From 06f287b7afd988f52842ebf62bb9e232df64ace1 Mon Sep 17 00:00:00 2001 From: qiudl Date: Sun, 4 Jan 2026 20:50:33 +1030 Subject: [PATCH] chore: enable auto-deploy for saltthing.top MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Added version comment for deployment tracking - Auto-deploy configured on fnos with 5-minute sync interval 🀖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 --- docs/headscale-ops-solution-task4448.md | 2305 ++++++ encrypt-page.js | 42 + nav-home-encrypted.html | 2 +- nav-home.html | 1 + node_modules/.package-lock.json | 13 + node_modules/crypto-js/CONTRIBUTING.md | 28 + node_modules/crypto-js/LICENSE | 24 + node_modules/crypto-js/README.md | 275 + node_modules/crypto-js/aes.js | 234 + node_modules/crypto-js/blowfish.js | 471 ++ node_modules/crypto-js/bower.json | 39 + node_modules/crypto-js/cipher-core.js | 895 +++ node_modules/crypto-js/core.js | 807 ++ node_modules/crypto-js/crypto-js.js | 6657 +++++++++++++++++ .../crypto-js/docs/QuickStartGuide.wiki | 470 ++ node_modules/crypto-js/enc-base64.js | 136 + node_modules/crypto-js/enc-base64url.js | 148 + node_modules/crypto-js/enc-hex.js | 18 + node_modules/crypto-js/enc-latin1.js | 18 + node_modules/crypto-js/enc-utf16.js | 149 + node_modules/crypto-js/enc-utf8.js | 18 + node_modules/crypto-js/evpkdf.js | 134 + node_modules/crypto-js/format-hex.js | 66 + node_modules/crypto-js/format-openssl.js | 18 + node_modules/crypto-js/hmac-md5.js | 18 + node_modules/crypto-js/hmac-ripemd160.js | 18 + node_modules/crypto-js/hmac-sha1.js | 18 + node_modules/crypto-js/hmac-sha224.js | 18 + node_modules/crypto-js/hmac-sha256.js | 18 + node_modules/crypto-js/hmac-sha3.js | 18 + node_modules/crypto-js/hmac-sha384.js | 18 + node_modules/crypto-js/hmac-sha512.js | 18 + node_modules/crypto-js/hmac.js | 143 + node_modules/crypto-js/index.js | 18 + node_modules/crypto-js/lib-typedarrays.js | 76 + node_modules/crypto-js/md5.js | 268 + node_modules/crypto-js/mode-cfb.js | 80 + node_modules/crypto-js/mode-ctr-gladman.js | 116 + node_modules/crypto-js/mode-ctr.js | 58 + node_modules/crypto-js/mode-ecb.js | 40 + node_modules/crypto-js/mode-ofb.js | 54 + node_modules/crypto-js/package.json | 42 + node_modules/crypto-js/pad-ansix923.js | 49 + node_modules/crypto-js/pad-iso10126.js | 44 + node_modules/crypto-js/pad-iso97971.js | 40 + node_modules/crypto-js/pad-nopadding.js | 30 + node_modules/crypto-js/pad-pkcs7.js | 18 + node_modules/crypto-js/pad-zeropadding.js | 47 + node_modules/crypto-js/pbkdf2.js | 145 + node_modules/crypto-js/rabbit-legacy.js | 190 + node_modules/crypto-js/rabbit.js | 192 + node_modules/crypto-js/rc4.js | 139 + node_modules/crypto-js/ripemd160.js | 267 + node_modules/crypto-js/sha1.js | 150 + node_modules/crypto-js/sha224.js | 80 + node_modules/crypto-js/sha256.js | 199 + node_modules/crypto-js/sha3.js | 326 + node_modules/crypto-js/sha384.js | 83 + node_modules/crypto-js/sha512.js | 326 + node_modules/crypto-js/tripledes.js | 779 ++ node_modules/crypto-js/x64-core.js | 304 + ops-unified-management-plan.md | 391 + 62 files changed, 17805 insertions(+), 1 deletion(-) create mode 100644 docs/headscale-ops-solution-task4448.md create mode 100644 encrypt-page.js create mode 100644 node_modules/.package-lock.json create mode 100644 node_modules/crypto-js/CONTRIBUTING.md create mode 100644 node_modules/crypto-js/LICENSE create mode 100644 node_modules/crypto-js/README.md create mode 100644 node_modules/crypto-js/aes.js create mode 100644 node_modules/crypto-js/blowfish.js create mode 100644 node_modules/crypto-js/bower.json create mode 100644 node_modules/crypto-js/cipher-core.js create mode 100644 node_modules/crypto-js/core.js create mode 100644 node_modules/crypto-js/crypto-js.js create mode 100644 node_modules/crypto-js/docs/QuickStartGuide.wiki create mode 100644 node_modules/crypto-js/enc-base64.js create mode 100644 node_modules/crypto-js/enc-base64url.js create mode 100644 node_modules/crypto-js/enc-hex.js create mode 100644 node_modules/crypto-js/enc-latin1.js create mode 100644 node_modules/crypto-js/enc-utf16.js create mode 100644 node_modules/crypto-js/enc-utf8.js create mode 100644 node_modules/crypto-js/evpkdf.js create mode 100644 node_modules/crypto-js/format-hex.js create mode 100644 node_modules/crypto-js/format-openssl.js create mode 100644 node_modules/crypto-js/hmac-md5.js create mode 100644 node_modules/crypto-js/hmac-ripemd160.js create mode 100644 node_modules/crypto-js/hmac-sha1.js create mode 100644 node_modules/crypto-js/hmac-sha224.js create mode 100644 node_modules/crypto-js/hmac-sha256.js create mode 100644 node_modules/crypto-js/hmac-sha3.js create mode 100644 node_modules/crypto-js/hmac-sha384.js create mode 100644 node_modules/crypto-js/hmac-sha512.js create mode 100644 node_modules/crypto-js/hmac.js create mode 100644 node_modules/crypto-js/index.js create mode 100644 node_modules/crypto-js/lib-typedarrays.js create mode 100644 node_modules/crypto-js/md5.js create mode 100644 node_modules/crypto-js/mode-cfb.js create mode 100644 node_modules/crypto-js/mode-ctr-gladman.js create mode 100644 node_modules/crypto-js/mode-ctr.js create mode 100644 node_modules/crypto-js/mode-ecb.js create mode 100644 node_modules/crypto-js/mode-ofb.js create mode 100644 node_modules/crypto-js/package.json create mode 100644 node_modules/crypto-js/pad-ansix923.js create mode 100644 node_modules/crypto-js/pad-iso10126.js create mode 100644 node_modules/crypto-js/pad-iso97971.js create mode 100644 node_modules/crypto-js/pad-nopadding.js create mode 100644 node_modules/crypto-js/pad-pkcs7.js create mode 100644 node_modules/crypto-js/pad-zeropadding.js create mode 100644 node_modules/crypto-js/pbkdf2.js create mode 100644 node_modules/crypto-js/rabbit-legacy.js create mode 100644 node_modules/crypto-js/rabbit.js create mode 100644 node_modules/crypto-js/rc4.js create mode 100644 node_modules/crypto-js/ripemd160.js create mode 100644 node_modules/crypto-js/sha1.js create mode 100644 node_modules/crypto-js/sha224.js create mode 100644 node_modules/crypto-js/sha256.js create mode 100644 node_modules/crypto-js/sha3.js create mode 100644 node_modules/crypto-js/sha384.js create mode 100644 node_modules/crypto-js/sha512.js create mode 100644 node_modules/crypto-js/tripledes.js create mode 100644 node_modules/crypto-js/x64-core.js create mode 100644 ops-unified-management-plan.md diff --git a/docs/headscale-ops-solution-task4448.md b/docs/headscale-ops-solution-task4448.md new file mode 100644 index 0000000..991d21f --- /dev/null +++ b/docs/headscale-ops-solution-task4448.md @@ -0,0 +1,2305 @@ +# OPS 统䞀管理方案 - Headscale 组眑实斜方案 + +> **任务猖号**: 4448 +> **版本**: v2.0 +> **最后曎新**: 2025-12-18 +> **文档状态**: 诊细讟计 + +--- + +## 目圕 + +1. [项目背景䞎目标](#1-项目背景䞎目标) +2. [技术方案抂述](#2-技术方案抂述) +3. [眑络架构讟计](#3-眑络架构讟计) +4. [基础讟斜规划](#4-基础讟斜规划) +5. [Headscale 服务端郚眲](#5-headscale-服务端郚眲) +6. [客户端接入方案](#6-客户端接入方案) +7. [访问控制䞎安党策略](#7-访问控制䞎安党策略) +8. [DNS 䞎服务发现](#8-dns-䞎服务发现) +9. [监控䞎告譊](#9-监控䞎告譊) +10. [运绎管理规范](#10-运绎管理规范) +11. [故障恢倍䞎灟倇](#11-故障恢倍䞎灟倇) +12. [实斜计划䞎里皋碑](#12-实斜计划䞎里皋碑) +13. [风险评䌰䞎应对](#13-风险评䌰䞎应对) +14. [附圕](#14-附圕) + +--- + +## 1. 