fix(deploy): 初始化并校验公开 API 地址

start.sh

@@ -30,6 +30,7 @@ DEPLOY_DOMAIN="${DEPLOY_DOMAIN:-}"
 DEPLOY_HTTPS_ENV="${DEPLOY_HTTPS_INPUT:-${DEPLOY_HTTPS:-}}"
 DEPLOY_HTTPS=false
 SECURITY_ENV_MODE="upgrade"
+PUBLIC_API_BASE_URL_CANDIDATE=""
 
 is_non_interactive() {
     [ "${DEPLOY_NON_INTERACTIVE:-0}" = "1" ] || [ "${CI:-}" = "true" ] || [ ! -t 0 ]
@@ -237,24 +238,34 @@ setup_env_files() {
         SECURITY_ENV_MODE="new"
     fi
 
-    local web_port
+    local web_port server_port public_scheme socket_scheme
     web_port="$(awk -F= '$1 == "WEB_PORT" { print $2; exit }' .env | tr -d '[:space:]')"
     web_port="${web_port:-3010}"
+    server_port="$(awk -F= '$1 == "SERVER_HTTP_PORT" { print $2; exit }' .env | tr -d '[:space:]')"
+    server_port="${server_port:-3001}"
 
     if [ "$DEPLOY_MODE" = "ip" ]; then
         # IP 模式
-        sed -i.bak "s|^NUXT_PUBLIC_BASE_APIURL=.*|NUXT_PUBLIC_BASE_APIURL=http://${DEPLOY_IP}:3001|" .env
+        sed -i.bak "s|^NUXT_PUBLIC_BASE_APIURL=.*|NUXT_PUBLIC_BASE_APIURL=http://${DEPLOY_IP}:${server_port}|" .env
         sed -i.bak "s|^NUXT_PUBLIC_BASE_SOCKETURL=.*|NUXT_PUBLIC_BASE_SOCKETURL=ws://${DEPLOY_IP}:3002|" .env
         sed -i.bak "s|^NUXT_PUBLIC_SG_APIURL=.*|NUXT_PUBLIC_SG_APIURL=http://${DEPLOY_IP}:3003|" .env
         sed -i.bak "s|^CONFIG_SECURITY_ORIGIN=.*|CONFIG_SECURITY_ORIGIN=http://${DEPLOY_IP}:${web_port}|" .env
+        PUBLIC_API_BASE_URL_CANDIDATE="${DEPLOY_PUBLIC_API_BASE_URL:-http://${DEPLOY_IP}:${server_port}}"
         echo "   ✓ .env 已配置为 IP 模式 (${DEPLOY_IP})"
     else
         # 域名模式
+        public_scheme="http"
+        socket_scheme="ws"
+        if [ "$DEPLOY_HTTPS" = true ]; then
+            public_scheme="https"
+            socket_scheme="wss"
+        fi
         sed -i.bak "s|^NUXT_PUBLIC_BASE_APIURL=.*|NUXT_PUBLIC_BASE_APIURL=/api|" .env
-        sed -i.bak "s|^NUXT_PUBLIC_BASE_SOCKETURL=.*|NUXT_PUBLIC_BASE_SOCKETURL=wss://${DEPLOY_DOMAIN}/socket.io|" .env
+        sed -i.bak "s|^NUXT_PUBLIC_BASE_SOCKETURL=.*|NUXT_PUBLIC_BASE_SOCKETURL=${socket_scheme}://${DEPLOY_DOMAIN}/socket.io|" .env
         sed -i.bak "s|^NUXT_PUBLIC_SG_APIURL=.*|NUXT_PUBLIC_SG_APIURL=/asg-api|" .env
         # 域名模式同时允许同域 HTTP/HTTPS，兼容首次签证书和复用既有证书两种流程。
         sed -i.bak "s|^CONFIG_SECURITY_ORIGIN=.*|CONFIG_SECURITY_ORIGIN=https://${DEPLOY_DOMAIN},http://${DEPLOY_DOMAIN}|" .env
+        PUBLIC_API_BASE_URL_CANDIDATE="${DEPLOY_PUBLIC_API_BASE_URL:-${public_scheme}://${DEPLOY_DOMAIN}/api}"
         echo "   ✓ .env 已配置为域名模式 (${DEPLOY_DOMAIN})"
 
         # 7. Nginx 配置（域名模式）
@@ -490,6 +501,15 @@ main() {
     . ./scripts/init-security-env.sh
     init_security_env .env "$SECURITY_ENV_MODE"
 
+    # 在拉取镜像或重建服务前完成公开地址迁移；非法或无法推导时立即终止。
+    # shellcheck source=scripts/init-public-api-base-url.sh
+    . ./scripts/init-public-api-base-url.sh
+    if [ "$DEPLOY_MODE" = "skip" ]; then
+        init_public_api_base_url .env upgrade "${DEPLOY_PUBLIC_API_BASE_URL:-}"
+    else
+        init_public_api_base_url .env configure "$PUBLIC_API_BASE_URL_CANDIDATE"
+    fi
+
     if [ "$DEPLOY_DRY_RUN" = "1" ]; then
         echo ""
         echo "⚠️  dry-run 模式：跳过 Docker 安装和服务启动"
@@ -508,7 +528,11 @@ main() {
     if [ "$DEPLOY_MODE" = "ip" ] && [ -n "$DEPLOY_IP" ]; then
         echo "访问地址: http://${DEPLOY_IP}:3010"
     elif [ "$DEPLOY_MODE" = "domain" ] && [ -n "$DEPLOY_DOMAIN" ]; then
-        echo "访问地址: http://${DEPLOY_DOMAIN} (配置 Nginx 后)"
+        if [ "$DEPLOY_HTTPS" = true ]; then
+            echo "访问地址: https://${DEPLOY_DOMAIN}"
+        else
+            echo "访问地址: http://${DEPLOY_DOMAIN} (配置 Nginx 后)"
+        fi
         if [ "$DEPLOY_HTTPS" = true ]; then
             echo "HTTPS 已启用"
         fi