141 lines
9.4 KiB
XML
141 lines
9.4 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="760" viewBox="0 0 1200 760" role="img" aria-labelledby="diagTitle diagDesc">
|
||
<title id="diagTitle">bitrix-vps-infra: схема взаимодействия сервисов</title>
|
||
<desc id="diagDesc">Браузер обращается к nginx по HTTPS; nginx передаёт PHP в php-fpm через unix-сокет; php-fpm работает с Percona MySQL только по локальному сокету и с двумя инстансами memcached; cron на CLI php выполняет агентов, обмен с 1С и бэкапы; nginx отдаёт логи CrowdSec и fail2ban, которые блокируют атакующих. TCP у MySQL закрыт.</desc>
|
||
|
||
<!-- ===== палитра проекта ===== -->
|
||
<defs>
|
||
<marker id="arrB" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path d="M0 0 L10 5 L0 10 z" fill="#58a6ff"/></marker>
|
||
<marker id="arrG" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path d="M0 0 L10 5 L0 10 z" fill="#3fb950"/></marker>
|
||
<marker id="arrN" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path d="M0 0 L10 5 L0 10 z" fill="#8d9cb0"/></marker>
|
||
<marker id="arrA" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path d="M0 0 L10 5 L0 10 z" fill="#d29922"/></marker>
|
||
<marker id="arrR" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path d="M0 0 L10 5 L0 10 z" fill="#f85149"/></marker>
|
||
</defs>
|
||
|
||
<rect width="1200" height="760" rx="20" fill="#0b0e14"/>
|
||
|
||
<g font-family="-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Arial,sans-serif">
|
||
|
||
<!-- ===== заголовок модуля ===== -->
|
||
<g id="heading">
|
||
<text x="48" y="66" font-size="30" font-weight="700" fill="#e6edf3">Архитектура стека</text>
|
||
<text x="48" y="94" font-size="18" fill="#8d9cb0">один VPS, нативные пакеты, без Docker</text>
|
||
</g>
|
||
|
||
<!-- ===== браузер ===== -->
|
||
<g id="browser">
|
||
<rect x="40" y="200" width="188" height="96" rx="10" fill="#141a23" stroke="#2a3341"/>
|
||
<text x="134" y="242" text-anchor="middle" font-size="22" font-weight="700" fill="#e6edf3">Браузер</text>
|
||
<text x="134" y="268" text-anchor="middle" font-size="17" fill="#8d9cb0">посетители</text>
|
||
</g>
|
||
|
||
<!-- ===== рамка VPS ===== -->
|
||
<g id="vps-frame">
|
||
<rect x="300" y="44" width="856" height="672" rx="14" fill="#0f131a" stroke="#2a3341"/>
|
||
<text x="320" y="78" font-size="16" letter-spacing="2" fill="#8d9cb0">VPS · UBUNTU 24.04 · НАТИВНО, БЕЗ DOCKER</text>
|
||
</g>
|
||
|
||
<!-- ===== nginx ===== -->
|
||
<g id="nginx-card">
|
||
<rect x="324" y="100" width="808" height="84" rx="10" fill="#141a23" stroke="#2a3341"/>
|
||
<rect x="324" y="100" width="5" height="84" rx="2" fill="#58a6ff"/>
|
||
<text x="346" y="136" font-size="26" font-weight="700" fill="#e6edf3">nginx</text>
|
||
<text x="346" y="166" font-size="19" fill="#8d9cb0">TLS · статика без PHP · urlrewrite · limit_req · gzip</text>
|
||
</g>
|
||
|
||
<!-- ===== php-fpm ===== -->
|
||
<g id="php-card">
|
||
<rect x="324" y="248" width="396" height="132" rx="10" fill="#141a23" stroke="#2a3341"/>
|
||
