5 Commits

Author SHA1 Message Date
endial da723fed20 feat: optimize nginx.conf and setup.sh for dynamic user ID support
ci/woodpecker/push/woodpecker Pipeline was successful
- Increase worker connections to 4096 and enable multi_accept
- Add security headers for enhanced protection
- Improve gzip compression settings
- Add dynamic permission handling in setup.sh for runtime user ID changes
- Increase file descriptor limits to 65535
- Optimize timeout and buffer settings
- Fix health check configuration in Dockerfile
2026-01-26 14:13:54 +08:00
endial 69afe0955c 更新:同步通用构建脚本到最新版本
ci/woodpecker/push/woodpecker Pipeline was successful
- 更新.ci/common子模块到最新提交b0ca0dc
- 包含对纯数字分支镜像标签生成的支持
- 包含本地编译通用脚本的改进
- 包含镜像标签配置的增强功能

确保nginx项目使用最新的通用构建脚本和最佳实践
2026-01-23 16:46:42 +08:00
endial 9f5bec31cb 重构:使用标准化日志函数替换旧版LOG_*函数调用
- 将LOG_D调用替换为debug()函数
- 将LOG_I调用替换为info()函数
- 编译时脚本保持使用echo()函数
- 修复LOG_I函数未定义导致的命令未找到错误
- 确保所有运行时脚本使用统一的日志格式

修改文件:
- customer/usr/local/bin/common.sh: 4处LOG_D改为debug调用
- customer/usr/local/bin/setup.sh: 3处LOG_I改为info,1处LOG_D改为debug调用
- customer/usr/local/bin/run.sh: 2处LOG_I改为info调用
- customer/usr/local/bin/entry.sh: 2处LOG_I改为info调用
2026-01-23 16:46:42 +08:00
endial 718ddc109b refactor: 修复nginx 1.28.1版本脚本调用错误并升级到新版架构
ci/woodpecker/push/woodpecker Pipeline was successful
- 修复Dockerfile中脚本调用缺少完整路径问题
- 修复customer脚本中错误的/colovu/lib/路径引用
- 升级build.sh采用新版build_local.sh架构
- 更新overrides脚本文件名匹配1.28.1版本号
- 统一架构检测使用TARGETARCH变量
- 保持nginx 1.28.1版本不变,仅修复架构问题
2026-01-23 09:34:29 +08:00
endial b9acada297 docs: 更新说明文档
ci/woodpecker/push/woodpecker Pipeline was successful
2026-01-21 10:12:39 +08:00
10 changed files with 88 additions and 217 deletions
+9 -9
View File
@@ -35,10 +35,10 @@ ARG LOCAL_URL
ARG TARGETARCH
# 选择软件包源,加速后续软件包安装
RUN select_source ${APT_SOURCE};
RUN /usr/local/sbin/select_source ${APT_SOURCE};
# 安装依赖的软件包及库
RUN install_pkg libperl-dev \
RUN /usr/local/sbin/install_pkg libperl-dev \
libpcre2-32-0 libpcre2-16-0 libpcre2-posix3 libpcre2-dev \
zlib1g zlib1g-dev \
libxslt1.1 libxslt1-dev \
@@ -53,11 +53,11 @@ RUN set -eux; \
appUrls="${localURL:-} \
http://nginx.org/download \
"; \
download_pkg unpack ${appName} "${appUrls}";
/usr/local/sbin/download_pkg unpack ${appName} "${appUrls}";
# 源码编译: 编译后将配置文件模板拷贝至 /usr/local/${app_name}/share/${app_name} 中
RUN set -eux; \
APP_ARCH=`arch` \
APP_ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
APP_SRC="/tmp/${APP_NAME}-${APP_VER}"; \
cd ${APP_SRC}; \
LDFLAGS="-L/usr/local/lib -L/usr/lib/${APP_ARCH}-linux-gnu" \
@@ -167,9 +167,9 @@ RUN set -eux; \
\
/bin/bash -c "ln -sf /usr/local/${APP_NAME}/etc/${APP_NAME} /etc/"; \
\
select_source ${APT_SOURCE}; \
