From 5d8ed1f293c6ed8c4fc436050c1a744f4f09ffe2 Mon Sep 17 00:00:00 2001
From: wangbo <wangbolhr@163.com>
Date: Tue, 28 Jul 2026 05:53:00 +0800
Subject: [PATCH] =?UTF-8?q?fix(deploy):=20=E5=9B=BA=E5=AE=9A=E8=AF=81?=
 =?UTF-8?q?=E4=B9=A6=E5=90=8C=E6=AD=A5=E7=9A=84=E9=A6=99=E6=B8=AF=20SSH=20?=
 =?UTF-8?q?Host=20Key?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

通过已认证的香港管理连接读取 Ed25519 host 公钥，将 WireGuard 地址 10.77.0.2 的精确键写入宁波 known_hosts，再执行证书同步；不关闭 StrictHostKeyChecking。

验证：远端 host key 格式解析、bash -n、ShellCheck，首次同步因缺少 known_hosts 的现场复现。
---
 scripts/cluster/install-certificate-sync.sh | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/scripts/cluster/install-certificate-sync.sh b/scripts/cluster/install-certificate-sync.sh
index 3d959dd..94616a9 100755
--- a/scripts/cluster/install-certificate-sync.sh
+++ b/scripts/cluster/install-certificate-sync.sh
@@ -6,6 +6,13 @@ script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 source "$script_dir/common.sh"
 load_cluster_env
 
+hongkong_host_key=$(cluster_ssh "$CLUSTER_HONGKONG_HOST" \
+  "cut -d ' ' -f 1,2 /etc/ssh/ssh_host_ed25519_key.pub")
+[[ $hongkong_host_key =~ ^ssh-ed25519\ [A-Za-z0-9+/]+={0,2}$ ]] || {
+  echo 'invalid Hong Kong SSH host key' >&2
+  exit 1
+}
+
 public_key=$(cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
 set -euo pipefail
 install -d -m 0700 /root/.ssh
@@ -28,6 +35,20 @@ chmod 0600 /root/.ssh/authorized_keys
 grep -Fqx "$public_key" /root/.ssh/authorized_keys || printf '%s\n' "$public_key" >>/root/.ssh/authorized_keys
 REMOTE
 
+cluster_ssh "$CLUSTER_NINGBO_HOST" bash -s -- "$hongkong_host_key" <<'REMOTE'
+set -euo pipefail
+hongkong_host_key=$1
+install -d -m 0700 /root/.ssh
+known_hosts=/root/.ssh/known_hosts
+temporary=$(mktemp /root/.ssh/known_hosts.XXXXXX)
+if [[ -f $known_hosts ]]; then
+  grep -Ev '^10\.77\.0\.2([ ,]|$)' "$known_hosts" >"$temporary" || true
+fi
+printf '10.77.0.2 %s\n' "$hongkong_host_key" >>"$temporary"
+chmod 0600 "$temporary"
+mv "$temporary" "$known_hosts"
+REMOTE
+
 cluster_scp "$script_dir/sync-nginx-certificate.sh" \
   "$CLUSTER_NINGBO_HOST:/usr/local/sbin/easyai-sync-nginx-certificate"
 cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'