Fabric 简易分布式部署

只部署两个节点：orderer和peer1，其分布在不同的服务器上。

orderer 在 192.168.56.100

org1-peer1 在 192.168.56.99

未使用Fabric CA，域名和TLS

项目目录为：/data/t

192.168.56.100

生成证书

crypto_config.yaml ，需要注意的是证书只生成一次，后面所有的节点都使用这个证书文件夹。(每次生成的证书都不同)


# ---------------------------------------------------------------------------
# "OrdererOrgs" - Definition of organizations managing orderer nodes
# ---------------------------------------------------------------------------
OrdererOrgs:
  # ---------------------------------------------------------------------------
  # Orderer
  # ---------------------------------------------------------------------------
  - Name: Orderer
    Domain: 192.168.56.100
    EnableNodeOUs: false

# ---------------------------------------------------------------------------
# "PeerOrgs" - Definition of organizations managing peer nodes
# ---------------------------------------------------------------------------
PeerOrgs:
  - Name: Org1
    Domain: 192.168.56.99
    EnableNodeOUs: false
    Template:
      Count: 1
    Users:
      Count: 1

1	cryptogen generate --config=crypto_config.yaml

生成的证书如下：

crypto-config
├── ordererOrganizations
│   └── 192.168.56.100
│       ├── ca
│       │   ├── ca.192.168.56.100-cert.pem
│       │   └── priv_sk
│       ├── msp
│       │   ├── admincerts
│       │   │   └── Admin@192.168.56.100-cert.pem
│       │   ├── cacerts
│       │   │   └── ca.192.168.56.100-cert.pem
│       │   └── tlscacerts
│       │       └── tlsca.192.168.56.100-cert.pem
│       ├── tlsca
│       │   ├── priv_sk
│       │   └── tlsca.192.168.56.100-cert.pem
│       └── users
│           └── Admin@192.168.56.100
│               ├── msp
│               │   ├── admincerts
│               │   │   └── Admin@192.168.56.100-cert.pem
│               │   ├── cacerts
│               │   │   └── ca.192.168.56.100-cert.pem
│               │   ├── keystore
│               │   │   └── priv_sk
│               │   ├── signcerts
│               │   │   └── Admin@192.168.56.100-cert.pem
│               │   └── tlscacerts
│               │       └── tlsca.192.168.56.100-cert.pem
│               └── tls
│                   ├── ca.crt
│                   ├── client.crt
│                   └── client.key
└── peerOrganizations
    └── 192.168.56.99
        ├── ca
        │   ├── ca.192.168.56.99-cert.pem
        │   └── priv_sk
        ├── msp
        │   ├── admincerts
        │   │   └── Admin@192.168.56.99-cert.pem
        │   ├── cacerts
        │   │   └── ca.192.168.56.99-cert.pem
        │   └── tlscacerts
        │       └── tlsca.192.168.56.99-cert.pem
        ├── peers
        │   └── peer0.192.168.56.99
        │       ├── msp
        │       │   ├── admincerts
        │       │   │   └── Admin@192.168.56.99-cert.pem
        │       │   ├── cacerts
        │       │   │   └── ca.192.168.56.99-cert.pem
        │       │   ├── keystore
        │       │   │   └── priv_sk
        │       │   ├── signcerts
        │       │   │   └── peer0.192.168.56.99-cert.pem
        │       │   └── tlscacerts
        │       │       └── tlsca.192.168.56.99-cert.pem
        │       └── tls
        │           ├── ca.crt
        │           ├── server.crt
        │           └── server.key
        ├── tlsca
        │   ├── priv_sk
        │   └── tlsca.192.168.56.99-cert.pem
        └── users
            ├── Admin@192.168.56.99
            │   ├── msp
            │   │   ├── admincerts
            │   │   │   └── Admin@192.168.56.99-cert.pem
            │   │   ├── cacerts
            │   │   │   └── ca.192.168.56.99-cert.pem
            │   │   ├── keystore
            │   │   │   └── priv_sk
            │   │   ├── signcerts
            │   │   │   └── Admin@192.168.56.99-cert.pem
            │   │   └── tlscacerts
            │   │       └── tlsca.192.168.56.99-cert.pem
            │   └── tls
            │       ├── ca.crt
            │       ├── client.crt
            │       └── client.key
            └── User1@192.168.56.99
                ├── msp
                │   ├── admincerts
                │   │   └── User1@192.168.56.99-cert.pem
                │   ├── cacerts
                │   │   └── ca.192.168.56.99-cert.pem
                │   ├── keystore
                │   │   └── priv_sk
                │   ├── signcerts
                │   │   └── User1@192.168.56.99-cert.pem
                │   └── tlscacerts
                │       └── tlsca.192.168.56.99-cert.pem
                └── tls
                    ├── ca.crt
                    ├── client.crt
                    └── client.key

