企业级 Jenkins CI/CD 平台部署与配置完整指南

cat > check-jenkins-env.sh << 'EOF'
#!/bin/bash

echo "=== Jenkins 环境检查脚本 ==="
echo "检查时间: $(date)"
echo

# 检查操作系统
echo "=== 系统信息 ==="
cat /etc/redhat-release
uname -a
echo

# 检查内存
echo "=== 内存信息 ==="
free -h
echo

# 检查磁盘空间
echo "=== 磁盘空间 ==="
df -h
echo

# 检查 Java 环境
echo "=== Java 环境检查 ==="
if command -v java >/dev/null 2>&1; then
    java -version
    echo "✓ Java 已安装"
else
    echo "✗ Java 未安装"
fi
echo

# 检查网络端口
echo "=== 端口检查 ==="
if netstat -tlnp | grep :8080 >/dev/null 2>&1; then
    echo "✗ 端口 8080 已被占用"
    netstat -tlnp | grep :8080
else
    echo "✓ 端口 8080 可用"
fi
echo

# 检查防火墙状态
echo "=== 防火墙状态 ==="
systemctl status firewalld --no-pager
echo

# 检查 SELinux 状态
echo "=== SELinux 状态 ==="
getenforce
echo

echo "=== 环境检查完成 ==="
EOF

chmod +x check-jenkins-env.sh
./check-jenkins-env.sh

# 安装 OpenJDK 11（推荐）
yum install -y java-11-openjdk java-11-openjdk-devel

# 或安装 OpenJDK 8（兼容性考虑）
yum install -y java-1.8.0-openjdk java-1.8.0-openjdk-devel

# 验证 Java 安装
java -version
javac -version

# 设置 JAVA_HOME 环境变量
echo 'export JAVA_HOME=/usr/lib/jvm/java-11-openjdk' >> /etc/profile
echo 'export PATH=$JAVA_HOME/bin:$PATH' >> /etc/profile
source /etc/profile

# 添加 Jenkins 官方 YUM 仓库
sudo wget -O /etc/yum.repos.d/jenkins.repo \
    https://pkg.jenkins.io/redhat-stable/jenkins.repo

# 导入 Jenkins GPG 密钥
sudo rpm --import https://pkg.jenkins.io/redhat-stable/jenkins.io.key

# 更新 YUM 缓存
yum clean all && yum makecache

# 安装 Jenkins
yum install -y jenkins

# 查看 Jenkins 版本
rpm -qa | grep jenkins

# 查看 Jenkins 服务状态
systemctl status jenkins

# 启动 Jenkins 服务
systemctl start jenkins

# 设置开机自启动
systemctl enable jenkins

# 检查服务状态
systemctl status jenkins

# 查看 Jenkins 日志
journalctl -u jenkins -f

# 开放 Jenkins 端口（8080）
firewall-cmd --permanent --add-port=8080/tcp
firewall-cmd --reload

# 验证端口开放
firewall-cmd --list-ports

# 检查端口监听状态
netstat -tlnp | grep 8080

# 创建 Jenkins 数据目录
mkdir -p /data/jenkins_home
chown -R 1000:1000 /data/jenkins_home

# 运行 Jenkins 容器
docker run -d \
  --name jenkins \
  --restart unless-stopped \
  -p 8080:8080 \
  -p 50000:50000 \
  -v /data/jenkins_home:/var/jenkins_home \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /usr/bin/docker:/usr/bin/docker \
  jenkins/jenkins:lts

# 查看初始管理员密码
docker exec jenkins cat /var/jenkins_home/secrets/initialAdminPassword

cat > docker-compose.yml << 'EOF'
version: '3.8'

services:
  jenkins:
    image: jenkins/jenkins:lts
    container_name: jenkins
    restart: unless-stopped
    ports:
      - "8080:8080"
      - "50000:50000"
    volumes:
      - jenkins_home:/var/jenkins_home
      - /var/run/docker.sock:/var/run/docker.sock
      - /usr/bin/docker:/usr/bin/docker
    environment:
      - JENKINS_OPTS=--httpPort=8080
      - JAVA_OPTS=-Xmx2048m -Xms1024m
    user: root

volumes:
  jenkins_home:
    driver: local
EOF

# 启动服务
docker-compose up -d

# 查看日志
docker-compose logs -f jenkins

cat > jenkins-k8s.yaml << 'EOF'
apiVersion: v1
kind: Namespace
metadata:
  name: jenkins

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins
  namespace: jenkins

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: jenkins
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get","list","watch"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: jenkins
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: jenkins
subjects:
- kind: ServiceAccount
  name: jenkins
  namespace: jenkins

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: jenkins-pvc
  namespace: jenkins
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 100Gi

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: jenkins
  namespace: jenkins
spec:
  replicas: 1
  selector:
    matchLabels:
      app: jenkins
  template:
    metadata:
      labels:
        app: jenkins
    spec:
      serviceAccountName: jenkins
      containers:
      - name: jenkins
        image: jenkins/jenkins:lts
        ports:
        - containerPort: 8080
        - containerPort: 50000
        volumeMounts:
        - name: jenkins-home
          mountPath: /var/jenkins_home
        env:
        - name: JAVA_OPTS
          value: "-Xmx2048m -Xms1024m"
        resources:
          requests:
            cpu: 1000m
            memory: 2Gi
          limits:
            cpu: 2000m
            memory: 4Gi
      volumes:
      - name: jenkins-home
        persistentVolumeClaim:
          claimName: jenkins-pvc

---
apiVersion: v1
kind: Service
metadata:
  name: jenkins
  namespace: jenkins
spec:
  type: NodePort
  ports:
  - port: 8080
    targetPort: 8080
    nodePort: 30080
  - port: 50000
    targetPort: 50000
    nodePort: 30050
  selector:
    app: jenkins
EOF

