From 81c3059892d6e915cb258863f7ed865ef82a5395 Mon Sep 17 00:00:00 2001 From: shanshanzhong Date: Tue, 26 May 2026 09:14:59 -0700 Subject: [PATCH] x --- .gitea/workflows/docker.yml | 2 +- aaa.conf | 76 ---- deploy/aws/ap-northeast-1/README.md | 358 ++++++++++++++++++ .../configs/aws-jp-infra.env.example | 55 +++ .../configs/backup-to-s3.env.example | 19 + ...mysql-seed-primary-and-replica.env.example | 21 + .../configs/ppanel.yaml.example | 112 ++++++ .../configs/replica-ops.env.example | 23 ++ .../configs/resource-inventory.current.md | 187 +++++++++ .../configs/resource-inventory.example.md | 69 ++++ .../ap-northeast-1/keys/ppanel-jp-recovery | 7 + .../keys/ppanel-jp-recovery.pub | 1 + .../aws/ap-northeast-1/nginx/ppanel-api.conf | 34 ++ deploy/systemd/hifast-mysql-backup.service | 17 + deploy/systemd/hifast-mysql-backup.timer | 11 + doc/withdrawal-api-zh.md | 144 +++++++ ops/hifast-aws-jp-cutover-checklist-zh.md | 116 ++++++ ops/hifast-aws-jp-migration-runbook-zh.md | 286 ++++++++++++++ ops/hifast-current-architecture-zh.md | 246 ++++++++++++ ops/hifast-s3-backup-runbook-zh.md | 36 ++ tempo/tempo-config.yaml | 37 ++ 21 files changed, 1780 insertions(+), 77 deletions(-) delete mode 100644 aaa.conf create mode 100644 deploy/aws/ap-northeast-1/README.md create mode 100644 deploy/aws/ap-northeast-1/configs/aws-jp-infra.env.example create mode 100644 deploy/aws/ap-northeast-1/configs/backup-to-s3.env.example create mode 100644 deploy/aws/ap-northeast-1/configs/mysql-seed-primary-and-replica.env.example create mode 100644 deploy/aws/ap-northeast-1/configs/ppanel.yaml.example create mode 100644 deploy/aws/ap-northeast-1/configs/replica-ops.env.example create mode 100644 deploy/aws/ap-northeast-1/configs/resource-inventory.current.md create mode 100644 deploy/aws/ap-northeast-1/configs/resource-inventory.example.md create mode 100644 deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery create mode 100644 deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery.pub create mode 100644 deploy/aws/ap-northeast-1/nginx/ppanel-api.conf create mode 100644 deploy/systemd/hifast-mysql-backup.service create mode 100644 deploy/systemd/hifast-mysql-backup.timer create mode 100644 doc/withdrawal-api-zh.md create mode 100644 ops/hifast-aws-jp-cutover-checklist-zh.md create mode 100644 ops/hifast-aws-jp-migration-runbook-zh.md create mode 100644 ops/hifast-current-architecture-zh.md create mode 100644 tempo/tempo-config.yaml diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml index 8685d7d..21854a9 100644 --- a/.gitea/workflows/docker.yml +++ b/.gitea/workflows/docker.yml @@ -22,7 +22,7 @@ env: SSH_KEY: ${{ secrets.AWS }} # TG通知 TG_BOT_TOKEN: 8114337882:AAHkEx03HSu7RxN4IHBJJEnsK9aPPzNLIk0 - TG_CHAT_ID: "-4940243803" + TG_CHAT_ID: "-494024380311" # Go构建变量 SERVICE: vpn SERVICE_STYLE: vpn diff --git a/aaa.conf b/aaa.conf deleted file mode 100644 index 685d49c..0000000 --- a/aaa.conf +++ /dev/null @@ -1,76 +0,0 @@ -upstream api_backend { - server 127.0.0.1:8080; -} - -server { - - listen 80; - server_name api.hifast.biz 4d3vsw888xgaen.hifast.biz; - location /.well-known/acme-challenge/ { - root /var/www/html; - allow all; - } - location / { - return 301 https://$host$request_uri; - } -} - -server { - listen 443 ssl http2; - server_name api.hifast.biz; - client_max_body_size 150M; - ssl_certificate /etc/nginx/ssl/hifast.biz/_.hifast.biz.pem; # managed by Certbot - ssl_certificate_key /etc/nginx/ssl/hifast.biz/_.hifast.biz.key; # managed by Certbot - - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; - add_header X-Frame-Options "DENY"; - - add_header X-Content-Type-Options nosniff; - if ($http_user_agent ~* '(9999|91\.78)') { - return 444; - } - location ~ ^/v1/common/client/download/file/(?Hi快VPN-(?windows|mac|android)-1.0.0-ic-.*\.(?exe|dmg|apk))$ { - alias /var/www/download/Hi快VPN-$os-1.0.0.$ext; - charset utf-8; - add_header Content-Disposition 'attachment; filename="$download_name"'; - add_header Content-Type application/octet-stream; - } - - location /v1/common/client/download/file/ { - alias /var/www/download/; - } - - location / { - proxy_pass http://api_backend; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - } - -} - -server { - listen 443 ssl http2; - server_name 4d3vsw888xgaen.hifast.biz; - client_max_body_size 150M; - ssl_certificate /etc/nginx/ssl/hifast.biz/_.hifast.biz.pem; # managed by Certbot - ssl_certificate_key /etc/nginx/ssl/hifast.biz/_.hifast.biz.key; # managed by Certbot - - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; - add_header X-Frame-Options DENY; - add_header X-Content-Type-Options nosniff; - - gzip on; - gzip_vary on; - gzip_min_length 1024; - gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json image/svg+xml; - root /var/www/admin; - location / { - try_files $uri $uri/ /index.html; - } - -} \ No newline at end of file diff --git a/deploy/aws/ap-northeast-1/README.md b/deploy/aws/ap-northeast-1/README.md new file mode 100644 index 0000000..c4272ed --- /dev/null +++ b/deploy/aws/ap-northeast-1/README.md @@ -0,0 +1,358 @@ +# PPanel 日本东京区 AWS 部署说明 + +本目录用于在 **AWS 日本东京区 `ap-northeast-1`** 重建一套全新生产环境，并承接当前香港区 `ap-east-1` 的正式迁移。 + +如果你要看“当前已经真实跑起来的东京架构”，优先看： + +- [`ops/hifast-current-architecture-zh.md`](/Users/Apple/code_vpn/vpn/ppanel-server/ops/hifast-current-architecture-zh.md) +- [`configs/resource-inventory.current.md`](./configs/resource-inventory.current.md) + +这份 README 更偏向： + +- 目标架构 +- 资源规划 +- 部署方法 +- 后续待完成项 + +目标架构： + +`DNS -> ALB -> WAF -> EC2(Nginx + ppanel-server + Redis + observability) -> RDS MySQL` + +灾备链路： + +`RDS MySQL / EC2 Redis -> 104.238.220.230 外部灾备` + +当前仓库内已补充： + +- 东京基础设施参数模板：[`configs/aws-jp-infra.env.example`](./configs/aws-jp-infra.env.example) +- 东京真实实施状态登记：[`configs/resource-inventory.current.md`](./configs/resource-inventory.current.md) +- 东京底座资源创建脚本：[`../../scripts/aws_jp_create_base_infra.sh`](../../scripts/aws_jp_create_base_infra.sh) +- 东京资源状态检查脚本：[`../../scripts/aws_jp_describe_state.sh`](../../scripts/aws_jp_describe_state.sh) +- MySQL 备份脚本：[`../../scripts/mysql_backup_to_s3.sh`](../../scripts/mysql_backup_to_s3.sh) +- 10 分钟 MySQL 备份定时器安装脚本：[`../../scripts/install_mysql_backup_timer.sh`](../../scripts/install_mysql_backup_timer.sh) + +## 1. 