Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix:权限调整

Browse Source
This commit is contained in:
waner
2026-05-19 17:12:53 +08:00
parent a30c029fc4
commit 58dc015e01
14 changed files with 651 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deployment/tms-deployment.md
+312 -10
View File
@@ -364,12 +364,12 @@ java -version
### 3.3 网络与端口
TMS 默认监听端口：
- `8080`
- `8088`
检查命令：
```bash
ss -lntp | grep 8080
ss -lntp | grep 8088
```
### 3.4 建议具备的系统命令
@@ -398,12 +398,33 @@ TMS 统一部署到 `/home/tms`：
│ ├── apply_standard_db.sh
│ ├── start_standard_apps.sh
│ ├── start_standard_nginx.sh
│ └── check_standard_runtime.sh
│ ├── stop_standard_apps.sh
│ ├── stop_standard_nginx.sh
│ ├── stop_standard_rabbitmq.sh
│ ├── check_standard_runtime.sh
│ └── resource-restore
│ ├── apply-resource-backup.sh
│ ├── restore-db.sh
│ └── replay-mq.sh
├── config
│ └── application.yml
├── gateway
│ ├── gm
│ │ ├── start.sh
│ │ ├── nginx.conf
│ │ └── config/http/tms.conf
│ ├── tls13
│ │ ├── start.sh
│ │ ├── nginx.conf
│ │ └── conf.d/tms.conf
│ └── logs
├── logs
│ ├── tms-framework.out.log
│ └── tms-framework.err.log
├── root-sbin
│ ├── tms-prepare-standard-permissions
│ ├── tms-rabbitmqctl
│ └── tms-run-standard-vendor-step
├── run
│ └── tms-framework.pid
├── scripts
@@ -418,7 +439,9 @@ TMS 统一部署到 `/home/tms`：
目录用途：
- `/home/tms/bin`：初始化后置辅助脚本目录，由 `tms.init.executor.*command` 引用
- `/home/tms/config`：Spring Boot 外部配置目录
- `/home/tms/gateway`：TMS 独立网关配置、启动脚本和日志目录
- `/home/tms/logs`：TMS 运行日志
- `/home/tms/root-sbin`：root 受控脚本的部署包暂存目录，实际执行位置为 `/usr/local/sbin`
- `/home/tms/run`：PID 文件目录
- `/home/tms/scripts`：TMS 启停控制脚本目录
- `/home/tms/tmp`：初始化执行日志和临时目录
@@ -432,10 +455,30 @@ TMS 统一部署到 `/home/tms`：
| `/home/tms/scripts/tms.sh` | `scripts/tms.sh` |
| `/home/tms/bin/apply_standard_db.sh` | `scripts/standard-init/apply_standard_db.sh` |
| `/home/tms/bin/start_standard_apps.sh` | `scripts/standard-init/start_standard_apps.sh` |
| `/home/tms/bin/stop_standard_apps.sh` | `scripts/standard-init/stop_standard_apps.sh` |
| `/home/tms/bin/start_standard_nginx.sh` | `scripts/standard-init/start_standard_nginx.sh` |
| `/home/tms/bin/stop_standard_nginx.sh` | `scripts/standard-init/stop_standard_nginx.sh` |
| `/home/tms/bin/stop_standard_rabbitmq.sh` | `scripts/standard-init/stop_standard_rabbitmq.sh` |
| `/home/tms/bin/check_standard_runtime.sh` | `scripts/standard-init/check_standard_runtime.sh` |
| `/home/tms/bin/resource-restore/apply-resource-backup.sh` | `scripts/resource-restore/apply-resource-backup.sh` |
| `/home/tms/bin/resource-restore/restore-db.sh` | `scripts/resource-restore/restore-db.sh` |
| `/home/tms/bin/resource-restore/replay-mq.sh` | `scripts/resource-restore/replay-mq.sh` |
| `/home/tms/root-sbin/tms-run-standard-vendor-step` | `scripts/standard-init/root-sbin/tms-run-standard-vendor-step` |
| `/home/tms/root-sbin/tms-prepare-standard-permissions` | `scripts/standard-init/root-sbin/tms-prepare-standard-permissions` |
