docs: add enterprise deployment documentation
Add comprehensive enterprise deployment setup including: - Docker Compose configuration - Environment setup examples - Quickstart guide - Enterprise configuration reference - Security checklist - Automated setup script Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
mattAtomsenses
parent
5f4715acfc
commit
166106089c
36
docs/deployment/.env.example
Normal file
36
docs/deployment/.env.example
Normal file
@ -0,0 +1,36 @@
|
||||
# Moltbot 企业部署环境变量配置
|
||||
# 复制此文件为 .env 并填写实际值
|
||||
|
||||
# ===== 必填配置 =====
|
||||
|
||||
# Anthropic API 密钥 (从 https://console.anthropic.com 获取)
|
||||
ANTHROPIC_API_KEY=sk-ant-xxxxxxxxxxxx
|
||||
|
||||
# Gateway 认证 Token (建议使用 32 字符以上的强密码)
|
||||
# 生成方法: openssl rand -base64 32
|
||||
CLAWDBOT_GATEWAY_TOKEN=your-secure-gateway-token-here
|
||||
|
||||
# ===== 可选配置 =====
|
||||
|
||||
# 自定义 API 端点 (如果使用代理)
|
||||
# ANTHROPIC_BASE_URL=https://your-proxy.com/api/anthropic
|
||||
|
||||
# Gateway 端口 (默认 18789)
|
||||
# MOLTBOT_PORT=18789
|
||||
|
||||
# 日志级别 (debug|info|warn|error)
|
||||
# LOG_LEVEL=info
|
||||
|
||||
# 最大并发数 (默认 8)
|
||||
# MAX_CONCURRENT=8
|
||||
|
||||
# 会话隔离模式 (main|per-peer|per-channel-peer|per-account-channel-peer)
|
||||
# DM_SCOPE=per-channel-peer
|
||||
|
||||
# ===== 高可用配置 (可选) =====
|
||||
|
||||
# Redis 连接字符串 (用于多实例部署)
|
||||
# REDIS_URL=redis://redis:6379
|
||||
|
||||
# 实例 ID (用于多实例识别)
|
||||
# INSTANCE_ID=gateway-1
|
||||
511
docs/deployment/ENTERPRISE.md
Normal file
511
docs/deployment/ENTERPRISE.md
Normal file
@ -0,0 +1,511 @@
|
||||
# Moltbot 企业级部署指南
|
||||
|
||||
## 目录
|
||||
- [架构概览](#架构概览)
|
||||
- [部署方案](#部署方案)
|
||||
- [安全最佳实践](#安全最佳实践)
|
||||
- [运维管理](#运维管理)
|
||||
- [监控和告警](#监控和告警)
|
||||
- [故障排查](#故障排查)
|
||||
|
||||
---
|
||||
|
||||
## 架构概览
|
||||
|
||||
### 推荐架构
|
||||
|
||||
```
|
||||
┌─────────────────┐
|
||||
│ 员工浏览器 │
|
||||
└────────┬────────┘
|
||||
│ HTTPS
|
||||
┌────────▼────────┐
|
||||
│ Nginx/Caddy │ ← SSL 终止、访问日志
|
||||
│ 反向代理 │
|
||||
└────────┬────────┘
|
||||
│ HTTP
|
||||
┌────────▼────────┐
|
||||
│ Moltbot Gateway │ ← 端口 18789
|
||||
│ - Token 认证 │
|
||||
│ - 会话隔离 │
|
||||
└────────┬────────┘
|
||||
│
|
||||
┌────────▼────────┐
|
||||
│ LLM API │
|
||||
│ (BigModel) │
|
||||
└─────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 部署方案
|
||||
|
||||
### 方案 A: 单服务器部署 (适合 <50 用户)
|
||||
|
||||
**硬件要求:**
|
||||
- CPU: 4 核心以上
|
||||
- 内存: 8GB 以上
|
||||
- 磁盘: 50GB SSD
|
||||
|
||||
**优点:**
|
||||
- 部署简单
|
||||
- 维护成本低
|
||||
- 适合小型团队
|
||||
|
||||
**缺点:**
|
||||
- 单点故障
|
||||
- 扩展性有限
|
||||
|
||||
### 方案 B: 高可用部署 (适合 50+ 用户)
|
||||
|
||||
**架构:**
|
||||
- 负载均衡器 (Nginx/HAProxy)
|
||||
- 2+ 个 Moltbot Gateway 实例
|
||||
- 共享存储 (NFS/云存储)
|
||||
- Redis (可选，用于会话共享)
|
||||
|
||||
**优点:**
|
||||
- 高可用性
|
||||
- 水平扩展
|
||||
- 负载分散
|
||||
|
||||
---
|
||||
|
||||
## 安全最佳实践
|
||||
|
||||
### 1. 认证和授权
|
||||
|
||||
#### Gateway Token 认证
|
||||
```json5
|
||||
{
|
||||
"gateway": {
|
||||
"auth": {
|
||||
"mode": "token",
|
||||
"token": "${CLAWDBOT_GATEWAY_TOKEN}" // 从环境变量读取
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**安全建议:**
|
||||
- Token 长度至少 32 字符
|
||||
- 定期轮换 Token (每月/季度)
|
||||
- 不要在代码中硬编码
|
||||
- 使用环境变量或密钥管理系统
|
||||
|
||||
### 2. 网络安全
|
||||
|
||||
#### 反向代理配置
|
||||
```nginx
|
||||
# /etc/nginx/sites-available/moltbot
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name moltbot.company.com;
|
||||
|
||||
# SSL 配置
|
||||
ssl_certificate /etc/letsencrypt/live/moltbot.company.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/moltbot.company.com/privkey.pem;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
|
||||
# 代理到 Moltbot
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:18789;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_to;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
#### 防火墙规则
|
||||
```bash
|
||||
# 只允许特定网络访问
|
||||
ufw allow from 10.0.0.0/8 to any port 18789
|
||||
ufw allow from 172.16.0.0/12 to any port 18789
|
||||
```
|
||||
|
||||
### 3. API 密钥管理
|
||||
|
||||
#### 使用环境变量
|
||||
```bash
|
||||
# /etc/moltbot/environment
|
||||
export ANTHROPIC_API_KEY="sk-ant-..."
