Kylin进阶教程

导读

本文根据银河麒麟Server V10运维真实环境配置教程，内容涵盖Docker、Mariadb 主备、Harbor、GlusterFS、Tomcat、Haproxy、rsyslog、Ansible、PostgreSQL

一、server1 系统环境配置#

1、修改主机名#

1
hostnamectl set-hostname server1.kylin.com
2
bash

2、创建多级目录并查看#

1
mkdir -p ~/kylin/docs/note
2
find ~/kylin -type d

3、复制文件并改名#

1
cp /etc/passwd ~/passwd_backup

4、查看文件权限并修改为 640#

1
ls -l /root/passwd_backup
2
chmod 640 /root/passwd_backup

5、配置 YUM 仓库源#

1
cd /etc/yum.repos.d/
2
mv kylin_x86_64.repo kylin_x86_64.repo.bak
3
vim local.repo

1
[local]
2
name=Local Kylin Repo
3
baseurl=http://192.168.122.1:58000/kylinsrv
4
enabled=1
5
gpgcheck=0

1
yum clean all
2
yum makecache

6、安装配置 vsftpd#

1
yum install -y vsftpd
2
vim /etc/vsftpd/vsftpd.conf

1
anonymous_enable=YES
2
anon_upload_enable=YES
3
anon_mkdir_write_enable=YES
4
anon_root=/data/ftp/
5
local_enable=YES
6
write_enable=YES
7
listen=YES
8
listen_ipv6=NO
9

10
# 受限用户 chroot
11
chroot_local_user=YES
12
chroot_list_enable=YES
13
chroot_list_file=/etc/vsftpd/chroot_list
14
allow_writeable_chroot=YES
15

16
# 双份日志
17
xferlog_enable=YES
18
xferlog_file=/var/log/xferlog
19
dual_log_enable=YES
20
vsftpd_log_file=/var/log/vsftpd.log

创建 ftp 用户并限制主目录：

1
useradd -s /sbin/nologin -d /home/kylinftp kylinftp
2
passwd kylinftp
3
touch /etc/vsftpd/chroot_list

将 /etc/pam.d/vsftpd 中的 auth required pam_shells.so 一行注释掉，避免 nologin 用户无法登录。

1
systemctl enable --now vsftpd
2
systemctl restart vsftpd

7、配置 chrony 时间服务器#

1
yum install -y chrony
2
vim /etc/chrony.conf

1
server 192.168.122.1 iburst
2
allow 172.16.0.0/16

1
systemctl restart chronyd
2
chronyc sources

8、配置 DNS 正向解析#

1
yum install -y bind
2
sed -i '/listen-on port 53/s/127.0.0.1/any/' /etc/named.conf
3
sed -i '/allow-query/s/localhost/any/' /etc/named.conf
4
cat >> /etc/named.rfc1912.zones <<EOF
5
zone "kylin.com" IN {
6
  type master;
7
  file "kylin.com.zone";
8
};
9
EOF

1
cat > /var/named/kylin.com.zone << 'EOF'
2
$TTL 1D
3
@  IN SOA  server1.kylin.com. rname.invalid. (
4
          2025010101  ; serial
5
          1D  ; refresh
6
          1H  ; retry
7
          1W  ; expire
8
          3H )  ; minimum
9
  NS  server1.kylin.com.
10
server1  A  172.16.50.231
11
server2  A  172.16.50.232
12
EOF
13
chown named:named /var/named/kylin.com.zone
14
systemctl enable --now named
15
systemctl restart named
16
nslookup server1.kylin.com 127.0.0.1
17
nslookup server2.kylin.com 127.0.0.1

9、配置 NFS 网络共享#

1
yum install -y nfs-utils
2
mkdir -p /nfsdata/KY01 /nfsdata/KY02
3
cat > /etc/exports <<EOF
4
/nfsdata/KY01 172.16.50.0/24(rw,sync,no_root_squash)
5
/nfsdata/KY02 server2.kylin.com(ro,sync,no_root_squash)
6
EOF
7
systemctl enable --now rpcbind nfs-server
8
exportfs -r
9
showmount -e localhost

二、server1 Docker 容器集群管理#

1、二进制方式部署 Docker 20.10.9#

1
cd /opt/software/
2
tar xf docker-20.10.9.tgz
3
cp docker/* /usr/bin/
4
mkdir -p /etc/docker
5
vim /etc/docker/daemon.json