# 部署到 Kubernetes
kubectl apply -f jenkins-k8s.yaml

# 查看部署状态
kubectl get pods -n jenkins
kubectl get svc -n jenkins

# YUM 安装方式
sudo cat /var/lib/jenkins/secrets/initialAdminPassword

# Docker 方式
docker exec jenkins cat /var/jenkins_home/secrets/initialAdminPassword

# Kubernetes 方式
kubectl exec -n jenkins deployment/jenkins -- cat /var/jenkins_home/secrets/initialAdminPassword

# YUM 安装方式修改端口
sudo vim /etc/sysconfig/jenkins

# 修改以下配置项
JENKINS_PORT="18080"

# 或使用 sed 命令批量替换
sed -i 's/JENKINS_PORT="8080"/JENKINS_PORT="18080"/g' /etc/sysconfig/jenkins

# 重启 Jenkins 服务
systemctl restart jenkins

# 验证端口变更
netstat -tlnp | grep 18080

# 编辑 Jenkins 配置文件
sudo vim /etc/sysconfig/jenkins

# 优化 JVM 参数
JENKINS_JAVA_OPTIONS="-Djava.awt.headless=true -Xms2048m -Xmx4096m -XX:+UseG1GC -XX:+UseStringDeduplication -Djava.net.preferIPv4Stack=true -Duser.timezone=Asia/Shanghai"

# 重启服务使配置生效
systemctl restart jenkins

# 默认工作目录：/var/lib/jenkins
# 如需修改工作目录，编辑配置文件
sudo vim /etc/sysconfig/jenkins

# 修改工作目录
JENKINS_HOME="/data/jenkins"

# 创建新目录并设置权限
sudo mkdir -p /data/jenkins
sudo chown jenkins:jenkins /data/jenkins

# 迁移现有数据（可选）
sudo rsync -av /var/lib/jenkins/ /data/jenkins/

# 重启服务
systemctl restart jenkins

# 安装 Nginx
yum install -y nginx

# 启动并设置开机自启
systemctl start nginx
systemctl enable nginx

# 创建 Jenkins 虚拟主机配置
cat > /etc/nginx/conf.d/jenkins.conf << 'EOF'
upstream jenkins {
    server 127.0.0.1:8080 fail_timeout=0;
}

server {
    listen 80;
    server_name jenkins.your-domain.com;

    # 安全头设置
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";

    # 日志配置
    access_log /var/log/nginx/jenkins.access.log;
    error_log /var/log/nginx/jenkins.error.log;

    # Jenkins 代理配置
    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;

        proxy_pass http://jenkins;
        proxy_read_timeout 90;
        proxy_redirect http://jenkins https://jenkins.your-domain.com;

        # WebSocket 支持
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # 大文件上传支持
        client_max_body_size 100m;
    }
}
EOF

# 测试 Nginx 配置
nginx -t

# 重新加载 Nginx 配置
systemctl reload nginx

# 安装 Certbot
yum install -y certbot python2-certbot-nginx

# 获取 SSL 证书
certbot --nginx -d jenkins.your-domain.com

# 自动续期设置
echo "0 12 * * * /usr/bin/certbot renew --quiet" | crontab -

# 安装 Apache
yum install -y httpd

# 启用必要模块
cat > /etc/httpd/conf.d/jenkins.conf << 'EOF'
<VirtualHost *:80>
    ServerName jenkins.your-domain.com

    ProxyPreserveHost On
    ProxyRequests Off
    ProxyPass / http://localhost:8080/
    ProxyPassReverse / http://localhost:8080/

    # 安全配置
    Header always set X-Frame-Options SAMEORIGIN
    Header always set X-Content-Type-Options nosniff
    Header always set X-XSS-Protection "1; mode=block"
</VirtualHost>
EOF

# 启动 Apache
systemctl start httpd
systemctl enable httpd

cat > traefik-jenkins.yml << 'EOF'
version: '3.8'

services:
  traefik:
    image: traefik:v2.9
    container_name: traefik
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/traefik.yml:ro
      - ./acme.json:/acme.json
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.your-domain.com`)"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"

  jenkins:
    image: jenkins/jenkins:lts
    container_name: jenkins
    restart: unless-stopped
    volumes:
      - jenkins_home:/var/jenkins_home
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.jenkins.rule=Host(`jenkins.your-domain.com`)"
      - "traefik.http.routers.jenkins.tls=true"
      - "traefik.http.routers.jenkins.tls.certresolver=letsencrypt"
      - "traefik.http.services.jenkins.loadbalancer.server.port=8080"

volumes:
  jenkins_home:
EOF

# 创建性能优化脚本
cat > optimize-jenkins.sh << 'EOF'
#!/bin/bash

echo "=== Jenkins 性能优化脚本 ==="

# 1. 系统参数优化
echo "优化系统参数..."
cat >> /etc/sysctl.conf << 'SYSCTL'
# Jenkins 性能优化
vm.swappiness = 1
vm.dirty_ratio = 15
vm.dirty_background_ratio = 5
net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 65535
SYSCTL

sysctl -p

# 2. 文件描述符限制
echo "优化文件描述符限制..."
cat >> /etc/security/limits.conf << 'LIMITS'
jenkins soft nofile 65535
jenkins hard nofile 65535
jenkins soft nproc 32768
jenkins hard nproc 32768
LIMITS