|
||||
export CLAWDBOT_GATEWAY_TOKEN="your-secure-token-here"
|
||||
```
|
||||
|
||||
#### 文件权限
|
||||
```bash
|
||||
chmod 600 /etc/moltbot/environment
|
||||
chmod 640 /etc/moltbot/moltbot.json
|
||||
chown root:moltbot /etc/moltbot/*
|
||||
```
|
||||
|
||||
### 4. 会话隔离
|
||||
|
||||
#### 多用户会话隔离配置
|
||||
```json5
|
||||
{
|
||||
"session": {
|
||||
"dmScope": "per-channel-peer", // 每个用户独立会话
|
||||
"reset": {
|
||||
"mode": "idle",
|
||||
"idleMinutes": 120
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**说明:**
|
||||
- `per-channel-peer`: 按频道+用户隔离
|
||||
- `per-peer`: 按用户隔离（跨频道共享）
|
||||
- `main`: 所有用户共享（不推荐多用户场景）
|
||||
|
||||
### 5. 文件系统安全
|
||||
|
||||
```bash
|
||||
# 设置严格的文件权限
|
||||
chmod 700 /var/lib/moltbot
|
||||
chmod 700 /var/lib/moltbot/sessions
|
||||
chmod 600 /var/lib/moltbot/sessions/*.jsonl
|
||||
|
||||
# 确保 Moltbot 运行在专用用户下
|
||||
useradd -r moltbot
|
||||
```
|
||||
|
||||
### 6. 日志和审计
|
||||
|
||||
#### 敏感信息脱敏
|
||||
```json5
|
||||
{
|
||||
"logging": {
|
||||
"redactSensitive": "tools", // 过滤工具调用中的敏感信息
|
||||
"file": {
|
||||
"enabled": true,
|
||||
"path": "/var/log/moltbot/gateway.log"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
#### 审计日志
|
||||
```bash
|
||||
# 定期运行安全审计
|
||||
moltbot security audit --deep
|
||||
|
||||
# 查看异常访问
|
||||
grep -i "unauthorized\|forbidden" /var/log/moltbot/gateway.log
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 运维管理
|
||||
|
||||
### 1. 服务管理
|
||||
|
||||
#### 启动和停止
|
||||
```bash
|
||||
# 启动服务
|
||||
systemctl start moltbot-gateway.service
|
||||
|
||||
# 停止服务
|
||||
systemctl stop moltbot-gateway.service
|
||||
|
||||
# 重启服务
|
||||
systemctl restart moltbot-gateway.service
|
||||
|
||||
# 查看状态
|
||||
systemctl status moltbot-gateway.service
|
||||
```
|
||||
|
||||
#### 查看日志
|
||||
```bash
|
||||
# 实时日志
|
||||
journalctl -u moltbot-gateway.service -f
|
||||
|
||||
# 最近 100 行
|
||||
journalctl -u moltbot-gateway.service -n 100
|
||||
|
||||
# 按时间过滤
|
||||
journalctl -u moltbot-gateway.service --since "1 hour ago"
|
||||
```
|
||||
|
||||
### 2. 配置更新
|
||||
|
||||
#### 热更新配置
|
||||
```bash
|
||||
# 通过 RPC 更新配置
|
||||
moltbot gateway call config.get --params '{}'
|
||||
moltbot gateway call config.patch --params '{
|
||||
"raw": "{ agents: { defaults: { maxConcurrent: 16 } } }",
|
||||
"baseHash": "<hash-from-config.get>"
|
||||
}'
|
||||
```
|
||||
|
||||
#### 手动更新
|
||||
```bash
|
||||
# 编辑配置文件
|
||||
vim /etc/moltbot/moltbot.json
|
||||
|
||||
# 重启服务
|
||||
systemctl restart moltbot-gateway.service
|
||||
```
|
||||
|
||||
### 3. 证书管理
|
||||
|
||||
#### Let's Encrypt 自动续期
|
||||
```bash
|
||||
# 安装 certbot
|
||||
apt install certbot python3-certbot-nginx
|
||||
|
||||
# 获取证书
|
||||
certbot --nginx -d moltbot.company.com
|
||||
|
||||
# 自动续期已通过 cron 配置
|
||||
certbot renew --dry-run
|
||||
```
|
||||
|
||||
### 4. 备份策略
|
||||
|
||||
#### 需要备份的内容
|
||||
```bash
|
||||
#!/bin/bash
|
||||
# backup-moltbot.sh
|
||||
|
||||
BACKUP_DIR="/backup/moltbot/$(date +%Y%m%d)"
|
||||
mkdir -p "$BACKUP_DIR"
|
||||
|
||||
# 备份配置
|
||||
cp /etc/moltbot/moltbot.json "$BACKUP_DIR/"
|
||||
cp /etc/moltbot/environment "$BACKUP_DIR/"
|
||||
|
||||
# 备份会话
|
||||
tar -czf "$BACKUP_DIR/sessions.tar.gz" /var/lib/moltbot/sessions/
|
||||
|
||||
# 备份凭证
|
||||
tar -czf "$BACKUP_DIR/credentials.tar.gz" /var/lib/moltbot/credentials/
|
||||
|
||||
# 清理 30 天前的备份
|
||||
find /backup/moltbot -type d -mtime +30 -exec rm -rf {} \;
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 监控和告警
|
||||
|
||||
### 1. 健康检查
|
||||
|
||||
#### 内置健康检查
|
||||
```bash
|
||||
# 检查服务健康
|
||||
curl http://127.0.0.1:18789/health
|
||||
|
||||
# 检查模型状态
|
||||
moltbot models status
|
||||
```
|
||||
|
||||
### 2. 监控指标
|
||||
|
||||
#### 关键指标
|
||||
- 服务运行时间
|
||||
- 内存使用率
|
||||
- CPU 使用率
|
||||
- 活跃会话数
|
||||
- API 调用延迟
|
||||
- 错误率
|
||||
|
||||
#### Prometheus 监控示例
|
||||
```yaml
|
||||
# prometheus.yml
|
||||
scrape_configs:
|
||||
- job_name: 'moltbot'
|
||||
static_configs:
|
||||
- targets: ['localhost:18789']
|
||||
metrics_path: '/metrics'
|
||||
```
|
||||
|
||||
### 3. 告警配置
|
||||
|
||||
#### 常见告警规则
|
||||
```yaml
|
||||
# alerting.yml
|
||||
groups:
|
||||
- name: moltbot
|
||||
rules:
|
||||
- alert: MoltbotServiceDown
|
||||
expr: up{job="moltbot"} == 0
|
||||
for: 1m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
summary: "Moltbot service is down"
|
||||
|
||||
- alert: MoltbotHighMemory
|
||||
expr: process_resident_memory_bytes{job="moltbot"} > 2GB
|
||||
for: 5m
|
||||
labels:
|
||||
severity: warning
|
||||
annotations:
|
||||
summary: "Moltbot memory usage is high"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 故障排查
|
||||
|
||||
### 常见问题
|
||||
|
||||
#### 1. 服务无法启动
|
||||
|
||||
**检查步骤:**
|
||||
```bash
|
||||
