值班辅助平台的部署、迁移与恢复

apt update
apt install -y \
  nginx python3 python3-venv python3-pip \
  rsync curl ca-certificates sqlite3 openssl tar

apt install -y build-essential python3-dev libffi-dev

network:
  version: 2
  ethernets:
    ens7:
      dhcp4: true
      dhcp6: true
      routes:
        - to: <behavior-device>/32
          via: <main-gateway>
    ens16:
      dhcp4: false
      dhcp6: false
      addresses:
        - <device-source-ip>/24
      routes:
        - to: <firewall-a>/32
          via: <device-gateway>

        - to: <internal-dns>/32
          via: <main-gateway>

cp -a /etc/netplan/00-installer-config.yaml \
  /etc/netplan/00-installer-config.yaml.before-fangyu
netplan generate
netplan try
netplan apply

ip route get <behavior-device>
# 期望：via <main-gateway>，src <platform-host>

ip route get <firewall-a>
# 期望：via <device-gateway>，src <device-source-ip>

ip route get <firewall-b>
# 期望：主网卡路径，src <platform-host>

ip route get <dhcp-host>
# 期望：第二网卡路径，src <device-source-ip>

resolvectl status
getent hosts <device-gateway>

for target in \
  '<zabbix-db-host> 3306' \
  '<dhcp-host> 5985' \
  '<behavior-device> 443' \
  '<firewall-b> 8447' \
  '<firewall-a> 8447' \
  '<alarm-backend> 8070' \
  '<smb-server> 445'
do
  set -- $target
  printf '%s:%s ' "$1" "$2"
  timeout 3 bash -c "</dev/tcp/$1/$2" 2>/dev/null \
    && echo reachable || echo unavailable
done

Set-Location '<project-dir>'

Push-Location frontend
npm ci
npm run test:registry
npm run build
Pop-Location

python -m compileall -q backend integrations\inspection-backend\app
python -m unittest tests.test_firewall_mirror tests.test_platform_api

.\deploy\build-release.ps1

scp release/fangyu-jingyao-platform-v<版本>-<时间>.tar.gz \
  root@<platform-host>:/srv/

release=/srv/platform-release
mkdir -p "$release"
tar -xzf /srv/platform-v<版本>-<时间>.tar.gz \
  -C "$release"

install -m 0600 \
  "$release/deploy/platform.env.example" \
  /etc/platform.env

install -m 0600 \
  "$release/deploy/inspection.env.example" \
  /etc/inspection.env

editor /etc/platform.env
editor /etc/inspection.env

chmod 600 \
  /etc/platform.env \
  /etc/inspection.env

bash "$release/deploy/install-preview.sh" "$release"

systemctl status fangyu-jingyao-platform.service --no-pager
systemctl status fangyu-jingyao-inspection.service --no-pager

curl -fsS http://<internal-endpoint>/api/healthz
curl -fsS http://<internal-endpoint>/api/health
curl -fsS http://<internal-endpoint>/api/healthz

/var/lib/platform/superadmin-bootstrap.txt

/opt/wecom-alarm-bot

tar \
  --exclude='.venv' \
  --exclude='__pycache__' \
  --exclude='*.pyc' \
  --exclude='*.bak-*' \
  -czf /srv/wecom-alarm-bot-current.tar.gz \
  -C /opt wecom-alarm-bot

sha256sum /srv/wecom-alarm-bot-current.tar.gz

/etc/wecom-alarm-bot.env
/var/lib/wecom-alarm-bot/audit.db
/etc/systemd/system/wecom-alarm-bot.service
/etc/systemd/system/wecom-alarm-dashboard.service
/etc/systemd/system/wecom-alarm-test-ack.service
/etc/systemd/system/wecom-alarm-test-ack.timer

useradd --system \
  --home-dir /opt/wecom-alarm-bot \
  --shell /usr/sbin/nologin \
  wecom-alarm-bot || true

install -d -o wecom-alarm-bot -g wecom-alarm-bot -m 0750 \
  /opt/wecom-alarm-bot /var/lib/wecom-alarm-bot