1
{
2
  "data-root": "/var/lib/docker",
3
  "storage-driver": "overlay2"
4
}

1
cat > /usr/lib/systemd/system/docker.service <<'EOF'
2
[Unit]
3
Description=Docker Application Container Engine
4
After=network-online.target
5
Wants=network-online.target
6

7
[Service]
8
Type=notify
9
ExecStart=/usr/bin/dockerd
10
ExecReload=/bin/kill -s HUP $MAINPID
11
LimitNOFILE=infinity
12
LimitNPROC=infinity
13
LimitCORE=infinity
14
TimeoutStartSec=0
15
Delegate=yes
16
KillMode=process
17
Restart=on-failure
18
StartLimitBurst=3
19
StartLimitInterval=60s
20

21
[Install]
22
WantedBy=multi-user.target
23
EOF
24
systemctl daemon-reload
25
systemctl enable --now docker
26
docker version

2、导入镜像并创建容器#

1
docker load -i /opt/software/kylin-10-sp3.tar.xz
2
docker images
3

4
docker run -itd --name kylin-1 --cpus=1 -m 2g kylin:laster /bin/bash
5
docker run -itd --name kylin-2 --cpus=1 -m 2g kylin:laster /bin/bash
6
docker ps

3、容器内安装配置 Mariadb#

将安装包拷入容器并进入容器安装：

1
docker cp /opt/software/mariadb-*.tar.gz kylin-1:/tmp/
2
docker cp /opt/software/mariadb-*.tar.gz kylin-2:/tmp/
3
docker exec -it kylin-1 bash

容器内（kylin-1、kylin-2 均执行）：

1
useradd -M -s /sbin/nologin mysql
2
mkdir -p /opt/mariadb /data/mysql /var/log/mysql
3
tar xf /tmp/mariadb-*.tar.gz -C /opt/mariadb --strip-components=1
4
chown -R mysql:mysql /data/mysql /var/log/mysql
5
/opt/mariadb/bin/mysqld --initialize-insecure --user=mysql --datadir=/data/mysql
6
/opt/mariadb/bin/mysqld_safe --user=mysql --datadir=/data/mysql &

登录并设置 root 密码、开放网段授权：

1
/opt/mariadb/bin/mysql -uroot
2
ALTER USER 'root'@'localhost' IDENTIFIED BY 'you_passwd';
3
CREATE USER 'root'@'%' IDENTIFIED BY 'you_passwd';
4
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
5
GRANT ALL PRIVILEGES ON *.* TO 'root'@'172.16.%' IDENTIFIED BY 'you_passwd';
6
GRANT ALL PRIVILEGES ON *.* TO 'root'@'172.17.%' IDENTIFIED BY 'you_passwd';
7
FLUSH PRIVILEGES;

4、Mariadb 互为主备#

修改 /etc/my.cnf 配置（kylin-1 上）：

1
[mysqld]
2
server-id = 1
3
log-bin = mysql-bin
4
binlog_format = row
5
auto_increment_increment = 2
6
auto_increment_offset = 1

kylin-2 上 server-id = 2、auto_increment_offset = 2。

重启两容器数据库：

1
/opt/mariadb/bin/mysqladmin -uroot -pyou_passwd shutdown
2
/opt/mariadb/bin/mysqld_safe --user=mysql --datadir=/data/mysql &

两容器均创建备份用户：

1
/opt/mariadb/bin/mysql -uroot -pyou_passwd
2
CREATE USER 'backup'@'%' IDENTIFIED BY 'you_passwd';
3
GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'backup'@'%';
4
FLUSH PRIVILEGES;

kylin-1 上指向 kylin-2：

1
CHANGE MASTER TO MASTER_HOST='kylin-2', MASTER_USER='backup', MASTER_PASSWORD='you_passwd', MASTER_LOG_FILE='mysql-bin.000001', MASTER_LOG_POS=4;
2
START SLAVE;

kylin-2 上指向 kylin-1：

1
CHANGE MASTER TO MASTER_HOST='kylin-1', MASTER_USER='backup', MASTER_PASSWORD='you_passwd', MASTER_LOG_FILE='mysql-bin.000001', MASTER_LOG_POS=4;
2
START SLAVE;

