征文投稿丨基于轻量应用服务器+OSS的中小型应用运维实践

docker network create traefik

~/.docker/compose/traefik/docker-compose.yml

YAML
version: "3.3"
services:
  traefik:
    image: traefik
    ports:
      -   "443:443"
    volumes:
      -   /var/run/docker.sock:/var/run/docker.sock
      -   ./traefik.yml:/etc/traefik/traefik.yml
      -   ./dynamic_conf.yml:/root/dynamic_conf.yml
      -   ~/.docker/volume/traefik/crt:/root/crt
      -   ~/.docker/volume/traefik/log:/root/log
    restart:   unless-stopped
    networks:
      - traefik
    environment:
        ALICLOUD_ACCESS_KEY: ${AK}
        ALICLOUD_SECRET_KEY: ${SK}
    extra_hosts:
      -   "host.docker.internal:172.18.0.1" # 172.18.0.1 是容器访问宿主机的 ip，通过   docker inspect 获取
    labels:
      -   com.centurylinklabs.watchtower.enable=false
networks:
  traefik:
    external: true

/root/.docker/compose/traefik/dynamic_conf.yml

YAML
http:
  middlewares:
    basic-auth:
      basicAuth:
        users:
          -   "root:$2b$12$aur8GtnfMi"
  routers:
    dashboard:
      rule:   "Host(`traefik.be.wizzstudio.com`)"
      service:   "api@internal"
      middlewares:
        - basic-auth
      tls:
          certResolver: myresolver
        domains:
        - main:   '*.be.wizzstudio.com'
        - sans:   '*.be.wizzstudio.com'

/root/.docker/compose/traefik/traefik.yml

YAML
providers:
  docker:
      exposedByDefault: false
    network: traefik
  file:
    filename:   /root/dynamic_conf.yml
    watch: true
api:
  dashboard: true
  # insecure: true
entryPoints:
  https:
    address:   ":443"
    http:
      tls:
          certresolver: myresolver
certificatesResolvers:
  myresolver:
    acme:
      dnsChallenge:
        provider:   alidns
          delayBeforeCheck: 0
      storage:   /root/crt/acme.json
      # caserver:   "https://acme-staging-v02.api.letsencrypt.org/directory" # test   server
accessLog:
  filePath:   "/root/log/access.log.json"
  format:   "json"

/root/.docker/compose/orientation-system-be/docker-compose.yml

Ruby
version: "3.3"
services:
  backend:
    image:   registry.cn-chengdu.aliyuncs.com/wizz-project/orientation-system-be:latest
    restart:   unless-stopped
    # ports:
    #   - "80:8080"
    labels:
      -   "traefik.enable=true"
      -   "traefik.http.routers.orientation-system-be.rule=Host(`orientation-system.be.wizzstudio.com`)"
      -   "traefik.http.routers.orientation-system-be.tls=true"
      -   "traefik.http.services.orientation-system-be.loadbalancer.server.port=80"
    networks:
      - traefik
    volumes:
      -   /etc/timezone:/etc/timezone:ro
      -   /etc/localtime:/etc/localtime:ro
      -   ~/.docker/volume/orientation-system-be/lab.log:/root/lab.log
networks:
  traefik:
    external: true
# mkdir -p ~/.docker/volume/orientation-system-be   && touch 
~/.docker/volume/orientation-system-be/lab.log

Dockerfile
FROM golang:1.18.0-alpine3.15 as build
LABEL maintainer="117503445"
RUN apk add --no-cache git
WORKDIR /root/project
COPY go.mod .
COPY go.sum .
RUN go mod download
COPY . .
RUN go build -ldflags="-s -w" -o server
FROM alpine:3.15 as prod
EXPOSE 8080
WORKDIR /root
#   https://stackoverflow.com/questions/66963068/docker-alpine-executable-binary-not-found-even-if-in-path
RUN apk add gcompat
COPY --from=build /root/project/server server
HEALTHCHECK --interval=5s --timeout=5s --retries=3 \
    CMD wget -nv -t1   --spider 'http://localhost:8080/' || exit 1
ENTRYPOINT ./server

.github/workflows/docker.yml

Perl
name: Build and Deploy to ACK
on:
  push:
    branches:
      - main
# Environment variables available to all jobs and steps in   this workflow.
env:
  REGION_ID:   cn-chengdu
  REGISTRY:   registry.cn-chengdu.aliyuncs.com
  NAMESPACE:   wizz-project
  IMAGE:   experiment-helper-backend
  TAG: ${{   github.sha }}
jobs:
  build:
    runs-on:   ubuntu-latest
    environment:   production
    steps:
      - name:   Checkout
        uses:   actions/checkout@v2
      # 1.1 Login to   ACR
      - name: Login   to ACR with the AccessKey pair
        uses:   aliyun/acr-login@v1
        with:
          region-id:   "${{ env.REGION_ID }}"
            access-key-id: "${{ secrets.ACCESS_KEY_ID }}"
            access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}"      
            # 1.2 Buid and   push image to ACR
      - name: Build   and push image to ACR
        run: |
          docker   build --tag "$REGISTRY/$NAMESPACE/$IMAGE:$TAG" . 
          docker   push "$REGISTRY/$NAMESPACE/$IMAGE:$TAG"
          docker tag   "$REGISTRY/$NAMESPACE/$IMAGE:$TAG"   "$REGISTRY/$NAMESPACE/$IMAGE:latest"
          docker   push "$REGISTRY/$NAMESPACE/$IMAGE:latest"

/root/.docker/compose/watchtower/docker-compose.yml

YAML
version: "3.3"
services:
  watchtower:
    image:   containrrr/watchtower
    restart:   unless-stopped
    volumes:
      -   /var/run/docker.sock:/var/run/docker.sock
      -   ~/.docker/config.json:/config.json
    command:   --interval 60 --cleanup --debug

.github/workflows/oss.yml

HTTP
name: oss
on:
  push:
    branches:
      - main
jobs:
  build:
    runs-on:   ubuntu-latest
    steps:
      - name:   checkout
        uses:   actions/checkout@v1
      - name:   install node
        uses:   actions/setup-node@v2
        with:
            node-version: "14"
      - name: build   dist
        run: |
          npm   install -g yarn
          yarn   install
          yarn build
      - name: upload   files to OSS
        uses:   fangbinwei/aliyun-oss-website-action@v1
        with:
          accessKeyId:   ${{ secrets.ACCESS_KEY_ID }}
            accessKeySecret: ${{ secrets.ACCESS_KEY_SECRET }}
          bucket:   experiment-helper-mobile
          endpoint:   https://oss-cn-hangzhou.aliyuncs.com
          folder:   ./dist/build/h5  

/root/.docker/compose/watchtower/docker-compose.yml

YAML
version: "3.3"
services:
  webdav:
    image:   117503445/go_webdav
    restart:   unless-stopped
    volumes:
      -   ~/.docker/volume/orientation-system-be:/root/orientation-system-be
    environment:
      -   dav=/orientation-system-be,/root/orientation-system-be,user1,pass1,true
    networks:
      - traefik
    labels:
      -   "traefik.enable=true"
      -   "traefik.http.routers.webdav.rule=Host(`webdav.be.wizzstudio.com`)"
      -   "traefik.http.routers.webdav.tls=true"
      -   "traefik.http.services.webdav.loadbalancer.server.port=80"
networks:
  traefik:
    external: true