API服务端部署运维手册

1. 手工部署

教你如何使用ASRT部署中文语音识别API服务器

2. Docker部署(推荐)

仅CPU运行推理识别，不作训练

$ docker pull ailemondocker/asrt_service:1.3.0
$ docker run --rm -it -p 20001:20001 -p 20002:20002 --name asrt-server -d ailemondocker/asrt_service:1.3.0

3. Nginx配置最佳实践

假设，我们分别在IP为 192.168.0.100 和 192.168.0.101的两个节点上运行了ASRT服务端，并对外通过域名 api.asrt.com 提供API接口调用，并且开启HTTPS加密支持(且支持HTTP2)，SSL证书(公钥+私钥)存放于路径 /root/sslcert 下，文件名分别为full_chain.pem 和 private.key，那么我们可以有如下Nginx的配置文件：
/etc/nginx/conf.d/api-asrt.conf

upstream asrt_servers_http {
        server 192.168.0.100:20001  max_fails=1 fail_timeout=10m;
        server 192.168.0.101:20001  backup;
}

server {
        listen 443 ssl;
        listen [::]:443 ssl;
        http2 on;

        ssl_certificate /root/sslcert/full_chain.pem;
        ssl_certificate_key /root/sslcert/private.key;
        include /root/sslcert/options-ssl-nginx.conf;

        server_name api.asrt.com;

        access_log /var/log/nginx/asrt_api-access.log;
        error_log /var/log/nginx/asrt_api-error.log;

        client_max_body_size    2m;
        keepalive_timeout 10s;

        location / {
                root   /var/www/html;
                index index.html;
        }

        location /asrt/v2/http/ {
                proxy_connect_timeout 500ms;
                proxy_next_upstream error timeout invalid_header http_502 http_503 http_504;
                proxy_http_version 1.1;
                proxy_pass http://asrt_servers_http/;
        }
}

server {
        if ($host = api.asrt.com) {
                return 301 https://$host$request_uri;
        }

        listen 80;
        listen [::]:80;
        server_name api.asrt.com;
        return 404;
}

其中，
/root/sslcert/options-ssl-nginx.conf

ssl_session_cache shared:le_nginx_SSL:1m;
ssl_session_timeout 1440m;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;

ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS";

实际中，上述配置里的IP、域名和文件路径等请根据实际情况替换。