wangbo/easyai
35
1
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Compare commits

base: wangbo/easyai:efd843b1b293c2ba895be2c776172f8dc8377101
Branches Tags
wangbo/easyai:main
..
compare: wangbo/easyai:f31e3494096559a1df8733ff6225c00d5ebc4706
Branches Tags
wangbo/easyai:main
5 Commits
efd843b1b2 .. f31e349409
Author SHA1 Message Date
wangbo f31e349409 feat(config): 添加 Node.js 堆内存配置和代理路径规范化
Test deployment public URL (Linux) / test-linux (push) Canceled after 0s
Details
Test start.ps1 (Windows) / test-windows (push) Canceled after 0s
Details 
- 在 .env.sample 中新增 NODE_MAX_OLD_SPACE_SIZE 配置项，默认设置为 8192 MiB
- 在 docker-compose.yml 中添加 NODE_OPTIONS 环境变量配置
- 在 easyai-proxy.conf.sample 中添加 /api 路径规范化重定向规则
- 修改 https.sh 脚本优先使用完整代理模板生成配置文件
- 更新 README.md 添加新版本发布说明
- 扩展测试脚本验证代理配置和路径重定向功能
 2026-07-24 22:10:45 +08:00
wangbo 6ee9666b0c fix(deploy): 初始化并校验公开 API 地址 2026-07-16 01:00:32 +08:00
wangbo 64bbf5c109 feat(deploy): initialize authentication security secrets 2026-07-15 11:29:41 +08:00
wangbo 2a40ad91c8 优化部署脚本非交互变量支持 2026-06-30 22:12:26 +08:00
wangbo d54cf2f6ce chore: enable gzip for nginx api responses 2026-06-30 22:00:27 +08:00
19 changed files with 1482 additions and 86 deletions
Expand all files Collapse all files
.env.sample
+38 -1
View File
@@ -8,6 +8,13 @@
NUXT_PUBLIC_BASE_APIURL=http://127.0.0.1:3001
# 域名访问：NUXT_PUBLIC_BASE_APIURL=/api
# 后端生成文件、预签名地址和异步任务查询地址时使用的公开 API 根地址。
# 留空时启动/升级脚本会根据本节已有配置初始化；手工维护时必须填写完整 http(s) URL。
CONFIG_PUBLIC_API_BASE_URL=
# 启动/升级脚本的高级覆盖项，适用于已有外部 TLS、特殊端口或手工反向代理。
# 示例：https://api.example.com:8443/api
DEPLOY_PUBLIC_API_BASE_URL=
# 默认 WebSocket 地址
NUXT_PUBLIC_BASE_SOCKETURL=ws://127.0.0.1:3002
# 域名访问：NUXT_PUBLIC_BASE_SOCKETURL=wss://yourwebsite.com/socket.io
@@ -23,6 +30,9 @@ WEB_PORT=3010
SERVER_HTTP_PORT=3001
# easyai-server 后端 HTTP 端口
NODE_MAX_OLD_SPACE_SIZE=8192
# easyai-server 的 Node.js V8 old-space 堆上限，单位 MiB
MALLOC_ARENA_MAX=2
# 限制 glibc native heap arena，降低 sharp/libvips 场景下 RSS 膨胀
MALLOC_TRIM_THRESHOLD_=131072
@@ -106,7 +116,34 @@ CONFIG_MQ_VHOST=/
# ========== 8. 鉴权与安全 ==========
CONFIG_TOKEN_EXPIRE=1800
CONFIG_JWT_SECRET='this is a very secret secret'
# JWT 签名密钥。启动/升级脚本发现空值、历史默认值或不足 32 字节时会生成并持久化到 .env。
# 也可手动生成：openssl rand -base64 48
CONFIG_JWT_SECRET=
# 后台 JWT 动态配置的 AES-256-GCM 独立主密钥，建议与 JWT 签名密钥分别生成。
# 启动/升级脚本会为新部署生成；数据库中已有的 JWT 轮转配置优先，不会被覆盖。
CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY=
# 验证码 HMAC、设备/指纹哈希和审计完整性密钥，由启动/升级脚本独立生成并持久化。
CONFIG_OTP_HASH_SECRET=
