# Ubuntu/Debian
sudo apt update
sudo apt install -y mysql-server

# 启动 MySQL
sudo systemctl start mysql
sudo systemctl enable mysql

# 创建 Trillian 数据库
mysql -u root -p << 'EOF'
CREATE DATABASE trillian;
CREATE USER 'trillian'@'localhost' IDENTIFIED BY 'trillian_password';
GRANT ALL PRIVILEGES ON trillian.* TO 'trillian'@'localhost';
FLUSH PRIVILEGES;
EOF

# 克隆 Trillian 仓库
git clone https://github.com/google/trillian.git
cd trillian

# 编译
go build -o trillian-log-server ./cmd/trillian_log_server
go build -o trillian-log-signer ./cmd/trillian_log_signer
go build -o createtree ./cmd/createtree

# 移动到 PATH
sudo mv trillian-log-server trillian-log-signer createtree /usr/local/bin/

# 初始化数据库
mysql -u root -p trillian < storage/mysql/schema/storage.sql

# Ubuntu/Debian
sudo apt install -y redis-server
sudo systemctl start redis-server
sudo systemctl enable redis-server

# 验证
redis-cli ping
# PONG

# 启动 Trillian Log Server
trillian-log-server \
  --mysql_uri="trillian:trillian_password@tcp(localhost:3306)/trillian" \
  --rpc_endpoint=localhost:8090 \
  --http_endpoint=localhost:8091 \
  --logtostderr

# 后台运行
nohup trillian-log-server \
  --mysql_uri="trillian:trillian_password@tcp(localhost:3306)/trillian" \
  --rpc_endpoint=localhost:8090 \
  --http_endpoint=localhost:8091 \
  --logtostderr \
  > /var/log/trillian-server.log 2>&1 &

# 启动 Trillian Log Signer
trillian-log-signer \
  --mysql_uri="trillian:trillian_password@tcp(localhost:3306)/trillian" \
  --rpc_endpoint=localhost:8092 \
  --http_endpoint=localhost:8093 \
  --logtostderr \
  --force_master

# 后台运行
nohup trillian-log-signer \
  --mysql_uri="trillian:trillian_password@tcp(localhost:3306)/trillian" \
  --rpc_endpoint=localhost:8092 \
  --http_endpoint=localhost:8093 \
  --logtostderr \
  --force_master \
  > /var/log/trillian-signer.log 2>&1 &

# 创建透明日志树
createtree \
  --admin_server=localhost:8090 \
  --tree_type=LOG \
  --signature_algorithm=ECDSA

# 记录返回的 Tree ID，后续配置 rekor-server 需要
# 例如: Created tree with ID: 1234567890

# /etc/rekor/rekor-config.yaml
rekor_server:
  address: 0.0.0.0
  port: 3000

trillian:
  log_server:
    address: localhost
    port: 8090
  
  log_id: 1234567890  # 使用 createtree 返回的 ID

redis:
  address: localhost
  port: 6379
  # 如果不需要 Redis，注释以上两行

enable_attestation_storage: true

attestation_storage:
  backend: blob
  blob:
    bucket: "rekor-attestations"
    # 或使用本地文件系统
    path: "/var/lib/rekor/attestations"

max_apibase_log_entries: 0

log:
  type: "log"
  level: "info"

# 基本启动
rekor-server serve \
  --trillian_log_server.address=localhost \
  --trillian_log_server.port=8090 \
  --rekor_server.address=0.0.0.0 \
  --rekor_server.port=3000 \
  --log_type=log \
  --log_level=info

# 使用配置文件启动（如果支持）
rekor-server serve --config=/etc/rekor/rekor-config.yaml

# 后台运行
nohup rekor-server serve \
  --trillian_log_server.address=localhost \
  --trillian_log_server.port=8090 \
  --rekor_server.address=0.0.0.0 \
  --rekor_server.port=3000 \
  > /var/log/rekor-server.log 2>&1 &

