feat: add one-click deploy script + project optimization
- deploy.sh: one-click deployment (squid + venv + pip + gunicorn + systemd) - gunicorn_config.py: unified gunicorn config with env var overrides - .env.example: env var template for SECRET_KEY, port, workers, security - wsgi.py: create all runtime dirs (uploads, ssl_certs); optional dotenv loading - requirements.txt: add python-dotenv + cryptography - .gitignore: cover runtime dirs, .env, pyc files
This commit is contained in:
Your Name
@@ -0,0 +1,425 @@
|
||||
#!/usr/bin/env bash
|
||||
# =============================================================================
|
||||
# Squid Manager - 一键部署脚本
|
||||
# =============================================================================
|
||||
# 功能：
|
||||
# 1. 安装系统依赖 (squid, python3, pip, gcc 等)
|
||||
# 2. 创建 Python 虚拟环境并安装 pip 依赖
|
||||
# 3. 初始化数据库 & 默认管理员
|
||||
# 4. 生成 gunicorn + systemd 服务文件并启动
|
||||
# 5. 配置 squid (放行 localnet + 基本安全设置)
|
||||
#
|
||||
# 用法：
|
||||
# bash deploy.sh # 全自动部署 (默认 /opt/squid-manager)
|
||||
# INSTALL_DIR=/opt/sm bash deploy.sh # 自定义安装目录
|
||||
# bash deploy.sh --no-squid # 不安装/配置 squid
|
||||
# bash deploy.sh --no-start # 不启动服务 (仅生成文件)
|
||||
# =============================================================================
|
||||
set -euo pipefail
|
||||
|
||||
# ---- 配置 -------------------------------------------------------------------
|
||||
INSTALL_DIR="${INSTALL_DIR:-/opt/squid-manager}"
|
||||
SERVICE_NAME="${SERVICE_NAME:-squid-manager}"
|
||||
GUNICORN_HOST="${SQUIDMGR_HOST:-0.0.0.0}"
|
||||
GUNICORN_PORT="${SQUIDMGR_PORT:-5200}"
|
||||
GUNICORN_WORKERS="${SQUIDMGR_WORKERS:-2}"
|
||||
ADMIN_USER="${ADMIN_USER:-admin}"
|
||||
ADMIN_PASS="${ADMIN_PASS:-admin123}"
|
||||
|
||||
INSTALL_SQUID=true
|
||||
START_SERVICE=true
|
||||
SKIP_EXISTING=false # 若服务已存在是否跳过
|
||||
|
||||
for arg in "$@"; do
|
||||
case "$arg" in
|
||||
--no-squid) INSTALL_SQUID=false ;;
|
||||
--no-start) START_SERVICE=false ;;
|
||||
--skip-existing) SKIP_EXISTING=true ;;
|
||||
-h|--help)
|
||||
sed -n '2,20p' "$0"
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
echo "未知参数: $arg" >&2; exit 1 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
# ---- 工具函数 ---------------------------------------------------------------
|
||||
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
|
||||
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
|
||||
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
||||
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
|
||||
|
||||
_generate_minimal_squid_conf() {
|
||||
# 生成一份最小可用的 Squid 5.x 配置
|
||||
local out="$1"
|
||||
cat > "$out" << 'SQUIDEOF'
|
||||
# Minimal Squid 5.x configuration — generated by Squid Manager deploy.sh
|
||||
# 可通过 Web UI (/config/raw) 继续编辑和扩展。
|
||||
|
||||
http_port 3128
|
||||
icp_port 3130
|
||||
|
||||
# Cache
|
||||
cache_mem 256 MB
|
||||
maximum_object_size 4096 KB
|
||||