生成通道文件

configtx.yaml ，配置通道信息和节点信息。主要关注orderer的ip、msp文件路径、共识机制和 peer节点的ip、msp文件路径。

# Copyright IBM Corp. All Rights Reserved.
#
# SPDX-License-Identifier: Apache-2.0
#

Organizations:

    # SampleOrg defines an MSP using the sampleconfig.  It should never be used
    # in production but may be used as a template for other definitions
    - &OrdererOrg
        # DefaultOrg defines the organization which is used in the sampleconfig
        # of the fabric.git development environment
        Name: OrdererOrg

        # ID to load the MSP definition as
        ID: OrdererMSP

        # MSPDir is the filesystem path which contains the MSP configuration
        MSPDir: /data/t/crypto-config/ordererOrganizations/192.168.56.100/users/Admin@192.168.56.100/msp

        # Policies defines the set of policies at this level of the config tree
        # For organization policies, their canonical path is usually
        #   /Channel/<Application|Orderer>/<OrgName>/<PolicyName>
        Policies:
            Readers:
                Type: Signature
                Rule: "OR('OrdererMSP.member')"
            Writers:
                Type: Signature
                Rule: "OR('OrdererMSP.member')"
            Admins:
                Type: Signature
                Rule: "OR('OrdererMSP.admin')"

        OrdererEndpoints:
            - 192.168.56.100:7050

    - &Org1
        # DefaultOrg defines the organization which is used in the sampleconfig
        # of the fabric.git development environment
        Name: Org1MSP

        # ID to load the MSP definition as
        ID: Org1MSP

        MSPDir: /data/t/crypto-config/peerOrganizations/192.168.56.99/users/Admin@192.168.56.99/msp

        # Policies defines the set of policies at this level of the config tree
        # For organization policies, their canonical path is usually
        #   /Channel/<Application|Orderer>/<OrgName>/<PolicyName>
        Policies:
            Readers:
                Type: Signature
                Rule: "OR('Org1MSP.admin', 'Org1MSP.peer', 'Org1MSP.client')"
            Writers:
                Type: Signature
                Rule: "OR('Org1MSP.admin', 'Org1MSP.client')"
            Admins:
                Type: Signature
                Rule: "OR('Org1MSP.admin')"
            Endorsement:
                Type: Signature
                Rule: "OR('Org1MSP.peer','Org1MSP.admin','Org1MSP.client')"


################################################################################
#
#   SECTION: Capabilities
#
#   - This section defines the capabilities of fabric network. This is a new
#   concept as of v1.1.0 and should not be utilized in mixed networks with
#   v1.0.x peers and orderers.  Capabilities define features which must be
#   present in a fabric binary for that binary to safely participate in the
#   fabric network.  For instance, if a new MSP type is added, newer binaries
#   might recognize and validate the signatures from this type, while older
#   binaries without this support would be unable to validate those
#   transactions.  This could lead to different versions of the fabric binaries
#   having different world states.  Instead, defining a capability for a channel
#   informs those binaries without this capability that they must cease
#   processing transactions until they have been upgraded.  For v1.0.x if any
#   capabilities are defined (including a map with all capabilities turned off)
#   then the v1.0.x peer will deliberately crash.
#
################################################################################
Capabilities:
    # Channel capabilities apply to both the orderers and the peers and must be
    # supported by both.
    # Set the value of the capability to true to require it.
    Channel: &ChannelCapabilities
        # V2_0 capability ensures that orderers and peers behave according
        # to v2.0 channel capabilities. Orderers and peers from
        # prior releases would behave in an incompatible way, and are therefore
        # not able to participate in channels at v2.0 capability.
        # Prior to enabling V2.0 channel capabilities, ensure that all
        # orderers and peers on a channel are at v2.0.0 or later.
        V2_0: true

    # Orderer capabilities apply only to the orderers, and may be safely
    # used with prior release peers.
    # Set the value of the capability to true to require it.
    Orderer: &OrdererCapabilities
        # V2_0 orderer capability ensures that orderers behave according
        # to v2.0 orderer capabilities. Orderers from
        # prior releases would behave in an incompatible way, and are therefore
        # not able to participate in channels at v2.0 orderer capability.
        # Prior to enabling V2.0 orderer capabilities, ensure that all
        # orderers on channel are at v2.0.0 or later.
        V2_0: true