/usr/local/sbin/select_source ${APT_SOURCE}; \
\
install_pkg `cat /usr/local/${APP_NAME}/runDeps`; \
/usr/local/sbin/install_pkg `cat /usr/local/${APP_NAME}/runDeps`; \
\
overrideShell="/usr/local/overrides/overrides-${APP_VER}.sh"; \
[ -e "${overrideShell}" ] && /bin/bash "${overrideShell}"; \
@@ -179,11 +179,11 @@ RUN set -eux; \
# 配置容器的数据卷、工作目录及服务端口(必须保证端口在1024之上)
VOLUME ["/srv/${APP_NAME}/conf", "/srv/${APP_NAME}/data", "/srv/${APP_NAME}/cert", "/srv/${APP_NAME}/log"]
WORKDIR /srv/${APP_NAME}
EXPOSE 80 443
EXPOSE 8080 8443
#HEALTHCHECK NONE
#HEALTHCHECK --interval=30s --timeout=30s --retries=3 CMD curl -fs http://localhost:8080/ || exit 1
HEALTHCHECK --interval=10s --timeout=10s --retries=3 CMD netstat -ltun | grep 8080
HEALTHCHECK --interval=30s --timeout=30s --retries=3 CMD curl -fs http://localhost:8080/ || exit 1
#HEALTHCHECK --interval=10s --timeout=10s --retries=3 CMD netstat -ltun | grep 8080
# 使用 dumb-init 启动入口 Shell,确保容器可以接收控制信号;并使用前台方式启动应用程序
ENTRYPOINT ["dumb-init", "entry.sh"]
+1 -1
View File
@@ -8,7 +8,6 @@
**版本信息:**
- 1.29、latest
- 1.28
**镜像信息:**
@@ -158,6 +157,7 @@ APP_CFG_yarn__log___aggregation___enable=true
## 更新记录
- 2026/1/21: 更新版本为 v1.28.1
- 2023/8/3: 更新为 Nginx 1.24.0
----
+15 -166
View File
@@ -1,175 +1,24 @@
#!/bin/bash
# Ver: 2.0 by Endial Fang (endial@126.com)
# Ver: 3.0 by Endial Fang (endial@126.com)
#
# Docker 镜像构建脚本 (仅linux/amd64)
# Docker 镜像构建脚本 - 主入口
# 编译后镜像名称
IMAGE_NAME="golang"
export IMAGE_NAME="nginx"
# 依赖镜像的仓库地址
REGISTRY_URL="swr.cn-north-4.myhuaweicloud.com/colovu/"
export REGISTRY_URL="swr.cn-north-4.myhuaweicloud.com/colovu/"
# 源仓库地址(本地编译时,使用阿里云源仓库)
APT_SOURCE="aliyun"
APP_VER="1.23.12"
LOCAL_URL="http://pkgs.colovu.com/dist"
export APT_SOURCE="aliyun"
# 针对无法直接下载到软件包,本地变异时,使用缓存的软件包
export LOCAL_URL="http://pkgs.colovu.com/dist"
# 获取发布版本标签
get_release_tag() {
if ! git rev-parse --git-dir >/dev/null 2>&1; then
echo "unknown"
elif [ -n "$(git status --porcelain)" ]; then
echo "latest"
else
# 尝试获取最近的git标签
local tag=$(git describe --tags --abbrev=0 2>/dev/null)
if [ -n "$tag" ]; then
echo "$tag"
else
local branch=$(git rev-parse --abbrev-ref HEAD)
case "$branch" in
master|main) echo "latest" ;;
*) echo "$branch" ;;
esac
fi
fi
}
# 获取镜像完整TAG
get_image_tag() {
local CURRENT_SUBVERSION
if git rev-parse --git-dir >/dev/null 2>&1; then
if [ -z "$(git status --porcelain)" ]; then
CURRENT_SUBVERSION=$(git rev-parse --short=12 HEAD)
else
CURRENT_SUBVERSION=$(date +%Y%m%d-%H%M%S)
fi
local branch=$(git rev-parse --abbrev-ref HEAD)
branch=$(echo "$branch" | sed -e 's/master/latest/' -e 's/main/latest/')
echo "${branch}-${CURRENT_SUBVERSION}"
else
CURRENT_SUBVERSION=$(date +%Y%m%d-%H%M%S)