# 3. Jenkins 用户环境优化
echo "优化 Jenkins 用户环境..."
sudo -u jenkins bash -c 'echo "ulimit -n 65535" >> ~/.bashrc'

# 4. 清理临时文件
echo "清理临时文件..."
find /var/lib/jenkins/workspace -name "*.tmp" -mtime +7 -delete
find /var/lib/jenkins/logs -name "*.log" -mtime +30 -delete

echo "=== 优化完成 ==="
EOF

chmod +x optimize-jenkins.sh
./optimize-jenkins.sh

# 创建 Jenkins 配置优化脚本
cat > jenkins-config-optimize.groovy << 'EOF'
import jenkins.model.*
import hudson.model.*

// 设置执行器数量
Jenkins.instance.setNumExecutors(4)

// 设置构建历史保留策略
def jobs = Jenkins.instance.getAllItems(Job.class)
jobs.each { job ->
    if (job.getBuildDiscarder() == null) {
        job.setBuildDiscarder(new LogRotator(-1, 10, -1, 5))
        job.save()
    }
}

// 优化系统配置
def desc = Jenkins.instance.getDescriptor("hudson.model.DirectoryBrowserSupport")
desc.setCSP("default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';")

println "Jenkins 配置优化完成"
EOF

# 通过 Jenkins CLI 执行优化脚本
java -jar jenkins-cli.jar -s http://localhost:8080/ groovy = < jenkins-config-optimize.groovy

# 创建镜像源配置脚本
cat > setup-jenkins-mirror.sh << 'EOF'
#!/bin/bash

# 确定 Jenkins 工作目录
if [ -d "/var/lib/jenkins" ]; then
    JENKINS_HOME="/var/lib/jenkins"
elif [ -d "/var/jenkins_home" ]; then
    JENKINS_HOME="/var/jenkins_home"
else
    echo "未找到 Jenkins 工作目录"
    exit 1
fi

echo "Jenkins 工作目录: $JENKINS_HOME"

# 备份原始配置
cp "${JENKINS_HOME}/hudson.model.UpdateCenter.xml" "${JENKINS_HOME}/hudson.model.UpdateCenter.xml.bak" 2>/dev/null || true
cp "${JENKINS_HOME}/updates/default.json" "${JENKINS_HOME}/updates/default.json.bak" 2>/dev/null || true

# 配置清华大学镜像源
echo "配置清华大学镜像源..."
sed -i 's#https://updates.jenkins.io#https://mirrors.tuna.tsinghua.edu.cn/jenkins/updates#g' "${JENKINS_HOME}/hudson.model.UpdateCenter.xml"

if [ -f "${JENKINS_HOME}/updates/default.json" ]; then
    sed -i 's#http://updates.jenkins-ci.org/download#https://mirrors.tuna.tsinghua.edu.cn/jenkins#g' "${JENKINS_HOME}/updates/default.json"
    sed -i 's#http://www.google.com#https://www.baidu.com#g' "${JENKINS_HOME}/updates/default.json"
fi

# 重启 Jenkins 服务
echo "重启 Jenkins 服务..."
systemctl restart jenkins

echo "镜像源配置完成！"
echo "请在 Web 界面中验证：Manage Jenkins → Manage Plugins → Advanced → Update Site"
echo "URL 应为: https://mirrors.tuna.tsinghua.edu.cn/jenkins/updates/update-center.json"
EOF

chmod +x setup-jenkins-mirror.sh
./setup-jenkins-mirror.sh

# Docker 运行时添加环境变量
docker run -d \
  --name jenkins \
  -p 8080:8080 \
  -p 50000:50000 \
  -v jenkins_home:/var/jenkins_home \
  -e JENKINS_UC=https://mirrors.tuna.tsinghua.edu.cn \
  -e JENKINS_UC_DOWNLOAD=https://mirrors.tuna.tsinghua.edu.cn/jenkins \
  -e JENKINS_OPTS="-Djava.awt.headless=true -Duser.timezone=Asia/Shanghai -Dhudson.model.UpdateCenter.updateCenterUrl=https://mirrors.tuna.tsinghua.edu.cn/jenkins/updates/update-center.json" \
  jenkins/jenkins:lts

# Docker Compose 配置
version: '3.8'
services:
  jenkins:
    image: jenkins/jenkins:lts
    environment:
      - JENKINS_UC=https://mirrors.tuna.tsinghua.edu.cn
      - JENKINS_UC_DOWNLOAD=https://mirrors.tuna.tsinghua.edu.cn/jenkins
      - JENKINS_OPTS=-Djava.awt.headless=true -Duser.timezone=Asia/Shanghai -Dhudson.model.UpdateCenter.updateCenterUrl=https://mirrors.tuna.tsinghua.edu.cn/jenkins/updates/update-center.json

cat > jenkins-plugins.txt << 'EOF'
# 基础插件
ant
build-timeout
credentials-binding
timestamper
ws-cleanup
gradle
workflow-aggregator
github-branch-source
pipeline-github-lib
pipeline-stage-view
git
ssh-slaves
matrix-auth
pam-auth
ldap
email-ext
mailer

# 高级插件
kubernetes
docker-workflow
docker-plugin
blueocean
sonar
role-strategy
rebuild
generic-webhook-trigger
http_request
ansicolor
build-user-vars-plugin
git-parameter
locale
localization-zh-cn
pipeline-utility-steps
simple-theme-plugin
periodicbackup
build-monitor-plugin
dingding-notifications
EOF

cat > install-jenkins-plugins.sh << 'EOF'
#!/bin/bash

JENKINS_URL="http://localhost:8080"
JENKINS_USER="admin"
JENKINS_TOKEN="your-api-token"
PLUGIN_LIST="jenkins-plugins.txt"

