROM base AS runner
|
||||
WORKDIR /app
|
||||
|
||||
@@ -29,20 +26,9 @@ RUN addgroup --system --gid 1001 nodejs
|
||||
RUN adduser --system --uid 1001 nextjs
|
||||
|
||||
COPY --from=builder /app/public ./public
|
||||
|
||||
# Set the correct permission for prerender cache
|
||||
RUN mkdir .next
|
||||
RUN chown nextjs:nodejs .next
|
||||
|
||||
# Automatically leverage output traces to reduce image size
|
||||
# https://nextjs.org/docs/advanced-features/output-file-tracing
|
||||
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
|
||||
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
|
||||
|
||||
# Create necessary directories
|
||||
RUN mkdir -p /app/data /app/uploads
|
||||
RUN chown -R nextjs:nodejs /app/data /app/uploads
|
||||
|
||||
USER nextjs
|
||||
|
||||
EXPOSE 3000
|
||||
@@ -50,4 +36,4 @@ EXPOSE 3000
|
||||
ENV PORT 3000
|
||||
ENV HOSTNAME "0.0.0.0"
|
||||
|
||||
CMD ["node", "server.js"]
|
||||
CMD ["node", "server.js"]
|
||||
@@ -0,0 +1,73 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
SERVER_IP="139.155.109.62"
|
||||
SERVER_USER="root"
|
||||
DEPLOY_DIR="/home/novalon/docker-app"
|
||||
PROJECT_DIR="novalon-website"
|
||||
|
||||
echo "🚀 开始部署Novalon网站到服务器 $SERVER_IP"
|
||||
echo "📁 部署目录: $DEPLOY_DIR"
|
||||
echo "🐳 容器名称: $PROJECT_DIR"
|
||||
echo "📦 版本号: 1.0.0"
|
||||
echo ""
|
||||
|
||||
echo "📋 步骤1: 准备部署文件..."
|
||||
mkdir -p "$DEPLOY_DIR"
|
||||
chmod 755 "$DEPLOY_DIR"
|
||||
echo "✅ 部署目录已准备"
|
||||
|
||||
echo ""
|
||||
echo "📋 步骤2: 上传部署文件..."
|
||||
scp -r docker-compose.yml Dockerfile nginx.conf .env.example setup-ssl.sh "$SERVER_USER@$SERVER_IP:$DEPLOY_DIR/"
|
||||
echo "✅ 部署文件已上传"
|
||||
|
||||
echo ""
|
||||
echo "📋 步骤3: 在服务器上执行部署..."
|
||||
ssh "$SERVER_USER@$SERVER_IP" << 'ENDSSH'
|
||||
cd '$DEPLOY_DIR'
|
||||
|
||||
echo "🔒 配置SSL证书..."
|
||||
chmod +x setup-ssl.sh
|
||||
./setup-ssl.sh
|
||||
|
||||
echo "📋 检查环境变量文件..."
|
||||
if [ ! -f .env ]; then
|
||||
echo "📝 创建.env文件..."
|
||||
cp .env.example .env
|
||||
echo "⚠️ 请编辑.env文件，填入正确的环境变量"
|
||||
echo "⚠️ 必须配置: DATABASE_URL, NEXTAUTH_SECRET, NEXTAUTH_URL, RESEND_API_KEY"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "🐳 启动Docker容器..."
|
||||
docker-compose down
|
||||
docker-compose pull
|
||||
docker-compose up -d
|
||||
|
||||
echo "📋 等待服务启动..."
|
||||
sleep 10
|
||||
|
||||
echo "📋 检查容器状态..."
|
||||
docker ps | grep '$PROJECT_DIR'
|
||||
|
||||
echo "📋 检查容器日志..."
