267 lines
6.8 KiB
Bash
267 lines
6.8 KiB
Bash
#!/bin/bash
|
|
# ============================================================
|
|
# Debian 12 系统初始化脚本
|
|
# 用途: 在 Debian 12 上安装 Docker、Java 17、Maven 等依赖
|
|
# 使用: chmod +x init-debian12.sh && sudo ./init-debian12.sh
|
|
# ============================================================
|
|
|
|
set -e
|
|
|
|
# 颜色定义
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
BLUE='\033[0;34m'
|
|
NC='\033[0m'
|
|
|
|
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
|
|
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
|
|
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
|
|
log_step() { echo -e "${BLUE}[STEP]${NC} $1"; }
|
|
|
|
# 检查是否为 root 用户
|
|
if [ "$EUID" -ne 0 ]; then
|
|
log_error "请使用 root 用户或 sudo 执行此脚本"
|
|
exit 1
|
|
fi
|
|
|
|
# 检查系统版本
|
|
if [ ! -f /etc/os-release ]; then
|
|
log_error "无法检测系统版本"
|
|
exit 1
|
|
fi
|
|
|
|
. /etc/os-release
|
|
log_info "检测到系统: $PRETTY_NAME"
|
|
|
|
if [ "$ID" != "debian" ]; then
|
|
log_warn "此脚本专为 Debian 设计，当前系统: $ID"
|
|
read -p "是否继续? (y/n): " confirm
|
|
if [ "$confirm" != "y" ]; then
|
|
exit 0
|
|
fi
|
|
fi
|
|
|
|
log_step "=========================================="
|
|
log_step "开始初始化 Debian 12 系统"
|
|
log_step "=========================================="
|
|
|
|
# 1. 更新系统
|
|
log_step "[1/8] 更新系统软件包..."
|
|
apt-get update
|
|
apt-get upgrade -y
|
|
apt-get dist-upgrade -y
|
|
|
|
# 2. 安装基础工具
|
|
log_step "[2/8] 安装基础工具..."
|
|
apt-get install -y \
|
|
curl \
|
|
wget \
|
|
git \
|
|
vim \
|
|
net-tools \
|
|
iputils-ping \
|
|
telnet \
|
|
netcat-openbsd \
|
|
lsof \
|
|
htop \
|
|
tree \
|
|
unzip \
|
|
gnupg \
|
|
apt-transport-https \
|
|
ca-certificates \
|
|
software-properties-common
|
|
|
|
# 3. 安装 Java 17
|
|
log_step "[3/8] 安装 OpenJDK 17..."
|
|
apt-get install -y openjdk-17-jdk openjdk-17-jre
|
|
|
|
# 验证 Java 安装
|
|
java -version
|
|
log_info "Java 安装完成: $(java -version 2>&1 | head -n 1)"
|
|
|
|
# 设置 JAVA_HOME
|
|
if ! grep -q "JAVA_HOME" /etc/profile; then
|
|
echo 'export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64' >> /etc/profile
|
|
echo 'export PATH=$JAVA_HOME/bin:$PATH' >> /etc/profile
|
|
log_info "已设置 JAVA_HOME 环境变量"
|
|
fi
|
|
|
|
# 4. 安装 Maven
|
|
log_step "[4/8] 安装 Maven..."
|
|
apt-get install -y maven
|
|
|
|
# 验证 Maven 安装
|
|
mvn -version
|
|
log_info "Maven 安装完成"
|
|
|
|
# 配置 Maven 镜像 (阿里云)
|
|
MAVEN_SETTINGS="/usr/share/maven/conf/settings.xml"
|
|
if [ -f "$MAVEN_SETTINGS" ]; then
|
|
if ! grep -q "aliyun" "$MAVEN_SETTINGS"; then
|
|
log_info "配置 Maven 阿里云镜像..."
|
|
sed -i '/<mirrors>/a \
|
|
<mirror>\
|
|
<id>aliyun</id>\
|
|
<mirrorOf>central</mirrorOf>\
|
|
<name>Aliyun Maven Mirror</name>\
|
|
<url>https://maven.aliyun.com/repository/public</url>\
|
|
</mirror>' "$MAVEN_SETTINGS"
|
|
fi
|
|
fi
|
|
|
|
# 5. 安装 Docker
|
|
log_step "[5/8] 安装 Docker..."
|
|
|
|
# 添加 Docker 官方 GPG 密钥
|
|
install -m 0755 -d /etc/apt/keyrings
|
|
curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
|
|
chmod a+r /etc/apt/keyrings/docker.gpg
|
|
|
|
# 添加 Docker 软件源
|
|
echo \
|
|
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
|
|
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
|
|
tee /etc/apt/sources.list.d/docker.list > /dev/null
|
|
|
|
# 安装 Docker
|
|
apt-get update
|
|
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
|
|
|
|
# 启动并设置开机自启
|
|
systemctl start docker
|
|
systemctl enable docker
|
|
|
|
# 验证 Docker 安装
|
|
docker --version
|
|
docker compose version
|
|
log_info "Docker 安装完成"
|
|
|
|
# 将当前非 root 用户添加到 docker 组
|
|
if [ -n "$SUDO_USER" ]; then
|
|
usermod -aG docker "$SUDO_USER"
|
|
log_info "已将用户 $SUDO_USER 添加到 docker 组"
|
|
fi
|
|
|
|
# 6. 配置 Docker 镜像加速 (国内镜像)
|
|
log_step "[6/8] 配置 Docker 镜像加速..."