# 检查 Jenkins CLI
if [ ! -f "jenkins-cli.jar" ]; then
    echo "下载 Jenkins CLI..."
    wget ${JENKINS_URL}/jnlpJars/jenkins-cli.jar
fi

# 安装插件
echo "开始安装插件..."
while IFS= read -r plugin; do
    # 跳过注释和空行
    [[ $plugin =~ ^#.*$ ]] && continue
    [[ -z "$plugin" ]] && continue

    echo "安装插件: $plugin"
    java -jar jenkins-cli.jar -s $JENKINS_URL -auth $JENKINS_USER:$JENKINS_TOKEN install-plugin $plugin
done < "$PLUGIN_LIST"

# 重启 Jenkins
echo "重启 Jenkins..."
java -jar jenkins-cli.jar -s $JENKINS_URL -auth $JENKINS_USER:$JENKINS_TOKEN restart

echo "插件安装完成！"
EOF

chmod +x install-jenkins-plugins.sh

# 检查当前版本
java -jar /usr/lib/jenkins/jenkins.war --version

# 更新到最新 LTS 版本
yum update jenkins

# 重启服务
systemctl restart jenkins

# 创建更新脚本
cat > update-jenkins.sh << 'EOF'
#!/bin/bash

# 配置变量
JENKINS_HOME="/var/lib/jenkins"
JENKINS_WAR_DIR="/usr/lib/jenkins"
BACKUP_DIR="/backup/jenkins"
NEW_VERSION="2.414.1"  # 指定要更新的版本

# 创建备份目录
mkdir -p $BACKUP_DIR

echo "=== Jenkins 更新脚本 ==="
echo "当前版本: $(java -jar $JENKINS_WAR_DIR/jenkins.war --version)"
echo "目标版本: $NEW_VERSION"

# 停止 Jenkins 服务
echo "停止 Jenkins 服务..."
systemctl stop jenkins

# 备份当前版本
echo "备份当前版本..."
cp $JENKINS_WAR_DIR/jenkins.war $BACKUP_DIR/jenkins-$(date +%Y%m%d-%H%M%S).war.bak

# 下载新版本
echo "下载新版本..."
cd $JENKINS_WAR_DIR

# 优先使用国内镜像
if wget -q --spider https://mirrors.aliyun.com/jenkins/war/$NEW_VERSION/jenkins.war; then
    echo "使用阿里云镜像下载..."
    wget https://mirrors.aliyun.com/jenkins/war/$NEW_VERSION/jenkins.war -O jenkins.war.new
elif wget -q --spider https://mirrors.tuna.tsinghua.edu.cn/jenkins/war/$NEW_VERSION/jenkins.war; then
    echo "使用清华镜像下载..."
    wget https://mirrors.tuna.tsinghua.edu.cn/jenkins/war/$NEW_VERSION/jenkins.war -O jenkins.war.new
else
    echo "使用官方源下载..."
    wget https://updates.jenkins.io/download/war/$NEW_VERSION/jenkins.war -O jenkins.war.new
fi

# 验证下载
if [ -f "jenkins.war.new" ] && [ -s "jenkins.war.new" ]; then
    mv jenkins.war.new jenkins.war
    echo "WAR 包更新成功"
else
    echo "下载失败，恢复备份"
    cp $BACKUP_DIR/jenkins-$(date +%Y%m%d)*.war.bak jenkins.war
    exit 1
fi

# 启动 Jenkins 服务
echo "启动 Jenkins 服务..."
systemctl start jenkins

# 等待服务启动
sleep 30

# 验证更新
echo "验证更新结果..."
NEW_VERSION_CHECK=$(java -jar $JENKINS_WAR_DIR/jenkins.war --version)
echo "更新后版本: $NEW_VERSION_CHECK"

# 检查服务状态
if systemctl is-active --quiet jenkins; then
    echo "✓ Jenkins 服务运行正常"
    echo "✓ 更新完成！"
else
    echo "✗ Jenkins 服务启动失败，请检查日志"
    journalctl -u jenkins --no-pager -n 20
fi
EOF

chmod +x update-jenkins.sh

# 创建更新检查脚本
cat > check-jenkins-updates.sh << 'EOF'
#!/bin/bash

JENKINS_URL="http://localhost:8080"
CURRENT_VERSION=$(java -jar /usr/lib/jenkins/jenkins.war --version)

# 获取最新 LTS 版本信息
LATEST_LTS=$(curl -s https://updates.jenkins.io/stable/latestCore.txt)

echo "当前版本: $CURRENT_VERSION"
echo "最新 LTS: $LATEST_LTS"

if [ "$CURRENT_VERSION" != "$LATEST_LTS" ]; then
    echo "发现新版本，建议更新"
    # 可以在这里添加邮件通知或其他告警机制
else
    echo "已是最新版本"
fi
EOF

chmod +x check-jenkins-updates.sh

# 设置定期检查（每周检查一次）
echo "0 9 * * 1 /path/to/check-jenkins-updates.sh" | crontab -

# 创建容器更新脚本
cat > update-jenkins-docker.sh << 'EOF'
#!/bin/bash

CONTAINER_NAME="jenkins"
NEW_IMAGE="jenkins/jenkins:lts"
BACKUP_DIR="/backup/jenkins"

echo "=== Docker Jenkins 更新脚本 ==="

# 创建数据备份
echo "备份 Jenkins 数据..."
mkdir -p $BACKUP_DIR
docker exec $CONTAINER_NAME tar czf /tmp/jenkins-backup-$(date +%Y%m%d).tar.gz -C /var/jenkins_home .
docker cp $CONTAINER_NAME:/tmp/jenkins-backup-$(date +%Y%m%d).tar.gz $BACKUP_DIR/

