部署yum存储服务器

AI 摘要

通过Windows上的nginx搭建yum缓存服务器，配置缓存目录与server块，并用nssm注册为服务，实现带外基础设施。客户端替换rocky、epel、docker、kubeadm源指向该服务器，解决内网yum安装依赖下载问题。

准备通过 windows 上的 nginx 来实现，做成带外的基础设施。

一、安装

scoop 安装

1	scoop install nginx

二、配置

创建缓存文件夹

1	mkdir E:\yum-cache

修改配置，配置文件一般在

1	D:\Software\scoop\apps\nginx\current\conf\nginx.conf

缓存配置

1
2
3

# http 块
    proxy_cache_path e:/yum-cache levels=1:2 keys_zone=yum_cache:100m
                      max_size=50g inactive=180d use_temp_path=off;

server 块

server {
    listen 80;
    listen 443 ssl;
    server_name yum.qx.lab;

    # 叶子证书，如果CA给的是 leaf+中间证书链，两个要cat到一个文件里
    # （根证书不要放这里，根证书是装到客户端信任库的）
    ssl_certificate      D:/Software/scoop/apps/nginx/current/certs/yum.qx.lab.crt;
    ssl_certificate_key  D:/Software/scoop/apps/nginx/current/certs/yum.qx.lab.key;

    # repodata索引文件，1周缓存
    location ~ /repodata/ {
        proxy_cache yum_cache;
        proxy_cache_valid 200 7d;
        proxy_cache_key $scheme$proxy_host$uri;
        proxy_pass https://mirrors.aliyun.com;
        proxy_set_header Host mirrors.aliyun.com;
        proxy_ssl_server_name on;
        add_header X-Cache-Status $upstream_cache_status;
    }

    # rpm包本身，不可变内容，长缓存
    location / {
        proxy_cache yum_cache;
        proxy_cache_valid 200 206 180d;
        proxy_cache_key $scheme$proxy_host$uri;
        proxy_pass https://mirrors.aliyun.com;
        proxy_set_header Host mirrors.aliyun.com;
        proxy_ssl_server_name on;
        proxy_cache_use_stale error timeout updating http_500 http_502 http_503;
        add_header X-Cache-Status $upstream_cache_status;
    }
}

三、包装为服务

安装 nssm

1	scoop install nssm

注册服务

nssm install nginx-yum "D:\Software\scoop\apps\nginx\current\nginx.exe"
nssm set nginx-yum AppDirectory "D:\Software\scoop\apps\nginx\current"
nssm set nginx-yum AppStdout "D:\Software\scoop\apps\nginx\current\logs\stdout.log"
nssm set nginx-yum AppStderr "D:\Software\scoop\apps\nginx\current\logs\stderr.log"
nssm set nginx-yum Start SERVICE_AUTO_START

启动

1	nssm start nginx-yum

移除服务

1	nssm remove nginx-yum confirm

四、使用

4.1 repo使用

替换 rocky 源

sed -e 's|^mirrorlist=|#mirrorlist=|g' \
    -e 's|^#baseurl=http://dl.rockylinux.org/$contentdir|baseurl=https://yum.qx.lab/rockylinux|g' \
    -i.bak \
    /etc/yum.repos.d/rocky*.repo

替换 epel 源

sed -e 's!^metalink=!#metalink=!g' \
    -e 's!^#baseurl=!baseurl=!g' \
    -e 's!https\?://download\.fedoraproject\.org/pub/epel!https://yum.qx.lab/epel!g' \
    -e 's!https\?://download\.example/pub/epel!https://yum.qx.lab/epel!g' \
    -i /etc/yum.repos.d/epel{,-testing}.repo