|
|
mkdir -p /etc/docker
|
|
cat > /etc/docker/daemon.json << 'EOF'
|
|
{
|
|
"registry-mirrors": [
|
|
"https://docker.1ms.run",
|
|
"https://docker.xuanyuan.me"
|
|
],
|
|
"log-driver": "json-file",
|
|
"log-opts": {
|
|
"max-size": "100m",
|
|
"max-file": "3"
|
|
},
|
|
"storage-driver": "overlay2",
|
|
"live-restore": true
|
|
}
|
|
EOF
|
|
systemctl daemon-reload
|
|
systemctl restart docker
|
|
log_info "Docker 镜像加速配置完成"
|
|
|
|
# 7. 配置系统参数
|
|
log_step "[7/8] 优化系统参数..."
|
|
|
|
# 内核参数优化
|
|
cat > /etc/sysctl.d/99-ha-ovp.conf << 'EOF'
|
|
# 网络优化
|
|
net.core.somaxconn = 65535
|
|
net.core.netdev_max_backlog = 65535
|
|
net.ipv4.tcp_max_syn_backlog = 65535
|
|
net.ipv4.tcp_fin_timeout = 30
|
|
net.ipv4.tcp_keepalive_time = 1200
|
|
net.ipv4.tcp_keepalive_probes = 5
|
|
net.ipv4.tcp_keepalive_intvl = 30
|
|
net.ipv4.tcp_max_tw_buckets = 5000
|
|
net.ipv4.tcp_tw_reuse = 1
|
|
net.ipv4.ip_local_port_range = 1024 65535
|
|
|
|
# 内存优化
|
|
vm.swappiness = 10
|
|
vm.overcommit_memory = 1
|
|
vm.max_map_count = 262144
|
|
|
|
# 文件描述符
|
|
fs.file-max = 655350
|
|
fs.nr_open = 655350
|
|
|
|
# 对于 Redis
|
|
net.core.somaxconn = 65535
|
|
vm.overcommit_memory = 1
|
|
EOF
|
|
sysctl -p /etc/sysctl.d/99-ha-ovp.conf
|
|
log_info "系统参数优化完成"
|
|
|
|
# 文件描述符限制
|
|
cat > /etc/security/limits.d/99-ha-ovp.conf << 'EOF'
|
|
* soft nofile 655350
|
|
* hard nofile 655350
|
|
* soft nproc 655350
|
|
* hard nproc 655350
|
|
root soft nofile 655350
|
|
root hard nofile 655350
|
|
root soft nproc 655350
|
|
root hard nproc 655350
|
|
EOF
|
|
log_info "文件描述符限制配置完成"
|
|
|
|
# 8. 配置防火墙
|
|
log_step "[8/8] 配置防火墙..."
|
|
apt-get install -y ufw
|
|
|
|
# 设置默认策略
|
|
ufw default deny incoming
|
|
ufw default allow outgoing
|
|
|
|
# 允许 SSH
|
|
ufw allow 22/tcp
|
|
|
|
# 允许项目端口
|
|
# 基础设施端口
|
|
ufw allow 3306/tcp comment 'MySQL'
|
|
ufw allow 6379/tcp comment 'Redis'
|
|
ufw allow 26379/tcp comment 'Redis Sentinel'
|
|
ufw allow 8848:8849/tcp comment 'Nacos'
|
|
ufw allow 9876/tcp comment 'RocketMQ NameServer'
|
|
ufw allow 10909:10912/tcp comment 'RocketMQ Broker'
|
|
ufw allow 9000:9001/tcp comment 'MinIO'
|
|
ufw allow 8880/tcp comment 'Sentinel Dashboard'
|
|
|
|
# 微服务端口
|
|
ufw allow 9000:9006/tcp comment 'Microservices'
|
|
|
|
# Nginx
|
|
ufw allow 80/tcp comment 'HTTP'
|
|
ufw allow 443/tcp comment 'HTTPS'
|
|
|
|
# 启用防火墙 (谨慎操作，确保 SSH 已开放)
|
|
# ufw enable
|
|
log_warn "防火墙已配置但未启用，请手动执行 'ufw enable' 启用"
|
|
|
|
log_step "=========================================="
|
|
log_step "系统初始化完成!"
|
|
log_step "=========================================="
|
|
|
|
# 显示安装信息
|
|
echo ""
|
|
log_info "安装版本信息:"
|
|
echo " - Java: $(java -version 2>&1 | head -n 1)"
|
|
echo " - Maven: $(mvn -version 2>&1 | head -n 1)"
|
|
echo " - Docker: $(docker --version)"
|
|
echo " - Docker Compose: $(docker compose version)"
|
|
echo ""
|
|
log_info "请执行以下命令使环境变量生效:"
|
|
echo " source /etc/profile"
|
|
echo ""
|
|
log_info "防火墙配置已完成，请根据需要执行:"
|
|
echo " ufw enable # 启用防火墙"
|
|
echo " ufw status # 查看状态"
|
|
echo ""
|
|
log_info "下一步: 请克隆项目并执行部署脚本"
|