AI站点部署与CDN防御实战(避坑指南)

# ========== 1. 系统更新与内核优化 ==========
# 升级系统包（CentOS 7.9）
yum update -y
# 安装epel源（补充依赖）
yum install -y epel-release
# 优化内核参数（解决高并发TIME_WAIT问题）
cat >> /etc/sysctl.conf << EOF
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_max_tw_buckets = 5000
net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 65535
net.core.netdev_max_backlog = 65535
EOF
sysctl -p

# ========== 2. 关闭无用服务与端口 ==========
# 关闭SELinux（避免权限问题）
sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
setenforce 0
# 关闭防火墙（改用阿里云安全组，双层防护）
systemctl stop firewalld && systemctl disable firewalld
# 仅开放必要端口（若使用防火墙）
# firewall-cmd --permanent --add-port={80/tcp,443/tcp,22/tcp}
# firewall-cmd --reload

# ========== 3. 安装基础依赖（AI部署必备） ==========
yum install -y gcc gcc-c++ pcre-devel zlib-devel openssl-devel \
               python39 python39-devel python39-pip \
               mariadb-devel redis wget curl vim htop

# ========== 4. 安装Nginx 1.24.0（稳定版） ==========
wget https://nginx.org/download/nginx-1.24.0.tar.gz
tar -zxvf nginx-1.24.0.tar.gz
cd nginx-1.24.0
./configure --prefix=/usr/local/nginx \
            --with-http_ssl_module \
            --with-http_v2_module \
            --with-http_stub_status_module \
            --with-http_limit_req_module
make && make install

# 设置Nginx开机自启
cat > /usr/lib/systemd/system/nginx.service << EOF
[Unit]
Description=nginx - high performance web server
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
PIDFile=/usr/local/nginx/logs/nginx.pid
ExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
ExecReload=/usr/local/nginx/sbin/nginx -s reload
ExecStop=/usr/local/nginx/sbin/nginx -s stop
PrivateTmp=true

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl start nginx && systemctl enable nginx

# AI API对接核心脚本（Python 3.9 + FastAPI）
# 文件名：ai_api_service.py
import os
import json
import time
import logging
import redis
import requests
from functools import wraps
from fastapi import FastAPI, HTTPException
from pydantic import BaseModel
from dotenv import load_dotenv

# ========== 1. 初始化配置（生产级） ==========
# 加载环境变量（敏感信息不硬编码）
load_dotenv('/etc/ai_service/.env')  # 密钥文件存放在非web目录
# 日志配置（生产级，按天轮转）
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s',
    handlers=[
        logging.FileHandler('/var/log/ai_service/access.log'),
        logging.StreamHandler()
    ]
)
logger = logging.getLogger('ai_api')

# Redis缓存初始化（降低重复请求压力）
redis_client = redis.Redis(
    host=os.getenv('REDIS_HOST', '127.0.0.1'),
    port=int(os.getenv('REDIS_PORT', 6379)),
    password=os.getenv('REDIS_PASSWORD'),
    db=0,
    decode_responses=True,
    socket_timeout=2  # Redis超时控制
)

# FastAPI应用初始化
app = FastAPI()

# ========== 2. 核心装饰器（超时重试+异常捕获） ==========
def retry_on_exception(max_retries=3, delay=1, exceptions=(requests.exceptions.Timeout,)):
    """
    异常重试装饰器（仅重试指定异常）
    :param max_retries: 最大重试次数
    :param delay: 重试间隔（秒）
    :param exceptions: 需要重试的异常类型
    """
    def decorator(func):
        @wraps(func)
        def wrapper(*args, **kwargs):
            for attempt in range(max_retries):
                try:
                    return func(*args, **kwargs)
                except exceptions as e:
                    logger.warning(f"请求失败（第{attempt+1}次）：{str(e)}")
                    if attempt < max_retries - 1:
                        time.sleep(delay * (attempt + 1))  # 指数退避
                        continue
                    logger.error(f"重试{max_retries}次后仍失败：{str(e)}")
                    raise HTTPException(status_code=504, detail="AI接口超时，请稍后重试")
                except Exception as e:
                    logger.error(f"非重试类异常：{str(e)}")
                    raise HTTPException(status_code=500, detail="服务器内部错误")
        return wrapper
    return decorator

