Ubuntu20.04.3 + opengrok1.7.25 + tomcat10.0.14安装

1.环境准备

Java >=11
Tomcat >=10.0
Python >=3.6

2.Jdk安装

apt-get install openjdk-11-jdk

3.Tomcat安装

apt install wget
wget https://archive.apache.org/dist/tomcat/tomcat-10/v10.0.14/bin/apache-tomcat-10.0.14.tar.gz
tar -zxvf apache-tomcat-10.0.14.tar.gz -C /usr/share/
cd /usr/share && mv apache-tomcat-10.0.14 apache-tomcat
useradd -M -d /usr/share/apache-tomcat tomcat
chown -R tomcat /usr/share/apache-tomcat

vim /etc/systemd/system/tomcat.service

[Unit]
Description=Tomcat
After=syslog.target network.target
[Service]
Type=forking
User=tomcat
Group=tomcat
Environment=JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64
Environment='JAVA_OPTS=-Djava.awt.headless=true'
Environment=CATALINA_HOME=/usr/share/apache-tomcat
Environment=CATALINA_BASE=/usr/share/apache-tomcat
Environment=CATALINA_PID=/usr/share/apache-tomcat/temp/tomcat.pid
ExecStart=/usr/share/apache-tomcat/bin/catalina.sh start
ExecStop=/usr/share/apache-tomcat/bin/catalina.sh stop
[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl restart tomcat
systemctl enable tomcat

如果启动成功，则应该在系统上看到Java进程正在使用8080端口

ss -tunelp | grep 8080

修改端口 vi /usr/share/apache-tomcat/conf/server.xml

#以下2个port都要修改
<Server port="8010" shutdown="SHUTDOWN">
<Connector port="8082" protocol="HTTP/1.1"

4.Ctags安装

如果机器上自带ctags需要先卸载，源码编译安装github上的版本

apt-get instal git
git clone https://github.com/universal-ctags
apt-get install autoconf automake pkg-config gcc g++
cd ctags
./autogen.sh
./configure
make 
make install

5.Opengrok部署

二进制包地址：https://github.com/oracle/opengrok/releases

此处下载的是opengrok-1.7.25.tar.gz

apt-get install python3
mkdir -p /opengrok/{src,data,dist,etc,log}
cd /opengrok
tar -C /opengrok/dist --strip-components=1 -xzf /opt/opengrok-1.7.25.tar.gz
cp /opengrok/dist/doc/logging.properties /opengrok/etc
pip3 install opengrok-tools.tar.gz
opengrok-deploy -c /opengrok/etc/configuration.xml /opengrok/dist/lib/source.war /usr/share/apache-tomcat/webapps
java -Djava.util.logging.config.file=/opengrok/etc/logging.properties -jar /opengrok/dist/lib/opengrok.jar -c /usr/local/bin/ctags -s /opengrok/src -d /opengrok/data -H -P -S -G -W /opengrok/etc/configuration.xml -U http://localhost:8080/source   #创建索引

java -jar /opengrok/dist/lib/opengrok.jar -h

主要参数如下：

-Djava.util.logging.config.file: 配置日志属性
-jar: 下载的opengrok.tar.gz中提供的opengrok.jar
-c: 之前编译好的ctags的执行路径
-s: 要建立索引的源代码目录
-d: 生成索引数据的目录
-W: 配置文件
-H:生成历史记录