# 查看服务状态
|
||||
systemctl status moltbot-gateway.service
|
||||
|
||||
# 查看详细日志
|
||||
journalctl -u moltbot-gateway.service -n 100 --no-pager
|
||||
|
||||
# 检查配置文件
|
||||
moltbot doctor --fix
|
||||
```
|
||||
|
||||
**常见原因:**
|
||||
- 配置文件语法错误
|
||||
- 端口被占用
|
||||
- 环境变量未设置
|
||||
- 权限问题
|
||||
|
||||
#### 2. 认证失败
|
||||
|
||||
**检查:**
|
||||
```bash
|
||||
# 验证 Token
|
||||
grep "CLAWDBOT_GATEWAY_TOKEN" /etc/moltbot/environment
|
||||
|
||||
# 检查日志
|
||||
grep "unauthorized\|auth" /var/log/moltbot/gateway.log
|
||||
```
|
||||
|
||||
#### 3. API 调用失败
|
||||
|
||||
**检查:**
|
||||
```bash
|
||||
# 验证 API 密钥
|
||||
grep "ANTHROPIC_API_KEY" /etc/moltbot/environment
|
||||
|
||||
# 测试 API 连接
|
||||
curl -X POST https://open.bigmodel.cn/api/anthropic/v1/messages \
|
||||
-H "x-api-key: $ANTHROPIC_API_KEY" \
|
||||
-H "anthropic-version: 2023-06-01" \
|
||||
-d '{"model":"claude-opus-4-5","max_tokens":100,"messages":[{"role":"user","content":"hello"}]}'
|
||||
```
|
||||
|
||||
#### 4. 性能问题
|
||||
|
||||
**排查:**
|
||||
```bash
|
||||
# 检查资源使用
|
||||
top -p $(pgrep moltbot-gateway)
|
||||
|
||||
# 查看活跃会话
|
||||
moltbot sessions list
|
||||
|
||||
# 检查并发配置
|
||||
grep "maxConcurrent" /etc/moltbot/moltbot.json
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 性能优化
|
||||
|
||||
### 1. 并发调优
|
||||
|
||||
```json5
|
||||
{
|
||||
"agents": {
|
||||
"defaults": {
|
||||
"maxConcurrent": 16, // 根据 CPU 核心数调整
|
||||
"subagents": {
|
||||
"maxConcurrent": 32
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### 2. 缓存优化
|
||||
|
||||
```json5
|
||||
{
|
||||
"agents": {
|
||||
"defaults": {
|
||||
"models": {
|
||||
"anthropic/claude-opus-4-5": {
|
||||
"params": {
|
||||
"cacheControlTtl": "1h" // 启用缓存
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### 3. 资源限制
|
||||
|
||||
```ini
|
||||
# /etc/systemd/system/moltbot-gateway.service
|
||||
[Service]
|
||||
MemoryMax=4G
|
||||
CPUQuota=300%
|
||||
LimitNOFILE=65536
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 成本控制
|
||||
|
||||
### 1. 使用量监控
|
||||
|
||||
```bash
|
||||
# 查看模型使用统计
|
||||
moltbot models usage
|
||||
|
||||
# 按用户统计
|
||||
awk '/user:/ {print}' /var/log/moltbot/gateway.log | sort | uniq -c
|
||||
```
|
||||
|
||||
### 2. 预算告警
|
||||
|
||||
配置预算限制并设置告警：
|
||||
```json5
|
||||
{
|
||||
"models": {
|
||||
"providers": {
|
||||
"anthropic": {
|
||||
"budget": {
|
||||
"daily": 100, // 每日限额 (美元)
|
||||
"alert": true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 附录
|
||||
|
||||
### A. 配置文件模板
|
||||
|
||||
参见 [enterprise-config.json5](enterprise-config.json5)
|
||||
|
||||
### B. 部署脚本
|
||||
|
||||
参见 [setup-enterprise.sh](setup-enterprise.sh)
|
||||
|
||||
### C. 相关文档
|
||||
|
||||
- [Moltbot 官方文档](https://docs.molt.bot)
|
||||
- [安全最佳实践](https://docs.molt.bot/gateway/security)
|
||||
- [配置参考](https://docs.molt.bot/gateway/configuration)
|
||||
223
docs/deployment/QUICKSTART.md
Normal file
223
docs/deployment/QUICKSTART.md
Normal file
@ -0,0 +1,223 @@
|
||||
# Moltbot 企业部署快速参考
|
||||
|
||||
## 🚀 5 分钟快速部署
|
||||
|
||||
```bash
|
||||
# 1. 运行安装脚本
|
||||
cd /root/moltbot/docs/deployment
|
||||
chmod +x setup-enterprise.sh
|
||||
sudo ./setup-enterprise.sh
|
||||
|
||||
# 2. 配置环境变量
|
||||
sudo vim /etc/moltbot/environment
|
||||
# 设置 ANTHROPIC_API_KEY 和 CLAWDBOT_GATEWAY_TOKEN
|
||||
|
||||
# 3. 复制配置文件
|
||||
sudo cp enterprise-config.json5 /etc/moltbot/moltbot.json
|
||||
|
||||
# 4. 启动服务
|
||||
sudo systemctl enable --now moltbot-gateway.service
|
||||
|
||||
# 5. 验证
|
||||
sudo systemctl status moltbot-gateway.service
|
||||
curl http://127.0.0.1:18789/health
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔑 关键配置
|
||||
|
||||
### 环境变量 (必须)
|
||||
```bash
|
||||
# /etc/moltbot/environment
|
||||
export ANTHROPIC_API_KEY="sk-ant-..."
|
||||
export CLAWDBOT_GATEWAY_TOKEN="secure-token-32chars-min"
|
||||
```
|
||||
|
||||
### 多用户会话隔离 (必须)
|
||||
```json5
|
||||
{
|
||||
"session": {
|
||||
"dmScope": "per-channel-peer" // 每个用户独立会话
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Gateway 认证 (必须)
|
||||
```json5
|
||||
{
|
||||
"gateway": {
|
||||
"bind": "lan", // 或 "127.0.0.1" 用于本地
|
||||
"auth": {
|
||||
"mode": "token",
|
||||
"token": "${CLAWDBOT_GATEWAY_TOKEN}"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📊 规模指南
|
||||
|
||||
| 用户数 | 配置 |
|
||||
|--------|------|
|
||||
| < 20 | 单服务器, 4核/8GB RAM |
|
||||
| 20-50 | 单服务器, 8核/16GB RAM |
|
||||
| 50-200 | 负载均衡 + 2个实例 |
|
||||
| 200+ | 集群 + Redis 共享会话 |
|
||||
|
||||
---
|
||||
|
||||
## 🛡️ 安全检查 (部署前)
|
||||
|
||||
```bash
|
||||
# 运行安全审计
|
||||
moltbot security audit --deep
|
||||
|
||||
# 检查文件权限
|
||||
ls -la /etc/moltbot/
|
||||
# 应该是: -rw-r----- (640)
|
||||
|
||||
# 检查服务用户
|
||||
ps aux | grep moltbot
|
||||
