5 changed files with 395 additions and 1 deletions
@ -0,0 +1,43 @@ |
|||||
|
# 使用OpenJDK 8作为基础镜像 |
||||
|
FROM openjdk:8-jre-alpine |
||||
|
|
||||
|
# 设置工作目录 |
||||
|
WORKDIR /app |
||||
|
|
||||
|
# 创建证书目录 |
||||
|
RUN mkdir -p /app/certs |
||||
|
|
||||
|
# 创建日志目录 |
||||
|
RUN mkdir -p /app/logs |
||||
|
|
||||
|
# 创建上传文件目录 |
||||
|
RUN mkdir -p /app/uploads |
||||
|
|
||||
|
# 添加应用用户（安全考虑） |
||||
|
RUN addgroup -g 1000 appgroup && \ |
||||
|
adduser -D -s /bin/sh -u 1000 -G appgroup appuser |
||||
|
|
||||
|
# 复制jar包到容器 |
||||
|
COPY target/*.jar app.jar |
||||
|
|
||||
|
# 设置目录权限 |
||||
|
RUN chown -R appuser:appgroup /app |
||||
|
|
||||
|
# 切换到应用用户 |
||||
|
USER appuser |
||||
|
|
||||
|
# 暴露端口 |
||||
|
EXPOSE 9200 |
||||
|
|
||||
|
# 设置JVM参数 |
||||
|
ENV JAVA_OPTS="-Xms512m -Xmx1024m -Djava.security.egd=file:/dev/./urandom" |
||||
|
|
||||
|
# 设置Spring Profile |
||||
|
ENV SPRING_PROFILES_ACTIVE=prod |
||||
|
|
||||
|
# 健康检查 |
||||
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \ |
||||
|
CMD wget --no-verbose --tries=1 --spider http://localhost:9200/actuator/health || exit 1 |
||||
|
|
||||
|
# 启动应用 |
||||
|
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -jar app.jar"] |
||||
@ -0,0 +1,68 @@ |
|||||
|
# 证书目录说明 |
||||
|
|
||||
|
这个目录用于存放支付相关的证书文件，支持Docker容器化部署。 |
||||
|
|
||||
|
## 目录结构 |
||||
|
|
||||
|
``` |
||||
|
certs/ |
||||
|
├── README.md # 本说明文件 |
||||
|
├── wechat/ # 微信支付证书目录 |
||||
|
│ ├── apiclient_key.pem # 商户私钥证书 |
||||
|
│ ├── apiclient_cert.pem # 商户证书 |
||||
|
│ └── wechatpay_cert.pem # 微信支付平台证书 |
||||
|
└── alipay/ # 支付宝证书目录 |
||||
|
├── app_private_key.pem # 应用私钥 |
||||
|
├── appCertPublicKey.crt # 应用公钥证书 |
||||
|
├── alipayCertPublicKey.crt # 支付宝公钥证书 |
||||
|
└── alipayRootCert.crt # 支付宝根证书 |
||||
|
``` |
||||
|
|
||||
|
## 使用说明 |
||||
|
|
||||
|
### 1. 开发环境 |
||||
|
- 将证书文件放在 `src/main/resources/certs/dev/` 目录下 |
||||
|
- 应用会从classpath加载证书 |
||||
|
|
||||
|
### 2. 生产环境 |
||||
|
- 将证书文件放在此目录下 |
||||
|
- Docker容器会将此目录挂载到 `/app/certs` |
||||
|
- 应用会从挂载卷加载证书 |
||||
|
|
||||
|
### 3. 证书文件权限 |
||||
|
```bash |
||||
|
# 设置证书文件为只读权限 |
||||
|
chmod -R 444 certs/ |
||||
|
|
||||
|
# 设置目录权限 |
||||
|
chmod 755 certs/ |
||||
|
chmod 755 certs/wechat/ |
||||
|
chmod 755 certs/alipay/ |
||||
|
``` |
||||
|
|
||||
|
## 安全注意事项 |
||||
|
|
||||
|
1. **不要将证书文件提交到版本控制系统** |
||||
|
2. **确保证书文件权限设置正确** |
||||
|
3. **定期更新证书文件** |
||||
|
4. **备份重要的证书文件** |
||||
|
|
||||
|
## 证书获取方式 |
||||
|
|
||||
|
### 微信支付证书 |
||||
|
1. 登录微信商户平台 |
