From 93edbc4417cfe287a1f18c621782b5561673a64e Mon Sep 17 00:00:00 2001
From: Toyas <toyasovo@gmail.com>
Date: Wed, 11 Mar 2026 15:46:12 +0800
Subject: [PATCH] chore(deploy): Add Debian 12 initialization script

---
 scripts/init-debian12.sh | 266 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 266 insertions(+)
 create mode 100644 scripts/init-debian12.sh

diff --git a/scripts/init-debian12.sh b/scripts/init-debian12.sh
new file mode 100644
index 0000000..98181de
--- /dev/null
+++ b/scripts/init-debian12.sh
@@ -0,0 +1,266 @@
+#!/bin/bash
+# ============================================================
+# Debian 12 系统初始化脚本
+# 用途: 在 Debian 12 上安装 Docker、Java 17、Maven 等依赖
+# 使用: chmod +x init-debian12.sh && sudo ./init-debian12.sh
+# ============================================================
+
+set -e
+
+# 颜色定义
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
+log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
+log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
+log_step() { echo -e "${BLUE}[STEP]${NC} $1"; }
+
+# 检查是否为 root 用户
+if [ "$EUID" -ne 0 ]; then
+    log_error "请使用 root 用户或 sudo 执行此脚本"
+    exit 1
+fi
+
+# 检查系统版本
+if [ ! -f /etc/os-release ]; then
+    log_error "无法检测系统版本"
+    exit 1
+fi
+
+. /etc/os-release
+log_info "检测到系统: $PRETTY_NAME"
+
+if [ "$ID" != "debian" ]; then
+    log_warn "此脚本专为 Debian 设计，当前系统: $ID"
+    read -p "是否继续? (y/n): " confirm
+    if [ "$confirm" != "y" ]; then
+        exit 0
+    fi
+fi
+
+log_step "=========================================="
+log_step "开始初始化 Debian 12 系统"
+log_step "=========================================="
+
+# 1. 更新系统
+log_step "[1/8] 更新系统软件包..."
+apt-get update
+apt-get upgrade -y
+apt-get dist-upgrade -y
+
+# 2. 安装基础工具
+log_step "[2/8] 安装基础工具..."
+apt-get install -y \
+    curl \
+    wget \
+    git \
+    vim \
+    net-tools \
+    iputils-ping \
+    telnet \
+    netcat-openbsd \
+    lsof \
+    htop \
+    tree \
+    unzip \
+    gnupg \
+    apt-transport-https \
+    ca-certificates \
+    software-properties-common
+
+# 3. 安装 Java 17
+log_step "[3/8] 安装 OpenJDK 17..."
+apt-get install -y openjdk-17-jdk openjdk-17-jre
+
+# 验证 Java 安装
+java -version
+log_info "Java 安装完成: $(java -version 2>&1 | head -n 1)"
+
+# 设置 JAVA_HOME
+if ! grep -q "JAVA_HOME" /etc/profile; then
+    echo 'export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64' >> /etc/profile
+    echo 'export PATH=$JAVA_HOME/bin:$PATH' >> /etc/profile
+    log_info "已设置 JAVA_HOME 环境变量"
+fi
+
+# 4. 安装 Maven
+log_step "[4/8] 安装 Maven..."
+apt-get install -y maven
+
+# 验证 Maven 安装
+mvn -version
+log_info "Maven 安装完成"
+
+# 配置 Maven 镜像 (阿里云)
+MAVEN_SETTINGS="/usr/share/maven/conf/settings.xml"
+if [ -f "$MAVEN_SETTINGS" ]; then
+    if ! grep -q "aliyun" "$MAVEN_SETTINGS"; then
+        log_info "配置 Maven 阿里云镜像..."
+        sed -i '/<mirrors>/a \
+    <mirror>\
+      <id>aliyun</id>\
+      <mirrorOf>central</mirrorOf>\
+      <name>Aliyun Maven Mirror</name>\
+      <url>https://maven.aliyun.com/repository/public</url>\
+    </mirror>' "$MAVEN_SETTINGS"
+    fi
+fi
+
+# 5. 安装 Docker
+log_step "[5/8] 安装 Docker..."
+
+# 添加 Docker 官方 GPG 密钥
+install -m 0755 -d /etc/apt/keyrings
+curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+chmod a+r /etc/apt/keyrings/docker.gpg
+
+# 添加 Docker 软件源
+echo \
+    "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
+    $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
+    tee /etc/apt/sources.list.d/docker.list > /dev/null
+
+# 安装 Docker
+apt-get update
+apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+
+# 启动并设置开机自启
+systemctl start docker
+systemctl enable docker
+
+# 验证 Docker 安装
+docker --version
+docker compose version
+log_info "Docker 安装完成"
+
+# 将当前非 root 用户添加到 docker 组
+if [ -n "$SUDO_USER" ]; then
+    usermod -aG docker "$SUDO_USER"
+    log_info "已将用户 $SUDO_USER 添加到 docker 组"
+fi
+
+# 6. 配置 Docker 镜像加速 (国内镜像)
+log_step "[6/8] 配置 Docker 镜像加速..."