# 应该运行在 moltbot 用户下，非 root
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📋 日常运维命令
|
||||
|
||||
```bash
|
||||
# 查看服务状态
|
||||
systemctl status moltbot-gateway.service
|
||||
|
||||
# 查看实时日志
|
||||
journalctl -u moltbot-gateway.service -f
|
||||
|
||||
# 重启服务
|
||||
systemctl restart moltbot-gateway.service
|
||||
|
||||
# 查看模型状态
|
||||
moltbot models status
|
||||
|
||||
# 查看活跃会话
|
||||
moltbot sessions list
|
||||
|
||||
# 安全审计
|
||||
moltbot security audit
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔧 故障排查
|
||||
|
||||
### 服务无法启动
|
||||
```bash
|
||||
# 检查配置
|
||||
moltbot doctor --fix
|
||||
|
||||
# 查看错误日志
|
||||
journalctl -u moltbot-gateway.service -n 100 --no-pager
|
||||
```
|
||||
|
||||
### 认证失败
|
||||
```bash
|
||||
# 检查 token
|
||||
grep CLAWDBOT_GATEWAY_TOKEN /etc/moltbot/environment
|
||||
|
||||
# 检查日志
|
||||
grep "unauthorized\|auth" /var/log/moltbot/gateway.log
|
||||
```
|
||||
|
||||
### 性能问题
|
||||
```bash
|
||||
# 检查资源使用
|
||||
top -p $(pgrep moltbot-gateway)
|
||||
|
||||
# 查看并发数
|
||||
grep "maxConcurrent" /etc/moltbot/moltbot.json
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📱 客户端连接
|
||||
|
||||
### Web UI
|
||||
```
|
||||
https://moltbot.company.com/?token=YOUR_GATEWAY_TOKEN
|
||||
```
|
||||
|
||||
### WebSocket
|
||||
```javascript
|
||||
const ws = new WebSocket('wss://moltbot.company.com');
|
||||
ws.send(JSON.stringify({
|
||||
type: 'auth',
|
||||
token: 'YOUR_GATEWAY_TOKEN'
|
||||
}));
|
||||
```
|
||||
|
||||
### HTTP API
|
||||
```bash
|
||||
curl -H "Authorization: Bearer YOUR_GATEWAY_TOKEN" \
|
||||
https://moltbot.company.com/v1/chat/completions
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔄 配置热更新
|
||||
|
||||
```bash
|
||||
# 获取当前配置哈希
|
||||
moltbot gateway call config.get --param '{}'
|
||||
|
||||
# 更新配置
|
||||
moltbot gateway call config.patch --param '{
|
||||
"raw": "{ agents: { defaults: { maxConcurrent: 16 } } }",
|
||||
"baseHash": "<hash-from-get>"
|
||||
}'
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 💰 成本控制
|
||||
|
||||
```bash
|
||||
# 查看使用统计
|
||||
moltbot models usage
|
||||
|
||||
# 设置每日限额
|
||||
# 在配置文件中:
|
||||
{
|
||||
"models": {
|
||||
"providers": {
|
||||
"anthropic": {
|
||||
"budget": {
|
||||
"daily": 100 // 美元
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📞 获取帮助
|
||||
|
||||
- 📖 [完整文档](ENTERPRISE.md)
|
||||
- 🔒 [安全清单](security-checklist.md)
|
||||
- 🐛 [问题反馈](https://github.com/m1heng/moltbot/issues)
|
||||
- 💬 [社区讨论](https://github.com/m1heng/moltbot/discussions)
|
||||
|
||||
---
|
||||
|
||||
## ⚠️ 重要提醒
|
||||
|
||||
1. **永远不要**将 API 密钥提交到版本控制
|
||||
2. **定期轮换** Gateway token (建议每月)
|
||||
3. **启用 HTTPS** 生产环境
|
||||
4. **配置会话隔离** 多用户场景
|
||||
5. **定期备份** 配置和会话数据
|
||||
6. **监控资源** 内存和 CPU 使用
|
||||
7. **更新软件** 保持最新版本
|
||||
183
docs/deployment/README.md
Normal file
183
docs/deployment/README.md
Normal file
@ -0,0 +1,183 @@
|
||||
# Moltbot 企业部署文件
|
||||
|
||||
本目录包含 Moltbot 企业级部署所需的所有文件和文档。
|
||||
|
||||
## 📁 文件说明
|
||||
|
||||
### 配置文件
|
||||
- **[enterprise-config.json5](enterprise-config.json5)** - 生产级配置模板
|
||||
- **[.env.example](.env.example)** - Docker 环境变量模板
|
||||
- **[docker-compose.yml](docker-compose.yml)** - Docker Compose 配置
|
||||
|
||||
### 脚本
|
||||
- **[setup-enterprise.sh](setup-enterprise.sh)** - 自动化部署脚本 (Linux/Ubuntu)
|
||||
|
||||
### 文档
|
||||
- **[ENTERPRISE.md](ENTERPRISE.md)** - 完整企业部署指南
|
||||
- **[QUICKSTART.md](QUICKSTART.md)** - 5分钟快速部署指南
|
||||
- **[security-checklist.md](security-checklist.md)** - 安全检查清单
|
||||
|
||||
## 🚀 快速开始
|
||||
|
||||
### 方案 1: 自动化脚本部署 (推荐用于 Ubuntu/Debian)
|
||||
|
||||
```bash
|
||||
# 1. 运行安装脚本
|
||||
chmod +x setup-enterprise.sh
|
||||
sudo ./setup-enterprise.sh
|
||||
|
||||
# 2. 配置环境变量
|
||||
sudo vim /etc/moltbot/environment
|
||||
|
||||
# 3. 启动服务
|
||||
sudo systemctl enable --now moltbot-gateway.service
|
||||
```
|
||||
|
||||
### 方案 2: Docker 部署
|
||||
|
||||
```bash
|
||||
# 1. 复制环境变量文件
|
||||
cp .env.example .env
|
||||
|
||||
# 2. 编辑 .env 文件，填写 API 密钥和 Token
|
||||
vim .env
|
||||
|
||||
# 3. 启动服务
|
||||
docker-compose up -d
|
||||
|
||||
# 4. 查看日志
|
||||
docker-compose logs -f
|
||||
```
|
||||
|
||||
### 方案 3: 手动部署
|
||||
|
||||
参见 [ENTERPRISE.md](ENTERPRISE.md) 中的详细步骤。
|
||||
|
||||
## 📋 部署前检查清单
|
||||
|
||||
在部署到生产环境前，请确认以下项目：
|
||||
|
||||
- [ ] 已设置强密码的 Gateway Token
|
||||
- [ ] API 密钥已通过环境变量配置
|
||||
- [ ] 配置了会话隔离 (`per-channel-peer`)
|
||||
- [ ] 启用了 Gateway 认证
|
||||
- [ ] 配置了 HTTPS/SSL
|
||||
- [ ] 设置了防火墙规则
|
||||
- [ ] 配置了日志轮转
|
||||
- [ ] 设置了定期备份
|
||||
- [ ] 运行了安全审计 (`moltbot security audit`)
|
||||
|
||||
完整检查清单请参考 [security-checklist.md](security-checklist.md)。
|
||||
|
||||
## 🔧 配置说明
|
||||
|
||||
### 必需配置
|
||||
|
||||
1. **环境变量** (必须)
|
||||
```bash
|
||||
export ANTHROPIC_API_KEY="sk-ant-..."
