重新构建运维流程

client-api/Jenkinsfile

@@ -1,29 +1,39 @@
 /**
  * OfferPie Backend Client-API 蓝绿部署流水线
  *
- * 工作目录说明：
+ * 部署架构：
- * - Jenkins 会自动为每个项目创建独立的工作空间：/var/jenkins_home/workspace/<项目名>/
+ * - Jenkins Master 通过 SSH(sshpass) 远程控制目标 Ubuntu 服务器
- * - docker-compose 文件在项目根目录，通过 -f 指定文件名
+ * - 目标服务器：Docker Nginx (443/80 SSL + 蓝绿切换) → blue/green 容器
- * - Dockerfile 在 client-api/ 子目录下，build context 为项目根目录（因为需要编译 common 和 manager 模块）
+ * - 目标服务器可以是全新裸机，流水线自动完成环境准备
- * - nginx.conf 在 client-api/ 下，首次部署时 docker cp 进 nginx 容器
+ *
+ * 前置条件：
+ * - Jenkins Master 已安装 sshpass
  */
 pipeline {
     agent any
 
     parameters {
         choice(name: 'BRANCH', choices: ['master', 'pre', 'dev', 'test'], description: '选择要部署的分支')
+        string(name: 'DEPLOY_HOST', defaultValue: '8.138.12.104', description: '目标服务器 IP')
+        string(name: 'DEPLOY_PORT', defaultValue: '22', description: 'SSH 端口')
+        string(name: 'DEPLOY_USER', defaultValue: 'root', description: 'SSH 用户名')
+        password(name: 'DEPLOY_PASSWORD', defaultValue: 'Mzpy520@126.com', description: 'SSH 密码')
     }
 
     environment {
-        COMPOSE_FILE = 'docker-compose.client-api.yml'       // docker-compose 文件名
+        COMPOSE_FILE = 'docker-compose.client-api.yml'
-        CONTAINER_PREFIX = 'offerpie-backend-client'          // 容器名前缀，拼接 -blue / -green / -nginx
+        CONTAINER_PREFIX = 'offerpie-backend-client'
-        HEALTH_URL = 'http://localhost:8080/api/public/actuator/health'  // 应用健康检查地址
+        HEALTH_URL = 'http://localhost:8080/api/public/actuator/health'
+        REMOTE_WORK_DIR = '/opt/offerpie/backend'
+        SSH_CMD = "sshpass -p '${params.DEPLOY_PASSWORD}' ssh -o StrictHostKeyChecking=no -p ${params.DEPLOY_PORT} ${params.DEPLOY_USER}@${params.DEPLOY_HOST}"
+        SCP_CMD = "sshpass -p '${params.DEPLOY_PASSWORD}' scp -o StrictHostKeyChecking=no -P ${params.DEPLOY_PORT}"
     }
 
     stages {
         stage('开始提示') {
             steps {
                 echo "OfferPie Backend Client-API 开始构建"
+                echo "目标服务器: ${params.DEPLOY_HOST}:${params.DEPLOY_PORT}"
             }
         }
 
