yum install mysql-server -y

vim /etc/my.cnf

[mysqld]
bind-address=192.168.1.1
log-bin=mysql-bin
server-id=1
default-storage-engine=INNODB
character-set-server=utf8mb4
collation-server=utf8mb4_unicode_ci

systemctl restart mysqld

[root@localhost ~] mysql

mysql> show databases;
mysql> use mysql;
mysql> select user,host from user; -- 此处出现host为localhost时，说明mysql只允许本机连接，外网和本地软件客户端则无法连接。

+---------------+-----------+
| user          | host      |
+---------------+-----------+
| root          | localhost |
| mysql.session | localhost |
| mysql.sys     | localhost |
+---------------+-----------+
3 rows in set (0.00 sec)
mysql> update user set host = '%' where user='root'; -- 设置允许root用户任意IP访问。
mysql> GRANT system_user on *.*  to 'root';
mysql> DELETE FROM mysql.user WHERE user='canal';
mysql> CREATE USER canal IDENTIFIED BY 'canal';
mysql> GRANT ALL PRIVILEGES ON *.* TO 'canal'@'%';
mysql> flush privileges; -- 刷新权限
mysql> exit

yum install redis -y

vim /etc/redis.conf

# It is possible to listen to just one or multiple selected interfaces using
# the "bind" configuration directive, followed by one or more IP addresses.
#
# Examples:
#
# bind 192.168.1.100 10.0.0.1
# bind 127.0.0.1 ::1
#
# ~~~ WARNING ~~~ If the computer running Redis is directly exposed to the
# internet, binding to all the interfaces is dangerous and will expose the
# instance to everybody on the internet. So by default we uncomment the
# following bind directive, that will force Redis to listen only into
# the IPv4 lookback interface address (this means Redis will be able to
# accept connections only from clients running into the same computer it
# is running).
#
# IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES
# JUST COMMENT THE FOLLOWING LINE.
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
bind 127.0.0.1 192.168.1.1 # 此处添加机器A的真实IP

systemctl start redis

# The number of milliseconds of each tick
tickTime=2000
# The number of ticks that the initial 
# synchronization phase can take
initLimit=10
# The number of ticks that can pass between 
# sending a request and getting an acknowledgement
syncLimit=5
# the directory where the snapshot is stored.
dataDir=/var/lib/zookeeper/data
# the port at which the clients will connect
clientPort=2181
# Enable/disable the ability to accept session-less connections (true/false)
quorumListenOnAllIPs=true

systemctl start zookeeper

uwsgi:
  port: 11115
  daemonize: /var/log/aops/uwsgi/host-information.log
  http_timeout: 60
  processes: 1
  gevent: 100

infrastructure:
  mysql:
    host: 192.168.1.1
    port: 3306
    username: root
    pool_size: 100
    pool_recycle: 7200
    database: aops
    username: root
  redis:
    host: 192.168.1.1
    port: 6379
  zookeeper:
    host: 192.168.1.1
    port: 2181
include: "/etc/aops/conf.d"
domain: "http://192.168.1.3"
services:
  log:
    log_level: "INFO"
    log_dir: "/var/log/aops"
    max_bytes: 31457280
    backup_count: 40

systemctl start zeus-host-information

aops-cli database --init zeus-host-information

yum install aops-hermes -y

vim /etc/nginx/nginx.conf

user root;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}
http {

  log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
    client_max_body_size 25M;
    include /etc/nginx/conf.d/*.conf;

  upstream host {
    server 192.168.1.2:11115;
  }

  #upstream accounts {
  #  server @accounts;
  #}

  #upstream distribute {
  #  server @distribute;
  #}

  #upstream apollo {
  #  server @apollo;
  #}
  underscores_in_headers on;
  server {
    listen       80;
    listen       [::]:80 default_server;
    server_name  localhost;