|
||||
export CLAWDBOT_GATEWAY_TOKEN="secure-token-32chars"
|
||||
```
|
||||
|
||||
2. **会话隔离** (多用户场景必须)
|
||||
```json5
|
||||
{
|
||||
"session": {
|
||||
"dmScope": "per-channel-peer"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
3. **Gateway 认证** (必须)
|
||||
```json5
|
||||
{
|
||||
"gateway": {
|
||||
"auth": {
|
||||
"mode": "token",
|
||||
"token": "${CLAWDBOT_GATEWAY_TOKEN}"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### 推荐配置
|
||||
|
||||
- HTTPS 反向代理 (Nginx/Caddy)
|
||||
- 日志轮转 (logrotate)
|
||||
- 系统服务管理 (systemd)
|
||||
- 资源限制 (Memory/CPU)
|
||||
- 健康检查监控
|
||||
|
||||
## 📊 规模建议
|
||||
|
||||
| 用户规模 | 服务器配置 | 部署方案 |
|
||||
|---------|----------|---------|
|
||||
| < 20 | 4核/8GB | 单服务器 |
|
||||
| 20-50 | 8核/16GB | 单服务器 |
|
||||
| 50-200 | 16核/32GB | 负载均衡 + 2实例 |
|
||||
| 200+ | 集群 | 负载均衡 + 多实例 + Redis |
|
||||
|
||||
## 🛡️ 安全建议
|
||||
|
||||
1. **永远不要**将 API 密钥提交到版本控制
|
||||
2. **使用环境变量**存储敏感信息
|
||||
3. **定期轮换**密钥和 Token (建议每月)
|
||||
4. **启用 HTTPS** 生产环境
|
||||
5. **配置会话隔离** 多用户场景
|
||||
6. **定期备份** 配置和数据
|
||||
7. **运行安全审计** 定期检查
|
||||
|
||||
## 📞 获取帮助
|
||||
|
||||
- 📖 [完整部署指南](ENTERPRISE.md)
|
||||
- ⚡ [快速开始](QUICKSTART.md)
|
||||
- 🔒 [安全检查清单](security-checklist.md)
|
||||
- 🐛 [问题反馈](https://github.com/m1heng/moltbot/issues)
|
||||
|
||||
## 📝 维护说明
|
||||
|
||||
### 日常维护
|
||||
|
||||
```bash
|
||||
# 查看服务状态
|
||||
systemctl status moltbot-gateway.service
|
||||
|
||||
# 查看日志
|
||||
journalctl -u moltbot-gateway.service -f
|
||||
|
||||
# 安全审计
|
||||
moltbot security audit
|
||||
|
||||
# 查看模型状态
|
||||
moltbot models status
|
||||
```
|
||||
|
||||
### 更新配置
|
||||
|
||||
```bash
|
||||
# 编辑配置
|
||||
sudo vim /etc/moltbot/moltbot.json
|
||||
|
||||
# 重启服务
|
||||
sudo systemctl restart moltbot-gateway.service
|
||||
```
|
||||
|
||||
### 备份
|
||||
|
||||
```bash
|
||||
# 备份配置和数据
|
||||
tar -czf moltbot-backup-$(date +%Y%m%d).tar.gz \
|
||||
/etc/moltbot \
|
||||
/var/lib/moltbot
|
||||
```
|
||||
|
||||
## ⚠️ 重要提示
|
||||
|
||||
1. 本目录中的配置文件仅供参考，实际部署时请根据您的环境调整
|
||||
2. 请务必修改所有默认值和示例值（密码、Token、域名等）
|
||||
3. 生产环境部署前请先在测试环境验证
|
||||
4. 定期检查并更新到最新版本以获取安全补丁
|
||||
|
||||
## 📄 许可证
|
||||
|
||||
本部署脚本和配置遵循 Moltbot 项目的开源许可证。
|
||||
92
docs/deployment/docker-compose.yml
Normal file
92
docs/deployment/docker-compose.yml
Normal file
@ -0,0 +1,92 @@
|
||||
version: '3.8'
|
||||
|
||||
services:
|
||||
moltbot:
|
||||
image: moltbot:latest
|
||||
container_name: moltbot-gateway
|
||||
restart: unless-stopped
|
||||
|
||||
# 环境变量
|
||||
environment:
|
||||
- ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
|
||||
- CLAWDBOT_GATEWAY_TOKEN=${CLAWDBOT_GATEWAY_TOKEN}
|
||||
- CLAWDBOT_STATE_DIR=/app/data
|
||||
- NODE_ENV=production
|
||||
|
||||
# 端口映射
|
||||
ports:
|
||||
- "18789:18789"
|
||||
|
||||
# 卷挂载
|
||||
volumes:
|
||||
- ./config:/app/config:ro
|
||||
- moltbot-data:/app/data
|
||||
- moltbot-logs:/app/logs
|
||||
|
||||
# 健康检查
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-f", "http://localhost:18789/health"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 40s
|
||||
|
||||
# 资源限制
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '2.0'
|
||||
memory: 4G
|
||||
reservations:
|
||||
cpus: '0.5'
|
||||
memory: 1G
|
||||
|
||||
# 日志配置
|
||||
logging:
|
||||
driver: "json-file"
|
||||
options:
|
||||
max-size: "100m"
|
||||
max-file: "5"
|
||||
|
||||
# 网络模式
|
||||
network_mode: "bridge"
|
||||
|
||||
# Nginx 反向代理 (可选)
|
||||
nginx:
|
||||
image: nginx:alpine
|
||||
container_name: moltbot-nginx
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
volumes:
|
||||
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
|
||||
- ./nginx/ssl:/etc/nginx/ssl:ro
|
||||
- ./nginx/logs:/var/log/nginx
|
||||
depends_on:
|
||||
- moltbot
|
||||
networks:
|
||||
- moltbot-network
|
||||
|
||||
# Redis (可选，用于高可用部署)
|
||||
redis:
|
||||
image: redis:alpine
|
||||
container_name: moltbot-redis
|
||||
restart: unless-stopped
|
||||
command: redis-server --appendonly yes
|
||||
volumes:
|
||||
- redis-data:/data
|
||||
networks:
|
||||
- moltbot-network
|
||||
|
||||
networks:
|
||||
moltbot-network:
|
||||
driver: bridge
|
||||
|
||||
volumes:
|
||||
moltbot-data:
|
||||
driver: local
|
||||
moltbot-logs:
|
||||
driver: local
|
||||
redis-data:
|
||||
driver: local
|
||||
110
docs/deployment/enterprise-config.json5
Normal file
110
docs/deployment/enterprise-config.json5
Normal file
@ -0,0 +1,110 @@
|
||||
{
|
||||
// ===== 网关配置 =====
|
||||
"gateway": {
|
||||
"mode": "local",
|
||||
"bind": "lan", // 绑定到所有网络接口
|
||||
"port": 18789,
|
||||
"auth": {
|
||||
"mode": "token", // 推荐: token 认证
|
||||
"token": "${CLAWDBOT_GATEWAY_TOKEN}" // 从环境变量读取
|
||||
},
|
||||
"trustedProxies": ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"] // 公司内网
|
||||
},
|
||||
|
||||
// ===== 模型配置 =====
|
||||
"models": {
|
||||
