commit a45b9e090211ced0c9989560893e05fcbc486405 Author: jingrow Date: Mon Jun 16 13:40:33 2025 +0800 初始提交 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..3df7d04 --- /dev/null +++ b/.gitignore @@ -0,0 +1,5 @@ +/apisix_log/* +!/apisix_log/.keep + +/etcd_data/* +!/etcd_data/.keep diff --git a/apisix_conf/apisix-standalone.yaml b/apisix_conf/apisix-standalone.yaml new file mode 100644 index 0000000..b0e4da3 --- /dev/null +++ b/apisix_conf/apisix-standalone.yaml @@ -0,0 +1,25 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +routes: + - + uri: /get + upstream: + nodes: + "web1:80": 1 + type: roundrobin +#END diff --git a/apisix_conf/config-standalone.yaml b/apisix_conf/config-standalone.yaml new file mode 100644 index 0000000..e8a963f --- /dev/null +++ b/apisix_conf/config-standalone.yaml @@ -0,0 +1,25 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +apisix: + node_listen: 9080 # APISIX listening port + enable_ipv6: false + +deployment: + role: data_plane + role_data_plane: + config_provider: yaml diff --git a/apisix_conf/config.yaml b/apisix_conf/config.yaml new file mode 100644 index 0000000..f727e91 --- /dev/null +++ b/apisix_conf/config.yaml @@ -0,0 +1,51 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +apisix: + node_listen: 9080 # APISIX listening port + enable_ipv6: false + + enable_control: true + control: + ip: "0.0.0.0" + port: 9092 + +deployment: + admin: + allow_admin: # https://nginx.org/en/docs/http/ngx_http_access_module.html#allow + - 0.0.0.0/0 # We need to restrict ip access rules for security. 0.0.0.0/0 is for test. + + admin_key: + - name: "admin" + key: 8206e6e42b6b53243c52a767cc633137 + role: admin # admin: manage all configuration data + + - name: "viewer" + key: 2462bfdd4a0c20a080d125551696d182 + role: viewer + + etcd: + host: # it's possible to define multiple etcd hosts addresses of the same etcd cluster. + - "http://etcd:2379" # multiple etcd address + prefix: "/apisix" # apisix configurations prefix + timeout: 30 # 30 seconds + +plugin_attr: + prometheus: + export_addr: + ip: "0.0.0.0" + port: 9091 diff --git a/dashboard_conf/conf.yaml b/dashboard_conf/conf.yaml new file mode 100644 index 0000000..ee2b50a --- /dev/null +++ b/dashboard_conf/conf.yaml @@ -0,0 +1,26 @@ +conf: + listen: + host: 0.0.0.0 + port: 9000 + etcd: + endpoints: + - http://etcd:2379 + log: + error_log: + level: warn + file_path: + logs/error.log +authentication: + secret: + secret + expire_time: 3600 + users: + - username: admin + password: admin + - username: user + password: user +plugin_attr: + prometheus: + export_addr: + ip: "0.0.0.0" + port: 9091 diff --git a/docker-compose-arm64.yml b/docker-compose-arm64.yml new file mode 100644 index 0000000..07328a6 --- /dev/null +++ b/docker-compose-arm64.yml @@ -0,0 +1,81 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +version: "3" + +services: + apisix: + image: apache/apisix:3.12.0-debian + restart: always + volumes: + - ./apisix_conf/config.yaml:/usr/local/apisix/conf/config.yaml:ro + depends_on: + - etcd + ports: + - "9180:9180/tcp" + - "9080:9080/tcp" + - "9091:9091/tcp" + - "9443:9443/tcp" + - "9092:9092/tcp" + networks: + apisix: + + etcd: + image: rancher/coreos-etcd:v3.4.15-arm64 + user: root + restart: always + volumes: + - ./etcd_data:/etcd-data + environment: + ETCD_UNSUPPORTED_ARCH: "arm64" + ETCD_ENABLE_V2: "true" + ALLOW_NONE_AUTHENTICATION: "yes" + ETCD_ADVERTISE_CLIENT_URLS: "http://etcd:2379" + ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379" + ETCD_DATA_DIR: "/etcd-data" + ports: + - "2379:2379/tcp" + networks: + apisix: + + web1: + image: nginx:1.19.10-alpine + restart: always + volumes: + - ./upstream/web1.conf:/etc/nginx/nginx.conf + ports: + - "9081:80/tcp" + environment: + - NGINX_PORT=80 + networks: + apisix: + + web2: + image: nginx:1.19.10-alpine + restart: always + volumes: + - ./upstream/web2.conf:/etc/nginx/nginx.conf + ports: + - "9082:80/tcp" + environment: + - NGINX_PORT=80 + networks: + apisix: + +networks: + apisix: + driver: bridge diff --git a/docker-compose-standalone.yml b/docker-compose-standalone.yml new file mode 100644 index 0000000..2348b20 --- /dev/null +++ b/docker-compose-standalone.yml @@ -0,0 +1,55 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +version: "3" + +services: + apisix: + image: