服务器运维资源大全

[mysqld]
# 基础设置
port = 3306
character-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci
default-storage-engine = InnoDB

# 连接设置
max_connections = 500
max_connect_errors = 100
wait_timeout = 28800
interactive_timeout = 28800

# 缓冲设置
innodb_buffer_pool_size = 1G
innodb_log_buffer_size = 16M
key_buffer_size = 32M
tmp_table_size = 64M
max_heap_table_size = 64M

# 日志设置
slow_query_log = 1
slow_query_log_file = /var/log/mysql/slow.log
long_query_time = 2
log_error = /var/log/mysql/error.log

[mysqld]
server-id = 1
log_bin = mysql-bin
binlog_format = ROW
binlog_do_db = database1,database2
expire_logs_days = 7

# GTID配置（推荐）
gtid_mode = ON
enforce_gtid_consistency = ON

# 半同步复制（可选）
plugin_load = "rpl_semi_sync_master=semisync_master.so"
rpl_semi_sync_master_enabled = 1
rpl_semi_sync_master_timeout = 1000

[mysqld]
server-id = 2
relay_log = mysql-relay-bin
read_only = ON
super_read_only = ON

# GTID配置
gtid_mode = ON
enforce_gtid_consistency = ON

# 半同步复制（可选）
plugin_load = "rpl_semi_sync_slave=semisync_slave.so"
rpl_semi_sync_slave_enabled = 1

[mysqld]
# InnoDB优化
innodb_buffer_pool_size = 4G
innodb_buffer_pool_instances = 8
innodb_log_file_size = 512M
innodb_log_buffer_size = 64M
innodb_flush_log_at_trx_commit = 2
innodb_flush_method = O_DIRECT
innodb_io_capacity = 2000
innodb_io_capacity_max = 4000
innodb_read_io_threads = 8
innodb_write_io_threads = 8

# 连接优化
max_connections = 1000
thread_cache_size = 100
back_log = 512

# 查询优化
sort_buffer_size = 4M
join_buffer_size = 4M
read_buffer_size = 2M
read_rnd_buffer_size = 2M

# 临时表优化
tmp_table_size = 256M
max_heap_table_size = 256M

# 基础设置
bind 127.0.0.1
port 6379
daemonize yes
pidfile /var/run/redis/redis.pid
logfile /var/log/redis/redis.log

# 内存设置
maxmemory 2gb
maxmemory-policy allkeys-lru

# 持久化设置
save 900 1
save 300 10
save 60 10000
appendonly yes
appendfsync everysec

# 安全设置
requirepass your_strong_password
rename-command FLUSHALL ""
rename-command FLUSHDB ""

# 性能设置
tcp-backlog 511
tcp-keepalive 300
timeout 0

# 从库配置
replicaof master-ip 6379
masterauth master-password
replica-serve-stale-data yes
replica-read-only yes

# 复制配置
repl-diskless-sync no
repl-diskless-sync-delay 5
repl-timeout 60

port 26379
sentinel monitor mymaster 192.168.1.100 6379 2
sentinel auth-pass mymaster your_password
sentinel down-after-milliseconds mymaster 30000
sentinel parallel-syncs mymaster 1
sentinel failover-timeout mymaster 180000
logfile /var/log/redis/sentinel.log
daemonize yes

# 内存优化
maxmemory 4gb
maxmemory-policy allkeys-lru
maxmemory-samples 5

# 持久化优化
save ""  # 禁用RDB（如只需AOF）
appendonly yes
appendfilename "appendonly.aof"
appendfsync everysec
no-appendfsync-on-rewrite no
auto-aof-rewrite-percentage 100
auto-aof-rewrite-min-size 64mb
aof-load-truncated yes
aof-use-rdb-preamble yes

# 网络优化
tcp-backlog 511
tcp-keepalive 300
timeout 0

# 客户端优化
maxclients 10000
client-output-buffer-limit normal 0 0 0
client-output-buffer-limit replica 256mb 64mb 60
client-output-buffer-limit pubsub 32mb 8mb 60

# 慢查询日志
slowlog-log-slower-than 10000
slowlog-max-len 128

# mongod.conf

# 存储配置
storage:
  dbPath: /var/lib/mongodb
  journal:
    enabled: true
  wiredTiger:
    engineConfig:
      cacheSizeGB: 2
    collectionConfig:
      blockCompressor: snappy

# 网络配置
net:
  port: 27017
  bindIp: 127.0.0.1
  maxIncomingConnections: 65536

# 日志配置
systemLog:
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongod.log
  logRotate: reopen

# 安全配置
security:
  authorization: enabled
  keyFile: /etc/mongodb/keyfile

# 性能配置
setParameter:
  enableLocalhostAuthBypass: false

# 进程管理
processManagement:
  fork: true
  pidFilePath: /var/run/mongodb/mongod.pid

# mongod.conf - 副本集配置

storage:
  dbPath: /var/lib/mongodb

net:
  port: 27017
  bindIp: 0.0.0.0

replication:
  replSetName: rs0
  oplogSizeMB: 1024

security:
  keyFile: /etc/mongodb/keyfile
  authorization: enabled

# 初始化副本集
# mongo --eval 'rs.initiate({
#   _id: "rs0",
#   members: [
#     { _id: 0, host: "mongo1:27017", priority: 2 },
#     { _id: 1, host: "mongo2:27017", priority: 1 },
#     { _id: 2, host: "mongo3:27017", arbiterOnly: true }
#   ]
# })'

