文件服务器怎么搭建和选购

所需裸容量 = 年新增数据量 × 留存年限 × 1.3(冗余与快照)
可用容量   = 裸容量 × RAID 利用率
  RAID 1  : 50%
  RAID 5  : (N-1)/N（N 为盘数，建议不超过 8 盘）
  RAID 6  : (N-2)/N
  RAID 10 : 50%
所需上行带宽(Mbps) = 日均下载量(GB) × 1024 × 8 / (高峰小时数 × 3600) × 1.5

# 规划阶段：摸清现有数据的真实占用与增长速度
du -sh /data/* | sort -hr | head -20          # 找出占用最大的目录
df -hT /data                                   # 剩余空间与文件系统类型
df -i /data                                    # inode 使用率，小文件场景必看

# 统计近 30 天新增量，推算年增长
find /data -type f -mtime -30 -printf '%s\n' | awk '{s+=$1} END {printf "近30天新增: %.2f GB\n", s/1024/1024/1024}'

# Ubuntu 24.04 安装 Samba
sudo apt update && sudo apt install -y samba samba-common-bin

# 创建共享目录与用户组
sudo mkdir -p /data/share /data/recycle
sudo groupadd smbusers
sudo useradd -M -s /sbin/nologin -G smbusers alice
sudo smbpasswd -a alice          # 设置 Samba 独立密码
sudo chgrp smbusers /data/share && sudo chmod 2775 /data/share

# /etc/samba/smb.conf
[global]
   workgroup = WORKGROUP
   server string = File Server
   security = user
   map to guest = Bad User
   # 禁用已不安全的 SMB1，只允许 SMB2 及以上
   server min protocol = SMB2
   client min protocol = SMB2
   log file = /var/log/samba/log.%m
   max log size = 1000

[share]
   path = /data/share
   browseable = yes
   writable = yes
   valid users = @smbusers
   create mask = 0664
   directory mask = 2775
   # 开启回收站，防误删（vfs_recycle 需要额外配置）
   vfs objects = recycle
   recycle:repository = /data/recycle/%U
   recycle:keeptree = yes
   recycle:versions = yes

# /etc/samba/smb.conf —— 按部门拆分共享段的写法
[design]
   path = /data/share/design
   browseable = yes
   writable = yes
   valid users = @design @manager
   write list = @design
   read list = @dev
   create mask = 0664
   directory mask = 2775
   force group = design
   vfs objects = recycle full_audit
   recycle:repository = /data/recycle/%U
   recycle:keeptree = yes
   # 审计：把打开、改名、删除等动作写进 syslog local5
   full_audit:prefix = %u|%I|%m|%S
   full_audit:success = open close rename unlink rmdir mkdir
   full_audit:failure = none
   full_audit:facility = local5
   full_audit:priority = NOTICE

[finance]
   path = /data/share/finance
   browseable = no          # 不在网上邻居里列出，需手动输入路径访问
   writable = yes
   valid users = @finance
   create mask = 0660
   directory mask = 2770

# 校验配置语法并生效
testparm
sudo systemctl enable --now smbd nmbd

# 防火墙只放通内网网段（切勿对公网开放 445！）
sudo ufw allow from 192.168.1.0/24 to any port 445 proto tcp
sudo ufw allow from 192.168.1.0/24 to any port 139 proto tcp

# 本地验证共享是否可见
smbclient -L localhost -U alice

# 服务端安装
sudo apt install -y nfs-kernel-server
sudo mkdir -p /data/nfs && sudo chown nobody:nogroup /data/nfs

# /etc/exports：只允许内网段，sync 保证数据安全落盘
echo '/data/nfs 192.168.1.0/24(rw,sync,no_subtree_check,no_root_squash)' | sudo tee -a /etc/exports
sudo exportfs -rav
sudo systemctl enable --now nfs-server
showmount -e localhost

sudo apt install -y nfs-common
sudo mkdir -p /mnt/nfs
# 推荐用 NFSv4，并加 soft/timeo 避免服务端宕机时客户端卡死
sudo mount -t nfs -o vers=4,soft,timeo=100,retrans=3 192.168.1.10:/data/nfs /mnt/nfs

