1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

services:
  mysql:
    image: mysql:8.0.42
    container_name: myapp-mysql
    restart: always
    ports:
      - "3307:3306"
    volumes:
      - /opt/docker/myapp-mysql/data/:/var/lib/mysql/
    environment:
      TZ: Asia/Shanghai
      MYSQL_ROOT_PASSWORD: <MySQL密码>
      # 初始化数据库（表结构由后端 Liquibase 自动创建）
      MYSQL_DATABASE: continew_admin
    command:
      --default-authentication-plugin=mysql_native_password
      --character-set-server=utf8mb4
      --collation-server=utf8mb4_general_ci
      --explicit_defaults_for_timestamp=true
      --lower_case_table_names=1

1
2
3

mysqld: Can't read dir of '/etc/mysql/conf.d/' (OS errno 13 - Permission denied)
mysqld: [ERROR] Stopped processing the 'includedir' directive in file /etc/my.cnf at line 36.
mysqld: [ERROR] Fatal error in defaults handling. Program aborted!

1
2
3
4
5
6

目录: drwxr-x---  属主 root(uid 0)
进程: mysqld      身份 mysql(uid 999)
                        ↓
              既不是属主，也不是同组
                        ↓
              落入其他人权限位 "---" → 什么都做不了 → errno 13

1
2
3
4
5
6
7
8
9

# 1) 初版 compose 里有一行 conf.d 挂载，既然没有自定义配置要放，直接删掉最干净
sed -i "\|/etc/mysql/conf.d|d" /opt/dockerfile/myapp-mysql/docker-compose.yml

# 2) 放开数据目录权限
chmod 755 /opt/docker /opt/docker/myapp-mysql /opt/docker/myapp-mysql/data

docker-compose up -d
docker exec myapp-mysql mysql -uroot -p<MySQL密码> -e "SHOW DATABASES;"
# → continew_admin 出现

1
2
3
4

/home/redis6/src/redis-cli -a <Redis密码> info keyspace
# # Keyspace   ← 下面一行都没有，16 个逻辑库零 key
ss -tn state established | grep 6379
# 无任何活跃连接

1
2
3

/home/redis6/src/redis-cli -a <Redis密码> shutdown nosave
systemctl disable redis redis-server 2>/dev/null   # 没有 systemd 服务，纯防御
mv /home/redis6 /home/redis6.bak.20260916          # 备份观察几天，没问题再删

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

services:
  redis:
    image: redis:7.2.8
    container_name: myapp-redis
    restart: always
    ports:
      - "6379:6379"
    volumes:
      - /opt/docker/myapp-redis/data/:/data/
    environment:
      TZ: Asia/Shanghai
    command: "redis-server --appendonly yes --requirepass <Redis密码>"

1
2
3
4

chmod 755 /opt/docker/myapp-redis /opt/docker/myapp-redis/data   # umask 坑，同上
docker-compose up -d
docker exec myapp-redis redis-cli -a <Redis密码> set __probe ok
docker exec myapp-redis redis-cli -a <Redis密码> get __probe    # → "ok"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

/opt/dockerfile/
├── myapp-backend/
│   ├── Dockerfile                  # 后端镜像
│   ├── myapp-backend-compose.yml    # 后端编排
│   └── myapp-backend.shell          # 部署脚本（删旧→构建→启动）
├── myapp-frontend/
│   ├── myapp-frontend.yml           # 前端编排
│   └── images-pkg/
│       ├── Dockerfile              # 前端镜像
│       ├── nginx/default.conf      # nginx 配置
│       ├── build_image.sh          # 构建镜像
│       ├── deploy-image-compse.sh  # 部署入口（构建+启动）
│       └── dist/                   # 流水线 scp 上来的构建产物
├── myapp-mysql/docker-compose.yml
└── myapp-redis/docker-compose.yml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

