优化：支付功能（10550）
This commit is contained in:
43
Dockerfile
Normal file
43
Dockerfile
Normal file
@@ -0,0 +1,43 @@
|
||||
# 使用OpenJDK 8作为基础镜像
|
||||
FROM openjdk:8-jre-alpine
|
||||
|
||||
# 设置工作目录
|
||||
WORKDIR /app
|
||||
|
||||
# 创建证书目录
|
||||
RUN mkdir -p /app/certs
|
||||
|
||||
# 创建日志目录
|
||||
RUN mkdir -p /app/logs
|
||||
|
||||
# 创建上传文件目录
|
||||
RUN mkdir -p /app/uploads
|
||||
|
||||
# 添加应用用户（安全考虑）
|
||||
RUN addgroup -g 1000 appgroup && \
|
||||
adduser -D -s /bin/sh -u 1000 -G appgroup appuser
|
||||
|
||||
# 复制jar包到容器
|
||||
COPY target/*.jar app.jar
|
||||
|
||||
# 设置目录权限
|
||||
RUN chown -R appuser:appgroup /app
|
||||
|
||||
# 切换到应用用户
|
||||
USER appuser
|
||||
|
||||
# 暴露端口
|
||||
EXPOSE 9200
|
||||
|
||||
# 设置JVM参数
|
||||
ENV JAVA_OPTS="-Xms512m -Xmx1024m -Djava.security.egd=file:/dev/./urandom"
|
||||
|
||||
# 设置Spring Profile
|
||||
ENV SPRING_PROFILES_ACTIVE=prod
|
||||
|
||||
# 健康检查
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
|
||||
CMD wget --no-verbose --tries=1 --spider http://localhost:9200/actuator/health || exit 1
|
||||
|
||||
# 启动应用
|
||||
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -jar app.jar"]
|
||||
68
certs/README.md
Normal file
68
certs/README.md
Normal file
@@ -0,0 +1,68 @@
|
||||
# 证书目录说明
|
||||
|
||||
这个目录用于存放支付相关的证书文件，支持Docker容器化部署。
|
||||
|
||||
## 目录结构
|
||||
|
||||
```
|
||||
certs/
|
||||
├── README.md # 本说明文件
|
||||
├── wechat/ # 微信支付证书目录
|
||||
│ ├── apiclient_key.pem # 商户私钥证书
|
||||
│ ├── apiclient_cert.pem # 商户证书
|
||||
│ └── wechatpay_cert.pem # 微信支付平台证书
|
||||
└── alipay/ # 支付宝证书目录
|
||||
├── app_private_key.pem # 应用私钥
|
||||
├── appCertPublicKey.crt # 应用公钥证书
|
||||
├── alipayCertPublicKey.crt # 支付宝公钥证书
|
||||
└── alipayRootCert.crt # 支付宝根证书
|
||||
```
|
||||
|
||||
## 使用说明
|
||||
|
||||
### 1. 开发环境
|
||||
- 将证书文件放在 `src/main/resources/certs/dev/` 目录下
|
||||
- 应用会从classpath加载证书
|
||||
|
||||
### 2. 生产环境
|
||||
- 将证书文件放在此目录下
|
||||
- Docker容器会将此目录挂载到 `/app/certs`
|
||||
- 应用会从挂载卷加载证书
|
||||
|
||||
### 3. 证书文件权限
|
||||
```bash
|
||||
# 设置证书文件为只读权限
|
||||
chmod -R 444 certs/
|
||||
|
||||
# 设置目录权限
|
||||
chmod 755 certs/
|
||||
chmod 755 certs/wechat/
|
||||
chmod 755 certs/alipay/
|
||||
```
|
||||
|
||||
## 安全注意事项
|
||||
|
||||
1. **不要将证书文件提交到版本控制系统**
|
||||
2. **确保证书文件权限设置正确**
|
||||
3. **定期更新证书文件**
|
||||
4. **备份重要的证书文件**
|
||||
|
||||
## 证书获取方式
|
||||
|
||||
### 微信支付证书
|
||||
1. 登录微信商户平台
|
||||
2. 进入"账户中心" -> "API安全"
|
||||
3. 下载商户证书和平台证书
|
||||
|
||||
### 支付宝证书
|
||||
1. 登录支付宝开放平台
|
||||
2. 进入应用详情页
|
||||
3. 在"开发设置"中下载相关证书
|
||||
|
||||
## 故障排除
|
||||
|
||||
如果遇到证书加载问题，请检查：
|
||||
1. 证书文件是否存在
|
||||
2. 证书文件路径是否正确
|
||||
3. 证书文件权限是否正确
|
||||
4. 证书文件是否已过期
|
||||
93
docker-compose.yml
Normal file
93
docker-compose.yml
Normal file
@@ -0,0 +1,93 @@
|
||||
version: '3.8'
|
||||
|
||||
services:
|
||||
# 应用服务
|
||||
cms-app:
|
||||
build: .
