Tarkibga o‘tish

Index

Tizimni tayyorlash

1. Tizim versiyasini tekshiring:

cat /etc/os-release

Kutilayotgan natija:

altlinux.png

2. Sana va vaqtni belgilang:

timedatectl

Kutilayotgan natija:

altlinux-1.png

Foydalanuvchini sozlash

Muhim: foydalanuvchidan octopus UID 1000 bo'lishi kerak.

1. Octopus foydalanuvchisining joriy UID raqamini tekshiring:

id octopus

altlinux-2.png

2. UID 1000 bepul ekanligini tekshiring:

getent passwd 1000

Kutilayotgan javob: bo'sh qator (UID bepul)

Agar UID boshqa foydalanuvchi tomonidan olingan bo'lsa

1. Kirish ostida root

su

altlinux-7.png

ALT Linux P10 da SSH server konfiguratsiyasi mavjud /etc/openssh/sshd_config. Agar foydalanuvchining UID-ni o'zgartirish zarur bo'lsa, SSH ruxsati faqat ushbu foydalanuvchi ostida mavjud bo'lsa, vaqtinchalik root-login ruxsati ishlatiladi, shundan so'ng kirish darhol yopiladi.

2. SSH orqali ildiz tizimiga kirishga vaqtincha ruxsat bering:

sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin yes/' /etc/openssh/sshd_config

3. O'zgarishlarni tekshiring:

grep -i PermitRootLogin /etc/openssh/sshd_config

4. SSH xizmatini qayta ishga tushiring:

systemctl reload sshd || systemctl restart sshd

5. Barcha seanslardan chiqish:

exit
exit

altlinux-3.png

altlinux-4.png

Ildiz sifatida qayta kiring va ahtapot seansini tugating

1. Serverga SSH orqali root sifatida kiring:

ssh root@<IP-адрес>

altlinux-8.png

Tizimli tizimlarda foydalanuvchi faol jarayonga ega bo'lishi mumkin /lib/systemd/systemd --user, hatto qobiq seanslari bo'lmasa ham.

2. Barcha foydalanuvchi seanslarini tugatish octopus:

loginctl terminate-user octopus

altlinux-9.png

3. Foydalanuvchi UIDni o'zgartiring octopus 1000 ga:

usermod -u 1000 octopus

4. Uy katalogining egasini o'zgartiring:

chown -R 1000:1000 /home/octopus

Ildizga kirishni o'chirish va sudo-ni sozlash

1. Ildizga kirishni o'chirib qo'ying:

sed -i 's/^PermitRootLogin.*/PermitRootLogin no/' /etc/openssh/sshd_config

2. Tekshiring:

grep -i PermitRootLogin /etc/openssh/sshd_config

altlinux-10.png

3. Sudoerlarga foydalanuvchi Octopus qo'shing:

echo 'octopus ALL=(ALL) ALL' > /etc/sudoers.d/octopus
chmod 0400 /etc/sudoers.d/octopus

4. Faylning toʻgʻriligini tekshiring:

ls -l /etc/sudoers.d/
visudo -c

altlinux-5.png

5. Ildiz seansdan chiqing:

exit

Octopus ostida tizimga kiring va tizimni yangilang

1. Octopus sifatida tizimga kiring:

ssh octopus@<IP-адрес>

2. Tizimni yangilang:

sudo apt-get update

Keyin:

sudo apt-get -y dist-upgrade

3. Kerakli yordamchi dasturlarni o'rnating:

sudo apt-get install -y \
  curl \
  wget \
  ca-certificates \
  tar \
  gzip \
  unzip \
  xz \
  jq \
  procps

4. Serverni qayta ishga tushiring:

sudo reboot

Tizim chegaralarini o'rnatish

Muhim: Cheklovlarni o'rnatmasdan, -bash: fork: qayta urinib ko'ring: Resurs vaqtincha mavjud emas kabi xatolar mumkin.

