wangjia
912a495e91
一台全新 Ubuntu/Debian VPS 上一条命令起整套 pangolin：MySQL + Redis（docker）
+ 控制面（HTTP + gRPC agent 服务）+ 节点 agent + sing-box 数据面，客户端连该
VPS 公网 IP 真实出网。
- deploy.sh：幂等编排——构建二进制 → docker MySQL/Redis → 生成 JWT/webhook/
derive 密钥 + Node CA + CA 签发的 gRPC server 证书（SAN localhost，匹配 agent
enroll 后的 mTLS 校验）+ REALITY 密钥对（持久化跨重部署）→ migrate + seed 节点
→ 起控制面（走完整 gRPC 分支）→ nodectl bootstrap-token → 起 agent + sing-box。
- systemd/{pangolin-server,pangolin-agent,sing-box}.service、docker-compose.yml
（MySQL/Redis 仅 loopback）、seed-node.sql.tmpl。
- README.md：架构图 + 部署/验证步骤 + 客户端接线（API URL / PANGOLIN_SINGBOX_BIN
/ sudoers / 真节点 uuid，客户端代码无改动）+ 排查指引。
本机验证：shellcheck + bash -n 通过；openssl CA ↔ mtls.NewCA + gRPC 证书链互通
已单测实测通过。VPS 端到端（出口 IP == VPS IP）待真机到位后执行。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
35 lines
1013 B
YAML
35 lines
1013 B
YAML
# Single-node datastores: MySQL + Redis, bound to loopback only (the control
|
|
# plane runs on the same host). Credentials come from db.env (generated by
|
|
# deploy.sh, gitignored). Standard ports — this is a dedicated box.
|
|
services:
|
|
mysql:
|
|
image: mysql:8.0
|
|
container_name: pangolin-mysql
|
|
restart: unless-stopped
|
|
command: ["--default-authentication-plugin=caching_sha2_password"]
|
|
environment:
|
|
MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:?set in db.env}
|
|
MYSQL_DATABASE: pangolin
|
|
ports:
|
|
- "127.0.0.1:3306:3306"
|
|
volumes:
|
|
- pangolin-mysql-data:/var/lib/mysql
|
|
healthcheck:
|
|
test: ["CMD", "mysqladmin", "ping", "-uroot", "-p${MYSQL_ROOT_PASSWORD}", "--silent"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 20
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
container_name: pangolin-redis
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:6379:6379"
|
|
volumes:
|
|
- pangolin-redis-data:/data
|
|
|
|
volumes:
|
|
pangolin-mysql-data:
|
|
pangolin-redis-data:
|