FROM bellsoft/liberica-openjdk-debian:17.0.14

COPY continew-admin.jar /app/bin/app.jar
WORKDIR /app/bin
RUN mkdir -p /app/logs

ENTRYPOINT ["java", \
            "-XX:+UseZGC", \
            "-XX:MetaspaceSize=128m", \
            "-XX:MaxMetaspaceSize=256m", \
            "-XX:+HeapDumpOnOutOfMemoryError", \
            "-XX:HeapDumpPath=/app/logs/oom.hprof", \
            "-XX:ErrorFile=/app/logs/hs_err_pid%p.log", \
            "-Djava.security.egd=file:/dev/./urandom", \
            "-jar", "app.jar"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

services:
  myapp-backend-server:
    image: myapp-backend
    container_name: myapp-backend-server
    environment:
      TZ: Asia/Shanghai
      PROFILES_ACTIVE: prod
      # 数据源：本机 myapp-mysql 容器（3307 端口；network_mode: host 所以用 127.0.0.1）
      DB_HOST: 127.0.0.1
      DB_PORT: 3307
      DB_USER: root
      DB_PWD: <MySQL密码>
      DB_NAME: continew_admin
      # 缓存：本机 myapp-redis 容器 6379，用 db 1
      REDIS_HOST: 127.0.0.1
      REDIS_PORT: 6379
      REDIS_PWD: <Redis密码>
      REDIS_DB: 1
      # 字段加密密钥（测试环境复用仓库 dev 示例值，正式环境必须换成独立生成的密钥对！）
      FIELD_ENCRYPT_PASSWORD: <AES密钥>
      FIELD_ENCRYPT_PUBLIC_KEY: <RSA公钥>
      FIELD_ENCRYPT_PRIVATE_KEY: <RSA私钥>
      # snail-job 已关闭，但占位符仍需解析，填不会使用的占位值（见坑 6）
      SCHEDULE_USERNAME: admin
      SCHEDULE_PASSWORD: unused-disabled
      SCHEDULE_TOKEN: unused-disabled
      # 关闭 snail-job 调度；application.url 用于跨域放行前端地址
      SPRING_APPLICATION_JSON: '{"snail-job":{"enabled":false},"application":{"url":"http://10.10.10.44:8085"}}'
    volumes:
      - /opt/docker/myapp-backend/logs/:/app/logs/
      - /opt/docker/myapp-backend/data/file/:/app/data/file/
    restart: always
    network_mode: "host"

1
2
3
4
5

# 在 .43 上：
rm -rf /opt/dockerfile/myapp-backend /opt/dockerfile/myapp-frontend /opt/docker/myapp-backend
/usr/local/mysql/bin/mysql -uroot -p<密码> -e "DROP DATABASE IF EXISTS continew_admin;"
sed -i.bak "/jenkins2-to-43-deploy/d" /root/.ssh/authorized_keys
ls /opt/dockerfile/   # 确认只剩 bid 项目的目录

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

tools { jdk 'jdk17'; maven 'maven3.9' }        // 名字与全局工具配置一致
parameters { string(name: 'BRANCH_NAME', defaultValue: 'dev') }
environment {
    JAR_FILE_NAME      = 'continew-admin.jar'
    LOCAL_JAR_PATH     = "continew-server/target/${JAR_FILE_NAME}"
    DEPLOY_PATH        = '/opt/dockerfile/myapp-backend'
    DEPLOY_SCRIPT_NAME = 'myapp-backend.shell'
    DEPLOY_HOST        = '10.10.10.44'
    DEPLOY_USER        = 'root'
    GIT_CREDENTIALS_ID = 'myapp-git'
}

1

ERROR: [ssh-agent] Could not find specified credentials: myapp-ssh-43

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# 私钥放进 jenkins_home（容器内即 /var/jenkins_home/.ssh/）
mkdir -p /home/compose-jenkins2/jenkins_home/.ssh
cp /home/compose-jenkins2/jenkins2_deploy_key /home/compose-jenkins2/jenkins_home/.ssh/deploy_key
printf '%s\n' 'Host 10.10.10.44' \
              '    IdentityFile /var/jenkins_home/.ssh/deploy_key' \
              '    IdentitiesOnly yes' \
  > /home/compose-jenkins2/jenkins_home/.ssh/config
chown -R 1000:1000 /home/compose-jenkins2/jenkins_home/.ssh
chmod 700 /home/compose-jenkins2/jenkins_home/.ssh
chmod 600 /home/compose-jenkins2/jenkins_home/.ssh/{deploy_key,config}

# 容器内验证免密通
docker exec jenkins2 ssh -o StrictHostKeyChecking=no -o BatchMode=yes \
    root@10.10.10.44 "echo CONTAINER_SSH_OK"     # → CONTAINER_SSH_OK

