騰訊云輕量Docker部署單節(jié)點(diǎn)MinIO
前言
因?yàn)轵v訊云最近新推出了輕量應(yīng)用服務(wù)器的云硬盤，相對(duì)于CVM的云硬盤性能幾乎一模一樣，而且因?yàn)樯闲伦龌顒?dòng)3年的1TB云硬盤只要59.7元，直接讓輕量變身超級(jí)大盤雞，我就尋思著能不能拿這硬盤整點(diǎn)花活，正巧聽說了有個(gè)開源且成熟的對(duì)象儲(chǔ)存系統(tǒng)MinIO，索性就拿來試試水……
點(diǎn)此前往騰訊云新春采購活動(dòng)（云硬盤活動(dòng)老用戶也能參加）：https://curl.qcloud.com/pUJXIiix
首先系統(tǒng)選擇的是Debian 11.1
MinIO offers high-performance, S3 compatible object storage.
Native to Kubernetes, MinIO is the only object storage suite available on
every public cloud, every Kubernetes distribution, the private cloud and the
edge. MinIO is software-defined and is 100% open source under GNU AGPL v3.
Docker安裝
安裝docker，這里使用官方的安裝腳本，安裝源為阿里云
curl -fsSL https://get.docker.com | bash -s docker --mirror Aliyun
Docker安裝MinIO
docker run \
?-p 9000:9000 \
?-p 9001:9001 \
?--name minio1 \
?-v /home/minio/data:/data \
?-e "MINIO_ROOT_USER=Your_Login_User_Name" \
?-e "MINIO_ROOT_PASSWORD=Your_Login_User_Password" \
?quay.io/minio/minio server /data --console-address ":9001"
在執(zhí)行完成后，瀏覽器訪問服務(wù)器IP地址:9001即可登錄MinIO的Web控制臺(tái)
反向代理
安裝Nginx，可以隨個(gè)人喜好，這里我直接安裝在本機(jī)環(huán)境內(nèi)了
apt install -y openssl libssl-dev libpcre3 libpcre3-dev
wget http://nginx.org/download/nginx-1.21.6.tar.gz
tar -xvzf nginx-1.21.6.tar.gz
cd nginx-1.21.6
./configure --user=www --group=www --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --with-http_sub_module --with-stream --with-stream_ssl_module --with-http_realip_module --with-http_gzip_static_module
make instll
ln -s /usr/local/nginx/sbin/nginx /usr/bin/nginx
配置Systemd守護(hù)
vi /usr/lib/systemd/system/nginx.service
[Unit]
Description=nginx - high performance web server
Documentation=http://nginx.org/en/docs/
After=network.target remote-fs.target nss-lookup.target
[Service]
Type=forking
PIDFile=/usr/local/nginx/logs/nginx.pid
ExecStartPre=/usr/local/nginx/sbin/nginx -t -c /usr/local/nginx/conf/nginx.conf
ExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s QUIT $MAINPID
PrivateTmp=true
[Install]
WantedBy=multi-user.target
啟動(dòng)Nginx
systemctl start nginx
編輯NGINX反向代理配置文件(默認(rèn))
server {
listen 80;
server_name example.com;
# To allow special characters in headers
ignore_invalid_headers off;
# Allow any size file to be uploaded.
# Set to a value such as 1000m; to restrict file size to a specific value
client_max_body_size 0;
# To disable buffering
proxy_buffering off;
location / {
? proxy_set_header X-Real-IP $remote_addr;
? proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
? proxy_set_header X-Forwarded-Proto $scheme;
? proxy_set_header Host $http_host;
? proxy_connect_timeout 300;
? # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
? proxy_http_version 1.1;
? proxy_set_header Connection "";
? chunked_transfer_encoding off;
? proxy_pass http://localhost:9000; # If you are using docker-compose this would be the hostname i.e. minio
? # Health Check endpoint might go here. See https://www.nginx.com/resources/wiki/modules/healthcheck/
? # /minio/health/live;
}
}
如果你想要將儲(chǔ)存桶與Web控制臺(tái)使用同域名，則應(yīng)按下面的配置文件編輯反向代理
server {
listen 80;
server_name example.com;
# To allow special characters in headers
ignore_invalid_headers off;