项目背景䞎目标 + +### 1.1 项目背景 + +随着䞚务发展运绎团队面䞎以䞋挑战 + +- **倚云倚地域分垃**: 服务噚分垃圚阿里云、腟讯云、AWS 等倚䞪云平台以及倚䞪物理机房 +- **眑络隔犻倍杂**: 䞍同环境生产、测试、匀发之闎眑络隔犻管理倍杂 +- **VPN 管理困隟**: 䌠统 VPN 方案OpenVPN、IPSec配眮倍杂、绎技成本高 +- **安党访问需求**: 需芁安党、䟿捷地访问内郚服务同时满足合规芁求 +- **运绎效率䜎䞋**: 跚眑络运绎操䜜繁琐无统䞀入口 + +### 1.2 项目目标 + +| 目标绎床 | 具䜓目标 | 验收标准 | +|---------|---------|---------| +| 眑络互通 | 实现所有节点 P2P 盎连 | 任意䞀节点延迟 < 50ms同区域| +| 安党性 | 零信任眑络架构 | 所有通信加密基于身仜讀证 | +| 易甚性 | 䞀键接入内眑 | 客户端安装配眮 < 5分钟 | +| 可扩展 | 支持快速扩容 | 新节点接入 < 10分钟 | +| 高可甚 | 控制平面高可甚 | SLA 99.9% | + +### 1.3 适甚范囎 + +- 生产环境所有服务噚 +- 测试/预发垃环境服务噚 +- 运绎/匀发人员工䜜讟倇 +- CI/CD 构建节点 +- 数据库、猓存等基础讟斜 + +--- + +## 2. 技术方案抂述 + +### 2.1 䞺什么选择 Headscale + +| 方案 | 䌘点 | 猺点 | 适甚场景 | +|------|-----|------|---------| +| **Headscale** | 匀源自托管、WireGuard 内栞、P2P 盎连、蜻量级 | 生态盞对蟃新 | 自䞻可控芁求高 | +| Tailscale | 完善的商䞚支持 | 数据过境囜倖、成本高 | 小团队快速起步 | +| OpenVPN | 成熟皳定 | 配眮倍杂、性胜蟃差 | 䌠统䌁䞚 | +| ZeroTier | 易于䜿甚 | 免莹版限制倚 | 小规暡䜿甚 | + +**选择 Headscale 的栞心理由** + +1. **数据䞻权**: 所有协调数据存傚圚自己的服务噚䞊 +2. **成本可控**: 完党匀源无订阅莹甚 +3. **WireGuard 䌘势**: 现代密码孊、䜎延迟、高性胜 +4. **Mesh 眑络**: 节点闎盎接通信无需䞭心蜬发 +5. **兌容 Tailscale 客户端**: 可䜿甚成熟的 Tailscale 客户端 + +### 2.2 技术架构囟 + +``` + ┌─────────────────────────────────────────────────────────┐ + │ Internet │ + └──────────────────────────┬──────────────────────────────┘ + │ + ┌──────────────────────────┮──────────────────────────────┐ + │ │ + ┌─────────▌─────────┐ ┌────────────────▌────────────────┐ + │ Headscale HA │ │ DERP Relay Servers │ + │ Control Plane │ │ (Beijing/Shanghai/HK) │ + │ │ │ │ + │ ┌───────────────┐ │ │ ┌─────────┐ ┌─────────┐ │ + │ │ Headscale │ │ │ │ DERP-BJ │ │ DERP-SH │ │ + │ │ Primary │ │ │ └─────────┘ └─────────┘ │ + │ └───────────────┘ │ │ ┌─────────┐ │ + │ ┌───────────────┐ │ │ │ DERP-HK │ │ + │ │ PostgreSQL │ │ │ └─────────┘ │ + │ │ (HA) │ │ └─────────────────────────────────┘ + │ └───────────────┘ │ + └─────────┬─────────┘ + │ Coordination + │ + ┌─────────────────────┌─────────────────────┬─────────────────────┐ + │ │ │ │ + â–Œ â–Œ â–Œ â–Œ +┌───────────────┐ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ +│ Production │ │ Staging │ │ Development │ │ Operator │ +│ Servers │ │ Servers │ │ Servers │ │ Devices │ +│ │ │ │ │ │ │ │ +│ ┌───────────┐ │ │ ┌───────────┐ │ │ ┌───────────┐ │ │ ┌───────────┐ │ +│ │ Tailscale │ │◄───►│ │ Tailscale │ │◄───►│ │ Tailscale │ │◄───►│ │ Tailscale │ │ +│ │ Agent │ │ P2P │ │ Agent │ │ P2P │ │ Agent │ │ P2P │ │ Client │ │ +│ └───────────┘ │ │ └───────────┘ │ │ └───────────┘ │ │ └───────────┘ │ +└───────────────┘ └───────────────┘ └───────────────┘ └───────────────┘ + 100.64.1.x 100.64.2.x 100.64.3.x 100.64.10.x +``` + +### 2.3 栞心组件诎明 + +| 组件 | 功胜 | 郚眲䜍眮 | 高可甚策略 | +|------|-----|---------|-----------| +| Headscale Server | 协调服务、密钥分发、ACL 管理 | 云䞻机 | 䞻倇 + PostgreSQL HA | +| DERP Relay | NAT 穿透倱莥时的䞭继服务 | 倚地域郚眲 | 倚节点冗䜙 | +| Tailscale Client | 客户端 Agent | 所有节点 | 匀机自启 | +| Admin UI | Web 管理界面 | 侎 Headscale 同机 | - | + +--- + +## 3. 眑络架构讟计 + +### 3.1 IP 地址规划 + +采甹 CGNAT 地址段 `100.64.0.0/10`按环境和甚途划分 + +``` +100.64.0.0/10 (总地址空闎: 4,194,304 䞪地址) +│ +├── 100.64.0.0/16 - 保留地址段 (管理甚途) +│ ├── 100.64.0.0/24 - Headscale 控制平面 +│ ├── 100.64.1.0/24 - DERP 䞭继服务噚 +│ └── 100.64.2.0/24 - 监控基础讟斜 +│ +├── 100.65.0.0/16 - 生产环境 (Production) +│ ├── 100.65.1.0/24 - Web 服务噚组 +│ ├── 100.65.2.0/24 - API 服务噚组 +│ ├── 100.65.3.0/24 - 数据库服务噚组 +│ ├── 100.65.4.0/24 - 猓存服务噚组 +│ ├── 100.65.5.0/24 - 消息队列服务噚组 +│ ├── 100.65.10.0/24 - Kubernetes Master +│ ├── 100.65.11.0/23 - Kubernetes Worker +│ └── 100.65.100.0/24 - 生产环境堡垒机 +│ +├── 100.66.0.0/16 - 预发垃环境 (Staging) +│ ├── 100.66.1.0/24 - 应甚服务噚 +│ ├── 100.66.2.0/24 - 数据库服务噚 +│ └── 100.66.10.0/24 - Kubernetes 集矀 +│ +├── 100.67.0.0/16 - 测试环境 (Testing) +│ ├── 100.67.1.0/24 - 应甚服务噚 +│ ├── 100.67.2.0/24 - 数据库服务噚 +│ └── 100.67.100.0/24 - CI/CD 构建节点 +│ +├── 100.68.0.0/16 - 匀发环境 (Development) +│ ├── 100.68.1.0/24 - 匀发服务噚 +│ └── 100.68.2.0/24 - 匀发数据库 +│ +├── 100.70.0.0/16 - 运绎人员讟倇 (Operators) +│ ├── 100.70.1.0/24 - 高级运绎 +│ ├── 100.70.2.0/24 - 普通运绎 +│ └── 100.70.10.0/24 - 倌班人员 +│ +├── 100.71.0.0/16 - 匀发人员讟倇 (Developers) +│ ├── 100.71.1.0/24 - 后端匀发 +│ ├── 100.71.2.0/24 - 前端匀发 +│ └── 100.71.3.0/24 - 移劚匀发 +│ +└── 100.80.0.0/16 - 倖郚合䜜䌙䌎 (Partners) + └── 100.80.1.0/24 - 第䞉方䟛应商 +``` + +### 3.2 呜名空闎讟计 + +Headscale 䜿甚 User (原 Namespace) 进行逻蟑隔犻 + +| User 名称 | 甹途 | IP 段 | 管理员 | +|-----------|-----|-------|--------| +| `infra` | 基础讟斜服务 | 100.64.0.0/16 | ops-admin | +| `prod` | 生产环境服务噚 | 100.65.0.0/16 | ops-admin | +| `staging` | 预发垃环境 | 100.66.0.0/16 | ops-admin | +| `testing` | 测试环境 | 100.67.0.0/16 | qa-admin | +| `dev` | 匀发环境 | 100.68.0.0/16 | dev-admin | +| `ops-team` | 运绎人员讟倇 | 100.70.0.0/16 | ops-admin | +| `dev-team` | 匀发人员讟倇 | 100.71.0.0/16 | dev-admin | +| `partners` | 倖郚合䜜䌙䌎 | 100.80.0.0/16 | ops-admin | + +### 3.3 节点呜名规范 + +``` +<环境>-<角色>-<区域>-<序号> + +瀺䟋: +- prod-web-bj-001 生产环境北京Web服务噚#1 +- prod-db-sh-001 生产环境䞊海数据库#1 +- staging-api-bj-001 预发垃环境北京API服务噚#1 +- ops-laptop-zhangsan 运绎人员匠䞉的笔记本 +``` + +### 3.4 DERP 䞭继眑络 + +郚眲自建 DERP 服务噚以确保 NAT 穿透倱莥时的可靠䞭继 + +| 节点 | 区域 | 公眑 IP | 端口 | 倇泚 | +|------|-----|---------|-----|------| +| derp-bj-01 | 北京 | x.x.x.x | 443/3478 | 阿里云䞻节点 | +| derp-sh-01 | 䞊海 | x.x.x.x | 443/3478 | 腟讯云倇节点 | +| derp-hk-01 | 銙枯 | x.x.x.x | 443/3478 | AWS 海倖节点 | +| derp-sg-01 | 新加坡 | x.x.x.x | 443/3478 | 䞜南亚节点 | + +--- + +## 4. 基础讟斜规划 + +### 4.1 服务噚资源规划 + +#### 4.1.1 Headscale 控制平面 + +| 组件 | 配眮 | 数量 | 诎明 | +|------|-----|------|-----| +| Headscale Primary | 4C8G 100GB SSD | 1 | 䞻控制节点 | +| Headscale Standby | 4C8G 100GB SSD | 1 | 热倇节点 | +| PostgreSQL Primary | 4C16G 500GB SSD | 1 | 数据库䞻节点 | +| PostgreSQL Replica | 4C16G 500GB SSD | 1 | 数据库从节点 | +| Admin UI | 2C4G 50GB SSD | 1 | 管理界面 | + +#### 4.1.2 DERP 䞭继服务噚 + +| 区域 | 配眮 | 垊宜 | 数量 | +|------|-----|------|------| +| 北京 | 2C4G 50GB | 100Mbps | 1 | +| 䞊海 | 2C4G 50GB | 100Mbps | 1 | +| 銙枯 | 2C4G 50GB | 100Mbps | 1 | +| 新加坡 | 2C4G 50GB | 100Mbps | 1 | + +### 4.2 眑络芁求 + +#### 4.2.1 Headscale 服务噚端口 + +| 端口 | 协议 | 甹途 | 来源 | +|-----|------|-----|------| +| 443 | TCP | HTTPS API & gRPC | 所有客户端 | +| 80 | TCP | HTTP 重定向 | 所有客户端 | +| 50443 | TCP | 管理 API (可选) | 管理眑络 | + +#### 4.2.2 DERP 服务噚端口 + +| 端口 | 协议 | 甹途 | 来源 | +|-----|------|-----|------| +| 443 | TCP | HTTPS DERP | 所有客户端 | +| 3478 | UDP | STUN | 所有客户端 | +| 80 | TCP | HTTP 重定向 | 所有客户端 | + +#### 4.2.3 Tailscale 客户端端口 + +| 端口 | 协议 | 甹途 | 方向 | +|-----|------|-----|------| +| 41641 | UDP | WireGuard 盎连 | 入站/出站 | +| 443 | TCP | DERP 䞭继 | 出站 | +| 3478 | UDP | STUN | 出站 | + +### 4.3 域名䞎证乊规划 + +| 域名 | 甹途 | 证乊类型 | +|------|-----|---------| +| hs.ops.company.com | Headscale API | Let's Encrypt 通配笊 | +| admin.hs.ops.company.com | 管理界面 | Let's Encrypt | +| derp-bj.ops.company.com | 北京 DERP | Let's Encrypt | +| derp-sh.ops.company.com | 䞊海 DERP | Let's Encrypt | +| derp-hk.ops.company.com | 銙枯 DERP | Let's Encrypt | + +--- + +## 5. Headscale 服务端郚眲 + +### 5.1 系统环境准倇 + +```bash +# 操䜜系统: Ubuntu 22.04 LTS / Rocky Linux 9 +# 时区讟眮 +timedatectl set-timezone Asia/Shanghai + +# 曎新系统 +apt update && apt upgrade -y + +# 安装必芁工具 +apt install -y curl wget vim htop net-tools jq unzip + +# 关闭 swap (容噚化郚眲时) +swapoff -a +sed -i '/swap/d' /etc/fstab + +# 讟眮内栞参数 +cat >> /etc/sysctl.conf << EOF +net.ipv4.ip_forward = 1 +net.ipv6.conf.all.forwarding = 1 +net.core.rmem_max = 2500000 +net.core.wmem_max = 2500000 +EOF +sysctl -p + +# 讟眮文件描述笊限制 +cat >> /etc/security/limits.conf << EOF +* soft nofile 65535 +* hard nofile 65535 +root soft nofile 65535 +root hard nofile 65535 +EOF +``` + +### 5.2 PostgreSQL 高可甚郚眲 + +#### 5.2.1 PostgreSQL 䞻节点安装 + +```bash +# 安装 PostgreSQL 15 +apt install -y postgresql-15 postgresql-contrib-15 + +# 配眮 PostgreSQL +cat > /etc/postgresql/15/main/postgresql.conf << 'EOF' +listen_addresses = '*' +port = 5432 +max_connections = 200 +shared_buffers = 4GB +effective_cache_size = 12GB +maintenance_work_mem = 1GB +checkpoint_completion_target = 0.9 +wal_buffers = 16MB +default_statistics_target = 100 +random_page_cost = 1.1 +effective_io_concurrency = 200 +work_mem = 10MB +min_wal_size = 1GB +max_wal_size = 4GB +max_worker_processes = 4 +max_parallel_workers_per_gather = 2 +max_parallel_workers = 4 +max_parallel_maintenance_workers = 2 + +# 倍制配眮 +wal_level = replica +max_wal_senders = 5 +wal_keep_size = 1GB +hot_standby = on +EOF + +# 配眮访问控制 +cat > /etc/postgresql/15/main/pg_hba.conf << 'EOF' +local all postgres peer +local all all peer +host all all 127.0.0.1/32 scram-sha-256 +host all all ::1/128 scram-sha-256 +host replication replicator /32 scram-sha-256 +host headscale headscale /32 scram-sha-256 +host headscale headscale /32 scram-sha-256 +EOF + +# 创建数据库和甚户 +sudo -u postgres psql << 'EOF' +CREATE USER headscale WITH PASSWORD 'your_secure_password_here'; +CREATE DATABASE headscale OWNER headscale; +GRANT ALL PRIVILEGES ON DATABASE headscale TO headscale; + +CREATE USER replicator WITH REPLICATION PASSWORD 'replicator_password'; +EOF + +systemctl restart postgresql +systemctl enable postgresql +``` + +#### 5.2.2 PostgreSQL 从节点配眮 + +```bash +# 停止 PostgreSQL +systemctl stop postgresql + +# 枅空数据目圕 +rm -rf /var/lib/postgresql/15/main/* + +# 从䞻节点倍制数据 +sudo -u postgres pg_basebackup -h -U replicator -p 5432 \ + -D /var/lib/postgresql/15/main -Fp -Xs -P -R + +# 启劚从节点 +systemctl start postgresql +``` + +### 5.3 Headscale 安装䞎配眮 + +#### 5.3.1 二进制安装 + +```bash +# 䞋蜜最新版本 (以 0.23.0 䞺䟋) +HEADSCALE_VERSION="0.23.0" +wget -O /tmp/headscale.deb \ + "https://github.com/juanfont/headscale/releases/download/v${HEADSCALE_VERSION}/headscale_${HEADSCALE_VERSION}_linux_amd64.deb" + +# 安装 +dpkg -i /tmp/headscale.deb + +# 或䜿甚 Docker +docker pull headscale/headscale:0.23.0 +``` + +#### 5.3.2 Headscale 配眮文件 + +```yaml +# /etc/headscale/config.yaml +--- +server_url: https://hs.ops.company.com:443 +listen_addr: 0.0.0.0:443 +metrics_listen_addr: 127.0.0.1:9090 +grpc_listen_addr: 0.0.0.0:50443 +grpc_allow_insecure: false + +# 私有密钥路埄 +private_key_path: /var/lib/headscale/private.key +noise: + private_key_path: /var/lib/headscale/noise_private.key + +# IP 地址前猀 +prefixes: + v4: 100.64.0.0/10 + v6: fd7a:115c:a1e0::/48 + allocation: sequential + +# 数据库配眮 (PostgreSQL) +database: + type: postgres + postgres: + host: + port: 5432 + name: headscale + user: headscale + pass: your_secure_password_here + max_open_conns: 100 + max_idle_conns: 10 + conn_max_idle_time_secs: 3600 + ssl: disable # 生产环境建议启甚 require + +# DERP 配眮 +derp: + server: + enabled: false # 䜿甚独立 DERP 服务噚 + region_id: 999 + region_code: "headscale" + region_name: "Headscale Embedded DERP" + stun_listen_addr: "0.0.0.0:3478" + urls: + - https://hs.ops.company.com/derp.json + paths: [] + auto_update_enabled: true + update_frequency: 24h + +# 犁甚默讀 Tailscale DERP +disable_check_updates: true +ephemeral_node_inactivity_timeout: 30m + +# 节点曎新检查 +node_update_check_interval: 10s + +# DNS 配眮 +dns: + magic_dns: true + base_domain: ts.company.local + nameservers: + global: + - 10.0.0.1 # 内郚 DNS + - 223.5.5.5 # 阿里 DNS (倇甚) + search_domains: + - company.local + extra_records: + - name: "grafana.ts.company.local" + type: "A" + value: "100.64.0.10" + - name: "prometheus.ts.company.local" + type: "A" + value: "100.64.0.11" + +# Unix socket 配眮 +unix_socket: /var/run/headscale/headscale.sock +unix_socket_permission: "0770" + +# TLS 配眮 (䜿甚反向代理时可讟䞺空) +tls_cert_path: "" +tls_key_path: "" + +# 日志配眮 +log: + format: json + level: info + +# ACL 策略 +policy: + mode: file + path: /etc/headscale/acl.json + +# OIDC 配眮 (可选) +oidc: + only_start_if_oidc_is_available: true + issuer: "https://sso.company.com/realms/ops" + client_id: "headscale" + client_secret: "your_oidc_client_secret" + scope: ["openid", "profile", "email"] + extra_params: + domain_hint: company.com + strip_email_domain: true + allowed_users: [] + allowed_groups: + - "/ops-team" + - "/dev-team" +``` + +#### 5.3.3 创建 systemd 服务 + +```ini +# /etc/systemd/system/headscale.service +[Unit] +Description=headscale coordination server +Documentation=https://github.com/juanfont/headscale +After=network-online.target postgresql.service +Wants=network-online.target +Requires=postgresql.service + +[Service] +User=headscale +Group=headscale +Type=simple +Restart=always +RestartSec=5 +ExecStart=/usr/bin/headscale serve +Environment="GIN_MODE=release" + +# 资源限制 +LimitNOFILE=65535 +LimitNPROC=65535 + +# 安党加固 +NoNewPrivileges=true +PrivateTmp=true +ProtectSystem=strict +ProtectHome=true +ReadWritePaths=/var/lib/headscale /var/run/headscale + +[Install] +WantedBy=multi-user.target +``` + +#### 5.3.4 启劚服务 + +```bash +# 创建甚户和目圕 +useradd -r -s /bin/false headscale +mkdir -p /var/lib/headscale /var/run/headscale /etc/headscale +chown -R headscale:headscale /var/lib/headscale /var/run/headscale + +# 启劚服务 +systemctl daemon-reload +systemctl enable headscale +systemctl start headscale + +# 验证服务状态 +systemctl status headscale +headscale version +``` + +### 5.4 DERP 䞭继服务噚郚眲 + +#### 5.4.1 DERP 服务噚配眮 + +```bash +# 安装 Go (劂果需芁猖译) +wget https://go.dev/dl/go1.21.5.linux-amd64.tar.gz +tar -C /usr/local -xzf go1.21.5.linux-amd64.tar.gz +export PATH=$PATH:/usr/local/go/bin + +# 安装 derper +go install tailscale.com/cmd/derper@latest + +# 或䜿甚 Docker +docker pull ghcr.io/tailscale/derper:latest +``` + +#### 5.4.2 DERP Docker Compose 郚眲 + +```yaml +# /opt/derper/docker-compose.yml +version: '3.8' +services: + derper: + image: ghcr.io/tailscale/derper:latest + container_name: derper + restart: always + ports: + - "443:443" + - "80:80" + - "3478:3478/udp" + volumes: + - ./certs:/etc/derper/certs:ro + - ./config:/etc/derper/config:ro + command: + - --hostname=derp-bj.ops.company.com + - --certmode=manual + - --certdir=/etc/derper/certs + - --stun + - --stun-port=3478 + - --verify-clients=true + - --verify-client-url=https://hs.ops.company.com/verify + environment: + - DERP_VERIFY_CLIENTS=true + logging: + driver: "json-file" + options: + max-size: "100m" + max-file: "3" +``` + +#### 5.4.3 DERP Map 配眮 + +圚 Headscale 服务噚䞊配眮 DERP Map + +```json +// /etc/headscale/derp.json +{ + "Regions": { + "900": { + "RegionID": 900, + "RegionCode": "bj", + "RegionName": "Beijing", + "Avoid": false, + "Nodes": [ + { + "Name": "bj1", + "RegionID": 900, + "HostName": "derp-bj.ops.company.com", + "DERPPort": 443, + "STUNPort": 3478, + "InsecureForTests": false + } + ] + }, + "901": { + "RegionID": 901, + "RegionCode": "sh", + "RegionName": "Shanghai", + "Avoid": false, + "Nodes": [ + { + "Name": "sh1", + "RegionID": 901, + "HostName": "derp-sh.ops.company.com", + "DERPPort": 443, + "STUNPort": 3478, + "InsecureForTests": false + } + ] + }, + "902": { + "RegionID": 902, + "RegionCode": "hk", + "RegionName": "Hong Kong", + "Avoid": false, + "Nodes": [ + { + "Name": "hk1", + "RegionID": 902, + "HostName": "derp-hk.ops.company.com", + "DERPPort": 443, + "STUNPort": 3478, + "InsecureForTests": false + } + ] + } + } +} +``` + +### 5.5 Nginx 反向代理配眮 + +```nginx +# /etc/nginx/sites-available/headscale +upstream headscale { + server 127.0.0.1:8080; + keepalive 32; +} + +server { + listen 80; + server_name hs.ops.company.com; + return 301 https://$server_name$request_uri; +} + +server { + listen 443 ssl http2; + server_name hs.ops.company.com; + + # SSL 配眮 + ssl_certificate /etc/letsencrypt/live/hs.ops.company.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/hs.ops.company.com/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 1d; + ssl_session_tickets off; + ssl_stapling on; + ssl_stapling_verify on; + + # 安党倎 + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header X-Frame-Options DENY always; + add_header X-Content-Type-Options nosniff always; + + location / { + proxy_pass http://headscale; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_buffering off; + proxy_read_timeout 86400s; + proxy_send_timeout 86400s; + } + + # gRPC 支持 + location /headscale.v1.HeadscaleService/ { + grpc_pass grpc://127.0.0.1:50443; + grpc_set_header Host $host; + grpc_set_header X-Real-IP $remote_addr; + } + + # 健康检查 + location /health { + proxy_pass http://headscale/health; + access_log off; + } + + # Metrics (仅内眑访问) + location /metrics { + allow 10.0.0.0/8; + allow 172.16.0.0/12; + allow 192.168.0.0/16; + allow 100.64.0.0/10; + deny all; + proxy_pass http://127.0.0.1:9090/metrics; + } +} +``` + +### 5.6 管理界面郚眲 (Headscale-UI) + +```yaml +# /opt/headscale-ui/docker-compose.yml +version: '3.8' +services: + headscale-ui: + image: ghcr.io/gurucomputing/headscale-ui:latest + container_name: headscale-ui + restart: always + ports: + - "127.0.0.1:8081:80" + environment: + - HS_SERVER=https://hs.ops.company.com +``` + +--- + +## 6. 客户端接入方案 + +### 6.1 Linux 服务噚接入 + +#### 6.1.1 安装 Tailscale 客户端 + +```bash +# Ubuntu/Debian +curl -fsSL https://tailscale.com/install.sh | sh + +# RHEL/CentOS +curl -fsSL https://tailscale.com/install.sh | sh + +# 或手劚安装 +# Ubuntu/Debian +curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/jammy.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null +curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/jammy.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list +apt update && apt install -y tailscale +``` + +#### 6.1.2 连接到 Headscale + +```bash +# 䜿甚预讀证密钥 (掚荐甚于服务噚) +tailscale up \ + --login-server https://hs.ops.company.com \ + --authkey tskey-preauth-xxxxxxxxxxxxx \ + --hostname prod-web-bj-001 \ + --advertise-tags tag:prod,tag:web \ + --accept-routes \ + --accept-dns + +# 亀互匏登圕 (甚于匀发机噚) +tailscale up \ + --login-server https://hs.ops.company.com \ + --hostname ops-laptop-zhangsan + +# 验证连接 +tailscale status +tailscale ip +``` + +#### 6.1.3 自劚化安装脚本 + +```bash +#!/bin/bash +# /opt/scripts/setup-tailscale.sh + +set -euo pipefail + +# 配眮变量 +HEADSCALE_URL="${HEADSCALE_URL:-https://hs.ops.company.com}" +AUTH_KEY="${AUTH_KEY:-}" +HOSTNAME="${HOSTNAME:-$(hostname -s)}" +TAGS="${TAGS:-}" +ACCEPT_ROUTES="${ACCEPT_ROUTES:-true}" + +# 日志凜数 +log() { + echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" +} + +# 检查是吊已安装 +if command -v tailscale &> /dev/null; then + log "Tailscale 已安装版本: $(tailscale version)" +else + log "正圚安装 Tailscale..." + curl -fsSL https://tailscale.com/install.sh | sh +fi + +# 构建 tailscale up 呜什 +UP_CMD="tailscale up --login-server ${HEADSCALE_URL}" + +if [ -n "$AUTH_KEY" ]; then + UP_CMD="$UP_CMD --authkey $AUTH_KEY" +fi + +if [ -n "$HOSTNAME" ]; then + UP_CMD="$UP_CMD --hostname $HOSTNAME" +fi + +if [ -n "$TAGS" ]; then + UP_CMD="$UP_CMD --advertise-tags $TAGS" +fi + +if [ "$ACCEPT_ROUTES" = "true" ]; then + UP_CMD="$UP_CMD --accept-routes --accept-dns" +fi + +# 执行连接 +log "正圚连接到 Headscale..." +eval $UP_CMD + +# 验证连接 +sleep 5 +if tailscale status | grep -q "100."; then + log "连接成功! IP: $(tailscale ip -4)" +else + log "连接倱莥请检查配眮" + exit 1 +fi +``` + +### 6.2 macOS/Windows 客户端接入 + +#### 6.2.1 macOS + +```bash +# 䜿甚 Homebrew 安装 +brew install tailscale + +# 启劚并连接 +sudo tailscaled & +tailscale up --login-server https://hs.ops.company.com + +# 或䜿甚官方客户端 +# 䞋蜜: https://tailscale.com/download/mac +# 安装后圚讟眮䞭修改 Login Server +``` + +#### 6.2.2 Windows + +```powershell +# 䜿甚 Winget 安装 +winget install tailscale.tailscale + +# 䜿甚 Chocolatey 安装 +choco install tailscale + +# 连接呜什 (PowerShell 管理员) +tailscale up --login-server https://hs.ops.company.com +``` + +### 6.3 移劚讟倇接入 + +1. 从 App Store / Google Play 䞋蜜 Tailscale 官方客户端 +2. 打匀 App点击讟眮囟标 +3. 选择 "Custom coordination server" +4. 蟓入: `https://hs.ops.company.com` +5. 点击 "Log in" 完成讀证 + +### 6.4 预讀证密钥管理 + +```bash +# 创建可重甚的预讀证密钥 (甚于自劚化郚眲) +headscale preauthkeys create \ + --user prod \ + --reusable \ + --expiration 720h \ + --tags tag:prod,tag:automated + +# 创建䞀次性预讀证密钥 +headscale preauthkeys create \ + --user ops-team \ + --expiration 24h + +# 查看所有预讀证密钥 +headscale preauthkeys list --user prod + +# 䜿密钥倱效 +headscale preauthkeys expire --user prod +``` + +### 6.5 Ansible 自劚化郚眲 + +```yaml +# roles/tailscale/tasks/main.yml +--- +- name: Install Tailscale + shell: curl -fsSL https://tailscale.com/install.sh | sh + args: + creates: /usr/bin/tailscale + +- name: Start tailscaled service + systemd: + name: tailscaled + state: started + enabled: yes + +- name: Check if already connected + command: tailscale status + register: ts_status + ignore_errors: yes + changed_when: false + +- name: Connect to Headscale + command: > + tailscale up + --login-server {{ headscale_url }} + --authkey {{ headscale_authkey }} + --hostname {{ inventory_hostname }} + --advertise-tags {{ tailscale_tags | join(',') }} + --accept-routes + --accept-dns + when: ts_status.rc != 0 + +- name: Verify connection + command: tailscale ip -4 + register: ts_ip + changed_when: false + +- name: Display Tailscale IP + debug: + msg: "Tailscale IP: {{ ts_ip.stdout }}" +``` + +--- + +## 7. 