86 lines
1.9 KiB
Markdown
86 lines
1.9 KiB
Markdown
# 服务器加固（2026-08-05）
|
||
|
||
## 1. Swap 交换空间
|
||
|
||
**原因：** 2G 内存没有 Swap，内存爆了直接 OOM 杀进程。
|
||
|
||
```bash
|
||
fallocate -l 2G /swapfile
|
||
chmod 600 /swapfile
|
||
mkswap /swapfile
|
||
swapon /swapfile
|
||
echo '/swapfile none swap sw 0 0' >> /etc/fstab
|
||
```
|
||
|
||
**验证：** `swapon --show` → `/swapfile file 2G`
|
||
|
||
## 2. 停止 SearXNG
|
||
|
||
**原因：** 不用搜索功能，容器每分钟重启一次浪费 CPU。
|
||
|
||
```bash
|
||
cd /lobehub
|
||
docker compose stop searxng
|
||
docker compose rm -f searxng
|
||
```
|
||
|
||
> 注意：不要运行 `docker compose up -d`（会重建 SearXNG），单服务用 `docker compose up -d lobe`
|
||
|
||
## 3. 开机自启
|
||
|
||
创建 `/etc/systemd/system/lobehub.service`：
|
||
|
||
```ini
|
||
[Unit]
|
||
Description=LobeHub Docker Stack
|
||
Requires=docker.service
|
||
After=docker.service
|
||
|
||
[Service]
|
||
Type=oneshot
|
||
RemainAfterExit=yes
|
||
WorkingDirectory=/lobehub
|
||
ExecStart=/usr/bin/docker compose up -d lobe postgresql redis rustfs
|
||
ExecStop=/usr/bin/docker compose stop
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
```
|
||
|
||
```bash
|
||
systemctl daemon-reload
|
||
systemctl enable lobehub docker nginx
|
||
```
|
||
|
||
## 4. 每日自动备份
|
||
|
||
脚本位置：`/lobehub/backup.sh`
|
||
|
||
```bash
|
||
#!/bin/bash
|
||
DB_PASS=$(grep POSTGRES_PASSWORD /lobehub/.env | cut -d= -f2)
|
||
DATE=$(date +%Y%m%d_%H%M%S)
|
||
FILE=/lobehub/backups/lobehub_$DATE.sql.gz
|
||
docker compose -f /lobehub/docker-compose.yml exec -T postgresql pg_dump -U postgres lobechat | gzip > $FILE
|
||
find /lobehub/backups -name '*.sql.gz' -mtime +7 -delete
|
||
echo "Backup: $FILE ($(du -h $FILE | cut -f1))"
|
||
```
|
||
|
||
Cron 任务（每天凌晨 3 点）：
|
||
```
|
||
0 3 * * * /lobehub/backup.sh >> /lobehub/backups/backup.log 2>&1
|
||
```
|
||
|
||
备份目录：`/lobehub/backups/`，保留最近 7 天。
|
||
|
||
## 最终状态
|
||
|
||
| 项目 | 值 |
|
||
|------|-----|
|
||
| 内存 | 1.0G/1.8G + 2.0G Swap |
|
||
| 磁盘 | 9.2G/40G (25%) |
|
||
| 容器数 | 4（lobehub, postgres, redis, rustfs） |
|
||
| SearXNG | 已停止删除 |
|
||
| 自启 | Docker + Nginx + LobeHub 全部 enabled |
|
||
| 备份 | 每日凌晨 3 点，保留 7 天 |
|