||||
|
2. 进入"账户中心" -> "API安全" |
||||
|
3. 下载商户证书和平台证书 |
||||
|
|
||||
|
### 支付宝证书 |
||||
|
1. 登录支付宝开放平台 |
||||
|
2. 进入应用详情页 |
||||
|
3. 在"开发设置"中下载相关证书 |
||||
|
|
||||
|
## 故障排除 |
||||
|
|
||||
|
如果遇到证书加载问题，请检查： |
||||
|
1. 证书文件是否存在 |
||||
|
2. 证书文件路径是否正确 |
||||
|
3. 证书文件权限是否正确 |
||||
|
4. 证书文件是否已过期 |
||||
@ -0,0 +1,93 @@ |
|||||
|
version: '3.8' |
||||
|
|
||||
|
services: |
||||
|
# 应用服务 |
||||
|
cms-app: |
||||
|
build: . |
||||
|
container_name: cms-java-app |
||||
|
ports: |
||||
|
- "9200:9200" |
||||
|
environment: |
||||
|
- SPRING_PROFILES_ACTIVE=prod |
||||
|
- JAVA_OPTS=-Xms512m -Xmx1024m |
||||
|
volumes: |
||||
|
# 证书挂载卷 - 将宿主机证书目录挂载到容器 |
||||
|
- ./certs:/app/certs:ro |
||||
|
# 日志挂载卷 |
||||
|
- ./logs:/app/logs |
||||
|
# 上传文件挂载卷 |
||||
|
- ./uploads:/app/uploads |
||||
|
networks: |
||||
|
- cms-network |
||||
|
depends_on: |
||||
|
- mysql |
||||
|
- redis |
||||
|
restart: unless-stopped |
||||
|
healthcheck: |
||||
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:9200/actuator/health"] |
||||
|
interval: 30s |
||||
|
timeout: 10s |
||||
|
retries: 3 |
||||
|
start_period: 60s |
||||
|
|
||||
|
# MySQL数据库 |
||||
|
mysql: |
||||
|
image: mysql:8.0 |
||||
|
container_name: cms-mysql |
||||
|
environment: |
||||
|
MYSQL_ROOT_PASSWORD: root123456 |
||||
|
MYSQL_DATABASE: modules |
||||
|
MYSQL_USER: modules |
||||
|
MYSQL_PASSWORD: 8YdLnk7KsPAyDXGA |
||||
|
ports: |
||||
|
- "3308:3306" |
||||
|
volumes: |
||||
|
- mysql_data:/var/lib/mysql |
||||
|
- ./mysql/conf:/etc/mysql/conf.d |
||||
|
- ./mysql/init:/docker-entrypoint-initdb.d |
||||
|
networks: |
||||
|
- cms-network |
||||
|
restart: unless-stopped |
||||
|
command: --default-authentication-plugin=mysql_native_password |
||||
|
|
||||
|
# Redis缓存 |
||||
|
redis: |
||||
|
image: redis:6.2-alpine |
||||
|
container_name: cms-redis |
||||
|
ports: |
||||
|
- "16379:6379" |
||||
|
volumes: |
||||
|
- redis_data:/data |
||||
|
- ./redis/redis.conf:/usr/local/etc/redis/redis.conf |
||||
|
networks: |
||||
|
- cms-network |
||||
|
restart: unless-stopped |
||||
|
command: redis-server /usr/local/etc/redis/redis.conf |
||||
|
|
||||
|
# Nginx反向代理（可选） |
||||
|
nginx: |
||||
|
image: nginx:alpine |
||||
|
container_name: cms-nginx |
||||
|
ports: |
||||
|
- "80:80" |
||||
|
- "443:443" |
||||
|
volumes: |
||||
|
- ./nginx/nginx.conf:/etc/nginx/nginx.conf |
||||
|
- ./nginx/conf.d:/etc/nginx/conf.d |
||||
|
- ./nginx/ssl:/etc/nginx/ssl |
||||
|
- ./uploads:/var/www/uploads |
||||
|