访问控制䞎安党策略 + +### 7.1 ACL 策略讟计原则 + +1. **最小权限原则**: 只授予完成工䜜所需的最小权限 +2. **分层隔犻**: 生产/测试/匀发环境䞥栌隔犻 +3. **基于角色**: 运绎/匀发䞍同角色䞍同权限 +4. **审计可远溯**: 所有访问可记圕和远溯 + +### 7.2 诊细 ACL 配眮 + +```json +// /etc/headscale/acl.json +{ + "groups": { + "group:ops-admin": ["user:zhangsan", "user:lisi"], + "group:ops-member": ["user:wangwu", "user:zhaoliu"], + "group:dev-senior": ["user:dev01", "user:dev02"], + "group:dev-junior": ["user:dev03", "user:dev04"], + "group:qa": ["user:qa01", "user:qa02"], + "group:dba": ["user:dba01"] + }, + + "tagOwners": { + "tag:prod": ["group:ops-admin"], + "tag:staging": ["group:ops-admin", "group:ops-member"], + "tag:testing": ["group:ops-admin", "group:qa"], + "tag:dev": ["group:ops-admin", "group:dev-senior"], + "tag:web": ["group:ops-admin"], + "tag:api": ["group:ops-admin"], + "tag:db": ["group:ops-admin", "group:dba"], + "tag:cache": ["group:ops-admin"], + "tag:mq": ["group:ops-admin"], + "tag:k8s": ["group:ops-admin"], + "tag:monitoring": ["group:ops-admin"], + "tag:bastion": ["group:ops-admin"] + }, + + "hosts": { + "prod-bastion": "100.65.100.1", + "staging-bastion": "100.66.100.1", + "monitoring-server": "100.64.0.10", + "jenkins-master": "100.67.100.1" + }, + + "acls": [ + // ===== 基础讟斜规则 ===== + // 所有节点可以访问 DNS + { + "action": "accept", + "src": ["*"], + "dst": ["100.64.0.1:53"] + }, + + // 所有节点可以访问监控系统 + { + "action": "accept", + "src": ["*"], + "dst": ["tag:monitoring:9090,9093,3000"] + }, + + // ===== 运绎管理员规则 ===== + // 运绎管理员可以访问所有环境的所有服务 + { + "action": "accept", + "src": ["group:ops-admin"], + "dst": ["*:*"] + }, + + // ===== 普通运绎规则 ===== + // 普通运绎可以访问非生产环境 + { + "action": "accept", + "src": ["group:ops-member"], + "dst": ["tag:staging:*", "tag:testing:*", "tag:dev:*"] + }, + // 普通运绎只胜通过堡垒机访问生产环境 + { + "action": "accept", + "src": ["group:ops-member"], + "dst": ["tag:bastion:22"] + }, + + // ===== DBA 规则 ===== + // DBA 可以访问所有数据库 + { + "action": "accept", + "src": ["group:dba"], + "dst": ["tag:db:3306,5432,6379,27017"] + }, + // DBA 可以访问堡垒机 + { + "action": "accept", + "src": ["group:dba"], + "dst": ["tag:bastion:22"] + }, + + // ===== 高级匀发规则 ===== + // 高级匀发可以访问匀发、测试和预发垃环境 + { + "action": "accept", + "src": ["group:dev-senior"], + "dst": ["tag:staging:*", "tag:testing:*", "tag:dev:*"] + }, + + // ===== 初级匀发规则 ===== + // 初级匀发只胜访问匀发环境 + { + "action": "accept", + "src": ["group:dev-junior"], + "dst": ["tag:dev:*"] + }, + + // ===== QA 规则 ===== + // QA 可以访问测试和预发垃环境 + { + "action": "accept", + "src": ["group:qa"], + "dst": ["tag:testing:*", "tag:staging:80,443,8080"] + }, + + // ===== 服务闎通信规则 ===== + // 生产环境 Web 服务噚可以访问 API 服务噚 + { + "action": "accept", + "src": ["tag:web"], + "dst": ["tag:api:8080,8443"] + }, + // API 服务噚可以访问数据库和猓存 + { + "action": "accept", + "src": ["tag:api"], + "dst": ["tag:db:3306,5432", "tag:cache:6379", "tag:mq:5672,15672"] + }, + // Kubernetes 集矀内郚通信 + { + "action": "accept", + "src": ["tag:k8s"], + "dst": ["tag:k8s:*"] + }, + + // ===== CI/CD 规则 ===== + // Jenkins 可以访问测试环境进行郚眲 + { + "action": "accept", + "src": ["jenkins-master"], + "dst": ["tag:testing:22,80,443,8080"] + }, + + // ===== 默讀拒绝规则 (隐含) ===== + ], + + // SSH 规则 (控制 Tailscale SSH) + "ssh": [ + { + "action": "accept", + "src": ["group:ops-admin"], + "dst": ["*"], + "users": ["root", "ubuntu", "centos"] + }, + { + "action": "accept", + "src": ["group:ops-member"], + "dst": ["tag:staging", "tag:testing", "tag:dev"], + "users": ["ubuntu", "centos"] + } + ], + + // 测试规则 (甚于调试) + "tests": [ + { + "src": "user:zhangsan", + "accept": ["tag:prod:22", "tag:db:3306"] + }, + { + "src": "user:dev01", + "accept": ["tag:dev:*"], + "deny": ["tag:prod:*"] + } + ] +} +``` + +### 7.3 标筟管理 + +```bash +# 䞺节点添加标筟 +headscale nodes tag -i -t "tag:prod,tag:web" + +# 查看节点标筟 +headscale nodes list + +# 批量曎新标筟 (通过 API) +curl -X POST https://hs.ops.company.com/api/v1/machine//tags \ + -H "Authorization: Bearer " \ + -H "Content-Type: application/json" \ + -d '{"tags": ["tag:prod", "tag:web", "tag:bj"]}' +``` + +### 7.4 安党加固措斜 + +#### 7.4.1 Headscale 服务噚加固 + +```bash +# 1. 防火墙配眮 +ufw default deny incoming +ufw default allow outgoing +ufw allow from 10.0.0.0/8 to any port 22 # SSH 仅允讞内眑 +ufw allow 80/tcp # HTTP 重定向 +ufw allow 443/tcp # HTTPS +ufw allow 50443/tcp # gRPC (劂需芁) +ufw enable + +# 2. fail2ban 配眮 +apt install -y fail2ban +cat > /etc/fail2ban/jail.local << 'EOF' +[sshd] +enabled = true +port = ssh +filter = sshd +logpath = /var/log/auth.log +maxretry = 3 +bantime = 3600 +findtime = 600 + +[headscale] +enabled = true +port = 443 +filter = headscale +logpath = /var/log/headscale/headscale.log +maxretry = 5 +bantime = 3600 +findtime = 600 +EOF + +# 3. 犁甚密码登圕 +sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config +systemctl restart sshd + +# 4. 定期曎新 +apt update && apt upgrade -y +``` + +#### 7.4.2 客户端安党配眮 + +```bash +# 限制 Tailscale 眑络接口的路由 +tailscale up \ + --shields-up \ # 默讀拒绝入站连接 + --accept-routes=false \ # 䞍接受其他节点的路由广播 + --advertise-routes="" \ # 䞍广播本地路由 + --exit-node="" # 䞍䜿甚出口节点 +``` + +--- + +## 8. DNS 䞎服务发现 + +### 8.1 MagicDNS 配眮 + +Headscale 内眮的 MagicDNS 提䟛自劚的服务发现胜力 + +```yaml +# config.yaml DNS 郚分 +dns: + magic_dns: true + base_domain: ts.company.local + nameservers: + global: + - 10.0.0.1 # 公叞内郚 DNS + - 223.5.5.5 # 阿里 DNS + restricted: + internal.company.com: + - 10.0.0.1 + aws.internal: + - 169.254.169.253 + search_domains: + - ts.company.local + - company.local + extra_records: + - name: "grafana" + type: "A" + value: "100.64.0.10" + - name: "prometheus" + type: "A" + value: "100.64.0.11" + - name: "jenkins" + type: "A" + value: "100.67.100.1" + - name: "gitlab" + type: "CNAME" + value: "prod-gitlab-bj-001" +``` + +### 8.2 DNS 解析规则 + +启甚 MagicDNS 后域名解析规则劂䞋 + +| 域名栌匏 | 解析目标 | 瀺䟋 | +|---------|---------|------| +| `` | 盎接解析 | `prod-web-bj-001` → `100.65.1.1` | +| `.` | 垊呜名空闎 | `prod-web-bj-001.prod` | +| `.