    # gzip config
    gzip on;
    gzip_min_length 1k;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/javascript application/json application/javascript application/x-javascript application/xml;
    gzip_vary on;
    gzip_disable "MSIE [1-6]\.";

    location ~ .*\.(js|css|ico|png|jpg|eot|svg|ttf|woff|html|txt|pdf|) {
        root /opt/aops/web/dist;
        expires 30d;
    }
    location / {
      try_files $uri $uri/ /index.html;
      if (!-e $request_filename){
          rewrite ^(.*)$ /index.html last;
      }
    }
    location /hosts {
      proxy_pass http://host;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Request-Header $http_request_header;
    }
    #location /accounts {
    #  proxy_pass http://accounts;
    #  proxy_set_header Host $host;
    #  proxy_set_header X-Real-IP $remote_addr;
    #  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #  proxy_set_header Request-Header $http_request_header;
    #}
    #location /distribute {
    #  rewrite ^/distribute(.*)$ /distribute break;
    #  proxy_pass http://distribute;
    #  proxy_set_header X-Real-URL $request_uri;
    #  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #  proxy_set_header Request-Header $http_request_header;
    #}
    #location /vulnerabilities {
    #  proxy_pass http://apollo;
    #  proxy_set_header X-Real-URL $request_uri;
    #  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #  proxy_set_header Request-Header $http_request_header;
    #}
  }
}
stream {
   upstream mysql_prod {
        server 192.168.1.1:3306;
    }
    server {
        listen 3306;
        proxy_responses 1;
        proxy_timeout 20s;
        proxy_pass mysql_prod;
   }
}

systemctl start aops-hermes
systemctl restart nginx

uwsgi:
  port: 11119
  daemonize: /var/log/aops/uwsgi/user-access.log
  http_timeout: 60
  processes: 1
  threads: 2

infrastructure:
  mysql:
    host: 192.168.1.1
    port: 3306
    username: root
    pool_size: 100
    pool_recycle: 7200
    database: aops
    username: root
  redis:
    host: 192.168.1.1
    port: 6379
  zookeeper:
    host: 192.168.1.1
    port: 2181
  individuation:
    gitee_client_id: 7420ebbb10f7f196de479bd3fe30f120691321143fdae882bc8b3320b3dbb71c
    gitee_client_secret: c6466348389db3a2da3a86ec3b544c19c15f50de513da4dc3edbadaa2e5df792
    redirect_url: http://127.0.0.1:8000/user/account
    exempt_authentication: ?Ohdc,&S*2O].f%-Y1Z~f%~9^U5uD]AQ
    private_key: sfwsfs{)sdf_+$%{$^%$NI07&*()@$&^*(*(^&%(

include: "/etc/aops/conf.d"
domain: 192.168.1.3
services:
  log:
    log_level: "INFO"
    log_dir: "/var/log/aops"
    max_bytes: 31457280
    backup_count: 40
  email:
    server: smtp.163.com
    port: 25
    sender: xxx@163.com
    authorization_code: xxx
    smtp_ssl: false
    enabled: false

systemctl start zeus-user-access

aops-cli database --init zeus-user-access

vim /etc/nginx/nginx.conf

user root;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}
http {

  log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
    client_max_body_size 25M;
    include /etc/nginx/conf.d/*.conf;

  #upstream host {
  #  server @hosts;
  #}

  upstream accounts {
    server 192.168.1.2:11119;
  }

  #upstream distribute {
  #  server @distribute;
  #}

  #upstream apollo {
  #  server @apollo;
  #}
  underscores_in_headers on;
  server {
    listen       80;
    listen       [::]:80 default_server;
    server_name  localhost;

    # gzip config
    gzip on;
    gzip_min_length 1k;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/javascript application/json application/javascript application/x-javascript application/xml;
    gzip_vary on;
    gzip_disable "MSIE [1-6]\.";

