云上搬砖——Code Server落地实践

# 编辑SSH服务配置
vim /etc/ssh/sshd_config
# 重启SSH服务（daemon）
systemctl restart sshd.service

# 删除预置的Lighthouse用户和用户目录（里边有SSH密钥对，安全起见要删除）
userdel lighthouse
rm -rf /home/lighthouse

# 卸载所有腾讯云的服务
/usr/local/qcloud/stargate/admin/uninstall.sh
/usr/local/qcloud/YunJing/uninst.sh
/usr/local/qcloud/monitor/barad/admin/uninstall.sh
cd /usr/local
rm -rf qcloud
rm -rf yd.socket.server
systemctl daemon-reload

# 关闭grub中对串口的输出
vim /etc/default/grub

# 禁用掉没用的服务
# 以下服务是根据实际需要进行禁用，请不要无脑复制粘贴
# 禁用cloud-init前建议提前进行静态地址配置
systemctl disable cloud-init
systemctl disable cloud-final.service
systemctl disable cloud-config.service
systemctl disable cloud-init-local.service
systemctl disable kdump.service
systemctl disable dnf-makecache.timer
systemctl disable iscsi-onboot.service
systemctl disable iscsi.service
systemctl disable iscsiuio.socket
systemctl disable lvm2-lvmpolld.socket
systemctl disable lvm2-monitor.service
systemctl disable qcloud-srv.service

# 安装常用软件
# NetworkManager习惯用于配置生成，一般生成完配置之后就禁用掉并且换成network-scripts了
dnf remove firewalld -y
dnf install iptables-services ipset -y
dnf install vim wget tmux bash-comp* net-tools iproute nano bind-utils traceroute NetworkManager-tui -y

# 修改iptables的规则
vim /etc/sysconfig/iptables

# 安装根证书
# 该步骤是我自己的CA，需要根据实际情况安装自己的CA。没有CA需要自行使用cfssl进行签发，否则后续无法发起客户端认证
# 自签发CA需要安装到自己设备，否则客户端会报不信任
# 请勿无脑复制粘贴
wget https://mirror.xuegaogg.com/xuegaonet/cert/XUEGAONET-CA.pem -O /tmp/XUEGAONET-CA.pem
mv /tmp/XUEGAONET-CA.pem /etc/pki/ca-trust/source/anchors/ -f
update-ca-trust

# 安装network-script
yum install network-scripts

# 请确保已经使用NetworkManager完成配置生成再执行此处命令
systemctl enable --now network
systemctl disable --now NetworkManager

# 修改内核操作
vim /etc/sysctl.conf

# 放开文件描述符限制
cat > /etc/security/limits.conf << EOF
* soft     nproc          65535
* hard     nproc          65535
* soft     nofile         65535
* hard     nofile         65535
EOF

# 更新内核到主线支持
yum install elrepo-release epel-release
yum --enablerepo=elrepo-kernel install kernel-ml

# 生成新的grub配置
grub2-mkconfig -o /boot/grub2/grub.cfg

Port <端口号>
ListenAddress <监听地址>
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
SyslogFacility AUTHPRIV

# 根据实际需要决定是否需要开启
PermitRootLogin no

MaxAuthTries <最大重试次数>
MaxSessions <最大会话数>
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication yes
ChallengeResponseAuthentication no
GSSAPIAuthentication yes
GSSAPICleanupCredentials no
UsePAM yes

# 关闭各种转发
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no

PrintMotd no
TCPKeepAlive yes
UseDNS no
PermitTunnel no
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
Subsystem sftp  /usr/libexec/openssh/sftp-server

# 限定特定的用户
AllowUsers <用户名>

# 等待时间
GRUB_TIMEOUT=1
GRUB_DISTRIBUTOR="$(sed 's, release .*$,,g' /etc/system-release)"
# 启动内核默认选项，一般习惯设置成0
GRUB_DEFAULT=0
GRUB_DISABLE_SUBMENU=true

# 下边两个原始配置中会有一个serial，需要删除
GRUB_TERMINAL="console"
GRUB_TERMINAL_OUTPUT="console"

# 原始配置中有一个serial的参数，需要删除
GRUB_CMDLINE_LINUX="crashkernel=auto console=ttyS0 console=tty0 panic=5 net.ifnames=0 biosdevname=0 intel_idle.max_cstate=1 intel_pstate=disable"
GRUB_DISABLE_RECOVERY="true"
GRUB_ENABLE_BLSCFG=true