CONFIG_AUDIT_HASH_PEPPER=
CONFIG_AUDIT_INTEGRITY_KEY=
# 允许访问后端的浏览器 Origin，多个值用英文逗号分隔，生产环境禁止使用 *。
# 域名部署示例：https://yourwebsite.com,https://www.yourwebsite.com
CONFIG_SECURITY_ORIGIN=http://127.0.0.1:3010,http://localhost:3010
# 可信反向代理 IP/CIDR，多个值用英文逗号分隔；未使用反向代理时保持为空。
# 仅填写实际 Nginx/负载均衡地址，不要使用 0.0.0.0/0。
CONFIG_TRUSTED_PROXY=
# 完成身份冲突扫描和人工处置后才能启用手机号、邮箱和微信身份唯一索引。
CONFIG_AUTH_UNIQUE_INDEXES_ENABLED=false
# 仅在首次创建 admin 账号时使用；启动脚本会生成随机值并持久化到 .env。
# 已存在 admin 的升级环境不会使用或修改现有管理员密码。
CONFIG_INITIAL_ADMIN_PASSWORD=
CONFIG_TOKEN_SIGN_SK=easyai2025easyai
# ========== 9. 运维与调试 ==========
.github/workflows/test-deployment-public-url.yml
+42
View File
@@ -0,0 +1,42 @@
name: Test deployment public URL (Linux)
on:
push:
paths:
- 'start.sh'
- 'update.sh'
- 'docker-compose.yml'
- 'easyai-proxy.conf.sample'
- '.env.sample'
- 'scripts/init-public-api-base-url.sh'
- 'scripts/test-public-api-base-url.sh'
- 'scripts/test-deployment-public-url.sh'
- '.github/workflows/test-deployment-public-url.yml'
pull_request:
paths:
- 'start.sh'
- 'update.sh'
- 'docker-compose.yml'
- 'easyai-proxy.conf.sample'
- '.env.sample'
- 'scripts/init-public-api-base-url.sh'
- 'scripts/test-public-api-base-url.sh'
- 'scripts/test-deployment-public-url.sh'
- '.github/workflows/test-deployment-public-url.yml'
workflow_dispatch:
jobs:
test-linux:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Check shell syntax
run: |
bash -n start.sh update.sh scripts/init-public-api-base-url.sh scripts/test-public-api-base-url.sh scripts/test-deployment-public-url.sh
- name: Test migration helper
run: bash scripts/test-public-api-base-url.sh
- name: Test deployment dry-run matrix
run: bash scripts/test-deployment-public-url.sh
.github/workflows/test-start-ps1.yml
+14 -1
View File
@@ -5,11 +5,17 @@ on:
push:
paths:
- 'start.ps1'
- 'update.ps1'
- 'scripts/Initialize-PublicApiBaseUrl.ps1'
- 'scripts/Test-PublicApiBaseUrl.ps1'
- '.env.sample'
- '.github/workflows/test-start-ps1.yml'
pull_request:
paths:
- 'start.ps1'
- 'update.ps1'
- 'scripts/Initialize-PublicApiBaseUrl.ps1'
- 'scripts/Test-PublicApiBaseUrl.ps1'
- '.env.sample'
- '.github/workflows/test-start-ps1.yml'
workflow_dispatch:
@@ -25,6 +31,7 @@ jobs:
DEPLOY_DRY_RUN: "1"
DEPLOY_IP: "192.168.1.100"
run: |
(Get-Content .env.sample) -replace '^SERVER_HTTP_PORT=.*$', 'SERVER_HTTP_PORT=4100' | Set-Content .env.sample -Encoding UTF8
powershell -ExecutionPolicy Bypass -File .\start.ps1
- name: Verify .env
@@ -32,7 +39,13 @@ jobs:
$api = Select-String -Path .env -Pattern '^NUXT_PUBLIC_BASE_APIURL=' | ForEach-Object { $_.Line }
$socket = Select-String -Path .env -Pattern '^NUXT_PUBLIC_BASE_SOCKETURL=' | ForEach-Object { $_.Line }
$sg = Select-String -Path .env -Pattern '^NUXT_PUBLIC_SG_APIURL=' | ForEach-Object { $_.Line }
if ($api -ne 'NUXT_PUBLIC_BASE_APIURL=http://192.168.1.100:3001') { exit 1 }
$publicApi = Select-String -Path .env -Pattern '^CONFIG_PUBLIC_API_BASE_URL=' | ForEach-Object { $_.Line }
if ($api -ne 'NUXT_PUBLIC_BASE_APIURL=http://192.168.1.100:4100') { exit 1 }
if ($socket -ne 'NUXT_PUBLIC_BASE_SOCKETURL=ws://192.168.1.100:3002') { exit 1 }
if ($sg -ne 'NUXT_PUBLIC_SG_APIURL=http://192.168.1.100:3003') { exit 1 }
if ($publicApi -ne 'CONFIG_PUBLIC_API_BASE_URL=http://192.168.1.100:4100') { exit 1 }
Write-Host "OK: .env 配置正确"
- name: Test public API URL migration helper
run: |
powershell -ExecutionPolicy Bypass -File .\scripts\Test-PublicApiBaseUrl.ps1
README.md
+115
View File
@@ -6,6 +6,67 @@
git clone --depth 1 https://git.51easyai.com/wangbo/easyai.git && cd easyai && chmod +x start.sh && ./start.sh
```
也可以通过环境变量直接传入部署方式，脚本会跳过对应问答：
```bash
# IP 访问
DEPLOY_ACCESS=ip DEPLOY_IP=服务器IP ./start.sh
# 域名访问，不申请 HTTPS 证书
DEPLOY_ACCESS=domain DEPLOY_DOMAIN=demo.example.com DEPLOY_HTTPS=false ./start.sh
# 域名访问，并自动申请 HTTPS 证书
DEPLOY_ACCESS=domain DEPLOY_DOMAIN=demo.example.com DEPLOY_HTTPS=true CERTBOT_EMAIL=ops@example.com ./start.sh
```
常用变量：
| 变量 | 说明 |
|------|------|
| `DEPLOY_ACCESS` | `ip` 或 `domain`；未传时进入问答选择 |
| `DEPLOY_IP` | IP 模式访问地址，如 `10.0.0.8` |
| `DEPLOY_DOMAIN` | 域名模式访问地址，可带 `http://` 或 `https://`，脚本会自动清理 |
| `DEPLOY_HTTPS` | `true/false`，域名模式下是否申请 HTTPS 证书 |
| `DEPLOY_PUBLIC_API_BASE_URL` | 高级覆盖后端公开 API 地址，例如 `https://api.example.com:8443/api` |
| `CERTBOT_EMAIL` | 申请 HTTPS 证书使用的邮箱，默认 `wangbo@51easyai.com` |
| `DEPLOY_FORCE_RECONFIG` | 非空时即使已有 `.env` 也重新生成部署配置 |
| `DEPLOY_DRY_RUN` | `1` 时只生成配置文件，不安装 Docker、不启动服务 |
| `DEPLOY_NON_INTERACTIVE` | `1` 时缺少必要变量会直接报错，不再进入问答 |
| `DEPLOY_MAC_DOCKER_INSTALL` | macOS 未安装 Docker 时使用，`auto` 自动安装或 `manual` 提示手动安装 |
#### 后端公开 API 地址
后端返回文件、预签名上传和异步任务查询地址时，按以下优先级确定公开入口：
1. `.env` 中的 `CONFIG_PUBLIC_API_BASE_URL`。
2. 来自可信代理的当前请求地址（仅当请求来源命中 `CONFIG_TRUSTED_PROXY` 时读取转发 Header）。
3. 当前请求的直接 `Host`。
启动和升级脚本会在拉取镜像、重建服务之前校验并持久化 `CONFIG_PUBLIC_API_BASE_URL`：新 IP 部署使用 `http://IP:${SERVER_HTTP_PORT}`；域名部署中 `DEPLOY_HTTPS=false` 使用 `http/ws`，`DEPLOY_HTTPS=true` 使用 `https/wss`，API 路径均为 `/api`。旧环境缺少该配置时，会依次从绝对 `NUXT_PUBLIC_BASE_APIURL`、WebSocket origin、首个 `CONFIG_SECURITY_ORIGIN` 推导。已有合法值保持不变，非法或无法推导时脚本会终止并提示修复。