` | 完敎域名 | `prod-web-bj-001.ts.company.local` | +| 自定义记圕 | extra_records | `grafana` → `100.64.0.10` | + +### 8.3 Split DNS 配眮 + +针对特定域名䜿甚特定 DNS 服务噚 + +```yaml +dns: + nameservers: + restricted: + # AWS 内郚域名䜿甚 AWS DNS + "compute.internal": + - 169.254.169.253 + "ec2.internal": + - 169.254.169.253 + # 阿里云内郚域名 + "alibaba-inc.com": + - 100.100.2.136 + - 100.100.2.138 + # 公叞内郚域名 + "company.internal": + - 10.0.0.1 + - 10.0.0.2 +``` + +### 8.4 服务发现集成 + +#### 8.4.1 侎 Consul 集成 + +```hcl +# consul-config.hcl +services { + id = "web-prod-001" + name = "web" + tags = ["prod", "tailscale"] + port = 80 + + checks = [ + { + http = "http://prod-web-bj-001.ts.company.local/health" + interval = "10s" + timeout = "2s" + } + ] +} +``` + +#### 8.4.2 侎 Kubernetes CoreDNS 集成 + +```yaml +# coredns-configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: coredns + namespace: kube-system +data: + Corefile: | + .:53 { + errors + health + kubernetes cluster.local in-addr.arpa ip6.arpa { + pods insecure + fallthrough in-addr.arpa ip6.arpa + } + # 蜬发 Tailscale 域名到 MagicDNS + forward ts.company.local 100.100.100.100 { + policy sequential + } + forward . /etc/resolv.conf + cache 30 + loop + reload + loadbalance + } +``` + +--- + +## 9. 监控䞎告譊 + +### 9.1 监控架构 + +``` +┌─────────────────────────────────────────────────────────────────┐ +│ Grafana Dashboard │ +│ (hs-monitor.ops.company.com) │ +└──────────────────────────────┬──────────────────────────────────┘ + │ + ┌─────────────┮─────────────┐ + │ Prometheus │ + │ (100.64.0.11:9090) │ + └─────────────┬─────────────┘ + │ + ┌───────────────┬───────┎───────┬───────────────┐ + │ │ │ │ + â–Œ â–Œ â–Œ â–Œ +┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ +│ Headscale │ │ DERP │ │ Tailscale │ │ System │ +│ Metrics │ │ Metrics │ │ Metrics │ │ Metrics │ +│ :9090 │ │ :8080 │ │ (via API) │ │ (node_exp) │ +└─────────────┘ └─────────────┘ └─────────────┘ └─────────────┘ +``` + +### 9.2 Prometheus 配眮 + +```yaml +# /etc/prometheus/prometheus.yml +global: + scrape_interval: 15s + evaluation_interval: 15s + +alerting: + alertmanagers: + - static_configs: + - targets: + - alertmanager:9093 + +rule_files: + - "/etc/prometheus/rules/*.yml" + +scrape_configs: + # Headscale 指标 + - job_name: 'headscale' + static_configs: + - targets: ['100.64.0.1:9090'] + metrics_path: /metrics + relabel_configs: + - source_labels: [__address__] + target_label: instance + replacement: headscale-primary + + # DERP 服务噚指标 + - job_name: 'derp' + static_configs: + - targets: + - 'derp-bj.ops.company.com:8080' + - 'derp-sh.ops.company.com:8080' + - 'derp-hk.ops.company.com:8080' + + # PostgreSQL 指标 + - job_name: 'postgresql' + static_configs: + - targets: ['100.64.0.2:9187'] + + # 所有 Tailscale 节点 (䜿甚服务发现) + - job_name: 'tailscale-nodes' + file_sd_configs: + - files: + - '/etc/prometheus/tailscale_nodes.json' + refresh_interval: 5m +``` + +### 9.3 关键监控指标 + +#### 9.3.1 Headscale 指标 + +| 指标名称 | 类型 | 诎明 | 告譊阈倌 | +|---------|-----|------|---------| +| `headscale_connected_nodes` | Gauge | 已连接节点数 | < 预期节点数 * 0.9 | +| `headscale_api_requests_total` | Counter | API 请求总数 | - | +| `headscale_api_request_duration_seconds` | Histogram | API 响应时闎 | P99 > 1s | +| `headscale_db_query_duration_seconds` | Histogram | 数据库查询时闎 | P99 > 500ms | + +#### 9.3.2 DERP 指标 + +| 指标名称 | 类型 | 诎明 | 告譊阈倌 | +|---------|-----|------|---------| +| `derp_connections` | Gauge | 圓前连接数 | > 10000 | +| `derp_bytes_sent_total` | Counter | 发送字节数 | 突增 > 200% | +| `derp_bytes_received_total` | Counter | 接收字节数 | 突增 > 200% | +| `derp_home_connections` | Gauge | Home 连接数 | - | + +#### 9.3.3 节点健康指标 + +| 指标名称 | 类型 | 诎明 | 告譊阈倌 | +|---------|-----|------|---------| +| `tailscale_up` | Gauge | 节点圚线状态 | = 0 | +| `tailscale_derp_latency_seconds` | Gauge | DERP 延迟 | > 200ms | +| `tailscale_peer_count` | Gauge | 对等节点数 | = 0 | + +### 9.4 告譊规则配眮 + +```yaml +# /etc/prometheus/rules/headscale.yml +groups: + - name: headscale + interval: 30s + rules: + # Headscale 服务䞍可甚 + - alert: HeadscaleDown + expr: up{job="headscale"} == 0 + for: 1m + labels: + severity: critical + annotations: + summary: "Headscale 控制平面䞍可甚" + description: "Headscale 服务已犻线超过1分钟" + + # 节点倧量犻线 + - alert: TailscaleNodesMassOffline + expr: | + (count(tailscale_up == 0) / count(tailscale_up)) > 0.1 + for: 5m + labels: + severity: warning + annotations: + summary: "超过10%的节点犻线" + description: "{{ $value | humanizePercentage }} 的节点圓前犻线" + + # API 响应慢 + - alert: HeadscaleAPILatencyHigh + expr: | + histogram_quantile(0.99, rate(headscale_api_request_duration_seconds_bucket[5m])) > 1 + for: 10m + labels: + severity: warning + annotations: + summary: "Headscale API 响应延迟过高" + description: "API P99 延迟: {{ $value | humanizeDuration }}" + + # 数据库连接问题 + - alert: HeadscaleDatabaseConnectionIssues + expr: | + rate(headscale_db_errors_total[5m]) > 0.1 + for: 5m + labels: + severity: critical + annotations: + summary: "Headscale 数据库连接匂垞" + description: "数据库错误率: {{ $value }}/s" + + - name: derp + rules: + # DERP 服务䞍可甚 + - alert: DERPServerDown + expr: up{job="derp"} == 0 + for: 2m + labels: + severity: critical + annotations: + summary: "DERP 䞭继服务噚䞍可甚" + description: "{{ $labels.instance }} DERP 服务已犻线" + + # DERP 连接数过高 + - alert: DERPConnectionsHigh + expr: derp_connections > 8000 + for: 10m + labels: + severity: warning + annotations: + summary: "DERP 连接数接近䞊限" + description: "{{ $labels.instance }} 圓前连接数: {{ $value }}" + + - name: nodes + rules: + # 单䞪节点犻线 + - alert: TailscaleNodeDown + expr: tailscale_up == 0 + for: 5m + labels: + severity: warning + annotations: + summary: "Tailscale 节点犻线" + description: "节点 {{ $labels.hostname }} 已犻线超过5分钟" + + # 生产环境节点犻线 (曎䞥栌) + - alert: ProductionNodeDown + expr: tailscale_up{env="prod"} == 0 + for: 2m + labels: + severity: critical + annotations: + summary: "生产环境节点犻线" + description: "生产节点 {{ $labels.hostname }} 已犻线" + + # 节点无法建立盎连 + - alert: TailscaleNoPeerConnection + expr: tailscale_peer_count == 0 and tailscale_up == 1 + for: 10m + labels: + severity: warning + annotations: + summary: "节点无法建立 P2P 连接" + description: "节点 {{ $labels.hostname }} 无法䞎其他节点建立盎接连接" +``` + +### 9.5 Grafana 仪衚板 + +创建以䞋仪衚板 + +1. **Headscale Overview** + - 总节点数、圚线节点数、犻线节点数 + - API 请求 QPS 和延迟 + - 数据库连接状态 + +2. **DERP Network** + - 各 DERP 服务噚连接数 + - 流量统计 (发送/接收) + - 区域分垃 + +3. **Node Health** + - 节点圚线状态矩阵 + - 各节点延迟热力囟 + - 节点流量统计 + +4. **ACL Audit** + - 访问拒绝事件 + - 规则呜䞭统计 + - 匂垞访问暡匏 + +--- + +## 10. 运绎管理规范 + +### 10.1 日垞运绎操䜜 + +#### 10.1.1 甚户管理 + +```bash +# 创建甚户 (呜名空闎) +headscale users create prod +headscale users create staging +headscale users create dev + +# 查看甚户列衚 +headscale users list + +# 删陀甚户 (谚慎操䜜) +headscale users destroy dev +``` + +#### 10.1.2 节点管理 + +```bash +# 列出所有节点 +headscale nodes list + +# 列出特定甚户的节点 +headscale nodes list --user prod + +# 查看节点诊情 +headscale nodes list --identifier prod-web-bj-001 + +# 删陀节点 +headscale nodes delete --identifier + +# 重呜名节点 +headscale nodes rename --identifier --name new-hostname + +# 移劚节点到其他甚户 +headscale nodes move --identifier --user staging + +# 讟眮节点过期时闎 +headscale nodes expire --identifier +``` + +#### 10.1.3 路由管理 + +```bash +# 查看所有路由 +headscale routes list + +# 启甚路由 +headscale routes enable --route + +# 犁甚路由 +headscale routes disable --route + +# 删陀路由 +headscale routes delete --route +``` + +#### 10.1.4 API Key 管理 + +```bash +# 创建 API Key +headscale apikeys create --expiration 90d + +# 列出 API Keys +headscale apikeys list + +# 䜿 API Key 过期 +headscale apikeys expire --prefix +``` + +### 10.2 运绎脚本工具 + +#### 10.2.1 节点健康检查脚本 + +```bash +#!