"mode": "merge", // 合并内置模型
|
||||
"providers": {
|
||||
"anthropic": {
|
||||
"baseUrl": "https://open.bigmodel.cn/api/anthropic",
|
||||
"apiKey": "${ANTHROPIC_API_KEY}", // 必须使用环境变量
|
||||
"api": "anthropic-messages",
|
||||
"models": [
|
||||
{
|
||||
"id": "claude-opus-4-5",
|
||||
"name": "Claude Opus 4.5",
|
||||
"reasoning": false,
|
||||
"input": ["text", "image"],
|
||||
"cost": {
|
||||
"input": 15,
|
||||
"output": 75,
|
||||
"cacheRead": 1.5,
|
||||
"cacheWrite": 3.75
|
||||
},
|
||||
"contextWindow": 200000,
|
||||
"maxTokens": 8192
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
|
||||
// ===== Agent 配置 =====
|
||||
"agents": {
|
||||
"defaults": {
|
||||
"workspace": "/var/lib/moltbot/workspace",
|
||||
"model": {
|
||||
"primary": "anthropic/claude-opus-4-5"
|
||||
},
|
||||
"maxConcurrent": 8, // 根据服务器资源调整
|
||||
"subagents": {
|
||||
"maxConcurrent": 16
|
||||
},
|
||||
"contextPruning": {
|
||||
"mode": "cache-ttl",
|
||||
"ttl": "1h"
|
||||
},
|
||||
"heartbeat": {
|
||||
"every": "30m"
|
||||
},
|
||||
"models": {
|
||||
"anthropic/claude-opus-4-5": {
|
||||
"params": {
|
||||
"cacheControlTtl": "1h"
|
||||
},
|
||||
"alias": "opus"
|
||||
}
|
||||
},
|
||||
"compaction": {
|
||||
"mode": "safeguard"
|
||||
},
|
||||
// 生产环境：禁用自动引导文件，使用 Git 管理的工作区
|
||||
"skipBootstrap": true
|
||||
}
|
||||
},
|
||||
|
||||
// ===== 会话隔离 (多用户关键配置) =====
|
||||
"session": {
|
||||
"dmScope": "per-channel-peer", // 每个用户独立会话
|
||||
"reset": {
|
||||
"mode": "idle", // 空闲时重置，而非固定时间
|
||||
"idleMinutes": 120
|
||||
}
|
||||
},
|
||||
|
||||
// ===== 日志配置 =====
|
||||
"logging": {
|
||||
"level": "info",
|
||||
"redactSensitive": "tools", // 过滤敏感信息
|
||||
"file": {
|
||||
"enabled": true,
|
||||
"path": "/var/log/moltbot/gateway.log",
|
||||
"maxSize": "100M",
|
||||
"maxFiles": 10
|
||||
}
|
||||
},
|
||||
|
||||
// ===== 安全配置 =====
|
||||
"commands": {
|
||||
"native": "auto",
|
||||
"nativeSkills": "auto",
|
||||
"useAccessGroups": ["operators"] // 只有操作员可以执行命令
|
||||
},
|
||||
|
||||
// ===== 消息配置 =====
|
||||
"messages": {
|
||||
"responsePrefix": "[{model}] ",
|
||||
"ackReaction": "👀",
|
||||
"ackReactionScope": "group-mentions"
|
||||
}
|
||||
}
|
||||
242
docs/deployment/security-checklist.md
Normal file
242
docs/deployment/security-checklist.md
Normal file
@ -0,0 +1,242 @@
|
||||
# Moltbot 安全检查清单
|
||||
|
||||
## 部署前安全检查
|
||||
|
||||
### ✅ 基础配置
|
||||
|
||||
- [ ] 使用专用系统用户运行 Moltbot (非 root)
|
||||
- [ ] 配置文件权限设置为 640 或更严格
|
||||
- [ ] 会话目录权限设置为 700
|
||||
- [ ] API 密钥使用环境变量存储，不硬编码
|
||||
- [ ] Gateway token 长度至少 32 字符
|
||||
- [ ] 启用 Gateway 认证 (token 或 password)
|
||||
- [ ] 配置会话隔离 (`session.dmScope: per-channel-peer`)
|
||||
|
||||
### ✅ 网络安全
|
||||
|
||||
- [ ] 使用 HTTPS (SSL/TLS)
|
||||
- [ ] 配置防火墙规则，限制访问来源
|
||||
- [ ] 配置反向代理 (Nginx/Caddy)
|
||||
- [ ] 设置 `trustedProxies` (如果使用反向代理)
|
||||
- [ ] 禁用公网绑定 (bind: loopback 或配置防火墙)
|
||||
|
||||
### ✅ 访问控制
|
||||
|
||||
- [ ] 配置用户白名单/配对机制
|
||||
- [ ] 限制可执行命令的用户组
|
||||
- [ ] 禁用不必要的工具/功能
|
||||
- [ ] 配置沙箱模式 (如果需要文件/Shell 访问)
|
||||
|
||||
### ✅ 日志和监控
|
||||
|
||||
- [ ] 启用敏感信息脱敏 (`redactSensitive: tools`)
|
||||
- [ ] 配置日志轮转
|
||||
- [ ] 设置日志监控和告警
|
||||
- [ ] 定期运行安全审计 (`moltbot security audit`)
|
||||
|
||||
### ✅ 数据保护
|
||||
|
||||
- [ ] 定期备份配置和会话数据
|
||||
- [ ] 加密备份文件
|
||||
- [ ] 限制备份文件访问权限
|
||||
- [ ] 制定数据保留策略
|
||||
|
||||
### ✅ 证书和密钥
|
||||
|
||||
- [ ] 使用 Let's Encrypt 或其他可信 CA 证书
|
||||
- [ ] 配置自动证书续期
|
||||
- [ ] 定期轮换 API 密钥和 token
|
||||
- [ ] 使用强密码策略
|
||||
|
||||
### ✅ 更新和维护
|
||||
|
||||
- [ ] 定期更新 Moltbot 到最新版本
|
||||
- [ ] 定期更新依赖包
|
||||
- [ ] 订阅安全公告
|
||||
- [ ] 制定应急响应计划
|
||||
|
||||
---
|
||||
|
||||
## 运行时安全检查
|
||||
|
||||
### 每日检查
|
||||
|
||||
```bash
|
||||
# 1. 服务状态
|
||||
systemctl status moltbot-gateway.service
|
||||
|
||||
# 2. 错误日志
|
||||
journalctl -u moltbot-gateway.service --since "1 day ago" | grep -i error
|
||||
|
||||
# 3. 异常访问
|
||||
grep -i "unauthorized\|forbidden" /var/log/moltbot/gateway.log
|
||||
|
||||
# 4. 资源使用
|
||||
ps aux | grep moltbot-gateway
|
||||
```
|
||||
|
||||
### 每周检查
|
||||
|
||||
```bash
|
||||
# 1. 完整安全审计
|
||||
moltbot security audit --deep
|
||||
|
||||
# 2. 磁盘使用
|
||||
du -sh /var/lib/moltbot
|
||||
|
||||
# 3. 日志大小
|
||||
du -sh /var/log/moltbot
|
||||
|
||||
# 4. 证书有效期
|
||||
openssl x509 -in /etc/letsencrypt/live/moltbot.company.com/cert.pem -noout -dates
|
||||
```
|
||||
|
||||
### 每月检查
|
||||
|
||||
```bash
|
||||
# 1. 备份验证
|
||||
test -f /backup/moltbot/$(date +%Y%m%d)/moltbot.json
|
||||
|
||||
# 2. API 使用统计
|
||||
moltbot models usage
|
||||
|
||||
# 3. 性能分析
|
||||
moltbot health
|
||||
|
||||
# 4. 密钥轮换检查
|
||||
# 检查密钥是否超过 90 天未更换
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 安全事件响应
|
||||
|
||||
### 检测到异常访问
|
||||
|
||||
1. **立即行动**
|
||||
```bash
|
||||
# 停止服务
|
||||
