Linux 生產環境 JDK、Tomcat、Nginx、MySQL 標準化部署運維手冊

使用：./create_tomcat_instance.sh portal 8080 8005 8009

3. JVM 調優參數 setenv.sh (實例 conf/ 目錄)

CATALINA_OPTS="-Xms4g -Xmx4g -XX:MetaspaceSize=512m -XX:MaxMetaspaceSize=1g"
CATALINA_OPTS="$CATALINA_OPTS -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:InitiatingHeapOccupancyPercent=45"
CATALINA_OPTS="$CATALINA_OPTS -XX:+ParallelRefProcEnabled -XX:+UnlockDiagnosticVMOptions -XX:+LogVMOutput"
CATALINA_OPTS="$CATALINA_OPTS -Xlog:gc*:file=$CATALINA_BASE/logs/gc.log:time,uptime,level,tags:filecount=10,filesize=100m"
CATALINA_OPTS="$CATALINA_OPTS -Djava.security.egd=file:/dev/./urandom -Dfile.encoding=UTF-8"
CATALINA_OPTS="$CATALINA_OPTS -Duser.timezone=Asia/Taipei"

三、Nginx 反向代理與靜態資源服務

# /etc/nginx/conf.d/tomcat_upstream.conf
upstream portal_backend {
    least_conn;
    server 127.0.0.1:8080 max_fails=3 fail_timeout=30s;
    keepalive 64;
}

upstream bbs_backend {
    least_conn;
    server 127.0.0.1:8180 max_fails=3 fail_timeout=30s;
    keepalive 64;
}

# /etc/nginx/conf.d/portal.conf
server {
    listen 80;
    listen 443 ssl http2;
    server_name portal.example.com;
    ssl_certificate /etc/nginx/certs/portal.pem;
    ssl_certificate_key /etc/nginx/certs/portal.key;

    location /static/ {
        alias /opt/tomcat/instances/portal/webapps/ROOT/static/;
        expires 1y; add_header Cache-Control "public, immutable";
    }

    location / {
        proxy_pass https://portal_backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 60s;
        proxy_send_timeout 60s;
    }
}

四、MySQL 8.0 / MariaDB 10.6 生產級部署

1. 安裝 (官方 Yum/Apt Repository 獲取最新穩定版)

# MySQL 8.0 (RHEL 系列)
dnf install -y https://dev.mysql.com/get/mysql80-community-release-el9-1.noarch.rpm
dnf install -y mysql-community-server

# MariaDB 10.6 (Ubuntu)
apt update && apt install -y mariadb-server

2. 核心配置 /etc/my.cnf.d/99-production.cnf

[mysqld]
# 基礎
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
pid-file=/run/mysqld/mysqld.pid
port=3306
bind-address=0.0.0.0
skip-name-resolve
default-authentication-plugin=mysql_native_password

# InnoDB 核心
innodb_buffer_pool_size=12G        # 實體記憶體 60~70%
innodb_log_file_size=2G
innodb_log_files_in_group=2
innodb_flush_log_at_trx_commit=1
innodb_flush_method=O_DIRECT
innodb_file_per_table=1
innodb_read_io_threads=8
innodb_write_io_threads=8
innodb_io_capacity=2000
innodb_io_capacity_max=4000

# 連線與並發
max_connections=2000
thread_cache_size=100
table_open_cache=4000
table_open_cache_instances=16

# 日誌與複寫
log_bin=mysql-bin
binlog_format=ROW
expire_logs_days=7
sync_binlog=1
gtid_mode=ON
enforce_gtid_consistency=ON
server-id=1

# 效能結構
performance_schema=ON
slow_query_log=ON
long_query_time=1
slow_query_log_file=/var/log/mysql/slow.log

# 字元集
character-set-server=utf8mb4
collation-server=utf8mb4_unicode_ci

3. 安全初始化與帳號管理

mysql_secure_installation
# 設定 root 密碼、移除匿名用戶、禁止 root 遠程登入、移除 test 資料庫

# 建立應用帳號 (最小權限原則)
CREATE USER 'app_portal'@'10.0.%' IDENTIFIED BY 'StrongPassw0rd!';
GRANT SELECT, INSERT, UPDATE, DELETE, EXECUTE ON portal_db.* TO 'app_portal'@'10.0.%';
FLUSH PRIVILEGES;

五、監控整合 (Prometheus + Grafana)

• JVM：jmx_exporter (Port 9404) + java -javaagent:jmx_prometheus_javaagent.jar=9404:config.yaml
• Tomcat：tomcat_exporter 或解析 manager/status?XML=true
• Nginx：nginx-prometheus-exporter 抓取 /nginx_status
• MySQL：mysqld_exporter (需 GRANT PROCESS, REPLICATION CLIENT, SELECT ON performance_schema.* TO 'exporter'@'localhost';)
• Node：node_exporter (系統指標)

六、備份與災難恢復策略

七、版本升級標準作業程序 (SOP)

1. 讀取 Release Notes / Changelog，評估破壞性變更
2. 預發環境完整部署並跑回歸測試 (含效能基準)
3. 生產環境維護視窗：systemctl stop tomcat@instance → 替換二進位/套件升級 → systemctl start
4. MySQL 升級：mysql_upgrade (8.0 內建) + 觀察錯誤日誌
5. 升級後 30 分鐘密集監控：錯誤率、延遲、GC、連線池、慢查詢
6. 確認無異常後更新 CMDB、文檔、知識庫

將上述標準化流程固化為 Ansible Playbook / Terraform Module / Helm Chart / GitOps Repository，即可實現「基礎設施即代碼」，讓 Java Web 技術棧的部署、變更、擴容、災難恢復全部納入可審計、可重現、可回滾的自動化管線。