hyperledger fabric生产环境搭建

hyperledger fabric生产环境搭建

本教程搭建了三组织 org0具备一个orderer组织 org1和org2具有两个peer节点

通过cryptogen生成msp证书

cryptogen showtemplate > crypto-config.yaml # 将默认模版输出到crypto-config.yaml中

crypto-config.yaml

# ---------------------------------------------------------------------------
# "OrdererOrgs" - Definition of organizations managing orderer nodes
# ---------------------------------------------------------------------------
OrdererOrgs: # orderer组织信息
  # ---------------------------------------------------------------------------
  # Orderer
  # ---------------------------------------------------------------------------
  - Name: Orderer # 定义了该orderer组织的名称
    Domain: example.com #order节点的域
    EnableNodeOUs: false  #节点组织单元

    # ---------------------------------------------------------------------------
    # "Specs" - See PeerOrgs below for complete description
    # ---------------------------------------------------------------------------
    Specs: #其他参数
      - Hostname: orderer

# ---------------------------------------------------------------------------
# "PeerOrgs" - Definition of organizations managing peer nodes
# ---------------------------------------------------------------------------
PeerOrgs: # peer节点信息 下面定义了两个peer组织
  # ---------------------------------------------------------------------------
  # Org1
  # ---------------------------------------------------------------------------
  - Name: Org1 # org1的名称
    Domain: org1.example.com # org1的域名
    EnableNodeOUs: false #节点组织单元

    # ---------------------------------------------------------------------------
    # "CA"
    # ---------------------------------------------------------------------------
    # Uncomment this section to enable the explicit definition of the CA for this
    # organization.  This entry is a Spec.  See "Specs" section below for details.
    # ---------------------------------------------------------------------------
    # CA:
    #    Hostname: ca # implicitly ca.org1.example.com
    #    Country: US
    #    Province: California
    #    Locality: San Francisco
    #    OrganizationalUnit: Hyperledger Fabric
    #    StreetAddress: address for org # default nil
    #    PostalCode: postalCode for org # default nil

    # ---------------------------------------------------------------------------
    # "Specs"
    # ---------------------------------------------------------------------------
    # Uncomment this section to enable the explicit definition of hosts in your
    # configuration.  Most users will want to use Template, below
    #
    # Specs is an array of Spec entries.  Each Spec entry consists of two fields:
    #   - Hostname:   (Required) The desired hostname, sans the domain.
    #   - CommonName: (Optional) Specifies the template or explicit override for
    #                 the CN.  By default, this is the template:
    #
    #                              "{{.Hostname}}.{{.Domain}}"
    #
    #                 which obtains its values from the Spec.Hostname and
    #                 Org.Domain, respectively.
    #   - SANS:       (Optional) Specifies one or more Subject Alternative Names
    #                 to be set in the resulting x509. Accepts template
    #                 variables {{.Hostname}}, {{.Domain}}, {{.CommonName}}. IP
    #                 addresses provided here will be properly recognized. Other
    #                 values will be taken as DNS names.
    #                 NOTE: Two implicit entries are created for you:
    #                     - {{ .CommonName }}
    #                     - {{ .Hostname }}
    # ---------------------------------------------------------------------------
    # Specs:
    #   - Hostname: foo # implicitly "foo.org1.example.com"
    #     CommonName: foo27.org5.example.com # overrides Hostname-based FQDN set above
    #     SANS:
    #       - "bar.{{.Domain}}"
    #       - "altfoo.{{.Domain}}"
    #       - "{{.Hostname}}.org6.net"
    #       - 172.16.10.31
    #   - Hostname: bar
    #   - Hostname: baz

    # ---------------------------------------------------------------------------
    # "Template"
    # ---------------------------------------------------------------------------
    # Allows for the definition of 1 or more hosts that are created sequentially
    # from a template. By default, this looks like "peer%d" from 0 to Count-1.
    # You may override the number of nodes (Count), the starting index (Start)
    # or the template used to construct the name (Hostname).
    #
    # Note: Template and Specs are not mutually exclusive.  You may define both
    # sections and the aggregate nodes will be created for you.  Take care with
    # name collisions
    # ---------------------------------------------------------------------------
    Template: # 在这里可以定义所生成的Org1组织中的Peer节点证书数量，不包括Admin
      Count: 2 # org1组织中只有1个peer节点
      # Start: 5
      # Hostname: {{.Prefix}}{{.Index}} # default
      # SANS:
      #   - "{{.Hostname}}.alt.{{.Domain}}"

    # ---------------------------------------------------------------------------
    # "Users"
    # ---------------------------------------------------------------------------
    # Count: The number of user accounts _in addition_ to Admin
    # ---------------------------------------------------------------------------
    Users: # 在这里可以定义所生成的Org1组织中类型为User的证书数量，不包括Admin
      Count: 1 #生成用户的证书的数量

  # ---------------------------------------------------------------------------
  # Org2: See "Org1" for full specification
  # ---------------------------------------------------------------------------
  - Name: Org2  #同上
    Domain: org2.example.com
    EnableNodeOUs: false
    Template:
      Count: 2
    Users:
      Count: 1