systemctl stop moltbot-gateway.service
|
||||
|
||||
# 检查日志
|
||||
journalctl -u moltbot-gateway.service -n 1000 > /tmp/security-incident.log
|
||||
|
||||
# 保存会话数据作为证据
|
||||
cp -r /var/lib/moltbot/sessions /tmp/evidence/
|
||||
```
|
||||
|
||||
2. **调查分析**
|
||||
- 检查访问日志中的异常 IP
|
||||
- 检查执行的命令
|
||||
- 检查文件访问记录
|
||||
|
||||
3. **恢复服务**
|
||||
- 轮换所有密钥和 token
|
||||
- 审查访问控制配置
|
||||
- 更新防火墙规则
|
||||
- 从备份恢复配置
|
||||
|
||||
4. **加固措施**
|
||||
- 限制访问来源
|
||||
- 启用更严格的认证
|
||||
- 增加监控频率
|
||||
- 通知相关用户
|
||||
|
||||
### API 密钥泄露
|
||||
|
||||
1. **立即撤销泄露的密钥**
|
||||
2. **生成新的 API 密钥**
|
||||
3. **更新环境变量**
|
||||
4. **重启服务**
|
||||
5. **检查使用记录，确认损失范围**
|
||||
|
||||
---
|
||||
|
||||
## 合规性检查
|
||||
|
||||
### GDPR (欧盟)
|
||||
|
||||
- [ ] 用户有权查看和删除其数据
|
||||
- [ ] 会话数据加密存储
|
||||
- [ ] 数据处理记录
|
||||
- [ ] 隐私政策告知用户数据使用
|
||||
|
||||
### SOC 2
|
||||
|
||||
- [ ] 访问控制文档化
|
||||
- [ ] 变更管理流程
|
||||
- [ ] 事件响应程序
|
||||
- [ ] 定期安全审计
|
||||
|
||||
### ISO 27001
|
||||
|
||||
- [ ] 信息安全策略
|
||||
- [ ] 资产管理
|
||||
- [ ] 访问控制
|
||||
- [ ] 密码学控制
|
||||
- [ ] 操作安全
|
||||
|
||||
---
|
||||
|
||||
## 安全配置示例
|
||||
|
||||
### 最小权限配置
|
||||
|
||||
```json5
|
||||
{
|
||||
"gateway": {
|
||||
"bind": "127.0.0.1", // 仅本地
|
||||
"auth": {
|
||||
"mode": "token",
|
||||
"token": "${CLAWDBOT_GATEWAY_TOKEN}"
|
||||
}
|
||||
},
|
||||
"session": {
|
||||
"dmScope": "per-channel-peer"
|
||||
},
|
||||
"commands": {
|
||||
"useAccessGroups": ["operators"]
|
||||
},
|
||||
"logging": {
|
||||
"redactSensitive": "tools"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### 企业级配置
|
||||
|
||||
```json5
|
||||
{
|
||||
"gateway": {
|
||||
"bind": "lan",
|
||||
"auth": {
|
||||
"mode": "token",
|
||||
"token": "${CLAWDBOT_GATEWAY_TOKEN}"
|
||||
},
|
||||
"trustedProxies": ["10.0.0.0/8"]
|
||||
},
|
||||
"session": {
|
||||
"dmScope": "per-channel-peer",
|
||||
"reset": {
|
||||
"mode": "idle",
|
||||
"idleMinutes": 60
|
||||
}
|
||||
},
|
||||
"agents": {
|
||||
"defaults": {
|
||||
"maxConcurrent": 8,
|
||||
"sandbox": {
|
||||
"mode": "docker" // 沙箱隔离
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 联系和支持
|
||||
|
||||
- 官方文档: https://docs.molt.bot
|
||||
- 安全问题: security@molt.bot
|
||||
- GitHub Issues: https://github.com/m1heng/moltbot/issues
|
||||
309
docs/deployment/setup-enterprise.sh
Normal file
309
docs/deployment/setup-enterprise.sh
Normal file
@ -0,0 +1,309 @@
|
||||
#!/bin/bash
|
||||
# Moltbot 企业部署脚本
|
||||
# 适用于 Ubuntu/Debian Linux
|
||||
|
||||
set -e
|
||||
|
||||
# ===== 配置变量 =====
|
||||
MOLTBOT_USER="moltbot"
|
||||
MOLTBOT_HOME="/var/lib/moltbot"
|
||||
MOLTBOT_LOG_DIR="/var/log/moltbot"
|
||||
MOLTBOT_CONFIG_DIR="/etc/moltbot"
|
||||
INSTALL_DIR="/opt/moltbot"
|
||||
|
||||
# 颜色输出
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
log_info() {
|
||||
echo -e "${GREEN}[INFO]${NC} $1"
|
||||
}
|
||||
|
||||
log_warn() {
|
||||
echo -e "${YELLOW}[WARN]${NC} $1"
|
||||
}
|
||||
|
||||
log_error() {
|
||||
echo -e "${RED}[ERROR]${NC} $1"
|
||||
}
|
||||
|
||||
# ===== 检查 root 权限 =====
|
||||
check_root() {
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
log_error "此脚本需要 root 权限运行"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# ===== 创建系统用户 =====
|
||||
create_user() {
|
||||
log_info "创建 Moltbot 系统用户..."
|
||||
if ! id "$MOLTBOT_USER" &>/dev/null; then
|
||||
useradd -r -s /bin/bash -d "$MOLTBOT_HOME" "$MOLTBOT_USER"
|
||||
log_info "用户 $MOLTBOT_USER 创建成功"
|
||||
else
|
||||
log_warn "用户 $MOLTBOT_USER 已存在"
|
||||
fi
|
||||
}
|
||||
|
||||
# ===== 创建目录结构 =====
|
||||
create_directories() {
|
||||
log_info "创建目录结构..."
|
||||
mkdir -p "$MOLTBOT_HOME"/{workspace,sessions,credentials}
|
||||
mkdir -p "$MOLTBOT_LOG_DIR"
|
||||
mkdir -p "$MOLTBOT_CONFIG_DIR"
|
||||
mkdir -p "$INSTALL_DIR"
|
||||
|
||||
# 设置权限
|
||||
chown -R "$MOLTBOT_USER:$MOLTBOT_USER" "$MOLTBOT_HOME"
|
||||
chown -R "$MOLTBOT_USER:$MOLTBOT_USER" "$MOLTBOT_LOG_DIR"
|
||||
chmod 750 "$MOLTBOT_HOME"
|
||||
chmod 750 "$MOLTBOT_LOG_DIR"
|
||||
|
||||
log_info "目录创建完成"
|
||||
}
|
||||
|
||||
# ===== 安装 Moltbot =====
|
||||
install_moltbot() {
|
||||
log_info "安装 Moltbot..."
|
||||
|
||||
# 检查是否已安装
|
||||
if [ -d "$INSTALL_DIR/moltbot" ]; then
|
||||
log_warn "Moltbot 似乎已安装在 $INSTALL_DIR/moltbot"
|
||||
read -p "是否重新安装? (y/N): " -n 1 -r
|
||||
echo
|
||||
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
|
||||
return
|
||||
fi
|
||||
rm -rf "$INSTALL_DIR/moltbot"
|
||||
fi
|
||||
|
||||
# 这里假设从现有目录复制或从 git 克隆
|
||||
if [ -d "/root/moltbot" ]; then
|
||||
cp -r /root/moltbot "$INSTALL_DIR/"
|
||||
chown -R "$MOLTBOT_USER:$MOLTBOT_USER" "$INSTALL_DIR/moltbot"
|
||||
log_info "Moltbot 安装完成"
|
||||
else
|
||||
log_error "请先在 /root/moltbot 准备 Moltbot 源码"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# ===== 配置环境变量 =====
|
||||
setup_environment() {
|
||||
log_info "配置环境变量..."
