HAOVP/backend/scripts/init-debian12.sh

#!/bin/bash
# ============================================================
# Debian 12 系统初始化脚本
# 用途: 在 Debian 12 上安装 Docker、Java 17、Maven 等依赖
# 使用: chmod +x init-debian12.sh && sudo ./init-debian12.sh
# ============================================================

set -e

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
log_step() { echo -e "${BLUE}[STEP]${NC} $1"; }

# 检查是否为 root 用户
if [ "$EUID" -ne 0 ]; then
    log_error "请使用 root 用户或 sudo 执行此脚本"
    exit 1
fi

# 检查系统版本
if [ ! -f /etc/os-release ]; then
    log_error "无法检测系统版本"
    exit 1
fi

. /etc/os-release
log_info "检测到系统: $PRETTY_NAME"

if [ "$ID" != "debian" ]; then
    log_warn "此脚本专为 Debian 设计，当前系统: $ID"
    read -p "是否继续? (y/n): " confirm
    if [ "$confirm" != "y" ]; then
        exit 0
    fi
fi

log_step "=========================================="
log_step "开始初始化 Debian 12 系统"
log_step "=========================================="

# 1. 更新系统
log_step "[1/8] 更新系统软件包..."
apt-get update
apt-get upgrade -y
apt-get dist-upgrade -y

# 2. 安装基础工具
log_step "[2/8] 安装基础工具..."
apt-get install -y \
    curl \
    wget \
    git \
    vim \
    net-tools \
    iputils-ping \
    telnet \
    netcat-openbsd \
    lsof \
    htop \
    tree \
    unzip \
    gnupg \
    apt-transport-https \
    ca-certificates \
    software-properties-common

# 3. 安装 Java 17
log_step "[3/8] 安装 OpenJDK 17..."
apt-get install -y openjdk-17-jdk openjdk-17-jre

# 验证 Java 安装
java -version
log_info "Java 安装完成: $(java -version 2>&1 | head -n 1)"

# 设置 JAVA_HOME
if ! grep -q "JAVA_HOME" /etc/profile; then
    echo 'export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64' >> /etc/profile
    echo 'export PATH=$JAVA_HOME/bin:$PATH' >> /etc/profile
    log_info "已设置 JAVA_HOME 环境变量"
fi

# 4. 安装 Maven
log_step "[4/8] 安装 Maven..."
apt-get install -y maven

# 验证 Maven 安装
mvn -version
log_info "Maven 安装完成"

# 配置 Maven 镜像 (阿里云)
MAVEN_SETTINGS="/usr/share/maven/conf/settings.xml"
if [ -f "$MAVEN_SETTINGS" ]; then
    if ! grep -q "aliyun" "$MAVEN_SETTINGS"; then
        log_info "配置 Maven 阿里云镜像..."
        sed -i '/<mirrors>/a \
    <mirror>\
      <id>aliyun</id>\
      <mirrorOf>central</mirrorOf>\
      <name>Aliyun Maven Mirror</name>\
      <url>https://maven.aliyun.com/repository/public</url>\
    </mirror>' "$MAVEN_SETTINGS"
    fi
fi

# 5. 安装 Docker
log_step "[5/8] 安装 Docker..."

# 添加 Docker 官方 GPG 密钥
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
chmod a+r /etc/apt/keyrings/docker.gpg

# 添加 Docker 软件源
echo \
    "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
    $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
    tee /etc/apt/sources.list.d/docker.list > /dev/null

# 安装 Docker
apt-get update
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# 启动并设置开机自启
systemctl start docker
systemctl enable docker

# 验证 Docker 安装
docker --version
docker compose version
log_info "Docker 安装完成"

# 将当前非 root 用户添加到 docker 组
if [ -n "$SUDO_USER" ]; then
    usermod -aG docker "$SUDO_USER"
    log_info "已将用户 $SUDO_USER 添加到 docker 组"
fi

# 6. 配置 Docker 镜像加速 (国内镜像)
log_step "[6/8] 配置 Docker 镜像加速..."
mkdir -p /etc/docker
cat > /etc/docker/daemon.json << 'EOF'
{
    "registry-mirrors": [
        "https://docker.1ms.run",
        "https://docker.xuanyuan.me"
    ],
    "log-driver": "json-file",
    "log-opts": {
        "max-size": "100m",
        "max-file": "3"
    },
    "storage-driver": "overlay2",
    "live-restore": true
}
EOF
systemctl daemon-reload
systemctl restart docker
log_info "Docker 镜像加速配置完成"

# 7. 配置系统参数
log_step "[7/8] 优化系统参数..."

# 内核参数优化
cat > /etc/sysctl.d/99-ha-ovp.conf << 'EOF'
# 网络优化
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 65535
net.ipv4.tcp_max_syn_backlog = 65535
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_keepalive_probes = 5
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_max_tw_buckets = 5000
net.ipv4.tcp_tw_reuse = 1
net.ipv4.ip_local_port_range = 1024 65535

# 内存优化
vm.swappiness = 10
vm.overcommit_memory = 1
vm.max_map_count = 262144

# 文件描述符
fs.file-max = 655350
fs.nr_open = 655350

# 对于 Redis
net.core.somaxconn = 65535
vm.overcommit_memory = 1
EOF
sysctl -p /etc/sysctl.d/99-ha-ovp.conf
log_info "系统参数优化完成"

# 文件描述符限制
cat > /etc/security/limits.d/99-ha-ovp.conf << 'EOF'
* soft nofile 655350
* hard nofile 655350
* soft nproc 655350
* hard nproc 655350
root soft nofile 655350
root hard nofile 655350
root soft nproc 655350
root hard nproc 655350
EOF
log_info "文件描述符限制配置完成"

# 8. 配置防火墙
log_step "[8/8] 配置防火墙..."
apt-get install -y ufw

# 设置默认策略
ufw default deny incoming
ufw default allow outgoing

# 允许 SSH
ufw allow 22/tcp

# 允许项目端口
# 基础设施端口
ufw allow 3306/tcp comment 'MySQL'
ufw allow 6379/tcp comment 'Redis'
ufw allow 26379/tcp comment 'Redis Sentinel'
ufw allow 8848:8849/tcp comment 'Nacos'
ufw allow 9876/tcp comment 'RocketMQ NameServer'
ufw allow 10909:10912/tcp comment 'RocketMQ Broker'
ufw allow 9000:9001/tcp comment 'MinIO'
ufw allow 8880/tcp comment 'Sentinel Dashboard'

# 微服务端口
ufw allow 9000:9006/tcp comment 'Microservices'

# Nginx
ufw allow 80/tcp comment 'HTTP'
ufw allow 443/tcp comment 'HTTPS'

# 启用防火墙 (谨慎操作，确保 SSH 已开放)
# ufw enable
log_warn "防火墙已配置但未启用，请手动执行 'ufw enable' 启用"

log_step "=========================================="
log_step "系统初始化完成!"
log_step "=========================================="

# 显示安装信息
echo ""
log_info "安装版本信息:"
echo "  - Java: $(java -version 2>&1 | head -n 1)"
echo "  - Maven: $(mvn -version 2>&1 | head -n 1)"
echo "  - Docker: $(docker --version)"
echo "  - Docker Compose: $(docker compose version)"
echo ""
log_info "请执行以下命令使环境变量生效:"
echo "  source /etc/profile"
echo ""
log_info "防火墙配置已完成，请根据需要执行:"
echo "  ufw enable    # 启用防火墙"
echo "  ufw status    # 查看状态"
echo ""
log_info "下一步: 请克隆项目并执行部署脚本"