修改文档&增加 LICENSE
This commit is contained in:
dushixiang committed
1 parent
5a6169fac6
commit
91c0ea0a79
14 files changed
+663
-294
No files matched your search
@@ -0,0 +1,73 @@
|
|||||||
|
Apache License
|
||||||
|
Version 2.0, January 2004
|
||||||
|
http://www.apache.org/licenses/
|
||||||
|
|
||||||
|
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||||
|
|
||||||
|
1. Definitions.
|
||||||
|
|
||||||
|
"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
|
||||||
|
|
||||||
|
"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
|
||||||
|
|
||||||
|
"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
|
||||||
|
|
||||||
|
"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
|
||||||
|
|
||||||
|
"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
|
||||||
|
|
||||||
|
"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
|
||||||
|
|
||||||
|
"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
|
||||||
|
|
||||||
|
"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
|
||||||
|
|
||||||
|
"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
|
||||||
|
|
||||||
|
"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
|
||||||
|
|
||||||
|
2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
|
||||||
|
|
||||||
|
3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
|
||||||
|
|
||||||
|
4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
|
||||||
|
|
||||||
|
(a) You must give any other recipients of the Work or Derivative Works a copy of this License; and
|
||||||
|
|
||||||
|
(b) You must cause any modified files to carry prominent notices stating that You changed the files; and
|
||||||
|
|
||||||
|
(c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
|
||||||
|
|
||||||
|
(d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
|
||||||
|
|
||||||
|
You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
|
||||||
|
|
||||||
|
5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
|
||||||
|
|
||||||
|
6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
|
||||||
|
|
||||||
|
7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
|
||||||
|
|
||||||
|
8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
|
||||||
|
|
||||||
|
9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
APPENDIX: How to apply the Apache License to your work.
|
||||||
|
|
||||||
|
To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives.
|
||||||
|
|
||||||
|
Copyright 2025 dushixiang
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
@@ -2,324 +2,100 @@
|
|||||||
|
|
||||||
<div align="center">
|
<div align="center">
|
||||||
|
|
||||||
一个基于 Go + PostgreSQL + VictoriaMetrics 的实时探针监控系统
|
一个基于 Go + PostgreSQL/SQLite + VictoriaMetrics 的实时探针监控系统
|
||||||
|
|
||||||
[快速开始](#快速开始) • [截图](#截图) • [功能特性](#功能特性) • [加入群聊](#加入群聊)
|
[快速开始](#快速开始) • [截图](#截图) • [功能特性](#功能特性) • [文档](#文档) • [加入群聊](#加入群聊)
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## 简介
|
## 简介
|
||||||
|
|
||||||
Pika 是一个轻量级的探针监控系统，支持实时数据采集、存储和查询。系统采用 WebSocket 进行探针与服务端的通信，使用 VictoriaMetrics 存储时序指标数据，使用 PostgreSQL 存储配置和审计数据。除了基础监控功能外，还提供 Linux 应急响应和安全基线检查能力，帮助快速发现和分析系统安全风险。
|
Pika 是一个轻量级的探针监控系统，支持实时数据采集、存储和查询。系统采用 WebSocket 进行探针与服务端的通信，使用 VictoriaMetrics 存储时序指标数据，支持 PostgreSQL 和 SQLite 两种数据库方案。除了基础监控功能外，还提供 Linux 应急响应和安全基线检查能力，帮助快速发现和分析系统安全风险。
|
||||||
|
|
||||||
|
|
||||||
很多人可能会误会使用 PostgreSQL 和 VictoriaMetrics 太重，系统占用太高，实际上这两个组件的占用资源都比较低，以下截图为使用 `docker compose stats` 命令查看容器的资源占用情况。
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## 功能特性
|
## 功能特性
|
||||||
|
|
||||||
### 📊 实时性能监控
|
- **📊 实时性能监控**：CPU、内存、磁盘、网络、GPU、温度等系统资源监控
|
||||||
|
- **🔍 服务监控**：HTTP/HTTPS、TCP 端口、ICMP/Ping 监控，支持证书到期检测
|
||||||
- 系统资源监控：CPU、内存、磁盘、网络、GPU、温度等指标
|
- **🛡️ 防篡改保护**：文件实时监控、属性巡检、事件告警
|
||||||
- 时序数据查询：支持多种时间范围（5分钟、15分钟、30分钟、1小时），实时刷新和历史趋势分析
|
- **🔒 安全审计**：资产清单收集、安全风险分析、历史审计记录
|
||||||
|
- **🔐 多种认证**：Basic Auth、OIDC、GitHub OAuth
|
||||||
### 🔍 服务监控
|
- **📦 轻量部署**：Docker Compose 一键部署，资源占用低