生成msg证书文件

cryptogen generate --config crypto-config.yaml  # 生成证书文件到 crypto-config 文件夹中 

生成创世区块 和 通道配置文件（最新版本锚节点以及淘汰了）

复制方示例项目test-network中的configtx.yaml配置文件

# Copyright IBM Corp. All Rights Reserved.
#
# SPDX-License-Identifier: Apache-2.0
#

---
################################################################################
#
#   Section: Organizations
#
#   - This section defines the different organizational identities which will
#   be referenced later in the configuration.
#
################################################################################
Organizations:  # 定义组织信息

  # SampleOrg defines an MSP using the sampleconfig.  It should never be used
  # in production but may be used as a template for other definitions
  - &OrdererOrg # 定义orderer组织信息
    # DefaultOrg defines the organization which is used in the sampleconfig
    # of the fabric.git development environment
    Name: OrdererOrg # orderer组织名称

    # ID to load the MSP definition as
    ID: OrdererMSP # 定义ID

    # MSPDir is the filesystem path which contains the MSP configuration
    MSPDir: ./crypto-config/ordererOrganizations/example.com/msp # msp证书储存位置

    # Policies defines the set of policies at this level of the config tree
    # For organization policies, their canonical path is usually
    #   /Channel///
    Policies: #定义相关策略
      Readers: # 读
        Type: Signature  # 类型
        Rule: "OR('OrdererMSP.member')" # 规则
      Writers: # 写
        Type: Signature
        Rule: "OR('OrdererMSP.member')"
      Admins: # admin
        Type: Signature
        Rule: "OR('OrdererMSP.admin')"

    OrdererEndpoints: # 定义orderer节点的socket 因为是运行在docker中
      - orderer.example.com:7050 # 容器名：开放端口

  - &Org1 # org1组织
    # DefaultOrg defines the organization which is used in the sampleconfig
    # of the fabric.git development environment
    Name: Org1MSP #定义组织一的名称

    # ID to load the MSP definition as
    ID: Org1MSP #定义组织一的ID

    MSPDir: ./crypto-config/peerOrganizations/org1.example.com/msp #指定MSP的文件目录

    # Policies defines the set of policies at this level of the config tree
    # For organization policies, their canonical path is usually
    #   /Channel///
    Policies: #定义相关策略
      Readers:
        Type: Signature
        Rule: "OR('Org1MSP.admin', 'Org1MSP.peer', 'Org1MSP.client')"
      Writers:
        Type: Signature
        Rule: "OR('Org1MSP.admin', 'Org1MSP.client')"
      Admins:
        Type: Signature
        Rule: "OR('Org1MSP.admin')"
      Endorsement:
        Type: Signature
        Rule: "OR('Org1MSP.peer')"

  - &Org2
    # DefaultOrg defines the organization which is used in the sampleconfig
    # of the fabric.git development environment
    Name: Org2MSP

    # ID to load the MSP definition as
    ID: Org2MSP

    MSPDir: ./crypto-config/peerOrganizations/org2.example.com/msp

    # Policies defines the set of policies at this level of the config tree
    # For organization policies, their canonical path is usually
    #   /Channel///
    Policies:
      Readers:
        Type: Signature
        Rule: "OR('Org2MSP.admin', 'Org2MSP.peer', 'Org2MSP.client')"
      Writers:
        Type: Signature
        Rule: "OR('Org2MSP.admin', 'Org2MSP.client')"
      Admins:
        Type: Signature
        Rule: "OR('Org2MSP.admin')"
      Endorsement:
        Type: Signature
        Rule: "OR('Org2MSP.peer')"

################################################################################
#
#   SECTION: Capabilities
#
#   - This section defines the capabilities of fabric network. This is a new
#   concept as of v1.1.0 and should not be utilized in mixed networks with
#   v1.0.x peers and orderers.  Capabilities define features which must be
#   present in a fabric binary for that binary to safely participate in the
#   fabric network.  For instance, if a new MSP type is added, newer binaries
#   might recognize and validate the signatures from this type, while older
#   binaries without this support would be unable to validate those
#   transactions.  This could lead to different versions of the fabric binaries
#   having different world states.  Instead, defining a capability for a channel
#   informs those binaries without this capability that they must cease
#   processing transactions until they have been upgraded.  For v1.0.x if any
#   capabilities are defined (including a map with all capabilities turned off)
#   then the v1.0.x peer will deliberately crash.
#
################################################################################
Capabilities: #这一区域主要是定义版本的兼容情况
  # Channel capabilities apply to both the orderers and the peers and must be
  # supported by both.
  # Set the value of the capability to true to require it.
  Channel: &ChannelCapabilities
    # V2_0 capability ensures that orderers and peers behave according
    # to v2.0 channel capabilities. Orderers and peers from
    # prior releases would behave in an incompatible way, and are therefore
    # not able to participate in channels at v2.0 capability.
    # Prior to enabling V2.0 channel capabilities, ensure that all
    # orderers and peers on a channel are at v2.0.0 or later.
    V2_0: true


