[3.0] 新的 Redis 组件

.github/actions/ci-prepare/action.yml

@@ -12,16 +12,19 @@ runs:
     - name: Setup Services
       shell: bash
       run: |
+        docker network create imi-ci-service-network --subnet 172.10.12.0/24
+        docker compose -f ./.github/service/redis-cluster/docker-compose.yml up -d
         docker compose -f ./.github/docker-compose.yml up -d ${{ inputs.env }}
         docker exec ${{ inputs.env }} php -v
         docker exec ${{ inputs.env }} php -m
+        docker exec ${{ inputs.env }} php --ri redis
         docker exec ${{ inputs.env }} php --ri swoole
         docker exec ${{ inputs.env }} php -r "echo 'opcache config: '; print_r(opcache_get_status(false));"
         docker exec ${{ inputs.env }} composer -V
     - name: Prepare
       shell: bash
       run: |
-        docker exec ${{ inputs.env }} apt install -y rsync
+        docker exec ${{ inputs.env }} apt install -y rsync netcat-openbsd
         docker exec ${{ inputs.env }} composer config --global cache-files-dir /tmp/base_cache/composer
         docker exec ${{ inputs.env }} composer config -g process-timeout 600
         docker exec ${{ inputs.env }} composer update --no-interaction --prefer-dist --no-progress ${COMPOSER_ENV}

.github/docker-compose.yml

@@ -1,12 +1,14 @@
-version: "3.4"
-volumes:
-  shared-volume:
+version: '3.5'
+
+name: ci
 services:
   shared-tmp:
     image: busybox
-    command: chmod -R 777 /tmp/docker
+    container_name: shared-tmp
+    command: /tmp/shared-env.sh
     volumes:
-      - shared-volume:/tmp/docker
+      - /run/shared:/run/shared
+      - ./shared-env.sh:/tmp/shared-env.sh
 
   mysql:
     image: mysql:${MYSQL_DOCKER_VERSION}
@@ -38,17 +40,51 @@ services:
     volumes:
       - "${GITHUB_WORKSPACE}:/imi:rw"
 
+#  redis:
+#    image: redis:6-alpine
+#    container_name: redis
+#    depends_on:
+#      - shared-tmp
+#    command: redis-server /etc/redis.conf
+#    volumes:
+#      - ./redis.conf:/etc/redis.conf
+#      - /run/shared:/run/shared
+#    ports:
+#      - 6379:6379
+
   redis:
-    image: redis:6-alpine
+    image: bitnami/redis:7.2
     container_name: redis
     depends_on:
       - shared-tmp
-    command: redis-server /etc/redis.conf
     volumes:
-      - ./redis.conf:/etc/redis.conf
-      - shared-volume:/tmp/docker
+      - "${GITHUB_WORKSPACE}/.github/service/redis-tls/certs:/opt/bitnami/redis/certs"
+      - "${GITHUB_WORKSPACE}/.github/service/redis-tls/redis-overrides.conf:/opt/bitnami/redis/redis-overrides.conf"
+      - /run/shared:/run/shared
+    environment:
+      REDIS_OVERRIDES_FILE: "/opt/bitnami/redis/redis-overrides.conf"
+      REDIS_PORT_NUMBER: 6379
+      REDIS_PASSWORD: "l83aa26"
+      REDIS_TLS_ENABLED: "true"
+      REDIS_TLS_PORT_NUMBER: 6443
+      REDIS_TLS_CERT_FILE: "/opt/bitnami/redis/certs/redis.crt"
+      REDIS_TLS_KEY_FILE: "/opt/bitnami/redis/certs/redis.key"
+      REDIS_TLS_DH_PARAMS_FILE: "/opt/bitnami/redis/certs/redis.dh"
+      REDIS_TLS_CA_FILE: "/opt/bitnami/redis/certs/ca.crt"
+      REDIS_TLS_AUTH_CLIENTS: "yes"
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli -h 127.0.0.1 -p $${REDIS_PORT_NUMBER:-6379} -a $${REDIS_PASSWORD} INFO | grep 'redis_version'"]
+      interval: 3s
+      timeout: 60s
+      retries: 30
     ports:
-      - 6379:6379
+      - "6379:6379"
+      - "6443:6443"
+    networks:
+      proxies:
+        aliases:
+          - redis
+        ipv4_address: 172.10.12.111
 