<rect x="324" y="248" width="5" height="132" rx="2" fill="#3fb950"/>
|
||
<text x="346" y="282" font-size="24" font-weight="700" fill="#e6edf3">php-fpm 8.4</text>
|
||
<text x="346" y="310" font-size="19" fill="#8d9cb0">pool «bitrix»: dynamic · max_children 30</text>
|
||
<text x="346" y="336" font-family="ui-monospace,SFMono-Regular,Consolas,monospace" font-size="17" fill="#8d9cb0">listen /run/php/bitrix-fpm.sock</text>
|
||
<text x="346" y="362" font-size="18" fill="#8d9cb0">max_requests 500 · slowlog > 5s</text>
|
||
</g>
|
||
|
||
<!-- ===== memcached x2 ===== -->
|
||
<g id="memcached-cards">
|
||
<rect x="792" y="248" width="340" height="62" rx="10" fill="#141a23" stroke="#2a3341"/>
|
||
<text x="812" y="276" font-size="20" font-weight="700" fill="#e6edf3">memcached · кэш</text>
|
||
<text x="812" y="300" font-family="ui-monospace,SFMono-Regular,Consolas,monospace" font-size="17" fill="#8d9cb0">127.0.0.1:11211 · igbinary</text>
|
||
|
||
<rect x="792" y="330" width="340" height="62" rx="10" fill="#141a23" stroke="#2a3341"/>
|
||
<text x="812" y="358" font-size="20" font-weight="700" fill="#e6edf3">memcached · сессии</text>
|
||
<text x="812" y="382" font-family="ui-monospace,SFMono-Regular,Consolas,monospace" font-size="17" fill="#8d9cb0">127.0.0.1:11212 · отдельно от кэша</text>
|
||
</g>
|
||
|
||
<!-- ===== mysql ===== -->
|
||
<g id="mysql-card">
|
||
<rect x="324" y="452" width="396" height="140" rx="10" fill="#141a23" stroke="#2a3341"/>
|
||
<rect x="324" y="452" width="5" height="140" rx="2" fill="#3fb950"/>
|
||
<text x="346" y="486" font-size="24" font-weight="700" fill="#e6edf3">Percona MySQL 8.0</text>
|
||
<text x="346" y="514" font-size="19" fill="#8d9cb0">innodb_buffer_pool_size = 4G</text>
|
||
<rect x="346" y="532" width="158" height="32" rx="8" fill="#f851491f" stroke="#f85149"/>
|
||
<text x="358" y="553" font-family="ui-monospace,SFMono-Regular,Consolas,monospace" font-size="16" fill="#f85149">✕ внешние :3306</text>
|
||
<rect x="516" y="532" width="182" height="32" rx="8" fill="#f851491f" stroke="#f85149"/>
|
||
<text x="528" y="553" font-family="ui-monospace,SFMono-Regular,Consolas,monospace" font-size="16" fill="#f85149">✕ только unix-сокет</text>
|
||
</g>
|
||
|
||
<!-- ===== cron и бэкапы ===== -->
|
||
<g id="cron-backup">
|
||
<rect x="792" y="452" width="340" height="64" rx="10" fill="#141a23" stroke="#2a3341"/>
|
||
<text x="812" y="480" font-size="20" font-weight="700" fill="#e6edf3">cron · CLI php</text>
|
||
<text x="812" y="504" font-size="17" fill="#8d9cb0">агенты раз в минуту · exchange */5</text>
|
||
|
||
<rect x="792" y="532" width="340" height="60" rx="10" fill="#141a23" stroke="#2a3341"/>
|
||
<text x="812" y="558" font-size="19" font-weight="700" fill="#e6edf3">бэкапы</text>
|
||
<text x="812" y="582" font-family="ui-monospace,SFMono-Regular,Consolas,monospace" font-size="16" fill="#8d9cb0">/var/backups/bitrix · 14 дней</text>
|
||
</g>
|
||
|
||
<!-- ===== периметр защиты ===== -->
|
||
<g id="security-band">
|
||