验证：

1
SHOW SLAVE STATUS\G;

5、创建数据库与表#

1
/opt/mariadb/bin/mysql -uroot -pyou_passwd
2
CREATE DATABASE kylin_db1;
3
USE kylin_db1;
4
CREATE TABLE student_info (
5
    Id INT PRIMARY KEY AUTO_INCREMENT,
6
    Name VARCHAR(20) NOT NULL,
7
    Birthday DATE NOT NULL,
8
    Gender ENUM('male','female','x') NOT NULL DEFAULT 'x',
9
    Password VARCHAR(100) NOT NULL
10
);
11
INSERT INTO student_info (Name, Birthday, Gender, Password) VALUES
12
('tom',  '1990-04-12', 'male',   PASSWORD('you_passwd')),
13
('harry', '1993-07-05', 'female', PASSWORD('you_passwd')),
14
('barry', '1992-02-23', 'male',   PASSWORD('you_passwd'));
15
SELECT * FROM student_info;

三、server1 Harbor 镜像仓库#

1、docker-compose 离线安装 Harbor#

1
cp /opt/software/docker-compose /usr/local/bin/docker-compose
2
chmod +x /usr/local/bin/docker-compose
3
docker-compose version
4

5
cd /opt/software/
6
tar zxf harbor-offline-installer-*.gz
7
cd harbor
8
cp harbor.yml.tmpl harbor.yml
9
vim harbor.yml

1
hostname: 172.16.50.231
2
http:
3
  port: 8000
4
harbor_admin_password: you_passwd
5
database:
6
  password: you_passwd
7
data_volume: /data/harbor

1
./install.sh
2
docker-compose ps

2、API 创建用户、项目并添加成员#

1
curl -u "admin:you_passwd" -X POST \
2
"http://172.16.50.231:8000/api/v2.0/users" \
3
-H "Content-Type: application/json" \
4
-d '{"username":"kylin","email":"kylin@yourdomain.com","password":"you_passwd","realname":"Kylin User","comment":"User created via API"}'
5

6
curl -u "admin:you_passwd" -X POST \
7
"http://172.16.50.231:8000/api/v2.0/projects" \
8
-H "Content-Type: application/json" \
9
-d '{"project_name":"kylin_web","metadata":{"public":"false"}}'
10

11
curl -u "admin:you_passwd" -X GET \
12
"http://172.16.50.231:8000/api/v2.0/users?username=kylin"
13

14
curl -u "admin:you_passwd" -X POST \
15
"http://172.16.50.231:8000/api/v2.0/projects/kylin_web/members" \
16
-H "Content-Type: application/json" \
17
-d '{"role_id": 4, "member_user": {"username": "kylin", "user_id": 5}}'

3、上传镜像到 Harbor#

1
docker login 172.16.50.231:8000 -u kylin -p you_passwd
2
docker tag kylin:laster 172.16.50.231:8000/kylin_web/kylin:laster
3
docker push 172.16.50.231:8000/kylin_web/kylin:laster

四、GlusterFS 存储集群（两台主机执行）#

1
yum install -y glusterfs-server
2
systemctl enable --now glusterd

1、格式化磁盘并挂载（两台）#

1
mkfs.xfs /dev/vdb
2
mkfs.xfs /dev/vdc
3
mkdir -p /data/storage/bricks01 /data/storage/bricks02
4
mkdir -p /data/storage/bricks01/safe_pool /data/storage/bricks02/data_pool
5
echo "/dev/vdb /data/storage/bricks01 xfs defaults 0 0" >> /etc/fstab
6
echo "/dev/vdc /data/storage/bricks02 xfs defaults 0 0" >> /etc/fstab
7
mount -a
8
df -h

2、添加信任存储节点#

1
gluster peer probe server2.kylin.com
2
gluster peer status

3、创建复制卷 gv_safe#

1
gluster volume create gv_safe replica 2 \
2
server1.kylin.com:/data/storage/bricks01/safe_pool \
3
server2.kylin.com:/data/storage/bricks01/safe_pool

4、创建分布式卷 gv_data#

1
gluster volume create gv_data \
2
server1.kylin.com:/data/storage/bricks02/data_pool \
3
server2.kylin.com:/data/storage/bricks02/data_pool

5、启动卷并设置访问控制#

1
gluster volume start gv_safe
2
gluster volume start gv_data
3
gluster volume set gv_safe auth.allow 172.16.50.0/24
4
gluster volume info