资源清单 + +按下面顺序创建资源： + +1. VPC +2. 2 个公有子网 + 2 个私有子网 +3. Internet Gateway +4. 公有 / 私有路由表 +5. 安全组 +6. RDS MySQL +7. EC2 本机 Redis Docker +8. EC2 +9. ACM 证书 +10. ALB + Target Group +11. WAF Web ACL +12. 东京平行环境域名 +13. 东京 S3 备份桶 + +建议命名： + +- VPC: `ppanel-jp-prod` +- EC2: `ppanel-app-jp-01` +- RDS: `ppanel-mysql-jp` +- Redis container: `hifast-redis` +- ALB: `ppanel-alb-jp` +- WAF: `ppanel-waf-jp` +- S3: `hifast-prod-backups-200810848252-ap-northeast-1` + +## 2. 默认规格 + +### EC2 + +- Region: `ap-northeast-1` +- OS: Ubuntu 24.04 LTS +- Instance type: `t4g.large` +- Disk: `gp3 80GB` +- Public subnet: 是 +- IAM Role: + - 允许读取 CloudWatch / SSM（如使用） + - 如果要在东京 EC2 上执行 S3 备份：额外允许写入东京备份桶 + +### RDS MySQL + +- Engine: `MySQL 8.4` +- Class: `db.r7g.xlarge` +- Storage: `gp3 100GB` +- DB name: `hifast` +- Username: `admin` +- Public access: `Yes` +- Charset: `utf8mb4` +- Backup retention: `7-14 days` +- Deletion protection: `On` +- Multi-AZ: `Yes`（当前按 2 实例 Multi-AZ 创建） + +说明： + +- 当前东京 RDS 需要允许 `104.238.220.230` 从公网直连 `3306`，用于外部 MySQL 从库复制 +- 因此本阶段 RDS 使用 `public subnet group + Publicly accessible = Yes` +- 访问面只通过 `sg-rds` 严格限制到业务 EC2 安全组和 `104.238.220.230/32` + +### Redis + +- 部署位置：业务 EC2 本机 +- 部署方式：Docker +- 版本：`redis:8.2.1` +- 监听：`0.0.0.0:6379` +- 应用连接：`127.0.0.1:6379` +- 安全组：仅对白名单备用节点 `104.238.220.230/32` 或同机应用开放 + +## 3. 网络与安全组 + +### 子网布局 + +- `public-a`, `public-c`: ALB / EC2 +- `private-a`, `private-c`: RDS + +说明： + +- 东京优先使用 `ap-northeast-1a` 和 `ap-northeast-1c` +- 如果账户映射不同，也可以用任意 2 个可用区，但公私网必须各 2 个子网 + +### 安全组建议 + +#### `sg-alb` + +- Inbound + - `80/tcp` from `0.0.0.0/0` + - `443/tcp` from `0.0.0.0/0` +- Outbound + - `80/tcp` to `sg-ec2` + +#### `sg-ec2` + +- Inbound + - `80/tcp` from `sg-alb` + - `22/tcp` from `你的固定运维 IP` + - `6379/tcp` from `104.238.220.230/32` +- Outbound + - all + +说明： + +- 应用容器监听 `127.0.0.1:8080` +- EC2 对外只让 Nginx 监听 `80` +- Grafana / Prometheus / Tempo 仅监听 `127.0.0.1` + +#### `sg-rds` + +- Inbound + - `3306/tcp` from `sg-ec2` + - `3306/tcp` from `104.238.220.230/32` + +## 4. ALB / Target Group / 健康检查 + +### Target Group + +- Type: `Instance` +- Protocol: `HTTP` +- Port: `80` +- Health check path: `/v1/common/heartbeat` +- Success code: `200` + +### ALB 监听器 + +- `80` -> redirect to `443` +- `443` -> forward 到 target group + +### ACM + +- 在 `ap-northeast-1` 重新申请证书 +- 先给平行环境域名，例如： + - `api-jp.hifast.biz` + - `logs-jp.hifast.biz` + +## 5. WAF 规则 + +首版至少启用： + +1. `AWSManagedRulesCommonRuleSet` +2. `AWSManagedRulesKnownBadInputsRuleSet` +3. `AWSManagedRulesAmazonIpReputationList` +4. 全站 rate-based rule +5. 针对高风险路径的 rate-based rule + +建议的第一版限流： + +- 全站：每 IP `2000 / 5 分钟` +- `/v1/public/user/subscribe`：每 IP `300 / 5 分钟` +- 登录 / 注册 / 验证码接口：每 IP `100 / 5 分钟` + +节点上报接口建议后续补： + +- `/v1/server/status` +- `/v1/server/online` +- `/v1/server/traffic` + +## 6. EC2 文件落地 + +在 EC2 上建议使用： + +- 应用目录：`/opt/ppanel` +- Nginx 配置：`/etc/nginx/sites-available/ppanel-api.conf` + +需要上传这些文件 / 目录： + +- `docker-compose.cloud.yml` +- `deploy/aws/ap-northeast-1/configs/ppanel.yaml.example` -> 重命名为 `configs/ppanel.yaml` +- `deploy/aws/ap-northeast-1/nginx/ppanel-api.conf` +- `grafana/` +- `loki/` +- `prometheus/` +- `tempo/` +- `.env.example` -> 重命名为 `.env` + +目标目录示例： + +```text +/opt/ppanel/ + docker-compose.cloud.yml + .env + configs/ppanel.yaml + grafana/ + loki/ + prometheus/ + tempo/ + logs/ + cache/ + tempo_data/ +``` + +## 7. 应用配置 + +基线模板见： + +- [`configs/ppanel.yaml.example`](./configs/ppanel.yaml.example) +- [`nginx/ppanel-api.conf`](./nginx/ppanel-api.conf) + +关键值必须替换： + +- `MySQL.Addr` +- `MySQL.Password` +- `Redis.Host` +- `Redis.Pass` +- `JwtAuth.AccessSecret` +- `Administrator.Email` +- `Administrator.Password` +- `AppSignature.AppSecrets.*` +- `device.security_secret` +- `Site.Host` +- `Site.SiteName` + +Redis 约定保持不变： + +- 业务缓存：DB `0` +- Asynq：DB `5` + +## 8. 部署步骤 + +### 8.0 创建东京基础设施 + +如果本机或跳板机已经配置好 AWS CLI 凭据，可以先直接执行： + +```bash +cp deploy/aws/ap-northeast-1/configs/aws-jp-infra.env.example /root/aws-jp-infra.env +chmod 600 /root/aws-jp-infra.env +vim /root/aws-jp-infra.env + +chmod +x deploy/scripts/aws_jp_create_base_infra.sh +bash deploy/scripts/aws_jp_create_base_infra.sh /root/aws-jp-infra.env +``` + +执行后可用下面命令随时核对东京底座状态： + +```bash +chmod +x deploy/scripts/aws_jp_describe_state.sh +bash deploy/scripts/aws_jp_describe_state.sh /root/aws-jp-infra.env +``` + +### 8.1 初始化 EC2 + +把脚本上传到东京 EC2 后执行： + +```bash +chmod +x deploy/scripts/bootstrap_aws_ec2.sh +sudo APP_DIR=/opt/ppanel APP_USER=ubuntu deploy/scripts/bootstrap_aws_ec2.sh +``` + +### 8.2 安装 Nginx 配置 + +```bash +sudo cp deploy/aws/ap-northeast-1/nginx/ppanel-api.conf /etc/nginx/sites-available/ppanel-api.conf +sudo ln -sf /etc/nginx/sites-available/ppanel-api.conf /etc/nginx/sites-enabled/ppanel-api.conf +sudo nginx -t +sudo systemctl reload nginx +``` + +### 8.3 启动容器 + +```bash +cd /opt/ppanel +docker compose -f docker-compose.cloud.yml up -d +``` + +### 8.4 预检 + +```bash +chmod +x deploy/scripts/preflight_aws_jp.sh +APP_DIR=/opt/ppanel \ +RDS_HOST= \ +REDIS_HOST=127.0.0.1 \ +deploy/scripts/preflight_aws_jp.sh +``` + +## 9. 数据迁移与切换 + +正式迁移请按： + +- [`ops/hifast-aws-jp-migration-runbook-zh.md`](/Users/Apple/code_vpn/vpn/ppanel-server/ops/hifast-aws-jp-migration-runbook-zh.md) + +执行。 + +核心原则： + +- 先搭平行环境 +- 停机后再导出香港主数据 +- 东京验收通过后再切正式域名 +- 切换后再重挂 `104` 灾备 + +## 10. 104 灾备节点常用模板 + +如果迁移完成后要把 `104.238.220.230` 重挂为东京主站从库，可复用： + +- [`deploy/scripts/hifast_mysql_seed_primary_and_replica.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_mysql_seed_primary_and_replica.sh) +- [`deploy/scripts/hifast_mysql_attach_replica.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_mysql_attach_replica.sh) +- [`deploy/scripts/hifast_redis_attach_replica.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_redis_attach_replica.sh) +- [`deploy/scripts/hifast_data_sync_tool.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_data_sync_tool.sh) +- [`configs/replica-ops.env.example`](./configs/replica-ops.env.example) + +## 11. 