环境要求

# Ubuntu/Debian
curl -fsSL https://get.docker.com | bash
sudo usermod -aG docker $USER

# macOS/Windows
# 下载并安装 Docker Desktop
# https://www.docker.com/products/docker-desktop

docker --version
# Docker version 24.0.0 or higher

docker compose version
# Docker Compose version v2.20.0 or higher

# Linux/macOS
sudo lsof -i :3306
sudo netstat -tulnp | grep 3306

# Windows
netstat -ano | findstr :3306

# Elasticsearch 需要
vm.max_map_count=262144

# 网络优化
net.core.somaxconn=65535
net.ipv4.tcp_max_syn_backlog=8192
net.ipv4.ip_local_port_range=1024 65535
net.ipv4.tcp_tw_reuse=1

# 文件描述符限制
fs.file-max=2097152

sudo sysctl -p

*  soft  nofile  65536
*  hard  nofile  65536
*  soft  nproc   4096
*  hard  nproc   4096

# 临时禁用
sudo swapoff -a

# 永久禁用（编辑 /etc/fstab，注释掉 swap 行）
sudo sed -i '/swap/d' /etc/fstab

# Linux
sudo timedatectl set-timezone Asia/Shanghai

# 验证
date

# HTTP/HTTPS（公网访问）
80/tcp (HTTP)
443/tcp (HTTPS)

# 管理端口（仅内网或 VPN 访问）
3306/tcp (MySQL)
6380/tcp (Redis Cache)
6381/tcp (Redis Market)
9200/tcp (Elasticsearch)
8080/tcp (ElasticVue)
9520/tcp (SODOS Manager)

# 允许访问 Binance API
443/tcp (HTTPS) -> stream.binance.com
443/tcp (HTTPS) -> api.binance.com

# Docker Hub（镜像拉取）
443/tcp (HTTPS) -> hub.docker.com
443/tcp (HTTPS) -> registry-1.docker.io

# Elasticsearch
9200/tcp, 9300/tcp (集群通信)

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow from 192.168.0.0/16 to any port 3306 proto tcp
sudo ufw allow from 192.168.0.0/16 to any port 6380 proto tcp
sudo ufw allow from 192.168.0.0/16 to any port 9200 proto tcp
sudo ufw enable

api.example.com       A     1.2.3.4
manager.example.com   A     1.2.3.4
h5.example.com        A     1.2.3.4
pc.example.com        A     1.2.3.4
www.example.com       A     1.2.3.4

*.example.com         A     1.2.3.4

# MySQL
MYSQL_ROOT_PASSWORD: ********************************
MYSQL_PASSWORD: ********************************

# Redis (redis_cache/redis.conf 和 redis_market/redis.conf)
requirepass ********************************

# Elasticsearch
ELASTIC_PASSWORD: ********************************

openssl rand -base64 32

# 禁用 root 登录
PermitRootLogin no

# 禁用密码登录，仅使用密钥
PasswordAuthentication no

# 修改默认 SSH 端口
Port 2222

# 根据内存调整
innodb_buffer_pool_size = 50%-70% 总内存
max_connections = 1000

# 日志优化
innodb_log_file_size = 256M
innodb_flush_log_at_trx_commit = 2  # 高并发场景

# 内存策略
maxmemory-policy allkeys-lru

# I/O 线程（Redis 6+）
io-threads 4
io-threads-do-reads yes

# 持久化策略
appendonly yes
appendfsync everysec  # 折衷性能与持久性

# JVM 堆内存（不超过 50% 总内存，最大 32GB）
ES_JAVA_OPTS: "-Xms2g -Xmx4g"

# 线程池
thread_pool.write.size: 3
thread_pool.search.size: 6

# 索引缓冲
indices.memory.index_buffer_size: 20%

// /etc/docker/daemon.json
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m",
    "max-file": "3"
  },
  "storage-driver": "overlay2",
  "storage-opts": [
    "overlay2.override_kernel_check=true"
  ]
}