    location ~ .*\.(js|css|ico|png|jpg|eot|svg|ttf|woff|html|txt|pdf|) {
        root /opt/aops/web/dist;
        expires 30d;
    }
    location / {
      try_files $uri $uri/ /index.html;
      if (!-e $request_filename){
          rewrite ^(.*)$ /index.html last;
      }
    }
    #location /hosts {
    #  proxy_pass http://host;
    #  proxy_set_header Host $host;
    #  proxy_set_header X-Real-IP $remote_addr;
    #  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #  proxy_set_header Request-Header $http_request_header;
    #}
    location /accounts {
      proxy_pass http://accounts;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Request-Header $http_request_header;
    }
    #location /distribute {
    #  rewrite ^/distribute(.*)$ /distribute break;
    #  proxy_pass http://distribute;
    #  proxy_set_header X-Real-URL $request_uri;
    #  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #  proxy_set_header Request-Header $http_request_header;
    #}
    #location /vulnerabilities {
    #  proxy_pass http://apollo;
    #  proxy_set_header X-Real-URL $request_uri;
    #  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #  proxy_set_header Request-Header $http_request_header;
    #}
  }
}
stream {
   upstream mysql_prod {
        server 192.168.1.1:3306;
    }
    server {
        listen 3306;
        proxy_responses 1;
        proxy_timeout 20s;
        proxy_pass mysql_prod;
   }
}

systemctl restart nginx

yum install async-task -y

vim /etc/aops/crontab.yml

# Timed task configuration file specification (YAML):

# Name of a scheduled task, name should be unique, only 'upstream', 'download-sa' and 'cve-scan' and 'correct-data' e.g
#   task: upstream

# Whether scheduled tasks are allowed to run
#   enable: true

# meta info for the task, it's customised for user
#   meta:
#     cvrf_url: https://repo.openeuler.org/security/data/cvrf

# Timed config, set the scheduled time and polling policy
#   timed:
# value between 0-6, for example, 0 means Monday, 0-6 means everyday
#     day_of_week: 0-6
# value between 0-23, for example, 2 means 2:00 in a day
#     hour: 3
# Polling strategy, The value can only be 'cron' 'date' 'interval', default value is 'cron'
#     trigger: cron

- task: upstream
  enable: true
  timed:
    day_of_week: 0-6
    hour: 3
    trigger: cron
- task: download-sa
  enable: true
  meta:
    cvrf_url: https://repo.openeuler.org/security/data/cvrf
  timed:
    day_of_week: 0-6
    hour: 3
    trigger: cron
- task: cve-scan
  enable: true
  timed:
    day_of_week: 0-6
    hour: 3
    trigger: cron
- task: correct-data
  enable: true
  timed:
    minutes: 20
    trigger: interval
- task: send-notification
  enable: true
  timed:
    day_of_week: 0-6
    hour: 4
    trigger: cron

systemctl start async-task

uwsgi:
  port: 11113
  daemonize: /var/log/aops/uwsgi/distribute.log
  http_timeout: 60
  processes: 1
  gevent: 100

infrastructure:
  redis:
    host: 192.168.1.1
    port: 6379
  zookeeper:
    host: 192.168.1.1
    port: 2181
  
include: "/etc/aops/conf.d"
domain: "http://192.168.1.3"
services:
  log:
    log_level: "INFO"
    log_dir: "/var/log/aops"
    max_bytes: 31457280
    backup_count: 40

systemctl start zeus-distribute

vim /etc/nginx/nginx.conf

user root;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}
http {

  log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
    client_max_body_size 25M;
    include /etc/nginx/conf.d/*.conf;

  #upstream host {
  #  server @hosts;
  #}

  #upstream accounts {
  #  server 192.168.1.2:11119;
  #}

  upstream distribute {
    server 192.168.1.2:11113;
  }

  #upstream apollo {
  #  server @apollo;
  #}
  underscores_in_headers on;
  server {
    listen       80;
    listen       [::]:80 default_server;
    server_name  localhost;

    # gzip config
    gzip on;
    gzip_min_length 1k;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/javascript application/json application/javascript application/x-javascript application/xml;
    gzip_vary on;
    gzip_disable "MSIE [1-6]\.";