# ========== 3. 请求模型验证（防止非法参数） ==========
class AIRequest(BaseModel):
    prompt: str
    model: str = "gpt-3.5-turbo"
    max_tokens: int = 1000
    temperature: float = 0.7

# ========== 4. 核心AI接口（带缓存+限流） ==========
@app.post("/api/v1/ai/chat")
@retry_on_exception(max_retries=3, delay=1)
async def ai_chat(request: AIRequest):
    """
    AI聊天接口（生产级）
    :param request: 请求参数（已通过Pydantic验证）
    """
    # 1. 参数校验（补充业务规则）
    if len(request.prompt) > 2000:
        raise HTTPException(status_code=400, detail="Prompt长度不能超过2000字符")
    if request.temperature < 0 or request.temperature > 2:
        raise HTTPException(status_code=400, detail="Temperature需在0-2之间")
    
    # 2. 缓存查询（相同Prompt直接返回缓存，降低API成本）
    cache_key = f"ai:cache:{hash(request.prompt)}{request.model}"
    cached_result = redis_client.get(cache_key)
    if cached_result:
        logger.info(f"命中缓存：{cache_key}")
        return json.loads(cached_result)
    
    # 3. 调用第三方AI API
    api_url = os.getenv('AI_API_URL')
    api_key = os.getenv('AI_API_KEY')
    headers = {
        "Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json"
    }
    data = {
        "model": request.model,
        "messages": [{"role": "user", "content": request.prompt}],
        "max_tokens": request.max_tokens,
        "temperature": request.temperature
    }
    
    # 4. 发送请求（严格超时控制）
    response = requests.post(
        api_url,
        headers=headers,
        json=data,
        timeout=10  # 核心超时控制，避免阻塞
    )
    
    # 5. 响应校验
    if response.status_code != 200:
        logger.error(f"API返回非200状态码：{response.status_code}，内容：{response.text}")
        raise HTTPException(status_code=500, detail="AI接口返回异常")
    
    # 6. 结果缓存（设置过期时间，避免脏数据）
    result = response.json()
    redis_client.setex(cache_key, 3600, json.dumps(result))  # 缓存1小时
    
    # 7. 日志记录（便于排查问题）
    logger.info(f"请求成功：Prompt长度={len(request.prompt)}, Model={request.model}, 耗时={response.elapsed.total_seconds()}s")
    
    return result

# ========== 5. 健康检查接口（监控用） ==========
@app.get("/health")
async def health_check():
    """健康检查接口（Prometheus监控用）"""
    try:
        redis_client.ping()  # 检查Redis连通性
        return {"status": "healthy", "timestamp": time.time()}
    except Exception as e:
        logger.error(f"健康检查失败：{str(e)}")
        raise HTTPException(status_code=503, detail="服务不可用")

# ========== 启动命令（生产级） ==========
# uvicorn ai_api_service:app --host 0.0.0.0 --port 8000 --workers 4 --timeout-keep-alive 60
# 注：workers数建议=CPU核心数*2，timeout-keep-alive控制长连接超时

# AI API配置
AI_API_URL=https://api.openai.com/v1/chat/completions
AI_API_KEY=sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# Redis配置
REDIS_HOST=127.0.0.1
REDIS_PORT=6379
REDIS_PASSWORD=你的Redis强密码（16位以上）
# 日志级别
LOG_LEVEL=INFO

# /usr/local/nginx/conf/nginx.conf
user root;
worker_processes auto;  # 自动适配CPU核心数
worker_cpu_affinity auto;  # 绑定CPU核心，提升性能
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

# 事件模块（高并发优化）
events {
    worker_connections 10240;  # 单worker最大连接数
    use epoll;  # 高效IO模型（Linux专属）
    multi_accept on;  # 一次性接受所有新连接
}

# HTTP模块
http {
    include       mime.types;
    default_type  application/octet-stream;

    # 日志格式（记录真实IP，CDN场景）
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" '
                      '$request_time $upstream_response_time';
    access_log  /var/log/nginx/access.log  main;

    # 核心优化参数
    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout  65;
    keepalive_requests 100;  # 单连接最大请求数
    client_header_timeout 10s;
    client_body_timeout 10s;
    send_timeout 10s;

