Ubuntu 24.04 部署 Artifact Keeper：北汽 N60 智能座舱制品仓库实录

# Git 代理
git config --global http.proxy  http://150.158.137.210:8964
git config --global https.proxy http://150.158.137.210:8964

# Docker 代理（systemd drop-in）
sudo mkdir -p /etc/systemd/system/docker.service.d
sudo tee /etc/systemd/system/docker.service.d/http-proxy.conf << 'EOF'
[Service]
Environment="HTTP_PROXY=http://150.158.137.210:8964"
Environment="HTTPS_PROXY=http://150.158.137.210:8964"
Environment="NO_PROXY=localhost,127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker

# 验证
sudo docker pull hello-world

sudo apt update && sudo apt upgrade -y

# 官方源
sudo apt-get install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \
  https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
  | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

sudo mkdir -p /data/artifact-keeper/{data,certs}
sudo chown -R sup1whu:sup1whu /data/artifact-keeper
cd /data/artifact-keeper

version: "3.8"

services:
  backend:
    image: artifactkeeper/artifactkeeper:latest
    container_name: ak-backend
    restart: unless-stopped
    ports:
      - "127.0.0.1:30080:8080"
    env_file:
      - .env
    volumes:
      - ./data:/var/lib/artifactkeeper
      # ★ 域控自签证书才需要下面这行
      # - ./certs/ad-ca.crt:/usr/local/share/ca-certificates/ad-ca.crt:ro
    environment:
      - TZ=Asia/Shanghai
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/api/v1/health"]
      interval: 30s
      timeout: 10s
      retries: 3

sudo tee /data/artifact-keeper/.env << 'ENVEOF'
# ── 管理员（首次启动设） ──
# 注意：部署完立即改掉默认密码
ADMIN_PASSWORD=***

# ── 存储 ──
STORAGE_PATH=/var/lib/artifactkeeper

# ── JWT 签名密钥 ──
# 生成方式：openssl rand -hex 32
JWT_SECRET=***

# ── LDAP（Windows Active Directory） ──
LDAP_URL=ldaps://dc01.bitech-auto.com:636
LDAP_BASE_DN=DC=bitech-auto,DC=com
LDAP_BIND_DN=CN=artifact-svc,OU=Service Accounts,DC=bitech-auto,DC=com
LDAP_BIND_PASSWORD=***
LDAP_USER_FILTER=(sAMAccountName={username})
LDAP_SYNC_INTERVAL=3600

# ── 组同步（可选） ──
LDAP_GROUP_FILTER=(member={user_dn})
LDAP_GROUP_BASE_DN=OU=Groups,DC=bitech-auto,DC=com
LDAP_GROUP_ATTRIBUTE=cn
ENVEOF

cd /data/artifact-keeper
sudo docker compose pull    # 走代理
sudo docker compose up -d

# 确认 LDAP 连通
sudo docker compose logs backend | grep -i ldap
# 正常输出：LDAP connection established to ldaps://dc01...

# /etc/nginx/sites-available/artifacts
upstream artifact_keeper {
    server 10.177.100.30:30080;
    keepalive 16;
}

server {
    server_name artifacts.bitech-auto.com;

    listen 443 ssl http2;
    ssl_certificate     /etc/nginx/certs/bitech-auto.com.fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/bitech-auto.com.key;
    ssl_protocols TLSv1.2 TLSv1.3;

    # ★ 大文件上传
    client_max_body_size 8g;
    proxy_read_timeout 600s;
    proxy_send_timeout 600s;

    # ★ 禁用缓冲——大文件直通不落磁盘
    proxy_buffering off;
    proxy_request_buffering off;

    location / {
        proxy_pass http://artifact_keeper;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

server {
    listen 80;
    server_name artifacts.bitech-auto.com;
    return 301 https://$host$request_uri;
}

sudo ln -s /etc/nginx/sites-available/artifacts /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

environment {
    AK_URL   = 'https://artifacts.bitech-auto.com'
    AK_REPO  = 'baic-n60-f19'
    AK_TOKEN = credentials('ak-api-token')   // Jenkins 凭据 ID
}

sh """
    curl -X PUT \\
      -H "Authorization: Bearer ***" \\
      --upload-file /data/products/.../BAIC_N60F19_...zip \\
      --connect-timeout 30 \\
      --max-time 1800 \\
      --retry 3 \\
      "${AK_URL}/api/v1/repos/${AK_REPO}/artifacts/BAIC_N60F19_...zip/${VERSION}_${VARIANT}"
"""

# 日常
cd /data/artifact-keeper
sudo docker compose logs -f          # 看日志
curl http://127.0.0.1:30080/health   # 健康检查

# 升级
sudo docker compose pull
sudo docker compose up -d

# 备份——30 天循环
#!/bin/bash
BACKUP_DIR=/data/backups/artifact-keeper
mkdir -p $BACKUP_DIR
rsync -av --delete /data/artifact-keeper/data/ $BACKUP_DIR/data/
find $BACKUP_DIR -mtime +30 -delete