Fabric1.4.1-solo模式的部署

Fabric solo模式的部署

本次部署基于solo模式部署，准备一台虚拟机就可以了。

环境准备

这一步主要是去初始化虚拟机的环境，拉取镜像和下载相关的工具。(做过这一步的同学可以略过这一步)

参考我的博客：Fabric部署环境初始化

下载工具

工具下载：hyperledger-fabric-linux-amd64-1.4.1.tar.gz

下载之后解压，在其文件夹中的"bin"目录下有"cryptogen"和"configtxgen"等工具。（复制到"fabric_solo/bin"目录中）

拉取镜像

# 下载脚本(没有安装curl命令，请自行安装-<yum install -y curl>)
curl -sS https://raw.githubusercontent.com/hyperledger/fabric/master/scripts/bootstrap.sh -o ./bootstrap.sh

# 赋予脚本执行权限
chmod +x ./bootstrap.sh

# 执行脚本来克隆fabric-samples库
# 镜像我们在前面的课程拉取过，这里跳过特定平台二进制文件的下载（很慢，自行通过浏览器下载，再上传到虚拟机）
./bootstrap.sh 1.4.1 1.4.1 0.4.15 -s -b

目录结构

fabric_solo
.
├── bin
│   ├── configtxgen
│   └── cryptogen
├── bootstrap.sh
├── channel-artifacts
│   └── ...
├── docker-solo.yaml
└── e2e-Orgs
    ├── configtx.yaml
    ├── crypto-config
    │   └── ...
    └── crypto-config.yaml

编写、生成配置

  1. 编写crypto-config.yaml
# ---------------------------------------------------------------------------
# "OrdererOrgs" - Definition of organizations managing orderer nodes
# ---------------------------------------------------------------------------
OrdererOrgs:
  # ---------------------------------------------------------------------------
  # Orderer
  # ---------------------------------------------------------------------------
  - Name: Orderer
    Domain: example.com
    CA:
        Country: US
        Province: California
        Locality: San Francisco
    Specs:
      - Hostname: orderer
# ---------------------------------------------------------------------------
# "PeerOrgs" - Definition of organizations managing peer nodes
# ---------------------------------------------------------------------------
PeerOrgs:
  # ---------------------------------------------------------------------------
  # Org1
  # ---------------------------------------------------------------------------
  - Name: Org1
    Domain: org1.example.com
    EnableNodeOUs: true
    CA:
        Country: US
        Province: California
        Locality: San Francisco
    # Template:
    #   Count: 2
    Users:
      Count: 1
    Specs:
      - Hostname: peer0
      - Hostname: peer1
  1. 编写configtx.yaml
################################################################################
#
#   ORGANIZATIONS
#
################################################################################
Organizations:
    - &OrdererOrg
        Name: OrdererOrg
        ID: OrdererMSP
        MSPDir: crypto-config/ordererOrganizations/example.com/msp
        Policies:
            Readers:
                Type: Signature
                Rule: "OR('OrdererMSP.member')"
            Writers:
                Type: Signature
                Rule: "OR('OrdererMSP.member')"
            Admins:
                Type: Signature
                Rule: "OR('OrdererMSP.admin')"

    - &Org1
        Name: Org1
        ID: Org1MSP
        MSPDir: crypto-config/peerOrganizations/org1.example.com/msp
        Policies:
            Readers:
                Type: Signature
                Rule: "OR('Org1MSP.member')"
            Writers:
                Type: Signature
                Rule: "OR('Org1MSP.member')"
            Admins:
                Type: Signature
                Rule: "OR('Org1MSP.admin')"
        AnchorPeers:
            - Host: peer0.org1.example.com
              Port: 7051

################################################################################
#
#   CAPABILITIES
#
################################################################################
Capabilities:
    Channel: &ChannelCapabilities
        V1_3: true

    Orderer: &OrdererCapabilities
        V1_1: true

    Application: &ApplicationCapabilities
        V1_3: true
        V1_2: false
        V1_1: false