cache_dir ufs /var/spool/squid 100 16 256
|
||||
|
||||
# ACLs
|
||||
acl localhost src 127.0.0.1/32 ::1
|
||||
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
|
||||
acl localnet src 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fc00::/7 fe80::/10
|
||||
acl Safe_ports port 80 443 21 70 210 1025-65535
|
||||
acl SSL_ports port 443 563
|
||||
acl CONNECT method CONNECT
|
||||
|
||||
# Refresh patterns
|
||||
refresh_pattern ^ftp: 1440 20% 10080
|
||||
refresh_pattern ^gopher: 1440 0% 1440
|
||||
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
|
||||
refresh_pattern . 0 20% 4320
|
||||
|
||||
# Access rules
|
||||
http_access allow manager localhost
|
||||
http_access deny manager
|
||||
http_access deny !Safe_ports
|
||||
http_access deny CONNECT !SSL_ports
|
||||
http_access allow localhost
|
||||
http_access allow localnet
|
||||
http_access deny all
|
||||
|
||||
# Logging
|
||||
access_log /var/log/squid/access.log squid
|
||||
cache_log /var/log/squid/cache.log
|
||||
|
||||
# Misc
|
||||
coredump_dir /var/spool/squid
|
||||
visible_hostname squid-manager
|
||||
SQUIDEOF
|
||||
}
|
||||
|
||||
must_run_as_root() {
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
error "此脚本必须以 root 运行 (sudo $0)"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
detect_os() {
|
||||
if [[ -f /etc/os-release ]]; then
|
||||
. /etc/os-release
|
||||
OS_ID="$ID"
|
||||
OS_VER="$VERSION_ID"
|
||||
elif command -v apt-get &>/dev/null; then
|
||||
OS_ID="debian"
|
||||
elif command -v yum &>/dev/null; then
|
||||
OS_ID="centos"
|
||||
else
|
||||
error "无法识别操作系统"
|
||||
exit 1
|
||||
fi
|
||||
info "操作系统: $OS_ID $OS_VER"
|
||||
}
|
||||
|
||||
pkg_install() {
|
||||
info "安装系统包: $*"
|
||||
case "$OS_ID" in
|
||||
debian|ubuntu)
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-get update -qq
|
||||
apt-get install -y -qq "$@"
|
||||
;;
|
||||
centos|rhel|rocky|almalinux|ol)
|
||||
yum install -y -q "$@"
|
||||
;;
|
||||
*)
|
||||
error "不支持的包管理器: $OS_ID"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# ---- 1. 前置检查 ------------------------------------------------------------
|
||||
must_run_as_root
|
||||
detect_os
|
||||
|
||||
info "安装目录: $INSTALL_DIR"
|
||||
info "服务名: $SERVICE_NAME"
|
||||
info "监听: $GUNICORN_HOST:$GUNICORN_PORT"
|
||||
|
||||
# ---- 2. 安装系统依赖 --------------------------------------------------------
|
||||
SYS_PACKAGES=(
|
||||
python3 python3-pip python3-venv python3-dev
|
||||
gcc libffi-dev libssl-dev
|
||||
curl
|
||||
)
|
||||
|
||||
if $INSTALL_SQUID; then
|
||||
SYS_PACKAGES+=(squid squidclient)
|
||||
fi
|
||||
|
||||
pkg_install "${SYS_PACKAGES[@]}"
|
||||
|
||||
# 确保 python3 / pip3 可用
|
||||
PYTHON_BIN="$(command -v python3)"
|
||||
PIP_BIN="$(command -v pip3 || command -v pip)"
|
||||
info "Python: $PYTHON_BIN"
|
||||
info "Pip: $PIP_BIN"
|
||||
|
||||
# ---- 3. 部署项目文件 --------------------------------------------------------
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
