wangjia
ff9a40277d
全新 Debian 12 一键初始化,后续新机复用。四块: - 系统:apt 升级+基础包(含 python3-systemd)、时区、swap 补足、sysctl(BBR/fq/句柄/队列) - Pangolin:建 pangolin 非特权系统用户(/var/lib/pangolin, nologin) - 网络安全:ufw 默认拒入站、放行 SSH+443(tcp/udp);fail2ban sshd jail (精简 Debian 无 rsyslog/auth.log → backend=systemd 读 journald) - SSH 加固:root 仅密钥、可选禁密码(仅当已有 authorized_keys 时生效,防锁死) - 监控:pangolin-monitor(systemd timer,CPU/内存/磁盘/进程/出网 → Telegram, 异常+心跳);deadman-watch(EC2 侧主动探活,补"宕机/不上报"告警) 已在 racknerd(107.172.55.251)实跑验证全部步骤通过。密钥/真实配置 gitignore。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
49 lines
1.8 KiB
Bash
Executable File
49 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# deadman-watch —— 死信守望。放在【常在线主机】(如 EC2)上,主动 TCP 探活各节点端口;
|
|
# 连续失败到阈值 → 告警(节点宕机/不上报时,节点自己报不了,这层补上)。恢复也通知。
|
|
#
|
|
# 配置 /etc/pangolin-deadman.env:
|
|
# TELEGRAM_BOT_TOKEN=... TELEGRAM_CHAT_ID=...
|
|
# NODES="racknerd-la=107.172.55.251:443 tokyo=1.2.3.4:443" # name=host:port 空格分隔
|
|
# FAIL_THRESHOLD=2 # 连续失败几次才告警(去抖)
|
|
#
|
|
# EC2 上每 3 分钟跑一次(cron,用户态即可):
|
|
# */3 * * * * /usr/local/bin/deadman-watch >/dev/null 2>&1
|
|
set -uo pipefail
|
|
|
|
ENV_FILE=/etc/pangolin-deadman.env
|
|
[ -r "$ENV_FILE" ] || { echo "缺少 $ENV_FILE" >&2; exit 1; }
|
|
# shellcheck disable=SC1090
|
|
. "$ENV_FILE"
|
|
: "${FAIL_THRESHOLD:=2}"
|
|
STATE_DIR=/var/lib/pangolin-deadman
|
|
mkdir -p "$STATE_DIR"
|
|
|
|
send_tg() {
|
|
local text="$1"
|
|
[ -n "${TELEGRAM_BOT_TOKEN:-}" ] && [ -n "${TELEGRAM_CHAT_ID:-}" ] || { echo "$text"; return; }
|
|
curl -fsS --max-time 15 \
|
|
"https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
|
|
--data-urlencode "chat_id=${TELEGRAM_CHAT_ID}" \
|
|
--data-urlencode "text=${text}" >/dev/null 2>&1 || echo "Telegram 发送失败" >&2
|
|
}
|
|
|
|
probe() { timeout 8 bash -c "exec 3<>/dev/tcp/$1/$2" 2>/dev/null; }
|
|
|
|
for entry in ${NODES:-}; do
|
|
name="${entry%%=*}"; hp="${entry#*=}"; host="${hp%%:*}"; port="${hp##*:}"
|
|
statef="${STATE_DIR}/${name}.fail"
|
|
if probe "$host" "$port"; then
|
|
if [ -f "$statef" ]; then
|
|
send_tg "🟢 [${name}] 恢复可达(${host}:${port})"
|
|
rm -f "$statef"
|
|
fi
|
|
else
|
|
fails=$(( $(cat "$statef" 2>/dev/null || echo 0) + 1 ))
|
|
echo "$fails" > "$statef"
|
|
if [ "$fails" -eq "$FAIL_THRESHOLD" ]; then
|
|
send_tg "🔴 [${name}] 不可达/疑似宕机(${host}:${port}),连续 ${fails} 次探测失败"
|
|
fi
|
|
fi
|
|
done
|