+mkdir -p /etc/docker
+cat > /etc/docker/daemon.json << 'EOF'
+{
+    "registry-mirrors": [
+        "https://docker.1ms.run",
+        "https://docker.xuanyuan.me"
+    ],
+    "log-driver": "json-file",
+    "log-opts": {
+        "max-size": "100m",
+        "max-file": "3"
+    },
+    "storage-driver": "overlay2",
+    "live-restore": true
+}
+EOF
+systemctl daemon-reload
+systemctl restart docker
+log_info "Docker 镜像加速配置完成"
+
+# 7. 配置系统参数
+log_step "[7/8] 优化系统参数..."
+
+# 内核参数优化
+cat > /etc/sysctl.d/99-ha-ovp.conf << 'EOF'
+# 网络优化
+net.core.somaxconn = 65535
+net.core.netdev_max_backlog = 65535
+net.ipv4.tcp_max_syn_backlog = 65535
+net.ipv4.tcp_fin_timeout = 30
+net.ipv4.tcp_keepalive_time = 1200
+net.ipv4.tcp_keepalive_probes = 5
+net.ipv4.tcp_keepalive_intvl = 30
+net.ipv4.tcp_max_tw_buckets = 5000
+net.ipv4.tcp_tw_reuse = 1
+net.ipv4.ip_local_port_range = 1024 65535
+
+# 内存优化
+vm.swappiness = 10
+vm.overcommit_memory = 1
+vm.max_map_count = 262144
+
+# 文件描述符
+fs.file-max = 655350
+fs.nr_open = 655350
+
+# 对于 Redis
+net.core.somaxconn = 65535
+vm.overcommit_memory = 1
+EOF
+sysctl -p /etc/sysctl.d/99-ha-ovp.conf
+log_info "系统参数优化完成"
+
+# 文件描述符限制
+cat > /etc/security/limits.d/99-ha-ovp.conf << 'EOF'
+* soft nofile 655350
+* hard nofile 655350
+* soft nproc 655350
+* hard nproc 655350
+root soft nofile 655350
+root hard nofile 655350
+root soft nproc 655350
+root hard nproc 655350
+EOF
+log_info "文件描述符限制配置完成"
+
+# 8. 配置防火墙
+log_step "[8/8] 配置防火墙..."
+apt-get install -y ufw
+
+# 设置默认策略
+ufw default deny incoming
+ufw default allow outgoing
+
+# 允许 SSH
+ufw allow 22/tcp
+
+# 允许项目端口
+# 基础设施端口
+ufw allow 3306/tcp comment 'MySQL'
+ufw allow 6379/tcp comment 'Redis'
+ufw allow 26379/tcp comment 'Redis Sentinel'
+ufw allow 8848:8849/tcp comment 'Nacos'
+ufw allow 9876/tcp comment 'RocketMQ NameServer'
+ufw allow 10909:10912/tcp comment 'RocketMQ Broker'
+ufw allow 9000:9001/tcp comment 'MinIO'
+ufw allow 8880/tcp comment 'Sentinel Dashboard'
+
+# 微服务端口
+ufw allow 9000:9006/tcp comment 'Microservices'
+
+# Nginx
+ufw allow 80/tcp comment 'HTTP'
+ufw allow 443/tcp comment 'HTTPS'
+
+# 启用防火墙 (谨慎操作，确保 SSH 已开放)
+# ufw enable
+log_warn "防火墙已配置但未启用，请手动执行 'ufw enable' 启用"
+
+log_step "=========================================="
+log_step "系统初始化完成!"
+log_step "=========================================="
+
+# 显示安装信息
+echo ""
+log_info "安装版本信息:"
+echo "  - Java: $(java -version 2>&1 | head -n 1)"
+echo "  - Maven: $(mvn -version 2>&1 | head -n 1)"
+echo "  - Docker: $(docker --version)"
+echo "  - Docker Compose: $(docker compose version)"
+echo ""
+log_info "请执行以下命令使环境变量生效:"
+echo "  source /etc/profile"
+echo ""
+log_info "防火墙配置已完成，请根据需要执行:"
+echo "  ufw enable    # 启用防火墙"
+echo "  ufw status    # 查看状态"
+echo ""
+log_info "下一步: 请克隆项目并执行部署脚本"