networks: |
||||
|
- cms-network |
||||
|
depends_on: |
||||
|
- cms-app |
||||
|
restart: unless-stopped |
||||
|
|
||||
|
networks: |
||||
|
cms-network: |
||||
|
driver: bridge |
||||
|
|
||||
|
volumes: |
||||
|
mysql_data: |
||||
|
driver: local |
||||
|
redis_data: |
||||
|
driver: local |
||||
@ -0,0 +1,188 @@ |
|||||
|
# Docker容器化部署指南 |
||||
|
|
||||
|
## 支付证书问题解决方案 |
||||
|
|
||||
|
本项目已经解决了Docker容器中支付证书路径失效的问题，支持多种证书加载方式。 |
||||
|
|
||||
|
## 目录结构 |
||||
|
|
||||
|
``` |
||||
|
project-root/ |
||||
|
├── Dockerfile |
||||
|
├── docker-compose.yml |
||||
|
├── certs/ # 证书目录（需要手动创建） |
||||
|
│ ├── wechat/ # 微信支付证书 |
||||
|
│ │ ├── apiclient_key.pem |
||||
|
│ │ ├── apiclient_cert.pem |
||||
|
│ │ └── wechatpay_cert.pem |
||||
|
│ └── alipay/ # 支付宝证书 |
||||
|
│ ├── app_private_key.pem |
||||
|
│ ├── appCertPublicKey.crt |
||||
|
│ ├── alipayCertPublicKey.crt |
||||
|
│ └── alipayRootCert.crt |
||||
|
├── logs/ # 日志目录 |
||||
|
├── uploads/ # 上传文件目录 |
||||
|
└── src/ |
||||
|
``` |
||||
|
|
||||
|
## 部署步骤 |
||||
|
|
||||
|
### 1. 准备证书文件 |
||||
|
|
||||
|
创建证书目录并放置证书文件： |
||||
|
|
||||
|
```bash |
||||
|
# 创建证书目录 |
||||
|
mkdir -p certs/wechat |
||||
|
mkdir -p certs/alipay |
||||
|
|
||||
|
# 复制微信支付证书到对应目录 |
||||
|
cp /path/to/your/apiclient_key.pem certs/wechat/ |
||||
|
cp /path/to/your/apiclient_cert.pem certs/wechat/ |
||||
|
cp /path/to/your/wechatpay_cert.pem certs/wechat/ |
||||
|
|
||||
|
# 复制支付宝证书到对应目录 |
||||
|
cp /path/to/your/app_private_key.pem certs/alipay/ |
||||
|
cp /path/to/your/appCertPublicKey.crt certs/alipay/ |
||||
|
cp /path/to/your/alipayCertPublicKey.crt certs/alipay/ |
||||
|
cp /path/to/your/alipayRootCert.crt certs/alipay/ |
||||
|
|
||||
|
# 设置证书文件权限（只读） |
||||
|
chmod -R 444 certs/ |
||||
|
``` |
||||
|
|
||||
|
### 2. 配置环境变量 |
||||
|
|
||||
|
创建 `.env` 文件（可选）： |
||||
|
|
||||
|
```bash |
||||
|
# 应用配置 |
||||
|
SPRING_PROFILES_ACTIVE=prod |
||||
|
JAVA_OPTS=-Xms512m -Xmx1024m |
||||
|
|
||||
|
# 数据库配置 |
||||
|
MYSQL_ROOT_PASSWORD=root123456 |
||||
|
MYSQL_DATABASE=modules |
||||
|
MYSQL_USER=modules |
||||
|
MYSQL_PASSWORD=8YdLnk7KsPAyDXGA |
||||
|
|
||||
|
# Redis配置 |
||||
|
REDIS_PASSWORD=redis_WSDb88 |
||||
|
``` |
||||
|
|
||||
|
### 3. 构建和启动 |
||||
|
|
||||
|
```bash |
||||
|
# 构建应用 |
||||
|
mvn clean package -DskipTests |
||||
|
|
||||
|
# 启动所有服务 |
||||
|
docker-compose up -d |
||||
|
|
||||
|
# 查看服务状态 |
||||
|
docker-compose ps |
||||
|
|
||||
|
# 查看应用日志 |
||||
|
docker-compose logs -f cms-app |
||||
|
``` |
