Index
Muhim: Yangi operatsion tizimni o'rnatishda siz foydalanuvchi yaratishingiz kerak
octopus/octopustizimni o'rnatish bosqichida.
Agar bu qadam o'tkazib yuborilsa, quyidagi amallarni bajaring:
Octopus foydalanuvchisini yaratish
Har bir foydalanuvchi uchun bir marta bajariladi root.
Muhim: Octopus foydalanuvchisi 1000 sobit UIDga ega bo'lishi kerak
Buyruqni ishga tushirish orqali UID 1000 bandligini tekshiring:
getent passwd 1000
Agar UID 1000 bepul bo'lsa, foydalanuvchi yarating:
useradd -m -u 1000 -s /bin/bash octopus
echo "octopus:octopus" | chpasswd
usermod -aG wheel octopus
Agar UID 1000 band bo'lsa, eski foydalanuvchini o'chiring:
userdel -r <старый_пользователь>
Asosiy tizimni sozlash
1. Xost va vaqtni sozlash uchun buyruqni bajaring:
sudo hostnamectl set-hostname red-octopus
sudo timedatectl set-timezone Europe/Moscow # или свою таймзону
sudo dnf -y update
2. Sozlamalarni tekshiring:
hostnamectl
timedatectl
3. Asosiy vositalarni o'rnating:
sudo dnf install -y curl vim unzip tar net-tools git lsof firewalld
Xavfsizlik devorini o'rnatish
1. Xavfsizlik devorini ishga tushiring:
sudo systemctl enable --now firewalld
sudo firewall-cmd --state
2. Octopus xizmatlarini oching:
sudo firewall-cmd --permanent --add-port=80/tcp # UI
sudo firewall-cmd --permanent --add-port=443/tcp # UI
sudo firewall-cmd --permanent --add-port=8081/tcp # Keycloak
3. Ochiq kommunal xizmatlar:
sudo firewall-cmd --permanent --add-port=22/tcp # SSH
4. Maskradlashni sozlang (NAT/forwarding uchun):
sudo firewall-cmd --permanent --add-masquerade
sudo firewall-cmd --reload
sudo firewall-cmd --list-all
Tarmoqqa yo'naltirishni sozlash
Red OS sukut bo'yicha yoqilgan qat'iy tarmoq siyosatiga ega, bu paketlarni tarmoq nomlari o'rtasida yo'naltirilishini bloklaydi. Ushbu xatti-harakat standart bo'yicha xavfsiz printsipi bilan bog'liq, ammo u bir xil Docker tarmog'ida joylashgan bo'lsa ham, Octopus konteynerlarining aloqa qilishiga to'sqinlik qiladi. Ishlayotganida Docker konteynerlar o'rtasida trafik o'tishiga imkon beruvchi xavfsizlik devori qoidalarini (iptables) yaratadi, shu jumladan ACCEPT hammasini -- istalgan joyda ctstate RELATED, ESABLISHED qoidasi. Biroq, yo'naltirish dastlab tizim yadrosida bloklanganligi sababli, ushbu qoidani o'rnatish mumkin emas, bu esa konteynerlar tarmog'ini bir-biridan izolyatsiya qilishga olib keladi.
Octopus konteynerlarining normal ishlashini ta'minlash uchun operatsion tizim yadrosi darajasida IP yo'naltirishni faollashtirish kerak.
1. IP uzatishni yoqish:
echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-octopus.conf
sudo sysctl --system
2. Buyruqni ishga tushirish orqali tekshiring:
sysctl net.ipv4.ip_forward
Javob qaytarilishi kerak: net.ipv4.ip_forward = 1
3. Docker FORWARD qoidalarini tiklash:
sudo iptables -P FORWARD ACCEPT
sudo iptables -F FORWARD
Docker CE ni o'rnatish (CentOS 8 filiali)
1. Docker omborini qo'shing:
sudo tee /etc/yum.repos.d/docker-ce.repo >/dev/null <<'EOF'
[docker-ce-stable]
name=Docker CE Stable - $basearch
baseurl=https://download.docker.com/linux/centos/8/$basearch/stable
enabled=1
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg
EOF
2. Keshni yangilang:
sudo dnf clean all
sudo dnf makecache
Dockerni ishga tushirish uchun SELinux sozlanmoqda
Red OS sukut bo'yicha SELinux-dan majburiy rejimda foydalanadi, bu xavfsizlikni oshiradi, lekin mahalliy hajmlarda Docker operatsiyalarini bloklashi mumkin. Bu fayl tizimlarini konteynerlarga o'rnatishni cheklaydigan xavfsizlik siyosati bilan bog'liq.