# 测试 Rekor Server
curl -s http://localhost:3000/api/v1/log | jq '.'

# 使用 rekor-cli
rekor-cli loginfo --rekor_server=http://localhost:3000

# 测试写入
echo "test" > /tmp/test.txt
cosign sign-blob \
  --rekor-url=http://localhost:3000 \
  --key cosign.key \
  --yes \
  /tmp/test.txt

# /etc/systemd/system/trillian-log-server.service
[Unit]
Description=Trillian Log Server
After=network.target mysql.service
Requires=mysql.service

[Service]
Type=simple
User=trillian
Group=trillian
ExecStart=/usr/local/bin/trillian-log-server \
  --mysql_uri=trillian:trillian_password@tcp(localhost:3306)/trillian \
  --rpc_endpoint=localhost:8090 \
  --http_endpoint=localhost:8091 \
  --logtostderr
Restart=always
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/trillian-log-signer.service
[Unit]
Description=Trillian Log Signer
After=network.target mysql.service trillian-log-server.service
Requires=mysql.service

[Service]
Type=simple
User=trillian
Group=trillian
ExecStart=/usr/local/bin/trillian-log-signer \
  --mysql_uri=trillian:trillian_password@tcp(localhost:3306)/trillian \
  --rpc_endpoint=localhost:8092 \
  --http_endpoint=localhost:8093 \
  --logtostderr \
  --force_master
Restart=always
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/rekor-server.service
[Unit]
Description=Rekor Server
After=network.target trillian-log-server.service redis.service
Requires=trillian-log-server.service

[Service]
Type=simple
User=rekor
Group=rekor
ExecStart=/usr/local/bin/rekor-server serve \
  --trillian_log_server.address=localhost \
  --trillian_log_server.port=8090 \
  --rekor_server.address=0.0.0.0 \
  --rekor_server.port=3000 \
  --redis_server.address=localhost \
  --redis_server.port=6379 \
  --log_type=log \
  --log_level=info
Restart=always
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

# 创建用户
sudo useradd -r -s /bin/false trillian
sudo useradd -r -s /bin/false rekor

# 创建目录
sudo mkdir -p /var/lib/rekor/attestations
sudo chown rekor:rekor /var/lib/rekor/attestations

# 重载 systemd
sudo systemctl daemon-reload

# 启动服务
sudo systemctl start trillian-log-server
sudo systemctl start trillian-log-signer
sudo systemctl start rekor-server

# 设置开机自启
sudo systemctl enable trillian-log-server
sudo systemctl enable trillian-log-signer
sudo systemctl enable rekor-server

# 检查状态
sudo systemctl status rekor-server

# /etc/nginx/sites-available/rekor
upstream rekor_backend {
    server 127.0.0.1:3000;
    # 多实例时添加更多后端
    # server 127.0.0.1:3001;
    # server 127.0.0.1:3002;
}

server {
    listen 80;
    server_name rekor.internal.mycompany.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name rekor.internal.mycompany.com;

    ssl_certificate /etc/nginx/ssl/rekor.crt;
    ssl_certificate_key /etc/nginx/ssl/rekor.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    # 速率限制
    limit_req_zone $binary_remote_addr zone=rekor_limit:10m rate=100r/s;

    location / {
        limit_req zone=rekor_limit burst=200 nodelay;
        
        proxy_pass http://rekor_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # 超时设置
        proxy_connect_timeout 10s;
        proxy_read_timeout 30s;
        proxy_send_timeout 30s;
        
        # 缓冲设置
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 16k;
    }

    # 健康检查
    location /healthz {
        access_log off;
        proxy_pass http://rekor_backend/api/v1/log;
    }
}

sudo ln -s /etc/nginx/sites-available/rekor /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

-- MySQL 优化配置 (my.cnf)
[mysqld]
# InnoDB 设置
innodb_buffer_pool_size = 4G
innodb_log_file_size = 256M
innodb_flush_log_at_trx_commit = 2
innodb_flush_method = O_DIRECT