@@ -36,18 +46,84 @@ pipeline {
             }
         }
 
+        /**
+         * 环境准备
+         * - 检查/安装 Docker
+         * - 检查/安装 docker-compose
+         * - 创建必要目录
+         */
+        stage('环境准备') {
+            steps {
+                script {
+                    // 检查/安装 Docker
+                    sh """
+                        ${SSH_CMD} '
+                            if ! command -v docker &> /dev/null; then
+                                echo "Docker 未安装，开始安装..."
+                                apt-get update
+                                apt-get install -y docker.io
+                                systemctl start docker
+                                systemctl enable docker
+                            else
+                                echo "Docker 已安装"
+                            fi
+                        '
+                    """
+
+                    // 检查/安装 docker-compose
+                    sh """
+                        ${SSH_CMD} '
+                            if ! command -v docker-compose &> /dev/null; then
+                                echo "docker-compose 未安装，开始安装..."
+                                curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-linux-x86_64" -o /usr/local/bin/docker-compose
+                                chmod +x /usr/local/bin/docker-compose
+                            else
+                                echo "docker-compose 已安装"
+                            fi
+                        '
+                    """
+
+                    // 创建必要目录
+                    sh """
+                        ${SSH_CMD} '
+                            mkdir -p /etc/ssl/offerpai
+                            mkdir -p /logs/offerpie-backend-client
+                            mkdir -p ${REMOTE_WORK_DIR}
+                        '
+                    """
+                }
+            }
+        }
+
+        /**
+         * 文件传输
+         * - scp 项目源码到目标服务器
+         * - scp SSL 证书到目标服务器
+         */
+        stage('文件传输') {
+            steps {
+                script {
+                    // 传输项目源码
+                    sh "${SCP_CMD} -r . ${params.DEPLOY_USER}@${params.DEPLOY_HOST}:${REMOTE_WORK_DIR}/"
+
+                    // 传输 SSL 证书
+                    sh "${SCP_CMD} client-api/offerpai.com.cn.crt ${params.DEPLOY_USER}@${params.DEPLOY_HOST}:/etc/ssl/offerpai/"
+                    sh "${SCP_CMD} client-api/offerpai.com.cn.key ${params.DEPLOY_USER}@${params.DEPLOY_HOST}:/etc/ssl/offerpai/"
+                }
+            }
+        }
+
         /**
          * 检测部署目标
-         * - 检查 blue 和 green 容器的运行状态
+         * - blue 在运行 → 部署 green
-         * - blue 在运行 → 部署 green；green 在运行 → 部署 blue
+         * - green 在运行 → 部署 blue
-         * - 都不在或都在 → 默认部署 blue
+         * - 都不在 → 默认部署 blue
          */
         stage('检测部署目标') {
             steps {
-                echo "检查当前容器状态"
                 script {
-                    def blueRunning = sh(script: "docker ps -q -f name=${CONTAINER_PREFIX}-blue", returnStdout: true).trim()
+                    def blueRunning = sh(script: "${SSH_CMD} 'docker ps -q -f name=${CONTAINER_PREFIX}-blue'", returnStdout: true).trim()
-                    def greenRunning = sh(script: "docker ps -q -f name=${CONTAINER_PREFIX}-green", returnStdout: true).trim()
+                    def greenRunning = sh(script: "${SSH_CMD} 'docker ps -q -f name=${CONTAINER_PREFIX}-green'", returnStdout: true).trim()
 
                     env.DEPLOY_TARGET = ''
 
@@ -70,44 +146,42 @@ pipeline {
 
         /**
          * 构建新版本
-         * - 先清理目标颜色的旧容器（如果残留）
+         * - 清理目标颜色的旧容器（如果残留）
          * - docker-compose build 编译新镜像
          */
         stage('构建新版本') {
             steps {
                 script {
-                    def existingContainer = sh(script: "docker ps -aq -f name=${CONTAINER_PREFIX}-${env.DEPLOY_TARGET}", returnStdout: true).trim()
+                    def existingContainer = sh(script: "${SSH_CMD} 'docker ps -aq -f name=${CONTAINER_PREFIX}-${env.DEPLOY_TARGET}'", returnStdout: true).trim()
                     if (existingContainer) {
                         echo "清理已存在的容器: ${CONTAINER_PREFIX}-${env.DEPLOY_TARGET}"
-                        sh "docker rm -f ${CONTAINER_PREFIX}-${env.DEPLOY_TARGET}"
+                        sh "${SSH_CMD} 'docker rm -f ${CONTAINER_PREFIX}-${env.DEPLOY_TARGET}'"
                     }
-                    sh "docker-compose -f ${COMPOSE_FILE} build ${env.DEPLOY_TARGET}"
+                    sh "${SSH_CMD} 'cd ${REMOTE_WORK_DIR} && docker-compose -f ${COMPOSE_FILE} build ${env.DEPLOY_TARGET}'"
                 }
             }
         }
 
