# 1. 删除或禁用 guest 用户
rabbitmqctl delete_user guest

# 2. 创建管理员用户
rabbitmqctl add_user admin secure_password_here
rabbitmqctl set_user_tags admin administrator
rabbitmqctl set_permissions -p / admin ".*" ".*" ".*"

# 3. 创建应用用户（最小权限）
rabbitmqctl add_user app_user app_password
rabbitmqctl set_permissions -p production app_user "^app\." "^app\." "^app\."

# 4. 创建监控用户（只读）
rabbitmqctl add_user monitor monitor_password
rabbitmqctl set_user_tags monitor monitoring
rabbitmqctl set_permissions -p / monitor "" "" ".*"

# 1. 限制远程访问
loopback_users.guest = true
# 或完全禁用 guest
# 这需要在 rabbitmq.conf 中设置

# 2. 使用 TLS/SSL
listeners.ssl.default = 5671
ssl_options.cacertfile = /etc/rabbitmq/ssl/ca_certificate.pem
ssl_options.certfile = /etc/rabbitmq/ssl/server_certificate.pem
ssl_options.keyfile = /etc/rabbitmq/ssl/server_key.pem
ssl_options.verify = verify_peer
ssl_options.fail_if_no_peer_cert = true

# 3. 管理界面 TLS
management.ssl.port = 15671
management.ssl.cacertfile = /etc/rabbitmq/ssl/ca_certificate.pem
management.ssl.certfile = /etc/rabbitmq/ssl/server_certificate.pem
management.ssl.keyfile = /etc/rabbitmq/ssl/server_key.pem

# 仅允许应用服务器访问 AMQP 端口
iptables -A INPUT -p tcp --dport 5672 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5672 -j DROP

# 管理界面仅允许运维网络
iptables -A INPUT -p tcp --dport 15672 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 15672 -j DROP

# 集群内部通信仅允许集群节点
iptables -A INPUT -p tcp --dport 25672 -s 10.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 25672 -s 10.0.0.2 -j ACCEPT
iptables -A INPUT -p tcp --dport 25672 -s 10.0.0.3 -j ACCEPT
iptables -A INPUT -p tcp --dport 25672 -j DROP

# 按业务域创建 VHost
rabbitmqctl add_vhost order_service
rabbitmqctl add_vhost payment_service
rabbitmqctl add_vhost notification_service

# 为每个服务分配最小权限
rabbitmqctl set_permissions -p order_service order_user "^order\." "^order\." "^order\."
rabbitmqctl set_permissions -p payment_service payment_user "^payment\." "^payment\." "^payment\."

# /etc/rabbitmq/rabbitmq.conf

# 1. 网络优化
tcp_listen_options.backlog = 128
tcp_listen_options.nodelay = true
tcp_listen_options.sndbuf = 196608
tcp_listen_options.recbuf = 196608

# 2. 内存管理
vm_memory_high_watermark.relative = 0.6
vm_memory_high_watermark_paging_ratio = 0.75

# 3. 磁盘 I/O
disk_free_limit.absolute = 2GB

# 4. 心跳配置
heartbeat = 60

# 5. 队列索引优化
queue_index_embed_msgs_below = 4096

# 6. 统计信息采集频率（降低开销）
collect_statistics_interval = 30000

# Python 生产者调优
import pika

# 1. 使用连接池
params = pika.ConnectionParameters(
    host='localhost',
    heartbeat=60,
    blocked_connection_timeout=300,
    # 调整 TCP 缓冲区
    socket_timeout=10
)

# 2. Publisher Confirm（异步模式）
channel.confirm_delivery()

# 3. 批量发布
for msg in messages:
    channel.basic_publish(
        exchange='ex',
        routing_key='key',
        body=msg,
        properties=pika.BasicProperties(delivery_mode=2)
    )