|
||||||
|
|
||||||
- HTTP/HTTPS 监控：支持状态码检查、响应时间测量、内容匹配、HTTPS 证书到期检测
|
|
||||||
- TCP 端口监控：检测端口连通性和响应时间
|
|
||||||
- ICMP/Ping 监控：测量网络延迟和丢包率
|
|
||||||
|
|
||||||
### 🛡️ 防篡改保护
|
|
||||||
|
|
||||||
- 文件保护：保护关键目录，防止未授权修改
|
|
||||||
- 实时监控：基于 fsnotify 实时监控受保护目录的文件变动
|
|
||||||
- 属性巡检：定期检查不可变属性，自动恢复被篡改的保护
|
|
||||||
- 事件告警：实时上报文件变动事件和属性篡改告警
|
|
||||||
|
|
||||||
### 🔒 安全审计与应急响应
|
|
||||||
|
|
||||||
- **资产清单收集**：支持收集网络资产（端口、连接、防火墙）、进程资产、用户资产（SSH配置、密钥）、登录日志、文件资产（Cron、服务、启动脚本）、内核资产等
|
|
||||||
- **安全风险分析**：自动检测登录异常、可疑进程、用户权限风险、SSH配置安全问题等，并按严重程度分级（Critical/High/Medium/Low）
|
|
||||||
- **历史审计记录**：保存审计历史，支持查询和对比
|
|
||||||
|
|
||||||
### 🔐 认证与授权
|
|
||||||
|
|
||||||
- 支持多种认证方式：Basic Auth（bcrypt）、OIDC、GitHub OAuth
|
|
||||||
- 灵活的权限管理：管理员权限、公开页面、JWT Token 认证
|
|
||||||
|
|
||||||
### 📦 部署与运维
|
|
||||||
|
|
||||||
- Docker Compose 一键部署，数据持久化到 PostgreSQL
|
|
||||||
- 灵活的 YAML 配置文件，支持网卡过滤和数据保留策略
|
|
||||||
|
|
||||||
|
详细功能说明请参考 [功能特性文档](docs/features.md)。
|
||||||
|
|
||||||
## 截图
|
## 截图
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## 快速开始
|
||||||
|
|
||||||
|
### SQLite 版本
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 下载配置文件
|
||||||
|
curl -O https://raw.githubusercontent.com/dushixiang/pika/main/docker-compose.sqlite.yml
|
||||||
|
curl -o config.yaml https://raw.githubusercontent.com/dushixiang/pika/main/config.sqlite.yaml
|
||||||
|
|
||||||
|
# 修改配置（重要：修改 JWT Secret 和管理员密码）
|
||||||
|
# 编辑 config.yaml
|
||||||
|
|
||||||
|
# 启动服务
|
||||||
|
docker-compose -f docker-compose.sqlite.yml up -d
|
||||||
|
|
||||||
|
# 访问 http://localhost:8080
|
||||||
|
# 默认账户 admin / admin123
|
||||||
|
```
|
||||||
|
|
||||||
|
详细文档：[SQLite 版本部署指南](docs/deployment-sqlite.md)
|
||||||
|
|
||||||
|
### PostgreSQL 版本
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 下载配置文件
|
||||||
|
curl -O https://raw.githubusercontent.com/dushixiang/pika/main/docker-compose.postgresql.yml
|
||||||
|
curl -o config.yaml https://raw.githubusercontent.com/dushixiang/pika/main/config.postgresql.yaml
|
||||||
|
|
||||||
|
# 修改配置（重要：修改数据库密码、JWT Secret 和管理员密码）
|
||||||
|
# 编辑 config.yaml
|
||||||
|
|
||||||
|
# 启动服务
|
||||||
|
docker-compose -f docker-compose.postgresql.yml up -d
|
||||||
|
|
||||||
|
# 访问 http://localhost:8080
|
||||||
|
# 默认账户 admin / admin123
|
||||||
|
```
|
||||||
|
|
||||||
|
详细文档：[PostgreSQL 版本部署指南](docs/deployment-postgresql.md)
|
||||||
|
|
||||||
|
## 文档
|
||||||
|
|
||||||
|
- [功能特性](docs/features.md)
|
||||||
|
- [SQLite 版本部署指南](docs/deployment-sqlite.md)
|
||||||
|
- [PostgreSQL 版本部署指南](docs/deployment-postgresql.md)
|
||||||
|
- [通用配置说明](docs/common-config.md)
|
||||||
|
|
||||||
|
## 环境要求
|
||||||
|
|
||||||
|
- Docker 20.10+
|
||||||
|
- Docker Compose 1.29+
|
||||||
|
|
||||||
## 加入群聊
|
## 加入群聊
|
||||||
|
|
||||||
请备注 pika
|
请备注 pika
|
||||||
|
|
||||||
<img src="screenshots/wx1.png" width="300" height="auto"/>
|
<img src="screenshots/wx1.png" width="300" height="auto"/>
|
||||||
|
|
||||||
## 快速开始
|
## 许可证
|
||||||
|
|
||||||
### 环境要求
|
本项目采用 MIT 许可证。
|
||||||
|
|
||||||
- Docker 20.10+
|
## 贡献
|
||||||
- Docker Compose 1.29+
|
|
||||||
|
|
||||||
### 一键部署
|
欢迎提交 Issue 和 Pull Request！
|
||||||
|
|
||||||
#### 1. 下载配置文件
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 下载 docker-compose.yml 配置文件
|
|
||||||
curl -O https://raw.githubusercontent.com/dushixiang/pika/main/docker-compose.yml
|
|
||||||
# 下载配置文件示例
|
|
||||||
curl -o config.yaml https://raw.githubusercontent.com/dushixiang/pika/main/config.example.yaml
|
|
||||||
|
|
||||||
# 或使用 wget
|
|
||||||
wget https://raw.githubusercontent.com/dushixiang/pika/main/docker-compose.yml
|
|
||||||
wget -O config.yaml https://raw.githubusercontent.com/dushixiang/pika/main/config.example.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
#### 2. 修改配置（重要）
|
|
||||||
|
|
||||||
编辑 `config.yaml` 文件，根据需要修改以下配置：
|
|
||||||
|
|
||||||
- **数据库配置**：确保数据库连接信息与 `docker-compose.yml` 中的 PostgreSQL 服务配置一致