echo "latest-${CURRENT_SUBVERSION}"
fi
}
# 根据当前系统架构构建镜像
build() {
local TAG=${1:-$(get_image_tag)}
# 获取当前系统的架构
local ARCH=$(uname -m)
local PLATFORM=""
case "$ARCH" in
x86_64)
PLATFORM="linux/amd64"
;;
aarch64|arm64)
PLATFORM="linux/arm64"
;;
armv7l)
PLATFORM="linux/arm/v7"
;;
*)
PLATFORM="linux/amd64" # 默认为 amd64
;;
esac
# 如果在命令中指定了TAG,则使用相同的TAG作为APP_VER
if [ -n "$1" ]; then
APP_VER="$1"
else
# 获取当前分支名并判断是否为主分支
local branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
if [ "$branch" != "master" ] && [ "$branch" != "main" ]; then
# 如果不是主分支,则使用分支名或标签名
local tag=$(git describe --tags --abbrev=0 2>/dev/null)
if [ -n "$tag" ] && [ "$(git rev-list -n 1 $tag 2>/dev/null)" = "$(git rev-parse HEAD)" ]; then
# 如果当前提交正好是标签,则使用标签名
APP_VER="$tag"
else
# 否则使用分支名
APP_VER="$branch"
fi
fi
fi
# 去除APP_VER中的v前缀,仅保留数字分段部分
APP_VER=$(echo "$APP_VER" | sed 's/^v//')
echo "Building image ${IMAGE_NAME}:${TAG} (${PLATFORM}) with APP_VER=${APP_VER}"
podman build --platform ${PLATFORM} \
--progress plain --force-rm \
--build-arg REGISTRY_URL=${REGISTRY_URL} \
--build-arg APT_SOURCE=${APT_SOURCE} \
--build-arg APP_VER=${APP_VER} \
--build-arg LOCAL_URL=${LOCAL_URL:-} \
-t ${IMAGE_NAME}:${TAG} \
-t ${IMAGE_NAME}:latest \
.
echo "Build complete"
}
# 清理工作空间
clean() {
echo "Cleaning workspace..."
# 删除所有与 IMAGE_NAME 相关的镜像标签(包括带 localhost 前缀的)
podman images --format "{{.Repository}}:{{.Tag}}" | grep -E "^(${IMAGE_NAME}|localhost/${IMAGE_NAME}):" | xargs -r podman rmi -f
# 删除所有已退出的容器
podman ps -a --format "{{.ID}}" --filter status=exited | xargs -r podman rm
# 删除所有悬空镜像(dangling images
podman images --filter "dangling=true" -q | xargs -r podman rmi -f
# 清理构建缓存
podman system prune -f
}
# 显示使用帮助信息
show_help() {
cat << EOF
Usage: $0 [COMMAND] [TAG]
Docker 镜像构建和清理脚本
COMMANDS:
build [tag] 构建镜像,可选择性指定标签,如未指定则自动生成
clean 清理工作空间,删除相关镜像和无用容器
help 显示此帮助信息
EXAMPLES:
$0 build # 构建镜像,使用自动生成的标签
$0 build mytag # 构建镜像,使用指定标签
$0 clean # 清理工作空间
$0 help # 显示帮助信息
DESCRIPTION:
该脚本用于构建 alpine 镜像,支持自动生成标签,包含清理功能。
构建的镜像名称为 ${IMAGE_NAME},默认会同时生成 latest 标签。
脚本会根据当前系统架构自动构建对应架构的镜像,并设置 APP_VER 参数(自动去除v前缀):
- 根据当前系统架构自动选择平台(linux/amd64, linux/arm64, linux/arm/v7 等)
- 当在命令中指定TAG时,APP_VER使用相同的TAG值(去除v前缀)
- 主分支(master/main)时使用 latest
- 其他分支时使用分支名
- 标签提交时使用标签名(去除v前缀)
EOF
}
# 主函数
main() {
case "$1" in
build) build "$2" ;; # 传递第二个参数作为标签
clean) clean ;;
help|-h|--help) show_help ;;
*)
if [ -z "$1" ]; then
show_help
else
echo "Error: Unknown command '$1'"
echo ""
show_help
# 引入本地构建脚本
if [ -f ".ci/common/build_local.sh" ]; then
# 执行本地构建脚本并传递参数
exec ".ci/common/build_local.sh" "$@"
else
echo "Error: .ci/common/build_local.sh script not found!"