         /**
          * 检查 Nginx
-         * - 检查 nginx 容器是否存在
+         * - 不存在：启动 → docker cp 配置 → reload
-         * - 不存在则启动并复制配置文件（首次部署）
+         * - 已存在：确保运行中
-         * - 存在则确保容器运行中
          */
         stage('检查Nginx') {
             steps {
                 script {
-                    def nginxExists = sh(script: "docker ps -aq -f name=${CONTAINER_PREFIX}-nginx", returnStdout: true).trim()
+                    def nginxExists = sh(script: "${SSH_CMD} 'docker ps -aq -f name=${CONTAINER_PREFIX}-nginx'", returnStdout: true).trim()
                     if (!nginxExists) {
                         echo "首次部署，初始化 Nginx 容器"
-                        sh "docker-compose -f ${COMPOSE_FILE} up -d nginx"
+                        sh "${SSH_CMD} 'cd ${REMOTE_WORK_DIR} && docker-compose -f ${COMPOSE_FILE} up -d nginx'"
                         sh "sleep 3"
-                        // 复制配置文件到容器内
+                        sh "${SSH_CMD} 'docker cp ${REMOTE_WORK_DIR}/client-api/nginx.conf ${CONTAINER_PREFIX}-nginx:/etc/nginx/nginx.conf'"
-                        sh "docker cp client-api/nginx.conf ${CONTAINER_PREFIX}-nginx:/etc/nginx/nginx.conf"
+                        sh "${SSH_CMD} 'docker exec ${CONTAINER_PREFIX}-nginx nginx -s reload'"
-                        sh "docker exec ${CONTAINER_PREFIX}-nginx nginx -s reload"
                     } else {
-                        def nginxRunning = sh(script: "docker ps -q -f name=${CONTAINER_PREFIX}-nginx", returnStdout: true).trim()
+                        def nginxRunning = sh(script: "${SSH_CMD} 'docker ps -q -f name=${CONTAINER_PREFIX}-nginx'", returnStdout: true).trim()
                         if (!nginxRunning) {
                             echo "Nginx 容器已停止，重新启动"
-                            sh "docker start ${CONTAINER_PREFIX}-nginx"
+                            sh "${SSH_CMD} 'docker start ${CONTAINER_PREFIX}-nginx'"
                             sh "sleep 2"
                         }
                         echo "Nginx 容器已存在且运行中"
@@ -119,8 +193,7 @@ pipeline {
         stage('启动新版本') {
             steps {
                 script {
-                    sh "docker-compose -f ${COMPOSE_FILE} up -d ${env.DEPLOY_TARGET}"
+                    sh "${SSH_CMD} 'cd ${REMOTE_WORK_DIR} && docker-compose -f ${COMPOSE_FILE} up -d ${env.DEPLOY_TARGET}'"
-                    // 等待 Spring Boot 应用完全启动
                     sh 'sleep 35'
                 }
             }
@@ -128,10 +201,8 @@ pipeline {
 
         /**
          * 健康检查
-         * - 进入容器执行 curl 检测应用是否正常响应
+         * - 容器内 curl 检测应用是否正常
-         * - curl -f 参数：HTTP 错误码（404、500等）时返回失败
          * - 最多重试 3 次，每次间隔 5 秒
-         * - 全部失败则终止部署流程
          */
         stage('健康检查') {
             steps {
@@ -142,7 +213,7 @@ pipeline {
 
                     while (retryCount < maxRetries && !healthy) {
                         try {
-                            sh "docker exec ${CONTAINER_PREFIX}-${env.DEPLOY_TARGET} curl -f ${HEALTH_URL}"
+                            sh "${SSH_CMD} 'docker exec ${CONTAINER_PREFIX}-${env.DEPLOY_TARGET} curl -f ${HEALTH_URL}'"
                             healthy = true
                         } catch (Exception e) {
                             retryCount++
@@ -163,31 +234,28 @@ pipeline {
 
         /**
          * 切换流量
-         * - 修改 nginx 配置中的 proxy_pass 指向新版本容器
+         * - sed 修改 nginx proxy_pass 指向新色
-         * - nginx 不挂载宿主机文件，直接 sed -i 修改容器内配置
+         * - reload 生效
-         * - reload 使新配置生效，实现零停机切换
          */
         stage('切换流量') {
             steps {
                 script {
-                    sh "docker exec ${CONTAINER_PREFIX}-nginx sed -i 's/proxy_pass http:\\/\\/\\(blue\\|green\\):8080;/proxy_pass http:\\/\\/${env.DEPLOY_TARGET}:8080;/' /etc/nginx/nginx.conf"
+                    sh "${SSH_CMD} \"docker exec ${CONTAINER_PREFIX}-nginx sed -i 's/proxy_pass http:\\/\\/\\(blue\\|green\\):8080;/proxy_pass http:\\/\\/${env.DEPLOY_TARGET}:8080;/' /etc/nginx/nginx.conf\""
-                    sh "docker exec ${CONTAINER_PREFIX}-nginx nginx -s reload"
+                    sh "${SSH_CMD} 'docker exec ${CONTAINER_PREFIX}-nginx nginx -s reload'"
                     echo "✅ 流量已切换到 ${env.DEPLOY_TARGET}"
                 }
             }
         }
 