# 停止并删除旧容器
echo "停止旧容器..."
docker stop $CONTAINER_NAME
docker rm $CONTAINER_NAME

# 拉取新镜像
echo "拉取新镜像..."
docker pull $NEW_IMAGE

# 启动新容器
echo "启动新容器..."
docker run -d \
  --name $CONTAINER_NAME \
  --restart unless-stopped \
  -p 8080:8080 \
  -p 50000:50000 \
  -v jenkins_home:/var/jenkins_home \
  $NEW_IMAGE

echo "更新完成！"
EOF

chmod +x update-jenkins-docker.sh

cat > rollback-jenkins.sh << 'EOF'
#!/bin/bash

JENKINS_WAR_DIR="/usr/lib/jenkins"
BACKUP_DIR="/backup/jenkins"

echo "=== Jenkins 版本回滚脚本 ==="

# 列出可用备份
echo "可用的备份版本："
ls -la $BACKUP_DIR/jenkins-*.war.bak

# 选择要回滚的版本
read -p "请输入要回滚的备份文件名: " BACKUP_FILE

if [ -f "$BACKUP_DIR/$BACKUP_FILE" ]; then
    echo "停止 Jenkins 服务..."
    systemctl stop jenkins

    echo "回滚到备份版本..."
    cp $BACKUP_DIR/$BACKUP_FILE $JENKINS_WAR_DIR/jenkins.war

    echo "启动 Jenkins 服务..."
    systemctl start jenkins

    echo "回滚完成！"
else
    echo "备份文件不存在: $BACKUP_DIR/$BACKUP_FILE"
fi
EOF

chmod +x rollback-jenkins.sh

# LDAP 配置参数示例
Server: ldap://ldap.your-domain.com:389
Root DN: dc=your-domain,dc=com
User search base: ou=people
User search filter: uid={0}
Group search base: ou=groups
Group search filter: (uniqueMember={0})
Manager DN: cn=admin,dc=your-domain,dc=com
Manager Password: your-admin-password
Display Name LDAP attribute: cn
Email Address LDAP attribute: mail

// Jenkins 配置脚本 (Groovy)
import jenkins.model.*
import hudson.security.*
import org.jenkinsci.plugins.ldap.*

def instance = Jenkins.getInstance()

// LDAP 配置
def ldapRealm = new LDAPSecurityRealm(
    "ldap://ldap.your-domain.com:389",  // server
    "dc=your-domain,dc=com",            // rootDN
    "ou=people,dc=your-domain,dc=com",  // userSearchBase
    "uid={0}",                          // userSearch
    "ou=groups,dc=your-domain,dc=com",  // groupSearchBase
    "(uniqueMember={0})",               // groupSearchFilter
    new LDAPSecurityRealm.LDAPGroupMembershipStrategy(), // groupMembershipStrategy
    "cn=admin,dc=your-domain,dc=com",   // managerDN
    "your-admin-password",              // managerPassword
    false,                              // inhibitInferRootDN
    false,                              // disableMailAddressResolver
    null,                               // cache
    null,                               // environmentProperties
    "cn",                               // displayNameAttributeName
    "mail",                             // mailAddressAttributeName
    IdStrategy.CASE_INSENSITIVE,        // userIdStrategy
    IdStrategy.CASE_INSENSITIVE         // groupIdStrategy
)

instance.setSecurityRealm(ldapRealm)
instance.save()

println "LDAP 配置完成"

# 创建 LDAP 连接测试脚本
cat > test-ldap-connection.sh << 'EOF'
#!/bin/bash

LDAP_SERVER="ldap.your-domain.com"
LDAP_PORT="389"
BASE_DN="dc=your-domain,dc=com"
ADMIN_DN="cn=admin,dc=your-domain,dc=com"
ADMIN_PASS="your-admin-password"

echo "=== LDAP 连接测试 ==="

# 测试基本连接
echo "测试 LDAP 服务器连接..."
ldapsearch -x -H ldap://$LDAP_SERVER:$LDAP_PORT -b "" -s base

# 测试管理员认证
echo "测试管理员认证..."
ldapsearch -x -H ldap://$LDAP_SERVER:$LDAP_PORT -D "$ADMIN_DN" -w "$ADMIN_PASS" -b "$BASE_DN" -s base

# 测试用户搜索
echo "测试用户搜索..."
ldapsearch -x -H ldap://$LDAP_SERVER:$LDAP_PORT -D "$ADMIN_DN" -w "$ADMIN_PASS" -b "ou=people,$BASE_DN" "(objectClass=inetOrgPerson)"

# 测试组搜索
echo "测试组搜索..."
ldapsearch -x -H ldap://$LDAP_SERVER:$LDAP_PORT -D "$ADMIN_DN" -w "$ADMIN_PASS" -b "ou=groups,$BASE_DN" "(objectClass=groupOfUniqueNames)"

echo "=== 测试完成 ==="
EOF

chmod +x test-ldap-connection.sh

# 全局角色定义示例
admin       # 管理员角色 - 所有权限
developer   # 开发者角色 - 构建、查看权限
viewer      # 只读角色 - 仅查看权限
operator    # 运维角色 - 部署、监控权限

# 项目角色模式示例
project-.*-admin     # 项目管理员
project-.*-developer # 项目开发者
project-.*-viewer    # 项目查看者

// 自动化权限配置脚本
import jenkins.model.*
import hudson.security.*
import com.michelin.cio.hudson.plugins.rolestrategy.*

def instance = Jenkins.getInstance()

// 创建角色策略
def strategy = new RoleBasedAuthorizationStrategy()

