远程部署服务器docker环境

自动部署脚本
将以下脚本(ca.sh) 放到服务器根目录(/root)
运行命令 sh /root/ca.sh
(ubuntu系统需要把yum换成apt-get)

#!/bin/bash -e

# 数据卷路径
VOLUME="/data"

COUNTRY="CN"
STATE="shanghai"
CITY="shanghai"
ORGANIZATION="shanghai"
ORGANIZATIONAL_UNIT="Dev"
EMAIL="service@shopxx.net"
TIMEOUT=3

ECSURL=$(curl ifconfig.co)
if [[ -z $ECSURL ]];then
    echo "ECS URL is empty"
    exit 8
fi

ECSPassword=Shopxx1234~

yum update -y
yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
yum install -y docker-ce
systemctl start docker
systemctl enable docker
echo '{
  "registry-mirrors": [
    "https://afjba8p7.mirror.aliyuncs.com",
    "https://reg-mirror.qiniu.com/",
    "http://hub-mirror.c.163.com",
    "https://docker.mirrors.ustc.edu.cn"
  ],
  "live-restore": true
}' >> /etc/docker/daemon.json
systemctl daemon-reload
systemctl restart docker

rm -rf /docker/ca
mkdir -p /docker/ca
cd /docker/ca
openssl genrsa -aes256 -passout "pass:$ECSPassword"  -out ca-key.pem 2048
openssl req -new -x509 -passin "pass:$ECSPassword" -days 3650 -key ca-key.pem -sha256 -out ca.pem -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORGANIZATION/OU=$ORGANIZATIONAL_UNIT/CN=$ECSURL/emailAddress=$EMAIL"
openssl genrsa -out server-key.pem 2048
openssl req -subj "/CN=$ECSURL" -new -key server-key.pem -out server.csr
echo "subjectAltName=IP:${ECSURL},IP:0.0.0.0" >> extfile.cnf
echo "extendedKeyUsage=serverAuth" >> extfile.cnf
openssl x509 -req -days 3650 -in server.csr -CA ca.pem -CAkey ca-key.pem -passin "pass:$ECSPassword" -CAcreateserial  -out server-cert.pem -extfile extfile.cnf
openssl genrsa -out key.pem 2048
openssl req -subj '/CN=client' -new -key key.pem -out client.csr
sh -c 'echo "extendedKeyUsage=clientAuth" > extfile.cnf'
openssl x509 -req -days 3650 -in client.csr -CA ca.pem -CAkey ca-key.pem  -passin "pass:$ECSPassword" -CAcreateserial -out cert.pem  -extfile extfile.cnf
chmod 0400 ca-key.pem key.pem server-key.pem
chmod 0444 ca.pem server-cert.pem cert.pem
rm -v client.csr server.csr
sed -i "s|\(ExecStart=/usr/bin/dockerd\).*\(-H fd:// --containerd=/run/containerd/containerd.sock\)|\1 --tlsverify --tlscacert=/docker/ca/ca.pem --tlscert=/docker/ca/server-cert.pem --tlskey=/docker/ca/server-key.pem -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock \2|" /usr/lib/systemd/system/docker.service
sed -i "s|\(ExecStart=/usr/bin/dockerd-current\).*\(\\)|\1 --tlsverify --tlscacert=/docker/ca/ca.pem --tlscert=/docker/ca/server-cert.pem --tlskey=/docker/ca/server-key.pem -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock \2|" /usr/lib/systemd/system/docker.service
ln -s /usr/libexec/docker/docker-runc-current /usr/bin/docker-runc
systemctl daemon-reload
systemctl restart docker.service

mkdir -p $VOLUME && chmod 777 $VOLUME

rm $0

把这三个文件下载到本地 并放入同一个文件夹(推荐以ca命名文件夹)

用idea运行Services

链接成功即可(有权限问题可能链接失败)
运行以下指令打开2375防火墙并重启

#查看防火墙状态
systemctl status firewalld
#启动防火墙 没有提示
systemctl start firewalld
#添加2375端口
firewall-cmd --permanent --zone=public --add-port=2375/tcp
#防火墙重启
firewall-cmd --reload
#查看开放的端口
firewall-cmd --permanent --zone=public --list-ports