tar -xzf /srv/wecom-alarm-bot-current.tar.gz -C /opt
chown -R wecom-alarm-bot:wecom-alarm-bot /opt/wecom-alarm-bot
chmod -R u=rwX,g=rX,o= /opt/wecom-alarm-bot

python3 -m venv /opt/wecom-alarm-bot/.venv
/opt/wecom-alarm-bot/.venv/bin/pip install \
  --disable-pip-version-check \
  -r /opt/wecom-alarm-bot/requirements.txt

install -o wecom-alarm-bot -g wecom-alarm-bot -m 0640 \
  <backup-dir>/robot-audit.db \
  /var/lib/wecom-alarm-bot/audit.db

python3 - <<'PY'
import base64
import json

accounts = [
    {"account": "user1", "password": "replace-me"},
    {"account": "user2", "password": "replace-me"},
]
raw = json.dumps(accounts, ensure_ascii=False).encode("utf-8")
print(base64.b64encode(raw).decode("ascii"))
PY

[Unit]
Description=WeCom System Alarm Confirmation Bot
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=wecom-alarm-bot
Group=wecom-alarm-bot
WorkingDirectory=/opt/wecom-alarm-bot
EnvironmentFile=/etc/wecom-alarm-bot.env
ExecStart=/opt/wecom-alarm-bot/.venv/bin/python /opt/wecom-alarm-bot/wecom_alarm_bot.py
Restart=always
RestartSec=5
TimeoutStopSec=20
StateDirectory=wecom-alarm-bot
StateDirectoryMode=0750
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
LockPersonality=true

[Install]
WantedBy=multi-user.target

[Unit]
Description=WeCom alarm operations dashboard
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=wecom-alarm-bot
Group=wecom-alarm-bot
WorkingDirectory=/opt/wecom-alarm-bot
EnvironmentFile=/etc/wecom-alarm-bot.env
ExecStart=/opt/wecom-alarm-bot/.venv/bin/python /opt/wecom-alarm-bot/dashboard.py
Restart=always
RestartSec=5
TimeoutStopSec=20
StateDirectory=wecom-alarm-bot
StateDirectoryMode=0750
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
LockPersonality=true

[Install]
WantedBy=multi-user.target

[Unit]
Description=Automatically acknowledge matching daily test alarms from 10:00:00 to 10:10:59 China time
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
User=wecom-alarm-bot
Group=wecom-alarm-bot
WorkingDirectory=/opt/wecom-alarm-bot
EnvironmentFile=/etc/wecom-alarm-bot.env
ExecStart=/opt/wecom-alarm-bot/.venv/bin/python /opt/wecom-alarm-bot/scheduled_test_ack.py
TimeoutStartSec=720
StateDirectory=wecom-alarm-bot
StateDirectoryMode=0750
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
LockPersonality=true

[Unit]
Description=Run daily test alarm acknowledgement at 10:00:00 China time

[Timer]
OnCalendar=*-*-* 10:00:00 Asia/Shanghai
AccuracySec=1s
RandomizedDelaySec=0
Persistent=false
Unit=wecom-alarm-test-ack.service

[Install]
WantedBy=timers.target

chmod 600 /etc/wecom-alarm-bot.env
systemctl daemon-reload
systemctl enable --now \
  wecom-alarm-bot.service \
  wecom-alarm-dashboard.service \
  wecom-alarm-test-ack.timer

systemctl is-active wecom-alarm-bot.service
systemctl is-active wecom-alarm-dashboard.service
systemctl is-active wecom-alarm-test-ack.timer
systemctl list-timers --all | grep wecom-alarm-test-ack
curl -fsS http://<internal-endpoint>/api/dashboard

unlink /etc/nginx/sites-enabled/default 2>/dev/null || true

install -m 0644 \
  /opt/platform/deploy/nginx-root.conf \
  /etc/nginx/sites-enabled/fangyu-jingyao-platform

nginx -t
systemctl reload nginx
curl -fsS http://<internal-endpoint>/api/healthz

bash /opt/platform/deploy/switch-root.sh \
  /etc/nginx/sites-enabled/inspection

rm -f /etc/nginx/conf.d/fangyu-jingyao-preview.conf
nginx -t
systemctl reload nginx