Octopusning normal ishlashi uchun tizimni rejimga o'tkazish kerak permissive, unda buzilishlar qayd etilgan, lekin bloklanmagan.
Bu kabinalar va ichki serverlar uchun xavfsiz variant.
1. SELinux-ni ga aylantiring permissive rejim:
sudo setenforce 0
sudo sed -i 's/^SELINUX=enforcing/SELINUX=permissive/' /etc/selinux/config
getenforce
2. Red OS cheklovlari ostida Docker-ni o'rnating:
Kalit --nobest Red OS 8 omborlaridagi versiya ziddiyatlarini chetlab o'tish uchun zarur
sudo dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin --nobest
3. Docker dasturini ishga tushiring:
sudo systemctl enable --now docker
docker --version
docker compose version
Octopus foydalanuvchisi uchun Docker kirish huquqlarini o'rnatish
1. Octopus foydalanuvchisini docker guruhiga qo'shing:
sudo getent group docker || sudo groupadd docker
sudo usermod -aG docker octopus
sudo chgrp docker /var/run/docker.sock
sudo chmod 660 /var/run/docker.sock
2. Huquqlarni ro'yxatdan o'tkazing systemd:
sudo mkdir -p /etc/systemd/system/docker.socket.d
sudo tee /etc/systemd/system/docker.socket.d/10-group.conf >/dev/null <<'EOF'
[Socket]
SocketMode=0660
SocketGroup=docker
EOF
3. Xizmatlarni qayta ishga tushirish:
sudo systemctl daemon-reload
sudo systemctl restart docker.socket docker
4. O'rnatishni tekshiring:
newgrp docker
docker run --rm hello-world
Kutilgan javob: Hello from Docker! This message shows that your installation appears to be working correctly.
5. Docker o'z qoidalarini o'rnatganligini tekshiring iptables:
sudo iptables -L FORWARD -n -v | grep ACCEPT
Avtomatik tekshirish
1. Serverni qayta ishga tushirgandan so'ng xizmatlar avtomatik ravishda o'z-o'zidan ishga tushishiga ishonch hosil qiling:
sudo systemctl enable docker
sudo firewall-cmd --runtime-to-permanent >/dev/null 2>&1
sudo reboot
2. Qayta ishga tushirish:
systemctl status --no-pager docker
docker ps
sudo firewall-cmd --list-ports
getenforce
Octopus o'rnatishga tayyorlanmoqda
1. Ishchi katalog yarating:
sudo mkdir -p /home/octopus/octopus
sudo chown -R octopus:octopus /home/octopus
cd /home/octopus
2. Tarqatish paketini oching:
unzip octopus-update-1.30.35.zip
Zipni ochgandan so'ng biz katalog tuzilishini olamiz:
octopus.deployment, octopus.images
3. Katalog nomini o'zgartiring octopus.deployment Octopusda:
mv octopus.deployment octopus
Katalog tuzilishi:
/home/octopus/
├── octopus/
│ ├── docker-compose.yml
│ ├── .env
│ ├── scripts/
│ ├── configs/
│ └── ...
└── octopus.images/
Docker tasvirlarini import qilish
Katalog octopus.images ishga tushirishdan oldin import qilinishi kerak bo'lgan oldindan tuzilgan Docker tasvirlarini (*.tar) o'z ichiga oladi docker-compose.
1. Ishchi papkangizga o'ting:
cd /home/octopus/octopus
2. Texnik skriptlar bilan jildga o'ting:
cd /home/octopus/octopus/scripts
3. Oflayn tasvirlarni import qilish:
./import-images.sh /home/octopus/octopus.images
Kutilayotgan natija:
[octopus@red-octopus scripts]$ ./import-images.sh /home/octopus/octopus.images
Importing image from /home/octopus/octopus.images/clickhouse_clickhouse-server_23.9.3.12-alpine.tar
Loaded image: clickhouse/clickhouse-server:23.9.3.12-alpine
Importing image from /home/octopus/octopus.images/grafana_grafana.tar
Loaded image: grafana/grafana:latest
4. Yuklab olingan rasmlarni tekshiring:
docker images | grep -E 'octopus|keycloak|clickhouse|zookeeper|kafka' || true
Octopus-ni ishga tushiring
1. Ishchi papkangizga o'ting:
cd /home/octopus/octopus
2. Stackni ishga tushiring:
docker compose down -v || true
docker compose up -d --pull never
docker compose ps
Kutish boshidan taxminan 10 daqiqa davom etadi.