# Allow any size file to be uploaded.
# Set to a value such as 1000m; to restrict file size to a specific value
client_max_body_size 0;
# To disable buffering
proxy_buffering off;
# Proxy requests to the bucket "photos" to MinIO server running on port 9000
location /photos/ {
? proxy_set_header X-Real-IP $remote_addr;
? proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
? proxy_set_header X-Forwarded-Proto $scheme;
? proxy_set_header Host $http_host;
? proxy_connect_timeout 300;
? # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
? proxy_http_version 1.1;
? proxy_set_header Connection "";
? chunked_transfer_encoding off;
? proxy_pass http://localhost:9000;
}
# Proxy any other request to the application server running on port 9001
location / {
? proxy_set_header X-Real-IP $remote_addr;
? proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
? proxy_set_header X-Forwarded-Proto $scheme;
? proxy_set_header Host $http_host;
? proxy_connect_timeout 300;
? # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
? proxy_http_version 1.1;
? proxy_set_header Connection "";
? chunked_transfer_encoding off;
? proxy_pass http://localhost:9001;
}
請(qǐng)將server_name換成你自己的域名
ACME.SH簽發(fā)證書
安裝ACME.SH
curl ?https://get.acme.sh | sh -s email=your_email_adress
重載環(huán)境
source .profile
添加DNSPOD API密鑰
export DP_Id="xxxxxx"
export DP_Key="xxxxxxxxxxxx"
DNSPOD密鑰創(chuàng)建位置在我的賬號(hào)-API密鑰-DNSPod Token
ID通常為6隨機(jī)6位數(shù)
簽發(fā)證書(通配符)
acme.sh --dns dns_dp --issue -d example.com -d *.example.com
安裝證書
acme.sh ?--installcert ?-d ?example.com ? \
? ? ? ?--key-file ? /usr/local/nginx/cert/example.com/privkey.pem \
? ? ? ?--fullchain-file /usr/local/nginx/cert/example.com/fullchain.pem
編輯nginx配置文件，增加SSL配置
? ?ssl on;
? ?ssl_certificate ?/usr/local/nginx/cert/example.com/fullchain.pem;
? ?ssl_certificate_key /usr/local/nginx/cert/example.com/privkey.pem;
? ?ssl_session_timeout 5m;
? ?ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
? ?ssl_protocols ?TLSv1.1 TLSv1.2 TLSv1.3;
? ?ssl_prefer_server_ciphers on;
重啟NGINX
systemctl restart nginx
將儲(chǔ)存桶設(shè)置為公開永久可讀
設(shè)置完這么多，到真正用的時(shí)候發(fā)現(xiàn)傳上去的文件公開不可讀？
這是因?yàn)镸inIO的儲(chǔ)存桶默認(rèn)沒有公開訪問權(quán)限
如果想要設(shè)置為儲(chǔ)存桶公開可讀，首先進(jìn)入MinIO的Web控制臺(tái)，點(diǎn)擊Buckets-Manage-Access Rules-Add Access Rules,新建一個(gè)如下圖所示的策略后點(diǎn)擊Save保存即可
此時(shí)你輸入IP:9000/Buckets_Name/FileName即可直接下載/查看文件，如果已配置NGINX代理，那么輸入域名/Buckets_Name/FileName即可直接下載/查看文件。
參考資料
MinIO | Learn more about MinIO’s Docker Implementation
MinIO | Setup Nginx proxy with MinIO – Cookbook/Recipe
說明 · acmesh-official/acme.sh Wiki · GitHub
Nginx下HTTP強(qiáng)制重定向至HTTPS – WillLin – 博客園 (cnblogs.com)
#レム あけおめ – eikaa的插畫 – pixiv