CREATE USER '<platform-db-user>'@'<device-source-ip>'
IDENTIFIED BY '<强密码>';

GRANT SELECT, DELETE ON zabbix.alerts
TO '<platform-db-user>'@'<device-source-ip>';

FLUSH PRIVILEGES;

Import-Module DHCPServer
Get-DhcpServerv4Scope
Get-DhcpServerv4Lease -IPAddress <main-gateway>0

http://<dhcp-host>:5985/wsman

获取 Token → 分页查重 → 创建或删除 → commit → 回读验证

openssl s_client \
  -connect <behavior-device>:443 \
  -bind <platform-host> \
  </dev/null 2>/dev/null \
  | openssl x509 -outform DER \
  | sha256sum

lflk-block-01
lflk-block-02
...
lflk-block-10

openssl s_client \
  -connect <firewall-a>:8447 \
  -bind <device-source-ip> \
  </dev/null 2>/dev/null \
  | openssl x509 -outform DER \
  | sha256sum

openssl s_client \
  -connect <firewall-b>:8447 \
  -bind <platform-host> \
  </dev/null 2>/dev/null \
  | openssl x509 -outform DER \
  | sha256sum

2026年7月31日早班巡检报告.docx
2026年7月31日晚班巡检报告.docx

/var/lib/inspection/reports/

timeout 3 bash -c '</dev/tcp/<smb-server>/445'
systemctl restart fangyu-jingyao-inspection.service
journalctl -u fangyu-jingyao-inspection.service -n 100 --no-pager

/var/lib/platform/platform.db

/var/lib/inspection/inspection.db
/var/lib/inspection/reports/
/var/lib/inspection/tmp/

tests/fixtures/report-gold/2026-07-30-morning-gold.docx
tests/fixtures/report-gold/2026-07-30-morning-gold.pdf

/var/lib/wecom-alarm-bot/audit.db

backup=/srv/fangyu-full-backup-$(date -u +%Y%m%dT%H%M%SZ)
install -d -m 0700 "$backup"

python3 - "$backup" <<'PY'
import sqlite3
import sys
from pathlib import Path

target = Path(sys.argv[1])
databases = {
    "/var/lib/platform/platform.db": "platform.db",
    "/var/lib/inspection/inspection.db": "inspection.db",
    "/var/lib/wecom-alarm-bot/audit.db": "robot-audit.db",
}

for source_name, target_name in databases.items():
    source = sqlite3.connect(source_name)
    destination = sqlite3.connect(target / target_name)
    source.backup(destination)
    destination.close()
    source.close()
PY

rsync -a /var/lib/inspection/reports/ \
  "$backup/reports/"
rsync -a /var/lib/inspection/tmp/ \
  "$backup/tmp/"

cp -a /var/lib/platform/initial_blacklist.txt \
  "$backup/"
cp -a /etc/platform.env \
  /etc/inspection.env \
  /etc/wecom-alarm-bot.env \
  "$backup/"
cp -a /etc/netplan/00-installer-config.yaml "$backup/"
cp -a /etc/nginx/sites-enabled/inspection "$backup/nginx-80.conf"
if [[ -f /etc/nginx/conf.d/fangyu-jingyao-preview.conf ]]; then
  cp -a /etc/nginx/conf.d/fangyu-jingyao-preview.conf \
    "$backup/nginx-8180.conf"
fi

install -d -m 0755 "$backup/systemd"
cp -a \
  /etc/systemd/system/fangyu-jingyao-platform.service \
  /etc/systemd/system/fangyu-jingyao-inspection.service \
  /etc/systemd/system/wecom-alarm-bot.service \
  /etc/systemd/system/wecom-alarm-dashboard.service \
  /etc/systemd/system/wecom-alarm-test-ack.service \
  /etc/systemd/system/wecom-alarm-test-ack.timer \
  "$backup/systemd/"