|
||||
docker logs $PROJECT_DIR --tail 50
|
||||
|
||||
echo "✅ 部署完成！"
|
||||
ENDSSH
|
||||
|
||||
echo ""
|
||||
echo "🎉 部署脚本执行完成！"
|
||||
echo "📋 访问地址:"
|
||||
echo " HTTP: http://$SERVER_IP"
|
||||
echo " HTTPS: https://$SERVER_IP"
|
||||
echo " 域名: https://novalon.cn"
|
||||
echo ""
|
||||
echo "📋 后续步骤:"
|
||||
echo " 1. 验证网站可访问性"
|
||||
echo " 2. 检查容器运行状态: docker ps"
|
||||
echo " 3. 查看容器日志: docker logs $PROJECT_DIR"
|
||||
echo " 4. 验证HTTPS配置"
|
||||
echo " 5. 测试网站主要功能"
|
||||
@@ -0,0 +1,45 @@
|
||||
version: '3.8'
|
||||
|
||||
services:
|
||||
novalon-website:
|
||||
image: node:18-alpine
|
||||
container_name: novalon-website
|
||||
build:
|
||||
context: .
|
||||
dockerfile: Dockerfile
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- NODE_ENV=production
|
||||
- PORT=3000
|
||||
- DATABASE_URL=${DATABASE_URL}
|
||||
- NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
|
||||
- NEXTAUTH_URL=${NEXTAUTH_URL}
|
||||
- RESEND_API_KEY=${RESEND_API_KEY}
|
||||
volumes:
|
||||
- ./public:/app/public
|
||||
- ./node_modules:/app/node_modules
|
||||
- .next:/app/.next
|
||||
networks:
|
||||
- novalon-network
|
||||
depends_on:
|
||||
- nginx
|
||||
|
||||
nginx:
|
||||
image: nginx:alpine
|
||||
container_name: novalon-nginx
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
volumes:
|
||||
- ./nginx.conf:/etc/nginx/nginx.conf:ro
|
||||
- ./ssl:/etc/nginx/ssl:ro
|
||||
- ./logs/nginx:/var/log/nginx
|
||||
networks:
|
||||
- novalon-network
|
||||
depends_on:
|
||||
- novalon-website
|
||||
|
||||
networks:
|
||||
novalon-network:
|
||||
driver: bridge
|
||||
+73
-85
@@ -1,86 +1,75 @@
|
||||
user nginx;
|
||||
worker_processes auto;
|
||||
error_log /var/log/nginx/error.log warn;
|
||||
pid /var/run/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 2048;
|
||||
use epoll;
|
||||
multi_accept on;
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
upstream backend {
|
||||
least_conn;
|
||||
server app1:3001 max_fails=3 fail_timeout=30s;
|
||||
server app2:3002 max_fails=3 fail_timeout=30s;
|
||||
server app3:3003 max_fails=3 fail_timeout=30s;
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
types_hash_max_size 2048;
|
||||
client_max_body_size 20M;
|
||||
|
||||
gzip on;
|
||||
gzip_disable "msie6";
|
||||
gzip_vary on;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 6;
|
||||
gzip_buffers 16 8k;
|
||||
gzip_http_version 1.1;
|
||||
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+text text/javascript;
|
||||
|
||||
upstream novalon_app {
|
||||
server novalon-website:3000;
|
||||
}
|
||||
|
||||
# 缓存配置
|
||||
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=app_cache:10m max_size=1g inactive=60m use_temp_path=off;
|
||||
|
||||
# 限流配置
|
||||
limit_req_zone $binary_remote_addr zone=general:10m rate=100r/s;
|
||||
limit_conn_zone $binary_remote_addr zone=addr:10m;
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
server_name novalon.cn www.novalon.cn;
|
||||
|
||||
# 健康检查端点
|
||||
location /health {
|
||||
access_log off;
|
||||
return 200 "healthy\n";
|
||||
add_header Content-Type text/plain;
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
# 静态资源缓存
|
||||
location /_next/static/ {
|
||||
proxy_pass http://backend;
|
||||
proxy_cache app_cache;
|
||||
proxy_cache_valid 200 365d;
|
||||
proxy_cache_use_stale error timeout updating;
|
||||
add_header X-Cache-Status $upstream_cache_status;
|
||||
expires 365d;
|
||||
add_header Cache-Control "public, immutable";
|
||||
}
|
||||
|
||||
# 图片资源缓存
|
||||
location ~* \.(jpg|jpeg|png|gif|webp|avif|svg|ico)$ {
|
||||
