opsx
3c9388658b
【已在线完成，零数据丢失】
K8s ns=log 资源全部改名：
Deployment opsx-loki → lokistack
Service opsx-loki → lokistack
Service opsx-loki-nodeport → lokistack-nodeport
PVC opsxloki-data → lokistack-data
Secret opsxloki-secrets → lokistack-secrets
Label app: opsx-loki → app: lokistack
Ingress log.astx.club 后端 → lokistack-nodeport:8080
镜像 lghost/opsxloki → lghost/lokistack
docker-compose 卷/容器名同步更名
【保留不变（改了会出事）】
namespace: log
数据文件名 opsxloki.json（代码硬编码）
容器内路径 /app/data
【迁移过程】
1. 备份 PVC 数据(32KB) + Secret 原值 + 旧 yaml → /root/lokistack-migration-backup-20261026-171141
2. scale 旧 Deployment → 0，等 Pod 消失
3. 复制 Secret（JWT sha256 校验一致）
4. 新建 PVC lokistack-data（Bound 30Gi cbs）
5. 临时 Pod 恢复数据（chown 1000:1000，opsxloki.json 保留 0600）
6. apply 新 Deployment → 1/1 Running
7. 修复 Ingress 后端（TKE qcloud 要求 NodePort）→ CLB 恢复 200
8. 删除旧 Deployment / 失效 Service
【验证】
lokistack 1/1，0 重启，镜像 lghost/lokistack:latest（statically linked）
/api/v1/health → {"status":"ok","version":"2.0.0"}
/app/data/opsxloki.json 610B 完整（admin 用户 + 配置）
http://log.astx.club/ → HTTP 200
镜像加固：admin123=0、/app/backend/=0、initial-admin-password.txt 存在
【回滚兜底（建议 7 天后删）】
pvc/opsxloki-data、secret/opsxloki-secrets
【文档】
README 新增「从 opsx-loki 升级」章节：
K8s 七步迁移脚本 + docker-compose 卷迁移命令
116 lines
3.4 KiB
YAML
116 lines
3.4 KiB
YAML
# ============================================================
|
|
# lokistack - Development Docker Compose Configuration
|
|
# ============================================================
|
|
# P0 Fixes:
|
|
# - Non-root kubeconfig mount (/home/lokistack/.kube)
|
|
# - Healthcheck for orchestration visibility
|
|
# - Resource limits to prevent noisy-neighbor
|
|
# - security_opt: no-new-privileges
|
|
# - Log rotation (json-file driver)
|
|
# - Named volumes instead of bind mounts
|
|
# P1 Fixes:
|
|
# - Restart policy optimization
|
|
# - Network isolation
|
|
# ============================================================
|
|
|
|
services:
|
|
lokistack:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
args:
|
|
TARGETARCH: ${TARGETARCH:-amd64}
|
|
image: lghost/lokistack:latest
|
|
container_name: lokistack
|
|
hostname: lokistack
|
|
|
|
# ---- P0: Security options ----
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
cap_add:
|
|
# Required for healthcheck (wget) and runtime operations
|
|
- NET_BIND_SERVICE
|
|
# Required for file operations in /app/data
|
|
- CHOWN
|
|
- SETGID
|
|
- SETUID
|
|
read_only: false # Dev mode needs writable /app/data
|
|
|
|
ports:
|
|
- "${SERVER_PORT:-8080}:8080"
|
|
|
|
# ---- P0: Named volumes for data persistence ----
|
|
volumes:
|
|
- lokistack-data:/app/data
|
|
# P0: Mount kubeconfig to non-root user directory
|
|
- ${KUBECONFIG_PATH:-${HOME}/.kube}:/home/lokistack/.kube:ro
|
|
# SSH keys for host-based deployments
|
|
- ${SSH_KEY_PATH:-${HOME}/.ssh}:/home/lokistack/.ssh:ro
|
|
|
|
# ---- P0: Environment variables (no default secrets) ----
|
|
environment:
|
|
- SERVER_PORT=8080
|
|
- DATA_DIR=/app/data
|
|
# P0: JWT_SECRET must be provided externally
|
|
# Set via .env file or shell export before running docker compose up.
|
|
# 注意：错误提示里不要内嵌 $(openssl ...)，否则会在 compose 解析时被执行。
|
|
- "JWT_SECRET=${JWT_SECRET:?JWT_SECRET is required. Generate: openssl rand -hex 32, then: export JWT_SECRET=<value>}"
|
|
# P0: ENCRYPTION_KEY must be provided externally (AES-256, >=32 字符)
|
|
- "ENCRYPTION_KEY=${ENCRYPTION_KEY:?ENCRYPTION_KEY is required. Generate: openssl rand -hex 32, then: export ENCRYPTION_KEY=<value>}"
|
|
# KUBECONFIG points to non-root user's .kube directory
|
|
- KUBECONFIG=/home/lokistack/.kube/config
|
|
|
|
# ---- P0: Healthcheck ----
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/index.html"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 15s
|
|
|
|
# ---- P0: Resource limits ----
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '2.0'
|
|
memory: 512M
|
|
pids: 100
|
|
reservations:
|
|
cpus: '0.25'
|
|
memory: 64M
|
|
|
|
# ---- P0: Log rotation ----
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "50m"
|
|
max-file: "5"
|
|
labels: "service,image"
|
|
env: "SERVER_PORT,DATA_DIR"
|
|
|
|
# ---- P1: Restart policy ----
|
|
restart: unless-stopped
|
|
stop_grace_period: 15s
|
|
|
|
networks:
|
|
- lokistack-net
|
|
|
|
# ---- Named volumes ----
|
|
volumes:
|
|
lokistack-data:
|
|
driver: local
|
|
labels:
|
|
- "com.lokistack.description=lokistack data directory"
|
|
|
|
# ---- Network isolation ----
|
|
networks:
|
|
lokistack-net:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 172.28.0.0/16
|
|
labels:
|
|
- "com.lokistack.description=lokistack internal network"
|