    # Application capabilities apply only to the peer network, and may be safely
    # used with prior release orderers.
    # Set the value of the capability to true to require it.
    Application: &ApplicationCapabilities
        # V2_0 application capability ensures that peers behave according
        # to v2.0 application capabilities. Peers from
        # prior releases would behave in an incompatible way, and are therefore
        # not able to participate in channels at v2.0 application capability.
        # Prior to enabling V2.0 application capabilities, ensure that all
        # peers on channel are at v2.0.0 or later.
        V2_0: true

################################################################################
#
#   SECTION: Application
#
#   - This section defines the values to encode into a config transaction or
#   genesis block for application related parameters
#
################################################################################
Application: &ApplicationDefaults

    # Organizations is the list of orgs which are defined as participants on
    # the application side of the network
    Organizations:

    # Policies defines the set of policies at this level of the config tree
    # For Application policies, their canonical path is
    #   /Channel/Application/<PolicyName>
    Policies:
        Readers:
            Type: ImplicitMeta
            Rule: "ANY Readers"
        Writers:
            Type: ImplicitMeta
            Rule: "ANY Writers"
        Admins:
            Type: ImplicitMeta
            Rule: "MAJORITY Admins"
        LifecycleEndorsement:
            Type: ImplicitMeta
            Rule: "MAJORITY Endorsement"
        Endorsement:
            Type: ImplicitMeta
            Rule: "MAJORITY Endorsement"

    Capabilities:
        <<: *ApplicationCapabilities
################################################################################
#
#   SECTION: Orderer
#
#   - This section defines the values to encode into a config transaction or
#   genesis block for orderer related parameters
#
################################################################################
Orderer: &OrdererDefaults

    # Orderer Type: The orderer implementation to start
    OrdererType: solo
    # Addresses used to be the list of orderer addresses that clients and peers
    # could connect to.  However, this does not allow clients to associate orderer
    # addresses and orderer organizations which can be useful for things such
    # as TLS validation.  The preferred way to specify orderer addresses is now
    # to include the OrdererEndpoints item in your org definition
    Addresses:
        - 192.168.56.100:7050

    # EtcdRaft:
    #     Consenters:
    #     - Host: kid1999.top
    #       Port: 7050
    #       ClientTLSCert: /data/t/crypto-config/ordererOrganizations/kid1999.top/tlsca/tlsca.kid1999.top-cert.pem
    #       ServerTLSCert: /data/t/crypto-config/ordererOrganizations/kid1999.top/tlsca/tlsca.kid1999.top-cert.pem

    # Batch Timeout: The amount of time to wait before creating a batch
    BatchTimeout: 2s

    # Batch Size: Controls the number of messages batched into a block
    BatchSize:

        # Max Message Count: The maximum number of messages to permit in a batch
        MaxMessageCount: 10

        # Absolute Max Bytes: The absolute maximum number of bytes allowed for
        # the serialized messages in a batch.
        AbsoluteMaxBytes: 99 MB

        # Preferred Max Bytes: The preferred maximum number of bytes allowed for
        # the serialized messages in a batch. A message larger than the preferred
        # max bytes will result in a batch larger than preferred max bytes.
        PreferredMaxBytes: 512 KB

    # Organizations is the list of orgs which are defined as participants on
    # the orderer side of the network
    Organizations:

    # Policies defines the set of policies at this level of the config tree
    # For Orderer policies, their canonical path is
    #   /Channel/Orderer/<PolicyName>
    Policies:
        Readers:
            Type: ImplicitMeta
            Rule: "ANY Readers"
        Writers:
            Type: ImplicitMeta
            Rule: "ANY Writers"
        Admins:
            Type: ImplicitMeta
            Rule: "MAJORITY Admins"
        # BlockValidation specifies what signatures must be included in the block
        # from the orderer for the peer to validate it.
        BlockValidation:
            Type: ImplicitMeta
            Rule: "ANY Writers"

################################################################################
#
#   CHANNEL
#
#   This section defines the values to encode into a config transaction or
#   genesis block for channel related parameters.
#
################################################################################
Channel: &ChannelDefaults
    # Policies defines the set of policies at this level of the config tree
    # For Channel policies, their canonical path is
    #   /Channel/<PolicyName>
    Policies:
        # Who may invoke the 'Deliver' API
        Readers:
            Type: ImplicitMeta
            Rule: "ANY Readers"
        # Who may invoke the 'Broadcast' API
        Writers:
            Type: ImplicitMeta
            Rule: "ANY Writers"
        # By default, who may modify elements at this config level
        Admins:
            Type: ImplicitMeta
            Rule: "MAJORITY Admins"