################################################################################
#
#   APPLICATION
#
################################################################################
Application: &ApplicationDefaults
    ACLs: &ACLsDefault
        #---Lifecycle System Chaincode (lscc) function to policy mapping for access control---#
        # ACL policy for lscc's "getid" function
        lscc/ChaincodeExists: /Channel/Application/Readers
        # ACL policy for lscc's "getdepspec" function
        lscc/GetDeploymentSpec: /Channel/Application/Readers
        # ACL policy for lscc's "getccdata" function
        lscc/GetChaincodeData: /Channel/Application/Readers
        # ACL Policy for lscc's "getchaincodes" function
        lscc/GetInstantiatedChaincodes: /Channel/Application/Readers
        #---Query System Chaincode (qscc) function to policy mapping for access control---#
        # ACL policy for qscc's "GetChainInfo" function
        qscc/GetChainInfo: /Channel/Application/Readers
        # ACL policy for qscc's "GetBlockByNumber" function
        qscc/GetBlockByNumber: /Channel/Application/Readers
        # ACL policy for qscc's  "GetBlockByHash" function
        qscc/GetBlockByHash: /Channel/Application/Readers
        # ACL policy for qscc's "GetTransactionByID" function
        qscc/GetTransactionByID: /Channel/Application/Readers
        # ACL policy for qscc's "GetBlockByTxID" function
        qscc/GetBlockByTxID: /Channel/Application/Readers
        #---Configuration System Chaincode (cscc) function to policy mapping for access control---#
        # ACL policy for cscc's "GetConfigBlock" function
        cscc/GetConfigBlock: /Channel/Application/Readers
        # ACL policy for cscc's "GetConfigTree" function
        cscc/GetConfigTree: /Channel/Application/Readers
        # ACL policy for cscc's "SimulateConfigTreeUpdate" function
        cscc/SimulateConfigTreeUpdate: /Channel/Application/Readers
        #---Miscellanesous peer function to policy mapping for access control---#
        # ACL policy for invoking chaincodes on peer
        peer/Propose: /Channel/Application/Writers
        # ACL policy for chaincode to chaincode invocation
        peer/ChaincodeToChaincode: /Channel/Application/Readers
        #---Events resource to policy mapping for access control###---#
        # ACL policy for sending block events
        event/Block: /Channel/Application/Readers
        # ACL policy for sending filtered block events
        event/FilteredBlock: /Channel/Application/Readers

    Organizations:

    Policies:
        Readers:
            Type: ImplicitMeta
            Rule: "ANY Readers"
        Writers:
            Type: ImplicitMeta
            Rule: "ANY Writers"
        Admins:
            Type: ImplicitMeta
            Rule: "MAJORITY Admins"

    Capabilities:
        <<: *ApplicationCapabilities

################################################################################
#
#   ORDERER
#
################################################################################
Orderer: &OrdererDefaults
    OrdererType: solo
    Addresses:
        - orderer.example.com:7050
    BatchTimeout: 2s
    BatchSize:
        MaxMessageCount: 10
        AbsoluteMaxBytes: 10 MB
        PreferredMaxBytes: 512 KB
    MaxChannels: 0
    Organizations:

    Policies:
        Readers:
            Type: ImplicitMeta
            Rule: "ANY Readers"
        Writers:
            Type: ImplicitMeta
            Rule: "ANY Writers"
        Admins:
            Type: ImplicitMeta
            Rule: "MAJORITY Admins"
        BlockValidation:
            Type: ImplicitMeta
            Rule: "ANY Writers"

    Capabilities:
        <<: *OrdererCapabilities

################################################################################
#
#   CHANNEL
#
################################################################################
Channel: &ChannelDefaults
    # Policies defines the set of policies at this level of the config tree
    # For Channel policies, their canonical path is
    #   /Channel/<PolicyName>
    Policies:
        # Who may invoke the 'Deliver' API
        Readers:
            Type: ImplicitMeta
            Rule: "ANY Readers"
        # Who may invoke the 'Broadcast' API
        Writers:
            Type: ImplicitMeta
            Rule: "ANY Writers"
        # By default, who may modify elements at this config level
        Admins:
            Type: ImplicitMeta
            Rule: "MAJORITY Admins"

    Capabilities:
        <<: *ChannelCapabilities

################################################################################
#
#   Profile
#
################################################################################
Profiles:
    OrgsOrdererGenesis:
        Orderer:
            <<: *OrdererDefaults
            Organizations:
                - *OrdererOrg
        Consortiums:
            SampleConsortium:
                Organizations:
                    - *Org1

    OrgsChannel:
        Consortium: SampleConsortium
        Application:
            <<: *ApplicationDefaults
            Organizations:
                - *Org1
  1. 生成组织证书
./bin/cryptogen generate \
--config ./e2e-Orgs/crypto-config.yaml \
--output ./e2e-Orgs/crypto-config/
  1. 生成创始区块
./bin/configtxgen \
--profile OrgsOrdererGenesis \
--channelID thyc-sys-channel \
--configPath ./e2e-Orgs \
--outputBlock ./channel-artifacts/genesis.block
  1. 生成通道配置

