feat(update): 发布双链路更新进度与线上验收审计

scripts/Initialize-SecurityEnv.ps1

@@ -58,7 +58,9 @@ function Initialize-SecurityEnv {
     $definitions = @(
         @{ Key = "CONFIG_JWT_SECRET"; Legacy = "this is a very secret secret"; MinLength = 32 },
         @{ Key = "WS_AUTH_WS_TICKET_SECRET"; Legacy = ""; MinLength = 32 },
-        @{ Key = "SYSTEM_UPDATE_INTERNAL_TOKEN"; Legacy = ""; MinLength = 32 }
+        @{ Key = "SYSTEM_UPDATE_INTERNAL_TOKEN"; Legacy = ""; MinLength = 32 },
+        @{ Key = "WATCHTOWER_API_KEY"; Legacy = ""; MinLength = 32 },
+        @{ Key = "WATCHTOWER_HTTP_API_EVENTS_TOKEN"; Legacy = ""; MinLength = 32 }
     )
     if ($Mode -eq "new") {
         $definitions += @(

scripts/init-security-env.sh

@@ -130,6 +130,8 @@ init_security_env() {
     ensure_security_secret "$file" "CONFIG_JWT_SECRET" "this is a very secret secret"
     ensure_security_secret "$file" "WS_AUTH_WS_TICKET_SECRET"
     ensure_security_secret "$file" "SYSTEM_UPDATE_INTERNAL_TOKEN"
+    ensure_security_secret "$file" "WATCHTOWER_API_KEY"
+    ensure_security_secret "$file" "WATCHTOWER_HTTP_API_EVENTS_TOKEN"
     ensure_env_list_item "$file" "WS_AUTH_METHODS" "ws_ticket" "none,bearer"
     if [ "$mode" = "new" ]; then
         ensure_security_secret "$file" "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY"

scripts/test-deployment-public-url.sh

@@ -145,7 +145,12 @@ for service in ("mongo", "rabbitmq", "video-edit", "dozzle", "agent-memory"):
 watchtower = services["watchtower"]
 command = " ".join(watchtower.get("command") or [])
 assert "http-api-update" not in command, command
-assert "WATCHTOWER_HTTP_API_TOKEN" not in (watchtower.get("environment") or {}), watchtower.get("environment")
+watchtower_env = watchtower.get("environment") or {}
+assert watchtower.get("ports") in (None, []), watchtower.get("ports")
+assert set(watchtower_env["WATCHTOWER_HTTP_API_ENDPOINTS"].split(",")) == {"health", "update", "metrics", "events", "history"}
+assert len(watchtower_env["WATCHTOWER_HTTP_API_TOKEN"]) >= 32
+assert len(watchtower_env["WATCHTOWER_HTTP_API_EVENTS_TOKEN"]) >= 32
+assert watchtower_env["WATCHTOWER_HTTP_API_TOKEN"] != watchtower_env["WATCHTOWER_HTTP_API_EVENTS_TOKEN"]
 watchtower_mounts = {(item.get("source"), item.get("target")) for item in watchtower.get("volumes") or []}
 assert any(target == "/config.json" for _, target in watchtower_mounts), watchtower_mounts
 assert services["dozzle"]["environment"]["DOZZLE_ENABLE_DOWNLOAD"] == "false", services["dozzle"]["environment"]
@@ -162,6 +167,7 @@ watchtower = services["watchtower"]
 