         /**
-         * 停止并删除旧版本
+         * 删除旧版本
-         * - 不能用 docker-compose down，会删除所有服务（包括 nginx）
-         * - 用 docker rm -f 只删除指定的旧颜色容器
          */
         stage('删除旧版本') {
             steps {
                 script {
-                    def otherExists = sh(script: "docker ps -aq -f name=${CONTAINER_PREFIX}-${env.OTHER_TARGET}", returnStdout: true).trim()
+                    def otherExists = sh(script: "${SSH_CMD} 'docker ps -aq -f name=${CONTAINER_PREFIX}-${env.OTHER_TARGET}'", returnStdout: true).trim()
                     if (otherExists) {
-                        sh "docker rm -f ${CONTAINER_PREFIX}-${env.OTHER_TARGET}"
+                        sh "${SSH_CMD} 'docker rm -f ${CONTAINER_PREFIX}-${env.OTHER_TARGET}'"
                         echo "旧版本 ${env.OTHER_TARGET} 已删除"
                     }
                 }

client-api/nginx.conf

@@ -23,9 +23,10 @@ http {
 
     client_max_body_size 20m;
 
+    # HTTP → HTTPS 跳转
     server {
         listen 80;
-        server_name _;
+        server_name api.offerpai.com.cn;
 
         # Nginx 自身健康检查
         location /health {
@@ -34,6 +35,26 @@ http {
             add_header Content-Type text/plain;
         }
 
+        location / {
+            return 301 https://$host$request_uri;
+        }
+    }
+
+    # HTTPS + 蓝绿切换
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name api.offerpai.com.cn;
+
+        ssl_certificate /etc/nginx/ssl/offerpai.com.cn.crt;
+        ssl_certificate_key /etc/nginx/ssl/offerpai.com.cn.key;
+
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_ciphers HIGH:!aNULL:!MD5;
+        ssl_prefer_server_ciphers on;
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_timeout 10m;
+
         # 默认代理到 blue，部署时通过 sed 切换
         location / {
             proxy_pass http://blue:8080;