    # Gzip压缩（降低带宽）
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_buffers 4 16k;
    gzip_comp_level 6;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    # 限流配置（双层防护，CDN+Nginx）
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;  # 单IP每秒10次
    limit_req_zone $http_x_forwarded_for zone=cdn_limit:10m rate=20r/s;  # CDN场景真实IP限流

    # 后端服务集群（AI接口）
    upstream ai_backend {
        server 127.0.0.1:8000;
        keepalive 32;  # 长连接，减少握手开销
        # 多节点配置示例：
        # server 192.168.1.10:8000;
        # server 192.168.1.11:8000 backup;  # 备用节点
    }

    # 业务域名配置
    server {
        listen       80;
        listen       443 ssl http2;
        server_name  yourdomain.com;

        # SSL配置（生产级）
        ssl_certificate      /etc/nginx/cert/yourdomain.crt;
        ssl_certificate_key  /etc/nginx/cert/yourdomain.key;
        ssl_session_cache    shared:SSL:10m;
        ssl_session_timeout  10m;
        ssl_protocols TLSv1.2 TLSv1.3;  # 禁用低版本协议
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;

        # 80端口强制跳转HTTPS
        if ($scheme = http) {
            return 301 https://$host$request_uri;
        }

        # 健康检查接口（无需限流）
        location /health {
            proxy_pass http://ai_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        # AI接口限流+反向代理
        location /api/ {
            # 限流配置（burst突发流量，nodelay不延迟）
            limit_req zone=cdn_limit burst=20 nodelay;
            # 连接数限制
            limit_conn addr 50;
            # 反向代理配置
            proxy_pass http://ai_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            # 超时控制（关键，避免Nginx等待超时）
            proxy_connect_timeout 5s;
            proxy_send_timeout 10s;
            proxy_read_timeout 15s;
            # 缓冲区配置（提升性能）
            proxy_buffers 8 16k;
            proxy_buffer_size 32k;
        }

        # 静态资源配置（CDN回源）
        location ~* \.(jpg|jpeg|png|gif|css|js|ico|svg)$ {
            root /var/www/ai_site/static;
            expires 7d;  # 缓存7天
            add_header Cache-Control "public, immutable";
            add_header X-Cache-Status $upstream_cache_status;
        }

        # 前端页面配置
        location / {
            root /var/www/ai_site;
            index index.html index.htm;
            expires 1h;  # 缓存1小时
            try_files $uri $uri/ /index.html;  # SPA应用路由兼容
        }

        # 禁止访问敏感文件
        location ~ /\.env {
            deny all;
            return 403;
        }
    }
}

# ========== 1. 创建专用账户（禁止root远程登录） ==========
mysql -uroot -p
# 创建业务账户，仅允许内网访问
CREATE USER 'ai_service'@'192.168.%.%' IDENTIFIED BY '强密码（16位以上，字母+数字+特殊字符）';
# 授权最小权限
GRANT SELECT, INSERT, UPDATE ON ai_db.* TO 'ai_service'@'192.168.%.%';
FLUSH PRIVILEGES;
# 禁用root远程登录
UPDATE mysql.user SET Host='localhost' WHERE User='root' AND Host!='localhost';
FLUSH PRIVILEGES;

# ========== 2. 配置文件优化（/etc/my.cnf） ==========
[mysqld]
# 基础配置
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
symbolic-links=0
log-error=/var/log/mysqld.log
pid-file=/var/run/mysqld/mysqld.pid

# 安全配置
skip-networking=0  # 0=允许网络访问，1=仅本地
bind-address=192.168.1.10  # 仅绑定内网IP
default_authentication_plugin=mysql_native_password
sql_mode=STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION

# 性能配置（16核32G服务器）
innodb_buffer_pool_size=20G  # 内存的60-70%
innodb_log_file_size=2G
innodb_log_buffer_size=64M
innodb_flush_log_at_trx_commit=1  # 生产环境建议1（数据安全）
max_connections=2000
wait_timeout=600
interactive_timeout=600

# 慢查询日志（定位性能问题）
slow_query_log=1
slow_query_log_file=/var/log/mysql/slow.log
long_query_time=1  # 超过1秒记录
log_queries_not_using_indexes=1  # 记录未使用索引的查询

# ========== 3. 自动备份脚本（/usr/local/bin/mysql_backup.sh） ==========
#!/bin/bash
# 备份时间
BACKUP_TIME=$(date +%Y%m%d_%H%M%S)
# 备份目录
BACKUP_DIR=/data/mysql_backup
# 数据库信息
DB_USER=ai_service
DB_PASS=你的数据库密码
DB_NAME=ai_db

