hectorzhao/lislgosms
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat: 完善服务监控与下游重投

Browse Source
This commit is contained in:
hectorzhao
2026-08-14 17:21:29 +08:00
parent d30d9ea4d0
commit 1ef4380422
50 changed files with 1279 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/security/install-security-agent.sh
+9 -3
View File
@@ -4,7 +4,8 @@ set -Eeuo pipefail
APP_DIR="${APP_DIR:-/opt/cmpp-platform}"
if [[ "$(id -u)" -ne 0 ]]; then echo "Run as root." >&2; exit 1; fi
for command_name in fail2ban-client nft nginx systemctl; do command -v "$command_name" >/dev/null || { echo "Missing command: $command_name" >&2; exit 1; }; done
[[ -x "$APP_DIR/dist/cmpp-security-agent" ]] || { echo "Missing built security agent" >&2; exit 1; }
agent_binary="$APP_DIR/dist/cmpp-security-agent"
[[ -x "$agent_binary" ]] || { echo "Missing built security agent: $agent_binary" >&2; exit 1; }
getent group cmpp-security >/dev/null || groupadd --system cmpp-security
id cmpp-api >/dev/null 2>&1 || useradd --system --home-dir /nonexistent --shell /usr/sbin/nologin cmpp-api
@@ -14,7 +15,8 @@ install -d -o root -g cmpp-security -m 0750 /var/lib/cmpp-security-agent
install -d -o cmpp-api -g cmpp-security -m 0750 "$APP_DIR/logs/api"
[[ -d /var/lib/cmpp-platform/object-storage ]] && chown -R cmpp-api:cmpp-security /var/lib/cmpp-platform/object-storage
install -m 0640 "$APP_DIR/deploy/security/cmpp-report-only.conf" /etc/fail2ban/action.d/cmpp-report-only.conf
sed "s#@CMPP_SECURITY_AGENT_BIN@#$agent_binary#g" "$APP_DIR/deploy/security/cmpp-report-only.conf" >/etc/fail2ban/action.d/cmpp-report-only.conf
chmod 0640 /etc/fail2ban/action.d/cmpp-report-only.conf
install -m 0640 "$APP_DIR/deploy/security/cmpp-http-scan.conf" /etc/fail2ban/filter.d/cmpp-http-scan.conf
install -d -m 0750 /etc/nginx/snippets /etc/nftables.d
touch /etc/nginx/snippets/cmpp-security-deny.conf
@@ -31,7 +33,11 @@ grep -q 'cmpp-security.nft' /etc/nftables.conf || printf '\ninclude "/etc/nftabl
nft -c -f /etc/nftables.conf
nft list table inet cmpp_security >/dev/null 2>&1 || nft -f /etc/nftables.d/cmpp-security.nft
sed "s#/opt/cmpp-platform/current#$APP_DIR#g" "$APP_DIR/deploy/security/cmpp-security-agent.service" >/etc/systemd/system/cmpp-security-agent.service
sed "s#@CMPP_SECURITY_AGENT_BIN@#$agent_binary#g" "$APP_DIR/deploy/security/cmpp-security-agent.service" >/etc/systemd/system/cmpp-security-agent.service
if grep -Rqs '@CMPP_SECURITY_AGENT_BIN@' /etc/systemd/system/cmpp-security-agent.service /etc/fail2ban/action.d/cmpp-report-only.conf; then
echo "Security agent executable placeholder was not rendered." >&2
exit 1
fi
install -d -m 0755 /etc/systemd/system/cmpp-api.service.d
cat >/etc/systemd/system/cmpp-api.service.d/security-boundary.conf <<EOF
[Service]