 assert updater.get("ports") in (None, []), updater.get("ports")
 assert updater.get("read_only") is True, updater.get("read_only")
+assert updater["networks"]["easyai"]["ipv4_address"] == "172.21.0.31", updater["networks"]
 assert set(updater.get("cap_drop") or []) == {"ALL"}, updater.get("cap_drop")
 assert "no-new-privileges:true" in (updater.get("security_opt") or []), updater.get("security_opt")
 mounts = {(item.get("source"), item.get("target")) for item in updater.get("volumes") or []}
@@ -201,7 +207,7 @@ assert manifest["channel"] == "stable"
 assert manifest["platform"] == "linux/amd64"
 assert manifest["managedUpdateAllowed"] is True
 assert manifest["rollbackSafe"] is True
-assert manifest["minimumUpdaterVersion"] == "1.0.0"
+assert manifest["minimumUpdaterVersion"] == "1.1.0"
 assert manifest["minimumDeploymentSchemaVersion"] == 2
 assert int(manifest["requiredFreeBytes"]) > 0
 components = {item["key"]: item for item in manifest["components"]}

scripts/test-update-env-migrations.sh

@@ -24,7 +24,12 @@ grep -qx 'EXISTING_VALUE=keep-me' "$LEGACY_ENV_FILE"
 grep -qx 'SYSTEM_UPDATE_MODE=legacy_watchtower' "$LEGACY_ENV_FILE"
 grep -qx 'COMPOSE_PROFILES=customer-profile' "$LEGACY_ENV_FILE"
 grep -qx 'WATCHTOWER_CLEANUP=' "$LEGACY_ENV_FILE"
-[ "$(wc -l < "$LEGACY_ENV_FILE" | tr -d ' ')" = "4" ]
+grep -qx 'WATCHTOWER_HTTP_API_PERIODIC_POLLS=false' "$LEGACY_ENV_FILE"
+grep -qx 'WATCHTOWER_UPDATE_TARGET=easyai-server easyai-wsgateway easyai-web' "$LEGACY_ENV_FILE"
+grep -qx 'WATCHTOWER_IMAGE=registry.cn-shanghai.aliyuncs.com/comfy-ai/watchtower-aliyun:1.22.3' "$LEGACY_ENV_FILE"
+cp "$LEGACY_ENV_FILE" "$TMP_DIR/legacy-first-run.env"
+bash "$PROJECT_ROOT/scripts/apply-update-env-migrations.sh" "$LEGACY_ENV_FILE" "$PROJECT_ROOT" >/dev/null
+cmp "$LEGACY_ENV_FILE" "$TMP_DIR/legacy-first-run.env"
 
 ENV_FILE="$TMP_DIR/.env"
 cat > "$ENV_FILE" <<'EOF'
@@ -43,6 +48,7 @@ read_value() {
 [ "$(read_value SYSTEM_UPDATE_MODE)" = "managed" ]
 [ "$(read_value COMPOSE_PROFILES)" = "customer-profile,managed-update" ]
 [ "$(read_value WATCHTOWER_CLEANUP)" = "true" ]
+[ "$(read_value WATCHTOWER_HTTP_API_PERIODIC_POLLS)" = "true" ]
 [ "$(read_value WATCHTOWER_CORE_UPDATE_ENABLED)" = "false" ]
 [ "$(read_value WATCHTOWER_UPDATE_TARGET)" = "easyai-updater" ]
 [ "$(read_value SYSTEM_UPDATER_UPDATE_INTERVAL_SECONDS)" = "86400" ]

scripts/update-env.d/020-watchtower-progress.env

@@ -0,0 +1,2 @@
+# 两种更新模式均启用内网接口；安全令牌由安全初始化脚本生成。
+WATCHTOWER_IMAGE=registry.cn-shanghai.aliyuncs.com/comfy-ai/watchtower-aliyun:1.22.3

scripts/update-env.d/021-watchtower-managed-polls.env

@@ -0,0 +1,2 @@
+@skip-if SYSTEM_UPDATE_MODE=legacy_watchtower
+WATCHTOWER_HTTP_API_PERIODIC_POLLS=true

scripts/update-env.d/022-watchtower-legacy-polls.env

@@ -0,0 +1,3 @@
+@skip-if SYSTEM_UPDATE_MODE=managed
+WATCHTOWER_HTTP_API_PERIODIC_POLLS=false
+WATCHTOWER_UPDATE_TARGET=easyai-server easyai-wsgateway easyai-web