东京资源创建前置检查 + +在 AWS 控制台里至少先确认： + +- 东京区已启用 +- `ap-northeast-1` 可创建 `t4g.large` +- `ap-northeast-1` RDS 可创建 `db.r7g.xlarge` +- ACM / ALB / WAF / S3 服务在东京区可正常使用 +- Tokyo 对应配额满足： + - On-Demand Standard vCPU + - ALB 数量 + - Elastic IP（如需） + - RDS 实例数 + +## 12. 当前已知真实进度 + +截至 `2026-05-20`，已知状态如下： + +- 东京 VPC `ppanel-jp-prod` 已创建 +- VPC ID: `vpc-0846b23b4a7d64eac` +- VPC CIDR: `10.20.0.0/16` +- 4 个子网在 AWS 控制台里曾填写完成，但提交时控制台 session 失效 +- 因此： + - 子网是否真正创建成功，需要重新核实 + - IGW / 路由表 / 安全组 / RDS / EC2 / ALB / WAF 都应按“未完成”处理，重新复核 + +实时状态请以后续更新的 [`configs/resource-inventory.current.md`](./configs/resource-inventory.current.md) 为准。 diff --git a/deploy/aws/ap-northeast-1/configs/aws-jp-infra.env.example b/deploy/aws/ap-northeast-1/configs/aws-jp-infra.env.example new file mode 100644 index 0000000..583b37d --- /dev/null +++ b/deploy/aws/ap-northeast-1/configs/aws-jp-infra.env.example @@ -0,0 +1,55 @@ +AWS_REGION=ap-northeast-1 +AWS_ACCOUNT_ID=200810848252 + +VPC_NAME=ppanel-jp-prod +VPC_ID= +VPC_CIDR=10.20.0.0/16 + +PUBLIC_SUBNET_A_NAME=ppanel-jp-public-a +PUBLIC_SUBNET_A_AZ=ap-northeast-1a +PUBLIC_SUBNET_A_CIDR=10.20.0.0/24 + +PUBLIC_SUBNET_C_NAME=ppanel-jp-public-c +PUBLIC_SUBNET_C_AZ=ap-northeast-1c +PUBLIC_SUBNET_C_CIDR=10.20.1.0/24 + +PRIVATE_SUBNET_A_NAME=ppanel-jp-private-a +PRIVATE_SUBNET_A_AZ=ap-northeast-1a +PRIVATE_SUBNET_A_CIDR=10.20.10.0/24 + +PRIVATE_SUBNET_C_NAME=ppanel-jp-private-c +PRIVATE_SUBNET_C_AZ=ap-northeast-1c +PRIVATE_SUBNET_C_CIDR=10.20.11.0/24 + +IGW_NAME=ppanel-jp-igw +PUBLIC_ROUTE_TABLE_NAME=ppanel-jp-public-rt +PRIVATE_ROUTE_TABLE_NAME=ppanel-jp-private-rt + +SG_ALB_NAME=ppanel-jp-sg-alb +SG_EC2_NAME=ppanel-jp-sg-ec2 +SG_RDS_NAME=ppanel-jp-sg-rds + +OPS_SSH_CIDR=CHANGE_ME_TO_YOUR_FIXED_PUBLIC_IP_OR_CIDR +DR_REPLICA_IP=104.238.220.230/32 + +EC2_NAME=ppanel-app-jp-01 +EC2_AMI_FAMILY=ubuntu-24.04 +EC2_INSTANCE_TYPE=t4g.large +EC2_DISK_GB=80 +EC2_KEY_PAIR=CHANGE_ME + +RDS_IDENTIFIER=ppanel-mysql-jp +RDS_DB_NAME=hifast +RDS_ADMIN_USER=admin +RDS_INSTANCE_CLASS=db.r7g.xlarge +RDS_STORAGE_GB=100 + +ALB_NAME=ppanel-alb-jp +TARGET_GROUP_NAME=ppanel-tg-jp +WAF_NAME=ppanel-waf-jp + +PARALLEL_API_DOMAIN=api-jp.hifast.biz +PARALLEL_LOGS_DOMAIN=logs-jp.hifast.biz +PRODUCTION_API_DOMAIN=CHANGE_ME + +S3_BACKUP_BUCKET=hifast-prod-backups-200810848252-ap-northeast-1 diff --git a/deploy/aws/ap-northeast-1/configs/backup-to-s3.env.example b/deploy/aws/ap-northeast-1/configs/backup-to-s3.env.example new file mode 100644 index 0000000..1a72193 --- /dev/null +++ b/deploy/aws/ap-northeast-1/configs/backup-to-s3.env.example @@ -0,0 +1,19 @@ +AWS_REGION=ap-northeast-1 +S3_BUCKET=hifast-prod-backups-200810848252-ap-northeast-1 +S3_PREFIX=mysql +BACKUP_DIR=/var/backups/hifast +HOST_TAG=104-standby-for-jp +KEEP_LOCAL_DAYS=3 +CHECK_REPLICA=1 + +MYSQL_HOST=127.0.0.1 +MYSQL_PORT=3306 +MYSQL_USER=backup_reader +MYSQL_PASSWORD=CHANGE_ME +MYSQL_SOCKET= +MYSQL_DATABASE=hifast + +REDIS_HOST=127.0.0.1 +REDIS_PORT=6379 +REDIS_PASSWORD=CHANGE_ME + diff --git a/deploy/aws/ap-northeast-1/configs/mysql-seed-primary-and-replica.env.example b/deploy/aws/ap-northeast-1/configs/mysql-seed-primary-and-replica.env.example new file mode 100644 index 0000000..93535fc --- /dev/null +++ b/deploy/aws/ap-northeast-1/configs/mysql-seed-primary-and-replica.env.example @@ -0,0 +1,21 @@ +PRIMARY_HOST=ppanel-mysql-jp..ap-northeast-1.rds.amazonaws.com +PRIMARY_PORT=3306 +PRIMARY_USER=admin +PRIMARY_PASSWORD=CHANGE_ME +PRIMARY_DB=hifast + +PRIMARY_REPL_USER=repl +PRIMARY_REPL_PASSWORD=CHANGE_ME +PRIMARY_REPL_HOST=104.238.220.230 +PRIMARY_BINLOG_RETENTION_HOURS=24 + +REPLICA_HOST=127.0.0.1 +REPLICA_PORT=3306 +REPLICA_USER=root +REPLICA_PASSWORD= +REPLICA_SOCKET=/var/run/mysqld/mysqld.sock +REPLICA_DB=hifast +REPLICA_SOURCE_SSL=1 + +DUMP_FILE= + diff --git a/deploy/aws/ap-northeast-1/configs/ppanel.yaml.example b/deploy/aws/ap-northeast-1/configs/ppanel.yaml.example new file mode 100644 index 0000000..2173937 --- /dev/null +++ b/deploy/aws/ap-northeast-1/configs/ppanel.yaml.example @@ -0,0 +1,112 @@ +Host: 0.0.0.0 +Port: 8080 +Debug: false + +JwtAuth: + AccessSecret: CHANGE_ME_TO_A_LONG_RANDOM_SECRET + AccessExpire: 604800 + +Logger: + ServiceName: PPanel + Mode: console + Encoding: plain + TimeFormat: "2006-01-02 15:04:05.000" + Path: logs + Level: info + MaxContentLength: 0 + Compress: false + Stat: true + KeepDays: 7 + StackCooldownMillis: 100 + MaxBackups: 7 + MaxSize: 100 + Rotation: daily + FileTimeFormat: "2006-01-02T15:04:05.000Z07:00" + +MySQL: + Addr: YOUR_TOKYO_RDS_ENDPOINT:3306 + Dbname: hifast + Username: admin + Password: CHANGE_ME_TO_TOKYO_RDS_PASSWORD + Config: charset=utf8mb4&parseTime=true&loc=Asia%2FTokyo + MaxIdleConns: 10 + MaxOpenConns: 100 + SlowThreshold: 1000 + +Redis: + Host: 127.0.0.1:6379 + Pass: CHANGE_ME_TO_TOKYO_REDIS_PASSWORD + DB: 0 + PoolSize: 100 + MinIdleConns: 10 + MaxRetries: 3 + PoolTimeout: 4 + IdleTimeout: 300 + MaxConnAge: 0 + DialTimeout: 5 + ReadTimeout: 3 + WriteTimeout: 3 + +Trace: + Name: ppanel-server + Endpoint: 127.0.0.1:4317 + Sampler: 0.1 + Batcher: otlpgrpc + +Site: + Host: api-jp.hifast.biz + SiteName: HiFastVPN + +Administrator: + Email: admin@example.com + Password: CHANGE_ME_TO_STRONG_ADMIN_PASSWORD + +Telegram: + Enable: false + BotID: 0 + BotName: "" + BotToken: "" + GroupChatID: "" + EnableNotify: false + WebHookDomain: "" + +Kutt: + Enable: false + ApiURL: "" + ApiKey: "" + TargetURL: "" + Domain: "" + +OpenInstall: + Enable: false + AppKey: "" + ApiKey: "" + +Loki: + Enable: true + URL: "http://localhost:3100" + +AppSignature: + AppSecrets: + android-client: CHANGE_ME_ANDROID_SIGNATURE_SECRET + ios-client: CHANGE_ME_IOS_SIGNATURE_SECRET + web-client: CHANGE_ME_WEB_SIGNATURE_SECRET + ValidWindowSeconds: 300 + SkipPrefixes: + - /v1/notify/ + - /v1/iap/notifications + - /v1/telegram/webhook + - /v1/subscribe/config + +Signature: + EnableSignature: false + +device: + enable: true + security_secret: CHANGE_ME_DEVICE_SECURITY_SECRET + +Register: + EnableTrial: true + EnableTrialEmailWhitelist: true + TrialEmailDomainWhitelist: "gmail.com,outlook.com,icloud.com,qq.com,163.com" + diff --git a/deploy/aws/ap-northeast-1/configs/replica-ops.env.example b/deploy/aws/ap-northeast-1/configs/replica-ops.env.example new file mode 100644 index 0000000..8f4b19b --- /dev/null +++ b/deploy/aws/ap-northeast-1/configs/replica-ops.env.example @@ -0,0 +1,23 @@ +MYSQL_HOST=127.0.0.1 +MYSQL_PORT=3306 +MYSQL_USER=root +MYSQL_PASSWORD=CHANGE_ME +MYSQL_SOCKET= + +REPL_SOURCE_HOST=ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com +REPL_SOURCE_PORT=3306 +REPL_SOURCE_USER=repl +REPL_SOURCE_PASSWORD=XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer +REPL_SOURCE_SSL=1 +REPL_SOURCE_LOG_FILE=mysql-bin-changelog.000189 +REPL_SOURCE_LOG_POS=185053 +REPL_SOURCE_AUTO_POSITION=1 + +REDIS_HOST=127.0.0.1 +REDIS_PORT=6379 +REDIS_PASSWORD=CHANGE_ME + +REDIS_SOURCE_HOST=3.114.29.208 +REDIS_SOURCE_PORT=6379 +REDIS_SOURCE_USER= +REDIS_SOURCE_PASSWORD=hifast67yj diff --git a/deploy/aws/ap-northeast-1/configs/resource-inventory.current.md b/deploy/aws/ap-northeast-1/configs/resource-inventory.current.md new file mode 100644 index 0000000..628847e --- /dev/null +++ b/deploy/aws/ap-northeast-1/configs/resource-inventory.current.md @@ -0,0 +1,187 @@ +# Tokyo Resource Inventory + +最后更新：`2026-05-21` + +这个文件记录当前东京迁移的真实实施状态，不是示例。 + +## Region + +- AWS account: `hifastvpn (200810848252)` +- Region: `ap-northeast-1` + +## Current Status + +- 东京迁移方案已在仓库内落地为执行资产 +- 东京 VPC 已创建 +- 东京子网、IGW、路由表已在 AWS 控制台创建并复核 +- 东京三层安全组已在 AWS 控制台创建并复核 +- 东京 VPC DNS 开关已开启，可支持公网可访问 RDS +- 东京 S3 备份桶已在 AWS 控制台创建并复核 +- 东京 ACM 证书请求已创建，等待 DNS 验证 +- 东京 RDS MySQL 已创建完成并可用 +- 东京业务 EC2 已创建完成并绑定固定 EIP +- 因当前本机没有可用 AWS CLI 凭据，云上资源状态仍需在 AWS 控制台或已登录环境中复查 + +## Networking + +- VPC + - Name: `ppanel-jp-prod` + - VPC ID: `vpc-0846b23b4a7d64eac` + - CIDR: `10.20.0.0/16` + - Status: `created` +- Public subnet A + - Name: `ppanel-jp-public-a` + - AZ: `ap-northeast-1a` + - CIDR: `10.20.0.0/24` + - Subnet ID: `subnet-091232bdb53e71490` + - Status: `created` +- Public subnet C + - Name: `ppanel-jp-public-c` + - AZ: `ap-northeast-1c` + - CIDR: `10.20.1.0/24` + - Subnet ID: `subnet-01ba0975c525ce8cf` + - Status: `created` +- Private subnet A + - Name: `ppanel-jp-private-a` + - AZ: `ap-northeast-1a` + - CIDR: `10.20.10.0/24` + - Subnet ID: `subnet-0bd13111c02f0edbe` + - Status: `created` +- Private subnet C + - Name: `ppanel-jp-private-c` + - AZ: `ap-northeast-1c` + - CIDR: `10.20.11.0/24` + - Subnet ID: `subnet-0d86c5c756dbc84b2` + - Status: `created` +- Internet Gateway + - Name: `ppanel-jp-igw` + - IGW ID: `igw-028041bcbf63b672c` + - Status: `created` +- Public route table + - Name: `ppanel-jp-public-rt` + - Route Table ID: `rtb-061b101080e4800e5` + - Default route: `0.0.0.0/0 -> igw-028041bcbf63b672c` + - Status: `created` +- Private route table + - Name: `ppanel-jp-private-rt` + - Route Table ID: `rtb-0d7a191a515031c45` + - Status: `created` + +## Security + +- `sg-alb` + - Name: `ppanel-jp-sg-alb` + - Security Group ID: `sg-0b3a23c31041a5a5a` + - Inbound: + - `80/tcp <- 0.0.0.0/0` + - `443/tcp <- 0.0.0.0/0` + - Status: `created` +- `sg-ec2` + - Name: `ppanel-jp-sg-ec2` + - Security Group ID: `sg-01f2a5a81e7505c91` + - Inbound: + - `80/tcp <- sg-0b3a23c31041a5a5a` + - `22/tcp <- 64.118.144.142/32` + - `6379/tcp <- 104.238.220.230/32` + - Status: `created` +- `sg-rds` + - Name: `ppanel-jp-sg-rds` + - Security Group ID: `sg-0b71db1e2c18b57c0` + - Inbound: + - `3306/tcp <- sg-01f2a5a81e7505c91` + - `3306/tcp <- 104.238.220.230/32` + - Status: `created` + +## Compute / Database / Edge + +- EC2 `ppanel-app-jp-01`: + - Instance ID: `i-07839130074cd7ed9` + - Type: `c7i.xlarge` + - Platform: `Ubuntu 26.04 / Linux` + - AZ: `ap-northeast-1c` + - VPC: `ppanel-jp-prod (vpc-0846b23b4a7d64eac)` + - Subnet: `ppanel-jp-public-c (subnet-01ba0975c525ce8cf)` + - Private IP: `10.20.1.168` + - Public IP / Elastic IP: `3.114.29.208` + - Public DNS: `ec2-3-114-29-208.ap-northeast-1.compute.amazonaws.com` + - Security group: `ppanel-jp-sg-ec2 (sg-01f2a5a81e7505c91)` + - Key pair: `ppanel-jp-key-20260521` + - Root volume: `gp3 100GiB` + - ENI: `eni-08accb427a470c9f7` + - EIP allocation ID: `eipalloc-038b32d5c0119accf` + - EIP association ID: `eipassoc-09184aa9161b6a4d9` + - Status: `running` + - SSH recovery private key: `deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery` + - SSH recovery public key: `deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery.pub` +- RDS subnet group: + - Name: `ppanel-jp-rds-subnet-group` + - VPC: `vpc-0846b23b4a7d64eac` + - Subnets: + - `subnet-0bd13111c02f0edbe` / `ppanel-jp-private-a` + - `subnet-0d86c5c756dbc84b2` / `ppanel-jp-private-c` + - Status: `created` +- RDS public subnet group: + - Name: `ppanel-jp-rds-public-subnet-group` + - VPC: `vpc-0846b23b4a7d64eac` + - Subnets: + - `subnet-091232bdb53e71490` / `ppanel-jp-public-a` + - `subnet-01ba0975c525ce8cf` / `ppanel-jp-public-c` + - Status: `created` +- RDS `ppanel-mysql-jp`: + - Engine: `MySQL Community 8.4.8` + - Class: `db.r7g.xlarge` + - Storage: `gp3 100GiB` + - Deployment: `Single instance (current actual state)` + - VPC: `ppanel-jp-prod (vpc-0846b23b4a7d64eac)` + - Subnet group: `ppanel-jp-rds-public-subnet-group` + - Security group: `ppanel-jp-sg-rds (sg-0b71db1e2c18b57c0)` + - Master username: `admin` + - Credential management: `self-managed` + - Secrets Manager managed password: `disabled` + - Current master password visibility: `not retrievable from AWS console; reset only` + - Public access: `enabled (set at creation time for external replication)` + - Status: `available` + - Endpoint: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com` + - Public IP (resolved via public DNS): `52.196.204.186` + - Connection test from Tokyo EC2: + - `mysql -h ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com -u admin -e "select 1"` + - Result: `ERROR 1045 (28000): Access denied for user 'admin'@'ip-10-20-1-168.ap-northeast-1.compute.internal' (using password: NO)` + - Meaning: `network path and security group are working; only the password is missing` + - Current admin password: `TkyRds20260521!N9mQ8sKe2vLp7Xa` + - External replica prep for `104.238.220.230`: + - binlog retention hours: `24` + - replication user: `repl@104.238.220.230` + - replication password: `XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer` + - current binlog file: `mysql-bin-changelog.000189` + - current binlog position: `185053` +- ALB `ppanel-alb-jp`: `not created` +- WAF `ppanel-waf-jp`: `not created` +- ACM certificate in `ap-northeast-1`: + - Certificate ID: `29d0b9b6-ab37-44d9-ad9e-18fa7e9aae3a` + - Domains: + - `api-jp.hifast.biz` + - `logs-jp.hifast.biz` + - Status: `pending_validation` + - Route 53 hosted zone in current AWS account: `not found` +- S3 backup bucket `hifast-prod-backups-200810848252-ap-northeast-1`: `created` + +## Domains + +- Parallel API domain: `api-jp.hifast.biz` +- Parallel logs domain: `logs-jp.hifast.biz` +- Production API domain: `pending user final confirmation` +- ACM DNS validation records pending external DNS add: + - `api-jp.hifast.biz` + - Name: `_0de5970dfbadaf46759447b2ea627a10.api-jp.hifast.biz.