|
|
||||||
```yaml
|
|
||||||
Database:
|
|
||||||
Postgres:
|
|
||||||
Hostname: pika-postgresql # Docker Compose 服务名
|
|
||||||
Port: 5432
|
|
||||||
Username: pika
|
|
||||||
Password: pika # 生产环境建议修改
|
|
||||||
Database: pika
|
|
||||||
```
|
|
||||||
|
|
||||||
- **VictoriaMetrics 配置**：确保时序数据库连接信息正确
|
|
||||||
```yaml
|
|
||||||
VictoriaMetrics:
|
|
||||||
Enabled: true
|
|
||||||
URL: "http://victoriametrics:8428"
|
|
||||||
RetentionDays: 7 # 数据保留时长
|
|
||||||
WriteTimeout: 60 # 写超时时间（秒）
|
|
||||||
QueryTimeout: 60 # 读超时时间（秒）
|
|
||||||
```
|
|
||||||
|
|
||||||
- **JWT 密钥**：必须修改为强随机字符串
|
|
||||||
```yaml
|
|
||||||
App:
|
|
||||||
JWT:
|
|
||||||
Secret: "your-secret-key-here" # 必须修改
|
|
||||||
```
|
|
||||||
|
|
||||||
生成随机密钥：
|
|
||||||
```bash
|
|
||||||
openssl rand -base64 32
|
|
||||||
```
|
|
||||||
|
|
||||||
- **用户认证**：配置管理员账户或启用 OIDC/GitHub 登录
|
|
||||||
```yaml
|
|
||||||
App:
|
|
||||||
# Basic Auth 用户（默认用户名: admin，密码: admin123）
|
|
||||||
Users:
|
|
||||||
admin: "$2y$12$7DXcOiX1D59xNTIn5riUKusAPLP88LxxoczWmUT83MBj5EFznbp8a"
|
|
||||||
|
|
||||||
# 可选：启用 OIDC 认证
|
|
||||||
OIDC:
|
|
||||||
Enabled: false
|
|
||||||
Issuer: "https://your-oidc-provider.com"
|
|
||||||
ClientID: "your-client-id"
|
|
||||||
ClientSecret: "your-client-secret"
|
|
||||||
|
|
||||||
# 可选：启用 GitHub OAuth
|
|
||||||
GitHub:
|
|
||||||
Enabled: false
|
|
||||||
ClientID: "your-github-client-id"
|
|
||||||
ClientSecret: "your-github-client-secret"
|
|
||||||
```
|
|
||||||
|
|
||||||
- **生成新的管理员密码**：
|
|
||||||
```bash
|
|
||||||
# 使用 htpasswd 工具
|
|
||||||
htpasswd -nBC 12 '' | tr -d ':\n'
|
|
||||||
```
|
|
||||||
|
|
||||||
**注意**：如果修改了 `docker-compose.yml` 中的数据库密码（`POSTGRES_PASSWORD`），也需要同步修改 `config.yaml` 中的数据库密码
|
|
||||||
|
|
||||||
#### 3. 启动服务
|
|
||||||
|
|
||||||
Docker Compose 会启动三个服务：
|
|
||||||
- **postgresql**: PostgreSQL 数据库，用于存储配置和审计数据
|
|
||||||
- **victoriametrics**: VictoriaMetrics 时序数据库，用于存储监控指标数据（保留 7 天）
|
|
||||||
- **pika**: Pika 主服务
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 启动所有服务
|
|
||||||
docker-compose up -d
|
|
||||||
|
|
||||||
# 查看服务状态
|
|
||||||
docker-compose ps
|
|
||||||
|
|
||||||
# 查看日志
|
|
||||||
docker-compose logs -f pika
|
|
||||||
```
|
|
||||||
|
|
||||||
#### 4. 访问服务
|
|
||||||
|
|
||||||
服务启动后，访问 http://localhost:8080
|
|
||||||
|
|
||||||
#### 5. 停止服务
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 停止服务
|
|
||||||
docker-compose stop
|
|
||||||
|
|
||||||
# 停止并删除容器
|
|
||||||
docker-compose down
|
|
||||||
|
|
||||||
# 停止并删除容器及数据卷
|
|
||||||
docker-compose down -v
|
|
||||||
```
|
|
||||||
|
|
||||||
### 生产环境部署建议
|
|
||||||
|
|
||||||
#### 1. 安全配置
|
|
||||||
|
|
||||||
- 修改 `docker-compose.yml` 中的默认数据库密码（`POSTGRES_PASSWORD`）
|
|
||||||
- 修改 `config.yaml` 中的数据库密码（`Database.Postgres.Password`），与 docker-compose 中的设置保持一致
|
|
||||||
- 在 `config.yaml` 中设置强随机的 JWT 密钥（`App.JWT.Secret`）
|
|
||||||
- 修改默认管理员密码或启用 OIDC/GitHub 认证
|
|
||||||
- 使用 HTTPS 反向代理（如 Nginx）
|
|
||||||
- 限制数据库端口仅允许内部访问（docker-compose.yml 中已配置为 `127.0.0.1:5432:5432`）
|
|
||||||
- 限制 VictoriaMetrics 端口仅允许内部访问（docker-compose.yml 中已配置为 `127.0.0.1:8428:8428`）
|
|
||||||
- 妥善保管 `config.yaml` 文件，避免泄露敏感信息
|
|
||||||
|
|
||||||
#### 2. 数据持久化
|
|
||||||
|
|
||||||
系统数据分别存储在以下目录：
|
|
||||||
- **PostgreSQL 数据**：`./data/postgresql` - 存储配置和审计数据
|
|
||||||
- **VictoriaMetrics 数据**：`./data/vmdata` - 存储时序指标数据（默认保留 7 天）
|
|
||||||
|
|
||||||
建议定期备份 PostgreSQL 数据库：
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 备份数据库
|
|
||||||
docker-compose exec postgresql pg_dump -U pika pika > backup.sql
|
|
||||||
|
|
||||||
# 恢复数据库
|
|
||||||
docker-compose exec -T postgresql psql -U pika pika < backup.sql
|
|
||||||
```
|
|
||||||
|
|
||||||
VictoriaMetrics 数据可以通过直接备份 `./data/vmdata` 目录来保存：
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 备份 VictoriaMetrics 数据
|
|
||||||
tar -czf vmdata-backup-$(date +%Y%m%d).tar.gz ./data/vmdata
|
|
||||||
