Деплой Flowlink

1# docker-compose.yml
2version: "3.9"
3
4services:
5  db:
6    image: postgres:16-alpine
7    environment:
8      POSTGRES_DB: ${POSTGRES_DB:-flowlink}
9      POSTGRES_USER: ${POSTGRES_USER:-flowlink}
10      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-flowlink_secret}
11    volumes:
12      - pgdata:/var/lib/postgresql/data
13    ports:
14      - "5432:5432"
15    healthcheck:
16      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-flowlink}"]
17      interval: 5s
18      timeout: 3s
19      retries: 10
20
21  relay:
22    image: ghcr.io/flow-masters/flowlink-relay:latest
23    depends_on:
24      db:
25        condition: service_healthy
26    environment:
27      DATABASE_URL: postgres://${POSTGRES_USER:-flowlink}:${POSTGRES_PASSWORD:-flowlink_secret}@db:5432/${POSTGRES_DB:-flowlink}
28      RELAY_PORT: 9081
29      WSS_PORT: 9080
30      JWT_SECRET: ${JWT_SECRET:-change-me-in-production}
31      MCP_MODE: ${MCP_MODE:-gateway}
32      SHIELD_ENABLED: ${SHIELD_ENABLED:-true}
33      LOG_LEVEL: info
34    ports:
35      - "9080:9080"
36      - "9081:9081"
37    restart: unless-stopped
38
39  gateway:
40    image: ghcr.io/flow-masters/flowlink-gateway:latest
41    depends_on:
42      - relay
43    environment:
44      RELAY_URL: http://relay:9081
45      GATEWAY_PORT: 443
46      TLS_CERT: /etc/flowlink/certs/cert.pem
47      TLS_KEY: /etc/flowlink/certs/key.pem
48    ports:
49      - "443:443"
50    volumes:
51      - ./certs:/etc/flowlink/certs:ro
52    restart: unless-stopped
53
54  agent:
55    image: ghcr.io/flow-masters/flowlink-agent:latest
56    depends_on:
57      - relay
58    environment:
59      RELAY_URL: wss://relay:9080
60      AGENT_TOKEN: ${AGENT_TOKEN:-generate-via-signup}
61      SHIELD_ENABLED: ${SHIELD_ENABLED:-false}
62    volumes:
63      - /var/run/docker.sock:/var/run/docker.sock
64      - /:/host:ro
65    privileged: true
66    pid: host
67    restart: unless-stopped
68
69volumes:
70  pgdata:

1# Запуск
2docker compose up -d
3
4# Проверка статуса
5docker compose ps
6
7# Логи
8docker compose logs -f relay

1# 1.1. Скачать бинарник
2curl -L https://flowlink.flow-masters.ru/downloads/flowlink-gateway \
3  -o /usr/local/bin/flowlink-gateway
4chmod +x /usr/local/bin/flowlink-gateway
5
6# 1.2. Создать директории
7mkdir -p /etc/flowlink/gateway /etc/flowlink/certs /var/log/flowlink
8
9# 1.3. Конфигурация
10cat > /etc/flowlink/gateway/config.toml << 'EOF'
11listen_addr = "0.0.0.0:443"
12relay_url  = "http://127.0.0.1:9081"
13
14[tls]
15cert = "/etc/flowlink/certs/cert.pem"
16key  = "/etc/flowlink/certs/key.pem"
17
18[mcp]
19mode = "gateway"
20max_connections = 1024
21timeout_ms = 30000
22EOF
23
24# 1.4. Systemd unit
25cat > /etc/systemd/system/flowlink-gateway.service << 'EOF'
26[Unit]
27Description=Flowlink Gateway
28After=network.target
29
30[Service]
31Type=simple
32ExecStart=/usr/local/bin/flowlink-gateway --config /etc/flowlink/gateway/config.toml
33Restart=always
34RestartSec=5
35LimitNOFILE=65535
36
37[Install]
38WantedBy=multi-user.target
39EOF
40
41systemctl daemon-reload
42systemctl enable --now flowlink-gateway

