基础设施运维师

# Prometheus 监控配置
global:
  scrape_interval: 15s
  evaluation_interval: 15s

rule_files:
  - "infrastructure_alerts.yml"
  - "application_alerts.yml"
  - "business_metrics.yml"

scrape_configs:
  # 基础设施监控
  - job_name: 'infrastructure'
    static_configs:
      - targets: ['localhost:9100']  # Node Exporter
    scrape_interval: 30s
    metrics_path: /metrics

  # 应用监控
  - job_name: 'application'
    static_configs:
      - targets: ['app:8080']
    scrape_interval: 15s

  # 数据库监控
  - job_name: 'database'
    static_configs:
      - targets: ['db:9104']  # PostgreSQL Exporter
    scrape_interval: 30s

# 告警配置
alerting:
  alertmanagers:
    - static_configs:
        - targets:
          - alertmanager:9093

# 基础设施告警规则
groups:
  - name: infrastructure.rules
    rules:
      - alert: HighCPUUsage
        expr: 100 - (avg by(instance) (irate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "检测到 CPU 使用率过高"
          description: "{{ $labels.instance }} 的 CPU 使用率已持续 5 分钟超过 80%"

      - alert: HighMemoryUsage
        expr: (1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100 > 90
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "检测到内存使用率过高"
          description: "{{ $labels.instance }} 的内存使用率超过 90%"

      - alert: DiskSpaceLow
        expr: 100 - ((node_filesystem_avail_bytes * 100) / node_filesystem_size_bytes) > 85
        for: 2m
        labels:
          severity: warning
        annotations:
          summary: "磁盘空间不足"
          description: "{{ $labels.instance }} 的磁盘使用率超过 85%"

      - alert: ServiceDown
        expr: up == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "服务宕机"
          description: "{{ $labels.job }} 已宕机超过 1 分钟"

# AWS 基础设施配置
terraform {
  required_version = ">= 1.0"
  backend "s3" {
    bucket = "company-terraform-state"
    key    = "infrastructure/terraform.tfstate"
    region = "us-west-2"
    encrypt = true
    dynamodb_table = "terraform-locks"
  }
}

# 网络基础设施
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name        = "main-vpc"
    Environment = var.environment
    Owner       = "infrastructure-team"
  }
}

resource "aws_subnet" "private" {
  count             = length(var.availability_zones)
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.${count.index + 1}.0/24"
  availability_zone = var.availability_zones[count.index]

  tags = {
    Name = "private-subnet-${count.index + 1}"
    Type = "private"
  }
}

resource "aws_subnet" "public" {
  count                   = length(var.availability_zones)
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.${count.index + 10}.0/24"
  availability_zone       = var.availability_zones[count.index]
  map_public_ip_on_launch = true

  tags = {
    Name = "public-subnet-${count.index + 1}"
    Type = "public"
  }
}

# 弹性伸缩基础设施
resource "aws_launch_template" "app" {
  name_prefix   = "app-template-"
  image_id      = data.aws_ami.app.id
  instance_type = var.instance_type

  vpc_security_group_ids = [aws_security_group.app.id]

  user_data = base64encode(templatefile("${path.module}/user_data.sh", {
    app_environment = var.environment
  }))

  tag_specifications {
    resource_type = "instance"
    tags = {
      Name        = "app-server"
      Environment = var.environment
    }
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_autoscaling_group" "app" {
  name                = "app-asg"
  vpc_zone_identifier = aws_subnet.private[*].id
  target_group_arns   = [aws_lb_target_group.app.arn]
  health_check_type   = "ELB"

  min_size         = var.min_servers
  max_size         = var.max_servers
  desired_capacity = var.desired_servers

  launch_template {
    id      = aws_launch_template.app.id
    version = "$Latest"
  }

  # 弹性伸缩策略
  tag {
    key                 = "Name"
    value               = "app-asg"
    propagate_at_launch = false
  }
}

# 数据库基础设施
resource "aws_db_subnet_group" "main" {
  name       = "main-db-subnet-group"
  subnet_ids = aws_subnet.private[*].id

  tags = {
    Name = "主数据库子网组"
  }
}

resource "aws_db_instance" "main" {
  allocated_storage      = var.db_allocated_storage
  max_allocated_storage  = var.db_max_allocated_storage
  storage_type          = "gp2"
  storage_encrypted     = true

  engine         = "postgres"
  engine_version = "13.7"
  instance_class = var.db_instance_class

  db_name  = var.db_name
  username = var.db_username
  password = var.db_password

  vpc_security_group_ids = [aws_security_group.db.id]
  db_subnet_group_name   = aws_db_subnet_group.main.name

  backup_retention_period = 7              # 备份保留 7 天
  backup_window          = "03:00-04:00"   # 备份时间窗口
  maintenance_window     = "Sun:04:00-Sun:05:00"  # 维护窗口

  skip_final_snapshot = false
  final_snapshot_identifier = "main-db-final-snapshot-${formatdate("YYYY-MM-DD-hhmm", timestamp())}"

  performance_insights_enabled = true      # 启用性能洞察
  monitoring_interval         = 60         # 监控间隔 60 秒
  monitoring_role_arn        = aws_iam_role.rds_monitoring.arn

  tags = {
    Name        = "main-database"
    Environment = var.environment
  }
}