|
|
||||||
# 恢复时停止服务，解压到 ./data/vmdata 目录即可
|
|
||||||
```
|
|
||||||
|
|
||||||
#### 3. 反向代理配置（Nginx 示例）
|
|
||||||
|
|
||||||
```nginx
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
server_name your-domain.com;
|
|
||||||
|
|
||||||
location / {
|
|
||||||
proxy_pass http://localhost:8080;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
|
|
||||||
# WebSocket 支持
|
|
||||||
proxy_http_version 1.1;
|
|
||||||
proxy_set_header Upgrade $http_upgrade;
|
|
||||||
proxy_set_header Connection "upgrade";
|
|
||||||
}
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
### 故障排查
|
|
||||||
|
|
||||||
#### 服务无法启动
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 查看详细日志
|
|
||||||
docker-compose logs -f
|
|
||||||
|
|
||||||
# 检查容器状态
|
|
||||||
docker-compose ps
|
|
||||||
|
|
||||||
# 重启服务
|
|
||||||
docker-compose restart
|
|
||||||
```
|
|
||||||
|
|
||||||
#### 数据库连接失败
|
|
||||||
|
|
||||||
- 确认 PostgreSQL 容器已启动且健康检查通过
|
|
||||||
- 检查 `config.yaml` 中的数据库配置是否正确：
|
|
||||||
- `Hostname` 应该为 `pika-postgresql`（Docker Compose 服务名）
|
|
||||||
- `Password` 应该与 `docker-compose.yml` 中的 `POSTGRES_PASSWORD` 一致
|
|
||||||
- 确认 `config.yaml` 文件已正确映射到容器中
|
|
||||||
- 查看数据库日志：`docker-compose logs postgresql`
|
|
||||||
- 查看应用日志：`docker-compose logs pika`
|
|
||||||
|
|
||||||
#### VictoriaMetrics 连接失败
|
|
||||||
|
|
||||||
- 确认 VictoriaMetrics 容器已启动
|
|
||||||
- 检查 `config.yaml` 中的 VictoriaMetrics 配置是否正确：
|
|
||||||
- `Address` 应该为 `http://victoriametrics:8428`（Docker Compose 服务名）
|
|
||||||
- 查看 VictoriaMetrics 日志：`docker-compose logs victoriametrics`
|
|
||||||
- 测试 VictoriaMetrics 是否正常工作：
|
|
||||||
```bash
|
|
||||||
# 从宿主机访问
|
|
||||||
curl http://localhost:8428/metrics
|
|
||||||
|
|
||||||
# 从容器内访问
|
|
||||||
docker-compose exec pika wget -O- http://victoriametrics:8428/metrics
|
|
||||||
```
|
|
||||||
|
|
||||||
#### 配置文件问题
|
|
||||||
|
|
||||||
- 确认 `config.yaml` 文件存在于与 `docker-compose.yml` 同一目录
|
|
||||||
- 检查 `config.yaml` 文件格式是否正确（YAML 语法）
|
|
||||||
- 验证配置文件权限：`ls -l config.yaml`
|
|
||||||
- 查看容器内是否成功加载配置：
|
|
||||||
```bash
|
|
||||||
docker-compose exec pika cat /app/config.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
#### 端口冲突
|
|
||||||
|
|
||||||
如果 8080 端口被占用，修改 `docker-compose.yml` 中的端口映射：
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
ports:
|
|
||||||
- "8081:8080" # 将 8080 改为其他端口
|
|
||||||
```
|
|
||||||
|
|
||||||
#### 网卡过滤
|
|
||||||
|
|
||||||
如果探针采集到了很多网卡，说明默认的过滤规则已经不适用于你的环境了。
|
|
||||||
|
|
||||||
你可以参考 [agent.example.yaml](cmd/agent/agent.example.yaml) 修改 `collector` 下的 `network_include` 或者 `network_exclude` 配置。
|
|
||||||
|
|
||||||
#### IP 归属地
|
|
||||||
|
|
||||||
- 注意：GeoIP 数据库需要手动下载并配置路径
|
|
||||||
- 下载地址 https://github.com/P3TERX/GeoLite.mmdb
|
|
||||||
- 下载后将config.yaml 中的 GeoIP.Enabled 配置启用，并把路径替换为您的实际路径
|
|
||||||
- 需要同步修改 docker-compose.yaml 中的文件映射
|
|
||||||
@@ -2,7 +2,7 @@ database:
|
|||||||
enabled: true
|
enabled: true
|
||||||
type: postgres
|
type: postgres
|
||||||
postgres:
|
postgres:
|
||||||
hostname: postgresql
|
hostname: pika-postgresql
|
||||||
port: 5432
|
port: 5432
|
||||||
username: pika
|
username: pika
|
||||||
password: pika
|
password: pika
|
||||||
@@ -19,7 +19,7 @@ server:
|
|||||||
|
|
||||||
App:
|
App:
|
||||||
JWT:
|
JWT:
|
||||||
Secret: "you_must_change_me" # 替换为任意 UUID 字符串
|
Secret: "" # 替换为任意 UUID 字符串
|
||||||
ExpiresHours: 168 # 7天
|
ExpiresHours: 168 # 7天
|
||||||
|
|
||||||
# Basic Auth 用户配置（使用 bcrypt 加密）
|
# Basic Auth 用户配置（使用 bcrypt 加密）
|
||||||
@@ -0,0 +1,54 @@
|
|||||||
|
database:
|
||||||
|
enabled: true
|
||||||
|
type: sqlite
|
||||||
|
sqlite:
|
||||||
|
path: "./pika.db"
|
||||||
|
show_sql: false
|
||||||
|
log:
|
||||||
|
level: debug # 日志等级 debug,info,waring,error
|
||||||
|
filename: ./logs/pika.log
|
||||||
|
|
||||||
|
server:
|
||||||
|
addr: "0.0.0.0:8080"
|
||||||
|
ip_extractor: "x-forwarded-for"
|
||||||
|
ip_trust_list: "0.0.0.0/0"
|
||||||
