使用Rsync和Nginx创建Rocky Linux 8.3 RC1本地存储库镜像

# 初始化磁盘
[root@localhost ~]# mkfs.xfs /dev/sdb

# 创建本地仓库目录
[root@localhost ~]#mkdir -p /data

# 挂载磁盘
[root@localhost ~]#mount /dev/sdb /data

# 创建rocky源目录
[root@localhost ~]# mkdir -p /data/repos/rocky

# 查看磁盘UUID
[root@localhost ~]# blkid | grep sdb
/dev/sdb: UUID="19eab4e2-0cab-498c-95e8-60cd54d64625" BLOCK_SIZE="512" TYPE="xfs"

# 设置开机自动挂载磁盘/dev/sdb
[root@localhost ~]# echo "UUID=19eab4e2-0cab-498c-95e8-60cd54d64625  /data                   xfs     defaults        0 0" >> /etc/fstab

# 确保配置是正常的
[root@localhost ~]# cat /etc/fstab

/dev/mapper/rl-root     /                       xfs     defaults        0 0
UUID=5e85ff20-6774-4dd3-8239-2de3eae0eb20 /boot                   xfs     defaults        0 0
/dev/mapper/rl-swap     none                    swap    defaults        0 0
UUID=19eab4e2-0cab-498c-95e8-60cd54d64625  /data                   xfs     defaults        0 0

# 安装同步软件
dnf install -y rsync

# 创建同步脚本
# 这是简单说一下rsync各参数的意思
# --delete: 将源中不存在的文件进行删除
# -a: 归档(压缩)模式,表示以递归方式传输文件,并保持所有文件属性等同于
# -v: 输出详细同步信息
# -q: 安静模式，禁止显示非错误消息
# -z: 在传输过程中进行压缩
# -S: 对稀疏文件进行特殊处理以节省空间（如虚拟机文件）
# -P: 在传输过程中显示进度
# -H: 保留硬链接，如果您愿意的话，木子建议使用-l选项同来保存软链接（符号链接）
# --delay-updates: 将所有更新的文件放在整个下载的末尾。也就是说，它不会在每次下载新文件时都进行更新，但是相反，如果有100个新文件，则在完成100个新文件后，将它们重新同步到位。
[root@localhost ~]# cat > /etc/rocky8_repo_sync1.sh << EOF
#!/bin/bash
repos_base_dir="/data/repos/rocky/"

if [[ -d "\$repos_base_dir" ]] ; then
  rsync -avzqlH --delete --delay-updates rsync://mirrors.vinters.com/rocky  "\$repos_base_dir"
fi
EOF

# 设置每天晚上0点30同步
[root@localhost ~]# crontab -e
30 0 * * * /etc/rocky8_repo_sync.sh

# 初始化同步
[root@localhost ~]# /etc/rocky8_repo_sync.sh

# 确保对应目录开始同步文件
[root@localhost ~]# ll
总用量 8
lrwxrwxrwx.  1 root root    3 4月  30 17:11 8 -> 8.3
drwxr-xr-x. 11 root root  160 5月   4 09:46 8.3
-rw-r--r--.  1 root root 1672 5月   3 17:11 RPM-GPG-KEY-rockyofficial
-rw-r--r--.  1 root root 1672 5月   3 17:11 RPM-GPG-KEY-rockytesting

# 安装nginx
dnf install -y nginx

# Nginx配置
[root@localhost ~]# cat > /etc/nginx/conf.d/rockylinux.conf << EOF
server {
        listen 80;
        server_name mirror.rockylinux.cn;
        root /data/repos/rocky/;

       location / {
                autoindex on;
        }
}
server {
        listen 443 ssl http2;
        server_name mirror.rockylinux.cn;
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:50m;
        ssl_session_tickets on;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
        ssl_prefer_server_ciphers on;
        ssl_dhparam /etc/nginx/cert/dhparam.pem;
        ssl_certificate /etc/nginx/cert/mirror.rockylinux.cn.pem;
        ssl_certificate_key /etc/nginx/cert/mirror.rockylinux.cn.key;
        add_header Strict-Transport-Security "max-age=15768000;includeSubDomains; preload;";
        add_header Referrer-Policy "no-referrer";
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Robots-Tag none;
        add_header X-Download-Options noopen;
        add_header X-Permitted-Cross-Domain-Policies none;
        root /data/repos/rocky/;

       location / {
                autoindex on;
        }
}
EOF

# 测试Nginx配置是否正确
[root@localhost ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

# 启动Nginx
[root@localhost ~]# systemctl start nginx

# 设置开机自启动
[root@localhost ~]# systemctl enable nginx

# 设置防火墙允许http&https
[root@localhost ~]# firewall-cmd --zone=public --permanent --add-service=http
[root@localhost ~]# firewall-cmd --zone=public --permanent --add-service=https
# 重载防火墙配置
[root@localhost ~]# firewall-cmd --reload

# 设置SELinux
[root@localhost ~]# semanage fcontext -a -t httpd_sys_content_t "/data/repos/rocky(/.*)?"
[root@localhost ~]# restorecon -Rv /data/repos/rocky
# 或直接禁用SELinux
[root@localhost ~]# sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
[root@localhost ~]# setenforce 0