` + - Type: `CNAME` + - Value: `_6a632a5b85c5b3f304cc492090b741b3.jkddzztszm.acm-validations.aws.` + - `logs-jp.hifast.biz` + - Name: `_349a2b2bc4678d76c3ab341ccf73db61.logs-jp.hifast.biz.` + - Type: `CNAME` + - Value: `_74ced20dc96aa39070188605cf0ced18.jkddzztszm.acm-validations.aws.` + +## DR + +- DR host: `104.238.220.230` +- Planned MySQL upstream after cutover: `Tokyo RDS` +- Planned Redis upstream after cutover: `Tokyo EC2 public IP` diff --git a/deploy/aws/ap-northeast-1/configs/resource-inventory.example.md b/deploy/aws/ap-northeast-1/configs/resource-inventory.example.md new file mode 100644 index 0000000..c58e1ce --- /dev/null +++ b/deploy/aws/ap-northeast-1/configs/resource-inventory.example.md @@ -0,0 +1,69 @@ +# Tokyo Resource Inventory Example + +Use this file as the single source of truth while building the Tokyo environment. + +## Region + +- AWS account: `hifastvpn (200810848252)` +- Region: `ap-northeast-1` + +## DNS + +- Production API domain: `CHANGE_ME` +- Parallel API domain: `api-jp.hifast.biz` +- Parallel logs domain: `logs-jp.hifast.biz` + +## Networking + +- VPC name: `ppanel-jp-prod` +- VPC CIDR: `10.20.0.0/16` +- Public subnet A: `10.20.0.0/24` +- Public subnet C: `10.20.1.0/24` +- Private subnet A: `10.20.10.0/24` +- Private subnet C: `10.20.11.0/24` +- Ops CIDR for SSH: `CHANGE_ME` + +## Compute + +- EC2 name: `ppanel-app-jp-01` +- EC2 type: `t4g.large` +- EC2 disk: `gp3 80GB` +- SSH key pair: `CHANGE_ME` + +## Database + +- RDS identifier: `ppanel-mysql-jp` +- RDS engine: `MySQL 8.4` +- RDS class: `db.r7g.xlarge` +- RDS storage: `gp3 100GB` +- DB name: `hifast` +- DB admin user: `admin` + +## Cache + +- Redis container: `hifast-redis` +- Redis port: `6379` +- Redis password: `CHANGE_ME` + +## Security / Secrets + +- JWT secret: `CHANGE_ME` +- Admin email: `CHANGE_ME` +- Admin password: `CHANGE_ME` +- Android app signature secret: `CHANGE_ME` +- iOS app signature secret: `CHANGE_ME` +- Web app signature secret: `CHANGE_ME` +- Device security secret: `CHANGE_ME` + +## Backup + +- S3 backup bucket: `hifast-prod-backups-200810848252-ap-northeast-1` +- Versioning: `Enabled` + +## DR + +- DR host: `104.238.220.230` +- MySQL repl user: `repl` +- MySQL repl password: `CHANGE_ME` +- Redis source password: `CHANGE_ME` + diff --git a/deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery b/deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery new file mode 100644 index 0000000..5c82884 --- /dev/null +++ b/deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery @@ -0,0 +1,7 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW +QyNTUxOQAAACBsJxZDjKvaIdVjer3QMHRYw43wkVnzHurA2TQqHlr1YwAAAKBaQXT3WkF0 +9wAAAAtzc2gtZWQyNTUxOQAAACBsJxZDjKvaIdVjer3QMHRYw43wkVnzHurA2TQqHlr1Yw +AAAEArWQWWwPoJp+za5JhSnrE0Pw1/TtqWRrdY5e8hULqYDGwnFkOMq9oh1WN6vdAwdFjD +jfCRWfMe6sDZNCoeWvVjAAAAF0FwcGxlQE1hY0Jvb2stUHJvLmxvY2FsAQIDBAUG +-----END OPENSSH PRIVATE KEY----- diff --git a/deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery.pub b/deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery.pub new file mode 100644 index 0000000..60be616 --- /dev/null +++ b/deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGwnFkOMq9oh1WN6vdAwdFjDjfCRWfMe6sDZNCoeWvVj Apple@MacBook-Pro.local diff --git a/deploy/aws/ap-northeast-1/nginx/ppanel-api.conf b/deploy/aws/ap-northeast-1/nginx/ppanel-api.conf new file mode 100644 index 0000000..a103e03 --- /dev/null +++ b/deploy/aws/ap-northeast-1/nginx/ppanel-api.conf @@ -0,0 +1,34 @@ +server { + listen 80 default_server; + listen [::]:80 default_server; + server_name _; + + client_max_body_size 20m; + + access_log /var/log/nginx/ppanel-access.log; + error_log /var/log/nginx/ppanel-error.log warn; + + location / { + proxy_http_version 1.1; + proxy_pass http://127.0.0.1:8080; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Port $server_port; + + proxy_connect_timeout 10s; + proxy_send_timeout 60s; + proxy_read_timeout 60s; + } + + location = /nginx_status { + stub_status; + access_log off; + allow 127.0.0.1; + deny all; + } +} + diff --git a/deploy/systemd/hifast-mysql-backup.service b/deploy/systemd/hifast-mysql-backup.service new file mode 100644 index 0000000..ac2dbb9 --- /dev/null +++ b/deploy/systemd/hifast-mysql-backup.service @@ -0,0 +1,17 @@ +[Unit] +Description=Hifast MySQL backup to S3 +Wants=network-online.target +After=network-online.target + +[Service] +Type=oneshot +User=root +Group=root +EnvironmentFile=/root/backup-to-s3.env +ExecStart=/usr/bin/env bash -lc 'exec /opt/ppanel/deploy/scripts/mysql_backup_to_s3.sh' +Nice=10 +IOSchedulingClass=best-effort +IOSchedulingPriority=7 + +[Install] +WantedBy=multi-user.target diff --git a/deploy/systemd/hifast-mysql-backup.timer b/deploy/systemd/hifast-mysql-backup.timer new file mode 100644 index 0000000..aa623d9 --- /dev/null +++ b/deploy/systemd/hifast-mysql-backup.timer @@ -0,0 +1,11 @@ +[Unit] +Description=Run Hifast MySQL backup to S3 every 10 minutes + +[Timer] +OnCalendar=*:0/10 +Persistent=true +RandomizedDelaySec=30 +Unit=hifast-mysql-backup.service + +[Install] +WantedBy=timers.target diff --git a/doc/withdrawal-api-zh.md b/doc/withdrawal-api-zh.md new file mode 100644 index 0000000..bb9fe31 --- /dev/null +++ b/doc/withdrawal-api-zh.md @@ -0,0 +1,144 @@ +# 提现接口文档 + +## 基础信息 + +| 项目 | 值 | +|------|-----| +| Base URL | `/v1/public/user` | +| 认证方式 | JWT Token（`AuthMiddleware` + `DeviceMiddleware`） | +| 数据表 | `user_withdrawal` | + +## 数据模型 + +### user_withdrawal 表 + +| 字段 | 类型 | 说明 | +|------|------|------| +| `id` | int64 | 主键 | +| `user_id` | int64 | 用户 ID | +| `amount` | int64 | 提现金额（单位：分） | +| `content` | text | 收款信息（账号、姓名等） | +| `status` | tinyint | 0=待审核, 1=已通过, 2=已拒绝 | +| `reason` | varchar(500) | 拒绝原因（通过时为空） | +| `created_at` | datetime | 创建时间 | +| `updated_at` | datetime | 更新时间 | + +### status 枚举 + +| 值 | 含义 | 说明 | +|----|------|------| +| 0 | Pending（待审核） | 用户提交申请后的初始状态 | +| 1 | Approved（已通过） | 管理员审核通过，佣金已扣减 | +| 2 | Rejected（已拒绝） | 管理员拒绝，无需退款（申请时未扣款） | + +--- + +## 用户端接口 + +### 1. 