/bin/bash +# /opt/scripts/check-tailscale-health.sh + +HEADSCALE_URL="https://hs.ops.company.com" +API_KEY="your_api_key" +ALERT_WEBHOOK="https://webhook.ops.company.com/alert" + +# 获取所有节点 +nodes=$(curl -s -H "Authorization: Bearer $API_KEY" \ + "${HEADSCALE_URL}/api/v1/machine" | jq -r '.machines[]') + +# 检查犻线节点 +offline_nodes=$(echo "$nodes" | jq -r 'select(.online == false) | .givenName') + +if [ -n "$offline_nodes" ]; then + # 发送告譊 + curl -X POST "$ALERT_WEBHOOK" \ + -H "Content-Type: application/json" \ + -d "{\"text\": \"[Tailscale] 以䞋节点犻线:\\n$offline_nodes\"}" +fi + +# 检查即将过期的节点 +expiring_nodes=$(echo "$nodes" | jq -r \ + 'select(.expiry != "0001-01-01T00:00:00Z") | + select((.expiry | fromdateiso8601) < (now + 604800)) | + .givenName + " (expires: " + .expiry + ")"') + +if [ -n "$expiring_nodes" ]; then + curl -X POST "$ALERT_WEBHOOK" \ + -H "Content-Type: application/json" \ + -d "{\"text\": \"[Tailscale] 以䞋节点即将过期:\\n$expiring_nodes\"}" +fi +``` + +#### 10.2.2 批量节点管理脚本 + +```python +#!/usr/bin/env python3 +# /opt/scripts/headscale-manager.py + +import requests +import argparse +import json +from datetime import datetime, timedelta + +class HeadscaleManager: + def __init__(self, url, api_key): + self.url = url.rstrip('/') + self.headers = { + 'Authorization': f'Bearer {api_key}', + 'Content-Type': 'application/json' + } + + def get_nodes(self, user=None): + """获取节点列衚""" + params = {} + if user: + params['user'] = user + + resp = requests.get( + f'{self.url}/api/v1/machine', + headers=self.headers, + params=params + ) + return resp.json().get('machines', []) + + def get_offline_nodes(self, threshold_hours=1): + """获取犻线节点""" + nodes = self.get_nodes() + offline = [] + + threshold = datetime.utcnow() - timedelta(hours=threshold_hours) + + for node in nodes: + if not node.get('online', False): + last_seen = datetime.fromisoformat( + node['lastSeen'].replace('Z', '+00:00') + ) + if last_seen < threshold.replace(tzinfo=last_seen.tzinfo): + offline.append(node) + + return offline + + def bulk_tag_nodes(self, node_ids, tags): + """批量讟眮节点标筟""" + results = [] + for node_id in node_ids: + resp = requests.post( + f'{self.url}/api/v1/machine/{node_id}/tags', + headers=self.headers, + json={'tags': tags} + ) + results.append({ + 'node_id': node_id, + 'success': resp.status_code == 200 + }) + return results + + def cleanup_expired_nodes(self, dry_run=True): + """枅理过期节点""" + nodes = self.get_nodes() + expired = [] + + for node in nodes: + expiry = node.get('expiry') + if expiry and expiry != '0001-01-01T00:00:00Z': + expiry_dt = datetime.fromisoformat(expiry.replace('Z', '+00:00')) + if expiry_dt < datetime.utcnow().replace(tzinfo=expiry_dt.tzinfo): + expired.append(node) + + if not dry_run: + for node in expired: + requests.delete( + f'{self.url}/api/v1/machine/{node["id"]}', + headers=self.headers + ) + + return expired + +if __name__ == '__main__': + parser = argparse.ArgumentParser(description='Headscale 管理工具') + parser.add_argument('--url', required=True, help='Headscale URL') + parser.add_argument('--api-key', required=True, help='API Key') + parser.add_argument('action', choices=['list', 'offline', 'cleanup']) + parser.add_argument('--user', help='过滀甚户') + parser.add_argument('--dry-run', action='store_true', help='试运行暡匏') + + args = parser.parse_args() + + manager = HeadscaleManager(args.url, args.api_key) + + if args.action == 'list': + nodes = manager.get_nodes(args.user) + print(json.dumps(nodes, indent=2)) + elif args.action == 'offline': + offline = manager.get_offline_nodes() + print(f"犻线节点数: {len(offline)}") + for node in offline: + print(f" - {node['givenName']} (last seen: {node['lastSeen']})") + elif args.action == 'cleanup': + expired = manager.cleanup_expired_nodes(dry_run=args.dry_run) + print(f"过期节点数: {len(expired)}") + for node in expired: + print(f" - {node['givenName']} (expired: {node['expiry']})") +``` + +### 10.3 日志管理 + +```bash +# Headscale 日志䜍眮 +/var/log/headscale/headscale.log + +# 日志蜮蜬配眮 +cat > /etc/logrotate.d/headscale << 'EOF' +/var/log/headscale/*.log { + daily + rotate 30 + compress + delaycompress + missingok + notifempty + create 0640 headscale headscale + sharedscripts + postrotate + systemctl reload headscale > /dev/null 2>&1 || true + endscript +} +EOF + +# 结构化日志查询 (JSON 栌匏) +cat /var/log/headscale/headscale.log | jq 'select(.level == "error")' +``` + +### 10.4 倇仜䞎恢倍 + +#### 10.4.1 数据库倇仜 + +```bash +#!/bin/bash +# /opt/scripts/backup-headscale.sh + +BACKUP_DIR="/backup/headscale" +DATE=$(date +%Y%m%d_%H%M%S) +RETENTION_DAYS=30 + +# PostgreSQL 倇仜 +pg_dump -h localhost -U headscale -d headscale -F c \ + -f "${BACKUP_DIR}/headscale_${DATE}.dump" + +# 配眮文件倇仜 +tar -czf "${BACKUP_DIR}/config_${DATE}.tar.gz" \ + /etc/headscale/config.yaml \ + /etc/headscale/acl.json \ + /etc/headscale/derp.json \ + /var/lib/headscale/private.key \ + /var/lib/headscale/noise_private.key + +# 枅理旧倇仜 +find "${BACKUP_DIR}" -type f -mtime +${RETENTION_DAYS} -delete + +# 䞊䌠到 S3 (可选) +aws s3 sync "${BACKUP_DIR}/" s3://backup-bucket/headscale/ +``` + +#### 10.4.2 数据恢倍 + +```bash +#!/bin/bash +# /opt/scripts/restore-headscale.sh + +BACKUP_FILE=$1 + +# 停止服务 +systemctl stop headscale + +# 恢倍数据库 +pg_restore -h localhost -U headscale -d headscale -c "${BACKUP_FILE}" + +# 恢倍配眮 +tar -xzf "${BACKUP_FILE%.dump}_config.tar.gz" -C / + +# 重启服务 +systemctl start headscale + +# 验证 +headscale nodes list +``` + +### 10.5 版本升级流皋 + +```bash +#!/bin/bash +# /opt/scripts/upgrade-headscale.sh + +NEW_VERSION=$1 +BACKUP_DIR="/backup/headscale/upgrade" + +echo "匀始升级 Headscale 到版本 ${NEW_VERSION}" + +# 1. 倇仜圓前版本 +echo "倇仜圓前配眮和数据..." +./backup-headscale.sh + +# 2. 䞋蜜新版本 +echo "䞋蜜新版本..." +wget -O /tmp/headscale_new.deb \ + "https://github.com/juanfont/headscale/releases/download/v${NEW_VERSION}/headscale_${NEW_VERSION}_linux_amd64.deb" + +# 3. 停止服务 +echo "停止 Headscale 服务..." +systemctl stop headscale + +# 4. 安装新版本 +echo "安装新版本..." +dpkg -i /tmp/headscale_new.deb + +# 5. 数据库迁移 (劂果需芁) +echo "执行数据库迁移..." +headscale serve --config /etc/headscale/config.yaml --migrate-only + +# 6. 启劚服务 +echo "启劚服务..." +systemctl start headscale + +# 7. 验证 +echo "验证升级..." +sleep 5 +headscale version +headscale nodes list | head -5 + +echo "升级完成!" +``` + +--- + +## 11. 故障恢倍䞎灟倇 + +### 11.1 故障场景䞎恢倍方案 + +#### 11.1.1 Headscale 䞻节点故障 + +**圱响范囎** +- 新节点无法加入眑络 +- 无法曎新 ACL 策略 +- 已连接节点正垞通信 (P2P 盎连) + +**恢倍步骀** + +```bash +# 1. 确讀䞻节点故障 +systemctl status headscale +curl -s https://hs.ops.company.com/health + +# 2. 切换到倇甚节点 +# 圚倇甚节点䞊修改 DNS 或莟蜜均衡噚配眮 + +# 3. 劂果是数据库问题切换到从库 +# 修改 config.yaml 䞭的数据库连接 + +# 4. 重启服务 +systemctl restart headscale + +# 5. 验证服务恢倍 +headscale nodes list +``` + +#### 11.1.2 PostgreSQL 数据库故障 + +**恢倍步骀** + +```bash +# 1. 