1# 2.1. Установить PostgreSQL 16
2apt install -y postgresql-16   # Debian/Ubuntu
3
4# 2.2. Создать базу и пользователя
5sudo -u postgres psql << 'SQL'
6CREATE DATABASE flowlink;
7CREATE USER flowlink WITH PASSWORD 'your_secure_password';
8GRANT ALL PRIVILEGES ON DATABASE flowlink TO flowlink;
9SQL
10
11# 2.3. Запустить миграции
12flowlink-relay migrate \
13  --database-url postgres://flowlink:your_secure_password@127.0.0.1:5432/flowlink
14
15# 2.4. Проверить
16flowlink-relay migrate --status \
17  --database-url postgres://flowlink:your_secure_password@127.0.0.1:5432/flowlink

1# 3.1. Скачать бинарник Relay
2curl -L https://flowlink.flow-masters.ru/downloads/flowlink-relay \
3  -o /usr/local/bin/flowlink-relay
4chmod +x /usr/local/bin/flowlink-relay
5
6# 3.2. Конфигурация
7cat > /etc/flowlink/relay/config.toml << 'EOF'
8listen_http = "0.0.0.0:9081"
9listen_wss  = "0.0.0.0:9080"
10
11[database]
12url = "postgres://flowlink:your_secure_password@127.0.0.1:5432/flowlink"
13max_connections = 50
14
15[security]
16jwt_secret = "your_jwt_secret_at_least_32_chars"
17mcp_mode = "gateway"
18shield_enabled = true
19
20[logging]
21level = "info"
22format = "json"
23EOF
24
25# 3.3. Systemd unit
26cat > /etc/systemd/system/flowlink-relay.service << 'EOF'
27[Unit]
28Description=Flowlink Relay (Control Plane)
29After=network.target postgresql.service
30Wants=postgresql.service
31
32[Service]
33Type=simple
34ExecStart=/usr/local/bin/flowlink-relay --config /etc/flowlink/relay/config.toml
35Restart=always
36RestartSec=5
37LimitNOFILE=65535
38
39[Install]
40WantedBy=multi-user.target
41EOF
42
43systemctl daemon-reload
44systemctl enable --now flowlink-relay

1# 4.1. Скачать бинарник агента
2curl -L https://flowlink.flow-masters.ru/downloads/flowlink \
3  -o /usr/local/bin/flowlink-relay
4chmod +x /usr/local/bin/flowlink-relay
5
6# 4.2. Регистрация агента на Relay
7flowlink-relay signup \
8  --relay-url https://relay.example.com:9081 \
9  --name "$(hostname)"
10
11# 4.3. Создать конфиг
12mkdir -p /etc/flowlink/agent
13cat > /etc/flowlink/agent/$(hostname).json << EOF
14{
15  "agent_id": "$(hostname)",
16  "token": "...",
17  "relay_url": "wss://relay.example.com:9093",
18  "reconnect_interval": 5,
19  "log_level": "info"
20}
21EOF
22
23# 4.4. Systemd unit
24cat > /etc/systemd/system/flowlink-agent.service << 'EOF'
25[Unit]
26Description=Flowlink Agent
27After=network-online.target
28Wants=network-online.target
29
30[Service]
31Type=simple
32ExecStart=/usr/local/bin/flowlink-agent --config /etc/flowlink/agent/$(hostname).json
33Restart=always
34RestartSec=5
35
36[Install]
37WantedBy=multi-user.target
38EOF
39
40systemctl daemon-reload
41systemctl enable --now flowlink-agent
42
43# 4.5. Проверить подключение
44systemctl status flowlink-agent
45journalctl -u flowlink-agent --no-pager -n 20

1# 5.1. Проверить поддержку eBPF
2uname -r   # должен быть 5.4+
3
4# 5.2. Загрузить Shield модуль
5flowlink-relay shield --load
6
7# 5.3. Добавить в конфиг агента
8cat >> /etc/flowlink/agent/$(hostname).json << 'EOF'
9,
10  "shield": {
11    "enabled": true,
12    "mode": "enforce",
13    "rules_path": "/etc/flowlink/shield/rules.yaml"
14  }
15EOF
16
17# 5.4. Перезапустить агент
18systemctl restart flowlink-agent
19
20# 5.5. Проверить статус Shield
21flowlink-relay shield --status