if [[ "$SCRIPT_DIR" != "$INSTALL_DIR" ]]; then
|
||||
if [[ -d "$INSTALL_DIR" ]] && $SKIP_EXISTING; then
|
||||
warn "安装目录已存在且 --skip-existing，跳过文件复制"
|
||||
else
|
||||
info "复制项目文件到 $INSTALL_DIR"
|
||||
mkdir -p "$INSTALL_DIR"
|
||||
# 复制源码（排除 .git / instance / backups 等运行时目录）
|
||||
rsync -a --delete \
|
||||
--exclude='.git/' \
|
||||
--exclude='__pycache__/' \
|
||||
--exclude='*.pyc' \
|
||||
--exclude='instance/*.db' \
|
||||
--exclude='backups/' \
|
||||
--exclude='uploads/' \
|
||||
--exclude='ssl_certs/*.pem' \
|
||||
--exclude='.env' \
|
||||
"$SCRIPT_DIR/" "$INSTALL_DIR/"
|
||||
fi
|
||||
fi
|
||||
|
||||
cd "$INSTALL_DIR"
|
||||
|
||||
# 确保运行时目录存在
|
||||
mkdir -p instance backups uploads ssl_certs
|
||||
chmod 700 instance ssl_certs
|
||||
|
||||
# ---- 4. 创建虚拟环境 + 安装 pip 依赖 ----------------------------------------
|
||||
VENV_DIR="$INSTALL_DIR/.venv"
|
||||
|
||||
if [[ -d "$VENV_DIR" ]] && $SKIP_EXISTING; then
|
||||
warn "虚拟环境已存在且 --skip-existing，跳过依赖安装"
|
||||
else
|
||||
info "创建 Python 虚拟环境: $VENV_DIR"
|
||||
$PYTHON_BIN -m venv "$VENV_DIR"
|
||||
|
||||
info "升级 pip + 安装 Python 依赖"
|
||||
"$VENV_DIR/bin/pip" install --upgrade pip setuptools wheel
|
||||
"$VENV_DIR/bin/pip" install -r requirements.txt
|
||||
fi
|
||||
|
||||
PYTHON="$VENV_DIR/bin/python"
|
||||
GUNICORN="$VENV_DIR/bin/gunicorn"
|
||||
|
||||
# ---- 5. 生成 .env 配置 ------------------------------------------------------
|
||||
ENV_FILE="$INSTALL_DIR/.env"
|
||||
if [[ ! -f "$ENV_FILE" ]] || ! $SKIP_EXISTING; then
|
||||
info "生成 .env 配置文件"
|
||||
SECRET_KEY="$($PYTHON -c "import secrets; print(secrets.token_urlsafe(48))")"
|
||||
cat > "$ENV_FILE" <<EOF
|
||||
# Squid Manager - 自动生成于 $(date -Iseconds)
|
||||
SECRET_KEY=$SECRET_KEY
|
||||
SQUIDMGR_HOST=$GUNICORN_HOST
|
||||
SQUIDMGR_PORT=$GUNICORN_PORT
|
||||
SQUIDMGR_WORKERS=$GUNICORN_WORKERS
|
||||
SQUIDMGR_TIMEOUT=120
|
||||
EOF
|
||||
chmod 600 "$ENV_FILE"
|
||||
fi
|
||||
|
||||
# ---- 6. 初始化数据库 & 默认管理员 ------------------------------------------
|
||||
info "初始化数据库"
|
||||
$PYTHON -c "
|
||||
import os, sys
|
||||
os.environ.setdefault('SECRET_KEY', 'deploy-init')
|
||||
sys.path.insert(0, '$INSTALL_DIR')
|
||||
from wsgi import app, db
|
||||
from app import User
|
||||
with app.app_context():
|
||||
db.create_all()
|
||||
# 种子管理员
|
||||
u = User.query.filter_by(username='$ADMIN_USER').first()
|
||||
if u is None:
|
||||
u = User(username='$ADMIN_USER', role='admin')
|
||||
u.set_password('$ADMIN_PASS')
|
||||
db.session.add(u)
|
||||
db.session.commit()
|
||||
print(f'[init] 创建管理员: $ADMIN_USER / $ADMIN_PASS')
|
||||
else:
|
||||
u.set_password('$ADMIN_PASS')
|
||||
db.session.commit()
|
||||
print(f'[init] 管理员密码已更新: $ADMIN_USER')
|
||||
"
|
||||
|
||||
# ---- 7. 配置 Squid (如果需要) ----------------------------------------------
|
||||
if $INSTALL_SQUID; then
|
||||
SQUID_CONF="/etc/squid/squid.conf"