  # Orderer capabilities apply only to the orderers, and may be safely
  # used with prior release peers.
  # Set the value of the capability to true to require it.
  Orderer: &OrdererCapabilities
    # V2_0 orderer capability ensures that orderers behave according
    # to v2.0 orderer capabilities. Orderers from
    # prior releases would behave in an incompatible way, and are therefore
    # not able to participate in channels at v2.0 orderer capability.
    # Prior to enabling V2.0 orderer capabilities, ensure that all
    # orderers on channel are at v2.0.0 or later.
    V2_0: true

  # Application capabilities apply only to the peer network, and may be safely
  # used with prior release orderers.
  # Set the value of the capability to true to require it.
  Application: &ApplicationCapabilities
    # V2.5 for Application enables the new non-backwards compatible
    # features of fabric v2.5, namely the ability to purge private data.
    # Prior to enabling V2.5 application capabilities, ensure that all
    # peers on a channel are at v2.5.0 or later.
    V2_5: true

################################################################################
#
#   SECTION: Application
#
#   - This section defines the values to encode into a config transaction or
#   genesis block for application related parameters
#
################################################################################
Application: &ApplicationDefaults # 同上，定义具体的策略

  # Organizations is the list of orgs which are defined as participants on
  # the application side of the network
  Organizations:

  # Policies defines the set of policies at this level of the config tree
  # For Application policies, their canonical path is
  #   /Channel/Application/
  Policies:
    Readers:
      Type: ImplicitMeta
      Rule: "ANY Readers"
    Writers:
      Type: ImplicitMeta
      Rule: "ANY Writers"
    Admins:
      Type: ImplicitMeta
      Rule: "MAJORITY Admins"
    LifecycleEndorsement:
      Type: ImplicitMeta
      Rule: "MAJORITY Endorsement"
    Endorsement:
      Type: ImplicitMeta
      Rule: "MAJORITY Endorsement"

  Capabilities:
    <<: *ApplicationCapabilities
################################################################################
#
#   SECTION: Orderer
#
#   - This section defines the values to encode into a config transaction or
#   genesis block for orderer related parameters
#
################################################################################
Orderer: &OrdererDefaults

  # Orderer Type: The orderer implementation to start
  OrdererType: solo
  # Addresses used to be the list of orderer addresses that clients and peers
  # could connect to.  However, this does not allow clients to associate orderer
  # addresses and orderer organizations which can be useful for things such
  # as TLS validation.  The preferred way to specify orderer addresses is now
  # to include the OrdererEndpoints item in your org definition
  Addresses:
    - orderer.example.com:7050

  EtcdRaft:
    Consenters:
      - Host: orderer.example.com
        Port: 7050
        ClientTLSCert: ./crypto-config/ordererOrganizations/example.com/orderers/orderer.example.com/tls/server.crt
        ServerTLSCert: ./crypto-config/ordererOrganizations/example.com/orderers/orderer.example.com/tls/server.crt

  # Batch Timeout: The amount of time to wait before creating a batch
  BatchTimeout: 2s

  # Batch Size: Controls the number of messages batched into a block
  BatchSize:

    # Max Message Count: The maximum number of messages to permit in a batch
    MaxMessageCount: 10

    # Absolute Max Bytes: The absolute maximum number of bytes allowed for
    # the serialized messages in a batch.
    AbsoluteMaxBytes: 99 MB

    # Preferred Max Bytes: The preferred maximum number of bytes allowed for
    # the serialized messages in a batch. A message larger than the preferred
    # max bytes will result in a batch larger than preferred max bytes.
    PreferredMaxBytes: 512 KB

  # Organizations is the list of orgs which are defined as participants on
  # the orderer side of the network
  Organizations:

  # Policies defines the set of policies at this level of the config tree
  # For Orderer policies, their canonical path is
  #   /Channel/Orderer/
  Policies:
    Readers:
      Type: ImplicitMeta
      Rule: "ANY Readers"
    Writers:
      Type: ImplicitMeta
      Rule: "ANY Writers"
    Admins:
      Type: ImplicitMeta
      Rule: "MAJORITY Admins"
    # BlockValidation specifies what signatures must be included in the block
    # from the orderer for the peer to validate it.
    BlockValidation:
      Type: ImplicitMeta
      Rule: "ANY Writers"

################################################################################
#
#   CHANNEL
#
#   This section defines the values to encode into a config transaction or
#   genesis block for channel related parameters.
#
################################################################################
Channel: &ChannelDefaults
  # Policies defines the set of policies at this level of the config tree
  # For Channel policies, their canonical path is
  #   /Channel/
  Policies:
    # Who may invoke the 'Deliver' API
    Readers:
      Type: ImplicitMeta
      Rule: "ANY Readers"
    # Who may invoke the 'Broadcast' API
    Writers:
      Type: ImplicitMeta
      Rule: "ANY Writers"
    # By default, who may modify elements at this config level
    Admins:
      Type: ImplicitMeta
      Rule: "MAJORITY Admins"

  # Capabilities describes the channel level capabilities, see the
  # dedicated Capabilities section elsewhere in this file for a full
  # description
  Capabilities:
    <<: *ChannelCapabilities