    location ~ .*\.(js|css|ico|png|jpg|eot|svg|ttf|woff|html|txt|pdf|) {
        root /opt/aops/web/dist;
        expires 30d;
    }
    location / {
      try_files $uri $uri/ /index.html;
      if (!-e $request_filename){
          rewrite ^(.*)$ /index.html last;
      }
    }
    #location /hosts {
    #  proxy_pass http://host;
    #  proxy_set_header Host $host;
    #  proxy_set_header X-Real-IP $remote_addr;
    #  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #  proxy_set_header Request-Header $http_request_header;
    #}
    #location /accounts {
    #  proxy_pass http://accounts;
    #  proxy_set_header Host $host;
    #  proxy_set_header X-Real-IP $remote_addr;
    #  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #  proxy_set_header Request-Header $http_request_header;
    #}
    location /distribute {
      rewrite ^/distribute(.*)$ /distribute break;
      proxy_pass http://distribute;
      proxy_set_header X-Real-URL $request_uri;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Request-Header $http_request_header;
    }
    #location /vulnerabilities {
    #  proxy_pass http://apollo;
    #  proxy_set_header X-Real-URL $request_uri;
    #  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #  proxy_set_header Request-Header $http_request_header;
    #}
  }
}
stream {
   upstream mysql_prod {
        server 192.168.1.1:3306;
    }
    server {
        listen 3306;
        proxy_responses 1;
        proxy_timeout 20s;
        proxy_pass mysql_prod;
   }
}

systemctl restart nginx

echo "[aops_elasticsearch]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md" > "/etc/yum.repos.d/aops_elascticsearch.repo"

yum install elasticsearch-7.14.0-1 -y

vim /etc/elasticsearch/elasticsearch.yml
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: node-1
# ---------------------------------- Network -----------------------------------
#
# By default Elasticsearch is only accessible on localhost. Set a different
# address here to expose this node on the network:
#
# 此处修改为机器A真实ip
network.host: 192.168.1.1
#
# By default Elasticsearch listens for HTTP traffic on the first free port it
# finds starting at 9200. Set a specific HTTP port here:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["node-1"]
# 跨域配置
http.cors.enabled: true
http.cors.allow-origin: "*"

systemctl restart elasticsearch

yum install aops-apollo -y

cve:
  cve_fix_function: yum
  # value between 0-23, for example, 2 means 2:00 in a day.
  cve_scan_time: 2

uwsgi:
  daemonize: /var/log/aops/uwsgi/apollo.log
  http_timeout: 600
  harakiri: 600
  processes: 1
  gevent: 100
  port: 11116

file:
  classname: ""
  path: /opt/aops/scripts/file_manage_support/download.py
  extra: ""

infrastructure:
  mysql:
    host: 192.168.1.1
    port: 3306
    username: root
    pool_size: 100
    pool_recycle: 7200
    database: aops
    username: root
  redis:
    host: 192.168.1.1
    port: 6379
  zookeeper:
    host: 192.168.1.1
    port: 2181
  elasticsearch:
    host: 192.168.1.1
    port: 9200
    max_es_query_num: 10000000
include: "/etc/aops/conf.d"
domain: "http://192.168.1.3"
services:
  log:
    log_level: "INFO"
    log_dir: "/var/log/aops"
    max_bytes: 31457280
    backup_count: 40

systemctl start aops-apollo

aops-cli database --init aops-apollo

yum install aops-ceres dnf-hotpatch-plugin -y

yum install aops-zeus -y

aops-cli deploy --ip 192.168.1.1

echo "[update]
name=update
baseurl=http://repo.openeuler.org/openEuler-20.03-LTS-SP4/update/$basearch/
enabled=1
gpgcheck=0
[update-epol]
name=update-epol
baseurl=http://repo.openeuler.org/openEuler-20.03-LTS-SP4/EPOL/update/main/$basearch/
enabled=1
gpgcheck=0" > /etc/yum.repos.d/openEuler-update.repo

vim /etc/elasticsearch/jvm.options

################################################################
## IMPORTANT: JVM heap size
################################################################
##
## The heap size is automatically configured by Elasticsearch
## based on the available memory in your system and the roles
## each node is configured to fulfill. If specifying heap is
## required, it should be done through a file in jvm.options.d,
## and the min and max should be set to the same value. For
## example, to set the heap to 4 GB, create a new file in the
## jvm.options.d directory containing these lines:
##
-Xms4g

systemctl restart elasticsearch

# 修改/etc/selinux/config文件中SELINUX状态为disabled

vi /etc/selinux/config
SELINUX=disabled

systemctl stop firewalld
systemctl disable firewalld
systemctl status firewalld
setenforce 0