1# /etc/flowlink/relay/config.toml
2
3[tls]
4cert = "/etc/flowlink/certs/relay.example.com.pem"
5key  = "/etc/flowlink/certs/relay.example.com.key"
6
7# Минимальная версия TLS
8min_version = "1.2"
9# Принудительное использование HTTPS (HSTS)
10hsts_max_age = 31536000

1# Установка certbot
2apt install -y certbot
3
4# Получить сертификат
5certbot certonly --standalone -d relay.example.com -d gateway.example.com
6
7# Скопировать в директорию Flowlink
8cp /etc/letsencrypt/live/relay.example.com/fullchain.pem /etc/flowlink/certs/relay.example.com.pem
9cp /etc/letsencrypt/live/relay.example.com/privkey.pem /etc/flowlink/certs/relay.example.com.key
10
11# Автообновление через cron
12(crontab -l 2>/dev/null; echo "0 3 * * * certbot renew --quiet && systemctl restart flowlink-relay flowlink-gateway") | crontab -

1# На стороне Relay — обязательно проверять сертификаты клиентов
2
3[tls]
4cert = "/etc/flowlink/certs/relay.pem"
5key  = "/etc/flowlink/certs/relay.key"
6ca_cert = "/etc/flowlink/certs/ca.pem"
7client_auth = "require"

1// На стороне Agent — в конфиге агента:
2{
3  "relay_url": "wss://relay.example.com:9080",
4  "tls": {
5    "cert": "/etc/flowlink/agent/agent.pem",
6    "key": "/etc/flowlink/agent/agent.key",
7    "ca_cert": "/etc/flowlink/agent/ca.pem"
8  }
9}

1# relay-deployment.yaml
2apiVersion: apps/v1
3kind: Deployment
4metadata:
5  name: flowlink-relay
6spec:
7  replicas: 3
8  selector:
9    matchLabels:
10      app: flowlink-relay
11  template:
12    metadata:
13      labels:
14        app: flowlink-relay
15    spec:
16      containers:
17        - name: relay
18          image: ghcr.io/flow-masters/flowlink-relay:latest
19          ports:
20            - containerPort: 9080
21            - containerPort: 9081
22          env:
23            - name: DATABASE_URL
24              valueFrom:
25                secretKeyRef:
26                  name: flowlink-secrets
27                  key: database-url
28            - name: JWT_SECRET
29              valueFrom:
30                secretKeyRef:
31                  name: flowlink-secrets
32                  key: jwt-secret
33          livenessProbe:
34            httpGet:
35              path: /health
36              port: 9081
37            initialDelaySeconds: 10
38            periodSeconds: 15
39          readinessProbe:
40            httpGet:
41              path: /ready
42              port: 9081
43            initialDelaySeconds: 5
44            periodSeconds: 10
45---
46apiVersion: v1
47kind: Service
48metadata:
49  name: flowlink-relay
50spec:
51  selector:
52    app: flowlink-relay
53  ports:
54    - name: http
55      port: 9081
56      targetPort: 9081
57    - name: wss
58      port: 9080
59      targetPort: 9080
60  type: ClusterIP

1# На primary-сервере postgresql.conf:
2wal_level = replica
3max_wal_senders = 5
4wal_keep_size = 1GB
5hot_standby = on
6
7# pg_hba.conf — разрешить репликацию:
8host replication flowlink_replica 10.0.0.0/8 scram-sha-256
9
10# На replica-сервере:
11pg_basebackup -h primary.example.com -U flowlink_replica \
12  -D /var/lib/postgresql/16/main -Fp -Xs -P -R
13
14# Рекомендуется Patroni или Stolon для авто-failover