################################################################################
#
#   Profile
#
#   - Different configuration profiles may be encoded here to be specified
#   as parameters to the configtxgen tool
#
################################################################################
Profiles:
  TwoOrgsOrdererGenesis:
    <<: *ChannelDefaults
    Orderer:
      <<: *OrdererDefaults
      Organizations:
        - *OrdererOrg
      Capabilities:
        <<: *OrdererCapabilities
    Consortiums:
      SampleConsortium:
        Organizations:
          - *Org1
          - *Org2
  TwoOrgsChannel:
      Consortium: SampleConsortium
      <<: *ChannelDefaults
      Application:
        <<: *ApplicationDefaults
        Organizations:
          - *Org1
          - *Org2
        Capabilities:
          <<: *ApplicationCapabilities

生成创世区块

configtxgen -profile TwoOrgsOrdererGenesis -channelID byfn-sys-channel -outputBlock ./channel-artifacts/genesis.block # 如果没有channel-artifacts这个文件夹，则需要手动去创建
# -outputBlock 输出的创世区块文件
# -channelID 指定channelID
# -profile 指定策略

生成通道文件

configtxgen -profile TwoOrgsChannel -outputCreateChannelTx ./channel-artifacts/channel.tx -channelID mychannel

开启网络

编写docker-compose文件

touch docker-compose.yaml # 创建一个新文件

orderer组织

version: '2'  #docker版本

networks: # 因为这里在本机搭建 所以创建一个网落
  fabric:

services: # 服务，可以包括若干个容器实例
  orderer.example.com: #定义一个名称为orderer.example.com的服务
    container_name: orderer.example.com #当前容器名称
    image: hyperledger/fabric-orderer:latest # 使用镜像版本
    environment: # 环境
      - FABRIC_LOGGING_SPEC=INFO # fabric网络日志等级 这里为info
      - ORDERER_GENERAL_LISTENADDRESS=0.0.0.0 # orderer节点监听地址
      - ORDERER_GENERAL_LISTENPORT=7050 # orderer节点监听端口
      - ORDERER_GENERAL_GENESISMETHOD=file # 创世区块文件的类型 这里为file
      - ORDERER_GENERAL_GENESISFILE=/var/hyperledger/orderer/orderer.genesis.block # 创世区块文件的位置
      - ORDERER_GENERAL_LOCALMSPID=OrdererMSP # ordererID
      - ORDERER_GENERAL_LOCALMSPDIR=/var/hyperledger/orderer/msp # orderer msp证书存放位置
      - ORDERER_GENERAL_TLS_ENABLED=true # 是否使用tls true使用  false 不使用
      - ORDERER_GENERAL_TLS_PRIVATEKEY=/var/hyperledger/orderer/tls/server.key # TLS私钥路径
      - ORDERER_GENERAL_TLS_CERTIFICATE=/var/hyperledger/orderer/tls/server.crt #TLS证书路径
      - ORDERER_GENERAL_TLS_ROOTCAS=[/var/hyperledger/orderer/tls/ca.crt]  #TLS根证书路径
      - ORDERER_KAFKA_TOPIC_REPLICATIONFACTOR=1 #以下为kafka集群的配置，本文中没有使用到
      - ORDERER_KAFKA_VERBOSE=true
      - ORDERER_GENERAL_CLUSTER_CLIENTCERTIFICATE=/var/hyperledger/orderer/tls/server.crt
      - ORDERER_GENERAL_CLUSTER_CLIENTPRIVATEKEY=/var/hyperledger/orderer/tls/server.key
      - ORDERER_GENERAL_CLUSTER_ROOTCAS=[/var/hyperledger/orderer/tls/ca.crt]
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric # 工作路径
    command: orderer # bash执行的命令
    volumes: # 挂载的卷
      - ./channel-artifacts/genesis.block:/var/hyperledger/orderer/orderer.genesis.block
      - ./crypto-config/ordererOrganizations/example.com/orderers/orderer.example.com/msp:/var/hyperledger/orderer/msp
      - ./crypto-config/ordererOrganizations/example.com/orderers/orderer.example.com/tls/:/var/hyperledger/orderer/tls
    ports: # 开放的端口
      - 7050:7050
    networks: # 使用的网络
      - fabric

启动orderer组织

docker-compose -f docker-compose.yaml up orderer.example.com
# -f 指定docker-compose文件

org1

  # 该教程中不实用leveldb 使用couchdb
  couchdb0.org1.example.com: # 服务名称
    container_name: couchdb0.org1.example.com # 容器名
    image: couchdb:latest # 使用镜像
    environment: # 环境
      - COUCHDB_USER=admin #couchdb0的用户名
      - COUCHDB_PASSWORD=adminpw  #couchdb0的登陆密码
    ports: # 映射端口
      - 5984:5984
    networks:
      - fabric