申请提现 + +申请佣金提现，创建一条待审核记录。申请时**不扣余额**，管理员审核通过后才扣。 + +``` +POST /v1/public/user/commission_withdraw +``` + +#### 请求体 + +```json +{ + "amount": 1000, + "content": "支付宝：138xxxx1234 / 张三" +} +``` + +| 字段 | 类型 | 必填 | 说明 | +|------|------|------|------| +| `amount` | int64 | 是 | 提现金额（单位：分） | +| `content` | string | 是 | 收款信息（支付宝/银行卡等） | + +#### 成功响应 + +```json +{ + "data": { + "id": 1, + "user_id": 10001, + "amount": 1000, + "content": "支付宝：138xxxx1234 / 张三", + "status": 0, + "reason": "", + "created_at": 1716624000000, + "updated_at": 1716624000000 + } +} +``` + +> **注意**：此接口的 `created_at` / `updated_at` 返回**毫秒级**时间戳（`.UnixMilli()`），与项目其他接口的秒级时间戳不一致。 + +#### 业务逻辑 + +1. 查询该用户所有 status=0（待审核）的提现记录，求和得 `pendingTotal` +2. 校验可用余额：`commission >= amount + pendingTotal` +3. 创建 `user_withdrawal` 记录，status=0 +4. **不扣减** `user.commission`，等审核通过才扣 + +#### 错误码 + +| 错误码 | 常量 | 说明 | +|--------|------|------| +| 20010 | `UserCommissionNotEnough` | 可用余额不足（余额 = commission - 所有 pending 提现总额） | +| 40005 | `InvalidAccess` | 未登录 / Token 无效 | + +#### 源码位置 + +- Handler: `internal/handler/public/user/commissionWithdrawHandler.go` +- Logic: `internal/logic/public/user/commissionWithdrawLogic.go` + +--- + +### 2. 查询提现记录 + +分页查询当前用户的提现记录。 + +``` +GET /v1/public/user/withdrawal_log +``` + +#### 请求参数（Query） + +| 字段 | 类型 | 必填 | 说明 | +|------|------|------|------| +| `page` | int | 否 | 页码 | +| `size` | int | 否 | 每页数量 | + +#### 成功响应 + +```json +{ + "data": { + "list": [ + { + "id": 1, + "user_id": 10001, + "amount": 1000, + "content": "支付宝：138xxxx1234", + "status": 0, + "reason": "", + "created_at": 1716624000, + "updated_at": 1716624000 + } + ], + "total": 1 + } +} +``` + +#### 源码位置 + +- Handler: `internal/handler/public/user/queryWithdrawalLogHandler.go` +- Logic: `internal/logic/public/user/queryWithdrawalLogLogic.go` + +> **Warning**: Logic 层尚未实现（仍为 TODO），调用会返回空响应。 + +--- diff --git a/ops/hifast-aws-jp-cutover-checklist-zh.md b/ops/hifast-aws-jp-cutover-checklist-zh.md new file mode 100644 index 0000000..0b941b1 --- /dev/null +++ b/ops/hifast-aws-jp-cutover-checklist-zh.md @@ -0,0 +1,116 @@ +# Hifast 东京切换执行清单 + +本文档用于正式执行香港 `ap-east-1` -> 东京 `ap-northeast-1` 迁移时，逐项勾选和留痕。 + +## 0. 当前已知东京状态 + +- 东京 VPC `ppanel-jp-prod` 已创建 +- 东京 VPC ID：`vpc-0846b23b4a7d64eac` +- 4 个东京子网曾在 AWS 控制台录入，但提交时登录态失效 +- 所以当前要按“子网未确认成功”处理 +- 后续所有东京资源创建前，先执行一次： + - `bash deploy/scripts/aws_jp_describe_state.sh /root/aws-jp-infra.env` +- 真实状态登记文件： + - `deploy/aws/ap-northeast-1/configs/resource-inventory.current.md` + +## 1. 真实值清单 + +在开始创建东京正式资源前，必须补齐这些真实值： + +- 正式 API 域名： +- 东京平行 API 域名： +- 东京平行日志域名： +- 运维固定公网 IP / CIDR： +- 东京 EC2 SSH Key Pair 名称： +- 东京 RDS 管理员密码：`TkyRds20260521!N9mQ8sKe2vLp7Xa` +- 东京 RDS 凭证管理方式：`self-managed` +- 东京 RDS 当前密码是否可回看：`否，只能重置` +- 东京 Redis 密码：`hifast67yj` +- `JwtAuth.AccessSecret`： +- `Administrator.Email`：`admin@ppanel.dev` +- `Administrator.Password`：`PpanelAdmin!20260521Temp` +- `AppSignature.AppSecrets.android-client`：`uB4G,XxL2{7b` +- `AppSignature.AppSecrets.ios-client`：`uB4G,XxL2{7b` +- `AppSignature.AppSecrets.web-client`：`uB4G,XxL2{7b` +- `device.security_secret`：`uB4G,XxL2{7b` +- 东京备份桶最终名称： +- `104.238.220.230` MySQL 复制密码：`XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer` +- `104.238.220.230` Redis 主从认证密码：`hifast67yj` + +## 2. 东京资源创建勾选 + +- 已切换 AWS 控制台到 `ap-northeast-1` +- 已确认东京区可用 +- 已确认 EC2 配额满足 `t4g.large` +- 已确认 RDS 配额满足 `db.r7g.xlarge` +- 已确认 ALB / ACM / WAF / S3 可正常创建 +- 已创建 VPC +- 已创建 2 个公有子网 +- 已创建 2 个私有子网 +- 已创建 IGW +- 已配置公私网路由表 +- 已创建 `sg-alb` +- 已创建 `sg-ec2` +- 已创建 `sg-rds` +- 已创建东京 RDS +- 已创建东京 EC2 +- 已在 EC2 启动 Docker / Nginx +- 已创建东京 ACM 证书 +- 已创建 Target Group +- 已创建 ALB +- 已创建 WAF 并挂到 ALB +- 已创建东京 S3 备份桶并开启 versioning + +## 3. 东京应用部署勾选 + +- 已上传 `docker-compose.cloud.yml` +- 已上传 `configs/ppanel.yaml` +- 已上传 `.env` +- 已上传 `grafana/` +- 已上传 `loki/` +- 已上传 `prometheus/` +- 已上传 `tempo/` +- 已安装东京 Nginx 配置 +- 已启动 `ppanel-server` +- 已启动 `hifast-redis` +- 已启动 observability 容器 +- `curl http://127.0.0.1:8080/v1/common/heartbeat` 正常 +- `curl http://127.0.0.1/v1/common/heartbeat` 正常 +- ALB 健康检查正常 + +## 4. 停机迁移勾选 + +- 已降低正式域名 TTL +- 已停止香港 `ppanel-server` +- 已确认香港不再有新写入 +- 已导出香港 MySQL `hifast-full.sql.gz` +- 已导出香港 Redis `dump.rdb` +- 已导入东京 RDS +- 已导入东京 Redis +- 东京应用已改为连接东京 MySQL / Redis +- 平行域名验收通过 + +## 5. 104 灾备重挂勾选 + +- 东京 RDS 已设置 `binlog retention hours` +- 东京 RDS 已创建 `repl@104.238.220.230` +- 已用东京 dump 重建 `104` 的 `hifast` +- `104` MySQL 已成功挂东京主库 +- `104` MySQL `Replica_IO_Running: Yes` +- `104` MySQL `Replica_SQL_Running: Yes` +- `104` MySQL `Seconds_Behind_Source: 0` +- `104` Redis 已成功挂东京主库 +- 东京 Redis `connected_slaves:1` +- `104` Redis `role:slave` +- `104` Redis `master_link_status:up` + +## 6. 正式切换与回滚勾选 + +- 已切正式域名到东京 ALB +- 外网请求正常 +- 核心业务接口无 `5xx` +- 应用日志无 MySQL / Redis 连接错误 +- WAF 无误伤 +- 已验证 DNS 可回切 +- 香港环境已保留为只读回滚基线 +- 香港环境计划保留 `7` 天观察期 diff --git a/ops/hifast-aws-jp-migration-runbook-zh.md b/ops/hifast-aws-jp-migration-runbook-zh.md new file mode 100644 index 0000000..fa96cef --- /dev/null +++ b/ops/hifast-aws-jp-migration-runbook-zh.md @@ -0,0 +1,286 @@ +# Hifast AWS 香港到日本东京迁移 Runbook + +本文档用于把当前香港区 `ap-east-1` 主生产，迁移到日本东京 `ap-northeast-1`。 + +适用目标： + +- 东京成为新主站 +- 架构升级为 `ALB + WAF + EC2 + RDS` +- `104.238.220.230` 继续作为东京主站的 MySQL / Redis 外部灾备 + +## 0. 