已有外部 TLS、手工代理、自定义公开端口或特殊路径时，可在执行脚本前设置高级覆盖：
```bash
DEPLOY_PUBLIC_API_BASE_URL=https://api.example.com:8443/custom-api ./update.sh
```
也可以直接在 `.env` 中维护：
```dotenv
CONFIG_PUBLIC_API_BASE_URL=https://api.example.com:8443/api
CONFIG_TRUSTED_PROXY=127.0.0.1,10.0.0.0/8
```
新的 `easyai-proxy.conf.sample` 会为 `/api/` 和 `/mcp` 转发保留客户端 authority 中的显式端口，并补齐 `X-Forwarded-Host`、`X-Forwarded-Port`；`/api/` 继续发送 `X-Original-Prefix: /api`。脚本不会改写已经生成的本地 Nginx 配置，旧部署可先通过显式 `CONFIG_PUBLIC_API_BASE_URL` 生效，再按模板手工同步代理 Header。
`https.sh` 单独执行时也可以跳过域名选择：
```bash
DEPLOY_DOMAIN=demo.example.com EASYAI_PROXY_CONF=demo.example.com.conf CERTBOT_EMAIL=ops@example.com ./https.sh
```
如需对已有 Nginx 配置追加或替换域名，可设置 `EASYAI_PROXY_DOMAIN_ACTION=add|replace`；未设置时默认追加。
### Windows
在 **PowerShell** 中执行：
@@ -14,6 +75,24 @@ git clone --depth 1 https://git.51easyai.com/wangbo/easyai.git && cd easyai && c
git clone --depth 1 "https://git.51easyai.com/wangbo/easyai.git" "easyai"; Set-Location "easyai"; powershell.exe -NoProfile -ExecutionPolicy Bypass -File ".\start.ps1"
```
Windows 也支持变量方式跳过选择：
```powershell
# 本机访问
$env:DEPLOY_ACCESS = "local"
powershell.exe -NoProfile -ExecutionPolicy Bypass -File ".\start.ps1"
# 局域网访问
$env:DEPLOY_IP = "192.168.1.10"
powershell.exe -NoProfile -ExecutionPolicy Bypass -File ".\start.ps1"
# 仅生成配置，不启动 Docker
$env:DEPLOY_IP = "127.0.0.1"
$env:DEPLOY_DRY_RUN = "1"
$env:DEPLOY_NO_WAIT = "1"
powershell.exe -NoProfile -ExecutionPolicy Bypass -File ".\start.ps1"
```
> **Windows 脚本权限说明**：PowerShell 默认禁止运行脚本，直接双击 `start.ps1` 会闪退。
>
> - **推荐**：使用 `powershell.exe -NoProfile -ExecutionPolicy Bypass -File ".\start.ps1"` 执行，无需修改系统策略
@@ -48,6 +127,12 @@ mv easyai easyai2
```
3. 重新执行一键部署命令，按脚本提示完成初始化输入。
如果希望跳过问答，可直接传入变量：
```bash
DEPLOY_ACCESS=ip DEPLOY_IP=服务器IP ./start.sh
# 或
DEPLOY_ACCESS=domain DEPLOY_DOMAIN=demo.example.com DEPLOY_HTTPS=false ./start.sh
```
4. 当脚本询问是否启用 HTTPS 时：
- 如果你之前已经有可用证书，填写 `N`（不生成新证书）。
@@ -58,6 +143,7 @@ mv easyai easyai2
update.sh 脚本用于自动更新 EasyAI 应用，包含以下功能：
- **拉取整个仓库**：执行 `git pull` 获取最新代码（docker-compose.yml、start.sh、.env.*.sample 等全部文件）
- 自动补齐缺失的环境配置文件（.env、.env.tools、.env.ASG、.env.AMS，从 .sample 生成且不覆盖已有文件）
- 在重建服务前迁移并校验 `CONFIG_PUBLIC_API_BASE_URL`
- 兼容 `docker compose` 和 `docker-compose` 两种命令格式
- 自动拉取最新镜像并重启服务
@@ -80,6 +166,18 @@ chmod +x update.sh
- `[2]` 仅更新镜像并重启（跳过 git pull，适用于有本地修改不想被覆盖的场景）