  peer0.org1.example.com: # 服务名称
    container_name: peer0.org1.example.com  # 容器名
    image: hyperledger/fabric-peer:latest # 使用镜像
    environment: # 环境变量
      - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
      - CORE_PEER_ID=peer0.org1.example.com # peerID
      - CORE_PEER_ADDRESS=peer0.org1.example.com:7051 #peer节点的访问地址
      - CORE_PEER_LISTENADDRESS=0.0.0.0:7051 # peer节点的监听地址
      - CORE_PEER_CHAINCODEADDRESS=peer0.org1.example.com:7052 #peer节点的链码访问地址
      - CORE_PEER_CHAINCODELISTENADDRESS=0.0.0.0:7052 # peer节点链码的访问地址
      - CORE_PEER_GOSSIP_BOOTSTRAP=peer0.org1.example.com:7051 #gossip为共识机制
      - CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer0.org1.example.com:7051 #gossip外部节点，表明为锚节点
      - CORE_PEER_LOCALMSPID=Org1MSP # org1msp
      - FABRIC_LOGGING_SPEC=INFO # 日志等级
      - CORE_PEER_TLS_ENABLED=true # 是否启动tls
      - CORE_PEER_GOSSIP_USELEADERELECTION=true
      - CORE_PEER_GOSSIP_ORGLEADER=false
      - CORE_PEER_PROFILE_ENABLED=true
      - CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/fabric/tls/server.crt # tls证书路径
      - CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/fabric/tls/server.key  # tls密钥路径
      - CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/fabric/tls/ca.crt # tls跟证书路径
      - CORE_CHAINCODE_EXECUTETIMEOUT=300s # 链码执行超时
      - CORE_LEDGER_STATE_STATEDATABASE=CouchDB # 使用couchdb 默认leveldb
      - CORE_LEDGER_STATE_COUCHDBCONFIG_COUCHDBADDRESS=couchdb0.org1.example.com:5984 # couchdb的socket
      - CORE_LEDGER_STATE_COUCHDBCONFIG_USERNAME=admin # couchdb的用户名
      - CORE_LEDGER_STATE_COUCHDBCONFIG_PASSWORD=adminpw # couchdb的密码
    depends_on: # 依赖，需要首先按顺序启动以下容器,但是不会等待以下容器完全启动才启动当前容器
      - couchdb0.org1.example.com # couchdb容器
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer # 工作目录
    command: peer node start # bash执行命令
    volumes: # 挂载的卷
      - /var/run/:/host/var/run/
      - ./crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/msp:/etc/hyperledger/fabric/msp
      - ./crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls:/etc/hyperledger/fabric/tls
    networks: # 网络
      - fabric

  couchdb1.org1.example.com: # 服务名称
    container_name: couchdb1.org1.example.com # 容器名
    image: couchdb:latest # 使用镜像
    environment: # 环境
      - COUCHDB_USER=admin #couchdb0的用户名
      - COUCHDB_PASSWORD=adminpw  #couchdb0的登陆密码
    ports: # 映射端口
      - 5985:5984
    networks:
      - fabric

  peer1.org1.example.com:  # 服务名称
    container_name: peer1.org1.example.com  # 容器名
    image: hyperledger/fabric-peer:latest # 使用镜像
    environment: # 环境变量
      - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
      - CORE_PEER_ID=peer1.org1.example.com # peerID
      - CORE_PEER_ADDRESS=peer1.org1.example.com:7051 #peer节点的访问地址
      - CORE_PEER_LISTENADDRESS=0.0.0.0:7051 # peer节点的监听地址
      - CORE_PEER_CHAINCODEADDRESS=peer1.org1.example.com:7052 #peer节点的链码访问地址
      - CORE_PEER_CHAINCODELISTENADDRESS=0.0.0.0:7052 # peer节点链码的访问地址
      - CORE_PEER_GOSSIP_BOOTSTRAP=peer1.org1.example.com:7051 #gossip为共识机制
      - CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer1.org1.example.com:7051 #gossip外部节点，表明为锚节点
      - CORE_PEER_LOCALMSPID=Org1MSP # org1msp
      - FABRIC_LOGGING_SPEC=INFO # 日志等级
      - CORE_PEER_TLS_ENABLED=true # 是否启动tls
      - CORE_PEER_GOSSIP_USELEADERELECTION=true
      - CORE_PEER_GOSSIP_ORGLEADER=false
      - CORE_PEER_PROFILE_ENABLED=true
      - CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/fabric/tls/server.crt # tls证书路径
      - CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/fabric/tls/server.key  # tls密钥路径
      - CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/fabric/tls/ca.crt # tls跟证书路径
      - CORE_CHAINCODE_EXECUTETIMEOUT=300s # 链码执行超时
      - CORE_LEDGER_STATE_STATEDATABASE=CouchDB # 使用couchdb 默认leveldb
      - CORE_LEDGER_STATE_COUCHDBCONFIG_COUCHDBADDRESS=couchdb1.org1.example.com:5984 # couchdb的socket
      - CORE_LEDGER_STATE_COUCHDBCONFIG_USERNAME=admin # couchdb的用户名
      - CORE_LEDGER_STATE_COUCHDBCONFIG_PASSWORD=adminpw # couchdb的密码
    depends_on: # 依赖，需要首先按顺序启动以下容器,但是不会等待以下容器完全启动才启动当前容器
      - couchdb1.org1.example.com # couchdb容器
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer # 工作目录
    command: peer node start # bash执行命令
    volumes: # 挂载的卷
      - /var/run/:/host/var/run/
      - ./crypto-config/peerOrganizations/org1.example.com/peers/peer1.org1.example.com/msp:/etc/hyperledger/fabric/msp
      - ./crypto-config/peerOrganizations/org1.example.com/peers/peer1.org1.example.com/tls:/etc/hyperledger/fabric/tls
    networks: # 网络
      - fabric

