第15章 生产环境部署实践

15.1 部署架构

15.2 安全加固

安全检查清单

配置示例

# 生产环境配置
listener 8883
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
cafile /etc/mosquitto/certs/ca.crt
require_certificate true
tls_version tlsv1.2

allow_anonymous false
password_file /etc/mosquitto/passwd
acl_file /etc/mosquitto/acl

max_connections -1
max_inflight_messages 20

15.3 Docker部署

Docker Compose生产配置

version: '3.8'

services:
  mosquitto:
    image: eclipse-mosquitto:2
    restart: always
    ports:
      - "1883:1883"
      - "8883:8883"
    volumes:
      - ./config:/mosquitto/config
      - ./data:/mosquitto/data
      - ./log:/mosquitto/log
    environment:
      - TZ=Asia/Shanghai
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 1G
        reservations:
          cpus: '1'
          memory: 512M
    healthcheck:
      test: ["CMD", "mosquitto_sub", "-t", "$$SYS/broker/uptime", "-C", "1"]
      interval: 30s
      timeout: 10s
      retries: 3

15.4 Kubernetes部署

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mosquitto
spec:
  serviceName: mosquitto
  replicas: 3
  selector:
    matchLabels:
      app: mosquitto
  template:
    metadata:
      labels:
        app: mosquitto
    spec:
      containers:
      - name: mosquitto
        image: eclipse-mosquitto:2
        ports:
        - containerPort: 1883
        - containerPort: 8883
        volumeMounts:
        - name: config
          mountPath: /mosquitto/config
        - name: data
          mountPath: /mosquitto/data
        resources:
          requests:
            memory: "512Mi"
            cpu: "500m"
          limits:
            memory: "1Gi"
            cpu: "1000m"
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 10Gi

15.5 备份与恢复

#!/bin/bash
# 备份脚本
BACKUP_DIR="/backup/mosquitto/$(date +%Y%m%d)"
mkdir -p $BACKUP_DIR

# 备份配置
cp -r /etc/mosquitto $BACKUP_DIR/

# 备份数据
cp -r /var/lib/mosquitto $BACKUP_DIR/

# 备份密码和ACL
cp /etc/mosquitto/passwd $BACKUP_DIR/
cp /etc/mosquitto/acl $BACKUP_DIR/

# 压缩
tar -czf $BACKUP_DIR.tar.gz $BACKUP_DIR

# 恢复
tar -xzf $BACKUP_DIR.tar.gz
cp -r $BACKUP_DIR/* /

15.6 本章小结

掌握了生产环境部署的最佳实践。