opengrok-projadm -b /opengrok -d xxx -U http://localhost:8080/xxx

主要参数如下：

-b:opengrok base目录
-d:要删除的目录
-U:项目URL

索引多项目

目录为：$test

mkdir -p /data/$test/src #放置代码，repo init -u ....
mkdir -p /data/$test/data
mkdir /opengrok/$test/{etc,log}
cp /opengrok/etc/logging.properties /opengrok/$test/etc
vim /opengrok/$test/etc/logging.properties #将第二行java.util.logging.FileHandler.pattern地址改为实际项目log位置
java.util.logging.FileHandler.pattern = /opengrok/$test/log/opengrok%g.%u.log
cd /opengrok/$test/ && ln -s /data/$test/src .   #源码位置，/data/$test/src 为需要索引的repo代码，可以提前下载到某个目录软连接过来
cd /opengrok/$test/ && ln -s /data/$test/data . #索引存放的位置
cp /opengrok/dist/lib/source.war /usr/share/apache-tomcat/webapps/$test.war 
vim /usr/share/apache-tomcat/webapps/$test/WEB-INF/web.xml 
#将CONFIGURATION地址指向项目实际配置文件地址，在这里是/opengrok/$test/etc/configuration.xm
java -Djava.util.logging.config.file=/opengrok/$test/etc/logging.properties -jar /opengrok/dist/lib/opengrok.jar -c /usr/local/bin/ctags -s /opengrok/$test/src  -d /opengrok/$test/data -P -S -G -W /opengrok/$test/etc/configuration.xml  -U http://localhost:8081/$test
systemctl  restart tomcat.service

crontab脚本设置每日自动更新代码、创建索引动作。

#查看定时任务
vi /etc/crontab

6.tomcat配用户

（1）手写用户
vi /usr/share/apache-tomcat/conf/tomcat-users.xml

  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <user username="tomcat" password="<must-be-changed>" roles="tomcat"/>
  <user username="both" password="<must-be-changed>" roles="tomcat,role1"/>
  <user username="role1" password="<must-be-changed>" roles="role1"/>

vi /usr/share/apache-tomcat/webapps/$test/WEB-INF/web.xml

#最后 </jsp-config> 后加上
<security-constraint>
    <web-resource-collection>
        <web-resource-name>In general everything needs to be authenticated</web-resource-name>
        <url-pattern>/*</url-pattern>
        <url-pattern>/api/v1/search</url-pattern>
        <url-pattern>/api/v1/suggest/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>role1</role-name>
    </auth-constraint>
    
</security-constraint>

<login-config>
    <auth-method>BASIC</auth-method>
</login-config>

（2）ldap
vi /usr/share/apache-tomcat/conf/server.xml
注释UserDatabase这段

 <Resource name="UserDatabase" auth="Container"
              type="org.apache.catalina.UserDatabase"
              description="User database that can be updated and saved"
              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
              pathname="conf/tomcat-users.xml" />

搜索realm修改成下面，即所有人可查看

<Realm className="org.apache.catalina.realm.LockOutRealm">
        <!-- This Realm uses the UserDatabase configured in the global JNDI
             resources under the key "UserDatabase".  Any edits
             that are performed against this UserDatabase are immediately
             available for use by the Realm.  -->
         <Realm className="org.apache.catalina.realm.JNDIRealm"
                connectionName="cn=admin,dc=test,dc=com"
                connectionPassword="admin"
                connectionURL="ldap://ip:389"
                userPattern="uid={0},ou=People,dc=test,dc=com" />
      </Realm>

vi /usr/share/apache-tomcat/webapps/$test/WEB-INF/web.xml

#最后 </jsp-config> 后加上
 <security-constraint>
    <web-resource-collection>
        <web-resource-name>API endpoints are checked separately by the web app</web-resource-name>
        <url-pattern>/api/*</url-pattern>
    </web-resource-collection>
</security-constraint>

<security-constraint>
    <web-resource-collection>
        <web-resource-name>In general everything needs to be authenticated</web-resource-name>
        <url-pattern>/*</url-pattern>
        <url-pattern>/api/v1/search</url-pattern>
        <url-pattern>/api/v1/suggest/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>*</role-name>
    </auth-constraint>

    <user-data-constraint>
        <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
</security-constraint>

<security-role>
    <role-name>*</role-name>
</security-role>

<login-config>
    <auth-method>BASIC</auth-method>
</login-config>

遗留问题：

尝试很多，指定roleName等，想让LDAP中指定群组访问，不是无法登陆就是报错权限不足等，有成功的小伙伴请留言指教，感谢！

参考资料：
http://t.zoukankan.com/imperfectLiu-p-9507166.html
https://tomcat.apache.org/tomcat-10.0-doc/realm-howto.html#JNDIRealm