| `/home/tms/root-sbin/tms-rabbitmqctl` | `scripts/standard-init/root-sbin/tms-rabbitmqctl` |
| `/usr/local/sbin/tms-run-standard-vendor-step` | 由 `/home/tms/root-sbin/tms-run-standard-vendor-step` 复制安装 |
| `/usr/local/sbin/tms-prepare-standard-permissions` | 由 `/home/tms/root-sbin/tms-prepare-standard-permissions` 复制安装 |
| `/usr/local/sbin/tms-rabbitmqctl` | 由 `/home/tms/root-sbin/tms-rabbitmqctl` 复制安装 |
| `/home/tms/gateway/tls13/start.sh` | `deployment/tms-gateway/tls13/start.sh` |
| `/home/tms/gateway/tls13/nginx.conf` | `deployment/tms-gateway/tls13/nginx.conf` |
| `/home/tms/gateway/tls13/conf.d/tms.conf` | `deployment/tms-gateway/tls13/conf.d/tms.conf` |
| `/home/tms/gateway/gm/start.sh` | `deployment/tms-gateway/gm/start.sh` |
| `/home/tms/gateway/gm/nginx.conf` | `deployment/tms-gateway/gm/nginx.conf` |
| `/home/tms/gateway/gm/config/http/tms.conf` | `deployment/tms-gateway/gm/config/http/tms.conf` |
| `/home/tms/config/application.yml` | 由 `config/application.yml.example` 复制生成 |
`scripts/cisd_init_precheck.sh` 和 `scripts/pcie_realcard_smoke.sh` 属于诊断脚本，不作为 TMS 常驻运行脚本默认部署。现场需要时可复制到 `/home/tms/tools/` 临时执行。
## 6. 部署步骤
### 6.1 构建 jar 包
@@ -448,7 +491,9 @@ mvn -q -DskipTests package
### 6.2 创建运行目录
```bash
sudo mkdir -p /home/tms/{bin,config,scripts,logs,run,tmp,uploads,libs}
sudo mkdir -p /home/tms/{bin,config,scripts,logs,run,tmp,uploads,libs,root-sbin,tools}
sudo mkdir -p /home/tms/bin/resource-restore
sudo mkdir -p /home/tms/gateway/{tls13,gm,logs/tls13,logs/gm}
sudo chown -R "$(whoami)":"$(whoami)" /home/tms
```
@@ -458,9 +503,16 @@ sudo chown -R "$(whoami)":"$(whoami)" /home/tms
cp target/tms-framework-*.jar /home/tms/tms-framework.jar
cp scripts/tms.sh /home/tms/scripts/tms.sh
cp scripts/standard-init/*.sh /home/tms/bin/
cp scripts/resource-restore/*.sh /home/tms/bin/resource-restore/
cp scripts/standard-init/root-sbin/* /home/tms/root-sbin/
cp -R deployment/tms-gateway/tls13/* /home/tms/gateway/tls13/
cp -R deployment/tms-gateway/gm/* /home/tms/gateway/gm/
cp config/application.yml.example /home/tms/config/application.yml
chmod +x /home/tms/scripts/tms.sh
chmod +x /home/tms/bin/*.sh
chmod +x /home/tms/bin/resource-restore/*.sh
chmod +x /home/tms/gateway/tls13/start.sh
chmod +x /home/tms/gateway/gm/start.sh
```
### 6.4 检查部署结果
@@ -516,7 +568,7 @@ tms:
### 7.3 标准版初始化关键配置
标准版初始化重点配置项：
- `standard-home-dir`：默认 `/home/cemp4i`
- `standard-home-dir`：默认 `/home/cmep4i`
- `standard-cpconfig-path`：标准版 `cpconfig.cfg` 路径
- `standard-db-script-base-dir`：默认 `${standard-home-dir}/cpackage`
- `standard-db-load-dir`：默认 `${standard-home-dir}/mysql/loadfilepath`
@@ -524,6 +576,8 @@ tms:
- `standard-web-front-zip-path`：默认 `${standard-home-dir}/cpackage/front/front.zip`
- `standard-web-target-dir`：默认 `/usr/local/nginx/html`
- `standard-web-organization-json-path`：默认 `/usr/local/nginx/html/organization.json`