五、server1 Java 应用环境配置#

1、部署 Java 与 Tomcat#

1
mkdir -p /opt/java /opt/tomcat1 /opt/tomcat2
2
tar xf /opt/software/java-23.tar.gz -C /opt/java --strip-components=1
3
tar xf /opt/software/apache-tomcat-10.1.94.tar.gz -C /opt/tomcat1 --strip-components=1
4
cp -r /opt/tomcat1/* /opt/tomcat2/

2、创建 tomcat 用户#

1
groupadd -g 1080 tomcat
2
useradd -u 1080 -g tomcat -s /sbin/nologin -M tomcat
3
chown -R tomcat:tomcat /opt/java /opt/tomcat1 /opt/tomcat2

3、配置 Java 环境变量#

1
cat >> /home/tomcat/.bash_profile <<EOF
2

3
export JAVA_HOME=/opt/java
4
export CLASSPATH=/opt/java/lib
5
export PATH=$PATH:/opt/java/bin
6
EOF

4、配置两套 Tomcat 端口#

1
sed -i 's/port="8080"/port="8081"/' /opt/tomcat1/conf/server.xml
2
sed -i 's/port="8005"/port="8006"/' /opt/tomcat1/conf/server.xml
3
sed -i 's/port="8009"/port="8010"/' /opt/tomcat1/conf/server.xml
4

5
sed -i 's/port="8080"/port="8082"/' /opt/tomcat2/conf/server.xml
6
sed -i 's/port="8005"/port="8007"/' /opt/tomcat2/conf/server.xml
7
sed -i 's/port="8009"/port="8011"/' /opt/tomcat2/conf/server.xml

5、配置默认首页#

1
echo "helloJava_ps_1" > /opt/tomcat1/webapps/ROOT/index.jsp
2
echo "helloJava_ps_2" > /opt/tomcat2/webapps/ROOT/index.jsp

6、tomcat.service 统一管理两套实例#

1
cat > /etc/systemd/system/tomcat.service <<'EOF'
2
[Unit]
3
Description=Apache Tomcat Web Application Container
4
After=network.target
5

6
[Service]
7
Type=forking
8
User=tomcat
9
Group=tomcat
10
Environment=JAVA_HOME=/opt/java
11
ExecStart=/bin/bash -c '/opt/tomcat1/bin/startup.sh && /opt/tomcat2/bin/startup.sh'
12
ExecStop=/bin/bash -c '/opt/tomcat1/bin/shutdown.sh && /opt/tomcat2/bin/shutdown.sh'
13

14
[Install]
15
WantedBy=multi-user.target
16
EOF
17
systemctl daemon-reload
18
systemctl enable --now tomcat
19
systemctl start tomcat
20
systemctl stop tomcat

验证：

1
curl http://172.16.50.231:8081/
2
curl http://172.16.50.231:8082/

六、server1 配置负载均衡 Haproxy#

1
rpm -ivh /opt/software/haproxy-*.rpm
2
vim /etc/haproxy/haproxy.cfg

1
global
2
    maxconn 4096
3

4
defaults
5
    mode http
6
    timeout connect 5000ms
7
    timeout client 50000ms
8
    timeout server 50000ms
9

10
frontend http_front
11
    bind *:8088
12
    default_backend java_servers
13

14
backend java_servers
15
    balance roundrobin
16
    server tomcat1 127.0.0.1:8081 check
17
    server tomcat2 127.0.0.1:8082 check
18

19
listen stats
20
    bind *:8009
21
    mode http
22
    stats enable
23
    stats uri /haproxy?stats

1
systemctl enable --now haproxy
2
systemctl restart haproxy
3
curl http://172.16.50.231:8088/
4
curl "http://172.16.50.231:8009/haproxy?stats"

七、server1 日志管理#

1、Tomcat 日志统一存放并修改前缀#

1
mkdir -p /var/log/tomcat/logs
2
chown tomcat:tomcat /var/log/tomcat/logs
3

4
sed -i 's|CATALINA_OUT="$CATALINA_BASE"/logs/catalina.out|CATALINA_OUT=/var/log/tomcat/logs/tomcat_1-catalina.out|' /opt/tomcat1/bin/catalina.sh
5
sed -i 's|^1catalina.org.apache.juli.AsyncFileHandler.prefix=catalina.|1catalina.org.apache.juli.AsyncFileHandler.prefix=tomcat_1-catalina.|' /opt/tomcat1/conf/logging.properties
6