#!/bin/bash
# 全面的备份与恢复脚本

set -euo pipefail

# 配置
BACKUP_ROOT="/backups"
LOG_FILE="/var/log/backup.log"
RETENTION_DAYS=30
ENCRYPTION_KEY="/etc/backup/backup.key"
S3_BUCKET="company-backups"
# 重要：这是模板示例，使用前请替换为实际的 Webhook URL
# 不要把真实的 Webhook URL 提交到版本控制
NOTIFICATION_WEBHOOK="${SLACK_WEBHOOK_URL:?请设置 SLACK_WEBHOOK_URL 环境变量}"

# 日志函数
log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# 错误处理
handle_error() {
    local error_message="$1"
    log "错误: $error_message"

    # 发送告警通知
    curl -X POST -H 'Content-type: application/json' \
        --data "{\"text\":\"备份失败: $error_message\"}" \
        "$NOTIFICATION_WEBHOOK"

    exit 1
}

# 数据库备份函数
backup_database() {
    local db_name="$1"
    local backup_file="${BACKUP_ROOT}/db/${db_name}_$(date +%Y%m%d_%H%M%S).sql.gz"

    log "开始备份数据库 $db_name"

    # 创建备份目录
    mkdir -p "$(dirname "$backup_file")"

    # 导出数据库
    if ! pg_dump -h "$DB_HOST" -U "$DB_USER" -d "$db_name" | gzip > "$backup_file"; then
        handle_error "数据库 $db_name 备份失败"
    fi

    # 加密备份文件
    if ! gpg --cipher-algo AES256 --compress-algo 1 --s2k-mode 3 \
             --s2k-digest-algo SHA512 --s2k-count 65536 --symmetric \
             --passphrase-file "$ENCRYPTION_KEY" "$backup_file"; then
        handle_error "数据库 $db_name 备份加密失败"
    fi

    # 删除未加密的文件
    rm "$backup_file"

    log "数据库 $db_name 备份完成"
    return 0
}

# 文件系统备份函数
backup_files() {
    local source_dir="$1"
    local backup_name="$2"
    local backup_file="${BACKUP_ROOT}/files/${backup_name}_$(date +%Y%m%d_%H%M%S).tar.gz.gpg"

    log "开始备份文件目录 $source_dir"

    # 创建备份目录
    mkdir -p "$(dirname "$backup_file")"

    # 压缩打包并加密
    if ! tar -czf - -C "$source_dir" . | \
         gpg --cipher-algo AES256 --compress-algo 0 --s2k-mode 3 \
             --s2k-digest-algo SHA512 --s2k-count 65536 --symmetric \
             --passphrase-file "$ENCRYPTION_KEY" \
             --output "$backup_file"; then
        handle_error "文件目录 $source_dir 备份失败"
    fi

    log "文件目录 $source_dir 备份完成"
    return 0
}

# 上传到 S3
upload_to_s3() {
    local local_file="$1"
    local s3_path="$2"

    log "正在上传 $local_file 到 S3"

    if ! aws s3 cp "$local_file" "s3://$S3_BUCKET/$s3_path" \
         --storage-class STANDARD_IA \
         --metadata "backup-date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"; then
        handle_error "S3 上传失败: $local_file"
    fi

    log "S3 上传完成: $local_file"
}

# 清理过期备份
cleanup_old_backups() {
    log "开始清理 $RETENTION_DAYS 天前的过期备份"

    # 本地清理
    find "$BACKUP_ROOT" -name "*.gpg" -mtime +$RETENTION_DAYS -delete

    # S3 清理（生命周期策略应该已经处理了，这里做二次确认）
    aws s3api list-objects-v2 --bucket "$S3_BUCKET" \
        --query "Contents[?LastModified<='$(date -d "$RETENTION_DAYS days ago" -u +%Y-%m-%dT%H:%M:%SZ)'].Key" \
        --output text | xargs -r -n1 aws s3 rm "s3://$S3_BUCKET/"

    log "过期备份清理完成"
}

# 验证备份完整性
verify_backup() {
    local backup_file="$1"

    log "正在验证备份完整性: $backup_file"

    if ! gpg --quiet --batch --passphrase-file "$ENCRYPTION_KEY" \
             --decrypt "$backup_file" > /dev/null 2>&1; then
        handle_error "备份完整性验证失败: $backup_file"
    fi

    log "备份完整性验证通过: $backup_file"
}

# 主流程
main() {
    log "开始执行备份流程"

    # 数据库备份
    backup_database "production"
    backup_database "analytics"

    # 文件系统备份
    backup_files "/var/www/uploads" "uploads"
    backup_files "/etc" "system-config"
    backup_files "/var/log" "system-logs"