|
|
||||||
|
App:
|
||||||
|
JWT:
|
||||||
|
Secret: "" # 替换为任意 UUID 字符串
|
||||||
|
ExpiresHours: 168 # 7天
|
||||||
|
|
||||||
|
# Basic Auth 用户配置（使用 bcrypt 加密）
|
||||||
|
# 生成密码命令: htpasswd -nBC 12 '' | tr -d ':\n'
|
||||||
|
# 或使用 Go: bcrypt.GenerateFromPassword([]byte("your_password"), bcrypt.DefaultCost)
|
||||||
|
Users:
|
||||||
|
admin: "$2y$12$7DXcOiX1D59xNTIn5riUKusAPLP88LxxoczWmUT83MBj5EFznbp8a" # 默认密码: admin123
|
||||||
|
|
||||||
|
# OIDC 认证配置（可选）
|
||||||
|
OIDC:
|
||||||
|
Enabled: false
|
||||||
|
Issuer: "https://your-oidc-provider.com"
|
||||||
|
ClientID: "your-client-id"
|
||||||
|
ClientSecret: "your-client-secret"
|
||||||
|
RedirectURL: "http://localhost:8080/oidc/callback" # 前端回调页面
|
||||||
|
|
||||||
|
# GitHub OAuth 认证配置（可选）
|
||||||
|
# 创建 GitHub OAuth App: https://github.com/settings/developers
|
||||||
|
GitHub:
|
||||||
|
Enabled: false
|
||||||
|
ClientID: "your-github-client-id"
|
||||||
|
ClientSecret: "your-github-client-secret"
|
||||||
|
RedirectURL: "http://localhost:8080/github/callback" # 前端回调页面
|
||||||
|
AllowedUsers: # 允许登录的 GitHub 用户名白名单，不配置或留空则允许所有用户
|
||||||
|
- "your-github-username"
|
||||||
|
- "another-username"
|
||||||
|
GeoIP:
|
||||||
|
Enabled: false
|
||||||
|
DBPath: "./GeoLite2-City.mmdb"
|
||||||
|
VictoriaMetrics:
|
||||||
|
Enabled: true
|
||||||
|
URL: "http://victoriametrics:8428"
|
||||||
|
RetentionDays: 7 # 数据保留时长
|
||||||
|
WriteTimeout: 60 # 写超时时间（秒）
|
||||||
|
QueryTimeout: 60 # 读超时时间（秒）
|
||||||
|
|
||||||
File renamed without changes.
@@ -0,0 +1,38 @@
|
|||||||
|
version: '3.8'
|
||||||
|
|
||||||
|
services:
|
||||||
|
victoriametrics:
|
||||||
|
image: victoriametrics/victoria-metrics:v1.131.0
|
||||||
|
container_name: victoriametrics
|
||||||
|
restart: always
|
||||||
|
command:
|
||||||
|
- "-retentionPeriod=7d" # 保留 7 天数据
|
||||||
|
- "-storageDataPath=/victoria-metrics-data"
|
||||||
|
- "-httpListenAddr=:8428"
|
||||||
|
ports:
|
||||||
|
- "127.0.0.1:8428:8428" # API, PromQL, insert, select
|
||||||
|
volumes:
|
||||||
|
- ./data/vmdata:/victoria-metrics-data
|
||||||
|
networks:
|
||||||
|
- pika-network
|
||||||
|
pika:
|
||||||
|
image: dushixiang/pika:latest
|
||||||
|
container_name: pika-server
|
||||||
|
volumes:
|
||||||
|
- ./config.yaml:/app/config.yaml
|
||||||
|
- ./data:/app/data
|
||||||
|
# 开启 Geo 配置后打开下面的配置
|
||||||
|
# - ./GeoLite2-City.mmdb:/app/GeoLite2-City.mmdb
|
||||||
|
ports:
|
||||||
|
- "8080:8080"
|
||||||
|
depends_on:
|
||||||
|
- victoriametrics
|
||||||
|
restart: unless-stopped
|
||||||
|
networks:
|
||||||
|
- pika-network
|
||||||
|
|
||||||
|
networks:
|
||||||
|
pika-network:
|
||||||
|
driver: bridge
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,161 @@
|
|||||||
|
# 通用配置说明
|
||||||
|
|
||||||
|
## 配置文件修改（重要）
|
||||||
|
|
||||||
|
编辑 `config.yaml` 文件，根据需要修改以下配置：
|
||||||
|
|
||||||
|
### VictoriaMetrics 配置
|
||||||
|
|
||||||
|
确保时序数据库连接信息正确：
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
App:
|
||||||
|
VictoriaMetrics:
|
||||||
|
Enabled: true
|
||||||
|
URL: "http://victoriametrics:8428"
|
||||||
|
RetentionDays: 7 # 数据保留时长
|
||||||
|
WriteTimeout: 60 # 写超时时间（秒）
|
||||||
|
QueryTimeout: 60 # 读超时时间（秒）
|
||||||
|
```
|
||||||
|
|
||||||
|
### JWT 密钥
|
||||||
|
|
||||||
|
必须修改为强随机字符串：
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
App:
|
||||||
|
JWT:
|
||||||
|
Secret: "your-secret-key-here" # 必须修改
|
||||||
|
```
|
||||||
|
|
||||||
|
生成随机密钥：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
openssl rand -base64 32
|
||||||
|
```
|
||||||
|
|
||||||
|
### 用户认证
|
||||||
|
|
||||||
|
配置管理员账户或启用 OIDC/GitHub 登录：
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
App:
|
||||||
|
# Basic Auth 用户（默认用户名: admin，密码: admin123）
|
||||||
|
Users:
|
||||||
|
admin: "$2y$12$7DXcOiX1D59xNTIn5riUKusAPLP88LxxoczWmUT83MBj5EFznbp8a"
|
||||||
|
|
||||||
|
# 可选：启用 OIDC 认证
|
||||||
|
OIDC:
|
||||||
|
Enabled: false
|
||||||
|
