postgresql+Kong+kongdashbord安装步骤

环境：CentOS Linux release 7.4.1708 (Core)

1、openresty-1.11.2.4.tar.gz

2、luarocks-2.4.2.tar.gz

3、pcre-8.40.tar.gz

4、openssl-1.0.2n.tar.gz

5、kong-0.11.0.tar.gz

6、node-v8.9.4-linux-x64.tar.xz

7.  luarocks-2.4.2-1.src.rock

8. sslconfig

源码目录:/home/package

/usr/local/kong

软件目录规划:

安装目录:/usr/local/kong

日志目录:/usr/local/kong/logs

PID目录:/opt/run/kong

配置文件目录:

/usr/local/kong

机器分配

Kong：10.95.196.149/150

PostgreSQL：10.95.196.149

PostgreSQL安装过程

10.95.196.149上的操作

下载PostgreSQL，

postgresql-9.6.6.tar.gz

#创建PGSQL用户及用户组

groupadd -g 26 -o -r postgres

useradd -M -g postgres -o -r -d /home/pgsql -s /bin/bash  -u 26 postgres

#创建pgsql数据目录及日志目录

mkdir -p /home/pgsql/{data,logs}

chown -R postgres /home/pgsql

#切换用户初始化PGSQL

su postgres

#添加环境变量

vi  .bash_profile

PGHOME=/home/pgsql/postgresql-9.6.6

export PGHOME

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PGHOME/lib

export PGLOG=/home/pgsql/logs/pgsql.log

PGDATA=/home/pgsql/data

export PGDATA

PATH=$PATH:$HOME/.local/bin:$HOME/bin:$PGHOME/bin

export PATH

---

初始化postgresql

initdb -E utf8 -D /home/pgsql/data -W -U postgres

注：以下操作均在postgres环境下操作

#增加PGSQL访问权限，修改/home/pgsql/data/pg_hba.conf

host    kong149            kong149            10.95.196.0/24           trust

新增的内容意思是允许10.95.196.0/24网段的机器可以使用用户kong访问数据库kong

#调整PGSQL的监听地址

sed -i "/#listen_addresses/c listen_addresses='10.95.196.149'" /home/pgsql/data/postgresql.conf

#启动PGSQL

pg_ctl start -D /home/pgsql/data -l /home/pgsql/logs/pgsql.log

#创建用户kong，根据提示设置用户kong的密码

createuser -l -E kong149 -P 

根据提示输入密码 ui8ga$No

#创建数据库kong

createdb -E utf8 -O kong149  kong149

---

10.95.196.149-150上的操作

安装一些另外的包

yum install devtoolset-3-gcc devtoolset-3-gcc-c++ devtoolset-3-libstdc++-devel gperftools-devel gperftools-libs

下载源码包

mkdir -p /home/package

cd  /home/package

wget https://openresty.org/download/openresty-1.11.2.4.tar.gz

wget ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.40.tar.gz

wget https://www.openssl.org/source/openssl-1.0.2j.tar.gz

wget http://luarocks.github.io/luarocks/releases/luarocks-2.4.2.tar.gz

git clone https://github.com/cloudflare/sslconfig.git

wget https://github.com/Mashape/kong/archive/0.10.3.tar.gz -O kong-0.10.3.tar.gz

以上包可以直接对对应网站下载，服务器直接下可以遇到ssl无法握手问题；

安装OpenSSL

tar -xf openssl-1.0.2n.tar.gz  #-xzvf解压安装会遇到问题，不清楚原因

cd  openssl-1.0.2n

patch -p1 </home/package/sslconfig/patches/openssl__chacha20_poly1305_draft_and_rfc_ossl102j.patch

./config threads shared

make depend

make && make install

默认安装到 /usr/local/ssl 对应下面编译中ssl环境目录需要相应变更

安装OpenResty

#创建用户及用户组  也可以不创建

groupadd websuite

useradd -g websuite -M -s /sbin/nologin websuite

---

#编译安装openresty

tar -xf 

openresty-1.11.2.4.tar.gz

tar -xf pcre-8.40.tar.gz

#创建OpenResty所需目录

mkdir -p /usr/local/kong/{run,logs,conf}

mkdir -p /usr/local/kong/temp/{client,proxy}

cd  openresty-1.11.2.4

./configure --prefix=/usr/local/kong -j24 \

--with-http_iconv_module \

--with-luajit \

--sbin-path=/usr/local/kong/sbin/nginx \

--conf-path=/usr/local/kong/conf/nginx.conf \

--error-log-path=/usr/local/kong/logs/error.log \

--http-log-path=/usr/local/kong/logs/access.log \

--with-threads \

--with-file-aio \

--with-http_realip_module \

--with-http_addition_module \

--with-http_auth_request_module \

--with-http_random_index_module \

--with-http_slice_module \

--with-http_stub_status_module \

--with-http_ssl_module \

--http-client-body-temp-path=/usr/local/kong/temp/client \

--http-proxy-temp-path=/usr/local/kong/temp/proxy \

--modules-path=/usr/local/kong/modules \

--with-http_v2_module \

--with-cc-opt='-w -pipe -march=native -mtune=native -m128bit-long-double -m64 -fno-builtin-malloc -I/usr/local/ssl/include' \