apache/apisix:${APISIX_IMAGE_TAG:-3.12.0-debian} + restart: always + volumes: + - ./apisix_conf/apisix-standalone.yaml:/usr/local/apisix/conf/apisix.yaml:ro + - ./apisix_conf/config-standalone.yaml:/usr/local/apisix/conf/config.yaml:ro + environment: + - APISIX_STAND_ALONE=true + ports: + - "9180:9180/tcp" + - "9080:9080/tcp" + - "9091:9091/tcp" + - "9443:9443/tcp" + - "9092:9092/tcp" + networks: + apisix: + + web1: + image: nginx:1.19.0-alpine + restart: always + volumes: + - ./upstream/web1.conf:/etc/nginx/nginx.conf + ports: + - "9081:80/tcp" + environment: + - NGINX_PORT=80 + networks: + apisix: + + +networks: + apisix: + driver: bridge + + diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..93e48b0 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,121 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +version: "3" + +services: + apisix: + image: apache/apisix:${APISIX_IMAGE_TAG:-3.12.0-debian} + restart: always + volumes: + - ./apisix_conf/config.yaml:/usr/local/apisix/conf/config.yaml:ro + depends_on: + - etcd + ##network_mode: host + ports: + - "9180:9180/tcp" + - "9080:9080/tcp" + - "9091:9091/tcp" + - "9443:9443/tcp" + - "9092:9092/tcp" + networks: + apisix: + + etcd: + image: bitnami/etcd:3.5.11 + restart: always + volumes: + - etcd_data:/bitnami/etcd + environment: + ETCD_ENABLE_V2: "true" + ALLOW_NONE_AUTHENTICATION: "yes" + ETCD_ADVERTISE_CLIENT_URLS: "http://etcd:2379" + ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379" + ports: + - "2379:2379/tcp" + networks: + apisix: + + web1: + image: nginx:1.19.0-alpine + restart: always + volumes: + - ./upstream/web1.conf:/etc/nginx/nginx.conf + ports: + - "9081:80/tcp" + environment: + - NGINX_PORT=80 + networks: + apisix: + + web2: + image: nginx:1.19.0-alpine + restart: always + volumes: + - ./upstream/web2.conf:/etc/nginx/nginx.conf + ports: + - "9082:80/tcp" + environment: + - NGINX_PORT=80 + networks: + apisix: + + prometheus: + image: prom/prometheus:v2.25.0 + restart: always + volumes: + - ./prometheus_conf/prometheus.yml:/etc/prometheus/prometheus.yml + ports: + - "9090:9090" + networks: + apisix: + + grafana: + image: grafana/grafana:7.3.7 + restart: always + ports: + - "3000:3000" + volumes: + - "./grafana_conf/provisioning:/etc/grafana/provisioning" + - "./grafana_conf/dashboards:/var/lib/grafana/dashboards" + - "./grafana_conf/config/grafana.ini:/etc/grafana/grafana.ini" + networks: + apisix: + + dashboard: + image: apache/apisix-dashboard:latest + container_name: apisix-dashboard + restart: always + ports: + - "9010:9000" + volumes: + - ./dashboard_conf/conf.yaml:/usr/local/apisix-dashboard/conf/conf.yaml:ro + environment: + - TZ=Asia/Shanghai + networks: + - apisix + depends_on: + - apisix + - etcd + +networks: + apisix: + driver: bridge + +volumes: + etcd_data: + driver: local diff --git a/etcd_conf/etcd.conf.yml b/etcd_conf/etcd.conf.yml new file mode 100644 index 0000000..1152953 --- /dev/null +++ b/etcd_conf/etcd.conf.yml @@ -0,0 +1,157 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +# This is the configuration file for the etcd server. + +# Human-readable name for this member. +name: 'default' + +# Path to the data directory. +data-dir: + +# Path to the dedicated wal directory. +wal-dir: + +# Number of committed transactions to trigger a snapshot to disk. +snapshot-count: 10000 + +# Time (in milliseconds) of a heartbeat interval. +heartbeat-interval: 100 + +# Time (in milliseconds) for an election to timeout. +election-timeout: 1000 + +# Raise alarms when backend size exceeds the given quota. 0 means use the +# default quota. +quota-backend-bytes: 0 + +# List of comma separated URLs to listen on for peer traffic. +listen-peer-urls: http://localhost:2380 + +# List of comma separated URLs to listen on for client traffic. +listen-client-urls: http://localhost:2379 + +# Maximum number of snapshot files to retain (0 is unlimited). +max-snapshots: 5 + +# Maximum number of wal files to retain (0 is unlimited). +max-wals: 5 + +# Comma-separated white list of origins for CORS (cross-origin resource sharing). +cors: + +# List of this member's peer URLs to advertise to the rest of the cluster. +# The URLs needed to be a comma-separated list. +initial-advertise-peer-urls: http://localhost:2380 + +# List of this member's client URLs to advertise to the