   rabbitmq:
     container_name: rabbitmq
@@ -100,15 +136,29 @@ services:
       - postgres
     environment:
       MYSQL_SERVER_HOST: mysql
-      REDIS_SERVER_HOST: ${REDIS_SERVER_HOST}
+      REDIS_SERVER_HOST: ${REDIS_SERVER_HOST:-redis}
+      REDIS_SERVER_PASSWORD: ${REDIS_SERVER_PASSWORD:-l83aa26}
       PGSQL_SERVER_HOST: postgres
       MYSQL_SERVER_PASSWORD: ""
       AMQP_SERVER_HOST: "rabbitmq"
       KAFKA_BOOTSTRAP_SERVERS: "kafka1:9092"
       GITHUB_TOKEN: ${GITHUB_TOKEN}
+      REDIS_SERVER_CLUSTER_PASSWORD: "l83aa26"
+      REDIS_SERVER_CLUSTER_SEEDS: "172.10.12.2:6379,172.10.12.3:6379,172.10.12.4:6379,172.10.12.5:6379,172.10.12.6:6379,172.10.12.7:6379"
+      REDIS_SERVER_TLS_CLUSTER_SEEDS: "172.10.12.2:6443,172.10.12.3:6443,172.10.12.4:6443,172.10.12.5:6443,172.10.12.6:6443,172.10.12.7:6443"
+      REDIS_SERVER_UNIX_SOCK: "/run/shared/redis.sock"
+      REDIS_SERVER_TLS_HOST: "redis"
+      REDIS_SERVER_TLS_PORT: "6443"
+      REDIS_SERVER_TLS_PASSWORD: "l83aa26"
+      REDIS_SERVER_TLS_CA_FILE: "/imi/.github/service/redis-tls/certs/ca.crt"
+      REDIS_SERVER_TLS_CERT_FILE: "/imi/.github/service/redis-tls/certs/client.crt"
+      REDIS_SERVER_TLS_KEY_FILE: "/imi/.github/service/redis-tls/certs/client.key"
     volumes:
       - "${GITHUB_WORKSPACE}:/imi:rw"
-      - shared-volume:/tmp/docker
+      - /run/shared:/run/shared
+    networks:
+      default:
+      proxies:
     working_dir: /imi
     command: tail -f /dev/null
     tty: true
@@ -125,11 +175,22 @@ services:
     environment:
       MYSQL_SERVER_HOST: mysql
       REDIS_SERVER_HOST: ${REDIS_SERVER_HOST}
+      REDIS_SERVER_PASSWORD: ${REDIS_SERVER_PASSWORD:-l83aa26}
       PGSQL_SERVER_HOST: postgres
       MYSQL_SERVER_PASSWORD: ""
       AMQP_SERVER_HOST: "rabbitmq"
       KAFKA_BOOTSTRAP_SERVERS: "kafka1:9092"
       GITHUB_TOKEN: ${GITHUB_TOKEN}
+      REDIS_SERVER_CLUSTER_PASSWORD: "l83aa26"
+      REDIS_SERVER_CLUSTER_SEEDS: "172.10.12.2:6379,172.10.12.3:6379,172.10.12.4:6379,172.10.12.5:6379,172.10.12.6:6379,172.10.12.7:6379"
+      REDIS_SERVER_TLS_CLUSTER_SEEDS: "172.10.12.2:6443,172.10.12.3:6443,172.10.12.4:6443,172.10.12.5:6443,172.10.12.6:6443,172.10.12.7:6443"
+      REDIS_SERVER_UNIX_SOCK: "/run/shared/redis.sock"
+      REDIS_SERVER_TLS_HOST: "redis"
+      REDIS_SERVER_TLS_PORT: "6443"
+      REDIS_SERVER_TLS_PASSWORD: "l83aa26"
+      REDIS_SERVER_TLS_CA_FILE: "/imi/.github/service/redis-tls/certs/ca.crt"
+      REDIS_SERVER_TLS_CERT_FILE: "/imi/.github/service/redis-tls/certs/client.crt"
+      REDIS_SERVER_TLS_KEY_FILE: "/imi/.github/service/redis-tls/certs/client.key"
     build:
       context: .
       dockerfile: php.dockerfile
@@ -141,7 +202,10 @@ services:
     volumes:
       - "${GITHUB_WORKSPACE}:/imi:rw"
       - "/tmp/base_cache:/tmp/base_cache:rw"
-      - shared-volume:/tmp/docker
+      - /run/shared:/run/shared
+    networks:
+      default:
+      proxies:
     working_dir: /imi
     command: tail -f /dev/null
 
