1. 项目背景与核心价值在开发环境中搭建高效的代码中转站是提升团队协作效率的关键基础设施。Codex作为轻量级代码托管与中转解决方案相比GitLab等重型工具更适用于中小型项目快速部署。Ubuntu 20.04 LTS以其稳定的系统内核和长期支持特性成为服务器环境的首选操作系统之一。这个配置方案特别适合以下场景需要快速搭建临时代码协作节点的敏捷团队跨国开发组之间的代码缓存加速作为CI/CD流水线中的中间代码暂存区个人开发者多设备间的代码同步枢纽2. 系统环境准备2.1 基础系统配置首先确保系统为纯净的Ubuntu 20.04 LTS版本lsb_release -a预期输出应包含Ubuntu 20.04字样。接着更新软件源sudo apt update sudo apt upgrade -y重要提示生产环境建议使用最小化安装Minimal Installation模式减少不必要的软件包带来的安全风险。2.2 必要依赖安装Codex运行需要以下基础组件sudo apt install -y \ git \ python3-pip \ nginx \ supervisor \ redis-server \ libssl-dev \ zlib1g-dev对于Python虚拟环境推荐使用sudo pip3 install virtualenvwrapper echo export WORKON_HOME$HOME/.virtualenvs ~/.bashrc echo source /usr/local/bin/virtualenvwrapper.sh ~/.bashrc source ~/.bashrc3. Codex服务部署3.1 源码获取与虚拟环境创建专用用户并设置隔离环境sudo adduser --system --group codex sudo mkdir /opt/codex sudo chown codex:codex /opt/codex切换到虚拟环境部署sudo -u codex bash mkvirtualenv codex -p /usr/bin/python3 git clone https://github.com/your_codex_repo /opt/codex/src cd /opt/codex/src pip install -r requirements.txt3.2 配置文件定制关键配置文件示例/opt/codex/src/config/production.pyDEBUG False SECRET_KEY 生成你的32位随机密钥 DATABASES { default: { ENGINE: django.db.backends.postgresql, NAME: codex_db, USER: codex_user, PASSWORD: 强密码, HOST: localhost, PORT: 5432, } } REDIS_URL redis://localhost:6379/0数据库初始化命令python manage.py migrate python manage.py createsuperuser4. 服务化与优化4.1 Supervisor进程管理配置示例/etc/supervisor/conf.d/codex.conf[program:codex] command/home/codex/.virtualenvs/codex/bin/gunicorn -w 4 -b 127.0.0.1:8000 config.wsgi directory/opt/codex/src usercodex autostarttrue autorestarttrue stderr_logfile/var/log/codex.err.log stdout_logfile/var/log/codex.out.log启动服务sudo supervisorctl reread sudo supervisorctl update sudo supervisorctl start codex4.2 Nginx反向代理优化配置/etc/nginx/sites-available/codexupstream codex { server 127.0.0.1:8000; } server { listen 80; server_name your_domain.com; client_max_body_size 100M; keepalive_timeout 5; location / { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_redirect off; proxy_pass http://codex; } location /static/ { alias /opt/codex/src/staticfiles/; expires 30d; } }启用配置sudo ln -s /etc/nginx/sites-available/codex /etc/nginx/sites-enabled sudo nginx -t sudo systemctl restart nginx5. 安全加固措施5.1 基础安全配置防火墙规则设置sudo ufw allow ssh sudo ufw allow http sudo ufw allow https sudo ufw enableSSH安全增强sudo sed -i s/#PermitRootLogin prohibit-password/PermitRootLogin no/ /etc/ssh/sshd_config sudo sed -i s/#PasswordAuthentication yes/PasswordAuthentication no/ /etc/ssh/sshd_config sudo systemctl restart sshd5.2 Codex专项防护定期备份策略# 每日凌晨3点执行备份 0 3 * * * pg_dump -U codex_user -h localhost codex_db /backups/codex_$(date \%Y\%m\%d).sql日志轮转配置/etc/logrotate.d/codex/var/log/codex*.log { daily missingok rotate 30 compress delaycompress notifempty create 640 codex adm sharedscripts postrotate /usr/bin/supervisorctl restart codex /dev/null endscript }6. 