Podman + Nginx + Affine 踩坑教程

安装 Podman

安装 podman 很简单

sudo apt install podman

验证安装

podman info

创建一个 pod 用于安装 Nginx 和 Affine

podman pod create --name mypod -p 80:8080

注意：需要在/etc/sysctl.conf中加入net.ipv4.ip_unprivileged_port_start=80才能创建 80 端口映射

安装 Nginx

创建对应的文件夹

mkdir -p /opt/serves/nginx/app
mkdir -p /opt/serves/nginx/conf
mkdir -p /opt/serves/nginx/logs

创建 bitnami 的 Nginx 容器

podman run -d --pod mypod --name nginx \
-v /opt/serves/nginx/app:/app \
-v /opt/serves/nginx/conf:/opt/bitnami/nginx/conf \
-v /opt/serves/nginx/logs:/opt/bitnami/nginx/logs \
bitnami/nginx:latest

需要注意的点：

• 用--pod mypod将容器加入 pod 中
• 浏览器访问http://IP检查 Nginx 是否正常运行

安装 Affine

创建对应的文件夹

mkdir -p /opt/serves/affine/postgres/pgdata
mkdir -p /opt/serves/affine/storage
mkdir -p /opt/serves/affine/config

通过 podman 命令安装 affine

虽然 Affine 官方提供了 docker-compose.yaml 文件，但是 podman comopse 无法直接将创建的容器加入 pod 中，因此需要用对应的命令逐个创建容器。

这是官方提供的 compose 和 env 文件，我们不使用它们，而是直接把环境变量和参数在命令行中设置好

• docker-compose.yaml

name: affine
services:
  affine:
    image: ghcr.io/toeverything/affine:${AFFINE_REVISION:-stable}
    container_name: affine_server
    # ports:
    #   - '${PORT:-3010}:3010'
    depends_on:
      redis:
        condition: service_healthy
      postgres:
        condition: service_healthy
      affine_migration:
        condition: service_completed_successfully
    volumes:
      # custom configurations
      - ${UPLOAD_LOCATION}:/root/.affine/storage
      - ${CONFIG_LOCATION}:/root/.affine/config
    env_file:
      - .env
    environment:
      - REDIS_SERVER_HOST=redis
      - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${DB_DATABASE:-affine}
      - AFFINE_INDEXER_ENABLED=false
    restart: unless-stopped

  affine_migration:
    image: ghcr.io/toeverything/affine:${AFFINE_REVISION:-stable}
    container_name: affine_migration_job
    volumes:
      # custom configurations
      - ${UPLOAD_LOCATION}:/root/.affine/storage
      - ${CONFIG_LOCATION}:/root/.affine/config
    command: ['sh', '-c', 'node ./scripts/self-host-predeploy.js']
    env_file:
      - .env
    environment:
      - REDIS_SERVER_HOST=redis
      - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${DB_DATABASE:-affine}
      - AFFINE_INDEXER_ENABLED=false
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy

  redis:
    image: redis
    container_name: affine_redis
    healthcheck:
      test: ['CMD', 'redis-cli', '--raw', 'incr', 'ping']
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  postgres:
    image: pgvector/pgvector:pg16
    container_name: affine_postgres
    volumes:
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: ${DB_DATABASE:-affine}
      POSTGRES_INITDB_ARGS: '--data-checksums'
      # you better set a password for you database
      # or you may add 'POSTGRES_HOST_AUTH_METHOD=trust' to ignore postgres security policy
      POSTGRES_HOST_AUTH_METHOD: trust
    healthcheck:
      test:
        ['CMD', 'pg_isready', '-U', "${DB_USERNAME}", '-d', "${DB_DATABASE:-affine}"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

• .env

# select a revision to deploy, available values: stable, beta, canary
AFFINE_REVISION=stable

# set the port for the server container it will expose the server on
PORT=3010

# set the host for the server for outgoing links
# AFFINE_SERVER_HTTPS=true
# AFFINE_SERVER_HOST=affine.yourdomain.com
# or
# AFFINE_SERVER_EXTERNAL_URL=https://affine.yourdomain.com

# position of the database data to persist
DB_DATA_LOCATION=/opt/serves/affine/postgres/pgdata
# position of the upload data(images, files, etc.) to persist
UPLOAD_LOCATION=/opt/serves/affine/storage
# position of the configuration files to persist
CONFIG_LOCATION=/opt/serves/affine/config