|
||||
container_name: cms-java-app
|
||||
ports:
|
||||
- "9200:9200"
|
||||
environment:
|
||||
- SPRING_PROFILES_ACTIVE=prod
|
||||
- JAVA_OPTS=-Xms512m -Xmx1024m
|
||||
volumes:
|
||||
# 证书挂载卷 - 将宿主机证书目录挂载到容器
|
||||
- ./certs:/app/certs:ro
|
||||
# 日志挂载卷
|
||||
- ./logs:/app/logs
|
||||
# 上传文件挂载卷
|
||||
- ./uploads:/app/uploads
|
||||
networks:
|
||||
- cms-network
|
||||
depends_on:
|
||||
- mysql
|
||||
- redis
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:9200/actuator/health"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 60s
|
||||
|
||||
# MySQL数据库
|
||||
mysql:
|
||||
image: mysql:8.0
|
||||
container_name: cms-mysql
|
||||
environment:
|
||||
MYSQL_ROOT_PASSWORD: root123456
|
||||
MYSQL_DATABASE: modules
|
||||
MYSQL_USER: modules
|
||||
MYSQL_PASSWORD: 8YdLnk7KsPAyDXGA
|
||||
ports:
|
||||
- "3308:3306"
|
||||
volumes:
|
||||
- mysql_data:/var/lib/mysql
|
||||
- ./mysql/conf:/etc/mysql/conf.d
|
||||
- ./mysql/init:/docker-entrypoint-initdb.d
|
||||
networks:
|
||||
- cms-network
|
||||
restart: unless-stopped
|
||||
command: --default-authentication-plugin=mysql_native_password
|
||||
|
||||
# Redis缓存
|
||||
redis:
|
||||
image: redis:6.2-alpine
|
||||
container_name: cms-redis
|
||||
ports:
|
||||
- "16379:6379"
|
||||
volumes:
|
||||
- redis_data:/data
|
||||
- ./redis/redis.conf:/usr/local/etc/redis/redis.conf
|
||||
networks:
|
||||
- cms-network
|
||||
restart: unless-stopped
|
||||
command: redis-server /usr/local/etc/redis/redis.conf
|
||||
|
||||
# Nginx反向代理（可选）
|
||||
nginx:
|
||||
image: nginx:alpine
|
||||
container_name: cms-nginx
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
volumes:
|
||||
- ./nginx/nginx.conf:/etc/nginx/nginx.conf
|
||||
- ./nginx/conf.d:/etc/nginx/conf.d
|
||||
- ./nginx/ssl:/etc/nginx/ssl
|
||||
- ./uploads:/var/www/uploads
|
||||
networks:
|
||||
- cms-network
|
||||
depends_on:
|
||||
- cms-app
|
||||
restart: unless-stopped
|
||||
|
||||
networks:
|
||||
cms-network:
|
||||
driver: bridge
|
||||
|
||||
volumes:
|
||||
mysql_data:
|
||||
driver: local
|
||||
redis_data:
|
||||
driver: local
|
||||
188
docker-deploy-guide.md
Normal file
188
docker-deploy-guide.md
Normal file
@@ -0,0 +1,188 @@
|
||||
# Docker容器化部署指南
|
||||
|
||||
## 支付证书问题解决方案
|
||||
|
||||