3. Holatni tekshiring:
docker ps --format '{{.Names}}\t{{.Status}}'
docker compose logs --tail=60 --no-log-prefix | sed -n '1,200p'
4. Startupda stekni ro'yxatdan o'tkazing.
Hammasi to'g'ri ekanligiga ishonch hosil qiling:
sudo systemctl is-active docker
sudo usermod -aG docker octopus
Ishga tushirishni sozlash
1. Systemd xizmatini yarating:
sudo tee /etc/systemd/system/octopus-stack.service >/dev/null <<'EOF'
[Unit]
Description=Octopus stack (Docker Compose)
After=docker.service network-online.target NetworkManager-wait-online.service
Wants=docker.service network-online.target
ConditionPathExists=/home/octopus/octopus/docker-compose.yml
[Service]
Type=oneshot
User=octopus
Group=octopus
WorkingDirectory=/home/octopus/octopus
Environment=PWD=/home/octopus/octopus
Environment=COMPOSE_PROJECT_NAME=octopus
ExecStartPre=/bin/bash -lc 'test -S /var/run/docker.sock'
ExecStartPre=/usr/bin/docker --version
ExecStartPre=/usr/bin/docker info
ExecStartPre=/usr/bin/docker compose version
ExecStartPre=/bin/bash -lc '/usr/bin/docker compose -p octopus config >/dev/null'
ExecStart=/usr/bin/docker compose -p octopus up -d --pull never
ExecStop=/usr/bin/docker compose -p octopus down --remove-orphans
RemainAfterExit=yes
TimeoutStartSec=900
TimeoutStopSec=120
Restart=on-failure
RestartSec=10
StandardOutput=journal
StandardError=journal
[Install]
WantedBy=multi-user.target
EOF
2. O'zgarishlarni faollashtiring:
sudo systemctl daemon-reload
sudo systemctl enable --now octopus-stack
systemctl status --no-pager octopus-stack
3. Tizimni qayta ishga tushiring:
sudo reboot
Taxminan 10 daqiqa kuting va veb-interfeysni tekshiring.
4. Konteynerlarning holati va ishlashini tekshiring:
systemctl status --no-pager octopus-stack
docker ps --format '{{.Names}}\t{{.Status}}' | sort
Kutilayotgan natija:
[octopus@red-octopus vmware-tools-distrib]$ systemctl status --no-pager octopus-stack
docker ps --format '{{.Names}}\t{{.Status}}' | sort
● octopus-stack.service - Octopus stack (Docker Compose)
Loaded: loaded (/etc/systemd/system/octopus-stack.service; enabled; preset: disabled)
Drop-In: /usr/lib/systemd/system/service.d
└─10-timeout-abort.conf
Active: active (exited) since Fri 2025-11-07 13:15:14 MSK; 14min ago
Main PID: 1306 (code=exited, status=0/SUCCESS)
CPU: 2.825s
ноя 07 13:14:31 red-octopus docker[1322]: Container agent.hyperv Started
ноя 07 13:14:32 red-octopus docker[1322]: Container agent.basis Started
ноя 07 13:14:33 red-octopus docker[1322]: Container agent.zabbix Started
ноя 07 13:14:42 red-octopus docker[1322]: Container agent.brest Started
ноя 07 13:14:44 red-octopus docker[1322]: Container agent.zvirt Started
ноя 07 13:14:46 red-octopus docker[1322]: Container agent.vcenter Started
ноя 07 13:14:46 red-octopus docker[1322]: Container api Started
ноя 07 13:14:46 red-octopus docker[1322]: Container ui Starting
ноя 07 13:15:14 red-octopus docker[1322]: Container ui Started
ноя 07 13:15:14 red-octopus systemd[1]: Finished octopus-stack.service - Octopus stack (Docker Compose).
agent.basis Up 15 minutes
agent.brest Up 15 minutes
agent.hyperv Up 15 minutes
agent.rosplatforma Up 15 minutes
agent.vcenter Up 15 minutes
agent.zabbix Up 15 minutes
agent.zvirt Up 15 minutes
analysis Up 16 minutes
api Up 15 minutes
grafana Up 16 minutes
keycloak Up 16 minutes
octopus.clickhouse Up 16 minutes
octopus-kafka Up 17 minutes
octopus.postgres Up 16 minutes
orchestrator Up 16 minutes
prometheus Up 16 minutes
pushgateway Up 16 minutes
repository Up 16 minutes
rsyslog Up 17 minutes
topology.worker Up 16 minutes
ui Up 14 minutes
zookeeper Up 16 minutes