# database credentials
DB_USERNAME=affine
DB_PASSWORD=[你的密码]
DB_DATABASE=affine

创建 Redis 容器

通过观察compose文件，可以看出我们需要创建 Redis、Postgres、Affine Migration 和 Affine Server 四个容器，我们从 Redis 开始

Redis 对应的部分是：

  redis:
    image: redis
    container_name: affine_redis
    healthcheck:
      test: ['CMD', 'redis-cli', '--raw', 'incr', 'ping']
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

转换成 podman 命令就是：

podman run -d --pod mypod --name affine_redis \
--restart unless-stopped \
--health-cmd "redis-cli --raw incr ping" \
--health-interval 10s \
--health-timeout 5s \
--health-retries 5 redis

可以看到创建 Redis 容器还是比较简单的，没有什么需要配置的地方

创建 Postgres 容器

不需要等待 Redis 运行，继续创建 Postgres 容器

Postgres 对应的部分是：

  postgres:
    image: pgvector/pgvector:pg16
    container_name: affine_postgres
    volumes:
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: ${DB_DATABASE:-affine}
      POSTGRES_INITDB_ARGS: '--data-checksums'
      # you better set a password for you database
      # or you may add 'POSTGRES_HOST_AUTH_METHOD=trust' to ignore postgres security policy
      POSTGRES_HOST_AUTH_METHOD: trust
    healthcheck:
      test:
        ['CMD', 'pg_isready', '-U', "${DB_USERNAME}", '-d', "${DB_DATABASE:-affine}"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

转换后的 podman 命令明显比 Redis 长了很多：

podman run -d --pod mypod --name affine_postgres \                                                           --restart unless-stopped \
  -v /opt/serves/affine/postgres/pgdata:/var/lib/postgresql/data \
  -e POSTGRES_USER=affine \
  -e POSTGRES_PASSWORD=[你的密码] \
  -e POSTGRES_DB=affine \
  -e POSTGRES_INITDB_ARGS='--data-checksums' \
  -e POSTGRES_HOST_AUTH_METHOD=trust \
  --health-cmd "pg_isready -U affine -d affine" \
  --health-interval 10s --health-timeout 5s --health-retries 5 \
  pgvector/pgvector:pg16

需要注意的地方：

• 把DB_USERNAME、DB_PASSWORD这些环境变量替换为真实的用户名、密码...

创建 Affine Migration 容器

在执行这一步之前需要等待 Redis 和 Postgres 的状态转变为healthy，可以通过podman ps查看这两个容器的状态

Affine Migration 对应的部分是：

  affine_migration:
    image: ghcr.io/toeverything/affine:${AFFINE_REVISION:-stable}
    container_name: affine_migration_job
    volumes:
      # custom configurations
      - ${UPLOAD_LOCATION}:/root/.affine/storage
      - ${CONFIG_LOCATION}:/root/.affine/config
    command: ['sh', '-c', 'node ./scripts/self-host-predeploy.js']
    env_file:
      - .env
    environment:
      - REDIS_SERVER_HOST=redis
      - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${DB_DATABASE:-affine}
      - AFFINE_INDEXER_ENABLED=false
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy

转换后的 podman 命令为：

podman run --rm --pod mypod --name affine_migration_job \
  -v /opt/serves/affine/storage:/root/.affine/storage \
  -v /opt/serves/affine/config:/root/.affine/config \
  -e REDIS_SERVER_HOST=localhost \
  -e DATABASE_URL=postgresql://affine:[密码]@affine_postgres:5432/$affine \
  -e AFFINE_INDEXER_ENABLED=false \
  ghcr.io/toeverything/affine:stable \
  sh -c 'node ./scripts/self-host-predeploy.js'

这其实是一个数据迁移步骤，执行完毕后用podman ps也不会看到相关容器，不必担心，需要注意的是：

• 由于所有容器都在一个 pod 中，REDIS_SERVER_HOST直接设置为localhost即可
• 如果出现User was denied access on the database错误，进入 postgres 容器创建对应数据库