--with-ld-opt='-L/usr/local/ssl/lib' \

--with-pcre=../pcre-8.40 \

--with-pcre-opt=-fPIC \

--with-pcre-jit

gmake -j8 && make install

---

安装luarocks

tar zxf luarocks-2.4.2.tar.gz

cd luarocks-2.4.2

./configure --prefix=/usr/local/kong \

--rocks-tree=/usr/local/kong/luajit \

--sysconfdir=/usr/local/kong/conf/luarocks \

--lua-suffix=jit \

--with-lua=/usr/local/kong/luajit \

--with-lua-include=/usr/local/kong/luajit/include/luajit-2.1

make build

make install

echo 'export PATH="${PATH}:/usr/local/kong/bin:/usr/local/kong/sbin:/usr/local/kong/luajit/bin"' > /etc/profile.d/kong.sh

source /etc/profile.d/kong.sh

把下载的luarocks-2.4.2-1.src.rock 放到luarocks-2.4.2目录下执行：

luarocks install luarocks-2.4.2-1.src.rock

---

安装Kong

tar -xf kong-0.11.0.tar.gz

cd kong-0.11.0

sed -i '/OPENSSL_DIR ?=/c OPENSSL_DIR ?= /usr/local/ssl' Makefile

make install

cp -r bin/* /usr/local/kong/bin/

安装

HiRes组件

yum -y  install perl-Time-HiRes

建立软连接

ln -f -s /usr/local/ssl/lib/libssl.so.1.0.0 /lib64/libssl.so.1.0.0

ln -f -s /usr/local/ssl/lib/libcrypto.so.1.0.0 /lib64/libcrypto.so.1.0.0

调整Kong的配置

路径：/usr/local/kong/luajit/share/lua/5.1/kong/templates

文件：nginx.lua

return [[

> if nginx_user then

user ${{NGINX_USER}};

> end

worker_processes ${{NGINX_WORKER_PROCESSES}};

daemon ${{NGINX_DAEMON}};

pid pids/nginx.pid;

error_log ${{PROXY_ERROR_LOG}} ${{LOG_LEVEL}};

> if nginx_optimizations then

worker_rlimit_nofile ${{WORKER_RLIMIT}};

> end

events {

> if nginx_optimizations then

use                 epoll;

worker_connections  65536;

multi_accept on;

> end

}

http {

include 'nginx-kong.conf';

}

]]

文件：nginx_kong.lua

return [[

charset UTF-8;

> if anonymous_reports then

${{SYSLOG_REPORTS}}

> end

error_log ${{PROXY_ERROR_LOG}} ${{LOG_LEVEL}};

>if nginx_optimizations then

include       /usr/local/kong/conf/mime.types;

default_type  application/octet-stream;

sendfile        on;

>-- send_timeout 60s;          # default value

keepalive_timeout 120s;     # default value

keepalive_requests     10000;

server_tokens     off;

>-- client_body_timeout 60s;   # default value

>-- client_header_timeout 60s; # default value

>-- tcp_nopush on;             # disabled until benchmarked

gzip  on;

gzip_comp_level     6;

gzip_min_length     1024;

gzip_proxied           any;

gzip_vary                 on;

gzip_buffers            96 8k;

gzip_types               text/json  text/plain  text/css  application/json  application/javascript  application/x-javascript  application/rss+xml;

>-- proxy_buffer_size 128k;    # disabled until benchmarked

proxy_buffers 128 8k;      # disabled until benchmarked

>-- proxy_busy_buffers_size 256k; # disabled until benchmarked

>-- reset_timedout_connection on; # disabled until benchmarked

>end

log_format  access '$http_x_forwarded_for [$time_local] request_time[$request_time] upto $upstream_addr,'

'upresponse_time[$upstream_response_time], "$request" $status $body_bytes_sent '