Issuer: "https://your-oidc-provider.com"
|
||||||
|
ClientID: "your-client-id"
|
||||||
|
ClientSecret: "your-client-secret"
|
||||||
|
|
||||||
|
# 可选：启用 GitHub OAuth
|
||||||
|
GitHub:
|
||||||
|
Enabled: false
|
||||||
|
ClientID: "your-github-client-id"
|
||||||
|
ClientSecret: "your-github-client-secret"
|
||||||
|
```
|
||||||
|
|
||||||
|
### 生成新的管理员密码
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 使用 htpasswd 工具
|
||||||
|
htpasswd -nBC 12 '' | tr -d ':\n'
|
||||||
|
```
|
||||||
|
|
||||||
|
## 生产环境部署建议
|
||||||
|
|
||||||
|
### 1. 安全配置
|
||||||
|
|
||||||
|
- 在 `config.yaml` 中设置强随机的 JWT 密钥（`App.JWT.Secret`）
|
||||||
|
- 修改默认管理员密码或启用 OIDC/GitHub 认证
|
||||||
|
- 使用 HTTPS 反向代理（如 Nginx）
|
||||||
|
- 限制 VictoriaMetrics 端口仅允许内部访问（docker-compose 中已配置为 `127.0.0.1:8428:8428`）
|
||||||
|
- 妥善保管 `config.yaml` 文件，避免泄露敏感信息
|
||||||
|
|
||||||
|
### 2. 反向代理配置（Nginx 示例）
|
||||||
|
|
||||||
|
```nginx
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
server_name your-domain.com;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://localhost:8080;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
|
||||||
|
# WebSocket 支持
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
## 故障排查
|
||||||
|
|
||||||
|
### 服务无法启动
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 查看详细日志
|
||||||
|
docker-compose logs -f
|
||||||
|
|
||||||
|
# 检查容器状态
|
||||||
|
docker-compose ps
|
||||||
|
|
||||||
|
# 重启服务
|
||||||
|
docker-compose restart
|
||||||
|
```
|
||||||
|
|
||||||
|
### VictoriaMetrics 连接失败
|
||||||
|
|
||||||
|
- 确认 VictoriaMetrics 容器已启动
|
||||||
|
- 检查 `config.yaml` 中的 VictoriaMetrics 配置是否正确：
|
||||||
|
- `URL` 应该为 `http://victoriametrics:8428`（Docker Compose 服务名）
|
||||||
|
- 查看 VictoriaMetrics 日志：`docker-compose logs victoriametrics`
|
||||||
|
- 测试 VictoriaMetrics 是否正常工作：
|
||||||
|
```bash
|
||||||
|
# 从宿主机访问
|
||||||
|
curl http://localhost:8428/metrics
|
||||||
|
|
||||||
|
# 从容器内访问
|
||||||
|
docker-compose exec pika wget -O- http://victoriametrics:8428/metrics
|
||||||
|
```
|
||||||
|
|
||||||
|
### 配置文件问题
|
||||||
|
|
||||||
|
- 确认 `config.yaml` 文件存在于与 `docker-compose.yml` 同一目录
|
||||||
|
- 检查 `config.yaml` 文件格式是否正确（YAML 语法）
|
||||||
|
- 验证配置文件权限：`ls -l config.yaml`
|
||||||
|
- 查看容器内是否成功加载配置：
|
||||||
|
```bash
|
||||||
|
docker-compose exec pika cat /app/config.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
### 端口冲突
|
||||||
|
|
||||||
|
如果 8080 端口被占用，修改 `docker-compose.yml` 中的端口映射：
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
ports:
|
||||||
|
- "8081:8080" # 将 8080 改为其他端口
|
||||||
|
```
|
||||||
|
|
||||||
|
### 网卡过滤
|
||||||
|
|
||||||
|
如果探针采集到了很多网卡，说明默认的过滤规则已经不适用于你的环境了。
|
||||||
|
|
||||||
|
你可以参考 [agent.example.yaml](../cmd/agent/agent.example.yaml) 修改 `collector` 下的 `network_include` 或者 `network_exclude` 配置。
|
||||||
|
|
||||||
|
### IP 归属地
|
||||||
|
|
||||||
|
- 注意：GeoIP 数据库需要手动下载并配置路径
|
||||||
|
- 下载地址 https://github.com/P3TERX/GeoLite.mmdb
|
||||||
|
- 下载后将 config.yaml 中的 GeoIP.Enabled 配置启用，并把路径替换为您的实际路径
|
||||||
|
- 需要同步修改 docker-compose.yml 中的文件映射
|
||||||
|
|
||||||
@@ -0,0 +1,122 @@
|
|||||||
|
# PostgreSQL 版本部署指南
|
||||||
|
|
||||||
|
## 环境要求
|
||||||
|
|
||||||
|
- Docker 20.10+
|
||||||
|
- Docker Compose 1.29+
|
||||||
|
|
||||||
|
## 快速开始
|
||||||
|
|
||||||
|
### 1. 下载配置文件
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 下载 docker-compose.yml 配置文件
|
||||||
|
curl -O https://raw.githubusercontent.com/dushixiang/pika/main/docker-compose.postgresql.yml
|
||||||
|
# 下载配置文件示例
|
||||||
|
curl -o config.yaml https://raw.githubusercontent.com/dushixiang/pika/main/config.postgresql.yaml
|
||||||
|
|
||||||
|
# 或使用 wget
|
||||||
|
wget https://raw.githubusercontent.com/dushixiang/pika/main/docker-compose.postgresql.yml
|
||||||
|
wget -O config.yaml https://raw.githubusercontent.com/dushixiang/pika/main/config.postgresql.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
### 2. 修改配置
|
||||||
|
|
||||||