// 定义全局角色
def globalRoles = [
    'admin': [
        'hudson.model.Hudson.Administer',
        'hudson.model.Hudson.Read'
    ],
    'developer': [
        'hudson.model.Hudson.Read',
        'hudson.model.Item.Build',
        'hudson.model.Item.Read',
        'hudson.model.Item.Workspace'
    ],
    'viewer': [
        'hudson.model.Hudson.Read',
        'hudson.model.Item.Read'
    ]
]

// 添加全局角色
globalRoles.each { roleName, permissions ->
    def role = new Role(roleName, permissions as Set)
    strategy.addRole(RoleBasedAuthorizationStrategy.GLOBAL, role)
}

// 定义项目角色
def projectRoles = [
    'project-admin': [
        'hudson.model.Item.Build',
        'hudson.model.Item.Cancel',
        'hudson.model.Item.Configure',
        'hudson.model.Item.Create',
        'hudson.model.Item.Delete',
        'hudson.model.Item.Read',
        'hudson.model.Item.Workspace'
    ],
    'project-developer': [
        'hudson.model.Item.Build',
        'hudson.model.Item.Cancel',
        'hudson.model.Item.Read',
        'hudson.model.Item.Workspace'
    ]
]

// 添加项目角色
projectRoles.each { roleName, permissions ->
    def role = new Role(roleName, "project-.*", permissions as Set)
    strategy.addRole(RoleBasedAuthorizationStrategy.PROJECT, role)
}

// 应用策略
instance.setAuthorizationStrategy(strategy)
instance.save()

println "权限配置完成"

/* Jenkins Material Theme CSS */
@import url('https://cdn.jsdelivr.net/gh/afonsof/jenkins-material-theme@master/dist/material-blue.css');

/* 自定义样式 */
.jenkins-header {
    background-color: #1976d2 !important;
}

.jenkins-logo {
    content: url('https://your-domain.com/logo.png');
    width: 120px;
    height: 40px;
}

/* 侧边栏样式 */
#side-panel {
    background-color: #f5f5f5;
}

/* 构建状态颜色 */
.build-status-success {
    color: #4caf50 !important;
}

.build-status-failed {
    color: #f44336 !important;
}

# 安装 Blue Ocean 插件套件
jenkins-cli.jar -s http://localhost:8080/ install-plugin blueocean

# 重启 Jenkins
systemctl restart jenkins

<!-- 自定义 HTML 头部 -->
<style>
/* 企业 Logo */
.logo img {
    content: url('/userContent/company-logo.png');
    max-height: 40px;
}

/* 企业色彩主题 */
:root {
    --primary-color: #your-brand-color;
    --secondary-color: #your-secondary-color;
}

/* 自定义页脚 */
.footer {
    background-color: var(--primary-color);
    color: white;
    text-align: center;
    padding: 10px;
}

.footer::after {
    content: "© 2024 Your Company Name. All rights reserved.";
}
</style>

<script>
// 自定义 JavaScript
document.addEventListener('DOMContentLoaded', function() {
    // 添加企业信息
    const footer = document.createElement('div');
    footer.className = 'footer';
    document.body.appendChild(footer);

    // 自定义页面标题
    document.title = 'Your Company CI/CD Platform';
});
</script>

/* 移动端适配 */
@media (max-width: 768px) {
    #main-panel {
        margin-left: 0;
    }

    #side-panel {
        transform: translateX(-100%);
        transition: transform 0.3s ease;
    }

    #side-panel.show {
        transform: translateX(0);
    }
}

/* 大屏幕优化 */
@media (min-width: 1920px) {
    .container {
        max-width: 1800px;
        margin: 0 auto;
    }
}

cat > jenkins-backup.sh << 'EOF'
#!/bin/bash

# 配置变量
JENKINS_HOME="/var/lib/jenkins"
BACKUP_DIR="/backup/jenkins"
RETENTION_DAYS=30
DATE=$(date +%Y%m%d_%H%M%S)
BACKUP_NAME="jenkins-backup-$DATE"

# 创建备份目录
mkdir -p $BACKUP_DIR

echo "=== Jenkins 备份脚本 ==="
echo "开始时间: $(date)"
echo "备份目录: $BACKUP_DIR"

# 停止 Jenkins 服务（可选，用于一致性备份）
read -p "是否停止 Jenkins 服务进行一致性备份？(y/N): " STOP_SERVICE
if [[ $STOP_SERVICE =~ ^[Yy]$ ]]; then
    echo "停止 Jenkins 服务..."
    systemctl stop jenkins
    RESTART_NEEDED=true
fi

# 创建备份
echo "创建备份: $BACKUP_NAME"
tar -czf "$BACKUP_DIR/$BACKUP_NAME.tar.gz" \
    --exclude="$JENKINS_HOME/workspace/*" \
    --exclude="$JENKINS_HOME/logs/*" \
    --exclude="$JENKINS_HOME/war/*" \
    --exclude="$JENKINS_HOME/.m2/repository/*" \
    -C "$(dirname $JENKINS_HOME)" \
    "$(basename $JENKINS_HOME)"

# 重启服务（如果之前停止了）
if [[ $RESTART_NEEDED == true ]]; then
    echo "重启 Jenkins 服务..."
    systemctl start jenkins
fi

# 验证备份
if [ -f "$BACKUP_DIR/$BACKUP_NAME.tar.gz" ]; then
    BACKUP_SIZE=$(du -h "$BACKUP_DIR/$BACKUP_NAME.tar.gz" | cut -f1)
    echo "✓ 备份完成: $BACKUP_NAME.tar.gz ($BACKUP_SIZE)"
else
    echo "✗ 备份失败"
    exit 1
fi

# 清理过期备份
echo "清理 $RETENTION_DAYS 天前的备份..."
find $BACKUP_DIR -name "jenkins-backup-*.tar.gz" -mtime +$RETENTION_DAYS -delete