@@ -154,6 +218,16 @@ services:
       - "${GITHUB_WORKSPACE}:/imi:rw"
       - "/tmp/base_cache:/tmp/base_cache:rw"
       - "/tmp/base_cache/phpstan:/tmp/phpstan:rw"
+    networks:
+      default:
+      proxies:
     working_dir: /imi
     command: tail -f /dev/null
-    tty: true
+    tty: true
+
+networks:
+  default:
+    driver: bridge
+  proxies:
+    name: "imi-ci-service-network"
+    external: true

.github/redis.conf

@@ -112,7 +112,7 @@ tcp-backlog 511
 # incoming connections. There is no default, so Redis will not listen
 # on a unix socket when not specified.
 #
-unixsocket /tmp/docker/redis.sock
+unixsocket /run/shared/redis.sock
 unixsocketperm 777
 
 # Close the connection after a client is idle for N seconds (0 to disable)

.github/service/redis-cluster/docker-compose.yml

@@ -0,0 +1,148 @@
+version: '3.5'
+
+name: redis-cluster
+services:
+  node-0:
+    image: bitnami/redis-cluster:7.2
+    volumes:
+      - "${GITHUB_WORKSPACE}/.github/service/redis-tls/certs:/opt/bitnami/redis/certs"
+    depends_on:
+      - node-1
+      - node-2
+      - node-3
+      - node-4
+      - node-5
+    environment:
+      REDIS_PORT_NUMBER: 6379
+      REDIS_PASSWORD: l83aa26
+      REDISCLI_AUTH: l83aa26
+      REDIS_CLUSTER_REPLICAS: 1
+      REDIS_CLUSTER_CREATOR: yes
+      REDIS_NODES: node-0 node-1 node-2 node-3 node-4 node-5
+      REDIS_TLS_ENABLED: "true"
+      REDIS_TLS_PORT_NUMBER: 6443
+      REDIS_TLS_CERT_FILE: "/opt/bitnami/redis/certs/redis.crt"
+      REDIS_TLS_KEY_FILE: "/opt/bitnami/redis/certs/redis.key"
+      REDIS_TLS_CA_FILE: "/opt/bitnami/redis/certs/ca.crt"
+      REDIS_TLS_DH_PARAMS_FILE: "/opt/bitnami/redis/certs/redis.dh"
+      REDIS_TLS_AUTH_CLIENTS: "yes"
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli -h 127.0.0.1 -p $${REDIS_PORT_NUMBER:-6379} -a $${REDIS_PASSWORD} CLUSTER INFO | grep 'cluster_state:ok'"]
+      interval: 3s
+      timeout: 60s
+      retries: 30
+    networks:
+      proxies:
+        aliases:
+          - redis-cluster-node-0
+        ipv4_address: 172.10.12.2
+
+  node-1:
+    image: bitnami/redis-cluster:7.2
+    volumes:
+      - "${GITHUB_WORKSPACE}/.github/service/redis-tls/certs:/opt/bitnami/redis/certs"
+    environment:
+      REDIS_PORT_NUMBER: 6379
+      REDIS_PASSWORD: l83aa26
+      REDIS_NODES: node-0 node-1 node-2 node-3 node-4 node-5
+      REDIS_TLS_ENABLED: "true"
+      REDIS_TLS_PORT_NUMBER: 6443
+      REDIS_TLS_CERT_FILE: "/opt/bitnami/redis/certs/redis.crt"
+      REDIS_TLS_KEY_FILE: "/opt/bitnami/redis/certs/redis.key"
+      REDIS_TLS_CA_FILE: "/opt/bitnami/redis/certs/ca.crt"
+      REDIS_TLS_DH_PARAMS_FILE: "/opt/bitnami/redis/certs/redis.dh"
+      REDIS_TLS_AUTH_CLIENTS: "yes"
+    networks:
+      proxies:
+        aliases:
+          - redis-cluster-node-1
+        ipv4_address: 172.10.12.3
+
+  node-2:
+    image: bitnami/redis-cluster:7.2
+    volumes:
+      - "${GITHUB_WORKSPACE}/.github/service/redis-tls/certs:/opt/bitnami/redis/certs"
+    environment:
+      REDIS_PORT_NUMBER: 6379
+      REDIS_PASSWORD: l83aa26
+      REDIS_NODES: node-0 node-1 node-2 node-3 node-4 node-5
+      REDIS_TLS_ENABLED: "true"
+      REDIS_TLS_PORT_NUMBER: 6443
+      REDIS_TLS_CERT_FILE: "/opt/bitnami/redis/certs/redis.crt"
+      REDIS_TLS_KEY_FILE: "/opt/bitnami/redis/certs/redis.key"
+      REDIS_TLS_CA_FILE: "/opt/bitnami/redis/certs/ca.crt"
+      REDIS_TLS_DH_PARAMS_FILE: "/opt/bitnami/redis/certs/redis.dh"
+      REDIS_TLS_AUTH_CLIENTS: "yes"
+    networks:
+      proxies:
+        aliases:
+          - redis-cluster-node-2
+        ipv4_address: 172.10.12.4
+
+  node-3:
+    image: bitnami/redis-cluster:7.2
+    volumes:
+      - "${GITHUB_WORKSPACE}/.github/service/redis-tls/certs:/opt/bitnami/redis/certs"
+    environment:
+      REDIS_PORT_NUMBER: 6379
+      REDIS_PASSWORD: l83aa26
+      REDIS_NODES: node-0 node-1 node-2 node-3 node-4 node-5
+      REDIS_TLS_ENABLED: "true"
+      REDIS_TLS_PORT_NUMBER: 6443
+      REDIS_TLS_CERT_FILE: "/opt/bitnami/redis/certs/redis.crt"
+      REDIS_TLS_KEY_FILE: "/opt/bitnami/redis/certs/redis.key"
+      REDIS_TLS_CA_FILE: "/opt/bitnami/redis/certs/ca.crt"
+      REDIS_TLS_DH_PARAMS_FILE: "/opt/bitnami/redis/certs/redis.dh"
+      REDIS_TLS_AUTH_CLIENTS: "yes"
+    networks:
+      proxies:
+        aliases:
+          - redis-cluster-node-3
+        ipv4_address: 172.10.12.5
+
+  node-4:
+    image: bitnami/redis-cluster:7.2
+    volumes:
+      - "${GITHUB_WORKSPACE}/.github/service/redis-tls/certs:/opt/bitnami/redis/certs"
+    environment:
+      REDIS_PORT_NUMBER: 6379
+      REDIS_PASSWORD: l83aa26
+      REDIS_NODES: node-0 node-1 node-2 node-3 node-4 node-5
+      REDIS_TLS_ENABLED: "true"
+      REDIS_TLS_PORT_NUMBER: 6443
+      REDIS_TLS_CERT_FILE: "/opt/bitnami/redis/certs/redis.crt"
+      REDIS_TLS_KEY_FILE: "/opt/bitnami/redis/certs/redis.key"
+      REDIS_TLS_CA_FILE: "/opt/bitnami/redis/certs/ca.crt"
+      REDIS_TLS_DH_PARAMS_FILE: "/opt/bitnami/redis/certs/redis.dh"
+      REDIS_TLS_AUTH_CLIENTS: "yes"
+    networks:
+      proxies:
+        aliases:
+          - redis-cluster-node-4
+        ipv4_address: 172.10.12.6
+
+  node-5:
+    image: bitnami/redis-cluster:7.2
+    volumes:
+      - "${GITHUB_WORKSPACE}/.github/service/redis-tls/certs:/opt/bitnami/redis/certs"
+    environment:
+      REDIS_PORT_NUMBER: 6379
+      REDIS_PASSWORD: l83aa26
+      REDIS_NODES: node-0 node-1 node-2 node-3 node-4 node-5
+      REDIS_TLS_ENABLED: "true"
+      REDIS_TLS_PORT_NUMBER: 6443
+      REDIS_TLS_CERT_FILE: "/opt/bitnami/redis/certs/redis.crt"
+      REDIS_TLS_KEY_FILE: "/opt/bitnami/redis/certs/redis.key"
+      REDIS_TLS_CA_FILE: "/opt/bitnami/redis/certs/ca.crt"
+      REDIS_TLS_DH_PARAMS_FILE: "/opt/bitnami/redis/certs/redis.dh"
+      REDIS_TLS_AUTH_CLIENTS: "yes"
+    networks:
+      proxies:
+        aliases:
+          - redis-cluster-node-5
+        ipv4_address: 172.10.12.7
+
+networks:
+  proxies:
+    name: "imi-ci-service-network"
+    external: true