  cli-org1: # 服务名
      container_name: cli-org1-test # 容器名
      image: hyperledger/fabric-tools:latest # 容器镜像
      tty: true # 使用伪终端
      stdin_open: true #标准输入
      environment: # 环境
        - GOPATH=/opt/gopath # go环境目录
        - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
        - FABRIC_LOGGING_SPEC=INFO # 日志等级
        - CORE_PEER_ID=cli # peerID
        - CORE_PEER_ADDRESS=peer0.org1.example.com:7051 # peer访问地址
        - CORE_PEER_LOCALMSPID=Org1MSP # 本机peer mspID
        - CORE_PEER_TLS_ENABLED=true # 是否启用tls
        - CORE_PEER_TLS_CERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/server.crt #tls证书
        - CORE_PEER_TLS_KEY_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/server.key # tls密钥
        - CORE_PEER_TLS_ROOTCERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt # tls根证书
        - CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/users/[email protected]/msp #管理员msp证书
      working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer #工作目录
      command: /bin/bash # bash执行的命令
      volumes: # 挂载的卷
        - /var/run/:/host/var/run/
        - ./chaincode/go/:/opt/gopath/src/github.com/hyperledger/fabric-cluster/chaincode/go
        - ./crypto-config:/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/
        - ./channel-artifacts:/opt/gopath/src/github.com/hyperledger/fabric/peer/channel-artifacts
      networks:
        - fabric

org2

  couchdb0.org2.example.com: # 服务名称
    container_name: couchdb0.org2.example.com # 容器名
    image: couchdb:latest # 使用镜像
    environment: # 环境
      - COUCHDB_USER=admin #couchdb0的用户名
      - COUCHDB_PASSWORD=adminpw  #couchdb0的登陆密码
    ports: # 映射端口
      - 5986:5984
    networks:
      - fabric

  peer0.org2.example.com: # 服务名称
    container_name: peer0.org2.example.com  # 容器名
    image: hyperledger/fabric-peer:latest # 使用镜像
    environment: # 环境变量
      - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
      - CORE_PEER_ID=peer0.org2.example.com # peerID
      - CORE_PEER_ADDRESS=peer0.org2.example.com:7051 #peer节点的访问地址
      - CORE_PEER_LISTENADDRESS=0.0.0.0:7051 # peer节点的监听地址
      - CORE_PEER_CHAINCODEADDRESS=peer0.org2.example.com:7052 #peer节点的链码访问地址
      - CORE_PEER_CHAINCODELISTENADDRESS=0.0.0.0:7052 # peer节点链码的访问地址
      - CORE_PEER_GOSSIP_BOOTSTRAP=peer0.org2.example.com:7051 #gossip为共识机制
      - CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer0.org2.example.com:7051 #gossip外部节点，表明为锚节点
      - CORE_PEER_LOCALMSPID=Org2MSP # org1msp
      - FABRIC_LOGGING_SPEC=INFO # 日志等级
      - CORE_PEER_TLS_ENABLED=true # 是否启动tls
      - CORE_PEER_GOSSIP_USELEADERELECTION=true
      - CORE_PEER_GOSSIP_ORGLEADER=false
      - CORE_PEER_PROFILE_ENABLED=true
      - CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/fabric/tls/server.crt # tls证书路径
      - CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/fabric/tls/server.key  # tls密钥路径
      - CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/fabric/tls/ca.crt # tls跟证书路径
      - CORE_CHAINCODE_EXECUTETIMEOUT=300s # 链码执行超时
      - CORE_LEDGER_STATE_STATEDATABASE=CouchDB # 使用couchdb 默认leveldb
      - CORE_LEDGER_STATE_COUCHDBCONFIG_COUCHDBADDRESS=couchdb0.org2.example.com:5984 # couchdb的socket
      - CORE_LEDGER_STATE_COUCHDBCONFIG_USERNAME=admin # couchdb的用户名
      - CORE_LEDGER_STATE_COUCHDBCONFIG_PASSWORD=adminpw # couchdb的密码
    depends_on: # 依赖，需要首先按顺序启动以下容器,但是不会等待以下容器完全启动才启动当前容器
      - couchdb0.org2.example.com # couchdb容器
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer # 工作目录
    command: peer node start # bash执行命令
    volumes: # 挂载的卷
      - /var/run/:/host/var/run/
      - ./crypto-config/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/msp:/etc/hyperledger/fabric/msp
      - ./crypto-config/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls:/etc/hyperledger/fabric/tls
    networks: # 网络
      - fabric