exit 1
fi
;;
esac
}
fi
main "$@"
+11 -11
View File
@@ -3,14 +3,14 @@
#
# 应用通用业务处理函数
. /colovu/lib/libcommon.sh # 通用函数库
. /usr/local/lib/libcommon.sh # 通用函数库
. /colovu/lib/libfile.sh
. /colovu/lib/libfs.sh
. /colovu/lib/liblog.sh
. /colovu/lib/libos.sh
. /colovu/lib/libservice.sh
. /colovu/lib/libvalidations.sh
. /usr/local/lib/libfile.sh
. /usr/local/lib/libfs.sh
. /usr/local/lib/liblog.sh
. /usr/local/lib/libos.sh
. /usr/local/lib/libservice.sh
. /usr/local/lib/libvalidations.sh
# 检测应用相应的配置文件是否存在,如果不存在,则从默认配置文件目录拷贝一份
# 默认配置文件路径:/etc/${APP_NAME}
@@ -27,15 +27,15 @@ app_ensure_config_file_exist() {
local f=""
shift 2
LOG_D "List to check in ${base_path}: $@"
debug "List to check in ${base_path}: $@"
while [ "$#" -gt 0 ]; do
f="${1}"
LOG_D " Process \"${f}\""
debug " Process \"${f}\""
if [ -d "${base_path}/${f}" ]; then
[[ ! -d "${dist_path}/${f}" ]] && LOG_D " Create directory: ${dist_path}/${f}" && mkdir -p "${dist_path}/${f}"
[[ ! -d "${dist_path}/${f}" ]] && debug " Create directory: ${dist_path}/${f}" && mkdir -p "${dist_path}/${f}"
[[ ! -z $(ls -A "${base_path}/${f}") ]] && app_ensure_config_file_exist "${dist_path}/${f}" "${base_path}/${f}" $(ls -A "${base_path}/${f}")
else
[[ ! -e "${dist_path}/${f}" ]] && LOG_D " Copy: ${base_path}/${f} to ${dist_path}" && cp "${base_path}/${f}" "${dist_path}"
[[ ! -e "${dist_path}/${f}" ]] && debug " Copy: ${base_path}/${f} to ${dist_path}" && cp "${base_path}/${f}" "${dist_path}"
fi
shift
done
+3 -3
View File
@@ -7,11 +7,11 @@
# -e: 命令执行错误则报错(errexit); -u: 变量未定义则报错(nounset); -x: 打印实际待执行的命令行; -o pipefail: 设置管道中命令遇到失败则报错
set -euo pipefail
. /colovu/lib/libcommon.sh # 加载通用函数库
. /usr/local/lib/libcommon.sh # 加载通用函数库
. /usr/local/bin/environment.sh # 设置环境变量
LOG_I "** Processing entry.sh **"
info "** Processing entry.sh **"
# 优先处理'-'开始的版本信息、帮助信息显示命令,如果是该类命令,处理后退出容器
[[ "${1:0:1}" == '-' ]] && set -- "${APP_EXEC:-/bin/bash}" "$@" && print_command_help "$@"
@@ -26,5 +26,5 @@ if [[ "$(id -u)" == '0' ]] && [[ "$1" == "run.sh" ]]; then
fi
# 处理非以上情形的自定义命令
LOG_I "Start container with command: $@"
info "Start container with command: $@"
exec "$@"
+3 -3
View File
@@ -7,11 +7,11 @@
# -e: 命令执行错误则报错(errexit); -u: 变量未定义则报错(nounset); -x: 打印实际待执行的命令行; -o pipefail: 设置管道中命令遇到失败则报错
set -euo pipefail
. /colovu/lib/liblog.sh # 日志输出函数库
. /usr/local/lib/liblog.sh # 日志输出函数库
. /usr/local/bin/environment.sh # 设置环境变量
LOG_I "** Processing run.sh **"
info "** Processing run.sh **"
readonly START_COMMAND="$(command -v ${APP_EXEC:-${APP_NAME}})"
# 配置默认启动参数(应用配置文件、前台方式启动)
@@ -20,5 +20,5 @@ flags=()
[[ -n "${APP_EXTRA_FLAGS:-}" ]] && flags+=("${APP_EXTRA_FLAGS[@]}")
flags+=("$@")
LOG_I "Start ${APP_NAME} with command: ${START_COMMAND[@]} ${flags[@]}"
info "Start ${APP_NAME} with command: ${START_COMMAND[@]} ${flags[@]}"
exec "${START_COMMAND[@]}" "${flags[@]}"
+17 -7
View File
@@ -7,29 +7,39 @@
# -e: 命令执行错误则报错(errexit); -u: 变量未定义则报错(nounset); -x: 打印实际待执行的命令行; -o pipefail: 设置管道中命令遇到失败则报错
set -euo pipefail
. /colovu/lib/libcommon.sh # 加载通用函数库
. /colovu/lib/libfs.sh # 加载文件操作函数库
. /colovu/lib/libos.sh # 加载系统管理函数库
. /usr/local/lib/libcommon.sh # 加载通用函数库
. /usr/local/lib/libfs.sh # 加载文件操作函数库
. /usr/local/lib/libos.sh # 加载系统管理函数库
