pangolin/deploy/bootstrap/monitor/pangolin-monitor.service at 6ee7114ff83df3c2ff0a13367b971a00a5d69d97 - pangolin - Gitea: Git with a cup of tea

wangjia/pangolin

Files

T

wangjia ff9a40277d feat(deploy/bootstrap): 节点幂等初始化脚本(加固+pangolin用户+监控+防火墙)

全新 Debian 12 一键初始化,后续新机复用。四块:
- 系统:apt 升级+基础包(含 python3-systemd)、时区、swap 补足、sysctl(BBR/fq/句柄/队列)
- Pangolin:建 pangolin 非特权系统用户(/var/lib/pangolin, nologin)
- 网络安全:ufw 默认拒入站、放行 SSH+443(tcp/udp);fail2ban sshd jail
  (精简 Debian 无 rsyslog/auth.log → backend=systemd 读 journald)
- SSH 加固:root 仅密钥、可选禁密码(仅当已有 authorized_keys 时生效,防锁死)
- 监控:pangolin-monitor(systemd timer,CPU/内存/磁盘/进程/出网 → Telegram,
  异常+心跳);deadman-watch(EC2 侧主动探活,补"宕机/不上报"告警)

已在 racknerd(107.172.55.251)实跑验证全部步骤通过。密钥/真实配置 gitignore。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-18 01:30:55 +08:00

13 lines

293 B

Desktop File

Raw Blame History

 [Unit]
 Description=Pangolin 节点监控(采集并经 Telegram 上报)
 After=network-online.target
 Wants=network-online.target
 [Service]
 Type=oneshot
 EnvironmentFile=/etc/pangolin-monitor.env
 ExecStart=/usr/local/bin/pangolin-monitor
 # 监控只读系统状态,降权运行
 User=root
 Nice=10