tar --exclude='.venv' --exclude='__pycache__' \
  -czf "$backup/wecom-alarm-bot.tar.gz" \
  -C /opt wecom-alarm-bot

find "$backup" -maxdepth 1 -type f ! -name SHA256SUMS \
  -print0 \
  | sort -z \
  | xargs -0 sha256sum \
  > "$backup/SHA256SUMS"

systemctl stop \
  fangyu-jingyao-platform.service \
  fangyu-jingyao-inspection.service \
  wecom-alarm-bot.service \
  wecom-alarm-dashboard.service

install -o fangyu-platform -g fangyu-platform -m 0600 \
  <备份目录>/platform.db \
  /var/lib/platform/platform.db

install -o fangyu-platform -g fangyu-platform -m 0640 \
  <备份目录>/inspection.db \
  /var/lib/inspection/inspection.db

install -o wecom-alarm-bot -g wecom-alarm-bot -m 0640 \
  <备份目录>/robot-audit.db \
  /var/lib/wecom-alarm-bot/audit.db

rsync -a <备份目录>/reports/ \
  /var/lib/inspection/reports/
chown -R fangyu-platform:fangyu-platform \
  /var/lib/inspection

systemctl daemon-reload
systemctl enable --now \
  fangyu-jingyao-inspection.service \
  wecom-alarm-bot.service \
  wecom-alarm-dashboard.service \
  wecom-alarm-test-ack.timer \
  fangyu-jingyao-platform.service

release=/srv/platform-release-<版本>
mkdir -p "$release"
tar -xzf /srv/platform-v<版本>.tar.gz -C "$release"
bash "$release/deploy/install-preview.sh" "$release"

cat /opt/platform/VERSION
systemctl is-active fangyu-jingyao-platform.service
systemctl is-active fangyu-jingyao-inspection.service
curl -fsS http://<internal-endpoint>/openapi.json \
  | python3 -c 'import json,sys; print(json.load(sys.stdin)["info"]["version"])'
curl -fsS http://<internal-endpoint>/api/healthz

bash /opt/platform/deploy/rollback-root.sh \
  /srv/platform-backups/<备份目录> \
  /etc/nginx/sites-enabled/inspection

systemctl is-active nginx
systemctl is-active fangyu-jingyao-platform.service
systemctl is-active fangyu-jingyao-inspection.service
systemctl is-active wecom-alarm-bot.service
systemctl is-active wecom-alarm-dashboard.service
systemctl is-active wecom-alarm-test-ack.timer

curl -fsS http://<internal-endpoint>/api/healthz
curl -fsS http://<internal-endpoint>/api/health
curl -fsS http://<internal-endpoint>/api/dashboard
curl -fsS http://<internal-endpoint>/api/healthz

systemctl status fangyu-jingyao-platform.service --no-pager
journalctl -u fangyu-jingyao-platform.service -n 100 --no-pager
curl -v http://<internal-endpoint>/api/healthz
nginx -t

systemctl status fangyu-jingyao-inspection.service --no-pager
journalctl -u fangyu-jingyao-inspection.service -n 150 --no-pager
ls -ld /var/lib/inspection/{tmp,reports}

ip route get <firewall-a>
timeout 3 bash -c '</dev/tcp/<firewall-a>/8447'

systemctl status wecom-alarm-test-ack.timer --no-pager
systemctl list-timers --all | grep wecom-alarm-test-ack
journalctl -u wecom-alarm-test-ack.service \
  --since 'today 09:55' --no-pager

独立业务服务或平台适配器
        ↓
平台同源 API、统一鉴权和审计
        ↓
模块注册表驱动左侧入口、首页卡片和状态

docs/MODULE-INTEGRATION.md

pre-current-release-backup
pre-previous-release-backup

chown root:root \
  /etc/platform.env \
  /etc/inspection.env \
  /etc/wecom-alarm-bot.env

chmod 600 \
  /etc/platform.env \
  /etc/inspection.env \
  /etc/wecom-alarm-bot.env