Note: 这个可以放在网络启起来之后再去做。

./bin/configtxgen \
--profile OrgsChannel \
--channelID mychannel \
--configPath ./e2e-Orgs \
--outputCreateChannelTx ./channel-artifacts/mychannel.tx
  1. 组织锚节点更新配置

Note: 这个可以放在网络启起来之后,或者通道创建之后再去做，根据实际的需求来决定是否设置锚节点。

./bin/configtxgen \
--profile OrgsChannel --channelID mychannel \
--asOrg Org1 --configPath ./e2e-Orgs/ \
--outputAnchorPeersUpdate ./channel-artifacts/Org1anchors.tx
  1. 编写docker_solo.yaml

使用tree命令可以直接查看目录结构（没有这个命令的请自行安装-<yum install -y tree>）

在去这个e2e-Orgs/crypto-config/peerOrganizations/org1.example.com/ca目录下找到私钥文件。
替换ca0服务下的 FABRIC_CA_SERVER_CA_KEYFILE 这个环境变量的私钥 ff0496478eb06f82d005a06d04d73dc658d785bf2985b15a363bfa82f34530de_sk

# 版本
version: '2'

# 网络
networks:
  basic:
    driver: bridge

# 服务
services:
  # run ca0
  ca0:
    image: hyperledger/fabric-ca:${IMAGE_TAG_FABRIC_CA}
    container_name: ca0.org1.example.com
    restart: always
    environment:
    - FABRIC_CA_SERVER_HOME=/etc/hyperledger/fabric-ca-server
    - FABRIC_CA_SERVER_CA_NAME=ca0
    - FABRIC_CA_SERVER_CA_CERTFILE=/etc/hyperledger/fabric-ca-server-config/ca.org1.example.com-cert.pem
    - FABRIC_CA_SERVER_CA_KEYFILE=/etc/hyperledger/fabric-ca-server-config/7b08f2f2ee4987547e19cb8023020c6d8177a20f894966ff1b41bf341cc6b9ed_sk
    - FABRIC_CA_SERVER_TLS_CERTFILE=/etc/hyperledger/fabric-ca-server-config/ca.org1.example.com-cert.pem
    - FABRIC_CA_SERVER_TLS_KEYFILE=/etc/hyperledger/fabric-ca-server-config/7b08f2f2ee4987547e19cb8023020c6d8177a20f894966ff1b41bf341cc6b9ed_sk
    - FABRIC_CA_SERVER_REGISTRY_MAXENROLLMENTS=-1
    command: sh -c 'mkdir -p /etc/hyperledger/fabric-ca-server;cp -R /tmp/msp /etc/hyperledger/fabric-ca-server; mv /etc/hyperledger/fabric-ca-server/msp/*PublicKey /etc/hyperledger/fabric-ca-server; fabric-ca-server start -b admin:adminpw ${V11_IDENTITIES_ALLOWREMOVE} ${V11_AFFILIATIONS_ALLOWREMOVE} ${ORG_HYPERLEDGER_FABRIC_SDKTEST_INTEGRATIONTESTS_CA_TLS} -d'
    volumes:
    # - ./fabric-data/:/etc/hyperledger/fabric-ca-server
    - ./e2e-Orgs/crypto-config/peerOrganizations/org1.example.com/ca/:/etc/hyperledger/fabric-ca-server-config:ro
    - ./e2e-Orgs/crypto-config/peerOrganizations/org1.example.com/msp/:/tmp/msp:ro
    ports:
    - 7054:7054
    networks:
    - basic