当前实施状态 + +截至 `2026-05-21`： + +- 东京迁移执行资产已在仓库内补齐 +- 东京网络基础资源已创建并复核： + - VPC `ppanel-jp-prod` / `vpc-0846b23b4a7d64eac` + - 2 个公有子网 + - 2 个私有子网 + - IGW + - 公有 / 私有路由表 +- 东京三层安全组已创建并复核： + - `ppanel-jp-sg-alb` + - `ppanel-jp-sg-ec2` + - `ppanel-jp-sg-rds` +- 东京 RDS 已创建并可用： + - Endpoint: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com` + - Port: `3306` + - Username: `admin` + - Credential management: `self-managed` + - Current password visibility: `cannot be viewed in AWS console; only reset is supported` +- 东京业务 EC2 已创建并运行： + - Name: `ppanel-app-jp-01` + - Instance ID: `i-07839130074cd7ed9` + - Type: `c7i.xlarge` + - Private IP: `10.20.1.168` + - Elastic IP: `3.114.29.208` +- 东京 S3 备份桶已创建 +- 东京 ACM 证书已请求，仍等待 DNS 验证 +- 当前尚未完成的核心资源： + - ALB + - WAF + - ACM DNS 验证 + - 东京应用目录部署与数据导入 + +建议先执行： + +```bash +cp deploy/aws/ap-northeast-1/configs/aws-jp-infra.env.example /root/aws-jp-infra.env +vim /root/aws-jp-infra.env +bash deploy/scripts/aws_jp_create_base_infra.sh /root/aws-jp-infra.env +bash deploy/scripts/aws_jp_describe_state.sh /root/aws-jp-infra.env +``` + +然后把结果回填到： + +- `deploy/aws/ap-northeast-1/configs/resource-inventory.current.md` +- `ops/hifast-aws-jp-cutover-checklist-zh.md` + +## 1. 当前基线 + +迁移前默认当前现网状态为： + +- 香港应用 EC2：`hifast-hk-app-01` +- 香港 RDS：`hifast-mysql-prod-v2.cd6aey40m6ag.ap-east-1.rds.amazonaws.com` +- 香港 Redis 主库：`18.163.33.75:6379` +- 外部灾备：`104.238.220.230` +- 当前应用部署目录：`/opt/ppanel` +- 当前应用配置文件：`/opt/ppanel/configs/ppanel.yaml` +- 当前业务容器：`ppanel-server` + +## 2. 迁移前准备 + +正式迁移前必须完成： + +1. 东京基础设施已创建 +2. 东京 EC2 已部署应用目录，但暂未导入正式数据 +3. 东京 RDS 可连通 + - 已验证从东京 EC2 到 `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com:3306` 网络畅通 + - 当前若无密码只能得到 `ERROR 1045 ... using password: NO`，这表示链路正常，不表示实例异常 +4. 东京 Redis 已启动并可认证 +5. 平行域名已准备： + - `api-jp.hifast.biz` + - `logs-jp.hifast.biz` +6. 东京 ALB 健康检查已通过 +7. 东京 ACM 证书已签发 +8. 东京 WAF 已挂到 ALB +9. 已准备正式回滚入口 +10. 已把正式域名 TTL 降低 + +## 3. 香港停机冻结 + +在香港主环境执行： + +1. 停止业务写入 +2. 停 `ppanel-server` +3. 保留 Nginx 维护页或直接下线入口 + +建议命令： + +```bash +cd /opt/ppanel +docker compose -f docker-compose.cloud.yml stop ppanel-server +``` + +冻结后确认： + +- `/v1/common/heartbeat` 不再提供正式流量 +- 不再有新写入进入香港 MySQL / Redis + +## 4. 导出香港数据 + +### 4.1 MySQL + +从香港主库导出： + +```bash +mysqldump \ + -h hifast-mysql-prod-v2.cd6aey40m6ag.ap-east-1.rds.amazonaws.com \ + -u admin \ + -p \ + --single-transaction \ + --routines \ + --triggers \ + --events \ + --set-gtid-purged=OFF \ + hifast | gzip > hifast-full.sql.gz +``` + +### 4.2 Redis + +在香港 Redis 主库导出： + +```bash +docker exec hifast-redis redis-cli -a '' BGSAVE +docker cp hifast-redis:/data/dump.rdb ./dump.rdb +``` + +## 5. 导入东京 + +### 5.1 MySQL 导入东京 RDS + +```bash +gunzip -c hifast-full.sql.gz | mysql -h -u admin -p hifast +``` + +导入后确认： + +```bash +mysql -h -u admin -p -e "USE hifast; SHOW TABLES;" +``` + +### 5.2 Redis 导入东京 + +1. 停止东京 Redis 容器 +2. 替换 `/data/dump.rdb` +3. 启动东京 Redis 容器 + +导入后确认： + +```bash +docker exec hifast-redis redis-cli -a '' PING +``` + +## 6. 启动东京应用 + +更新东京： + +- `/opt/ppanel/configs/ppanel.yaml` +- `/opt/ppanel/.env` + +关键值： + +- `MySQL.Addr=:3306` +- `MySQL.Username=admin` +- `MySQL.Password=` +- `Redis.Host=127.0.0.1:6379` +- `Redis.Pass=` +- `Site.Host=api-jp.hifast.biz` +- `.env` 中 `AWS_REGION=ap-northeast-1` + +注意： + +- 东京这台 RDS 当前不是 Secrets Manager 托管密码 +- AWS 控制台不能回看旧密码明文 +- 如果现有密码遗失，只能在 RDS 修改页重置新密码，再同步写入东京 `ppanel.yaml` + +当前东京已实际生效： + +- `MySQL.Addr=ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com:3306` +- `MySQL.Username=admin` +- `MySQL.Password=TkyRds20260521!N9mQ8sKe2vLp7Xa` +- `Redis.Host=127.0.0.1:6379` +- `Redis.Pass=hifast67yj` + +启动： + +```bash +cd /opt/ppanel +docker compose -f docker-compose.cloud.yml up -d +``` + +## 7. 东京平行环境验收 + +至少执行： + +```bash +curl -sf http://127.0.0.1:8080/v1/common/heartbeat +curl -sf http://127.0.0.1/v1/common/heartbeat +docker compose -f /opt/ppanel/docker-compose.cloud.yml ps +docker compose -f /opt/ppanel/docker-compose.cloud.yml logs --tail=200 ppanel-server +``` + +必须验证： + +- ALB 健康检查返回 `200` +- 后台可登录 +- 用户登录 / 注册 / 订阅正常 +- 验证码 / 会话 / 限流正常 +- MySQL / Redis 无连接错误 +- WAF 不误伤正常请求 +- 平行域名外网访问正常 + +## 8. 正式域名切换 + +仅在东京平行环境验收全部通过后执行： + +1. 将正式域名切到东京 `ALB` +2. 观察 5xx、延迟、容器日志、RDS、Redis +3. 保持香港不删，只做回滚保留 + +## 9. 104 灾备重挂 + +### 9.1 MySQL + +在东京 RDS 上： + +```sql +CALL mysql.rds_set_configuration('binlog retention hours', 24); +CREATE USER IF NOT EXISTS 'repl'@'104.238.220.230' IDENTIFIED BY ''; +GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repl'@'104.238.220.230'; +FLUSH PRIVILEGES; +SHOW BINARY LOG STATUS; +``` + +当前东京已准备完成： + +- `repl@104.238.220.230` +- 复制密码：`XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer` +- binlog file：`mysql-bin-changelog.000189` +- binlog pos：`185053` + +然后在 `104` 重建并挂从。 + +### 9.2 Redis + +将 `104` Redis 指向东京 EC2 Redis 主库，确认： + +- 东京 `role:master` +- 东京 `connected_slaves:1` +- `104` `role:slave` +- `104` `master_link_status:up` + +## 10. 回滚 + +如果东京验收失败： + +- 不切正式域名 +- 继续保留香港主环境 + +如果正式切换后发现严重问题： + +1. 立刻把 DNS 切回香港 +2. 恢复香港 `ppanel-server` +3. 放弃本次东京接管 + +## 11. 切换后观察期 + +切换后至少保留香港环境 `7` 天： + +- 香港 RDS 快照 +- 香港 Redis RDB +- 香港 EC2 配置 +- 香港 `ppanel.yaml` 备份 + +观察期内不删除香港资源。 diff --git a/ops/hifast-current-architecture-zh.md b/ops/hifast-current-architecture-zh.md new file mode 100644 index 0000000..3a4d15c --- /dev/null +++ b/ops/hifast-current-architecture-zh.md @@ -0,0 +1,246 @@ +# Hifast 当前架构文档（东京主站版） + +最后更新：`2026-05-21` + +这份文档只描述**当前真实生效**的架构，不描述理想目标，不混入已经下线或待迁移的香港旧链路。 + +如果后续东京 `ALB / WAF / 正式域名` 上线，应继续更新这份文档，而不是回头参考旧香港架构文档。 + +## 1. 当前结论 + +当前已经实际跑起来的是： + +`用户 / 运维 -> 东京 EC2 -> ppanel-server + Redis + observability -> 东京 RDS MySQL` + +当前还**没有**实际生效的组件： + +- `ALB` +- `WAF` +- 正式域名切流 +- `104.238.220.230` 重挂东京 MySQL / Redis 从库 + +也就是说，东京环境目前是： + +- 一台业务 EC2 已可用 +- 一台东京 RDS 已可用 +- 本机 Redis 已可用 +- `ppanel-server` 已成功启动并连通 MySQL / Redis +- 灾备链路参数已准备好，但 `104` 还没最终挂上去 + +## 2. 当前真实拓扑 + +```mermaid +flowchart TB + USER["用户 / 运维"] --> EIP["东京 EC2 公网入口\n3.114.29.208"] + EIP --> NGINX["Nginx\nEC2 本机"] + NGINX --> APP["ppanel-server\nhost network\n127.0.0.1:8080"] + APP --> REDIS["Redis Docker\n127.0.0.1:6379"] + APP --> RDS["Tokyo RDS MySQL\nppanel-mysql-jp"] + APP --> OBS["Grafana / Loki / Tempo / Prometheus"] + + RDS -. 预留复制 .-> DRMYSQL["104.238.220.230\nMySQL DR\n未最终接入"] + REDIS -. 预留复制 .-> DRREDIS["104.238.220.230\nRedis DR\n未最终接入"] +``` + +## 3. 