|
数据库配置（PostgreSQL）：
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
database:
|
||||||
|
enabled: true
|
||||||
|
type: postgres
|
||||||
|
postgres:
|
||||||
|
hostname: pika-postgresql # Docker Compose 服务名
|
||||||
|
port: 5432
|
||||||
|
username: pika
|
||||||
|
password: pika # 生产环境建议修改
|
||||||
|
database: pika
|
||||||
|
```
|
||||||
|
|
||||||
|
**注意**：如果修改了 `docker-compose.postgresql.yml` 中的数据库密码（`POSTGRES_PASSWORD`），也需要同步修改 `config.yaml` 中的数据库密码。
|
||||||
|
|
||||||
|
其他配置项请参考 [通用配置说明](common-config.md)。
|
||||||
|
|
||||||
|
### 3. 启动服务
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 启动所有服务
|
||||||
|
docker-compose -f docker-compose.postgresql.yml up -d
|
||||||
|
|
||||||
|
# 查看服务状态
|
||||||
|
docker-compose -f docker-compose.postgresql.yml ps
|
||||||
|
|
||||||
|
# 查看日志
|
||||||
|
docker-compose -f docker-compose.postgresql.yml logs -f pika
|
||||||
|
```
|
||||||
|
|
||||||
|
### 4. 访问服务
|
||||||
|
|
||||||
|
服务启动后，访问 http://localhost:8080
|
||||||
|
|
||||||
|
默认账户：
|
||||||
|
- 用户名: `admin`
|
||||||
|
- 密码: `admin123`
|
||||||
|
|
||||||
|
### 5. 停止服务
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 停止服务
|
||||||
|
docker-compose -f docker-compose.postgresql.yml stop
|
||||||
|
|
||||||
|
# 停止并删除容器
|
||||||
|
docker-compose -f docker-compose.postgresql.yml down
|
||||||
|
|
||||||
|
# 停止并删除容器及数据卷
|
||||||
|
docker-compose -f docker-compose.postgresql.yml down -v
|
||||||
|
```
|
||||||
|
|
||||||
|
## 生产环境安全配置
|
||||||
|
|
||||||
|
- 修改 `docker-compose.postgresql.yml` 中的默认数据库密码（`POSTGRES_PASSWORD`）
|
||||||
|
- 修改 `config.yaml` 中的数据库密码（`database.postgres.password`），与 docker-compose 中的设置保持一致
|
||||||
|
- 限制数据库端口仅允许内部访问（docker-compose.yml 中已配置为 `127.0.0.1:5432:5432`）
|
||||||
|
|
||||||
|
其他安全配置请参考 [通用配置说明](common-config.md)。
|
||||||
|
|
||||||
|
## 数据持久化
|
||||||
|
|
||||||
|
系统数据分别存储在以下目录：
|
||||||
|
- **PostgreSQL 数据**：`./data/postgresql` - 存储配置和审计数据
|
||||||
|
- **VictoriaMetrics 数据**：`./data/vmdata` - 存储时序指标数据（默认保留 7 天）
|
||||||
|
|
||||||
|
### 备份 PostgreSQL 数据库
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 备份数据库
|
||||||
|
docker-compose -f docker-compose.postgresql.yml exec postgresql pg_dump -U pika pika > backup.sql
|
||||||
|
|
||||||
|
# 恢复数据库
|
||||||
|
docker-compose -f docker-compose.postgresql.yml exec -T postgresql psql -U pika pika < backup.sql
|
||||||
|
```
|
||||||
|
|
||||||
|
### 备份 VictoriaMetrics 数据
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 备份 VictoriaMetrics 数据
|
||||||
|
tar -czf vmdata-backup-$(date +%Y%m%d).tar.gz ./data/vmdata
|
||||||
|
|
||||||
|
# 恢复时停止服务，解压到 ./data/vmdata 目录即可
|
||||||
|
```
|
||||||
|
|
||||||
|
## 故障排查
|
||||||
|
|
||||||
|
### 数据库连接失败
|
||||||
|
|
||||||
|
- 确认 PostgreSQL 容器已启动且健康检查通过
|
||||||
|
- 检查 `config.yaml` 中的数据库配置是否正确：
|
||||||
|
- `hostname` 应该为 `pika-postgresql`（Docker Compose 服务名）
|
||||||
|
- `password` 应该与 `docker-compose.postgresql.yml` 中的 `POSTGRES_PASSWORD` 一致
|
||||||
|
- 确认 `config.yaml` 文件已正确映射到容器中
|
||||||
|
- 查看数据库日志：`docker-compose -f docker-compose.postgresql.yml logs postgresql`
|
||||||
|
- 查看应用日志：`docker-compose -f docker-compose.postgresql.yml logs pika`
|
||||||
|
|
||||||
|
其他故障排查请参考 [通用配置说明](common-config.md)。
|
||||||
@@ -0,0 +1,108 @@
|
|||||||
|
# SQLite 版本部署指南
|
||||||
|
|
||||||
|
## 环境要求
|
||||||
|
|
||||||
|
- Docker 20.10+
|
||||||
|
- Docker Compose 1.29+
|
||||||
|
|
||||||
|
## 快速开始
|
||||||
|
|
||||||
|
### 1. 下载配置文件
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 下载 docker-compose.yml 配置文件
|
||||||
|
curl -O https://raw.githubusercontent.com/dushixiang/pika/main/docker-compose.sqlite.yml
|
||||||
|
# 下载配置文件示例
|
||||||
|
curl -o config.yaml https://raw.githubusercontent.com/dushixiang/pika/main/config.sqlite.yaml
|
||||||
|
|
||||||
|
# 或使用 wget
|
||||||
|
wget https://raw.githubusercontent.com/dushixiang/pika/main/docker-compose.sqlite.yml
|
||||||
|