劂果䞻库故障提升从库 +# 圚从库执行 +sudo -u postgres pg_ctl promote -D /var/lib/postgresql/15/main + +# 2. 曎新 Headscale 配眮指向新䞻库 +sed -i 's/old_primary_ip/new_primary_ip/' /etc/headscale/config.yaml + +# 3. 重启 Headscale +systemctl restart headscale + +# 4. 重建从库 +# 䜿甚 pg_basebackup 从新䞻库同步 +``` + +#### 11.1.3 DERP 䞭继服务噚故障 + +**圱响范囎** +- 无法 NAT 穿透的节点将倱去连接 +- 可盎连的节点䞍受圱响 + +**恢倍步骀** + +```bash +# 1. 检查 DERP 服务状态 +systemctl status derper +curl -s https://derp-bj.ops.company.com/derp/probe + +# 2. 劂果无法恢倍从 DERP Map 䞭移陀该节点 +# 猖蟑 /etc/headscale/derp.json移陀故障节点 + +# 3. 等埅客户端自劚切换到其他 DERP +# 或手劚区制刷新 +tailscale netcheck +``` + +#### 11.1.4 完党灟隟恢倍 + +```bash +# 1. 准倇新服务噚 + +# 2. 从倇仜恢倍数据库 +pg_restore -h localhost -U headscale -d headscale /backup/latest.dump + +# 3. 恢倍配眮文件 +tar -xzf /backup/config_latest.tar.gz -C / + +# 4. 安装 Headscale +dpkg -i headscale_latest.deb + +# 5. 启劚服务 +systemctl start headscale + +# 6. 曎新 DNS 指向新服务噚 + +# 7. 验证所有节点重新连接 +watch 'headscale nodes list | grep -c Online' +``` + +### 11.2 RTO 和 RPO 目标 + +| 场景 | RTO (恢倍时闎目标) | RPO (数据恢倍点目标) | +|------|-------------------|---------------------| +| Headscale 单点故障 | < 5 分钟 | 0 (热倇接管) | +| 数据库故障 | < 15 分钟 | < 1 分钟 (同步倍制) | +| DERP 故障 | 自劚切换 | N/A | +| 完党灟隟 | < 2 小时 | < 24 小时 | + +### 11.3 定期挔练 + +建议每季床进行䞀次故障挔练 + +1. **挔练内容** + - 䞻倇切换 + - 数据库故障蜬移 + - 从倇仜恢倍 + - ACL 策略回滚 + +2. **挔练记圕** + - 挔练时闎和参䞎人员 + - 实际恢倍时闎 + - 发现的问题和改进措斜 + +--- + +## 12. 实斜计划䞎里皋碑 + +### 12.1 实斜阶段 + +#### 第䞀阶段基础讟斜准倇 + +| 任务 | 莟莣人 | 前眮条件 | 亀付物 | +|------|--------|---------|--------| +| 服务噚资源申请 | 运绎 | 预算审批 | 服务噚枅单 | +| 域名和证乊准倇 | 运绎 | 域名莭买 | SSL 证乊 | +| PostgreSQL 高可甚郚眲 | DBA | 服务噚就绪 | 数据库集矀 | +| 眑络规划确讀 | 眑络组 | - | IP 规划文档 | + +#### 第二阶段栞心服务郚眲 + +| 任务 | 莟莣人 | 前眮条件 | 亀付物 | +|------|--------|---------|--------| +| Headscale 䞻节点郚眲 | 运绎 | PostgreSQL 就绪 | 服务运行 | +| Headscale 倇节点配眮 | 运绎 | 䞻节点就绪 | 䞻倇切换测试 | +| DERP 䞭继服务噚郚眲 | 运绎 | 服务噚就绪 | 倚区域 DERP | +| ACL 策略配眮 | 安党组 | 服务运行 | ACL 文件 | +| 监控告譊郚眲 | 运绎 | 服务运行 | Grafana 仪衚板 | + +#### 第䞉阶段节点接入 + +| 任务 | 莟莣人 | 前眮条件 | 亀付物 | +|------|--------|---------|--------| +| 测试环境接入 | 运绎 | 服务就绪 | 测试节点圚线 | +| 预发垃环境接入 | 运绎 | 测试通过 | 预发垃节点圚线 | +| 生产环境接入 (批次1) | 运绎 | 预发垃验证 | 銖批生产节点 | +| 生产环境接入 (批次2-N) | 运绎 | 批次1成功 | 党郚生产节点 | +| 运绎人员讟倇接入 | 运绎 | 生产皳定 | 运绎讟倇圚线 | +| 匀发人员讟倇接入 | 匀发组长 | 运绎验证 | 匀发讟倇圚线 | + +#### 第四阶段验收䞎亀接 + +| 任务 | 莟莣人 | 前眮条件 | 亀付物 | +|------|--------|---------|--------| +| 功胜验收测试 | QA | 党郚接入 | 验收报告 | +| 性胜压力测试 | 性胜组 | 功胜验收 | 性胜报告 | +| 故障挔练 | 运绎 | 验收通过 | 挔练记圕 | +| 文档亀付 | 运绎 | 挔练通过 | 运绎手册 | +| 培训亀接 | 运绎 | 文档完成 | 培训记圕 | + +### 12.2 里皋碑 + +``` +┌─────────────────────────────────────────────────────────────────────────────┐ +│ 实斜时闎线 │ +├────────────────────────────────────────────────────────────────────────────── +│ │ +│ M1: 基础讟斜就绪 │ +│ ├── PostgreSQL HA 郚眲完成 │ +│ ├── 域名/证乊准倇完成 │ +│ └── 眑络规划确讀 │ +│ │ +│ M2: 栞心服务䞊线 │ +│ ├── Headscale 䞻倇节点运行 │ +│ ├── DERP 倚区域郚眲 │ +│ ├── 监控告譊就绪 │ +│ └── ACL 策略配眮完成 │ +│ │ +│ M3: 测试验证完成 │ +│ ├── 测试环境党郚接入 │ +│ ├── 预发垃环境接入 │ +│ └── 功胜验收通过 │ +│ │ +│ M4: 生产环境迁移完成 │ +│ ├── 生产服务噚党郚接入 │ +│ ├── 旧 VPN 方案䞋线 │ +│ └── 运绎讟倇接入 │ +│ │ +│ M5: 项目验收 │ +│ ├── 故障挔练通过 │ +│ ├── 培训亀接完成 │ +│ └── 项目正匏结项 │ +│ │ +└─────────────────────────────────────────────────────────────────────────────┘ +``` + +### 12.3 验收标准 + +| 验收项 | 验收标准 | 验收方法 | +|--------|---------|---------| +| 眑络连通性 | 任意䞀节点可互通 | ping/traceroute 测试 | +| 连接延迟 | 同区域 P2P < 10ms | Tailscale ping | +| 服务可甚性 | 99.9% 可甚率 | 监控数据 | +| ACL 生效 | 策略笊合讟计 | 安党扫描 | +| 故障恢倍 | RTO < 目标时闎 | 故障挔练 | +| 性胜指标 | 支持 1000+ 节点 | 压力测试 | + +--- + +## 13. 风险评䌰䞎应对 + +### 13.1 风险矩阵 + +| 风险项 | 可胜性 | 圱响 | 风险等级 | 应对措斜 | +|--------|-------|-----|---------|---------| +| Headscale 版本䞍皳定 | äž­ | 高 | 高 | 充分测试制定回滚方案 | +| 眑络穿透倱莥率高 | äž­ | äž­ | äž­ | 郚眲倚区域 DERP | +| 密钥泄露 | 䜎 | 极高 | 高 | 密钥管理定期蜮换 | +| 性胜瓶颈 | äž­ | äž­ | äž­ | 监控预譊容量规划 | +| 运绎人员技胜䞍足 | äž­ | äž­ | äž­ | 培训文档完善 | +| 䞎现有系统冲突 | 䜎 | äž­ | 䜎 | 充分测试分批䞊线 | + +### 13.2 回滚方案 + +#### 13.2.1 服务端回滚 + +```bash +# 1. 停止新版本服务 +systemctl stop headscale + +# 2. 恢倍旧版本 +dpkg -i /backup/headscale_old.deb + +# 3. 恢倍配眮 +cp /backup/config_old.yaml /etc/headscale/config.yaml + +# 4. 劂需回滚数据库 +pg_restore -h localhost -U headscale -d headscale -c /backup/db_old.dump + +# 5. 重启服务 +systemctl start headscale +``` + +#### 13.2.2 客户端回滚 + +```bash +# 断匀 Headscale 连接 +tailscale down + +# 恢倍原有 VPN 配眮 +# (根据原有 VPN 方案操䜜) +``` + +### 13.3 应急联系人 + +| 角色 | 姓名 | 联系方匏 | 职莣 | +|------|-----|---------|-----| +| 项目莟莣人 | xxx | 138xxxxxxxx | 决策、协调 | +| 技术莟莣人 | xxx | 139xxxxxxxx | 技术方案 | +| 运绎莟莣人 | xxx | 137xxxxxxxx | 郚眲实斜 | +| DBA | xxx | 136xxxxxxxx | 数据库运绎 | +| 安党莟莣人 | xxx | 135xxxxxxxx | 安党评审 | + +--- + +## 14. 附圕 + +### 14.1 术语衚 + +| 术语 | 解释 | +|------|-----| +| Headscale | Tailscale 的匀源自托管控制服务噚 | +| Tailscale | 基于 WireGuard 的零配眮 VPN 方案 | +| WireGuard | 现代化的 VPN 协议 | +| DERP | Designated Encrypted Relay for Packets加密䞭继协议 | +| MagicDNS | Tailscale 的自劚 DNS 服务 | +| ACL | Access Control List访问控制列衚 | +| PreAuth Key | 预讀证密钥甚于无亀互接入 | +| Mesh Network | 眑状眑络节点闎可盎接通信 | +| NAT Traversal | NAT 穿透技术 | +| STUN | Session Traversal Utilities for NAT | + +### 14.2 参考文档 + +- [Headscale 官方文档](https://headscale.net/) +- [Tailscale 官方文档](https://tailscale.com/docs/) +- [WireGuard 官方眑站](https://www.wireguard.com/) +- [Headscale GitHub](https://github.com/juanfont/headscale) + +### 14.3 垞甚呜什速查 + +```bash +# Headscale 服务管理 +systemctl start|stop|restart|status headscale + +# 甚户管理 +headscale users list +headscale users create +headscale users destroy + +# 节点管理 +headscale nodes list +headscale nodes delete -i +headscale nodes expire -i +headscale nodes rename -i -n +headscale nodes tag -i -t + +# 预讀证密钥 +headscale preauthkeys create --user --expiration 24h +headscale preauthkeys list --user + +# 路由管理 +headscale routes list +headscale routes enable -r + +# API Key +headscale apikeys create --expiration 90d +headscale apikeys list + +# Tailscale 客户端 +tailscale up --login-server +tailscale down +tailscale status +tailscale ip +tailscale ping +tailscale netcheck +``` + +### 14.4 配眮暡板 + +配眮暡板文件䜍于 +- `/opt/templates/headscale/config.yaml.tmpl` +- `/opt/templates/headscale/acl.json.tmpl` +- `/opt/templates/derp/docker-compose.yml.tmpl` + +### 14.5 变曎记圕 + +| 版本 | 日期 | 变曎内容 | 变曎人 | +|------|-----|---------|--------| +| v1.0 | 2025-12-15 | 初皿 | xxx | +| v2.0 | 2025-12-18 | 诊细讟计完善 | AI Assistant | + +--- + +> **文档绎技诎明**: 本文档应随着项目进展持续曎新每次重倧变曎需记圕圚变曎记圕䞭。 diff --git a/encrypt-page.js b/encrypt-page.js new file mode 100644 index 0000000..21efec9 --- /dev/null +++ b/encrypt-page.js @@ -0,0 +1,42 @@ +const crypto = require('crypto'); +const fs = require('fs'); + +// 读取原始 HTML +const originalHtml = fs.readFileSync('nav-home.html', 'utf8'); + +// 提取 body 内容从 到  +const bodyMatch = originalHtml.match(/]*>([\s\S]*)<\/body>/); +const bodyContent = bodyMatch ? bodyMatch[1] : ''; + +// 提取 style 内容 +const styleMatch = originalHtml.match(/