第 12 章：系统集成、测试与发布

12.1 集成测试策略

测试层次与覆盖目标

API 集成测试示例

"""tests/integration/test_disk_api.py — 磁盘管理 API 集成测试"""

import pytest
from httpx import AsyncClient, ASGITransport
from nas.main import app  # FastAPI 应用实例


@pytest.fixture
async def client():
    """创建测试客户端"""
    transport = ASGITransport(app=app)
    async with AsyncClient(transport=transport, base_url="http://test") as ac:
        yield ac


@pytest.fixture
def auth_headers():
    """获取测试认证令牌"""
    return {"Authorization": "Bearer test_token_admin"}


class TestDiskAPI:
    """磁盘管理 API 集成测试"""

    @pytest.mark.integration
    async def test_list_disks_requires_auth(self, client):
        """未认证用户应被拒绝"""
        response = await client.get("/api/disks/")
        assert response.status_code == 401

    @pytest.mark.integration
    async def test_list_disks_returns_array(self, client, auth_headers):
        """认证用户可获取磁盘列表"""
        response = await client.get("/api/disks/", headers=auth_headers)
        assert response.status_code == 200
        data = response.json()
        assert "disks" in data
        assert isinstance(data["disks"], list)

    @pytest.mark.integration
    async def test_get_nonexistent_disk(self, client, auth_headers):
        """不存在的磁盘返回 404"""
        response = await client.get("/api/disks/sdzzz", headers=auth_headers)
        assert response.status_code == 404

    @pytest.mark.integration
    async def test_mount_nonexistent_device(self, client, auth_headers):
        """挂载不存在的设备返回 400"""
        response = await client.post(
            "/api/disks/mount",
            headers=auth_headers,
            json={"device": "/dev/sdzzz", "mount_point": "test", "fs_type": "ext4"}
        )
        assert response.status_code == 400

12.2 安全加固

安全加固清单

安全加固脚本

#!/bin/bash
# scripts/harden.sh — NAS 系统安全加固脚本

set -euo pipefail

echo "🔒 开始 NAS 系统安全加固..."

# 1. 配置防火墙
echo "  → 配置防火墙规则..."
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp    comment 'SSH'
ufw allow 80/tcp    comment 'HTTP'
ufw allow 443/tcp   comment 'HTTPS'
ufw allow 445/tcp   comment 'SMB'
ufw allow 2049/tcp  comment 'NFS'
ufw --force enable

# 2. SSH 加固
echo "  → 加固 SSH 配置..."
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/^#MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config
systemctl reload sshd

# 3. 内核安全参数
echo "  → 设置内核安全参数..."
cat > /etc/sysctl.d/99-nas-security.conf <<'EOF'
# 防止 IP 欺骗
net.ipv4.conf.all.rp_filter = 1
# 忽略 ICMP 广播
net.ipv4.icmp_echo_ignore_broadcasts = 1
# 防止 SYN 洪水
net.ipv4.tcp_syncookies = 1
# 记录可疑包
net.ipv4.conf.all.log_martians = 1
EOF
sysctl -p /etc/sysctl.d/99-nas-security.conf

# 4. 文件权限加固
echo "  → 加固关键文件权限..."
chmod 640 /etc/shadow
chmod 644 /etc/passwd
chmod 640 /etc/samba/smb.conf

# 5. 删除不必要的包
echo "  → 清理不必要的软件包..."
apt-get purge -y telnetd rsh-server 2>/dev/null || true

echo "✅ 安全加固完成"

12.3 部署打包

一键安装脚本

#!/bin/bash
# scripts/install.sh — NAS 系统一键安装脚本
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
NAS_HOME="/opt/nas-os"
VENV_DIR="$NAS_HOME/venv"

echo "🚀 开始安装 NAS 操作系统..."
echo "================================"

# 1. 系统依赖
echo "📦 安装系统依赖..."
apt-get update
apt-get install -y --no-install-recommends \
    python3.11 python3.11-venv python3-pip \
    samba nfs-kernel-server \
    smartmontools lvm2 mdadm \
    nginx redis-server \
    exfatprogs ntfs-3g btrfs-progs

# 2. 创建 NAS 目录
echo "📁 创建目录结构..."
mkdir -p "$NAS_HOME" /mnt/nas /etc/nas /var/log/nas
cp -r "$SCRIPT_DIR/../src" "$NAS_HOME/"
cp "$SCRIPT_DIR/../nas.service" /etc/systemd/system/

# 3. Python 虚拟环境
echo "🐍 配置 Python 环境..."
python3.11 -m venv "$VENV_DIR"
source "$VENV_DIR/bin/activate"
pip install --upgrade pip
pip install -r "$NAS_HOME/src/requirements.txt"

# 4. 配置文件
echo "⚙️ 生成配置文件..."
if [ ! -f /etc/nas/config.yaml ]; then
    cat > /etc/nas/config.yaml <<'EOF'
web:
  host: "0.0.0.0"
  port: 8000
storage:
  mount_base: "/mnt/nas"
  health_check_interval: 3600
auth:
  jwt_secret: "CHANGE_ME_IN_PRODUCTION"
  jwt_expire_hours: 24
  max_login_attempts: 5
  lockout_minutes: 15
EOF
    echo "  ⚠️ 请修改 /etc/nas/config.yaml 中的 jwt_secret！"
fi

# 5. systemd 服务
echo "🔧 注册 systemd 服务..."
systemctl daemon-reload
systemctl enable nas-api nas-worker nas-monitor
systemctl start nas-api

# 6. Nginx 配置
echo "🌐 配置 Nginx..."
cat > /etc/nginx/sites-available/nas <<'NGINX'
server {
    listen 80;
    server_name _;
    client_max_body_size 10G;

    location /api/ {
        proxy_pass http://127.0.0.1:8000/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location / {
        root /opt/nas-os/static;
        index index.html;
        try_files $uri $uri/ /index.html;
    }
}
NGINX
ln -sf /etc/nginx/sites-available/nas /etc/nginx/sites-enabled/
rm -f /etc/nginx/sites-enabled/default
nginx -t && systemctl reload nginx

echo "================================"
echo "✅ NAS 系统安装完成！"
echo "   访问 http://$(hostname -I | awk '{print $1}'):80"
echo "   默认管理员: admin / admin123（请立即修改密码！）"

12.4 项目复盘与 AI 编程方法论总结