本项目已经解决了Docker容器中支付证书路径失效的问题，支持多种证书加载方式。
|
||||
|
||||
## 目录结构
|
||||
|
||||
```
|
||||
project-root/
|
||||
├── Dockerfile
|
||||
├── docker-compose.yml
|
||||
├── certs/ # 证书目录（需要手动创建）
|
||||
│ ├── wechat/ # 微信支付证书
|
||||
│ │ ├── apiclient_key.pem
|
||||
│ │ ├── apiclient_cert.pem
|
||||
│ │ └── wechatpay_cert.pem
|
||||
│ └── alipay/ # 支付宝证书
|
||||
│ ├── app_private_key.pem
|
||||
│ ├── appCertPublicKey.crt
|
||||
│ ├── alipayCertPublicKey.crt
|
||||
│ └── alipayRootCert.crt
|
||||
├── logs/ # 日志目录
|
||||
├── uploads/ # 上传文件目录
|
||||
└── src/
|
||||
```
|
||||
|
||||
## 部署步骤
|
||||
|
||||
### 1. 准备证书文件
|
||||
|
||||
创建证书目录并放置证书文件：
|
||||
|
||||
```bash
|
||||
# 创建证书目录
|
||||
mkdir -p certs/wechat
|
||||
mkdir -p certs/alipay
|
||||
|
||||
# 复制微信支付证书到对应目录
|
||||
cp /path/to/your/apiclient_key.pem certs/wechat/
|
||||
cp /path/to/your/apiclient_cert.pem certs/wechat/
|
||||
cp /path/to/your/wechatpay_cert.pem certs/wechat/
|
||||
|
||||
# 复制支付宝证书到对应目录
|
||||
cp /path/to/your/app_private_key.pem certs/alipay/
|
||||
cp /path/to/your/appCertPublicKey.crt certs/alipay/
|
||||
cp /path/to/your/alipayCertPublicKey.crt certs/alipay/
|
||||
cp /path/to/your/alipayRootCert.crt certs/alipay/
|
||||
|
||||
# 设置证书文件权限（只读）
|
||||
chmod -R 444 certs/
|
||||
```
|
||||
|
||||
### 2. 配置环境变量
|
||||
|
||||
创建 `.env` 文件（可选）：
|
||||
|
||||
```bash
|
||||
# 应用配置
|
||||
SPRING_PROFILES_ACTIVE=prod
|
||||
JAVA_OPTS=-Xms512m -Xmx1024m
|
||||
|
||||
# 数据库配置
|
||||
MYSQL_ROOT_PASSWORD=root123456
|
||||
MYSQL_DATABASE=modules
|
||||
MYSQL_USER=modules
|
||||
MYSQL_PASSWORD=8YdLnk7KsPAyDXGA
|
||||
|
||||
# Redis配置
|
||||
REDIS_PASSWORD=redis_WSDb88
|
||||
```
|
||||
|
||||
### 3. 构建和启动
|
||||
|
||||
```bash
|
||||
# 构建应用
|
||||
mvn clean package -DskipTests
|
||||
|
||||
# 启动所有服务
|
||||
docker-compose up -d
|
||||
|
||||
# 查看服务状态
|
||||
docker-compose ps
|
||||
|
||||
# 查看应用日志
|
||||
docker-compose logs -f cms-app
|
||||
```
|
||||
|
||||
### 4. 验证部署
|
||||
|
||||
```bash
|
||||
# 检查应用健康状态
|
||||
curl http://localhost:9200/actuator/health
|
||||
|
||||
# 检查证书是否正确加载
|
||||
docker exec cms-java-app ls -la /app/certs/
|
||||
```
|
||||
|
||||
## 证书加载模式
|
||||
|
||||
### 开发环境 (CLASSPATH)
|
||||
- 证书文件放在 `src/main/resources/certs/` 目录下
|
||||
- 打包时会包含在jar包中
|
||||
- 适合开发和测试环境
|
||||
|
||||