'"$http_user_agent"';

client_max_body_size ${{CLIENT_MAX_BODY_SIZE}};

proxy_ssl_server_name on;

underscores_in_headers on;

lua_package_path '${{LUA_PACKAGE_PATH}};;';

lua_package_cpath '${{LUA_PACKAGE_CPATH}};;';

lua_socket_pool_size ${{LUA_SOCKET_POOL_SIZE}};

lua_max_running_timers 4096;

lua_max_pending_timers 16384;

lua_shared_dict kong                30m;

lua_shared_dict kong_cache          ${{MEM_CACHE_SIZE}};

lua_shared_dict kong_process_events 30m;

lua_shared_dict kong_cluster_events 30m;

lua_shared_dict kong_healthchecks   30m;

> if database == "cassandra" then

lua_shared_dict kong_cassandra      5m;

> end

lua_socket_log_errors off;

> if lua_ssl_trusted_certificate then

lua_ssl_trusted_certificate '${{LUA_SSL_TRUSTED_CERTIFICATE}}';

lua_ssl_verify_depth ${{LUA_SSL_VERIFY_DEPTH}};

> end

init_by_lua_block {

kong = require 'kong'

kong.init()

}

init_worker_by_lua_block {

kong.init_worker()

}

proxy_next_upstream_tries 2;

upstream kong_upstream {

server 0.0.0.1;

balancer_by_lua_block {

kong.balancer()

}

keepalive ${{UPSTREAM_KEEPALIVE}};

}

server {

    server_name localhost;

listen ${{PROXY_LISTEN}}${{PROXY_PROTOCOL}};

error_page 400 404 408 411 412 413 414 417 /kong_error_handler;

error_page 500 502 503 504 /kong_error_handler;

    access_log ${{PROXY_ACCESS_LOG}} access;

error_log ${{PROXY_ERROR_LOG}} ${{LOG_LEVEL}};

client_body_buffer_size ${{CLIENT_BODY_BUFFER_SIZE}};

> if ssl then

listen ${{PROXY_LISTEN_SSL}} ssl${{HTTP2}}${{PROXY_PROTOCOL}};

ssl_certificate ${{SSL_CERT}};

ssl_certificate_key ${{SSL_CERT_KEY}};

ssl_protocols TLSv1.1 TLSv1.2;

ssl_certificate_by_lua_block {

kong.ssl_certificate()

}

ssl_session_cache shared:SSL:10m;

ssl_session_timeout 10m;

ssl_prefer_server_ciphers on;

ssl_ciphers ${{SSL_CIPHERS}};

> end

> if client_ssl then

proxy_ssl_certificate ${{CLIENT_SSL_CERT}};

proxy_ssl_certificate_key ${{CLIENT_SSL_CERT_KEY}};

> end

real_ip_header     ${{REAL_IP_HEADER}};

real_ip_recursive  ${{REAL_IP_RECURSIVE}};

> for i = 1, #trusted_ips do

set_real_ip_from   $(trusted_ips[i]);

> end

location / {

set $upstream_host               '';

set $upstream_upgrade            '';

set $upstream_connection         '';

set $upstream_scheme             'http';

set $upstream_uri                '';

set $upstream_x_forwarded_for    '';

set $upstream_x_forwarded_proto  '';

set $upstream_x_forwarded_host   '';

set $upstream_x_forwarded_port   '';

rewrite_by_lua_block {

kong.rewrite()

}

access_by_lua_block {

kong.access()

}

proxy_http_version 1.1;

proxy_set_header   Host              $upstream_host;

proxy_set_header   Upgrade           $upstream_upgrade;

proxy_set_header   Connection        $upstream_connection;

#proxy_set_header   X-Forwarded-For   $upstream_x_forwarded_for;

proxy_set_header   X-Forwarded-Proto $upstream_x_forwarded_proto;

proxy_set_header   X-Forwarded-Host  $upstream_x_forwarded_host;

proxy_set_header   X-Forwarded-Port  $upstream_x_forwarded_port;

        proxy_set_header   X-Real-IP         $http_x_forwarded_for;

proxy_pass_header  Server;

proxy_pass_header  Date;

proxy_ssl_name     $upstream_host;

        proxy_pass         http://kong_upstream$upstream_uri;

header_filter_by_lua_block {

kong.header_filter()

}

body_filter_by_lua_block {

kong.body_filter()

}

log_by_lua_block {

kong.log()

}

}

location = /kong_error_handler {

internal;

content_by_lua_block {

kong.handle_error()

}

}

}

server {

    server_name localhost;

listen ${{ADMIN_LISTEN}};

access_log ${{ADMIN_ACCESS_LOG}};

error_log ${{ADMIN_ERROR_LOG}} ${{LOG_LEVEL}};

client_max_body_size 10m;

client_body_buffer_size 10m;