# 连接设置
max_connections = 200
wait_timeout = 600

# 查询缓存（MySQL 8.0 之前）
# query_cache_type = 1
# query_cache_size = 256M

# 慢查询日志
slow_query_log = 1
slow_query_log_file = /var/log/mysql/slow.log
long_query_time = 1

#!/bin/bash
# backup-rekor.sh - Rekor 数据库备份脚本

BACKUP_DIR="/var/backup/rekor"
DATE=$(date +%Y%m%d_%H%M%S)
MYSQL_USER="trillian"
MYSQL_PASS="trillian_password"
DATABASE="trillian"

mkdir -p "$BACKUP_DIR"

# 数据库备份
mysqldump -u "$MYSQL_USER" -p"$MYSQL_PASS" "$DATABASE" | gzip > "$BACKUP_DIR/trillian_$DATE.sql.gz"

# 清理 30 天前的备份
find "$BACKUP_DIR" -name "*.sql.gz" -mtime +30 -delete

echo "备份完成: $BACKUP_DIR/trillian_$DATE.sql.gz"

# 设置定时备份
# crontab -e
0 2 * * * /opt/rekor/scripts/backup-rekor.sh >> /var/log/rekor-backup.log 2>&1

-- 主服务器配置 (my.cnf)
[mysqld]
server-id = 1
log_bin = /var/log/mysql/mysql-bin.log
binlog_do_db = trillian

-- 从服务器配置 (my.cnf)
[mysqld]
server-id = 2
relay_log = /var/log/mysql/mysql-relay-bin.log
log_bin = /var/log/mysql/mysql-bin.log
binlog_do_db = trillian
read_only = 1

-- 在从服务器上设置复制
CHANGE MASTER TO
  MASTER_HOST='192.168.1.10',
  MASTER_USER='replication_user',
  MASTER_PASSWORD='replication_password',
  MASTER_LOG_FILE='mysql-bin.000001',
  MASTER_LOG_POS=0;

START SLAVE;
SHOW SLAVE STATUS\G

# prometheus.yml
scrape_configs:
  - job_name: 'rekor-server'
    static_configs:
      - targets: ['localhost:3000']
    metrics_path: /metrics
    scrape_interval: 15s

  - job_name: 'trillian-log-server'
    static_configs:
      - targets: ['localhost:8091']
    metrics_path: /metrics
    scrape_interval: 15s

  - job_name: 'trillian-log-signer'
    static_configs:
      - targets: ['localhost:8093']
    metrics_path: /metrics
    scrape_interval: 15s

{
  "dashboard": {
    "title": "Rekor Server Dashboard",
    "panels": [
      {
        "title": "Request Rate",
        "type": "graph",
        "targets": [
          {
            "expr": "rate(rekor_http_requests_total[5m])",
            "legendFormat": "{{method}} {{path}}"
          }
        ]
      },
      {
        "title": "Request Latency (P99)",
        "type": "graph",
        "targets": [
          {
            "expr": "histogram_quantile(0.99, rate(rekor_http_request_duration_seconds_bucket[5m]))",
            "legendFormat": "P99 Latency"
          }
        ]
      },
      {
        "title": "Tree Size",
        "type": "stat",
        "targets": [
          {
            "expr": "trillian_sequencer_tree_size",
            "legendFormat": "Entries"
          }
        ]
      }
    ]
  }
}

# 生成自签名证书（测试环境）
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/ssl/private/rekor.key \
  -out /etc/ssl/certs/rekor.crt \
  -subj "/CN=rekor.internal.mycompany.com"

# 生产环境建议使用企业 CA 签发的证书

# 如果需要 API 认证，配置 Nginx basic auth
sudo apt install -y apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd rekor_user

# 在 Nginx 配置中添加
# auth_basic "Rekor API";
# auth_basic_user_file /etc/nginx/.htpasswd;

# UFW 配置
sudo ufw allow 22/tcp    # SSH
sudo ufw allow 443/tcp   # HTTPS
sudo ufw allow 80/tcp    # HTTP (重定向到 HTTPS)
sudo ufw deny 3000/tcp   # 阻止直接访问 Rekor
sudo ufw deny 8090/tcp   # 阻止直接访问 Trillian RPC
sudo ufw deny 3306/tcp   # 阻止直接访问 MySQL
sudo ufw enable