  # run orderer
  orderer.example.com:
    image: hyperledger/fabric-orderer:${IMAGE_TAG_FABRIC}
    container_name: orderer.example.com
    restart: always
    environment:
    - FABRIC_LOGGING_SPEC=INFO
    - ORDERER_GENERAL_LISTENADDRESS=0.0.0.0
    - ORDERER_GENERAL_GENESISMETHOD=file
    # 指定创世区块文件
    - ORDERER_GENERAL_GENESISFILE=/etc/hyperledger/configtx/genesis.block
    - ORDERER_GENERAL_LOCALMSPID=OrdererMSP
    - ORDERER_GENERAL_LOCALMSPDIR=/etc/hyperledger/msp/orderer/msp
    # 是否开启TLS，该变量的值在.env中定义
    - ORDERER_GENERAL_TLS_ENABLED=${ORG_HYPERLEDGER_FABRIC_SDKTEST_INTEGRATIONTESTS_TLS}
    # 是否开启客户端授权，该变量的值在.env中定义
    - ORDERER_GENERAL_TLS_CLIENTAUTHREQUIRED=${ORG_HYPERLEDGER_FABRIC_SDKTEST_INTEGRATIONTESTS_CLIENT_AUTH_REQUIRED}
    - ORDERER_GENERAL_TLS_PRIVATEKEY=/etc/hyperledger/msp/orderer/tls/server.key
    - ORDERER_GENERAL_TLS_CERTIFICATE=/etc/hyperledger/msp/orderer/tls/server.crt
    - ORDERER_GENERAL_TLS_ROOTCAS=[/etc/hyperledger/msp/orderer/tls/ca.crt]
    - ORDERER_GENERAL_TLS_CLIENTROOTCAS=[/etc/hyperledger/msp/peerOrg1/msp/tlscacerts/tlsca.org1.example.com-cert.pem]
    - GRPC_TRACE=all=true
    - GRPC_VERBOSITY=info
    - ORDERER_GENERAL_AUTHENTICATION_TIMEWINDOW=3600s #Not for production -- remove.
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric
    command: orderer
    volumes:
    # - ./fabric-data/:/var/hyperledger/production
    - ./channel-artifacts:/etc/hyperledger/configtx:ro
    # 虚拟机向容器共享orderer节点的相关文件
    - ./e2e-Orgs/crypto-config/ordererOrganizations/example.com/orderers/orderer.example.com/:/etc/hyperledger/msp/orderer:ro
    # 虚拟机向容器共享组织1的peer0节点的证书文件
    - ./e2e-Orgs/crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/:/etc/hyperledger/msp/peerOrg1:ro
    ports:
    - 7050:7050
    extra_hosts:
    - "peer1.org1.example.com:192.168.1.202"
    - "peer0.org1.example.com:192.168.1.202"
    networks:
    - basic

  # run peer0Org1
  peer0.org1.example.com:
    image: hyperledger/fabric-peer:${IMAGE_TAG_FABRIC}
    container_name: peer0.org1.example.com
    restart: always
    environment:
    - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
    - CORE_VM_DOCKER_HOSTCONFIG_NETWORKMODE=fabric_basic
    - FABRIC_LOGGING_SPEC=INFO
    - CORE_PEER_ENDORSER_ENABLED=true
    - CORE_PEER_GOSSIP_USELEADERELECTION=true
    - CORE_PEER_GOSSIP_ORGLEADER=false
    - CORE_PEER_CHANNELSERVICE_ENABLED=true
    - CORE_CHAINCODE_STARTUPTIMEOUT=10m
    - CORE_PEER_MSPCONFIGPATH=/etc/hyperledger/msp/peer/msp
    - CORE_PEER_PROFILE_ENABLED=false
    - CORE_PEER_TLS_ENABLED=${ORG_HYPERLEDGER_FABRIC_SDKTEST_INTEGRATIONTESTS_TLS}
    - CORE_PEER_TLS_CLIENTAUTHREQUIRED=${ORG_HYPERLEDGER_FABRIC_SDKTEST_INTEGRATIONTESTS_CLIENT_AUTH_REQUIRED}
    - CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/msp/peer/tls/server.crt
    - CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/msp/peer/tls/server.key
    - CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/msp/peer/tls/ca.crt
    # ------
    - CORE_PEER_ID=peer0.org1.example.com
    - CORE_PEER_ADDRESS=peer0.org1.example.com:7051
    - CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer0.org1.example.com:7051
    - CORE_PEER_LOCALMSPID=Org1MSP
    - CORE_PEER_GOSSIP_BOOTSTRAP=peer1.org1.example.com:7056
    # - CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/msp/peer/msp/cacerts/ca.org1.example.com-cert.pem
    - CORE_PEER_TLS_CLIENTROOTCAS_FILES=/etc/hyperledger/msp/peer/msp/tlscacerts/tlsca.org1.example.com-cert.pem
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer
    command: peer node start
    volumes:
    # - ./fabric-data/:/var/hyperledger/production
    - /var/run/:/host/var/run/
    - ./e2e-Orgs/crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/:/etc/hyperledger/msp/peer:ro
    ports:
    - 7051:7051
    depends_on:
    - orderer.example.com
    extra_hosts:
    - "peer1.org1.example.com:192.168.1.202"
    networks:
    - basic