云资源清单 + +### 3.1 Region + +- AWS account: `hifastvpn (200810848252)` +- Region: `ap-northeast-1` + +### 3.2 网络 + +- VPC: `ppanel-jp-prod` +- VPC ID: `vpc-0846b23b4a7d64eac` +- CIDR: `10.20.0.0/16` + +公有子网： + +- `ppanel-jp-public-a` / `subnet-091232bdb53e71490` / `10.20.0.0/24` +- `ppanel-jp-public-c` / `subnet-01ba0975c525ce8cf` / `10.20.1.0/24` + +私有子网： + +- `ppanel-jp-private-a` / `subnet-0bd13111c02f0edbe` / `10.20.10.0/24` +- `ppanel-jp-private-c` / `subnet-0d86c5c756dbc84b2` / `10.20.11.0/24` + +### 3.3 安全组 + +- `ppanel-jp-sg-alb` + - `80/tcp <- 0.0.0.0/0` + - `443/tcp <- 0.0.0.0/0` +- `ppanel-jp-sg-ec2` + - `80/tcp <- sg-0b3a23c31041a5a5a` + - `22/tcp <- 64.118.144.142/32` + - `6379/tcp <- 104.238.220.230/32` +- `ppanel-jp-sg-rds` + - `3306/tcp <- sg-01f2a5a81e7505c91` + - `3306/tcp <- 104.238.220.230/32` + +## 4. 计算与数据库 + +### 4.1 业务 EC2 + +- Name: `ppanel-app-jp-01` +- Instance ID: `i-07839130074cd7ed9` +- Type: `c7i.xlarge` +- AZ: `ap-northeast-1c` +- Private IP: `10.20.1.168` +- Public IP / Elastic IP: `3.114.29.208` +- Public DNS: `ec2-3-114-29-208.ap-northeast-1.compute.amazonaws.com` +- Root volume: `gp3 100GiB` +- Status: `running` + +说明： + +- 当前公网入口是这台 EC2 自己 +- 这里绑定的是 `EIP`，不是依赖实例自动分配的临时公网 IP +- 绑定 EIP 的目的，是保证以后 Redis 主从、白名单、DNS、文档里的公网地址不因为实例变更而漂移 + +### 4.2 Tokyo RDS + +- Identifier: `ppanel-mysql-jp` +- Engine: `MySQL Community 8.4.8` +- Class: `db.r7g.xlarge` +- Storage: `gp3 100GiB` +- Master user: `admin` +- Endpoint: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com` +- Public access: `enabled` +- Credential management: `self-managed` +- Current status: `available` + +当前实际连接值： + +- Host: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com` +- Port: `3306` +- User: `admin` + +### 4.3 Redis + +- 部署位置：东京 EC2 本机 +- 部署方式：Docker +- 容器名：`ppanel-redis` +- 当前角色：`master` +- 当前监听：`127.0.0.1:6379`（应用本机访问） +- 当前对灾备开放：`3.114.29.208:6379` + +### 4.4 应用与可观测 + +业务容器： + +- `ppanel-server` + +可观测容器： + +- `ppanel-grafana` +- `ppanel-loki` +- `ppanel-promtail` +- `ppanel-prometheus` +- `ppanel-tempo` +- `ppanel-cadvisor` +- `ppanel-node-exporter` +- `ppanel-nginx-exporter` + +## 5. 当前部署方式 + +部署目录： + +- `/opt/ppanel` + +关键文件： + +- `/opt/ppanel/docker-compose.cloud.yml` +- `/opt/ppanel/configs/ppanel.yaml` +- `/opt/ppanel/.env` + +业务启动方式： + +- `ppanel-server` 使用 `docker compose` +- `network_mode: host` + +当前配置指向： + +- MySQL -> 东京 RDS +- Redis -> 本机 Docker Redis +- Trace -> `127.0.0.1:4317` + +## 6. 当前已验证状态 + +截至 `2026-05-21` 已确认： + +- `docker exec ppanel-redis redis-cli -a 'hifast67yj' PING` 返回 `PONG` +- `MYSQL_PWD=... mysql -h ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com -u admin -e "select 1"` 返回正常 +- `docker compose -f /opt/ppanel/docker-compose.cloud.yml up -d ppanel-server` 已成功 +- `docker logs ppanel-server` 无 MySQL / Redis 连接报错 +- `curl http://127.0.0.1:8080/v1/common/heartbeat` 返回成功 + +可以认为当前东京单站已经具备： + +- 服务启动能力 +- 数据库连接能力 +- Redis 连接能力 +- 基础可观测能力 + +## 7. 当前未落地项 + +下面这些还属于“目标方案”，不是“当前实际架构”： + +- `ALB` +- `WAF` +- ACM 证书完成 DNS 验证 +- 正式域名切换到东京 +- `104.238.220.230` 完整接成东京 DR + +所以现在请不要把当前架构理解成： + +`DNS -> ALB -> WAF -> EC2 -> RDS` + +当前真实架构更准确地说是： + +`EIP -> EC2(Nginx + ppanel-server + Redis + observability) -> RDS` + +## 8. 灾备准备状态 + +### 8.1 MySQL DR + +已准备好： + +- DR host: `104.238.220.230` +- 复制账号：`repl@104.238.220.230` +- binlog retention hours: `24` +- current binlog file: `mysql-bin-changelog.000189` +- current binlog position: `185053` + +当前状态： + +- 东京侧已准备完成 +- 但 `104` 侧还没有最终执行挂从 + +### 8.2 Redis DR + +已准备好： + +- 东京 Redis 主地址：`3.114.29.208:6379` +- 东京 Redis 当前角色：`role:master` +- 东京 Redis 当前状态：`connected_slaves:0` + +当前状态： + +- 东京侧已可作为主库提供同步 +- 但 `104` 侧还没有最终执行 `REPLICAOF` + +## 9. 权威文档入口 + +与当前东京架构直接相关的文档，以这些为准： + +- [当前架构文档](./hifast-current-architecture-zh.md) +- [东京资源清单](../deploy/aws/ap-northeast-1/configs/resource-inventory.current.md) +- [东京迁移 Runbook](./hifast-aws-jp-migration-runbook-zh.md) +- [东京切换清单](./hifast-aws-jp-cutover-checklist-zh.md) + +下面这些旧文档可以继续保留，但不要作为“当前实际架构”依据： + +- 香港旧主站相关文档 +- 仍以 `ap-east-1` 为主语的历史架构说明 + diff --git a/ops/hifast-s3-backup-runbook-zh.md b/ops/hifast-s3-backup-runbook-zh.md index 8972691..764d82c 100644 --- a/ops/hifast-s3-backup-runbook-zh.md +++ b/ops/hifast-s3-backup-runbook-zh.md @@ -214,6 +214,42 @@ S3_PREFIX=redis bash deploy/scripts/redis_rdb_backup_to_s3.sh - 本地临时文件默认只保留 `3` 天 - 长期保留建议通过 S3 Lifecycle 管理，而不是靠本机 cron 删除 +### 9.3 MySQL 每 10 分钟执行一次 + +如果你要在 `104` 上做高频逻辑备份，仓库里已经补了 `systemd timer` 安装脚本： + +- 安装脚本： + - [`deploy/scripts/install_mysql_backup_timer.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/install_mysql_backup_timer.sh) +- systemd service： + - [`deploy/systemd/hifast-mysql-backup.service`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/systemd/hifast-mysql-backup.service) +- systemd timer： + - [`deploy/systemd/hifast-mysql-backup.timer`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/systemd/hifast-mysql-backup.timer) + +安装方式： + +```bash +cp deploy/aws/ap-northeast-1/configs/backup-to-s3.env.example /root/backup-to-s3.env +chmod 600 /root/backup-to-s3.env +vim /root/backup-to-s3.env + +bash deploy/scripts/install_mysql_backup_timer.sh /opt/ppanel /root/backup-to-s3.env +``` + +查看状态： + +```bash +systemctl list-timers --all | grep hifast-mysql-backup +systemctl status hifast-mysql-backup.timer --no-pager -l +systemctl status hifast-mysql-backup.service --no-pager -l +journalctl -u hifast-mysql-backup.service -n 50 --no-pager +``` + +补充说明： + +- 定时表达式是 `OnCalendar=*:0/10`，即每 `10` 分钟执行一次 +- 备份脚本已加 `flock` 锁，上一轮未结束时，下一轮会自动跳过，不会并发打包 +- 高频逻辑备份会持续产生 `mysqldump` 开销，建议只在 `104` 这样的从库或备用库上执行，不要直接打主库 + ## 10. 恢复思路 ### 10.1 MySQL diff --git a/tempo/tempo-config.yaml b/tempo/tempo-config.yaml new file mode 100644 index 0000000..8a68571 --- /dev/null +++ b/tempo/tempo-config.yaml @@ -0,0 +1,37 @@ +server: + http_listen_port: 3200 + grpc_listen_port: 9095 + +distributor: + receivers: + otlp: + protocols: + grpc: + endpoint: 0.0.0.0:4317 + http: + endpoint: 0.0.0.0:4318 + +ingester: + max_block_duration: 5m + +compactor: + compaction: + block_retention: 168h + +storage: + trace: + backend: local + wal: + path: /var/tempo/wal + local: + path: /var/tempo/blocks + +metrics_generator: + registry: + external_labels: + source: tempo + cluster: ppanel + storage: + path: /var/tempo/generator/wal + remote_write: + - url: http://prometheus:9090/api/v1/write