<rect x="324" y="612" width="808" height="88" rx="10" fill="#10151c" stroke="#2a3341" stroke-dasharray="6 5"/>
|
||
<text x="344" y="638" font-size="16" letter-spacing="2" fill="#8d9cb0">ЗАЩИТА ПЕРИМЕТРА</text>
|
||
|
||
<rect x="344" y="650" width="374" height="40" rx="8" fill="#141a23" stroke="#2a3341"/>
|
||
<text x="358" y="676" font-size="19" font-weight="700" fill="#e6edf3">CrowdSec</text>
|
||
<text x="486" y="676" font-size="17" fill="#8d9cb0">access.log · баны в nftables</text>
|
||
|
||
<rect x="742" y="650" width="366" height="40" rx="8" fill="#141a23" stroke="#2a3341"/>
|
||
<text x="756" y="676" font-size="19" font-weight="700" fill="#e6edf3">fail2ban</text>
|
||
<text x="862" y="676" font-size="17" fill="#8d9cb0">sshd jail · ban 1h</text>
|
||
</g>
|
||
|
||
<!-- ===== связи: запросы (синие) ===== -->
|
||
<g id="flows-http" stroke-width="2">
|
||
<path d="M228 248 H264 V142 H318" fill="none" stroke="#58a6ff" marker-end="url(#arrB)"/>
|
||
<text x="272" y="224" font-size="18" font-family="ui-monospace,SFMono-Regular,Consolas,monospace" fill="#58a6ff">HTTPS :443</text>
|
||
|
||
<path d="M500 186 V242" fill="none" stroke="#58a6ff" marker-end="url(#arrB)"/>
|
||
<text x="514" y="212" font-size="18" fill="#8d9cb0">fastcgi</text>
|
||
<text x="514" y="232" font-family="ui-monospace,SFMono-Regular,Consolas,monospace" font-size="16" fill="#8d9cb0">unix socket</text>
|
||
</g>
|
||
|
||
<!-- ===== связи: данные (зелёные / серые) ===== -->
|
||
<g id="flows-data" stroke-width="2">
|
||
<path d="M480 380 V446" fill="none" stroke="#3fb950" marker-end="url(#arrG)"/>
|
||
<text x="494" y="406" font-size="18" fill="#3fb950">localhost = сокет</text>
|
||
|
||
<path d="M720 290 H784" fill="none" stroke="#8d9cb0" marker-end="url(#arrN)"/>
|
||
<path d="M720 330 H784 V361 H784" fill="none" stroke="#8d9cb0"/>
|
||
|
||
<path d="M962 516 V526" fill="none" stroke="#8d9cb0" marker-end="url(#arrN)"/>
|
||
</g>
|
||
|
||
<!-- ===== связь: логи в защиту (янтарная пунктирная) ===== -->
|
||
<path d="M1136 146 H1152 V660 H1138" fill="none" stroke="#d29922" stroke-width="2" stroke-dasharray="7 5" marker-end="url(#arrA)"/>
|
||
|
||
<!-- ===== связь: блокировка (красная пунктирная) ===== -->
|
||
<path d="M322 656 H214 V304" fill="none" stroke="#f85149" stroke-width="2" stroke-dasharray="7 5" marker-end="url(#arrR)"/>
|
||
<text transform="rotate(-90 196 470)" x="196" y="470" text-anchor="middle" font-size="17" fill="#f85149">отбой атакующих</text>
|
||
|
||
<!-- ===== легенда ===== -->
|
||
<g id="legend" font-size="17" fill="#8d9cb0">
|
||
<path d="M120 744 H148" stroke="#58a6ff" stroke-width="2"/><text x="156" y="750">HTTP-запросы</text>
|
||
<path d="M330 744 H358" stroke="#3fb950" stroke-width="2"/><text x="366" y="750">сокеты и данные</text>
|
||
<path d="M580 744 H608" stroke="#d29922" stroke-width="2" stroke-dasharray="7 5"/><text x="616" y="750">журналы</text>
|
||
<path d="M790 744 H818" stroke="#f85149" stroke-width="2" stroke-dasharray="7 5"/><text x="826" y="750">блокировка</text>
|
||
</g>
|
||
|
||
</g>
|
||
</svg>
|