# 备份报告
echo "=== 备份报告 ==="
echo "备份文件: $BACKUP_DIR/$BACKUP_NAME.tar.gz"
echo "备份大小: $BACKUP_SIZE"
echo "完成时间: $(date)"
echo "当前备份列表:"
ls -lh $BACKUP_DIR/jenkins-backup-*.tar.gz | tail -5
EOF

chmod +x jenkins-backup.sh

cat > jenkins-incremental-backup.sh << 'EOF'
#!/bin/bash

JENKINS_HOME="/var/lib/jenkins"
BACKUP_DIR="/backup/jenkins/incremental"
FULL_BACKUP_DIR="/backup/jenkins"
DATE=$(date +%Y%m%d_%H%M%S)

mkdir -p $BACKUP_DIR

# 查找最近的完整备份
LAST_FULL_BACKUP=$(ls -t $FULL_BACKUP_DIR/jenkins-backup-*.tar.gz 2>/dev/null | head -1)

if [ -z "$LAST_FULL_BACKUP" ]; then
    echo "未找到完整备份，请先执行完整备份"
    exit 1
fi

# 获取完整备份的时间戳
FULL_BACKUP_TIME=$(stat -c %Y "$LAST_FULL_BACKUP")

echo "=== Jenkins 增量备份 ==="
echo "基于完整备份: $(basename $LAST_FULL_BACKUP)"

# 创建增量备份
find $JENKINS_HOME -newer "$LAST_FULL_BACKUP" -type f | \
    tar -czf "$BACKUP_DIR/jenkins-incremental-$DATE.tar.gz" -T -

echo "✓ 增量备份完成: jenkins-incremental-$DATE.tar.gz"
EOF

chmod +x jenkins-incremental-backup.sh

# 配置 crontab 定时备份
cat > setup-backup-cron.sh << 'EOF'
#!/bin/bash

# 添加定时任务
(crontab -l 2>/dev/null; cat << 'CRON'
# Jenkins 备份任务
# 每天凌晨 2 点执行完整备份
0 2 * * * /path/to/jenkins-backup.sh >> /var/log/jenkins-backup.log 2>&1

# 每 6 小时执行增量备份
0 */6 * * * /path/to/jenkins-incremental-backup.sh >> /var/log/jenkins-backup.log 2>&1

# 每周日执行深度清理
0 3 * * 0 find /var/lib/jenkins/workspace -type d -mtime +7 -exec rm -rf {} + 2>/dev/null
CRON
) | crontab -

echo "定时备份任务已配置"
crontab -l
EOF

chmod +x setup-backup-cron.sh
./setup-backup-cron.sh

cat > jenkins-restore.sh << 'EOF'
#!/bin/bash

BACKUP_DIR="/backup/jenkins"
JENKINS_HOME="/var/lib/jenkins"

echo "=== Jenkins 恢复脚本 ==="

# 列出可用备份
echo "可用的备份文件:"
ls -lh $BACKUP_DIR/jenkins-backup-*.tar.gz | nl

# 选择备份文件
read -p "请输入要恢复的备份文件编号: " BACKUP_NUM
BACKUP_FILE=$(ls $BACKUP_DIR/jenkins-backup-*.tar.gz | sed -n "${BACKUP_NUM}p")

if [ ! -f "$BACKUP_FILE" ]; then
    echo "备份文件不存在: $BACKUP_FILE"
    exit 1
fi

echo "选择的备份文件: $BACKUP_FILE"
read -p "确认恢复？这将覆盖现有数据 (yes/no): " CONFIRM

if [ "$CONFIRM" != "yes" ]; then
    echo "恢复已取消"
    exit 0
fi

# 停止 Jenkins 服务
echo "停止 Jenkins 服务..."
systemctl stop jenkins

# 备份当前数据
echo "备份当前数据..."
mv $JENKINS_HOME ${JENKINS_HOME}.backup.$(date +%Y%m%d_%H%M%S)

# 恢复数据
echo "恢复数据..."
mkdir -p $(dirname $JENKINS_HOME)
tar -xzf "$BACKUP_FILE" -C $(dirname $JENKINS_HOME)

# 修复权限
echo "修复权限..."
chown -R jenkins:jenkins $JENKINS_HOME

# 启动 Jenkins 服务
echo "启动 Jenkins 服务..."
systemctl start jenkins

# 等待服务启动
echo "等待服务启动..."
sleep 30

# 验证恢复
if systemctl is-active --quiet jenkins; then
    echo "✓ Jenkins 恢复成功"
    echo "请访问 Web 界面验证功能"
else
    echo "✗ Jenkins 启动失败，请检查日志"
    journalctl -u jenkins --no-pager -n 20
fi
EOF

chmod +x jenkins-restore.sh

cat > jenkins-monitor.sh << 'EOF'
#!/bin/bash

JENKINS_URL="http://localhost:8080"
JENKINS_HOME="/var/lib/jenkins"
LOG_FILE="/var/log/jenkins-monitor.log"

# 日志函数
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a $LOG_FILE
}

# 检查 Jenkins 服务状态
check_service() {
    if systemctl is-active --quiet jenkins; then
        log "✓ Jenkins 服务运行正常"
        return 0
    else
        log "✗ Jenkins 服务异常"
        return 1
    fi
}

# 检查 Web 界面响应
check_web_response() {
    local response_code=$(curl -s -o /dev/null -w "%{http_code}" $JENKINS_URL/login)
    if [ "$response_code" = "200" ]; then
        log "✓ Web 界面响应正常"
        return 0
    else
        log "✗ Web 界面响应异常 (HTTP $response_code)"
        return 1
    fi
}