    # Capabilities describes the channel level capabilities, see the
    # dedicated Capabilities section elsewhere in this file for a full
    # description
    Capabilities:
        <<: *ChannelCapabilities

################################################################################
#
#   Profile
#
#   - Different configuration profiles may be encoded here to be specified
#   as parameters to the configtxgen tool
#
################################################################################
Profiles:

    TwoOrgsOrdererGenesis:
        <<: *ChannelDefaults
        Orderer:
            <<: *OrdererDefaults
            Organizations:
                - *OrdererOrg
            Capabilities:
                <<: *OrdererCapabilities
        Consortiums:
            SampleConsortium:
                Organizations:
                    - *Org1
        
    TwoOrgsChannel:
        Consortium: SampleConsortium
        <<: *ChannelDefaults
        Application:
            <<: *ApplicationDefaults
            Organizations:
                - *Org1
            Capabilities:
                <<: *ApplicationCapabilities

生成创世区块

1	configtxgen -outputBlock ./channel-artifacts/genesis.block -profile TwoOrgsOrdererGenesis -channelID orderer-system-channel

创建通道

1	configtxgen -outputCreateChannelTx ./channel-artifacts/channel.tx -profile TwoOrgsChannel -channelID mychannel

以上生成的文件都需要拷贝到192.168.56.99服务器上。

生成节点容器

docker-compose.yaml ，生成orderer节点

version: '2'

networks:
  test:
    name: twonodes_test

services:

  orderer:
    container_name: orderer
    image: hyperledger/fabric-orderer:2.2
    environment:
      - FABRIC_LOGGING_SPEC=INFO
      - ORDERER_GENERAL_LISTENADDRESS=0.0.0.0
      - ORDERER_GENERAL_LISTENPORT=7050
      - ORDERER_GENERAL_GENESISMETHOD=file
      - ORDERER_GENERAL_GENESISFILE=/var/hyperledger/orderer/orderer.genesis.block
      - ORDERER_GENERAL_LOCALMSPID=OrdererMSP
      - ORDERER_GENERAL_LOCALMSPDIR=/orderer/users/Admin@192.168.56.100/msp
      # enabled TLS
      - ORDERER_GENERAL_TLS_ENABLED=false
    command: orderer
    volumes:            # 修改为自定义文件路径
        - ./channel-artifacts/genesis.block:/var/hyperledger/orderer/orderer.genesis.block
        - ./crypto-config/ordererOrganizations/192.168.56.100:/orderer
    ports: 
      - 7050:7050
    networks: 
      - test

1	docker-compose up

192.168.56.99

前置：拷贝orderer节点生成的证书文件夹和通道文件。

生成节点容器

docker-compose.yaml ，生成peer1节点

version: '2'

networks:
  test:
    name: twonodes_test
  
services:
  
  pee1:
    container_name: pee1
    image: hyperledger/fabric-peer:2.2
    environment:
      - GODEBUG=netdns=go
      - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
      - CORE_VM_DOCKER_HOSTCONFIG_NETWORKMODE=twonodes_test
      - FABRIC_LOGGING_SPEC=DEBUG
      - CORE_PEER_TLS_ENABLED=false
      - CORE_PEER_PROFILE_ENABLED=true
      # - CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/fabric/tls/server.crt
      # - CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/fabric/tls/server.key
      # - CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/fabric/tls/ca.crt
      # Peer specific variabes
      - CORE_PEER_ID=192.168.56.99
      - CORE_PEER_ADDRESS=192.168.56.99:7051
      - CORE_PEER_LISTENADDRESS=0.0.0.0:7051
      - CORE_PEER_CHAINCODEADDRESS=192.168.56.99:7052
      - CORE_PEER_CHAINCODELISTENADDRESS=0.0.0.0:7052
      - CORE_PEER_GOSSIP_BOOTSTRAP=192.168.56.99:7051
      - CORE_PEER_GOSSIP_EXTERNALENDPOINT=192.168.56.99:7051
      - CORE_PEER_LOCALMSPID=Org1MSP
    volumes:        # 修改为自定义文件路径
        - /var/run/docker.sock:/host/var/run/docker.sock
        - ./crypto-config/peerOrganizations/192.168.56.99/users/Admin@192.168.56.99/msp:/etc/hyperledger/fabric/msp
    command: peer node start
    ports: 
      - 7051:7051
      - 7052:7052
    networks: 
      - test


