From 86a95cca9548ef1566f7d26862d56cad38606136 Mon Sep 17 00:00:00 2001 From: BryantHe Date: Mon, 29 May 2023 16:46:03 +0800 Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=E6=96=B0=E6=9C=8D=E5=8A=A1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 10 + apisix_conf/config.yaml | 51 + dashboard_conf/conf.yaml | 112 ++ docker-compose-apisix.yml | 101 + etcd_conf/etcd.conf.yml | 157 ++ grafana_conf/config/grafana.ini | 756 +++++++ .../dashboards/apisix-grafana-dashboard.json | 1782 +++++++++++++++++ grafana_conf/provisioning/dashboards/all.yaml | 27 + .../provisioning/datasources/all.yaml | 25 + mkcert/README.md | 17 + mkcert/lvh.me+1-key.pem | 28 + mkcert/lvh.me+1.pem | 25 + mkcert/rootCA-key.pem | 40 + mkcert/rootCA.pem | 27 + prometheus_conf/prometheus.yml | 40 + 15 files changed, 3198 insertions(+) create mode 100644 apisix_conf/config.yaml create mode 100644 dashboard_conf/conf.yaml create mode 100644 docker-compose-apisix.yml create mode 100644 etcd_conf/etcd.conf.yml create mode 100644 grafana_conf/config/grafana.ini create mode 100644 grafana_conf/dashboards/apisix-grafana-dashboard.json create mode 100644 grafana_conf/provisioning/dashboards/all.yaml create mode 100644 grafana_conf/provisioning/datasources/all.yaml create mode 100644 mkcert/README.md create mode 100644 mkcert/lvh.me+1-key.pem create mode 100644 mkcert/lvh.me+1.pem create mode 100644 mkcert/rootCA-key.pem create mode 100644 mkcert/rootCA.pem create mode 100644 prometheus_conf/prometheus.yml diff --git a/README.md b/README.md index dfe0056..e55ba1f 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,8 @@ chassis 微服务基座依赖的服务 - Logstash - Kibana - Fluentd +- Gateway + - APISIX - MiddleWares - RabbitMQ - Mysql @@ -35,6 +37,14 @@ grafana 的配置在：./service_configs/admin_service/grafana/xxxx.json （根 `docker-compose -f docker-compose-logging.yml up -d --build --remove-orphans` +## 启动 APISIX + + +启动服务的命令： + +`docker-compose -f docker-compose-apisix.yml up -d --build --remove-orphans` + + ## 启动 RabbitMQ diff --git a/apisix_conf/config.yaml b/apisix_conf/config.yaml new file mode 100644 index 0000000..8012137 --- /dev/null +++ b/apisix_conf/config.yaml @@ -0,0 +1,51 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +apisix: + node_listen: 9080 # APISIX listening port + enable_ipv6: false + + enable_control: true + control: + ip: "0.0.0.0" + port: 9092 + +deployment: + admin: + allow_admin: # https://nginx.org/en/docs/http/ngx_http_access_module.html#allow + - 0.0.0.0/0 # We need to restrict ip access rules for security. 0.0.0.0/0 is for test. + + admin_key: + - name: "admin" + key: edd1c9f034335f136f87ad84b625c8f1 + role: admin # admin: manage all configuration data + + - name: "viewer" + key: 4054f7cf07e344346cd3f287985e76a2 + role: viewer + + etcd: + host: # it's possible to define multiple etcd hosts addresses of the same etcd cluster. + - "http://etcd:2379" # multiple etcd address + prefix: "/apisix" # apisix configurations prefix + timeout: 30 # 30 seconds + +plugin_attr: + prometheus: + export_addr: + ip: "0.0.0.0" + port: 9091 diff --git a/dashboard_conf/conf.yaml b/dashboard_conf/conf.yaml new file mode 100644 index 0000000..cc9adab --- /dev/null +++ b/dashboard_conf/conf.yaml @@ -0,0 +1,112 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +conf: + listen: + host: 0.0.0.0 # `manager api` listening ip or host name + port: 9000 # `manager api` listening port + allow_list: # If we don't set any IP list, then any IP access is allowed by default. + - 0.0.0.0/0 + etcd: + endpoints: # supports defining multiple etcd host addresses for an etcd cluster + - "http://etcd:2379" + # yamllint disable rule:comments-indentation + # etcd basic auth info + # username: "root" # ignore etcd username if not enable etcd auth + # password: "123456" # ignore etcd password if not enable etcd auth + mtls: + key_file: "" # Path of your self-signed client side key + cert_file: "" # Path of your self-signed client side cert + ca_file: "" # Path of your self-signed ca cert, the CA is used to sign callers' certificates + # prefix: /apisix # apisix config's prefix in etcd, /apisix by default + log: + error_log: + level: warn # supports levels, lower to higher: debug, info, warn, error, panic, fatal + file_path: + logs/error.log # supports relative path, absolute path, standard output + # such as: logs/error.log, /tmp/logs/error.log, /dev/stdout, /dev/stderr + access_log: + file_path: + logs/access.log # supports relative path, absolute path, standard output + # such as: logs/access.log, /tmp/logs/access.log, /dev/stdout, /dev/stderr + # log example: 2020-12-09T16:38:09.039+0800 INFO filter/logging.go:46 /apisix/admin/routes/r1 {"status": 