|
||||
|
||||
cat > "$MOLTBOT_CONFIG_DIR/environment" <<EOF
|
||||
# Moltbot 环境变量
|
||||
# 注意：不要在版本控制中提交实际密钥
|
||||
|
||||
# Anthropic API 密钥 (必填)
|
||||
export ANTHROPIC_API_KEY="your-api-key-here"
|
||||
|
||||
# Gateway Token (必填，建议使用强密码)
|
||||
export CLAWDBOT_GATEWAY_TOKEN="your-gateway-token-here"
|
||||
|
||||
# 可选：自定义配置文件路径
|
||||
export CLAWDBOT_STATE_DIR="$MOLTBOT_HOME"
|
||||
export CLAWDBOT_CONFIG_FILE="$MOLTBOT_CONFIG_DIR/moltbot.json"
|
||||
EOF
|
||||
|
||||
chmod 600 "$MOLTBOT_CONFIG_DIR/environment"
|
||||
chown "$MOLTBOT_USER:$MOLTBOT_USER" "$MOLTBOT_CONFIG_DIR/environment"
|
||||
|
||||
log_warn "请编辑 $MOLTBOT_CONFIG_DIR/environment 并设置您的 API 密钥"
|
||||
}
|
||||
|
||||
# ===== 安装 systemd 服务 =====
|
||||
install_service() {
|
||||
log_info "安装 systemd 服务..."
|
||||
|
||||
cat > /etc/systemd/system/moltbot-gateway.service <<EOF
|
||||
[Unit]
|
||||
Description=Moltbot Gateway
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=$MOLTBOT_USER
|
||||
Group=$MOLTBOT_USER
|
||||
WorkingDirectory=$INSTALL_DIR/moltbot
|
||||
EnvironmentFile=$MOLTBOT_CONFIG_DIR/environment
|
||||
ExecStart=/usr/bin/node $INSTALL_DIR/moltbot/dist/index.js gateway
|
||||
Restart=on-failure
|
||||
RestartSec=10
|
||||
StandardOutput=append:$MOLTBOT_LOG_DIR/gateway.log
|
||||
StandardError=append:$MOLTBOT_LOG_DIR/gateway-error.log
|
||||
|
||||
# 安全加固
|
||||
NoNewPrivileges=true
|
||||
PrivateTmp=true
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
ReadWritePaths=$MOLTBOT_HOME $MOLTBOT_LOG_DIR $MOLTBOT_CONFIG_DIR
|
||||
|
||||
# 资源限制
|
||||
LimitNOFILE=65536
|
||||
MemoryMax=2G
|
||||
CPUQuota=200%
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
systemctl daemon-reload
|
||||
log_info "systemd 服务安装完成"
|
||||
}
|
||||
|
||||
# ===== 配置 logrotate =====
|
||||
setup_logrotate() {
|
||||
log_info "配置日志轮转..."
|
||||
|
||||
cat > /etc/logrotate.d/moltbot <<EOF
|
||||
$MOLTBOT_LOG_DIR/*.log {
|
||||
daily
|
||||
rotate 30
|
||||
compress
|
||||
delaycompress
|
||||
notifempty
|
||||
create 0640 $MOLTBOT_USER $MOLTBOT_USER
|
||||
sharedscripts
|
||||
postrotate
|
||||
systemctl reload moltbot-gateway.service >/dev/null 2>&1 || true
|
||||
endscript
|
||||
}
|
||||
EOF
|
||||
|
||||
log_info "日志轮转配置完成"
|
||||
}
|
||||
|
||||
# ===== 配置防火墙 =====
|
||||
setup_firewall() {
|
||||
log_info "配置防火墙..."
|
||||
|
||||
if command -v ufw &> /dev/null; then
|
||||
ufw allow 18789/tcp comment 'Moltbot Gateway'
|
||||
log_info "UFW 防火墙规则已添加"
|
||||
elif command -v firewall-cmd &> /dev/null; then
|
||||
firewall-cmd --permanent --add-port=18789/tcp
|
||||
firewall-cmd --reload
|
||||
log_info "firewalld 防火墙规则已添加"
|
||||
else
|
||||
log_warn "未检测到防火墙，请手动开放端口 18789"
|
||||
fi
|
||||
}
|
||||
|
||||
# ===== 安装 Nginx 反向代理 =====
|
||||
install_nginx() {
|
||||
log_info "配置 Nginx 反向代理..."
|
||||
|
||||
if ! command -v nginx &> /dev/null; then
|
||||
log_warn "Nginx 未安装，跳过反向代理配置"
|
||||
return
|
||||
fi
|
||||
|
||||
cat > /etc/nginx/sites-available/moltbot <<'EOF'
|
||||
# Moltbot Gateway 反向代理配置
|
||||
server {
|
||||
listen 80;
|
||||
server_name moltbot.yourcompany.com;
|
||||
|
||||
# 强制 HTTPS
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name moltbot.yourcompany.com;
|
||||
|
||||
# SSL 证书配置 (使用 Let's Encrypt)
|
||||
ssl_certificate /etc/letsencrypt/live/moltbot.yourcompany.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/moltbot.yourcompany.com/privkey.pem;
|
||||
|
||||
# SSL 安全配置
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
# 日志
|
||||
access_log /var/log/nginx/moltbot-access.log;
|
||||
error_log /var/log/nginx/moltbot-error.log;
|
||||
|
||||
# 反向代理到 Moltbot Gateway
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:18789;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
# WebSocket 支持
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
|
||||
# 代理头
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_to;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# 超时设置
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_read_timeout 300s;
|
||||
|
||||
# 缓冲禁用 (流式响应需要)
|
||||
proxy_buffering off;
|
||||
}
|
||||
|
||||
# 健康检查端点
|
||||
location /health {
|
||||
proxy_pass http://127.0.0.1:18789/health;
|
||||
access_log off;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
log_info "Nginx 配置文件已创建: /etc/nginx/sites-available/moltbot"
|
||||
log_warn "请修改 server_name 并启用配置: ln -s /etc/nginx/sites-available/moltbot /etc/nginx/sites-enabled/"
|
||||
}
|
||||
|
||||
# ===== 主函数 =====
|
||||
main() {
|
||||
log_info "开始安装 Moltbot 企业版..."
|
||||
|
||||
check_root
|
||||
create_user
|
||||
create_directories
|
||||
install_moltbot
|
||||
setup_environment
|
||||
install_service
|
||||
setup_logrotate
|
||||
setup_firewall
|
||||
install_nginx
|
||||
|
||||
echo ""
|
||||
log_info "安装完成！"
|
||||
echo ""
|
||||
echo "后续步骤："
|
||||
echo "1. 编辑环境变量文件："
|
||||
echo " vim $MOLTBOT_CONFIG_DIR/environment"
|
||||
echo ""
|
||||
echo "2. 复制企业配置文件："
|
||||
echo " cp enterprise-config.json5 $MOLTBOT_CONFIG_DIR/moltbot.json"
|
||||
echo ""
|
||||
echo "3. 配置 Nginx（如果使用）："
|
||||
echo " vim /etc/nginx/sites-available/moltbot"
|
||||
echo " ln -s /etc/nginx/sites-available/moltbot /etc/nginx/sites-enabled/"
|
||||
echo " nginx -t && systemctl reload nginx"
|
||||
echo ""
|
||||
echo "4. 启动服务："
|
||||
echo " systemctl enable --now moltbot-gateway.service"
|
||||
echo ""
|
||||
echo "5. 查看状态："
|
||||
echo " systemctl status moltbot-gateway.service"
|
||||
echo " journalctl -u moltbot-gateway.service -f"
|
||||
}
|
||||
|
||||
# 运行主函数
|
||||
main "$@"
|
||||
Loading…
Reference in New Issue
Block a user