|
||||
|
||||
# 如果现有配置无法通过语法校验（升级后废弃指令等），用最小可用配置兜底
|
||||
if [[ -f "$SQUID_CONF" ]]; then
|
||||
if ! squid -k parse -f "$SQUID_CONF" &>/dev/null; then
|
||||
warn "现有 squid.conf 语法校验失败，备份后用最小可用配置替换"
|
||||
cp "$SQUID_CONF" "${SQUID_CONF}.broken.$(date +%s)"
|
||||
_generate_minimal_squid_conf "$SQUID_CONF"
|
||||
fi
|
||||
else
|
||||
info "squid.conf 不存在，生成最小可用配置"
|
||||
mkdir -p "$(dirname "$SQUID_CONF")"
|
||||
_generate_minimal_squid_conf "$SQUID_CONF"
|
||||
fi
|
||||
|
||||
if [[ -f "$SQUID_CONF" ]]; then
|
||||
info "配置 Squid"
|
||||
|
||||
# 备份原始配置
|
||||
if [[ ! -f "${SQUID_CONF}.orig" ]]; then
|
||||
cp "$SQUID_CONF" "${SQUID_CONF}.orig"
|
||||
info "已备份原始配置到 ${SQUID_CONF}.orig"
|
||||
fi
|
||||
|
||||
# 放行内网 (localnet)
|
||||
# 1) 确保 localnet ACL 存在
|
||||
if grep -qE '^acl[[:space:]]+localnet' "$SQUID_CONF"; then
|
||||
info "localnet ACL 已存在"
|
||||
else
|
||||
_localnet_def="acl localnet src 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fc00::/7 fe80::/10"
|
||||
# 找到第一个 http_access 行之前插入
|
||||
if grep -n '^http_access' "$SQUID_CONF" | head -1 | cut -d: -f1 >/dev/null; then
|
||||
_insert_line=$(grep -n '^http_access' "$SQUID_CONF" | head -1 | cut -d: -f1)
|
||||
sed -i "${_insert_line}i${_localnet_def}" "$SQUID_CONF"
|
||||
else
|
||||
echo "$_localnet_def" >> "$SQUID_CONF"
|
||||
fi
|
||||
info "已添加 localnet ACL 定义"
|
||||
fi
|
||||
|
||||
# 2) 确保 http_access allow localnet 在 deny all 之前
|
||||
if grep -q '^http_access allow localnet' "$SQUID_CONF"; then
|
||||
info "http_access allow localnet 已存在"
|
||||
else
|
||||
if grep -q '^http_access deny all' "$SQUID_CONF"; then
|
||||
sed -i '/^http_access deny all/i http_access allow localnet' "$SQUID_CONF"
|
||||
else
|
||||
echo "http_access allow localnet" >> "$SQUID_CONF"
|
||||
echo "http_access deny all" >> "$SQUID_CONF"
|
||||
fi
|
||||
info "已添加 http_access allow localnet"
|
||||
fi
|
||||
|
||||
# 3) 处理注释掉的老配置
|
||||
if grep -q '^# http_access allow localnet' "$SQUID_CONF"; then
|
||||
sed -i 's/^# http_access allow localnet/http_access allow localnet/' "$SQUID_CONF"
|
||||
fi
|
||||
|
||||
# visible_hostname
|
||||
if ! grep -q '^visible_hostname' "$SQUID_CONF"; then
|
||||
echo "visible_hostname $(hostname -f 2>/dev/null || hostname)" >> "$SQUID_CONF"
|
||||
fi
|
||||
|
||||
# 语法校验
|
||||
if squid -k parse -f "$SQUID_CONF" &>/dev/null; then
|
||||
info "Squid 配置语法校验通过"
|
||||
else
|
||||
warn "Squid 配置语法校验有警告，请检查 squid -k parse 输出"
|
||||
squid -k parse -f "$SQUID_CONF" 2>&1 | tail -10
|
||||
fi
|
||||
|
||||
# 初始化缓存目录 (首次启动需要 squid -z)
|
||||
if [[ ! -d /var/spool/squid/00 ]]; then
|
||||
info "初始化 Squid 缓存目录"
|
||||
squid -z 2>/dev/null || true
|
||||
chown -R proxy:proxy /var/spool/squid 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# 启动 squid 服务
|
||||
if command -v systemctl &>/dev/null; then
|
||||
systemctl enable --now squid 2>/dev/null || {
|
||||
