12 · 部署上线与系列总结：从 localhost 到公网

检测 Python(>=3.10) → 创建 venv → 装依赖 → migrate →
全新库自动 init_data（演示数据+管理员，凭据写 admin_credentials.txt）→
端口检查 → runserver 8014

bash start.sh              # 本地模式
bash start.sh --setup-only # 只准备环境不启动
bash start.sh --demo       # 补充初始化演示数据
bash start.sh --docker     # 直接走生产编排（下一节）

db        PostgreSQL 16 —— 指标/日志/告警的持久层
web       gunicorn（2 worker × 4 线程），OBS_DISABLE_WORKERS=1，可多副本
worker    python manage.py obs_workers —— 四条周期线程，租约选主，可多副本

# 烽火台 Beacon Tower · 生产镜像
# 构建镜像不含密钥：SECRET_KEY / 接入令牌 / 数据库连接全部运行时注入
FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1

WORKDIR /app

# 先装依赖再拷代码：依赖未变时命中 Docker 层缓存
COPY requirements-prod.txt .
RUN pip install --no-cache-dir -r requirements-prod.txt

COPY . .

# 非 root 运行（容器内只写 /data 卷：sqlite 兜底库与密钥文件）
RUN useradd --create-home obs \
    && mkdir -p /data \
    && chown -R obs:obs /app /data
USER obs

ENV DJANGO_DEBUG=0 \
    OBS_DATA_DIR=/data

EXPOSE 8014

# gunicorn：2 worker × 4 线程；本容器仅处理请求（OBS_DISABLE_WORKERS 由 compose 注入），
# 采集/告警/拨测/巡检线程由单副本 worker 服务承担
CMD ["sh", "-c", "python manage.py migrate --noinput && python manage.py collectstatic --noinput && gunicorn config.wsgi:application --bind 0.0.0.0:8014 --workers 2 --threads 4 --timeout 60 --access-logfile -"]

services:
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: obs
      POSTGRES_USER: obs
      POSTGRES_PASSWORD: ${OBS_PG_PASSWORD:?请在 .env 设置 OBS_PG_PASSWORD}
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U obs -d obs"]
      interval: 5s
      timeout: 3s
      retries: 12
    restart: unless-stopped

  web:
    build: .
    ports:
      # 默认只绑本机回环：反代（nginx/Caddy）在本机转发即可，公网不必直连 8014
      - "${OBS_PUBLISH_ADDR:-127.0.0.1}:8014:8014"
    environment: &web_env
      DJANGO_DEBUG: "0"
      DJANGO_ALLOWED_HOSTS: ${DJANGO_ALLOWED_HOSTS:-localhost,127.0.0.1}
      DJANGO_ALLOW_ALL_HOSTS: "0"
      DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:?请在 .env 设置 DJANGO_SECRET_KEY}
      OBS_INGEST_TOKEN: ${OBS_INGEST_TOKEN:?请在 .env 设置 OBS_INGEST_TOKEN}
      OBS_DATABASE_URL: postgres://obs:${OBS_PG_PASSWORD}@db:5432/obs
      OBS_DISABLE_WORKERS: "1"          # web 只处理请求，后台任务全部在 worker
      OBS_TRUST_XFORWARDED_FOR: "${OBS_TRUST_XFORWARDED_FOR:-0}"
      DJANGO_SECURE_COOKIES: "${DJANGO_SECURE_COOKIES:-0}"
      DJANGO_CSRF_TRUSTED_ORIGINS: "${DJANGO_CSRF_TRUSTED_ORIGINS:-}"
    volumes:
      # bind 卷：collectstatic 产物要能被宿主机 nginx 直接读到（DEBUG=0 时
      # Django 不伺服静态文件，只反代应用会让页面丢样式与图表）
      - ./staticfiles:/app/staticfiles
      # 密钥/令牌/SQLite 兜底库都在 /data：不挂卷的话容器一重建密钥就重新生成
      - obsdata:/data
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c",
             "import urllib.request;urllib.request.urlopen('http://127.0.0.1:8014/api/health/', timeout=5)"]
      interval: 15s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  worker:
    build: .
    command: ["python", "manage.py", "obs_workers"]
    environment:
      <<: *web_env
      OBS_DISABLE_WORKERS: "0"
    volumes:
      - obsdata:/data      # 与 web 共用：读同一份 SECRET_KEY / 接入令牌
    depends_on:
      web:
        condition: service_started   # 等 web 先完成 migrate 再拉起任务线程
    restart: unless-stopped
    # docker compose up -d --scale worker=3：多副本抢租约，只有一个在跑

volumes:
  pgdata:
  obsdata:

cp .env.example .env   # 填 DJANGO_SECRET_KEY / OBS_INGEST_TOKEN / OBS_PG_PASSWORD
# 密钥生成：python -c "import secrets;print(secrets.token_urlsafe(64))"

docker compose up -d --build
docker compose exec web python manage.py createsuperuser
docker compose logs -f web        # 看启动日志

# 1) 代码与虚拟环境
python3 -m venv /opt/beacon-tower/.venv
/opt/beacon-tower/.venv/bin/pip install -r /opt/beacon-tower/requirements-prod.txt

# 2) /etc/beacon.env（EnvironmentFile 格式，放 DJANGO_* 与 OBS_* 变量）
#    代码树归 root、服务用户只读时，两个可写目录必须指出来：
#    OBS_DATA_DIR=/var/lib/beacon        （令牌/凭据/SQLite 兜底）
#    OBS_STATIC_ROOT=/var/lib/beacon/static

[Unit]
Description=Beacon Tower web (gunicorn)
After=network.target postgresql.service

[Service]
User=beacon
EnvironmentFile=/etc/beacon.env
WorkingDirectory=/opt/beacon-tower
ExecStart=/opt/beacon-tower/.venv/bin/gunicorn config.wsgi:application \
    --bind 127.0.0.1:8014 --workers 1 --threads 4 --timeout 60
Restart=always

[Install]
WantedBy=multi-user.target

[Unit]
Description=Beacon Tower background workers
After=beacon.service

[Service]
User=beacon
EnvironmentFile=/etc/beacon.env
WorkingDirectory=/opt/beacon-tower
ExecStart=/opt/beacon-tower/.venv/bin/python manage.py obs_workers
Restart=always

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now beacon.service beacon-worker.service

server {
    listen 443 ssl http2;
    server_name obs.example.com;

    ssl_certificate     /etc/nginx/certs/obs.pem;
    ssl_certificate_key /etc/nginx/certs/obs.key;

    # 静态文件：指向 OBS_STATIC_ROOT（collectstatic 的产物）
    location /static/ {
        alias /var/lib/beacon/static/;
        expires 7d;
    }

    location / {
        proxy_pass http://127.0.0.1:8014;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# 在目标服务器上
curl -o obs_agent.py https://obs.example.com/static/agent/obs_agent.py
pip install psutil
export OBS_SERVER_URL="https://obs.example.com"
export OBS_INGEST_TOKEN="<接入令牌，见接入中心页面>"
export OBS_HOST_NAME="web-1"
python obs_agent.py     # 用 systemd 或 nohup 常驻（接入中心页面有完整示例）