Komari 监控面板部署教程

# 1. 建目录并进入
mkdir -p /opt/komari && cd /opt/komari

# 2. 写配置（nano / vim 均可）
nano compose.yaml

services:
  komari:
    image: ghcr.io/komari-monitor/komari:latest
    container_name: komari
    restart: unless-stopped
    ports:
      # 只绑本机！写成 25774:25774 会把登录页直接暴露在公网
      - "127.0.0.1:25774:25774"
    volumes:
      - ./data:/app/data
    environment:
      - ADMIN_USERNAME=admin
      - ADMIN_PASSWORD=YourSecurePassword123
      - TZ=Asia/Shanghai

docker compose up -d && docker compose ps
docker logs komari | tail -n 5

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update && sudo apt install -y caddy

# 先停掉刚装好的官方版（后面要替换它的二进制）
sudo systemctl stop caddy

# -L 跟随重定向；p 参数指定要打进的插件
curl -L -o caddy "https://caddyserver.com/api/download?os=linux&arch=amd64&p=github.com/caddy-dns/cloudflare"

ls -lh caddy

chmod +x caddy && sudo mv caddy /usr/bin/caddy
/usr/bin/caddy version

{
    # 443 被 sing-box 占用，改用 Cloudflare 支持的 8443
    https_port 8443
}

monitor.232777.xyz {
    # DNS-01 挑战：调 Cloudflare API 验证，小黄云开着也不影响
    tls {
        dns cloudflare YOUR_CF_TOKEN
    }

    # 反代到本机 Komari；WebSocket 由 Caddy 自动处理
    reverse_proxy 127.0.0.1:25774
}

# Caddyfile 里躺着 API Token，只让 root 可读
sudo chmod 600 /etc/caddy/Caddyfile

# 先校验，通过再启动
sudo caddy validate --config /etc/caddy/Caddyfile && sudo systemctl start caddy
sudo systemctl status caddy | head -n 5

bash <(curl -sL https://raw.githubusercontent.com/komari-monitor/komari-agent/refs/heads/main/install.sh) \
  -e https://monitor.232777.xyz \
  -t YOUR_AGENT_TOKEN \
  --disable-web-ssh

sudo ufw allow 22/tcp

# IPv4 段（以 cloudflare.com/ips 公布的为准）
for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
  sudo ufw allow proto tcp from $ip to any port 8443
done
# IPv6 段
for ip in $(curl -s https://www.cloudflare.com/ips-v6); do
  sudo ufw allow proto tcp from $ip to any port 8443
done

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw --force enable && sudo ufw status numbered