### 生产环境 (VOLUME)
|
||||
- 证书文件通过Docker挂载卷加载
|
||||
- 证书文件在宿主机上，挂载到容器的 `/app/certs` 目录
|
||||
- 支持证书文件的动态更新（重启容器后生效）
|
||||
|
||||
### 文件系统模式 (FILESYSTEM)
|
||||
- 直接从文件系统路径加载证书
|
||||
- 适合传统部署方式
|
||||
|
||||
## 配置说明
|
||||
|
||||
### application.yml 配置
|
||||
|
||||
```yaml
|
||||
certificate:
|
||||
load-mode: VOLUME # 证书加载模式
|
||||
cert-root-path: /app/certs # 证书根目录
|
||||
|
||||
wechat-pay:
|
||||
dev:
|
||||
api-v3-key: "your-api-v3-key"
|
||||
private-key-file: "apiclient_key.pem"
|
||||
apiclient-cert-file: "apiclient_cert.pem"
|
||||
wechatpay-cert-file: "wechatpay_cert.pem"
|
||||
```
|
||||
|
||||
### 环境特定配置
|
||||
|
||||
- **开发环境**: `application-dev.yml` - 使用CLASSPATH模式
|
||||
- **生产环境**: `application-prod.yml` - 使用VOLUME模式
|
||||
|
||||
## 故障排除
|
||||
|
||||
### 1. 证书文件找不到
|
||||
|
||||
```bash
|
||||
# 检查证书文件是否存在
|
||||
docker exec cms-java-app ls -la /app/certs/
|
||||
|
||||
# 检查文件权限
|
||||
docker exec cms-java-app ls -la /app/certs/wechat/
|
||||
```
|
||||
|
||||
### 2. 支付接口调用失败
|
||||
|
||||
```bash
|
||||
# 查看应用日志
|
||||
docker-compose logs cms-app | grep -i cert
|
||||
|
||||
# 检查证书配置
|
||||
docker exec cms-java-app cat /app/application.yml | grep -A 10 certificate
|
||||
```
|
||||
|
||||
### 3. 容器启动失败
|
||||
|
||||
```bash
|
||||
# 查看详细错误信息
|
||||
docker-compose logs cms-app
|
||||
|
||||
# 检查容器状态
|
||||
docker-compose ps
|
||||
```
|
||||
|
||||
## 安全建议
|
||||
|
||||
1. **证书文件权限**: 设置为只读权限 (444)
|
||||
2. **证书目录权限**: 限制访问权限
|
||||
3. **敏感信息**: 使用环境变量或Docker secrets管理敏感配置
|
||||
4. **网络安全**: 使用内部网络，限制端口暴露
|
||||
|
||||
## 更新证书
|
||||
|
||||
1. 停止应用容器：`docker-compose stop cms-app`
|
||||
2. 更新证书文件到 `certs/` 目录
|
||||
3. 重启应用容器：`docker-compose start cms-app`
|
||||
|
||||
## 监控和日志
|
||||
|
||||
- 应用日志：`./logs/` 目录
|
||||
- 容器日志：`docker-compose logs`
|
||||
- 健康检查：访问 `/actuator/health` 端点
|
||||
|
||||
通过以上配置，你的应用在Docker容器中就能正确加载支付证书了！
|
||||
@@ -322,7 +322,9 @@
|
||||
<if test="param.selfTakeMerchantName != null">
|
||||
self_take_merchant_name = #{param.selfTakeMerchantName},
|
||||
</if>
|
||||
|
||||
<if test="param.addressId != null">
|
||||
address_id = #{param.addressId},
|
||||
</if>
|
||||
<if test="param.address != null">
|
||||
address = #{param.address},
|
||||
</if>
|
||||
|
||||
Reference in New Issue
Block a user