public. +# The URLs needed to be a comma-separated list. +advertise-client-urls: http://localhost:2379 + +# Discovery URL used to bootstrap the cluster. +discovery: + +# Valid values include 'exit', 'proxy' +discovery-fallback: 'proxy' + +# HTTP proxy to use for traffic to discovery service. +discovery-proxy: + +# DNS domain used to bootstrap initial cluster. +discovery-srv: + +# Initial cluster configuration for bootstrapping. +initial-cluster: + +# Initial cluster token for the etcd cluster during bootstrap. +initial-cluster-token: 'etcd-cluster' + +# Initial cluster state ('new' or 'existing'). +initial-cluster-state: 'new' + +# Reject reconfiguration requests that would cause quorum loss. +strict-reconfig-check: false + +# Accept etcd V2 client requests +enable-v2: true + +# Enable runtime profiling data via HTTP server +enable-pprof: true + +# Valid values include 'on', 'readonly', 'off' +proxy: 'off' + +# Time (in milliseconds) an endpoint will be held in a failed state. +proxy-failure-wait: 5000 + +# Time (in milliseconds) of the endpoints refresh interval. +proxy-refresh-interval: 30000 + +# Time (in milliseconds) for a dial to timeout. +proxy-dial-timeout: 1000 + +# Time (in milliseconds) for a write to timeout. +proxy-write-timeout: 5000 + +# Time (in milliseconds) for a read to timeout. +proxy-read-timeout: 0 + +client-transport-security: + # Path to the client server TLS cert file. + cert-file: + + # Path to the client server TLS key file. + key-file: + + # Enable client cert authentication. + client-cert-auth: false + + # Path to the client server TLS trusted CA cert file. + trusted-ca-file: + + # Client TLS using generated certificates + auto-tls: false + +peer-transport-security: + # Path to the peer server TLS cert file. + cert-file: + + # Path to the peer server TLS key file. + key-file: + + # Enable peer client cert authentication. + client-cert-auth: false + + # Path to the peer server TLS trusted CA cert file. + trusted-ca-file: + + # Peer TLS using generated certificates. + auto-tls: false + +# Enable debug-level logging for etcd. +debug: false + +logger: zap + +# Specify 'stdout' or 'stderr' to skip journald logging even when running under systemd. +log-outputs: [stderr] + +# Force to create a new one member cluster. +force-new-cluster: false + +auto-compaction-mode: periodic +auto-compaction-retention: "1" diff --git a/grafana_conf/config/grafana.ini b/grafana_conf/config/grafana.ini new file mode 100644 index 0000000..cb6a737 --- /dev/null +++ b/grafana_conf/config/grafana.ini @@ -0,0 +1,756 @@ +##################### Grafana Configuration Example ##################### +# +# Everything has defaults so you only need to uncomment things you want to +# change + +# possible values : production, development +;app_mode = production + +# instance name, defaults to HOSTNAME environment variable value or hostname if HOSTNAME var is empty +;instance_name = ${HOSTNAME} + +#################################### Paths #################################### +[paths] +# Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used) +;data = /var/lib/grafana + +# Temporary files in `data` directory older than given duration will be removed +;temp_data_lifetime = 24h + +# Directory where grafana can store logs +;logs = /var/log/grafana + +# Directory where grafana will automatically scan and look for plugins +;plugins = /var/lib/grafana/plugins + +# folder that contains provisioning config files that grafana will apply on startup and while running. +;provisioning = conf/provisioning + +#################################### Server #################################### +[server] +# Protocol (http, https, h2, socket) +;protocol = http + +# The ip address to bind to, empty will bind to all interfaces +;http_addr = + +# The http port to use +;http_port = 3000 + +# The public facing domain name used to access grafana from a browser +;domain = localhost + +# Redirect to correct domain if host header does not match domain +# Prevents DNS rebinding attacks +;enforce_domain = false + +# The full public facing url you use in browser, used for redirects and emails +# If you use reverse proxy and sub path specify full url (with sub path) +;root_url = %(protocol)s://%(domain)s:%(http_port)s/ + +# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons. +;serve_from_sub_path = false + +# Log web requests +;router_logging = false + +# the path relative working path +;static_root_path = public + +# enable gzip +;enable_gzip = false + +# https certs & key file +;cert_file = +;cert_key = + +# Unix socket path +;socket = + +#################################### Database #################################### +[database] +# You can configure the database connection by specifying type, host, name, user and password +# as separate properties or as on string using the url properties. + +# Either "mysql", "postgres" or "sqlite3", it's your choice +;type = sqlite3 +;host = 127.0.0.1:3306 +;name = grafana +;user = root +# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;""" +;password = + +# Use either URL or the previous fields to configure the database +# Example: mysql://user:secret@host:port/database +;url = + +# For "postgres" only, either "disable", "require" or "verify-full" +;ssl_mode = disable + +;ca_cert_path = +;client_key_path = +;client_cert_path = +;server_cert_name = + +# For "sqlite3" only, path relative to data_path setting +;path = grafana.db + +# Max idle conn setting default is 2 +;max_idle_conn = 2 + +# Max conn setting default is 0 (mean not set) +;max_open_conn = + +# Connection Max Lifetime default is 14400 (means 14400 seconds or 4 hours) +;conn_max_lifetime = 14400 + +# Set to true to log the sql calls and execution times. +;log_queries = + +# For "sqlite3" only. cache mode setting used for connecting to the database. (private, shared) +;cache_mode = private + +#################################### Cache server ############################# +[remote_cache] +# Either "redis", "memcached" or "database" default is "database" +;type = database + +# cache connectionstring options +# database: will use Grafana primary database. +# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0,ssl=false`. Only addr is required. ssl may be 'true', 'false', or 'insecure'. +# memcache: 127.0.0.1:11211 +;connstr = + +#################################### Data proxy ########################### +[dataproxy] + +# This enables data proxy logging, default is false +;logging = false + +# How long the data proxy should wait before timing out default is 30 (seconds) +;timeout = 30 + +# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request, default is false. +;send_user_header = false + +#################################### Analytics #################################### +[analytics] +# Server reporting, sends usage counters to stats.grafana.org every 24 hours. +# No ip addresses are being tracked, only simple counters to track +# running instances, dashboard and error counts. It is very helpful to us. +# Change this option to false to disable reporting. +;reporting_enabled = true + +# Set to false to disable all checks to https://grafana.net +# for new vesions (grafana itself and plugins), check is used +# in some UI views to notify that grafana or plugin update exists +# This option does not cause any auto updates, nor send any information +# only a GET request to http://grafana.com to get latest versions +;check_for_updates = true + +# Google Analytics universal tracking code, only enabled if you specify an id here +;google_analytics_ua_id = + +# Google Tag Manager ID, only enabled if you specify an id here +;google_tag_manager_id = + +#################################### Security #################################### +[security] +# disable creation of admin user on first start of grafana +;disable_initial_admin_creation = false + +# default admin user, created on startup +;admin_user = admin + +# default admin password, can be changed before first start of grafana, or in profile settings +;admin_password = admin + +# used for signing +;secret_key = SW2YcwTIb9zpOOhoPsMm + +# disable gravatar profile images +;disable_gravatar = false + +# data source proxy whitelist (ip_or_domain:port separated by spaces) +;data_source_proxy_whitelist = + +# disable protection against brute force login attempts +;disable_brute_force_login_protection = false + +# set to true if you host Grafana behind HTTPS. default is false. +;cookie_secure = false + +# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled" +;cookie_samesite = none + +# set to true if you want to allow browsers to render Grafana in a ,