    # 把新备份上传到 S3
    find "$BACKUP_ROOT" -name "*.gpg" -mtime -1 | while read -r backup_file; do
        relative_path=$(echo "$backup_file" | sed "s|$BACKUP_ROOT/||")
        upload_to_s3 "$backup_file" "$relative_path"
        verify_backup "$backup_file"
    done

    # 清理过期备份
    cleanup_old_backups

    # 发送成功通知
    curl -X POST -H 'Content-type: application/json' \
        --data "{\"text\":\"备份全部完成\"}" \
        "$NOTIFICATION_WEBHOOK"

    log "备份流程全部完成"
}

# 执行主流程
main "$@"

# 评估当前基础设施的健康状况和性能
# 找出优化空间和潜在风险
# 规划基础设施变更，准备回滚方案

# 基础设施健康与性能报告

## 摘要

### 系统可靠性指标
**可用性**：99.95%（目标：99.9%，环比：+0.02%）
**平均恢复时间**：3.2 小时（目标：<4 小时）
**事件数量**：2 个严重、5 个轻微（环比：严重 -1、轻微 +1）
**性能**：98.5% 的请求响应时间在 200ms 以内

### 成本优化成果
**月度基础设施费用**：$[金额]（预算偏差 [+/-]%）
**单用户成本**：$[金额]（环比 [+/-]%）
**优化节省**：通过合理配置和自动化节省 $[金额]
**ROI**：基础设施优化投资回报率 [%]

### 待办事项
1. **紧急**：[需要立即处理的基础设施问题]
2. **优化**：[成本或性能改善机会]
3. **战略**：[长期基础设施规划建议]

## 详细基础设施分析

### 系统性能
**CPU 利用率**：[所有系统的平均值和峰值]
**内存使用**：[当前利用率和增长趋势]
**存储**：[容量利用率和增长预测]
**网络**：[带宽用量和延迟数据]

### 可用性与可靠性
**服务可用性**：[按服务拆分的可用性指标]
**错误率**：[应用和基础设施的错误统计]
**响应时间**：[所有端点的性能指标]
**恢复指标**：[MTTR、MTBF 和事件响应效果]

### 安全态势
**漏洞评估**：[安全扫描结果和修复进展]
**访问控制**：[用户访问审查和合规状态]
**补丁管理**：[系统更新状态和安全补丁级别]
**合规状态**：[监管合规状态和审计就绪度]

## 成本分析与优化

### 支出拆分
**计算成本**：$[金额]（占比 [%]，优化空间：$[金额]）
**存储成本**：$[金额]（占比 [%]，含数据生命周期管理）
**网络成本**：$[金额]（占比 [%]，CDN 和带宽优化）
**第三方服务**：$[金额]（占比 [%]，供应商优化空间）

### 优化机会
**合理配置**：[实例优化和预计节省]
**预留容量**：[长期承诺的节省空间]
**自动化**：[通过自动化降低运营成本]
**架构优化**：[高性价比的架构改进]

## 基础设施建议

### 立即行动（7 天内）
**性能**：[需要紧急处理的性能问题]
**安全**：[高风险的安全漏洞]
**成本**：[风险小、见效快的降本措施]

### 短期改善（30 天内）
**监控**：[加强监控和告警]
**自动化**：[基础设施自动化和优化项目]
**容量**：[容量规划和弹性伸缩改进]

### 战略举措（90 天以上）
**架构**：[长期架构演进和现代化改造]
**技术栈**：[技术栈升级和迁移]
**灾备**：[业务连续性和灾难恢复增强]

### 容量规划
**增长预测**：[基于业务增长的资源需求]
**扩展策略**：[水平和垂直扩展建议]
**技术路线图**：[基础设施技术演进计划]
**投资需求**：[资本支出规划和 ROI 分析]

---
**基础设施运维师**：[姓名]
**报告日期**：[日期]
**覆盖期间**：[期间]
**下次评审**：[计划评审日期]
**审批状态**：[技术和业务审批进度]