性能调优实战6.1 数据库优化PostgreSQL专用配置/etc/postgresql/12/main/postgresql.confshared_buffers 2GB # 建议系统内存的25% effective_cache_size 6GB # 建议系统内存的50-75% maintenance_work_mem 512MB # 大型数据库可增至1GB random_page_cost 1.1 # SSD存储建议值 wal_buffers 16MB6.2 Gunicorn参数调整优化后的启动命令gunicorn -w $((2 * $(nproc) 1)) \ -b 127.0.0.1:8000 \ --max-requests 1000 \ --max-requests-jitter 50 \ --timeout 120 \ config.wsgi7. 日常运维要点7.1 监控方案部署基础监控配置sudo apt install -y prometheus-node-exporter sudo systemctl enable prometheus-node-exporterCodex健康检查端点示例# urls.py from django.urls import path from .views import health_check urlpatterns [ path(health/, health_check), ] # views.py from django.http import JsonResponse import redis from django.db import connection def health_check(request): try: connection.ensure_connection() r redis.Redis() r.ping() return JsonResponse({status: healthy}) except Exception as e: return JsonResponse({status: unhealthy, error: str(e)}, status500)7.2 升级维护流程标准升级步骤sudo -u codex bash workon codex cd /opt/codex/src git pull origin main pip install -r requirements.txt --upgrade python manage.py migrate python manage.py collectstatic --noinput exit sudo supervisorctl restart codex关键提示重大版本升级前务必执行数据库备份测试环境验证通过后再部署到生产环境。8. 故障排查手册8.1 常见问题速查表现象可能原因解决方案502 Bad GatewayGunicorn进程崩溃检查/var/log/codex.err.log增加worker数量静态资源404Nginx权限问题确保static目录有读取权限检查alias路径数据库连接失败PostgreSQL最大连接数耗尽增加max_connections或优化连接池上传大文件失败Nginx client_max_body_size限制调整nginx配置后重载服务8.2 日志分析技巧实时监控错误日志tail -f /var/log/codex.err.log | grep -E ERROR|CRITICAL请求耗时分析awk {print $1,$(NF-1)} /var/log/nginx/access.log | sort | uniq -c | sort -nr内存泄漏检测sudo -u codex bash workon codex pip install memray python -m memray run manage.py runserver
1. 项目背景与核心价值在开发环境中搭建高效的代码中转站是提升团队协作效率的关键基础设施。Codex作为轻量级代码托管与中转解决方案相比GitLab等重型工具更适用于中小型项目快速部署。Ubuntu 20.04 LTS以其稳定的系统内核和长期支持特性成为服务器环境的首选操作系统之一。这个配置方案特别适合以下场景需要快速搭建临时代码协作节点的敏捷团队跨国开发组之间的代码缓存加速作为CI/CD流水线中的中间代码暂存区个人开发者多设备间的代码同步枢纽2. 系统环境准备2.1 基础系统配置首先确保系统为纯净的Ubuntu 20.04 LTS版本lsb_release -a预期输出应包含Ubuntu 20.04字样。接着更新软件源sudo apt update sudo apt upgrade -y重要提示生产环境建议使用最小化安装Minimal Installation模式减少不必要的软件包带来的安全风险。2.2 必要依赖安装Codex运行需要以下基础组件sudo apt install -y \ git \ python3-pip \ nginx \ supervisor \ redis-server \ libssl-dev \ zlib1g-dev对于Python虚拟环境推荐使用sudo pip3 install virtualenvwrapper echo export WORKON_HOME$HOME/.virtualenvs ~/.bashrc echo source /usr/local/bin/virtualenvwrapper.sh ~/.bashrc source ~/.bashrc3. Codex服务部署3.1 源码获取与虚拟环境创建专用用户并设置隔离环境sudo adduser --system --group codex sudo mkdir /opt/codex sudo chown codex:codex /opt/codex切换到虚拟环境部署sudo -u codex bash mkvirtualenv codex -p /usr/bin/python3 git clone https://github.com/your_codex_repo /opt/codex/src cd /opt/codex/src pip install -r requirements.txt3.2 配置文件定制关键配置文件示例/opt/codex/src/config/production.pyDEBUG False SECRET_KEY 生成你的32位随机密钥 DATABASES { default: { ENGINE: django.db.backends.postgresql, NAME: codex_db, USER: codex_user, PASSWORD: 强密码, HOST: localhost, PORT: 5432, } } REDIS_URL redis://localhost:6379/0数据库初始化命令python manage.py migrate python manage.py createsuperuser4. 