# config server (mongod.conf)
sharding:
  clusterRole: configsvr
replication:
  replSetName: configReplSet

# mongos (mongos.conf)
sharding:
  configDB: configReplSet/config1:27019,config2:27019,config3:27019
net:
  port: 27017
  bindIp: 0.0.0.0

# shard server (mongod.conf)
sharding:
  clusterRole: shardsvr
replication:
  replSetName: shard1

# 启用分片
# sh.enableSharding("mydb")
# sh.shardCollection("mydb.mycollection", {"shardKey": 1})

version: '3.8'
services:
  web:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
      - ./ssl:/etc/nginx/ssl
      - ./html:/usr/share/nginx/html
    depends_on:
      - app
    restart: always

  app:
    image: node:18-alpine
    working_dir: /app
    volumes:
      - ./app:/app
    command: npm start
    environment:
      - NODE_ENV=production
    depends_on:
      - db
      - redis
    restart: always

  db:
    image: mysql:8.0
    environment:
      MYSQL_ROOT_PASSWORD: your_password
      MYSQL_DATABASE: appdb
    volumes:
      - db_data:/var/lib/mysql
    restart: always

  redis:
    image: redis:7-alpine
    volumes:
      - redis_data:/data
    restart: always

volumes:
  db_data:
  redis_data:

version: '3.8'
services:
  mysql:
    image: mysql:8.0
    ports:
      - "3306:3306"
    environment:
      MYSQL_ROOT_PASSWORD: root
      MYSQL_DATABASE: dev
    volumes:
      - mysql_data:/var/lib/mysql

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"

  mongo:
    image: mongo:6
    ports:
      - "27017:27017"
    environment:
      MONGO_INITDB_ROOT_USERNAME: admin
      MONGO_INITDB_ROOT_PASSWORD: admin

  adminer:
    image: adminer
    ports:
      - "8080:8080"

volumes:
  mysql_data:

version: '3.8'
services:
  prometheus:
    image: prom/prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'

  grafana:
    image: grafana/grafana
    ports:
      - "3000:3000"
    volumes:
      - grafana_data:/var/lib/grafana
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin

  node_exporter:
    image: prom/node-exporter
    ports:
      - "9100:9100"

  alertmanager:
    image: prom/alertmanager
    ports:
      - "9093:9093"
    volumes:
      - ./alertmanager.yml:/etc/alertmanager/alertmanager.yml

volumes:
  prometheus_data:
  grafana_data:

# 生成私钥
openssl genrsa -out server.key 2048

# 生成CSR
openssl req -new -key server.key -out server.csr

# 生成自签名证书（有效期365天）
openssl x509 -req -days 365 -in server.csr \
  -signkey server.key -out server.crt

# 一键生成（测试用）
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout server.key -out server.crt \
  -subj "/C=CN/ST=Beijing/L=Beijing/O=Company/CN=localhost"

# 安装certbot
apt install certbot python3-certbot-nginx

# 申请证书
certbot --nginx -d example.com -d www.example.com

# 手动申请（DNS验证）
certbot certonly --manual --preferred-challenges dns \
  -d example.com -d *.example.com

# 续期
certbot renew --dry-run

# 自动续期（crontab）
0 3 * * * /usr/bin/certbot renew --quiet

# 生成2048位DH参数
openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

# 生成4096位（更安全但更慢）
openssl dhparam -out /etc/nginx/ssl/dhparam.pem 4096

# Nginx配置
ssl_dhparam /etc/nginx/ssl/dhparam.pem;

# PEM转PKCS12（.p12/.pfx）
openssl pkcs12 -export -out cert.p12 \
  -inkey server.key -in server.crt -certfile ca.crt

# PKCS12转PEM
openssl pkcs12 -in cert.p12 -out cert.pem -nodes

# PEM转DER
openssl x509 -in cert.pem -outform DER -out cert.der

# DER转PEM
openssl x509 -in cert.der -inform DER -out cert.pem -outform PEM

# 查看证书信息
openssl x509 -in cert.pem -text -noout

# 验证证书链
openssl verify -CAfile ca.crt cert.crt

server {
    listen 443 ssl http2;
    server_name example.com;
    
    # 证书配置
    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;
    
    # 协议配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    
    # 会话配置
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;
    
    # DH参数
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    
    # HSTS
    add_header Strict-Transport-Security "max-age=31536000" always;
    
    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
}