# 写入 /etc/fstab 实现开机自动挂载
echo '192.168.1.10:/data/nfs /mnt/nfs nfs vers=4,soft,timeo=100,retrans=3,_netdev 0 0' | sudo tee -a /etc/fstab

# docker-compose.yml —— Nextcloud + MariaDB + Redis
version: "3.8"
services:
  db:
    image: mariadb:11.4
    restart: always
    command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
    volumes:
      - ./db:/var/lib/mysql
    environment:
      MYSQL_ROOT_PASSWORD: <改成强密码>
      MYSQL_PASSWORD: <改成强密码>
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud

  redis:
    image: redis:7-alpine
    restart: always

  app:
    image: nextcloud:30-apache
    restart: always
    ports:
      - "8080:80"
    depends_on:
      - db
      - redis
    volumes:
      - ./nextcloud:/var/www/html
      - ./data:/var/www/html/data
    environment:
      MYSQL_HOST: db
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: <改成强密码>
      REDIS_HOST: redis

# 二进制方式部署 MinIO（Linux x86_64）
wget https://dl.min.io/server/minio/release/linux-amd64/minio
chmod +x minio && sudo mv minio /usr/local/bin/

# 准备数据目录（生产建议用独立的数据盘，且不要与系统盘共用）
sudo mkdir -p /data/minio

# 启动，控制台端口 9001，API 端口 9000
MINIO_ROOT_USER=admin MINIO_ROOT_PASSWORD='<改成强密码>' \
  minio server /data/minio --console-address ":9001"

# 安装 mc 并配置别名
wget https://dl.min.io/client/mc/release/linux-amd64/mc && chmod +x mc && sudo mv mc /usr/local/bin/
mc alias set local http://127.0.0.1:9000 admin '<密码>'
mc alias set remote https://s3..amazonaws.com  

# 创建桶、设置匿名只读（用于图片外链）
mc mb local/images
mc anonymous set download local/images

# 镜像同步到远端（备份/容灾）
mc mirror --watch local/images remote/backup-bucket

# 建组与目录骨架
sudo groupadd finance && sudo groupadd design && sudo groupadd dev
sudo mkdir -p /data/share/{public,finance,design,dev,archive}
sudo chgrp finance /data/share/finance && sudo chmod 2770 /data/share/finance

# design 目录：设计组读写、研发组只读、其他人无权限（POSIX 表达不了，改用 ACL）
sudo chgrp design /data/share/design && sudo chmod 2770 /data/share/design
sudo setfacl -m g:design:rwx -m g:dev:rx -m o:--- /data/share/design
# default 条目让新建文件自动继承，缺少它新文件仍按 umask 生成
sudo setfacl -d -m g:design:rwx -m g:dev:rx /data/share/design

# 人员进出只改组成员
sudo gpasswd -a alice design
sudo gpasswd -d bob design

# 查看与校验（ACL 必须用 getfacl 才能看全）
getfacl -p /data/share/design

# 用 auditd 监控关键目录的删除与权限变更
sudo apt install -y auditd audispd-plugins
sudo auditctl -w /data/share -p wa -k fileserver_watch
sudo ausearch -k fileserver_watch -i | tail -20

# 1) 本地快照：使用 btrfs/lvm 快照或 rsnapshot 做小时级回滚点
sudo apt install -y rsnapshot
# /etc/rsnapshot.conf 中保留 hourly.0~5、daily.0~6、weekly.0~3

# 2) 异地同步：rsync over ssh，保留硬链接做增量
rsync -aHAX --delete --numeric-ids \
  -e "ssh -p 22" /data/share/ backup@<异地IP>:/backup/share/

# 3) 上云归档：rclone 同步到对象存储
rclone sync /data/share remote:backup-bucket/share \
  --transfers 16 --checkers 32 --log-file=/var/log/rclone.log

# 定时任务：每日 02:00 增量同步，每周日凌晨全量校验
crontab -l | { cat; echo '0 2 * * * /usr/bin/rsync -aHAX --delete /data/share/ backup@<异地IP>:/backup/share/ >> /var/log/rsync.log 2>&1'; } | crontab -