wget -O config.yaml https://raw.githubusercontent.com/dushixiang/pika/main/config.sqlite.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
### 2. 修改配置
|
||||||
|
|
||||||
|
数据库配置（SQLite）：
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
database:
|
||||||
|
enabled: true
|
||||||
|
type: sqlite
|
||||||
|
sqlite:
|
||||||
|
path: "./data/pika.db"
|
||||||
|
```
|
||||||
|
|
||||||
|
其他配置项请参考 [通用配置说明](common-config.md)。
|
||||||
|
|
||||||
|
### 3. 启动服务
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 启动所有服务
|
||||||
|
docker-compose -f docker-compose.sqlite.yml up -d
|
||||||
|
|
||||||
|
# 查看服务状态
|
||||||
|
docker-compose -f docker-compose.sqlite.yml ps
|
||||||
|
|
||||||
|
# 查看日志
|
||||||
|
docker-compose -f docker-compose.sqlite.yml logs -f pika
|
||||||
|
```
|
||||||
|
|
||||||
|
### 4. 访问服务
|
||||||
|
|
||||||
|
服务启动后，访问 http://localhost:8080
|
||||||
|
|
||||||
|
默认账户：
|
||||||
|
- 用户名: `admin`
|
||||||
|
- 密码: `admin123`
|
||||||
|
|
||||||
|
### 5. 停止服务
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 停止服务
|
||||||
|
docker-compose -f docker-compose.sqlite.yml stop
|
||||||
|
|
||||||
|
# 停止并删除容器
|
||||||
|
docker-compose -f docker-compose.sqlite.yml down
|
||||||
|
|
||||||
|
# 停止并删除容器及数据卷
|
||||||
|
docker-compose -f docker-compose.sqlite.yml down -v
|
||||||
|
```
|
||||||
|
|
||||||
|
## 数据持久化
|
||||||
|
|
||||||
|
系统数据分别存储在以下目录：
|
||||||
|
- **SQLite 数据库**：`./data/pika.db` - 存储配置和审计数据
|
||||||
|
- **VictoriaMetrics 数据**：`./data/vmdata` - 存储时序指标数据（默认保留 7 天）
|
||||||
|
|
||||||
|
### 备份 SQLite 数据库
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 备份数据库
|
||||||
|
cp ./data/pika.db ./data/pika.db.backup-$(date +%Y%m%d)
|
||||||
|
|
||||||
|
# 或使用 SQLite 的备份命令
|
||||||
|
sqlite3 ./data/pika.db ".backup './data/pika.db.backup-$(date +%Y%m%d)'"
|
||||||
|
```
|
||||||
|
|
||||||
|
### 备份 VictoriaMetrics 数据
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 备份 VictoriaMetrics 数据
|
||||||
|
tar -czf vmdata-backup-$(date +%Y%m%d).tar.gz ./data/vmdata
|
||||||
|
|
||||||
|
# 恢复时停止服务，解压到 ./data/vmdata 目录即可
|
||||||
|
```
|
||||||
|
|
||||||
|
## 故障排查
|
||||||
|
|
||||||
|
### 数据库文件权限问题
|
||||||
|
|
||||||
|
- 确认 `./data` 目录存在且有写入权限
|
||||||
|
- 检查 SQLite 数据库文件权限：`ls -l ./data/pika.db`
|
||||||
|
- 如果遇到权限问题，可以尝试：
|
||||||
|
```bash
|
||||||
|
chmod 755 ./data
|
||||||
|
chmod 644 ./data/pika.db
|
||||||
|
```
|
||||||
|
|
||||||
|
其他故障排查请参考 [通用配置说明](common-config.md)。
|
||||||
@@ -0,0 +1,37 @@
|
|||||||
|
# 功能特性
|
||||||
|
|
||||||
|
## 📊 实时性能监控
|
||||||
|
|
||||||
|
- 系统资源监控：CPU、内存、磁盘、网络、GPU、温度等指标
|
||||||
|
- 时序数据查询：支持多种时间范围（5分钟、15分钟、30分钟、1小时），实时刷新和历史趋势分析
|
||||||
|
|
||||||
|
## 🔍 服务监控
|
||||||
|
|
||||||
|
- HTTP/HTTPS 监控：支持状态码检查、响应时间测量、内容匹配、HTTPS 证书到期检测
|
||||||
|
- TCP 端口监控：检测端口连通性和响应时间
|
||||||
|
- ICMP/Ping 监控：测量网络延迟和丢包率
|
||||||
|
|
||||||
|
## 🛡️ 防篡改保护
|
||||||
|
|
||||||
|
- 文件保护：保护关键目录，防止未授权修改
|
||||||
|
- 实时监控：基于 fsnotify 实时监控受保护目录的文件变动
|
||||||
|
- 属性巡检：定期检查不可变属性，自动恢复被篡改的保护
|
||||||
|
- 事件告警：实时上报文件变动事件和属性篡改告警
|
||||||
|
|
||||||
|
## 🔒 安全审计与应急响应
|
||||||
|
|
||||||
|
- **资产清单收集**：支持收集网络资产（端口、连接、防火墙）、进程资产、用户资产（SSH配置、密钥）、登录日志、文件资产（Cron、服务、启动脚本）、内核资产等
|
||||||
|
- **安全风险分析**：自动检测登录异常、可疑进程、用户权限风险、SSH配置安全问题等，并按严重程度分级（Critical/High/Medium/Low）
|
||||||
|
- **历史审计记录**：保存审计历史，支持查询和对比
|
||||||
|
|
||||||
|
## 🔐 认证与授权
|
||||||
|
|
||||||
|
- 支持多种认证方式：Basic Auth（bcrypt）、OIDC、GitHub OAuth
|
||||||
|
- 灵活的权限管理：管理员权限、公开页面、JWT Token 认证
|
||||||
|
|
||||||
|
## 📦 部署与运维
|
||||||
|
|
||||||
|
- Docker Compose 一键部署，数据持久化
|
||||||
|
- 支持 SQLite 和 PostgreSQL 两种数据库方案
|
||||||
|
- 灵活的 YAML 配置文件，支持网卡过滤和数据保留策略
|
||||||
|
|
||||||
Binary file not shown.
|
Before Width: | Height: | Size: 344 KiB After Width: | Height: | Size: 330 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 239 KiB After Width: | Height: | Size: 294 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 290 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 217 KiB |
Reference in new issue
Block a user