401, "host": "127.0.0.1:9000", "query": "asdfsafd=adf&a=a", "requestId": "3d50ecb8-758c-46d1-af5b-cd9d1c820156", "latency": 0, "remoteIP": "127.0.0.1", "method": "PUT", "errs": []} + security: + # access_control_allow_origin: "http://httpbin.org" + # access_control_allow_credentials: true # support using custom cors configration + # access_control_allow_headers: "Authorization" + # access_control-allow_methods: "*" + # x_frame_options: "deny" + content_security_policy: "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-src *" # You can set frame-src to provide content for your grafana panel. + +authentication: + secret: + secret # secret for jwt token generation. + # NOTE: Highly recommended to modify this value to protect `manager api`. + # if it's default value, when `manager api` start, it will generate a random string to replace it. + expire_time: 604800 # jwt token expire time, in second + users: # yamllint enable rule:comments-indentation + - username: admin # username and password for login `manager api` + password: admin + - username: user + password: user + +plugins: # plugin list (sorted in alphabetical order) + - api-breaker + - authz-keycloak + - basic-auth + - batch-requests + - consumer-restriction + - cors + # - dubbo-proxy + - echo + # - error-log-logger + # - example-plugin + - fault-injection + - grpc-transcode + - hmac-auth + - http-logger + - ip-restriction + - jwt-auth + - kafka-logger + - key-auth + - limit-conn + - limit-count + - limit-req + # - log-rotate + # - node-status + - openid-connect + - prometheus + - proxy-cache + - proxy-mirror + - proxy-rewrite + - redirect + - referer-restriction + - request-id + - request-validation + - response-rewrite + - serverless-post-function + - serverless-pre-function + - skywalking + - sls-logger + - syslog + - tcp-logger + - udp-logger + - uri-blocker + - wolf-rbac + - zipkin + - server-info + - traffic-split diff --git a/docker-compose-apisix.yml b/docker-compose-apisix.yml new file mode 100644 index 0000000..d6e13f6 --- /dev/null +++ b/docker-compose-apisix.yml @@ -0,0 +1,101 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +version: "3" + +services: + apisix-dashboard: + image: apache/apisix-dashboard:latest + container_name: 'apisix-dashboard' + hostname: 'apisix-dashboard' + restart: always + volumes: + - ./dashboard_conf/conf.yaml:/usr/local/apisix-dashboard/conf/conf.yaml + ports: + - "9000:9000" + networks: + apisix: + + apisix: + image: apache/apisix:3.3.0-debian + container_name: 'apisix' + hostname: 'apisix' + restart: always + volumes: + - ./apisix_conf/config.yaml:/usr/local/apisix/conf/config.yaml:ro + depends_on: + - etcd + ##network_mode: host + ports: + - "9180:9180/tcp" + - "9080:9080/tcp" + - "9091:9091/tcp" + - "9443:9443/tcp" + - "9092:9092/tcp" + networks: + apisix: + + etcd: + image: bitnami/etcd:latest + container_name: 'apisix-etcd' + hostname: 'apisix-etcd' + restart: always + volumes: + - etcd_data:/bitnami/etcd + environment: + ETCD_ENABLE_V2: "true" + ALLOW_NONE_AUTHENTICATION: "yes" + ETCD_ADVERTISE_CLIENT_URLS: "http://etcd:2379" + ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379" + ports: + - "2379:2379/tcp" + networks: + apisix: + + prometheus: + image: prom/prometheus:latest + container_name: 'apisix-prometheus' + hostname: 'apisix-prometheus' + restart: always + volumes: + - ./prometheus_conf/prometheus.yml:/etc/prometheus/prometheus.yml + ports: + - "9093:9090" + networks: + apisix: + + grafana: + image: grafana/grafana:latest + container_name: 'apisix-grafana' + hostname: 'apisix-grafana' + restart: always + ports: + - "3010:3000" + volumes: + - "./grafana_conf/provisioning:/etc/grafana/provisioning" + - "./grafana_conf/dashboards:/var/lib/grafana/dashboards" + - "./grafana_conf/config/grafana.ini:/etc/grafana/grafana.ini" + networks: + apisix: + +networks: + apisix: + driver: bridge + +volumes: + etcd_data: + driver: local diff --git a/etcd_conf/etcd.conf.yml b/etcd_conf/etcd.conf.yml new file mode 100644 index 0000000..1152953 --- /dev/null +++ b/etcd_conf/etcd.conf.yml @@ -0,0 +1,157 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +# This is the configuration file for the etcd server. + +# Human-readable name for this member. +name: 'default' + +# Path to the data directory. +data-dir: + +# Path to the dedicated wal directory. +wal-dir: + +# Number of committed transactions to trigger a snapshot to disk. +snapshot-count: 10000 + +# Time (in milliseconds) of a heartbeat interval. +heartbeat-interval: 100 + +# Time (in milliseconds) for an election to timeout. +election-timeout: 1000 + +# Raise alarms when backend size exceeds the given quota. 