- `standard-vendor-step-runner-command`：默认 `/usr/local/sbin/tms-run-standard-vendor-step`，用于 `SET_RABBITMQ`、`SET_TLQ`、`TLQ_CONF_APPLY`、`DEPLOY_RECEIVER`
- `rabbitmq-ctl-command`：默认 `sudo -n /usr/local/sbin/tms-rabbitmqctl`，初始化和资源恢复统一通过 root 受控 wrapper 调用 RabbitMQ CLI
### 7.4 不建议直接写入 application.yml 的凭据
@@ -559,7 +613,7 @@ tms:
- `DB_HOST`，默认 `127.0.0.1`
- `DB_PORT`，默认 `4000`
- `DB_NAME`，默认 `CMEP`
- `LOAD_DIR`，默认 `/home/cemp4i/mysql/loadfilepath`
- `LOAD_DIR`，默认 `/home/cmep4i/mysql/loadfilepath`
示例：
@@ -579,8 +633,8 @@ export DB_PASSWORD='secret'
- 启动 CMTP
依赖：
- `/home/cemp4i/cmsp/start_cmsp.sh`
- `/home/cemp4i/cmtp/start_cmtp.sh`
- `/home/cmep4i/cmsp/start_cmsp.sh`
- `/home/cmep4i/cmtp/start_cmtp.sh`
- 用户 `cmep4i`
### 8.3 `start_standard_nginx.sh`
@@ -608,6 +662,50 @@ export DB_PASSWORD='secret'
该脚本仅用于初始化后的结果校验，不负责修复。
### 8.5 `tms-run-standard-vendor-step`
来源：
- [tms-run-standard-vendor-step](/Users/waner/Work/CISD/文档/tms-framework/scripts/standard-init/root-sbin/tms-run-standard-vendor-step)
部署位置：
- `/usr/local/sbin/tms-run-standard-vendor-step`
作用：
- 作为 root 拥有的受控入口，按固定参数执行标准 vendor 脚本
- 内部切换到 `cmep4i` 用户后执行 `/home/cmep4i/cpackage/toolsh/*.sh`
- 当前只允许 `setfraq`、`setftq`、`settlq`、`setsptp`
部署命令：
```bash
sudo cp scripts/standard-init/root-sbin/tms-run-standard-vendor-step /usr/local/sbin/tms-run-standard-vendor-step
sudo chown root:root /usr/local/sbin/tms-run-standard-vendor-step
sudo chmod 755 /usr/local/sbin/tms-run-standard-vendor-step
```
sudoers 建议：
```sudoers
Defaults:tms !requiretty
tms ALL=(root) NOPASSWD: \
/usr/local/sbin/tms-rabbitmqctl *, \
/usr/local/sbin/tms-run-standard-vendor-step setfraq, \
/usr/local/sbin/tms-run-standard-vendor-step setftq, \
/usr/local/sbin/tms-run-standard-vendor-step settlq, \
/usr/local/sbin/tms-run-standard-vendor-step setsptp
```
验证：
```bash
su - tms
sudo -n /usr/local/sbin/tms-run-standard-vendor-step setsptp
ls -l /home/cmep4i/cmsp /home/cmep4i/cmtp
```
执行后 `/home/cmep4i` 下由 vendor 脚本生成或替换的文件应保持为 `cmep4i` 可访问，不应再由 `tms` 直接写成 `tms:tms`。
## 9. 文件上传与 `fileId` 模型
### 9.1 核心原则
@@ -683,6 +781,207 @@ tail -n 100 /home/tms/logs/tms-framework.out.log
tail -n 100 /home/tms/logs/tms-framework.err.log
```
## 10.6 TMS 独立网关（可选）
当现场需要为 `tms-framework` 单独提供 HTTPS 入口时，建议新增独立 TMS 网关，而不是接管标准收发器现有 `/usr/local/nginx`。
这套独立网关的定位是：
- 只服务 TMS 前端和 TMS API
- 独立于标准收发器现有 Nginx
- 不参与 `START_NGINX`、`STOP_NGINX`、`POST_CHECK`
标准收发器现有 Nginx 仍然保持：
- 配置路径：`/usr/local/nginx/conf/nginx.conf`
- Web 发布目录：`/usr/local/nginx/html`
- 默认标准 Web 验收入口：`8000`
### 10.6.1 推荐端口
推荐保留如下边界：
- 标准收发器现有 Web：`8000`
- TMS TLS 1.3 网关：`443`
- TMS 国密网关：`8443`
- TMS 后端：`127.0.0.1:8088`
因此在启用独立网关前，建议先检查：
```bash
ss -lntp | grep -E ':443|:8443|:8000|:8088'
```
### 10.6.2 推荐目录
建议按如下结构部署：
```text
/home/tms
├── web
│ └── dist
└── gateway
├── tls13
├── gm
└── logs
├── tls13
└── gm
```
说明：
- `/home/tms/web/dist`：TMS 前端构建产物
- `/home/tms/gateway/tls13`：TLS 1.3 网关配置
- `/home/tms/gateway/gm`：国密网关配置
- `/home/tms/gateway/logs/*`：对应网关日志
### 10.6.3 仓库模板位置
仓库已提供两套模板：