client-api/offerpai.com.cn.crt

@@ -0,0 +1,49 @@
+-----BEGIN CERTIFICATE-----
+MIIDnTCCAyKgAwIBAgISBVWuRhhOaiBkuQnFxKyCJDMFMAoGCCqGSM49BAMDMDIx
+CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
+NzAeFw0yNjA1MjIxMDI2MjRaFw0yNjA4MjAxMDI2MjNaMBoxGDAWBgNVBAMTD29m
+ZmVycGFpLmNvbS5jbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFf/rMowrqMf
++sD6s2QBnj3uT2CjxxjQkVnuKXGlV8QCQvLhCNiPqyVaXhwQRnW4/A4DDygQ0SjG
+7S3qKPBrCXCjggIuMIICKjAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYB
+BQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUMUW5y29bkHDb++PS0DfpFe/k
+ubYwHwYDVR0jBBgwFoAUrkie3IcdRKBv2qLlYHQEeMKcAIAwMgYIKwYBBQUHAQEE
+JjAkMCIGCCsGAQUFBzAChhZodHRwOi8vZTcuaS5sZW5jci5vcmcvMC0GA1UdEQQm
+MCSCESoub2ZmZXJwYWkuY29tLmNugg9vZmZlcnBhaS5jb20uY24wEwYDVR0gBAww
+CjAIBgZngQwBAgEwLAYDVR0fBCUwIzAhoB+gHYYbaHR0cDovL2U3LmMubGVuY3Iu
+b3JnLzYuY3JsMIIBDQYKKwYBBAHWeQIEAgSB/gSB+wD5AHYAwjF+V0UZo0Xufzje
+spBB68fCIVoiv3/Vta12mtkOUs0AAAGeT25fsAAABAMARzBFAiEA+wB1nILWmjta
+TYVKK0O3dy/XYw8yN9tAHU2m48ILxFgCIEhNQOZOSQcJckwuPUkAnz+3EwCo95d3
+8KR2hjCv7KkkAH8AqCbL4wrGNRJGUz/gZfFPGdluGQgTxB3ZbXkAsxI8VScAAAGe
+T25jRQAIAAAFAAwCz/kEAwBIMEYCIQDhvNquPNk6cnZru4zQeX9fd9JAqPbVk76l
+mLrC5QWiRAIhAMf1zNpuUAg9sz8Ft0szAbdmGwT7B7nBftIVyU2LseO6MAoGCCqG
+SM49BAMDA2kAMGYCMQC8wvsgPm4l+i1nGGfNph7QVnu1hc4giTqHco5dp+sLr9Qi
+E0Cm013ub291oy92sYECMQCMshoYY/LnubmjMxnkAIV9/WbhZ2FJCtWmKWSNdGnU
+l+l/l6tgc1a1iHB8E0lr31I=
+-----END CERTIFICATE-----
+
+-----BEGIN CERTIFICATE-----
+MIIEVzCCAj+gAwIBAgIRAKp18eYrjwoiCWbTi7/UuqEwDQYJKoZIhvcNAQELBQAw
+TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
+cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
+WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
+RW5jcnlwdDELMAkGA1UEAxMCRTcwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARB6AST
+CFh/vjcwDMCgQer+VtqEkz7JANurZxLP+U9TCeioL6sp5Z8VRvRbYk4P1INBmbef
+QHJFHCxcSjKmwtvGBWpl/9ra8HW0QDsUaJW2qOJqceJ0ZVFT3hbUHifBM/2jgfgw
+gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
+ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSuSJ7chx1EoG/aouVgdAR4
+wpwAgDAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g
+BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu
+Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAjx66fDdLk5ywFn3CzA1w1qfylHUD
+aEf0QZpXcJseddJGSfbUUOvbNR9N/QQ16K1lXl4VFyhmGXDT5Kdfcr0RvIIVrNxF
+h4lqHtRRCP6RBRstqbZ2zURgqakn/Xip0iaQL0IdfHBZr396FgknniRYFckKORPG
+yM3QKnd66gtMst8I5nkRQlAg/Jb+Gc3egIvuGKWboE1G89NTsN9LTDD3PLj0dUMr
+OIuqVjLB8pEC6yk9enrlrqjXQgkLEYhXzq7dLafv5Vkig6Gl0nuuqjqfp0Q1bi1o
+yVNAlXe6aUXw92CcghC9bNsKEO1+M52YY5+ofIXlS/SEQbvVYYBLZ5yeiglV6t3S
+M6H+vTG0aP9YHzLn/KVOHzGQfXDP7qM5tkf+7diZe7o2fw6O7IvN6fsQXEQQj8TJ
+UXJxv2/uJhcuy/tSDgXwHM8Uk34WNbRT7zGTGkQRX0gsbjAea/jYAoWv0ZvQRwpq
+Pe79D/i7Cep8qWnA+7AE/3B3S/3dEEYmc0lpe1366A/6GEgk3ktr9PEoQrLChs6I
+tu3wnNLB2euC8IKGLQFpGtOO/2/hiAKjyajaBP25w1jF0Wl8Bbqne3uZ2q1GyPFJ
+YRmT7/OXpmOH/FVLtwS+8ng1cAmpCujPwteJZNcDG0sF2n/sc0+SQf49fdyUK0ty
++VUwFj9tmWxyR/M=
+-----END CERTIFICATE-----

client-api/offerpai.com.cn.key

@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIAj3lWeQ/L+GVhLzcfgJe6oak4e3L3y1sSowG5k3HGvUoAoGCCqGSM49
+AwEHoUQDQgAEV/+syjCuox/6wPqzZAGePe5PYKPHGNCRWe4pcaVXxAJC8uEI2I+r
+JVpeHBBGdbj8DgMPKBDRKMbtLeoo8GsJcA==
+-----END EC PRIVATE KEY-----

docker-compose.client-api.yml

@@ -3,13 +3,11 @@ services:
     image: nginx:alpine
     container_name: offerpie-backend-client-nginx
     restart: unless-stopped
-    networks:
-      - xxl-job-network
     ports:
-      - "10202:80"
+      - "443:443"
-    depends_on:
+      - "80:80"
-      - blue
+    volumes:
-      - green
+      - /etc/ssl/offerpai:/etc/nginx/ssl:ro
     healthcheck:
       test: ["CMD", "wget", "--spider", "-q", "http://localhost/health"]
       interval: 30s
@@ -27,8 +25,6 @@ services:
       dockerfile: client-api/Dockerfile
     container_name: offerpie-backend-client-blue
     restart: unless-stopped
-    networks:
-      - xxl-job-network
     expose:
       - "8080"
     environment:
@@ -55,8 +51,6 @@ services:
       dockerfile: client-api/Dockerfile
     container_name: offerpie-backend-client-green
     restart: unless-stopped
-    networks:
-      - xxl-job-network
     expose:
       - "8080"
     environment:
@@ -76,7 +70,3 @@ services:
         limits:
           memory: 2G
           cpus: '2'
-
-networks:
-  xxl-job-network:
-    external: true