0 means use the +# default quota. +quota-backend-bytes: 0 + +# List of comma separated URLs to listen on for peer traffic. +listen-peer-urls: http://localhost:2380 + +# List of comma separated URLs to listen on for client traffic. +listen-client-urls: http://localhost:2379 + +# Maximum number of snapshot files to retain (0 is unlimited). +max-snapshots: 5 + +# Maximum number of wal files to retain (0 is unlimited). +max-wals: 5 + +# Comma-separated white list of origins for CORS (cross-origin resource sharing). +cors: + +# List of this member's peer URLs to advertise to the rest of the cluster. +# The URLs needed to be a comma-separated list. +initial-advertise-peer-urls: http://localhost:2380 + +# List of this member's client URLs to advertise to the public. +# The URLs needed to be a comma-separated list. +advertise-client-urls: http://localhost:2379 + +# Discovery URL used to bootstrap the cluster. +discovery: + +# Valid values include 'exit', 'proxy' +discovery-fallback: 'proxy' + +# HTTP proxy to use for traffic to discovery service. +discovery-proxy: + +# DNS domain used to bootstrap initial cluster. +discovery-srv: + +# Initial cluster configuration for bootstrapping. +initial-cluster: + +# Initial cluster token for the etcd cluster during bootstrap. +initial-cluster-token: 'etcd-cluster' + +# Initial cluster state ('new' or 'existing'). +initial-cluster-state: 'new' + +# Reject reconfiguration requests that would cause quorum loss. +strict-reconfig-check: false + +# Accept etcd V2 client requests +enable-v2: true + +# Enable runtime profiling data via HTTP server +enable-pprof: true + +# Valid values include 'on', 'readonly', 'off' +proxy: 'off' + +# Time (in milliseconds) an endpoint will be held in a failed state. +proxy-failure-wait: 5000 + +# Time (in milliseconds) of the endpoints refresh interval. +proxy-refresh-interval: 30000 + +# Time (in milliseconds) for a dial to timeout. +proxy-dial-timeout: 1000 + +# Time (in milliseconds) for a write to timeout. +proxy-write-timeout: 5000 + +# Time (in milliseconds) for a read to timeout. +proxy-read-timeout: 0 + +client-transport-security: + # Path to the client server TLS cert file. + cert-file: + + # Path to the client server TLS key file. + key-file: + + # Enable client cert authentication. + client-cert-auth: false + + # Path to the client server TLS trusted CA cert file. + trusted-ca-file: + + # Client TLS using generated certificates + auto-tls: false + +peer-transport-security: + # Path to the peer server TLS cert file. + cert-file: + + # Path to the peer server TLS key file. + key-file: + + # Enable peer client cert authentication. + client-cert-auth: false + + # Path to the peer server TLS trusted CA cert file. + trusted-ca-file: + + # Peer TLS using generated certificates. + auto-tls: false + +# Enable debug-level logging for etcd. +debug: false + +logger: zap + +# Specify 'stdout' or 'stderr' to skip journald logging even when running under systemd. +log-outputs: [stderr] + +# Force to create a new one member cluster. +force-new-cluster: false + +auto-compaction-mode: periodic +auto-compaction-retention: "1" diff --git a/grafana_conf/config/grafana.ini b/grafana_conf/config/grafana.ini new file mode 100644 index 0000000..cb6a737 --- /dev/null +++ b/grafana_conf/config/grafana.ini @@ -0,0 +1,756 @@ +##################### Grafana Configuration Example ##################### +# +# Everything has defaults so you only need to uncomment things you want to +# change + +# possible values : production, development +;app_mode = production + +# instance name, defaults to HOSTNAME environment variable value or hostname if HOSTNAME var is empty +;instance_name = ${HOSTNAME} + +#################################### Paths #################################### +[paths] +# Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used) +;data = /var/lib/grafana + +# Temporary files in `data` directory older than given duration will be removed +;temp_data_lifetime = 24h + +# Directory where grafana can store logs +;logs = /var/log/grafana + +# Directory where grafana will automatically scan and look for plugins +;plugins = /var/lib/grafana/plugins + +# folder that contains provisioning config files that grafana will apply on startup and while running. +;provisioning = conf/provisioning + +#################################### Server #################################### +[server] +# Protocol (http, https, h2, socket) +;protocol = http + +# The ip address to bind to, empty will bind to all interfaces +;http_addr = + +# The http port to use +;http_port = 3000 + +# The public facing domain name used to access grafana from a browser +;domain = localhost + +# Redirect to correct domain