# 禁用IPv6，暂且用不上
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.lo.disable_ipv6=1

# 放开文件描述符限制
fs.file-max = 65536
# 调整swap，当然也可以直接设置成0
# 一定记得结合实际内存大小设置
# 无脑复制粘贴可能会造成重大后果
vm.swappiness = 1

# 调整TCP重传算法
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr

# 下载并安装
curl -fOL https://github.com/cdr/code-server/releases/download/v3.8.0/code-server-3.8.0-amd64.rpm
dnf install ./code-server-3.8.0-amd64.rpm

# 新增开发用户
useradd harris
# 此处我并没有使用官方的systemd service
# 请注意区别
# service文件见下方
vim /etc/systemd/system/code-server.service

# 生成配置文件
# 路径需要根据自身变化进行更正
mkdir /home/harris/.config/code-server -p
cat > /home/harris/.config/code-server/config.yaml << EOF
bind-addr: 127.0.0.1:9999
auth: password
password: <设置的密码>
cert: false
EOF
chown harris:harris /home/harris -R

# 重载并启动服务
systemctl daemon-reload
systemctl enable --now code-server
.service

[Unit]
Description=code-server
After=network.target

[Service]
Type=exec
ExecStart=/usr/bin/code-server --bind-addr 127.0.0.1:9999
Restart=always
User=harris

[Install]
WantedBy=default.target

yum install yum-utils

# 安装repo
cat > /etc/yum.repos.d/nginx.repo
 << EOF
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
[nginx-mainline]
name=nginx mainline repo
baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
EOF

# 安装nginx stable
dnf makecache
yum-config-manager --enable nginx-stable
yum install nginx

# 生成DH密钥
openssl dhparam -dsaparam -out /etc/nginx/dhparam.pem 4096

# 生成nginx.conf配置
cat > /etc/nginx/nginx.conf
 << EOF
user  nginx;
worker_processes  2;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
    use epoll;
    multi_accept on;
    accept_mutex on;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    include /etc/nginx/conf.d/*.conf;

    log_format main       '$remote_addr - '
                                '$http_x_forwarded_for - '
                                '$remote_user, '
                                '[$time_local], '
                                '"$request" $status $body_bytes_sent '
                                '"$http_referer" "$http_user_agent" "$gzip_ratio"';

    access_log  /var/log/nginx/access.log  main;

    server_names_hash_bucket_size 128;
    client_header_buffer_size 32k;
    large_client_header_buffers 4 32k;
    client_max_body_size 128m;

    sendfile on;
    sendfile_max_chunk 512k;
    tcp_nopush on;

    keepalive_timeout 60;

    tcp_nodelay on;

    fastcgi_connect_timeout 300;
    fastcgi_send_timeout 300;
    fastcgi_read_timeout 300;
    fastcgi_buffer_size 64k;
    fastcgi_buffers 4 64k;
    fastcgi_busy_buffers_size 128k;
    fastcgi_temp_file_write_size 256k;

    gzip on;
    gzip_min_length  1k;
    gzip_buffers     4 16k;
    gzip_http_version 1.1;
    gzip_comp_level 2;
    gzip_types     text/plain application/javascript application/x-javascript text/javascript text/css application/xml application/xml+rss;
    gzip_vary on;
    gzip_proxied   expired no-cache no-store private auth;
    gzip_disable   "MSIE [1-6]\.";

    server_tokens off;
    access_log off;

}
EOF

# 设置反代参数
cat > /etc/nginx/cdr-proxy.conf
 << EOF
proxy_connect_timeout 300s;
proxy_send_timeout   300s;
proxy_read_timeout   300s;
proxy_buffer_size    32k;
proxy_buffers     4 32k;
proxy_busy_buffers_size 64k;
proxy_redirect     off;
proxy_hide_header  Vary;
proxy_set_header   Host   $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Accept-Encoding gzip;
proxy_set_header   X-Real-IP  $remote_addr;
proxy_set_header   X-Forwarded-For $http_x_forwarded_for;
proxy_set_header   X-Forwarded-Proto $scheme;
EOF

cat > /etc/nginx/conf.d/code-server.conf
 << EOF
server {
    listen       443 ssl http2;
    server_name  code.xuegaogg.com;

    ssl_certificate cert.pem;
    ssl_certificate_key cert-key.pem;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM";
    ssl_session_cache builtin:1000 shared:SSL:10m;
    ssl_verify_client on;
    ssl_dhparam dhparam.pem;
    ssl_client_certificate XUEGAONET-CA.pem;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location /
    {
        proxy_pass http://127.0.0.1:9999/;
        include cdr-proxy.conf;
    }
}
EOF

# 设置用户密码
passwd harris
# 添加到sudoer中
vim /etc/sudoers

harris  ALL=(ALL)       ALL