7
sed -i 's|CATALINA_OUT="$CATALINA_BASE"/logs/catalina.out|CATALINA_OUT=/var/log/tomcat/logs/tomcat_2-catalina.out|' /opt/tomcat2/bin/catalina.sh
8
sed -i 's|^1catalina.org.apache.juli.AsyncFileHandler.prefix=catalina.|1catalina.org.apache.juli.AsyncFileHandler.prefix=tomcat_2-catalina.|' /opt/tomcat2/conf/logging.properties
9

10
systemctl restart tomcat
11
ls /var/log/tomcat/logs/

2、rsyslog 发送日志到 server2#

1
cat > /etc/rsyslog.d/10-forwards.conf <<EOF
2
*.* @@172.16.50.232:514
3
EOF
4
systemctl restart rsyslog

八、server2 系统环境配置#

1、修改主机名#

1
hostnamectl set-hostname server2.kylin.com
2
bash

2、配置 YUM 源（ftp）#

1
cat > /etc/yum.repos.d/ftp.repo <<EOF
2
[ftp]
3
name=Server1 FTP Repo
4
baseurl=ftp://server1.kylin.com
5
enabled=1
6
gpgcheck=0
7
EOF
8
yum clean all
9
yum makecache

3、用户组管理与密码策略#

1
groupadd devgroup
2
useradd -G devgroup dev1
3
useradd -G devgroup dev2
4
passwd dev1
5
cat > /etc/sudoers.d/devgroup <<EOF
6
%devgroup ALL=(ALL) NOPASSWD: ALL
7
EOF
8
chage -M 90 -W 7 -m 2 dev1
9
chage -l dev1

4、目录 SGID 特殊权限#

1
mkdir /opt/project
2
chown root:devgroup /opt/project
3
chmod 2775 /opt/project

5、创建 pk.sh 监控脚本#

1
cat > /opt/pk.sh <<'EOF'
2
#!/bin/bash
3
CPU_USAGE=$(top -bn1 | grep "Cpu(s)" | sed 's/.*, *\([0-9.]*\)%* id.*/\1/' | awk '{print 100-$1}')
4
MEM_TOTAL=$(free -m | awk '/^Mem:/{print $2}')
5
MEM_USED=$(free -m | awk '/^Mem:/{print $3}')
6
MEM_PERCENT=$(awk -v u="$MEM_USED" -v t="$MEM_TOTAL" 'BEGIN{printf "%.1f", u/t*100}')
7
echo "CPU Usage: ${CPU_USAGE}%"
8
echo "Memory Usage: ${MEM_USED}/${MEM_TOTAL}MB(${MEM_PERCENT}%)"
9
EOF
10
chmod 750 /opt/pk.sh
11
/opt/pk.sh | tee /var/log/monitor.log

6、创建 info.sh 参数脚本#

1
cat > /opt/info.sh <<'EOF'
2
#!/bin/bash
3
if [ "$1" = "kylin" ] || [ "$1" = "ITAI" ]; then
4
    echo "$1"
5
else
6
    echo "Error 99" >&2
7
fi
8
EOF
9
chmod 750 /opt/info.sh
10
/opt/info.sh kylin
11
/opt/info.sh ITAI
12
/opt/info.sh xx

7、配置 chrony 时间同步#

1
yum install -y chrony
2
sed -i '/^pool /d' /etc/chrony.conf
3
echo "server server1.kylin.com iburst" >> /etc/chrony.conf
4
systemctl restart chronyd
5
chronyc sources

8、指定 DNS 服务器#

1
echo "nameserver 172.16.50.231" > /etc/resolv.conf
2
nslookup server1.kylin.com
3
nslookup server2.kylin.com

9、网络共享#

1
yum install -y nfs-utils autofs
2
mkdir -p /nfs/net_public /nfsdata/net_dir

KY01 使用 autofs 挂载：

1
cat >> /etc/auto.master <<EOF
2
/nfs/net_public /etc/auto.misc --timeout=60
3
EOF
4
cat >> /etc/auto.misc <<EOF
5
KY01 -fstype=nfs,rw server1.kylin.com:/nfsdata/KY01
6
EOF
7
systemctl enable --now autofs
8
systemctl restart autofs
9
ls /nfs/net_public/KY01
10
df -h

KY02 开机自动挂载：

1
echo "server1.kylin.com:/nfsdata/KY02 /nfsdata/net_dir nfs ro,_netdev 0 0" >> /etc/fstab
2
mount -a
3
df -h