Systemd o'rnatilmoqda

1. Systemd uchun konfiguratsiya yarating:

sudo mkdir -p /etc/systemd/system.conf.d
sudo tee /etc/systemd/system.conf.d/limits.conf <<'EOF'
[Manager]
DefaultTasksMax=16384
EOF

altlinux-23.png

2. Foydalanuvchilar uchun:

sudo mkdir -p /etc/systemd/logind.conf.d
sudo tee /etc/systemd/logind.conf.d/limits.conf <<'EOF'
[Login]
UserTasksMax=16384
EOF

PAM chegaralarini o'rnatish

Muhim: ALT Serverda ulimit -u=512 Docker va ko'p konteynerli Java ilovalarini ishga tushirishni bloklaydi. Octopus-ni o'rnatishdan oldin, jarayon chegarasini kamida 16384 ga oshirishingiz kerak. PAM uchun (ulimit)

1. Cheklovlarni sozlang:

sudo tee /etc/security/limits.d/99-octopus.conf <<'EOF'
* soft nproc 16384
* hard nproc 16384
EOF

altlinux-6.png

2. Limitlar faylini yarating:

sudo tee /etc/security/limits.d/99-octopus.conf <<'EOF'
# Octopus platform limits
octopus soft nofile 65535
octopus hard nofile 65535
octopus soft nproc 65535
octopus hard nproc 65535
* soft nproc 16384
* hard nproc 16384
EOF

3. Systemd ni qayta ishga tushiring (majburiy):

sudo systemctl daemon-reexec

Tarmoq sozlamalarini sozlash

1. Marshrutlash va ko'prik trafigini yoqish:

sudo tee /etc/sysctl.d/99-octopus.conf <<'EOF'
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
EOF

2. O'zgarishlarni qo'llash:

sudo /sbin/sysctl --system

altlinux-11.png

3. Serverni qayta ishga tushiring:

sudo reboot

Amaldagi chegaralarni tekshirish

Qayta ishga tushirgandan so'ng, sozlamalarni tekshiring:

sudo cat /etc/security/limits.d/99-octopus.conf
grep -R DefaultTasksMax /etc/systemd/system.conf.d
grep -R UserTasksMax /etc/systemd/logind.conf.d

altlinux-13.png

Docker o'rnatilmoqda

Docker Engine o'rnatish

1. Docker-ni Alt Linux omboridan o'rnating:

sudo apt-get install -y docker-engine docker-cli

2. Versiyani tekshiring:

docker --version

Kutilayotgan natija:

octopus@octopus-alt ~]$ docker --version
Docker version 27.1.1, build 59a4d52

Dockerni ishga tushirish va sozlash

1. Docker avtomatik ishga tushirishni yoqing:

sudo systemctl enable --now docker

altlinux-12.png

2. Holatni tekshiring:

systemctl status docker --no-pager -l

Kutilayotgan natija:

  • active (running)
  • jurnalda xatolik yo'q

Octopus foydalanuvchisi uchun huquqlarni o'rnatish

1. Foydalanuvchini docker guruhiga qo'shing:

sudo usermod -aG docker octopus

Muhim: Qaytadan kiring:

exit

3. Tekshirish guruhlari:

groups

altlinux-14.png

Docker tekshiruvi ishlamoqda

1. Sinov buyruqlarini bajaring:

docker ps
docker run --rm hello-world

Docker Compose-ni o'rnatish

1. Docker Compose v2 ni o'rnating:

sudo apt-get update
sudo apt-get install -y docker-compose-v2

2. Versiyani tekshiring:

docker compose version

altlinux-15.png

Docker o'rnatilishi va tizim sozlamalari to'g'riligini tekshirish

Octopus-ni o'rnatishdan oldin, Docker to'g'ri ishlayotganiga va tizim cheklovlari va huquqlari to'g'ri sozlanganligiga ishonch hosil qilishingiz kerak. Quyidagi tekshiruvlarni ketma-ket bajaring.

Docker xizmati tekshirilmoqda

Docker ishlayotganiga va ishga tushirishga qo'shilishiga ishonch hosil qiling:

sudo systemctl enable docker
sudo systemctl start docker

Octopus foydalanuvchi huquqlarini tekshirish

1. Octopus foydalanuvchisi docker guruhining a'zosi bo'lishi kerak (sudosiz ishlash uchun):

id octopus

2. Tizimda docker guruhi mavjudligini va foydalanuvchi a'zoligini tekshiring:

getent group docker

altlinux-16.png

Docker soketining mavjudligi tekshirilmoqda

1. Soket /var/run/docker.sock docker guruhi tomonidan o'qilishi va yozilishi mumkin bo'lishi kerak:

ls -lah /var/run/docker.sock

altlinux-17.png

Systemd, guruhlar va chegaralarni tekshirish

1. Tizim systemd dan foydalanayotganligiga ishonch hosil qiling:

ps -p 1 -o comm=

2. Cgroups versiyasini tekshiring:

stat -fc %T /sys/fs/cgroup/

3. Docker ishlatadigan guruhlar drayverini aniqlang:

docker info | grep -i cgroup

4. Octopus foydalanuvchisi uchun ochiq fayl chegarasini tekshiring:

ulimit -n

altlinux-18.png

Octopus-ni o'rnatish va ishga tushirish

Ishchi katalogni tayyorlash

1. Katalog yarating va sozlang:

mkdir -p /home/octopus/
cd /home/octopus/

2. Ruxsatlarni o'rnating:

sudo chown -R octopus:octopus /home/octopus/

Tarqatish paketini ochish

1. Olingan arxivdan nusxa oling octopus-stable-update.zip ichida /home/octopus/ va o'ramidan chiqarib oling:

unzip octopus-stable-update.zip

2. Octopus.deployment katalogining nomini Octopus qilib o‘zgartiring:

mv octopus.deployment octopus

Struktura quyidagicha ko'rinishi kerak:

/home/octopus/
├── octopus.images/
└── octopus/
    ├── docker-compose.yml
    ├── scripts/
    └── ...

Docker tasvirlarini import qilish

octopus.images katalogida docker-compose dasturini ishga tushirishdan oldin import qilinishi kerak bo'lgan oldindan o'rnatilgan Docker tasvirlari (*.tar) mavjud.

1. Ishchi papkangizga o'ting:

cd /home/octopus/Octopus

2. Texnik skriptlar bilan jildga o'ting:

cd /home/octopus/octopus/scripts

3. Oflayn tasvirlarni import qilish:

./import-images.sh /home/octopus/octopus.images

2. Import qilingan rasmlarni tekshiring:

docker images | grep -E 'octopus|keycloak|clickhouse|zookeeper|kafka' || true

altlinux-19.png

Octopus stekini ishga tushirish

1. Ishchi papkangizga o'ting:

cd /home/octopus/octopus

2. Stackni ishga tushiring:

docker compose down -v || true

altlinux-20.png

3. Qilish:

docker compose up -d --pull never

altlinux-21.png

4. Holatni tekshiring:

docker compose ps

Barcha xizmatlarni ishga tushirish taxminan 10 daqiqa davom etadi.

Funktsionallikni tekshirish

1. Idishlarning holatini tekshiring:

docker ps --format '{{.Names}}\t{{.Status}}'

altlinux-22.png

2. Jurnallarni ko'rish (ixtiyoriy):

docker compose logs --tail=60 --no-log-prefix | sed -n '1,200p'

Avtomatik ishga tushirishni sozlash

1. Stackni avtomatik ishga tushirish uchun xizmat yarating:

sudo tee /etc/systemd/system/octopus-stack.service >/dev/null <<'EOF'
[Unit]
Description=Octopus stack (Docker Compose)
After=docker.service network-online.target
Wants=docker.service network-online.target
ConditionPathExists=/home/octopus/octopus/docker-compose.yml

[Service]
Type=oneshot
User=octopus
Group=octopus
WorkingDirectory=/home/octopus/octopus
Environment=PWD=/home/octopus/octopus
Environment=COMPOSE_PROJECT_NAME=octopus

# sanity-checks
ExecStartPre=/bin/bash -lc 'test -S /var/run/docker.sock'
ExecStartPre=/usr/bin/docker --version
ExecStartPre=/usr/bin/docker info
ExecStartPre=/usr/bin/docker compose version
ExecStartPre=/bin/bash -lc '/usr/bin/docker compose -p octopus config >/dev/null'

ExecStart=/usr/bin/docker compose -p octopus up -d --pull never
ExecStop=/usr/bin/docker compose -p octopus down --remove-orphans

RemainAfterExit=yes
TimeoutStartSec=900
TimeoutStopSec=120
Restart=on-failure
RestartSec=10
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF

2. O'zgarishlarni faollashtiring:

sudo systemctl daemon-reload
sudo systemctl enable --now octopus-stack.service
systemctl status --no-pager octopus-stack

3. Serverni qayta ishga tushiring:

sudo reboot

Qayta ishga tushirgandan so'ng, taxminan 10 daqiqa kuting va Octopus veb-interfeysini quyidagi manzilda oching:

http://<IP-адрес-сервера>