Lee
8f5a35395d
All checks were successful
Java Maven 3.9.9 & JDK 26 CI/CD Pipeline / build-and-deploy (push) Successful in 9m30s
52 lines
2.1 KiB
Markdown
52 lines
2.1 KiB
Markdown
# Trace deployment on HK-1
|
|
|
|
The production stack lives at `/opt/trace` on `156.238.122.140` and is sized for a 1-core, 1-GiB host.
|
|
|
|
## Services
|
|
|
|
- MySQL 8.0.40: Docker-only `trace-net`; no host port is published.
|
|
- Gitea 1.22.6: HTTPS at `git.1633292.cn`; host ports 3000 and 2222 remain bound to loopback.
|
|
- Gitea Actions runner: capacity 1, label `centos-env`, Docker socket access.
|
|
- Trace: built by Gitea Actions, bound to `127.0.0.1:8080` and served by host Nginx.
|
|
- Nginx: HTTPS for `t.1633292.cn` and `git.1633292.cn`. Its stream module owns public port 443 and routes these two SNI names to local TLS virtual hosts; all other SNI traffic passes unchanged to Xray on `127.0.0.1:7443`.
|
|
|
|
## Bootstrap
|
|
|
|
Copy `compose.yaml`, `runner-config.yaml`, `nginx-trace.conf`, `nginx-sni.conf`, and `bootstrap-env.sh` to `/opt/trace`. Install `nginx-mod-stream` and `certbot`, issue certificates for both hostnames, move Xray's listener to `127.0.0.1:7443`, and add this top-level block to `/etc/nginx/nginx.conf`:
|
|
|
|
```nginx
|
|
stream {
|
|
include /etc/nginx/stream.d/*.conf;
|
|
}
|
|
```
|
|
|
|
Then run:
|
|
|
|
```bash
|
|
cd /opt/trace
|
|
chmod 700 bootstrap-env.sh
|
|
./bootstrap-env.sh
|
|
install -m 644 nginx-trace.conf /etc/nginx/conf.d/trace.conf
|
|
install -D -m 644 nginx-sni.conf /etc/nginx/stream.d/sni.conf
|
|
nginx -t && systemctl reload nginx
|
|
docker compose pull
|
|
docker compose up -d
|
|
```
|
|
|
|
`bootstrap-env.sh` creates random database and bootstrap passwords in `stack.env` and `app.env`, both mode 0600. Add `DEEPSEEK_API_KEY` and `MIMO_API_KEY` to `app.env` on the server; never commit either file.
|
|
|
|
## Operations
|
|
|
|
```bash
|
|
cd /opt/trace
|
|
docker compose ps
|
|
docker compose logs --tail 100 mysql gitea runner
|
|
docker stats --no-stream
|
|
curl -I https://t.1633292.cn/login
|
|
curl -I https://git.1633292.cn/user/login
|
|
```
|
|
|
|
Certbot's packaged systemd timer renews the certificates. A successful renewal must be followed by `systemctl reload nginx`; `/etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh` provides that hook on the server.
|
|
|
|
The workflow in `.gitea/workflows/deploy.yaml` builds on pushes to `dev`, joins the application to `trace-net`, loads `/opt/trace/app.env`, and replaces only `trace-container`.
|