  couchdb1.org2.example.com: # 服务名称
    container_name: couchdb1.org2.example.com # 容器名
    image: couchdb:latest # 使用镜像
    environment: # 环境
      - COUCHDB_USER=admin #couchdb0的用户名
      - COUCHDB_PASSWORD=adminpw  #couchdb0的登陆密码
    ports: # 映射端口
      - 5987:5984
    networks:
      - fabric

  peer1.org2.example.com:  # 服务名称
    container_name: peer1.org2.example.com  # 容器名
    image: hyperledger/fabric-peer:latest # 使用镜像
    environment: # 环境变量
      - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
      - CORE_PEER_ID=peer1.org2.example.com # peerID
      - CORE_PEER_ADDRESS=peer1.org2.example.com:7051 #peer节点的访问地址
      - CORE_PEER_LISTENADDRESS=0.0.0.0:7051 # peer节点的监听地址
      - CORE_PEER_CHAINCODEADDRESS=peer1.org2.example.com:7052 #peer节点的链码访问地址
      - CORE_PEER_CHAINCODELISTENADDRESS=0.0.0.0:7052 # peer节点链码的访问地址
      - CORE_PEER_GOSSIP_BOOTSTRAP=peer1.org2.example.com:7051 #gossip为共识机制
      - CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer1.org2.example.com:7051 #gossip外部节点，表明为锚节点
      - CORE_PEER_LOCALMSPID=Org2MSP # org1msp
      - FABRIC_LOGGING_SPEC=INFO # 日志等级
      - CORE_PEER_TLS_ENABLED=true # 是否启动tls
      - CORE_PEER_GOSSIP_USELEADERELECTION=true
      - CORE_PEER_GOSSIP_ORGLEADER=false
      - CORE_PEER_PROFILE_ENABLED=true
      - CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/fabric/tls/server.crt # tls证书路径
      - CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/fabric/tls/server.key  # tls密钥路径
      - CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/fabric/tls/ca.crt # tls跟证书路径
      - CORE_CHAINCODE_EXECUTETIMEOUT=300s # 链码执行超时
      - CORE_LEDGER_STATE_STATEDATABASE=CouchDB # 使用couchdb 默认leveldb
      - CORE_LEDGER_STATE_COUCHDBCONFIG_COUCHDBADDRESS=couchdb1.org2.example.com:5984 # couchdb的socket
      - CORE_LEDGER_STATE_COUCHDBCONFIG_USERNAME=admin # couchdb的用户名
      - CORE_LEDGER_STATE_COUCHDBCONFIG_PASSWORD=adminpw # couchdb的密码
    depends_on: # 依赖，需要首先按顺序启动以下容器,但是不会等待以下容器完全启动才启动当前容器
      - couchdb1.org2.example.com # couchdb容器
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer # 工作目录
    command: peer node start # bash执行命令
    volumes: # 挂载的卷
      - /var/run/:/host/var/run/
      - ./crypto-config/peerOrganizations/org2.example.com/peers/peer1.org2.example.com/msp:/etc/hyperledger/fabric/msp
      - ./crypto-config/peerOrganizations/org2.example.com/peers/peer1.org2.example.com/tls:/etc/hyperledger/fabric/tls
    networks: # 网络
      - fabric

  cli-org2: # 服务名
    container_name: cli-org2-test # 容器名
    image: hyperledger/fabric-tools:latest # 容器镜像
    tty: true # 使用伪终端
    stdin_open: true #标准输入
    environment: # 环境
      - GOPATH=/opt/gopath # go环境目录
      - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
      - FABRIC_LOGGING_SPEC=INFO # 日志等级
      - CORE_PEER_ID=cli # peerID
      - CORE_PEER_ADDRESS=peer0.org2.example.com:7051 # peer访问地址
      - CORE_PEER_LOCALMSPID=Org2MSP # 本机peer mspID
      - CORE_PEER_TLS_ENABLED=true # 是否启用tls
      - CORE_PEER_TLS_CERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/server.crt #tls证书
      - CORE_PEER_TLS_KEY_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/server.key # tls密钥
      - CORE_PEER_TLS_ROOTCERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt # tls根证书
      - CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/users/[email protected]/msp #管理员msp证书
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer #工作目录
    command: /bin/bash # bash执行的命令
    volumes: # 挂载的卷
      - /var/run/:/host/var/run/
      - ./chaincode/go/:/opt/gopath/src/github.com/hyperledger/fabric-cluster/chaincode/go
      - ./crypto-config:/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/
      - ./channel-artifacts:/opt/gopath/src/github.com/hyperledger/fabric/peer/channel-artifacts
    networks:
      - fabric

启动fabric网络

docker-compose -f docker-compose.yaml up -d
# 注意: 请先关闭先前打开的orderer网络

创建channel以及加入channel

创建通道需要进入cli容器

# 进入org1的cli
docker exec -it  cli-org1-test bash

创建channel

peer channel create -o orderer.example.com:7050 -c mychannel -f ./channel-artifacts/channel.tx --tls true --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/msp/tlscacerts/tlsca.example.com-cert.pem
# -o  orderer节点的地址
# -c  要创建的通道的ID, 必须小写, 在250个字符以内。
# -f  由configtxgen生成的通道文件, 用于提交给orderer
# -t  创建通道的超时时长, 默认为5s。
# -tls 通信时是否使用tls加密
# --cafile 当前orderer节点pem格式的tls证书文件, 要使用绝对路径。