  cli1:
    container_name: cli1
    image: hyperledger/fabric-tools:2.2
    tty: true
    stdin_open: true
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer
    environment:
    - GODEBUG=netdns=go
    - FABRIC_LOGGING_SPEC=DEBUG
    - GOPATH=/opt/gopath
    - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
    - CORE_PEER_TLS_ENABLED=false
    - CORE_PEER_LOCALMSPID=Org1MSP
    - CORE_PEER_MSPCONFIGPATH=/peer-msp
    - CORE_PEER_ADDRESS=192.168.56.99:7051
    command: /bin/bash
    volumes:        # 修改为映射路径
        - /var/run/:/host/var/run/
        - ./chaincode:/chaincode      #预留链码路径
        - /data/t/crypto-config/peerOrganizations/192.168.56.99/users/Admin@192.168.56.99/msp:/peer-msp
        - /data/t/crypto-config/ordererOrganizations/192.168.56.100/users/Admin@192.168.56.100/msp:/orderer-msp
        - ./channel-artifacts:/channel-artifacts
    networks: 
      - test

生成容器

1	docker-compose up

cli1中创建新通道

1	peer channel create -c mychannel --orderer 192.168.56.100:7050 -f /channel-artifacts/channel.tx --cafile /orderer-msp/cacerts/ca.192.168.56.100-cert.pem

将cli1创建的mychannel.block 分发给需要加入此通道的容器

1
2
3

docker cp cli1:/opt/gopath/src/github.com/hyperledger/fabric/peer/mychannel.block ./

docker cp  ./mychannel.block  cli2:/opt/gopath/src/github.com/hyperledger/fabric/peer/mychannel.block

节点加入channel

1
2
3

peer channel join -b mychannel.block
# 查看通道
peer channel getinfo -c mychannel

安装链码

链码依赖环境

链码的安装涉及：打包、提交审批、提交过程。

docker exec -it cli1 bash

cd /chaincode

go env -w  GOPROXY=https://goproxy.cn,direct

go mod vendor

打包链码

1	peer lifecycle chaincode package fabcar.tar.gz --path /chaincode/ --label fabcar

安装链码包

peer lifecycle chaincode install fabcar.tar.gz

# 查询已安装的链码
peer lifecycle chaincode queryinstalled

批准链码定义

peer lifecycle chaincode approveformyorg --channelID mychannel --name fabcar --version 1.0 --package-id fabcar:e7bb85ded9daf8f3262a76eaa810d55912767ba52af604a269c2c6d149b49b7c --sequence 1 --cafile /orderer-msp/cacerts/ca.192.168.56.100-cert.pem

# 查询已批准的链码
peer lifecycle chaincode checkcommitreadiness --channelID mychannel --name fabcar --version 1.0  --sequence 1 --tls true --cafile /orderer-msp/cacerts/ca.192.168.56.100-cert.pem --output json

提交链码到通道

peer lifecycle chaincode commit -o 192.168.56.100:7050 --channelID mychannel --name fabcar --version 1.0  --sequence 1  --cafile /orderer-msp/cacerts/ca.192.168.56.100-cert.pem --peerAddresses 192.168.56.99:7051 --cafile /peer-msp/cacerts/ca.192.168.56.99-cert.pem 

# 查询已提交的链码
peer lifecycle chaincode querycommitted --channelID mychannel --name fabcar --cafile /orderer-msp/cacerts/ca.192.168.56.100-cert.pem

执行链码

执行链码程序

peer chaincode invoke -o 192.168.56.100:7050 -C mychannel -n fabcar --isInit  --cafile /orderer-msp/cacerts/ca.192.168.56.100 -cert.pem  --peerAddresses 192.168.56.99:7051 --cafile /peer-msp/cacerts/ca.192.168.56.99-cert.pem -c '{"Args":["InitLedger"]}'

查询链上数据

1
2
3

peer chaincode query -C mychannel -n fabcar -c '{"Args":["QueryAllCars"]}'

peer chaincode query -C mychannel -n fabcar -c '{"Args":["QueryCar","CAR4"]}'

参考：

https://little-star.love/posts/ae361aeb/#cryptogen-%E9%85%8D%E7%BD%AE%E6%A8%A1%E6%9D%BF

https://hyperledger-fabric.readthedocs.io/en/release-2.2/deploy_chaincode.html#approve-a-chaincode-definition