混合云服务器架构方案

# 云下 IDC 侧网关，安装 strongSwan（Ubuntu 24.04 LTS）
sudo apt update && sudo apt install -y strongswan swanctl

# swanctl 配置：left=本地 IDC，right=云上 VPN 网关
sudo tee /etc/swanctl/conf.d/idc-to-cloud.conf >/dev/null <<'EOF'
connections {
  idc-to-cloud {
    version = 2
    local_addrs  = 203.0.113.10        # 本地 IDC 出口公网 IP
    remote_addrs = 198.51.100.20       # 云上 VPN 网关公网 IP
    proposals = aes256-sha256-modp2048
    local  { auth = psk; id = 203.0.113.10 }
    remote { auth = psk; id = 198.51.100.20 }
    children {
      net-net {
        local_ts  = 10.10.0.0/16       # 本地内网网段
        remote_ts = 172.16.0.0/16      # 云上 VPC 网段
        esp_proposals = aes256-sha256-modp2048
        start_action = start
        dpd_action = restart
      }
    }
  }
}
secrets {
  ike-idc-cloud {
    id-1 = 198.51.100.20
    secret = "请替换为高强度预共享密钥"
  }
}
EOF

# 放行 UDP 500（IKE）与 4500（NAT-T），以及 ESP（IP 协议号 50）
sudo ufw allow 500,4500/udp
sudo ufw reload

# 开启内核转发并加载配置
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-ipsec-forward.conf
sudo sysctl --system
sudo swanctl --load-all
sudo swanctl --list-sas

# 让 TCP 协商的 MSS 适配路径 MTU（二选一，推荐第一条）
sudo iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
# PMTU 探测失效时（常见于禁 ICMP 的网络），直接写死一个安全值
sudo iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1360

# 持久化规则，重启后仍然生效
sudo apt install -y iptables-persistent
sudo netfilter-persistent save

# 检查本地网段与云上 VPC/K8s 网段是否重叠（依赖系统自带 python3）
python3 - <<'PY'
import ipaddress, itertools

onprem = ["10.10.0.0/16", "192.168.1.0/24", "172.17.0.0/16"]  # 现有 IDC / Docker
cloud  = ["172.16.0.0/16", "10.244.0.0/16", "10.96.0.0/12"]  # 云上 VPC / K8s Pod & Service

nets = [(n, ipaddress.ip_network(n)) for n in onprem + cloud]
conflict = False
for (na, a), (nb, b) in itertools.combinations(nets, 2):
    if a.overlaps(b):
        conflict = True
        print(f"[冲突] {na} <-> {nb}，重叠掩码不短于 /{max(a.prefixlen, b.prefixlen)}")
if not conflict:
    print("无网段重叠，可以继续实施")
PY

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["ecs:Describe*", "ecs:StartInstance", "ecs:StopInstance"],
      "Resource": "*",
      "Condition": {
        "StringEquals": { "acs:ResourceTag/Env": "hybrid-prod" }
      }
    },
    {
      "Effect": "Deny",
      "Action": ["ecs:DeleteInstance", "oss:DeleteBucket"],
      "Resource": "*"
    }
  ]
}

# 1) 云下主库开启 binlog 与 GTID
sudo tee -a /etc/mysql/mysql.conf.d/mysqld.cnf >/dev/null <<'EOF'
server-id        = 1001
log_bin          = /var/lib/mysql/mysql-bin
binlog_format    = ROW
gtid_mode        = ON
enforce_gtid_consistency = ON
EOF
sudo systemctl restart mysql

# 2) 主库创建复制账号（生产环境请限制来源 IP）
mysql -uroot -p -e "CREATE USER 'repl'@'%' IDENTIFIED BY '改成强密码'; \
  GRANT REPLICATION SLAVE ON *.* TO 'repl'@'%'; FLUSH PRIVILEGES;"

# 3) 云上从库建立复制并确认状态
mysql -uroot -p -e "CHANGE REPLICATION SOURCE TO SOURCE_HOST='10.10.0.10', \
  SOURCE_USER='repl', SOURCE_PASSWORD='改成强密码', SOURCE_AUTO_POSITION=1; START REPLICA;"
mysql -uroot -p -e "SHOW REPLICA STATUS\G" | grep -E 'Replica_IO_Running|Seconds_Behind|Last_Error'

terraform {
  required_providers {
    alicloud = { source = "aliyun/alicloud", version = "~> 1.220" }
    libvirt  = { source = "dmacvicar/libvirt", version = "~> 0.8" }
  }
}

variable "pod_cidr" { default = "10.244.0.0/16" }

resource "alicloud_vpc" "hybrid" {
  vpc_name   = "hybrid-vpc"
  cidr_block = "172.16.0.0/16"   # 与 IDC 网段 10.10.0.0/16 互不重叠
}

resource "libvirt_domain" "idc_worker" {
  name   = "idc-worker-01"
  vcpu   = 8
  memory = 32768                # 单位 MiB

  disk {
    volume_id = libvirt_volume.base.id
  }

  network_interface {
    network_id = libvirt_network.idc.id
  }
}

# inventory/hosts：云上按地域分组，云下按机房分组
all:
  children:
    cloud_hz:
      hosts:
        ecs-hz-01: { ansible_host: 172.16.1.10, env: prod }
    idc_sh:
      hosts:
        kvm-sh-01: { ansible_host: 10.10.1.10, env: prod }
  vars:
    ntp_servers: ["ntp.aliyun.com"]
    log_collector: "10.10.0.20:5140"


# site.yml：一条命令同时作用于云上云下
- name: 统一基线配置
  hosts: all
  become: true
  tasks:
    - name: 下发统一时间同步配置
      ansible.builtin.template:
        src: chrony.conf.j2
        dest: /etc/chrony/chrony.conf
        mode: "0644"
      notify: restart chrony

    - name: 下发统一日志采集地址
      ansible.builtin.lineinfile:
        path: /etc/rsyslog.d/90-central.conf
        line: "*.* @@{{ log_collector }}"
        create: true

  handlers:
    - name: restart chrony
      ansible.builtin.service:
        name: chrony
        state: restarted