加入channel

peer channel list -d mychannel.block
# -d 指定channel文件

将org2加入channel

docker cp cli-org1-test:/opt/gopath/src/github.com/hyperledger/fabric/peer/mychannel.block . # 将channel文件复制到当前目录 org2加入需要

docker cp mychannel.block cli-org2-test:/opt/gopath/src/github.com/hyperledger/fabric/peer/ # 将channel文件复制到org2 cli中

进入cli- org2-test容器中

docker exec -it cli-org2-test bash

org2加入channel

peer channel join -b mychannel.block

部署链码

创建链码存放目录

# 首先我们使用以下命令在项目路径下创建一个文件夹名为chaincode
mkdir chaincode

将官方示例的智能合约复制到我们刚刚创建的chaincode文件夹中 go文件夹中。

cd ~/hyperledger/fabric-samples/chaincode
cp -r sacc ~/hyperledger/multinodes/chaincode/go/

进入org1的cli

docker exec -it cli-org1-test bash

切换到链码所在目录

cd /opt/gopath/src/github.com/hyperledger/fabric-cluster/chaincode/go/sacc

设置go语言依赖包

go env -w GOPROXY=https://goproxy.cn,direct
go mod vendor

进入peer目录

cd /opt/gopath/src/github.com/hyperledger/fabric/peer

Fabric生命周期将链码打包在易于阅读的tar文件中，方便协调跨多个组织的安装，使用以下命令打包链码。

peer lifecycle chaincode package sacc.tar.gz  --path github.com/hyperledger/fabric-cluster/chaincode/go/sacc/ --label sacc_1

打包好的链码复制到Org2的cli中

 docker cp cli-org1-test:/opt/gopath/src/github.com/hyperledger/fabric/peer/sacc.tar.gz . # 先复制到本地
 
 docker cp sacc.tar.gz cli-org2-test:/opt/gopath/src/github.com/hyperledger/fabric/peer/ # 再复制到cli-org2

进入org1

docker exec -it cli-org1-test bash # 进入org1客户端

安装链码

peer lifecycle chaincode install sacc.tar.gz # 安装链码

查询链码

peer lifecycle chaincode queryinstalled # 查询链码

使用以下命令批准链码（Org1和Org2的虚拟机中都要进行以下操作，其中链码的ID要根据上面查询的结果替换到下面的命令中）。

peer lifecycle chaincode approveformyorg --channelID mychannel --name sacc --version 1.0 --init-required --package-id sacc_1:1d9838e6893e068a94f055e807b18289559af748e5196a79a640b66305a74428 --sequence 1 --tls true --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem

使用以下命令查看链码是否就绪（Org1和Org2的虚拟机中都要进行以下操作）。

peer lifecycle chaincode checkcommitreadiness --channelID mychannel --name sacc --version 1.0 --init-required --sequence 1 --tls true --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem --output json

进入org2

docker exec -it cli-org2-test bash # 进入org1客户端

安装链码

peer lifecycle chaincode install sacc.tar.gz # 安装链码

查询链码

peer lifecycle chaincode queryinstalled # 查询链码

使用以下命令批准链码（Org1和Org2的虚拟机中都要进行以下操作，其中链码的ID要根据上面查询的结果替换到下面的命令中）。

peer lifecycle chaincode approveformyorg --channelID mychannel --name sacc --version 1.0 --init-required --package-id sacc_1:1d9838e6893e068a94f055e807b18289559af748e5196a79a640b66305a74428 --sequence 1 --tls true --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem

使用以下命令查看链码是否就绪（Org1和Org2的虚拟机中都要进行以下操作）。

peer lifecycle chaincode checkcommitreadiness --channelID mychannel --name sacc --version 1.0 --init-required --sequence 1 --tls true --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem --output json

提交链码

peer lifecycle chaincode commit -o orderer.example.com:7050 --channelID mychannel --name sacc --version 1.0 --sequence 1 --init-required --tls true --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem --peerAddresses peer0.org1.example.com:7051 --tlsRootCertFiles /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses peer0.org2.example.com:7051 --tlsRootCertFiles /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt

链码初始化

peer chaincode invoke -o orderer.example.com:7050 --isInit --ordererTLSHostnameOverride orderer.example.com --tls true --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n sacc --peerAddresses peer0.org1.example.com:7051 --tlsRootCertFiles /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses peer0.org2.example.com:7051 --tlsRootCertFiles /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"Args":["a","bb"]}' 

使用以下命令查询数据

peer chaincode query -C mychannel -n sacc -c '{"Args":["query","a"]}'

使用以下命令调用链码，新增数据。

peer chaincode invoke -o orderer.example.com:7050 --tls true --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n sacc --peerAddresses peer0.org1.example.com:7051 --tlsRootCertFiles /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses peer0.org2.example.com:7051 --tlsRootCertFiles /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"Args":["set","a","cc"]}'