# 把流水线里的 sshagent 步骤换成普通 script 块（直接改任务 config.xml 再重启）
sed -i "s/sshagent(\[env\.SSH_CREDENTIALS_ID\])/script/" \
    /home/compose-jenkins2/jenkins_home/jobs/*/config.xml
docker restart jenkins2

1
2
3

+ ssh root@10.10.10.44 'cd /opt/dockerfile/myapp-backend && ./myapp-backend.shell'
bash: line 1: ./myapp-backend.shell: Permission denied
ERROR: script returned exit code 126

1
2
3

chmod +x /opt/dockerfile/myapp-backend/myapp-backend.shell \
         /opt/dockerfile/myapp-frontend/images-pkg/build_image.sh \
         /opt/dockerfile/myapp-frontend/images-pkg/deploy-image-compse.sh

1
2
3
4
5

Application run failed
BeanCreationException: Error creating bean with name 'feignConfiguration'
Caused by: org.springframework.util.PlaceholderResolutionException:
Could not resolve placeholder 'SCHEDULE_PASSWORD' in value "${SCHEDULE_PASSWORD}"
    <-- "${snail-job.server.api.password}"

1
2
3

      SCHEDULE_USERNAME: admin
      SCHEDULE_PASSWORD: unused-disabled
      SCHEDULE_TOKEN: unused-disabled

1

Started ContiNewAdminApplication in 17.987 seconds

1
2
3

curl -s -o /dev/null -w '%{http_code}' http://localhost:18000/    # → 200
docker exec myapp-mysql mysql -uroot -p<密码> -e "SHOW TABLES;" continew_admin | wc -l
# Liquibase 已自动建好全部表

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

tools { nodejs 'node22' }
parameters { string(name: 'BRANCH_NAME', defaultValue: 'dev') }
environment {
    BUILD_OUTPUT       = 'dist'
    REMOTE_DEPLOY_PATH = '/opt/dockerfile/myapp-frontend/images-pkg'
    DEPLOY_HOST        = '10.10.10.44'
    DEPLOY_USER        = 'root'
    GIT_CREDENTIALS_ID = 'myapp-git'
    // shell 环境变量优先级高于 .env 文件，覆盖 .env.production 里的上游演示地址
    VITE_API_BASE_URL  = 'http://10.10.10.44:8085/api'
    VITE_API_WS_URL    = 'ws://10.10.10.44:8085/api'
}

1
2
3
4
5
6
7

services:
  myapp-frontend:
    image: myapp-frontend
    container_name: myapp-frontend-server
    ports:
      - "8085:80"
    restart: always

1
2
3
4
5
6

FROM nginx:1.27.0

COPY dist/ /usr/share/nginx/html/
COPY nginx/default.conf /etc/nginx/conf.d/default.conf
# 构建产物可能带有 640/750 权限（CI umask），nginx 用户需要可读
RUN chmod -R a+rX /usr/share/nginx/html

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

server {
    listen 80;
    server_name _;
    client_max_body_size 100m;

    # 前端静态资源（history 路由回退到 index.html）
    location / {
        root /usr/share/nginx/html;
        try_files $uri $uri/ /index.html;
        index index.html;
    }

    # /api/ 代理到后端（172.17.0.1 为宿主机，后端端口 18000，代理时去掉 /api 前缀）
    location /api/ {
        proxy_pass http://172.17.0.1:18000/;
        proxy_ignore_client_abort on;
        proxy_http_version 1.1;

        # WebSocket 支持
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        "Upgrade";
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

1

open() "/usr/share/nginx/html/index.html" failed (13: Permission denied)

1

RUN chmod -R a+rX /usr/share/nginx/html

1
2

docker exec myapp-mysql mysql -uroot -p<密码> continew_admin \
    -e "UPDATE sys_option SET value='/logo.png' WHERE code='SITE_LOGO';"

1
2
3

docker exec myapp-redis redis-cli -a <密码> -n 1 keys "OPTION:*"
# OPTION:SITE / OPTION:TENANT / OPTION:LOGIN_CAPTCHA_ENABLED / ...
docker exec myapp-redis redis-cli -a <密码> -n 1 del OPTION:SITE ...

1
2
3
4
5

<!-- SettingDrawer.vue -->
const settingOpen = JSON.parse(import.meta.env.VITE_APP_SETTING)
<a-divider v-if="settingOpen" orientation="center">系统布局</a-divider>
<a-descriptions v-if="settingOpen" ...>界面显示...</a-descriptions>
...