腾讯云轻量Docker部署单节点MinIO

前言

因为腾讯云最近新推出了轻量应用服务器的云硬盘，相对于CVM的云硬盘性能几乎一模一样，而且因为上新做活动3年的1TB云硬盘只要59.7元，直接让轻量变身超级大盘鸡，我就寻思着能不能拿这硬盘整点花活，正巧听说了有个开源且成熟的对象储存系统MinIO，索性就拿来试试水……

点此前往腾讯云新春采购活动（云硬盘活动老用户也能参加）：https://curl.qcloud.com/pUJXIiix

首先系统选择的是Debian 11.1

Docker安装

安装docker，这里使用官方的安装脚本，安装源为阿里云

curl -fsSL https://get.docker.com | bash -s docker --mirror Aliyun

Docker安装MinIO

docker run -d --restart=always\
  -p 9000:9000 \
  -p 9001:9001 \
  --name minio1 \
  -v /home/minio/data:/data \
  -e "MINIO_ROOT_USER=Your_Login_User_Name" \
  -e "MINIO_ROOT_PASSWORD=Your_Login_User_Password" \
  quay.io/minio/minio server /data --console-address ":9001"

在执行完成后，浏览器访问服务器IP地址:9001即可登录MinIO的Web控制台

反向代理

安装Nginx，可以随个人喜好，这里我直接安装在本机环境内了

apt install -y openssl libssl-dev libpcre3 libpcre3-dev
wget http://nginx.org/download/nginx-1.21.6.tar.gz
tar -xvzf nginx-1.21.6.tar.gz
cd nginx-1.21.6
./configure --user=www --group=www --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --with-http_sub_module --with-stream --with-stream_ssl_module --with-http_realip_module --with-http_gzip_static_module
make instll
ln -s /usr/local/nginx/sbin/nginx /usr/bin/nginx

配置Systemd守护

vi /usr/lib/systemd/system/nginx.service

[Unit]
Description=nginx - high performance web server 
Documentation=http://nginx.org/en/docs/
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
PIDFile=/usr/local/nginx/logs/nginx.pid
ExecStartPre=/usr/local/nginx/sbin/nginx -t -c /usr/local/nginx/conf/nginx.conf
ExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s QUIT $MAINPID
PrivateTmp=true

[Install]
WantedBy=multi-user.target

启动Nginx

systemctl start nginx

编辑NGINX反向代理配置文件(默认)

server {
 listen 80;
 server_name example.com;

 # To allow special characters in headers
 ignore_invalid_headers off;
 # Allow any size file to be uploaded.
 # Set to a value such as 1000m; to restrict file size to a specific value
 client_max_body_size 0;
 # To disable buffering
 proxy_buffering off;

 location / {
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header Host $http_host;

   proxy_connect_timeout 300;
   # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
   proxy_http_version 1.1;
   proxy_set_header Connection "";
   chunked_transfer_encoding off;

   proxy_pass http://localhost:9000; # If you are using docker-compose this would be the hostname i.e. minio
   # Health Check endpoint might go here. See https://www.nginx.com/resources/wiki/modules/healthcheck/
   # /minio/health/live;
 }
}

如果你想要将储存桶与Web控制台使用同域名，则应按下面的配置文件编辑反向代理

server {
 listen 80;
 server_name example.com;

 # To allow special characters in headers
 ignore_invalid_headers off;
 # Allow any size file to be uploaded.
 # Set to a value such as 1000m; to restrict file size to a specific value
 client_max_body_size 0;
 # To disable buffering
 proxy_buffering off;

 # Proxy requests to the bucket "photos" to MinIO server running on port 9000
 location /photos/ {
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header Host $http_host;

   proxy_connect_timeout 300;
   # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
   proxy_http_version 1.1;
   proxy_set_header Connection "";
   chunked_transfer_encoding off;

   proxy_pass http://localhost:9000;
 }

 # Proxy any other request to the application server running on port 9001
 location / {
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header Host $http_host;

   proxy_connect_timeout 300;
   # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
   proxy_http_version 1.1;
   proxy_set_header Connection "";
   chunked_transfer_encoding off;

   proxy_pass http://localhost:9001;
 }

ACME.SH签发证书

安装ACME.SH

curl  https://get.acme.sh | sh -s email=your_email_adress

重载环境

source .profile

添加DNSPOD API密钥

export DP_Id="xxxxxx"
export DP_Key="xxxxxxxxxxxx"

签发证书(通配符)

acme.sh --dns dns_dp --issue -d example.com -d *.example.com

安装证书

acme.sh  --installcert  -d  example.com   \
        --key-file   /usr/local/nginx/cert/example.com/privkey.pem \
        --fullchain-file /usr/local/nginx/cert/example.com/fullchain.pem

编辑nginx配置文件，增加SSL配置

    ssl on;
    ssl_certificate  /usr/local/nginx/cert/example.com/fullchain.pem;
    ssl_certificate_key /usr/local/nginx/cert/example.com/privkey.pem;
    ssl_session_timeout 5m;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols  TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

重启NGINX

systemctl restart nginx

将储存桶设置为公开永久可读

设置完这么多，到真正用的时候发现传上去的文件公开不可读？

这是因为MinIO的储存桶默认没有公开访问权限

如果想要设置为储存桶公开可读，首先进入MinIO的Web控制台，点击Buckets-Manage-Access Rules-Add Access Rules,新建一个如下图所示的策略后点击Save保存即可

此时你输入IP:9000/Buckets_Name/FileName即可直接下载/查看文件，如果已配置NGINX代理，那么输入域名/Buckets_Name/FileName即可直接下载/查看文件。

设置API/Web Console域名

如果想要设置API/Web Console域名，那么就需要重新创建Docker容器，只要数据目录不做修改那么资料就不会丢失

docker run -d --restart=always\
  -p 9000:9000 \
  -p 9001:9001 \
  --name minio1 \
  -v /home/minio/data:/data \
  -e "MINIO_ROOT_USER=Your_Login_User_Name" \
  -e "MINIO_ROOT_PASSWORD=Your_Login_User_Password" \
  -e "MINIO_SERVER_URL=https://file.Your_DominName.com" \
  -e "MINIO_BROWSER_REDIRECT_URL=https://minio.Your_DominName.com" \
  quay.io/minio/minio server /data --console-address ":9001"

需要注意的是，如果你的API域名与Web Console相同，那么可能需要在NGINX配置中增加一个location段用于转发API请求到9000端口

 location /api/ {
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header Host $http_host;

   proxy_connect_timeout 300;
   # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
   proxy_http_version 1.1;
   proxy_set_header Connection "";
   chunked_transfer_encoding off;

   proxy_pass http://localhost:9000;
 }

数据迁移/多备份

MinIO本身支持多节点备份且无需停机，多节点分布式部署请移步下面的文章

关于Docker部署分布式Minio的探索

2年前

310641

参考资料

• MinIO | Learn more about MinIO’s Docker Implementation
• MinIO | Setup Nginx proxy with MinIO – Cookbook/Recipe
• 说明 · acmesh-official/acme.sh Wiki · GitHub
• Nginx下HTTP强制重定向至HTTPS – WillLin – 博客园 (cnblogs.com)
• #レム あけおめ – eikaa的插画 – pixiv