九、server2 Ansible 自动化部署 nginx#

1、安装 ansible 并配置清单#

1
rpm -ivh /opt/software/ansible-*.rpm
2
mkdir -p /etc/ansible
3
cat > /etc/ansible/hosts <<EOF
4
[web]
5
server1.kylin.com
6
EOF
7
ssh-keygen -t rsa -N ""
8
ssh-copy-id root@server1.kylin.com

2、创建 nginx role#

1
mkdir -p /etc/ansible/roles/nginx/{tasks,templates,files}
2
cp /opt/software/nginx.conf /etc/ansible/roles/nginx/files/
3
cp /opt/software/nginx.j2 /etc/ansible/roles/nginx/templates/
4
cp /opt/software/nginx-*.rpm /etc/ansible/roles/nginx/files/nginx.rpm

1
cat > /etc/ansible/roles/nginx/tasks/main.yml <<'EOF'
2
---
3
- name: 拷贝 nginx 软件包
4
  copy: src=nginx.rpm dest=/opt/software/nginx.rpm
5

6
- name: 安装 nginx
7
  yum: name=/opt/software/nginx.rpm state=present
8

9
- name: 渲染 nginx 配置模板
10
  template: src=nginx.j2 dest=/etc/nginx/nginx.conf
11
  notify: restart nginx
12

13
- name: 启动 nginx
14
  service: name=nginx state=started enabled=yes
15
EOF

1
cat > /etc/ansible/roles/nginx/handlers/main.yml <<'EOF'
2
---
3
- name: restart nginx
4
  service: name=nginx state=restarted
5
EOF

3、编写 playbook 并执行#

1
cat > /etc/ansible/nginx.yml <<'EOF'
2
---
3
- hosts: web
4
  roles:
5
    - nginx
6
EOF
7
ansible-playbook /etc/ansible/nginx.yml
8
ansible web -m ping
9
curl http://server1.kylin.com/

十、server2 PostgreSQL 数据库运维#

1、安装初始化 postgresql#

1
rpm -ivh /opt/software/postgresql-server-*.rpm
2
/usr/bin/postgresql-setup --initdb
3
systemctl enable --now postgresql

1
vim /var/lib/pgsql/data/postgresql.conf

1
listen_addresses = '*'
2
port = 5432

1
cat >> /var/lib/pgsql/data/pg_hba.conf <<EOF
2
host    all    all    172.16.50.0/24    md5
3
EOF
4
systemctl restart postgresql

设置 postgres 口令：

1
su - postgres -c "psql -c \"ALTER USER postgres WITH PASSWORD 'you_passwd';\""

2、创建数据库并导入#

1
su - postgres -c "createdb company_db"
2
su - postgres -c "psql company_db < /opt/software/company_db.sql"

3、数据库操作（按顺序执行）#

查询每部门员工数量、平均薪资、最高薪资，按平均薪资降序：

1
su - postgres -c "psql company_db -c \"SELECT d.department_name, COUNT(e.employee_id) AS emp_count, AVG(e.salary) AS avg_salary, MAX(e.salary) AS max_salary FROM employees e JOIN departments d ON e.department_id = d.department_id GROUP BY d.department_name ORDER BY avg_salary DESC;\"" > /data/result_1.log

查询参与“ERP系统升级”项目的员工信息：

1
su - postgres -c "psql company_db -c \"SELECT e.employee_name, d.department_name, p.role, p.work_hours FROM employees e JOIN departments d ON e.department_id = d.department_id JOIN project_members p ON e.employee_id = p.employee_id JOIN projects pr ON p.project_id = pr.project_id WHERE pr.project_name = 'ERP系统升级';\"" > /data/result_2.log

查询薪资高于部门平均薪资的员工：

1
su - postgres -c "psql company_db -c \"SELECT e.employee_name, d.department_name, e.salary, a.avg_salary FROM employees e JOIN departments d ON e.department_id = d.department_id JOIN (SELECT department_id, AVG(salary) AS avg_salary FROM employees GROUP BY department_id) a ON e.department_id = a.department_id WHERE e.salary > a.avg_salary;\"" > /data/result_3.log