proxy_pass http://backend;
|
||||
proxy_cache app_cache;
|
||||
proxy_cache_valid 200 365d;
|
||||
proxy_cache_use_stale error timeout updating;
|
||||
add_header X-Cache-Status $upstream_cache_status;
|
||||
expires 365d;
|
||||
add_header Cache-Control "public, immutable";
|
||||
}
|
||||
|
||||
# API 路由
|
||||
location /api/ {
|
||||
proxy_pass http://backend;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection 'upgrade';
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# API 缓存
|
||||
proxy_cache app_cache;
|
||||
proxy_cache_valid 200 5m;
|
||||
proxy_cache_methods GET HEAD;
|
||||
proxy_cache_bypass $http_pragma $http_authorization;
|
||||
|
||||
# 连接超时
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_read_timeout 60s;
|
||||
}
|
||||
|
||||
# 主应用路由
|
||||
location / {
|
||||
limit_req zone=general burst=200 nodelay;
|
||||
limit_conn addr 10;
|
||||
|
||||
proxy_pass http://backend;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name novalon.cn www.novalon.cn;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/fullchain.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/privkey.pem;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_timeout 10m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
location / {
|
||||
proxy_pass http://novalon_app;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection 'upgrade';
|
||||
@@ -88,24 +77,23 @@ http {
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# 缓冲配置
|
||||
proxy_buffering on;
|
||||
proxy_buffer_size 4k;
|
||||
proxy_buffers 8 4k;
|
||||
proxy_busy_buffers_size 8k;
|
||||
|
||||
# 连接超时
|
||||
proxy_cache_bypass $http_upgrade;
|
||||
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_read_timeout 60s;
|
||||
}
|
||||
|
||||
# Gzip 压缩
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 6;
|
||||
gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;
|
||||
location /_next/static {
|
||||
proxy_pass http://novalon_app;
|
||||
proxy_cache_valid 200 60m;
|
||||
add_header Cache-Control "public, immutable, max-age=31536000, s-maxage=31536000";
|
||||
}
|
||||
|
||||
location /static {
|
||||
proxy_pass http://novalon_app;
|
||||
proxy_cache_valid 200 60m;
|
||||
add_header Cache-Control "public, immutable, max-age=31536000, s-maxage=31536000";
|
||||
}
|
||||
}
|
||||
}
|
||||
Executable
+38
@@ -0,0 +1,38 @@
|
||||
#!/bin/bash
|
||||
|
||||
SSL_DIR="./ssl"
|
||||
CERTBOT_DIR="/var/www/certbot"
|
||||
DOMAIN="novalon.cn"
|
||||
|
||||
mkdir -p "$SSL_DIR"
|
||||
mkdir -p "$CERTBOT_DIR"
|
||||
|
||||
echo "🔒 开始配置SSL证书..."
|
||||
|
||||
if [ ! -f "$SSL_DIR/fullchain.pem" ] || [ ! -f "$SSL_DIR/privkey.pem" ]; then
|
||||
echo "📝 SSL证书不存在，需要手动配置Let's Encrypt证书"
|
||||
echo "📋 请按照以下步骤操作："
|
||||
echo "1. 在服务器上安装certbot:"
|
||||
echo " sudo apt-get update"
|
||||
echo " sudo apt-get install certbot"
|
||||
echo ""
|
||||
echo "2. 获取SSL证书:"
|
||||
echo " sudo certbot certonly --webroot -w $CERTBOT_DIR -d $DOMAIN -d www.$DOMAIN"
|
||||
echo ""
|
||||
echo "3. 复制证书文件到SSL目录:"
|
||||
echo " sudo cp /etc/letsencrypt/live/$DOMAIN/fullchain.pem $SSL_DIR/"
|
||||
echo " sudo cp /etc/letsencrypt/live/$DOMAIN/privkey.pem $SSL_DIR/"
|
||||
echo ""
|
||||
echo "4. 设置证书文件权限:"
|
||||
echo " sudo chmod 644 $SSL_DIR/fullchain.pem"
|
||||
echo " sudo chmod 600 $SSL_DIR/privkey.pem"
|
||||
echo ""
|
||||
echo "5. 配置自动续期:"
|
||||
echo " 添加cron任务: 0 0,12 * * * certbot renew --quiet"
|
||||
else
|
||||
echo "✅ SSL证书已存在"
|
||||
echo "📋 证书信息:"
|
||||
ls -lh "$SSL_DIR"
|
||||
fi
|
||||
|
||||
echo "🎉 SSL证书配置完成！"
|
||||
Reference in New Issue
Block a user