.github/service/redis-tls/certs/ca.crt

@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFSzCCAzOgAwIBAgIUJ9PoXzht9SGd1PP9unf2JK8Lp1gwDQYJKoZIhvcNAQEL
+BQAwNTETMBEGA1UECgwKUmVkaXMgVGVzdDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUg
+QXV0aG9yaXR5MB4XDTI0MDMwODA4MTc0MloXDTM0MDMwNjA4MTc0MlowNTETMBEG
+A1UECgwKUmVkaXMgVGVzdDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4a8sm6bsz1yz86wF8gDZ
+C4pjXH5xwMZbV4/iXgtPRbPxhUM+9wk4wXJyflxtBmeVIa1tC56GLqjg/b5Td57Q
+OeKtGZVCXkefTKPND87hIUafXHol8ss69FzJ/Y3K1sVeJXZyvDumuuOq4mFei4HJ
+M8+e+Cy4PxRZVm/FlG7JqNKIYLpkx1HbwFChhtyH0kRPCKqm0OS2Ez0Ok6awoFM4
+LkiGDiDQUl71INn4zfwNF246V/CXUdOYRtjcZETkB4etAffg4NBFdxuklK4e1Yvu
+OJTz4wotXWA3BWyEP4BazFxJDIPYhzeGR+s5/1Pv22t/rt8qjiW6OH3YKACQLddx
+uBDKIxivbdwK322fLpESKoW6unGXH2G92AgjZcAzHT+u9y2A/RTUmJQ9Tvadp7r8
+hKZ6cLUYa722iT2Pwy/9InyR7gJKobtbTHeLgzaHv+yYEy+57DieVwmg9ae47Pi2
+Uv6FkuAP0WcsfCzNgUJ2+XtUBVo3XfgMMPKy9z17Ub+38pZJVN5hG/Jnj/7BCECe
+/i9kleVsBp5CO6728jwDdX85zsgy7cPjbfjE0LaN9a/kq0mVB5+Aa4mHua5eTmgB
+EZukUEHx6wPazuFVYAz0z4SSvIX0IWRvJK9E2mSr0akMzkXpFTMnNr5XLzympvKq
+Dow5aZlrSTrqeM/SKOiEYrsCAwEAAaNTMFEwHQYDVR0OBBYEFNelk3Skwpg/I+Yr
+B+rMwWPlkSlRMB8GA1UdIwQYMBaAFNelk3Skwpg/I+YrB+rMwWPlkSlRMA8GA1Ud
+EwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBAE1Vho2acHEZN8v+UMMSZRoO
+JAJI9RytvEoSoO7F3sl6nHsDfCgplyO5pLfhRUuU1UC0O6Vi1azwy3Hy93s9+6GP
+oXe1yoseZ0rr80JMQZQMAvhymTt5uOfN7T1wd8fZFsaZmXz8WEeMduYYToZKa3pl
+5i2rr2+w/A63J2wgDBvC+T9gtXkufgCDIvZ41vews2TrqPO2fy3RG5iZ0aKkTUb5
+MDxIPYgwchK7BTjY7TEidk+VKC7Gk48EuX6CCeFqftJW6I4hBb0RA3soJ2tvbGeY
+ENlP+udM1lwJEO/x+n9NiNgmGJmYDvfJ0dRDLk8ugcSF0uNsKI9VtU5tn674lLHH
+YpxCyvC4iPgrXW02z8SP7Jvcy/rUtg836CXx6shRr5b7WWtDdRUjr8S6FoLermzF
+JgqC4LpSGwAawGKsquq2c/sbrw3p2F5OBwD4Zhub5LNYgHe5fbJUE+2GJalhwrF5
+RPOCFi7EXn8YpD3AIkojy4YGRZEPdjpre9Km87+9MTpxpr5v1YH11HvTCbmPlud+
+cXPSGEhnSV4kv8lwTnZqNJcZrk1XOkBy3mz3sOTWxs3Lx5GDR0L1ZRncR2rSAjEN
+suL90zQzyMDny3HUA43M/yb46qySsp9uduGnQn9Hdq/eXUZ09yuReJq690/Ux0dd
+7tP7mhYKvuJwxuokBDBc
+-----END CERTIFICATE-----