# 1. 进入容器
podman exec -it affine_postgres psql -U postgres

# 2. 确认用户是否存在
\du

# 3. 如果没有 affine 用户，请创建：
CREATE USER affine WITH PASSWORD '19970614yao';

# 4. 创建数据库并授权
CREATE DATABASE affine OWNER affine;
GRANT ALL PRIVILEGES ON DATABASE affine TO affine;

# 5. 刷新权限
FLUSH PRIVILEGES;

# 6. 退出数据库后重新运行创建affine_migration_job容器即可

创建 Affine Server 容器

终于到了部署 Affine 的最后一步

Affine Migration 对应的部分是：

  affine:
    image: ghcr.io/toeverything/affine:${AFFINE_REVISION:-stable}
    container_name: affine_server
    ports:
      - '${PORT:-3010}:3010'
    depends_on:
      redis:
        condition: service_healthy
      postgres:
        condition: service_healthy
      affine_migration:
        condition: service_completed_successfully
    volumes:
      # custom configurations
      - ${UPLOAD_LOCATION}:/root/.affine/storage
      - ${CONFIG_LOCATION}:/root/.affine/config
    env_file:
      - .env
    environment:
      - REDIS_SERVER_HOST=redis
      - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${DB_DATABASE:-affine}
      - AFFINE_INDEXER_ENABLED=false
    restart: unless-stopped

转换后的 podman 命令为：

podman run -d --pod mypod --name affine_server \
  --restart unless-stopped \
  -v /opt/serves/affine/storage:/root/.affine/storage \
  -v /opt/serves/affine/config:/root/.affine/config \
  -e REDIS_SERVER_HOST=localhost \
  -e DATABASE_URL=postgresql://affine:[密码]@localhost:5432/affine \
  -e AFFINE_INDEXER_ENABLED=false \
  ghcr.io/toeverything/affine:stable

运行podman logs affine_server检查运行情况，应该有如下输出：

LOG [NestApplication] Nest application successfully started
LOG [WorkspaceResolver] AFFiNE Server is running in [selfhosted] mode
LOG [WorkspaceResolver] Listening on http://0.0.0.0:3010
LOG [WorkspaceResolver] And the public server should be recognized as http://localhost:3010

要注意的是：

• 由于 pod 统一映射了端口，不需要再设置端口映射

配置 Nginx 反向代理

终于我们完成了 Affine 的配置，接下来只要再配置 Nginx 反向代理让我们能访问 Affine 服务就行了

在/opt/serves/nginx/conf/server_blocks下新建一个affine.conf文件和一个default.conf文件

• affine.conf
  
  用于把访问affine.your.domain的流量代理至 Affine 监听的 3010 端口

server {
    listen 8080;  # 映射的是pod外的80端口
    server_name affine.your.domain;  # 只有通过这个域名访问的流量才会被代理至Affine
    access_log /opt/bitnami/nginx/logs/affine.log;
    error_log /opt/bitnami/nginx/logs/affine.log;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header HOST $http_host;
        proxy_set_header X-NginX-Proxy true;

        proxy_pass http://localhost:3010;  # 代理至 Affine监听的3010端口
        proxy_redirect off;
    }
}

• default.conf
  
  用于屏蔽域名不匹配的流量（可选）
  
  当不是通过affine.your.domain访问服务器时，直接关闭连接

server {
    listen 8080 default_server;
    server_name _;              # 匹配任何 Host
    return 444;                 # 直接关闭连接（也可以 404 / 503）
}

完成上述步骤后，即可在浏览器中通过域名访问 affine 服务

注册 systemd 服务(推荐)

由于 podman 没有守护进程，所以没法开机自启动 pod 或容器，要借助 systemd 实现自启动

podman generate systemd --name mypod --new --files

# 会生成下面这些文件
/opt/serves/container-doocs.service
/opt/serves/container-affine_redis.service
/opt/serves/container-affine_postgres.service
/opt/serves/pod-mypod.service
/opt/serves/container-affine_server.service
/opt/serves/container-nginx.service

把这些文件复制到用户的 systemd 目录下，没有这个目录就创建一个

mkdir -p ~/.config/systemd/user  # 一般都有这个目录
cp *.service ~/.config/systemd/user

重载 systemd 并应用服务

systemctl --user daemon-reload
systemctl --user enable --now pod-mypod.service

导出 pod 文件（推荐）

可以导出 pod 文件，这样下次再创建 pod 就不需要这么麻烦了

podman generate kube mypod>mypod.yaml # 导出pod配置，兼容k8s
podmam play kube mypod.yaml # 可以从yaml文件重新创建mod