腾讯云轻量Docker部署单节点MinIO

腾讯云轻量Docker部署单节点MinIO

前言

因为腾讯云最近新推出了轻量应用服务器的云硬盘,相对于CVM的云硬盘性能几乎一模一样,而且因为上新做活动3年的1TB云硬盘只要59.7元,直接让轻量变身超级大盘鸡,我就寻思着能不能拿这硬盘整点花活,正巧听说了有个开源且成熟的对象储存系统MinIO,索性就拿来试试水……

点此前往腾讯云新春采购活动(云硬盘活动老用户也能参加):https://curl.qcloud.com/pUJXIiix

首先系统选择的是Debian 11.1

MinIO offers high-performance, S3 compatible object storage.
Native to Kubernetes, MinIO is the only object storage suite available on
every public cloud, every Kubernetes distribution, the private cloud and the
edge. MinIO is software-defined and is 100% open source under GNU AGPL v3.

Docker安装

安装docker,这里使用官方的安装脚本,安装源为阿里云

curl -fsSL https://get.docker.com | bash -s docker --mirror Aliyun

Docker安装MinIO

docker run -d --restart=always\
  -p 9000:9000 \
  -p 9001:9001 \
  --name minio1 \
  -v /home/minio/data:/data \
  -e "MINIO_ROOT_USER=Your_Login_User_Name" \
  -e "MINIO_ROOT_PASSWORD=Your_Login_User_Password" \
  quay.io/minio/minio server /data --console-address ":9001"

在执行完成后,浏览器访问服务器IP地址:9001即可登录MinIO的Web控制台

反向代理

安装Nginx,可以随个人喜好,这里我直接安装在本机环境内了

apt install -y openssl libssl-dev libpcre3 libpcre3-dev
wget http://nginx.org/download/nginx-1.21.6.tar.gz
tar -xvzf nginx-1.21.6.tar.gz
cd nginx-1.21.6
./configure --user=www --group=www --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --with-http_sub_module --with-stream --with-stream_ssl_module --with-http_realip_module --with-http_gzip_static_module
make instll
ln -s /usr/local/nginx/sbin/nginx /usr/bin/nginx

配置Systemd守护

vi /usr/lib/systemd/system/nginx.service
[Unit]
Description=nginx - high performance web server 
Documentation=http://nginx.org/en/docs/
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
PIDFile=/usr/local/nginx/logs/nginx.pid
ExecStartPre=/usr/local/nginx/sbin/nginx -t -c /usr/local/nginx/conf/nginx.conf
ExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s QUIT $MAINPID
PrivateTmp=true

[Install]
WantedBy=multi-user.target

启动Nginx

systemctl start nginx

编辑NGINX反向代理配置文件(默认)

server {
 listen 80;
 server_name example.com;

 # To allow special characters in headers
 ignore_invalid_headers off;
 # Allow any size file to be uploaded.
 # Set to a value such as 1000m; to restrict file size to a specific value
 client_max_body_size 0;
 # To disable buffering
 proxy_buffering off;

 location / {
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header Host $http_host;

   proxy_connect_timeout 300;
   # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
   proxy_http_version 1.1;
   proxy_set_header Connection "";
   chunked_transfer_encoding off;

   proxy_pass http://localhost:9000; # If you are using docker-compose this would be the hostname i.e. minio
   # Health Check endpoint might go here. See https://www.nginx.com/resources/wiki/modules/healthcheck/
   # /minio/health/live;
 }
}

如果你想要将储存桶与Web控制台使用同域名,则应按下面的配置文件编辑反向代理

server {
 listen 80;
 server_name example.com;

 # To allow special characters in headers
 ignore_invalid_headers off;
 # Allow any size file to be uploaded.
 # Set to a value such as 1000m; to restrict file size to a specific value
 client_max_body_size 0;
 # To disable buffering
 proxy_buffering off;

 # Proxy requests to the bucket "photos" to MinIO server running on port 9000
 location /photos/ {
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header Host $http_host;

   proxy_connect_timeout 300;
   # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
   proxy_http_version 1.1;
   proxy_set_header Connection "";
   chunked_transfer_encoding off;

   proxy_pass http://localhost:9000;
 }

 # Proxy any other request to the application server running on port 9001
 location / {
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header Host $http_host;

   proxy_connect_timeout 300;
   # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
   proxy_http_version 1.1;
   proxy_set_header Connection "";
   chunked_transfer_encoding off;

   proxy_pass http://localhost:9001;
 }

ACME.SH签发证书

安装ACME.SH

curl  https://get.acme.sh | sh -s email=your_email_adress

重载环境

source .profile

添加DNSPOD API密钥

export DP_Id="xxxxxx"
export DP_Key="xxxxxxxxxxxx"

签发证书(通配符)

acme.sh --dns dns_dp --issue -d example.com -d *.example.com

安装证书

acme.sh  --installcert  -d  example.com   \
        --key-file   /usr/local/nginx/cert/example.com/privkey.pem \
        --fullchain-file /usr/local/nginx/cert/example.com/fullchain.pem

编辑nginx配置文件,增加SSL配置

    ssl on;
    ssl_certificate  /usr/local/nginx/cert/example.com/fullchain.pem;
    ssl_certificate_key /usr/local/nginx/cert/example.com/privkey.pem;
    ssl_session_timeout 5m;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols  TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

重启NGINX

systemctl restart nginx

将储存桶设置为公开永久可读

设置完这么多,到真正用的时候发现传上去的文件公开不可读?

这是因为MinIO的储存桶默认没有公开访问权限

如果想要设置为储存桶公开可读,首先进入MinIO的Web控制台,点击Buckets-Manage-Access Rules-Add Access Rules,新建一个如下图所示的策略后点击Save保存即可

图片[1]-腾讯云轻量Docker部署单节点MinIO-Rain's Blog

此时你输入IP:9000/Buckets_Name/FileName即可直接下载/查看文件,如果已配置NGINX代理,那么输入域名/Buckets_Name/FileName即可直接下载/查看文件。

设置API/Web Console域名

如果想要设置API/Web Console域名,那么就需要重新创建Docker容器,只要数据目录不做修改那么资料就不会丢失

docker run -d --restart=always\
  -p 9000:9000 \
  -p 9001:9001 \
  --name minio1 \
  -v /home/minio/data:/data \
  -e "MINIO_ROOT_USER=Your_Login_User_Name" \
  -e "MINIO_ROOT_PASSWORD=Your_Login_User_Password" \
  -e "MINIO_SERVER_URL=https://file.Your_DominName.com" \
  -e "MINIO_BROWSER_REDIRECT_URL=https://minio.Your_DominName.com" \
  quay.io/minio/minio server /data --console-address ":9001"
图片[2]-腾讯云轻量Docker部署单节点MinIO-Rain's Blog
重新创建后,ShareFile功能可以正常获取到域名而不是Docker IP地址

需要注意的是,如果你的API域名与Web Console相同,那么可能需要在NGINX配置中增加一个location段用于转发API请求到9000端口

 location /api/ {
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header Host $http_host;

   proxy_connect_timeout 300;
   # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
   proxy_http_version 1.1;
   proxy_set_header Connection "";
   chunked_transfer_encoding off;

   proxy_pass http://localhost:9000;
 }

数据迁移/多备份

MinIO本身支持多节点备份且无需停机,多节点分布式部署请移步下面的文章

参考资料

© 版权声明
THE END
喜欢就支持一下吧
点赞0赞赏 分享
评论 抢沙发
头像
说点什么?
提交
头像

昵称

取消
昵称表情代码图片