技术部（部门 ID 为 1）薪资低于 12000 的员工加薪 10%，最高不超过 13000：

1
su - postgres -c "psql company_db -c \"UPDATE employees SET salary = LEAST(salary * 1.1, 13000) WHERE department_id = 1 AND salary < 12000;\""

表名/字段名以 company_db.sql 实际结构为准，如不一致按实际结构调整 SQL。

4、挂载 gv_safe 并进行完整备份#

1
yum install -y glusterfs-client
2
mkdir -p /mnt/backup
3
echo "server1.kylin.com:/gv_safe /mnt/backup glusterfs defaults,_netdev 0 0" >> /etc/fstab
4
mount -a
5
df -h
6

7
su - postgres -c "pg_dump company_db" > /mnt/backup/db_backup.sql
8
ls -l /mnt/backup/

5、配置 crontab 定期备份#

1
mkdir -p /data/backup /data/script
2
cat > /data/script/backup.sh <<'EOF'
3
#!/bin/bash
4
su - postgres -c "pg_dump company_db" > /data/backup/db_backup_$(date +%F).sql
5
EOF
6
chmod +x /data/script/backup.sh
7

8
cat > /data/script/store.sh <<'EOF'
9
#!/bin/bash
10
tar czf /mnt/backup/db_backup_$(date +%F).tar.gz -C /data/backup db_backup_*.sql
11
EOF
12
chmod +x /data/script/store.sh
13

14
crontab -e

1
55 23 * * 0 bash /data/script/backup.sh
2
0 23 25 * * bash /data/script/store.sh

1
crontab -l

十一、server2 rsyslog 日志服务器#

1
vim /etc/rsyslog.conf

取消以下注释：

1
$ModLoad imudp
2
$UDPServerRun 514
3
$ModLoad imtcp
4
$InputTCPServerRun 514

创建日志收集模板：

1
cat > /etc/rsyslog.d/20-logs-template.conf <<'EOF'
2
$template logs,"/var/log/remote/%HOSTNAME%/%programname%.log"
3
*.* ?logs
4
EOF
5
systemctl restart rsyslog

验证：

1
ss -tunlp | grep 514
2
ls /var/log/remote/
3
ls /var/log/remote/server1/

一、server1 系统环境配置#

1、修改主机名#

2、创建多级目录并查看#

3、复制文件并改名#

4、查看文件权限并修改为 640#

5、配置 YUM 仓库源#

6、安装配置 vsftpd#

7、配置 chrony 时间服务器#

8、配置 DNS 正向解析#

9、配置 NFS 网络共享#

二、server1 Docker 容器集群管理#

1、二进制方式部署 Docker 20.10.9#

2、导入镜像并创建容器#

3、容器内安装配置 Mariadb#

4、Mariadb 互为主备#

5、创建数据库与表#

三、server1 Harbor 镜像仓库#

1、docker-compose 离线安装 Harbor#

2、API 创建用户、项目并添加成员#

3、上传镜像到 Harbor#

四、GlusterFS 存储集群（两台主机执行）#

1、格式化磁盘并挂载（两台）#

2、添加信任存储节点#

3、创建复制卷 gv_safe#

4、创建分布式卷 gv_data#

5、启动卷并设置访问控制#

五、server1 Java 应用环境配置#

1、部署 Java 与 Tomcat#

2、创建 tomcat 用户#

3、配置 Java 环境变量#

4、配置两套 Tomcat 端口#

5、配置默认首页#

6、tomcat.service 统一管理两套实例#

六、server1 配置负载均衡 Haproxy#

七、server1 日志管理#

1、Tomcat 日志统一存放并修改前缀#

2、rsyslog 发送日志到 server2#

八、server2 系统环境配置#

1、修改主机名#

2、配置 YUM 源（ftp）#

3、用户组管理与密码策略#

4、目录 SGID 特殊权限#

5、创建 pk.sh 监控脚本#

6、创建 info.sh 参数脚本#

7、配置 chrony 时间同步#

8、指定 DNS 服务器#

9、网络共享#

九、server2 Ansible 自动化部署 nginx#

1、安装 ansible 并配置清单#

2、创建 nginx role#

3、编写 playbook 并执行#

十、server2 PostgreSQL 数据库运维#

1、安装初始化 postgresql#

2、创建数据库并导入#

3、数据库操作（按顺序执行）#

4、挂载 gv_safe 并进行完整备份#

5、配置 crontab 定期备份#

十一、server2 rsyslog 日志服务器#

相关文章

评论区

音乐