# 4. 合理的 QoS
channel.basic_qos(prefetch_count=50)

// Java 生产者调优
ConnectionFactory factory = new ConnectionFactory();
factory.setHost("localhost");
factory.setRequestedHeartBeat(60);
factory.setConnectionTimeout(30000);
factory.setAutomaticRecoveryEnabled(true);
factory.setTopologyRecoveryEnabled(true);

// 使用 NIO（高并发场景）
factory.useNio();
factory.setNioParams(new NioParams()
    .setNbIoThreads(4)
    .setWriteEnqueueTimeout(5000)
    .setReadByteBufferSize(65536)
    .setWriteByteBufferSize(65536)
);

#!/bin/bash
# daily_check.sh - 每日巡检脚本

echo "=== RabbitMQ 每日巡检 ==="
echo "日期: $(date)"
echo

API="http://localhost:15672/api"
AUTH="admin:admin123"

# 1. 节点状态
echo "1. 节点状态"
curl -s -u $AUTH $API/nodes | jq -r '.[] | "  \(.name): running=\(.running), mem=\(.mem_used/1073741824)GB, disk_free=\(.disk_free/1073741824)GB"'
echo

# 2. 集群状态
echo "2. 集群状态"
rabbitmqctl cluster_status 2>/dev/null | grep -E "nodes|alarms|partitions"
echo

# 3. 队列堆积
echo "3. 队列堆积 (>100)"
curl -s -u $AUTH $API/queues | jq -r '.[] | select(.messages > 100) | "  \(.name): \(.messages) msgs"'
echo

# 4. 连接数
echo "4. 连接数"
conn=$(curl -s -u $AUTH $API/connections | jq 'length')
echo "  当前连接: $conn"
echo

# 5. 告警
echo "5. 系统告警"
curl -s -u $AUTH $API/health/checks/alarms
echo

# 6. 关键队列消费者
echo "6. 无消费者的队列"
curl -s -u $AUTH $API/queues | jq -r '.[] | select(.consumers == 0 and .messages > 0) | "  \(.name): \(.messages) msgs, 0 consumers"'
echo

# 1. 准备
# - 备份元数据
rabbitmqctl export_definitions /backup/definitions.json
# - 通知下游应用
# - 确认集群健康

# 2. 升级第一个节点
# - 从负载均衡移除该节点
rabbitmqctl stop_app
# - 安装新版本
rabbitmqctl start_app
# - 等待同步完成
rabbitmq-diagnostics check_running

# 3. 验证新节点
# - 检查队列状态
# - 检查消息投递
# - 运行健康检查

# 4. 重复步骤 2-3 升级其他节点

# 5. 全部完成后验证
rabbitmqctl cluster_status
# - 恢复负载均衡配置
# - 监控系统运行

# 导出定义（元数据）
rabbitmqctl export_definitions /backup/definitions_$(date +%Y%m%d).json

# 导入定义
rabbitmqctl import_definitions /backup/definitions_20260510.json

# 备份配置文件
cp /etc/rabbitmq/rabbitmq.conf /backup/
cp /etc/rabbitmq/advanced.config /backup/

# 备份数据目录（需停止服务）
systemctl stop rabbitmq-server
tar czf /backup/rabbitmq_data_$(date +%Y%m%d).tar.gz /var/lib/rabbitmq/
systemctl start rabbitmq-server

# /etc/rabbitmq/rabbitmq.conf - 生产环境推荐配置

# === 网络 ===
listeners.tcp.default = 5672
management.tcp.port = 15672
heartbeat = 60
channel_max = 2048

# === 内存 ===
vm_memory_high_watermark.relative = 0.6
vm_memory_high_watermark_paging_ratio = 0.75

# === 磁盘 ===
disk_free_limit.absolute = 2GB

# === 安全 ===
loopback_users.guest = true
# listeners.ssl.default = 5671

# === 日志 ===
log.file.level = info
log.dir = /var/log/rabbitmq

# === 集群 ===
cluster_partition_handling = pause_minority

# === 队列默认类型 ===
# default_queue_type = quorum