1# nginx stream proxy — sticky sessions по IP
2stream {
3    upstream relay_wss {
4        hash $remote_addr consistent;
5        server relay1:9080;
6        server relay2:9080;
7        server relay3:9080;
8    }
9
10    server {
11        listen 9093;
12        proxy_pass relay_wss;
13        proxy_timeout 86400s;
14    }
15}

1#!/bin/bash
2# upgrade-flowlink.sh
3set -euo pipefail
4
5# 1. Rolling restart агентов
6for host in agent-node-1 agent-node-2; do
7  ssh "$host" "systemctl restart flowlink-agent"
8done
9sleep 5
10
11# 2. Обновление Relay
12curl -L https://flowlink.flow-masters.ru/downloads/flowlink-relay \
13  -o /usr/local/bin/flowlink-relay-new
14chmod +x /usr/local/bin/flowlink-relay-new
15mv /usr/local/bin/flowlink-relay /usr/local/bin/flowlink-relay.bak
16mv /usr/local/bin/flowlink-relay-new /usr/local/bin/flowlink-relay
17systemctl restart flowlink-relay
18sleep 3
19
20# 3. Обновление Gateway
21curl -L https://flowlink.flow-masters.ru/downloads/flowlink-gateway \
22  -o /usr/local/bin/flowlink-gateway-new
23chmod +x /usr/local/bin/flowlink-gateway-new
24mv /usr/local/bin/flowlink-gateway /usr/local/bin/flowlink-gateway.bak
25mv /usr/local/bin/flowlink-gateway-new /usr/local/bin/flowlink-gateway
26systemctl restart flowlink-gateway
27
28# 4. Запуск миграций
29flowlink-relay migrate \
30  --database-url "postgres://flowlink:pass@127.0.0.1:5432/flowlink"
31
32# Обновление завершено

1# Обновить образ Relay
2kubectl set image deployment/flowlink-relay \
3  relay=ghcr.io/flow-masters/flowlink-relay:1.2.0
4
5# Следить за rollout
6kubectl rollout status deployment/flowlink-relay
7
8# Откат при необходимости
9kubectl rollout undo deployment/flowlink-relay

1#!/bin/bash
2# ежедневный бэкап PostgreSQL
3
4BACKUP_DIR="/var/backups/flowlink"
5DATE=$(date +%Y-%m-%d_%H%M%S)
6RETENTION_DAYS=30
7mkdir -p "$BACKUP_DIR"
8
9# Полный бэкап
10pg_dump -Fc -h 127.0.0.1 -U flowlink -d flowlink \
11  > "$BACKUP_DIR/flowlink_$DATE.dump"
12gzip -f "$BACKUP_DIR/flowlink_$DATE.dump"
13find "$BACKUP_DIR" -name "flowlink_*.dump.gz" -mtime +"$RETENTION_DAYS" -delete

1#!/bin/bash
2# Бэкап всех конфигов Flowlink
3
4BACKUP_DIR="/var/backups/flowlink/config"
5DATE=$(date +%Y-%m-%d_%H%M%S)
6mkdir -p "$BACKUP_DIR"
7
8tar czf "$BACKUP_DIR/flowlink-config_$DATE.tar.gz" \
9  /etc/flowlink/ \
10  /etc/systemd/system/flowlink-*.service

1#!/bin/bash
2# Восстановление из бэкапа
3BACKUP_FILE="/var/backups/flowlink/flowlink_2026-05-15_030000.dump.gz"
4
5# 1. Остановить сервисы
6systemctl stop flowlink-agent flowlink-gateway flowlink-relay
7
8# 2. Восстановить базу данных
9gunzip -c "$BACKUP_FILE" | pg_restore \
10  -h 127.0.0.1 -U flowlink -d flowlink \
11  --clean --if-exists
12
13# 3. Проверить целостность
14flowlink-relay migrate --status \
15  --database-url "postgres://flowlink:pass@127.0.0.1:5432/flowlink"
16
17# 4. Запустить сервисы
18systemctl start flowlink-relay
19sleep 3
20systemctl start flowlink-gateway
21systemctl start flowlink-agent