# 创建备份目录
mkdir -p $BACKUP_DIR

# 备份数据库（压缩）
mysqldump -u$DB_USER -p$DB_PASS $DB_NAME | gzip > $BACKUP_DIR/$DB_NAME"_"$BACKUP_TIME.sql.gz

# 删除7天前的备份（避免磁盘满）
find $BACKUP_DIR -name "*.sql.gz" -mtime +7 -delete

# 同步到OSS（可选，异地备份）
# ossutil cp $BACKUP_DIR/$DB_NAME"_"$BACKUP_TIME.sql.gz oss://ai-backup/

# ========== 4. 添加定时任务（每天凌晨2点备份） ==========
chmod +x /usr/local/bin/mysql_backup.sh
crontab -e
# 添加以下内容
0 2 * * * /usr/local/bin/mysql_backup.sh > /var/log/mysql_backup.log 2>&1

# ========== 1. 安装Prometheus ==========
# 下载安装包
wget https://github.com/prometheus/prometheus/releases/download/v2.45.0/prometheus-2.45.0.linux-amd64.tar.gz
tar -zxvf prometheus-2.45.0.linux-amd64.tar.gz
mv prometheus-2.45.0.linux-amd64 /usr/local/prometheus

# 创建配置文件
cat > /usr/local/prometheus/prometheus.yml << EOF
global:
  scrape_interval: 15s  # 采集间隔
  evaluation_interval: 15s

alerting:
  alertmanagers:
    - static_configs:
        - targets:
          - localhost:9093

rule_files:
  - "alert_rules.yml"

scrape_configs:
  # 监控Prometheus自身
  - job_name: "prometheus"
    static_configs:
      - targets: ["localhost:9090"]
  # 监控服务器（node_exporter）
  - job_name: "node"
    static_configs:
      - targets: ["localhost:9100"]
  # 监控Nginx（nginx-vts-exporter）
  - job_name: "nginx"
    static_configs:
      - targets: ["localhost:9913"]
  # 监控AI接口（FastAPI自带/metrics）
  - job_name: "ai_api"
    static_configs:
      - targets: ["localhost:8000"]
EOF

# 创建告警规则
cat > /usr/local/prometheus/alert_rules.yml << EOF
groups:
- name: server_alerts
  rules:
  - alert: HighCPUUsage
    expr: 100 - (avg by (instance) (irate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80
    for: 2m
    labels:
      severity: warning
    annotations:
      summary: "CPU使用率过高"
      description: "服务器{{ \$labels.instance }} CPU使用率超过80% (当前: {{ \$value }}%)"
  - alert: HighMemoryUsage
    expr: (1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100 > 85
    for: 2m
    labels:
      severity: warning
    annotations:
      summary: "内存使用率过高"
      description: "服务器{{ \$labels.instance }} 内存使用率超过85% (当前: {{ \$value }}%)"
EOF

# 启动Prometheus
nohup /usr/local/prometheus/prometheus --config.file=/usr/local/prometheus/prometheus.yml --web.listen-address=:9090 > /var/log/prometheus.log 2>&1 &

# ========== 2. 安装Grafana ==========
yum install -y https://dl.grafana.com/oss/release/grafana-10.0.3-1.x86_64.rpm
systemctl start grafana-server && systemctl enable grafana-server

# ========== 3. 安装node_exporter（服务器监控） ==========
wget https://github.com/prometheus/node_exporter/releases/download/v1.6.1/node_exporter-1.6.1.linux-amd64.tar.gz
tar -zxvf node_exporter-1.6.1.linux-amd64.tar.gz
mv node_exporter-1.6.1.linux-amd64/node_exporter /usr/local/bin/
nohup node_exporter > /var/log/node_exporter.log 2>&1 &

# ========== 4. 配置Grafana告警（钉钉/短信） ==========
# 1. 访问http://服务器IP:3000（默认账号密码admin/admin）
# 2. 添加Prometheus数据源（URL: http://localhost:9090）
# 3. 导入模板（服务器监控推荐模板ID: 1860，Nginx监控模板ID: 9614）
# 4. 配置告警通道（钉钉机器人/短信API）