> if admin_ssl then

listen ${{ADMIN_LISTEN_SSL}} ssl${{ADMIN_HTTP2}};

ssl_certificate ${{ADMIN_SSL_CERT}};

ssl_certificate_key ${{ADMIN_SSL_CERT_KEY}};

ssl_protocols TLSv1.1 TLSv1.2;

ssl_session_cache shared:SSL:10m;

ssl_session_timeout 10m;

ssl_prefer_server_ciphers on;

ssl_ciphers ${{SSL_CIPHERS}};

> end

location / {

default_type application/json;

content_by_lua_block {

kong.serve_admin_api()

}

}

location /nginx_status {

internal;

access_log off;

stub_status;

}

location /robots.txt {

return 200 'User-agent: *\nDisallow: /';

}

}

]]

文件：kong_defaults.lua 

return [[

prefix = /usr/local/kong/

log_level = notice

proxy_access_log = logs/access.log

proxy_error_log = logs/error.log

admin_access_log = logs/admin_access.log

admin_error_log = logs/admin_error.log

custom_plugins = NONE

anonymous_reports = on

proxy_listen = 0.0.0.0:8000

proxy_listen_ssl = 0.0.0.0:8443

admin_listen = 0.0.0.0:5000

admin_listen_ssl = 0.0.0.0:5443

nginx_user = root

nginx_worker_processes = auto

nginx_optimizations = on

nginx_daemon = on

mem_cache_size = 1024m

http2 = off

ssl = on

ssl_cert = NONE

ssl_cert_key = NONE

client_ssl = off

client_ssl_cert = NONE

client_ssl_cert_key = NONE

ssl_cipher_suite = modern

ssl_ciphers = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AE

S256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256

admin_http2 = off

admin_ssl = on

admin_ssl_cert = NONE

admin_ssl_cert_key = NONE

upstream_keepalive = 60

server_tokens = off

latency_tokens = on

trusted_ips = NONE

real_ip_header = X-Forwarded-For

real_ip_recursive = off

client_max_body_size = 8m

client_body_buffer_size = 8k

error_default_type = text/plain

database = postgres

pg_host = 10.95.196.149

pg_port = 5432

pg_database = kong149

pg_user = kong149

pg_password = ui8ga$No

pg_ssl = off

pg_ssl_verify = off

cassandra_contact_points = 127.0.0.1

cassandra_port = 9042

cassandra_keyspace = kong

cassandra_timeout = 5000

cassandra_ssl = off

cassandra_ssl_verify = off

cassandra_username = kong

cassandra_password = NONE

cassandra_consistency = ONE

cassandra_lb_policy = RoundRobin

cassandra_local_datacenter = NONE

cassandra_repl_strategy = SimpleStrategy

cassandra_repl_factor = 1

cassandra_data_centers = dc1:2,dc2:3

cassandra_schema_consensus_timeout = 10000

db_update_frequency = 60

db_update_propagation = 0

db_cache_ttl = 3600

dns_resolver = NONE

dns_hostsfile = /etc/hosts

dns_order = LAST,SRV,A,CNAME

dns_stale_ttl = 4

dns_not_found_ttl = 30

dns_error_ttl = 1

dns_no_sync = off

lua_socket_pool_size = 30

lua_ssl_trusted_certificate = NONE

lua_ssl_verify_depth = 1

lua_package_path = ./?.lua;./kong/init.lua;

lua_package_cpath = NONE

]]

启动Kong

kong start or kong start -vv(如果执行kong start报错，可以使用kong start -vv来进行调试)

如遇数据库表结构不兼容 执行kong migrations up

---

下载安装node

node-v8.9.4-linux-x64.tar.xz

wget https://nodejs.org/dist/v8.9.4/node-v8.9.4-linux-x64.tar.xz // 下载

tar xf node-v8.9.4-linux-x64.tar.xz

cd node-v8.9.4-linux-x64/

ln -s /home/package/kongpack/node-v8.9.4-linux-x64/bin/npm /usr/local/bin/

ln -s /home/package/kongpack/node-v8.9.4-linux-x64/bin/node  /usr/local/bin/

node -v

---

使用 npm安装Kong-dashboard 安装 启动运行

nohup node /usr/local/bin/kong-dashboard start -u http://127.0.0.1:5000 -p 9001 --basic-auth admin=bei}g6Th &

在浏览器中输入地址，使用用户名密码登录

---

再在F5层做负载均衡配置到10.96.196.149/150实现高可用

---