||||
|
|
||||
|
### 4. 验证部署 |
||||
|
|
||||
|
```bash |
||||
|
# 检查应用健康状态 |
||||
|
curl http://localhost:9200/actuator/health |
||||
|
|
||||
|
# 检查证书是否正确加载 |
||||
|
docker exec cms-java-app ls -la /app/certs/ |
||||
|
``` |
||||
|
|
||||
|
## 证书加载模式 |
||||
|
|
||||
|
### 开发环境 (CLASSPATH) |
||||
|
- 证书文件放在 `src/main/resources/certs/` 目录下 |
||||
|
- 打包时会包含在jar包中 |
||||
|
- 适合开发和测试环境 |
||||
|
|
||||
|
### 生产环境 (VOLUME) |
||||
|
- 证书文件通过Docker挂载卷加载 |
||||
|
- 证书文件在宿主机上，挂载到容器的 `/app/certs` 目录 |
||||
|
- 支持证书文件的动态更新（重启容器后生效） |
||||
|
|
||||
|
### 文件系统模式 (FILESYSTEM) |
||||
|
- 直接从文件系统路径加载证书 |
||||
|
- 适合传统部署方式 |
||||
|
|
||||
|
## 配置说明 |
||||
|
|
||||
|
### application.yml 配置 |
||||
|
|
||||
|
```yaml |
||||
|
certificate: |
||||
|
load-mode: VOLUME # 证书加载模式 |
||||
|
cert-root-path: /app/certs # 证书根目录 |
||||
|
|
||||
|
wechat-pay: |
||||
|
dev: |
||||
|
api-v3-key: "your-api-v3-key" |
||||
|
private-key-file: "apiclient_key.pem" |
||||
|
apiclient-cert-file: "apiclient_cert.pem" |
||||
|
wechatpay-cert-file: "wechatpay_cert.pem" |
||||
|
``` |
||||
|
|
||||
|
### 环境特定配置 |
||||
|
|
||||
|
- **开发环境**: `application-dev.yml` - 使用CLASSPATH模式 |
||||
|
- **生产环境**: `application-prod.yml` - 使用VOLUME模式 |
||||
|
|
||||
|
## 故障排除 |
||||
|
|
||||
|
### 1. 证书文件找不到 |
||||
|
|
||||
|
```bash |
||||
|
# 检查证书文件是否存在 |
||||
|
docker exec cms-java-app ls -la /app/certs/ |
||||
|
|
||||
|
# 检查文件权限 |
||||
|
docker exec cms-java-app ls -la /app/certs/wechat/ |
||||
|
``` |
||||
|
|
||||
|
### 2. 支付接口调用失败 |
||||
|
|
||||
|
```bash |
||||
|
# 查看应用日志 |
||||
|
docker-compose logs cms-app | grep -i cert |
||||
|
|
||||
|
# 检查证书配置 |
||||
|
docker exec cms-java-app cat /app/application.yml | grep -A 10 certificate |
||||
|
``` |
||||
|
|
||||
|
### 3. 容器启动失败 |
||||
|
|
||||
|
```bash |
||||
|
# 查看详细错误信息 |
||||
|
docker-compose logs cms-app |
||||
|
|
||||
|
# 检查容器状态 |
||||
|
docker-compose ps |
||||
|
``` |
||||
|
|
||||
|
## 安全建议 |
||||
|
|
||||
|
1. **证书文件权限**: 设置为只读权限 (444) |
||||
|
2. **证书目录权限**: 限制访问权限 |
||||
|
3. **敏感信息**: 使用环境变量或Docker secrets管理敏感配置 |
||||
|
4. **网络安全**: 使用内部网络，限制端口暴露 |
||||
|
|
||||
|
## 更新证书 |
||||
|
|
||||
|
1. 停止应用容器：`docker-compose stop cms-app` |
||||
|
2. 更新证书文件到 `certs/` 目录 |
||||
|
3. 重启应用容器：`docker-compose start cms-app` |
||||
|
|
||||
|
## 监控和日志 |
||||
|
|
||||
|
- 应用日志：`./logs/` 目录 |
||||
|
- 容器日志：`docker-compose logs` |
||||
|
- 健康检查：访问 `/actuator/health` 端点 |
||||
|
|
||||
|
通过以上配置，你的应用在Docker容器中就能正确加载支付证书了！ |
||||
Loading…
Reference in new issue