服务化与优化4.1 Supervisor进程管理配置示例/etc/supervisor/conf.d/codex.conf[program:codex] command/home/codex/.virtualenvs/codex/bin/gunicorn -w 4 -b 127.0.0.1:8000 config.wsgi directory/opt/codex/src usercodex autostarttrue autorestarttrue stderr_logfile/var/log/codex.err.log stdout_logfile/var/log/codex.out.log启动服务sudo supervisorctl reread sudo supervisorctl update sudo supervisorctl start codex4.2 Nginx反向代理优化配置/etc/nginx/sites-available/codexupstream codex { server 127.0.0.1:8000; } server { listen 80; server_name your_domain.com; client_max_body_size 100M; keepalive_timeout 5; location / { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_redirect off; proxy_pass http://codex; } location /static/ { alias /opt/codex/src/staticfiles/; expires 30d; } }启用配置sudo ln -s /etc/nginx/sites-available/codex /etc/nginx/sites-enabled sudo nginx -t sudo systemctl restart nginx5. 安全加固措施5.1 基础安全配置防火墙规则设置sudo ufw allow ssh sudo ufw allow http sudo ufw allow https sudo ufw enableSSH安全增强sudo sed -i s/#PermitRootLogin prohibit-password/PermitRootLogin no/ /etc/ssh/sshd_config sudo sed -i s/#PasswordAuthentication yes/PasswordAuthentication no/ /etc/ssh/sshd_config sudo systemctl restart sshd5.2 Codex专项防护定期备份策略# 每日凌晨3点执行备份 0 3 * * * pg_dump -U codex_user -h localhost codex_db /backups/codex_$(date \%Y\%m\%d).sql日志轮转配置/etc/logrotate.d/codex/var/log/codex*.log { daily missingok rotate 30 compress delaycompress notifempty create 640 codex adm sharedscripts postrotate /usr/bin/supervisorctl restart codex /dev/null endscript }6. 性能调优实战6.1 数据库优化PostgreSQL专用配置/etc/postgresql/12/main/postgresql.confshared_buffers 2GB # 建议系统内存的25% effective_cache_size 6GB # 建议系统内存的50-75% maintenance_work_mem 512MB # 大型数据库可增至1GB random_page_cost 1.1 # SSD存储建议值 wal_buffers 16MB6.2 Gunicorn参数调整优化后的启动命令gunicorn -w $((2 * $(nproc) 1)) \ -b 127.0.0.1:8000 \ --max-requests 1000 \ --max-requests-jitter 50 \ --timeout 120 \ config.wsgi7. 日常运维要点7.1 监控方案部署基础监控配置sudo apt install -y prometheus-node-exporter sudo systemctl enable prometheus-node-exporterCodex健康检查端点示例# urls.py from django.urls import path from .views import health_check urlpatterns [ path(health/, health_check), ] # views.py from django.http import JsonResponse import redis from django.db import connection def health_check(request): try: connection.ensure_connection() r redis.Redis() r.ping() return JsonResponse({status: healthy}) except Exception as e: return JsonResponse({status: unhealthy, error: str(e)}, status500)7.2 升级维护流程标准升级步骤sudo -u codex bash workon codex cd /opt/codex/src git pull origin main pip install -r requirements.txt --upgrade python manage.py migrate python manage.py collectstatic --noinput exit sudo supervisorctl restart codex关键提示重大版本升级前务必执行数据库备份测试环境验证通过后再部署到生产环境。8. 故障排查手册8.1 常见问题速查表现象可能原因解决方案502 Bad GatewayGunicorn进程崩溃检查/var/log/codex.err.log增加worker数量静态资源404Nginx权限问题确保static目录有读取权限检查alias路径数据库连接失败PostgreSQL最大连接数耗尽增加max_connections或优化连接池上传大文件失败Nginx client_max_body_size限制调整nginx配置后重载服务8.2 日志分析技巧实时监控错误日志tail -f /var/log/codex.err.log | grep -E ERROR|CRITICAL请求耗时分析awk {print $1,$(NF-1)} /var/log/nginx/access.log | sort | uniq -c | sort -nr内存泄漏检测sudo -u codex bash workon codex pip install memray python -m memray run manage.py runserver
)