  # run peer1Org1
  peer1.org1.example.com:
    image: hyperledger/fabric-peer:${IMAGE_TAG_FABRIC}
    container_name: peer1.org1.example.com
    restart: always
    environment:
    - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
    - CORE_VM_DOCKER_HOSTCONFIG_NETWORKMODE=fabric_basic
    - FABRIC_LOGGING_SPEC=INFO
    - CORE_PEER_ENDORSER_ENABLED=true
    - CORE_PEER_GOSSIP_USELEADERELECTION=true
    - CORE_PEER_GOSSIP_ORGLEADER=false
    - CORE_PEER_CHANNELSERVICE_ENABLED=true
    - CORE_CHAINCODE_STARTUPTIMEOUT=10m
    - CORE_PEER_MSPCONFIGPATH=/etc/hyperledger/msp/peer/msp
    - CORE_PEER_PROFILE_ENABLED=false
    - CORE_PEER_TLS_ENABLED=${ORG_HYPERLEDGER_FABRIC_SDKTEST_INTEGRATIONTESTS_TLS}
    - CORE_PEER_TLS_CLIENTAUTHREQUIRED=${ORG_HYPERLEDGER_FABRIC_SDKTEST_INTEGRATIONTESTS_CLIENT_AUTH_REQUIRED}
    - CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/msp/peer/tls/server.crt
    - CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/msp/peer/tls/server.key
    - CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/msp/peer/tls/ca.crt
    # ------
    - CORE_PEER_ID=peer1.org1.example.com
    - CORE_PEER_ADDRESS=peer1.org1.example.com:7051
    - CORE_PEER_LISTENADDRESS=peer1.org1.example.com:7051
    - CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer1.org1.example.com:7051
    - CORE_PEER_GOSSIP_BOOTSTRAP=peer0.org1.example.com:7051
    - CORE_PEER_LOCALMSPID=Org1MSP
    # - CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/msp/peer/msp/cacerts/ca.org1.example.com-cert.pem
    - CORE_PEER_TLS_CLIENTROOTCAS_FILES=/etc/hyperledger/msp/peer/msp/tlscacerts/tlsca.org1.example.com-cert.pem
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer
    command: peer node start
    volumes:
    # - ./fabric-data/:/var/hyperledger/production
    - /var/run/:/host/var/run/
    - ./e2e-Orgs/crypto-config/peerOrganizations/org1.example.com/peers/peer1.org1.example.com/:/etc/hyperledger/msp/peer:ro
    ports:
    - 7056:7051
    depends_on:
    - orderer.example.com
    - peer0.org1.example.com
    extra_hosts:
    - "peer0.org1.example.com:192.168.1.202"
    networks:
    - basic
  1. 环境变量文件.env
#default env. vars settings
#TLS:
#ORG_HYPERLEDGER_FABRIC_SDKTEST_INTEGRATIONTESTS_TLS=true
#ORG_HYPERLEDGER_FABRIC_SDKTEST_INTEGRATIONTESTS_CA_TLS=--tls.enabled
ORG_HYPERLEDGER_FABRIC_SDKTEST_INTEGRATIONTESTS_TLS=false
ORG_HYPERLEDGER_FABRIC_SDKTEST_INTEGRATIONTESTS_CA_TLS=
ORG_HYPERLEDGER_FABRIC_SDKTEST_INTEGRATIONTESTS_CLIENT_AUTH_REQUIRED=false
# docker-compose config for setting project name
COMPOSE_PROJECT_NAME=fabric

#
#Image tags - Fabric versions.

##V 1.4.1
# yes we reuse 1.3 since no change in fabric.
V11_IDENTITIES_ALLOWREMOVE=--cfg.identities.allowremove
V11_AFFILIATIONS_ALLOWREMOVE=--cfg.affiliations.allowremove
IMAGE_TAG_FABRIC=1.4.1
IMAGE_TAG_FABRIC_CA=1.4.1

启动网络

# 使用docker-compose来启动网络
docker-compose -f ./docker-solo.yaml up -d
# 强制重新创建
docker-compose -f ./docker-solo.yaml up --force-recreate -d

验证网络

这里就使用Fabric-java-sdk去检验网络。因为后面章节的课程，我讲SDK

其他命令

# 停止并移除所有容器
docker stop $(docker ps -aq) && docker rm $(docker ps -aq)
posted @ 2020-04-10 10:43  itwetouch  阅读(628)  评论(0)  编辑  收藏  举报