- TLS 1.3：
- `deployment/tms-gateway/tls13/nginx.conf`
- `deployment/tms-gateway/tls13/conf.d/tms.conf`
- `deployment/tms-gateway/tls13/start.sh`
- `deployment/tms-gateway/tls13/README.md`
- 国密：
- `deployment/tms-gateway/gm/nginx.conf`
- `deployment/tms-gateway/gm/config/http/tms.conf`
- `deployment/tms-gateway/gm/start.sh`
- `deployment/tms-gateway/gm/README.md`
部署时建议将模板复制到：
- `/home/tms/gateway/tls13`
- `/home/tms/gateway/gm`
### 10.6.4 前端发布目录
TMS 前端建议统一发布到：
```text
/home/tms/web/dist
```
不建议继续沿用其他项目使用过的 `/app/hsm/vue` 命名。
网关容器建议统一将：
```text
/home/tms/web
```
挂载到容器：
```text
/app
```
这样容器内静态资源根目录仍保持：
```text
/app/dist
```
### 10.6.5 后端代理约定
独立网关统一代理到：
```text
http://127.0.0.1:8088
```
需要放行的核心路由：
- `/`
- `/api/v1/`
- `/swagger-ui.html`
- `/swagger-ui/`
- `/v3/api-docs/`
特别注意：
- TMS 接口本身挂在 `/api/v1/**`
- 网关 `proxy_pass` 不应把 `/api/v1/` 前缀错误改写掉
- 若网关误把 `/api/v1/device/status` 转成 `/device/status`，后端会返回 404
因此后续修改网关配置时，应保持“原始请求路径透传到 TMS 后端”这一约束。
### 10.6.6 证书与镜像
TLS 1.3 网关：
- 默认使用 `nginx:latest`
- 证书目录：`/home/tms/gateway/tls13/certs`
- 默认文件名：
- `rsa.dev.pem`
- `rsa.dev.key`
国密网关：
- 默认使用 `gateway.lib:latest`
- 证书目录：`/home/tms/gateway/gm/certs`
- 默认文件名：
- `sm2.sig.pem`
- `sm2.sig.key`
- `sm2.enc.pem`
- `sm2.enc.key`
- `rsa.dev.pem`
- `rsa.dev.key`
补充说明：
- TLS 1.3 网关默认读取自己的 `/home/tms/gateway/tls13/certs`
- 国密网关默认读取自己的 `/home/tms/gateway/gm/certs`
- 如果现场希望 TLS 1.3 直接复用国密目录中的 RSA 证书，可在启动 TLS 1.3 网关时额外指定 `CERT_DIR=/home/tms/gateway/gm/certs`
如果现场为离线部署，可参考：
```bash
docker load -i /Users/waner/Work/CISD/文档/manager/tls13/tls13.tar
docker load -i /Users/waner/Work/CISD/文档/manager/gateway.tar
```
### 10.6.7 启动与验收
TLS 1.3 网关：
```bash
cd /home/tms/gateway/tls13
bash start.sh
```
国密网关：
```bash
cd /home/tms/gateway/gm
bash start.sh
```
TLS 1.3 验收可先检查：
```bash
curl -k https://127.0.0.1/
curl -k https://127.0.0.1/swagger-ui.html
curl -k https://127.0.0.1/api/v1/device/status
```
国密入口建议使用现场指定的国密兼容浏览器或客户端进行验证。
### 10.6.8 与标准收发器 Nginx 的边界
本独立网关方案不改变以下既有边界：
- 不写入 `/usr/local/nginx/conf/nginx.conf`
- 不使用 `/usr/local/nginx/html`
- 不替代标准收发器 Web 发布流程
- 不改变标准收发器初始化和 reset 当前逻辑
换句话说：
- 标准收发器 Nginx 继续服务标准产品自身的 Web
- TMS 独立网关只负责 TMS 自己的前端和 API
## 11. 初始化前置检查
预检查脚本：
@@ -859,8 +1158,8 @@ pgrep -f '/usr/local/nginx/sbin/nginx'
```bash
/home/tms/scripts/tms.sh status
ss -lntp | grep 8080
curl -s http://127.0.0.1:8080/api/v1/device/status
ss -lntp | grep 8088
curl -s http://127.0.0.1:8088/api/v1/device/status
find /home/tms/uploads -maxdepth 2 -type f | sort
ls -l /home/tms/bin
ls -l /home/tms/config/application.yml
@@ -871,7 +1170,10 @@ ls -l /home/tms/config/application.yml
```bash
bash -n /home/tms/bin/apply_standard_db.sh
bash -n /home/tms/bin/start_standard_apps.sh
bash -n /home/tms/bin/stop_standard_apps.sh
bash -n /home/tms/bin/start_standard_nginx.sh
bash -n /home/tms/bin/stop_standard_nginx.sh
bash -n /home/tms/bin/stop_standard_rabbitmq.sh
bash -n /home/tms/bin/check_standard_runtime.sh
```