if host header does not match domain +# Prevents DNS rebinding attacks +;enforce_domain = false + +# The full public facing url you use in browser, used for redirects and emails +# If you use reverse proxy and sub path specify full url (with sub path) +;root_url = %(protocol)s://%(domain)s:%(http_port)s/ + +# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons. +;serve_from_sub_path = false + +# Log web requests +;router_logging = false + +# the path relative working path +;static_root_path = public + +# enable gzip +;enable_gzip = false + +# https certs & key file +;cert_file = +;cert_key = + +# Unix socket path +;socket = + +#################################### Database #################################### +[database] +# You can configure the database connection by specifying type, host, name, user and password +# as separate properties or as on string using the url properties. + +# Either "mysql", "postgres" or "sqlite3", it's your choice +;type = sqlite3 +;host = 127.0.0.1:3306 +;name = grafana +;user = root +# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;""" +;password = + +# Use either URL or the previous fields to configure the database +# Example: mysql://user:secret@host:port/database +;url = + +# For "postgres" only, either "disable", "require" or "verify-full" +;ssl_mode = disable + +;ca_cert_path = +;client_key_path = +;client_cert_path = +;server_cert_name = + +# For "sqlite3" only, path relative to data_path setting +;path = grafana.db + +# Max idle conn setting default is 2 +;max_idle_conn = 2 + +# Max conn setting default is 0 (mean not set) +;max_open_conn = + +# Connection Max Lifetime default is 14400 (means 14400 seconds or 4 hours) +;conn_max_lifetime = 14400 + +# Set to true to log the sql calls and execution times. +;log_queries = + +# For "sqlite3" only. cache mode setting used for connecting to the database. (private, shared) +;cache_mode = private + +#################################### Cache server ############################# +[remote_cache] +# Either "redis", "memcached" or "database" default is "database" +;type = database + +# cache connectionstring options +# database: will use Grafana primary database. +# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0,ssl=false`. Only addr is required. ssl may be 'true', 'false', or 'insecure'. +# memcache: 127.0.0.1:11211 +;connstr = + +#################################### Data proxy ########################### +[dataproxy] + +# This enables data proxy logging, default is false +;logging = false + +# How long the data proxy should wait before timing out default is 30 (seconds) +;timeout = 30 + +# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request, default is false. +;send_user_header = false + +#################################### Analytics #################################### +[analytics] +# Server reporting, sends usage counters to stats.grafana.org every 24 hours. +# No ip addresses are being tracked, only simple counters to track +# running instances, dashboard and error counts. It is very helpful to us. +# Change this option to false to disable reporting. +;reporting_enabled = true + +# Set to false to disable all checks to https://grafana.net +# for new vesions (grafana itself and plugins), check is used +# in some UI views to notify that grafana or plugin update exists +# This option does not cause any auto updates, nor send any information +# only a GET request to http://grafana.com to get latest versions +;check_for_updates = true + +# Google Analytics universal tracking code, only enabled if you specify an id here +;google_analytics_ua_id = + +# Google Tag Manager ID, only enabled if you specify an id here +;google_tag_manager_id = + +#################################### Security #################################### +[security] +# disable creation of admin user on first start of grafana +;disable_initial_admin_creation = false + +# default admin user, created on startup +;admin_user = admin + +# default admin password, can be changed before first start of grafana, or in profile settings +;admin_password = admin + +# used for signing +;secret_key = SW2YcwTIb9zpOOhoPsMm + +# disable gravatar profile images +;disable_gravatar = false + +# data source proxy whitelist (ip_or_domain:port separated by spaces) +;data_source_proxy_whitelist = + +# disable protection against brute force login attempts +;disable_brute_force_login_protection = false + +# set to true if you host Grafana behind HTTPS. default is false. +;cookie_secure = false + +# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled" +;cookie_samesite = none + +# set to true if you want to allow browsers to render Grafana in a ,