warn "squid 服务启动失败，请手动检查 (systemctl status squid)"
|
||||
}
|
||||
if systemctl is-active --quiet squid; then
|
||||
info "Squid 服务运行正常 ✓"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
warn "未生成 squid.conf，跳过 squid 配置"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ---- 8. 生成 systemd 服务文件 ----------------------------------------------
|
||||
SERVICE_FILE="/etc/systemd/system/${SERVICE_NAME}.service"
|
||||
|
||||
info "生成 systemd 服务文件: $SERVICE_FILE"
|
||||
cat > "$SERVICE_FILE" <<EOF
|
||||
[Unit]
|
||||
Description=Squid Web Manager
|
||||
After=network.target squid.service
|
||||
Wants=squid.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=root
|
||||
Group=root
|
||||
WorkingDirectory=$INSTALL_DIR
|
||||
EnvironmentFile=$INSTALL_DIR/.env
|
||||
ExecStart=$GUNICORN -c gunicorn_config.py wsgi:app
|
||||
ExecReload=/bin/kill -s HUP \$MAINPID
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
TimeoutStopSec=30
|
||||
# 安全加固
|
||||
NoNewPrivileges=yes
|
||||
ProtectSystem=full
|
||||
ProtectHome=true
|
||||
ReadWritePaths=$INSTALL_DIR /etc/squid /var/log/squid /var/spool/squid /run
|
||||
PrivateTmp=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
systemctl daemon-reload
|
||||
systemctl enable "$SERVICE_NAME"
|
||||
info "systemd 服务已注册并设为开机自启"
|
||||
|
||||
# ---- 9. 启动服务 ------------------------------------------------------------
|
||||
if $START_SERVICE; then
|
||||
info "启动 $SERVICE_NAME 服务"
|
||||
systemctl restart "$SERVICE_NAME"
|
||||
sleep 2
|
||||
|
||||
if systemctl is-active --quiet "$SERVICE_NAME"; then
|
||||
info "$SERVICE_NAME 服务运行正常 ✓"
|
||||
else
|
||||
error "$SERVICE_NAME 服务启动失败！"
|
||||
echo "---------- journalctl 最后 30 行 ----------"
|
||||
journalctl -u "$SERVICE_NAME" --no-pager -n 30
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 健康检查
|
||||
if curl -sf -o /dev/null "http://127.0.0.1:${GUNICORN_PORT}/login"; then
|
||||
info "HTTP 健康检查通过 ✓ (http://127.0.0.1:${GUNICORN_PORT}/login)"
|
||||
else
|
||||
warn "HTTP 健康检查失败，请检查防火墙或端口配置"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ---- 10. 输出汇总 -----------------------------------------------------------
|
||||
echo ""
|
||||
echo "================================================================"
|
||||
echo " Squid Manager 部署完成！"
|
||||
echo "================================================================"
|
||||
echo " Web UI: http://<服务器IP>:${GUNICORN_PORT}"
|
||||
echo " 账号: ${ADMIN_USER} / ${ADMIN_PASS}"
|
||||
echo " 安装目录: ${INSTALL_DIR}"
|
||||
echo " 服务名: ${SERVICE_NAME}"
|
||||
echo " 配置文件: ${INSTALL_DIR}/.env"
|
||||
echo ""
|
||||
echo " 常用命令:"
|
||||
echo " systemctl status $SERVICE_NAME # 查看状态"
|
||||
echo " systemctl restart $SERVICE_NAME # 重启服务"
|
||||
echo " journalctl -u $SERVICE_NAME -f # 实时日志"
|
||||
echo ""
|
||||
echo " ⚠️ 请立即登录后修改默认密码！"
|
||||
echo "================================================================"
|
||||
Reference in New Issue
Block a user