# 检查磁盘空间
check_disk_space() {
    local usage=$(df $JENKINS_HOME | awk 'NR==2 {print $5}' | sed 's/%//')
    if [ $usage -lt 80 ]; then
        log "✓ 磁盘空间充足 (${usage}%)"
        return 0
    elif [ $usage -lt 90 ]; then
        log "⚠ 磁盘空间不足 (${usage}%)"
        return 1
    else
        log "✗ 磁盘空间严重不足 (${usage}%)"
        return 2
    fi
}

# 检查内存使用
check_memory() {
    local jenkins_pid=$(pgrep -f jenkins.war)
    if [ -n "$jenkins_pid" ]; then
        local memory_mb=$(ps -p $jenkins_pid -o rss= | awk '{print int($1/1024)}')
        log "✓ Jenkins 内存使用: ${memory_mb}MB"

        if [ $memory_mb -gt 4096 ]; then
            log "⚠ 内存使用较高"
            return 1
        fi
        return 0
    else
        log "✗ 无法获取 Jenkins 进程信息"
        return 1
    fi
}

# 检查构建队列
check_build_queue() {
    local queue_length=$(curl -s "$JENKINS_URL/queue/api/json" | jq '.items | length' 2>/dev/null || echo "0")
    log "构建队列长度: $queue_length"

    if [ $queue_length -gt 10 ]; then
        log "⚠ 构建队列过长"
        return 1
    fi
    return 0
}

# 主监控函数
main() {
    log "=== Jenkins 监控检查开始 ==="

    local issues=0

    check_service || ((issues++))
    check_web_response || ((issues++))
    check_disk_space || ((issues++))
    check_memory || ((issues++))
    check_build_queue || ((issues++))

    if [ $issues -eq 0 ]; then
        log "✓ 所有检查通过"
    else
        log "⚠ 发现 $issues 个问题"
        # 这里可以添加告警通知
        send_alert "Jenkins 监控发现 $issues 个问题"
    fi

    log "=== Jenkins 监控检查完成 ==="
}

# 告警通知函数
send_alert() {
    local message="$1"

    # 邮件通知
    if command -v mail >/dev/null 2>&1; then
        echo "$message" | mail -s "Jenkins 监控告警" admin@your-domain.com
    fi

    # 钉钉通知（需要配置 webhook）
    if [ -n "$DINGTALK_WEBHOOK" ]; then
        curl -X POST "$DINGTALK_WEBHOOK" \
            -H 'Content-Type: application/json' \
            -d "{\"msgtype\": \"text\", \"text\": {\"content\": \"$message\"}}"
    fi
}

main "$@"
EOF

chmod +x jenkins-monitor.sh

# 设置定时监控
echo "*/5 * * * * /path/to/jenkins-monitor.sh" | crontab -

# 安装 Prometheus Metrics Plugin
jenkins-cli.jar -s http://localhost:8080/ install-plugin prometheus

# 配置 Prometheus 抓取
cat > prometheus-jenkins.yml << 'EOF'
global:
  scrape_interval: 15s

scrape_configs:
  - job_name: 'jenkins'
    static_configs:
      - targets: ['localhost:8080']
    metrics_path: '/prometheus'
    scrape_interval: 30s
EOF

# Jenkins 启动失败诊断脚本
cat > diagnose-jenkins.sh << 'EOF'
#!/bin/bash

echo "=== Jenkins 故障诊断 ==="

# 检查 Java 环境
echo "1. 检查 Java 环境"
java -version
echo "JAVA_HOME: $JAVA_HOME"

# 检查 Jenkins 服务状态
echo -e "\n2. 检查服务状态"
systemctl status jenkins --no-pager

# 检查端口占用
echo -e "\n3. 检查端口占用"
netstat -tlnp | grep 8080

# 检查日志
echo -e "\n4. 最近的错误日志"
journalctl -u jenkins --no-pager -n 20 | grep -i error

# 检查磁盘空间
echo -e "\n5. 检查磁盘空间"
df -h /var/lib/jenkins

# 检查权限
echo -e "\n6. 检查权限"
ls -la /var/lib/jenkins | head -5

# 检查配置文件
echo -e "\n7. 检查配置文件"
if [ -f /etc/sysconfig/jenkins ]; then
    grep -v "^#" /etc/sysconfig/jenkins | grep -v "^$"
fi

echo -e "\n=== 诊断完成 ==="
EOF

chmod +x diagnose-jenkins.sh

# 性能分析脚本
cat > jenkins-performance-analysis.sh << 'EOF'
#!/bin/bash

JENKINS_PID=$(pgrep -f jenkins.war)

if [ -z "$JENKINS_PID" ]; then
    echo "Jenkins 进程未运行"
    exit 1
fi

echo "=== Jenkins 性能分析 ==="
echo "进程 ID: $JENKINS_PID"

# CPU 使用率
echo -e "\nCPU 使用率:"
ps -p $JENKINS_PID -o pid,ppid,cmd,%cpu,%mem

# 内存详情
echo -e "\n内存使用详情:"
cat /proc/$JENKINS_PID/status | grep -E "(VmSize|VmRSS|VmHWM)"

# 线程信息
echo -e "\n线程数量:"
cat /proc/$JENKINS_PID/status | grep Threads

# GC 信息（如果启用了 GC 日志）
if [ -f /var/log/jenkins/gc.log ]; then
    echo -e "\n最近的 GC 活动:"
    tail -10 /var/log/jenkins/gc.log
fi

# 网络连接
echo -e "\n网络连接:"
netstat -an | grep :8080

echo -e "\n=== 分析完成 ==="
EOF

chmod +x jenkins-performance-analysis.sh