. /usr/local/bin/environment.sh # 设置环境变量
. /usr/local/bin/common.sh # 应用专用函数库
LOG_I "** Processing setup.sh **"
info "** Processing setup.sh **"
APP_DIRS=(/var/log/${APP_NAME} /var/run/${APP_NAME} /var/cache/${APP_NAME} ${APP_HOME})
APP_DIRS+=(${APP_HOME}/conf ${APP_HOME}/data ${APP_HOME}/cert ${APP_HOME}/log)
LOG_I "Ensure directory exists: ${APP_DIRS[@]}"
info "Ensure directory exists: ${APP_DIRS[@]}"
for dir in ${APP_DIRS[@]}; do
ensure_dir_exists ${dir}
done
# 动态权限处理
current_uid=$(id -u)
current_gid=$(id -g)
# 确保当前用户对必要目录有访问权限
for dir in ${APP_DIRS[@]}; do
if [ -d "$dir" ]; then
chown $current_uid:$current_gid $dir
fi
done
# 检测指定文件是否在配置文件存储目录存在,如果不存在则拷贝(新挂载数据卷、手动删除都会导致不存在)
LOG_I "Check config files in: ${APP_CONF_DIR}"
info "Check config files in: ${APP_CONF_DIR}"
if [[ -z "$(ls -A "${APP_CONF_DIR}")" ]]; then
app_ensure_config_file_exist "${APP_CONF_DIR}" "${APP_DEF_DIR}" $(ls -A "${APP_DEF_DIR}")
fi
# 解决使用non-root后,[emerg] open() "/dev/stdout" failed (13: Permission denied)
LOG_D "Change permissions of stdout/stderr to 0662"
debug "Change permissions of stdout/stderr to 0662"
chmod 0662 /dev/stdout /dev/stderr
+28 -16
View File
@@ -24,7 +24,6 @@ pcre_jit on;
# error_log /srv/nginx/log/error.log info;
# error_log /srv/nginx/log/error.log notice;
# error_log /srv/nginx/log/error.log;
# error_log /dev/stdout warn;
# 包含配置文件,以加载动态模块
include /usr/local/nginx/modules/*.conf;
@@ -32,14 +31,16 @@ include /usr/local/nginx/modules/*.conf;
# 设置PID文件路径为对应的子目录
pid /var/run/nginx/nginx.pid;
worker_rlimit_nofile 32767;
# 增加文件描述符限制
worker_rlimit_nofile 65535;
events {
# 使用 epoll 模型
use epoll;
# 设置一个进程可以打开的最大并发链接数量
worker_connections 20480;
worker_connections 4096;
multi_accept on;
}
http {
@@ -65,6 +66,13 @@ http {
# 对客户端隐藏服务器版本
server_tokens off;
# 安全头部设置
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
# 客户端上传文件大小限制,超出时返回错误代码 413。
# 默认值:1m;设置为 0 时禁用该限制
@@ -79,13 +87,20 @@ http {
server_names_hash_max_size 2048;
# 连接超时时间,默认值:65秒
keepalive_timeout 60;
keepalive_timeout 65;
# 读取客户端请求头超时时间,默认值:60秒
client_header_timeout 15;
client_header_timeout 60;
# 读取客户端请求体超时时间,默认值:60秒
client_body_timeout 30;
client_body_timeout 60;
# 临时文件路径
client_body_temp_path /tmp/client_body_temp;
fastcgi_temp_path /tmp/fastcgi_temp;
proxy_temp_path /tmp/proxy_temp;
scgi_temp_path /tmp/scgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
proxy_buffer_size 128k;
proxy_buffering on;
@@ -106,19 +121,16 @@ http {
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 5m;
# 启用或禁用应答信息的压缩传输
gzip off;
# Set the Vary HTTP header as defined in the RFC 2616.
# 启用或禁用应答信息的压缩传输
gzip on;
gzip_vary on;
gzip_disable "msie6";
gzip_proxied any;
gzip_min_length 1000;
gzip_min_length 1024;
gzip_comp_level 6;
gzip_buffers 8 16k;
gzip_types text/plain text/css text/xml application/xml application/javascript text/javascript application/json application/x-javascript text/xml;
gzip_buffers 16 8k;
gzip_http_version 1.1;
gzip_types text/plain text/css text/xml application/javascript application/json application/rss+xml;
gzip_proxied no-cache no-store private expired auth;
gzip_disable "MSIE [1-6]\.";
# Enable checking the existence of precompressed files.
# gzip_static on;