- 如果本次**不涉及配置文件更新**（如 `.env*`、`docker-compose.yml`、`easyai-proxy.conf*` 无变更），可直接选择 `[2]`，仅更新后台服务镜像并重启即可。
- 自动化更新可通过变量跳过选择：
```bash
# 更新仓库 + 拉取镜像 + 重启（等同默认选 1）
UPDATE_MODE=full ./update.sh
# 仅拉取镜像 + 重启（等同选 2）
UPDATE_MODE=image ./update.sh
# 或使用布尔变量
UPDATE_SKIP_REPO_UPDATE=true ./update.sh
```
- **查看帮助**：`./update.sh -h` 或 `./update.sh --help`
### 更新说明
@@ -94,11 +192,28 @@ Windows 下使用 `update.ps1`，功能与 Linux 版一致：
```
- 执行后会**命令行内选择**：`[1]` 更新并拉取仓库 + 更新镜像（默认）；`[2]` 仅更新镜像
- 需在 Git 克隆的 easyai 目录下运行
- 也可通过变量跳过选择：
```powershell
$env:UPDATE_MODE = "image"
$env:UPDATE_NO_WAIT = "1"
.\update.ps1
```
---
## 重要更新记录：
### 2026.07.16
1. **公开 URL 稳定化**：新增 `CONFIG_PUBLIC_API_BASE_URL`，后端文件、预签名和任务查询地址不再依赖 Redis 中缓存的首次请求 Host。
2. **新装与升级迁移**：Linux/macOS 和 Windows 启动、升级脚本会在重建服务前初始化并校验公开 API 地址，支持 IP 自定义 `SERVER_HTTP_PORT`、HTTP/HTTPS 域名和 `DEPLOY_PUBLIC_API_BASE_URL` 高级覆盖。
3. **代理端口透传**：新 Nginx 模板为 `/api/`、`/mcp` 补齐公开 Host/Port Header；已有生成配置不会自动改写。
### 2026.07.15
1. **主服务 Node.js 堆内存上限**：`easyai-server` 默认通过 `NODE_OPTIONS` 将 V8 old-space 堆上限设置为 8192 MiB，可在 `.env` 中使用 `NODE_MAX_OLD_SPACE_SIZE` 覆盖。该值只限制 V8 堆，不包含 Buffer、sharp/libvips 等 native 内存。
2. **生效要求**：该参数仅在创建 Node.js 进程时读取，更新部署文件后需要在合适的维护窗口重建 `easyai-server` 容器。
### 2026.06.24
1. **主服务 sharp/native 内存护栏**：`easyai-server` 默认关闭 sharp/libvips cache，并将 sharp 并发限制为 1；同时设置 `MALLOC_ARENA_MAX=2`、`MALLOC_TRIM_THRESHOLD_=131072`、`MALLOC_MMAP_THRESHOLD_=131072`、`MALLOC_TOP_PAD_=131072`，降低图片处理和大 Buffer 场景下 native RSS 持续膨胀风险。
docker-compose.yml
+2
View File
@@ -68,6 +68,8 @@ services:
# - ./data/backend/pm2.config.js:/app/pm2.config.js
restart: unless-stopped
environment:
# Node.js V8 old-space 堆上限（MiB），可在 .env 中覆盖
- NODE_OPTIONS=--max-old-space-size=${NODE_MAX_OLD_SPACE_SIZE:-8192}
# MongoDB配置，用户管理，不会配置的话保持默认即可
- CONFIG_DB_MONGO_URI=mongodb://172.21.0.3:27017
- CONFIG_DB_MONGO_USERNAME=${MONGO_INITDB_ROOT_USERNAME}
docs/Windows一键部署方案.md
+22 -9
View File
@@ -7,6 +7,7 @@
- **仅 IP 访问**：不含域名模式与 HTTPS
- **本地访问无需放行端口**：选择本地 (127.0.0.1) 时，不涉及防火墙配置
- **Docker 未安装时**：用户可选择手动或自动安装 **Docker Desktop for Windows**（winget/Chocolatey）
- **支持变量非交互部署**：通过 `DEPLOY_IP` 或 `DEPLOY_ACCESS=local` 可跳过访问方式选择
## 2. Linux start.sh 流程梳理
@@ -103,9 +104,13 @@ Windows 版**仅支持 IP 访问**，不包含域名模式与 HTTPS 配置。用
| 变量 | 说明 |
|------|------|
| `DEPLOY_ACCESS` | `local` 时直接使用 `127.0.0.1`；`lan`/`ip` 需要同时传 `DEPLOY_IP` |
| `DEPLOY_IP` | 访问 IP（本地填 `127.0.0.1`，局域网填实际 IP） |
| `DEPLOY_DRY_RUN` | 1 时只生成配置，不安装/启动 Docker |
| `DEPLOY_FORCE_RECONFIG` | 非空时强制重新配置 |
| `DEPLOY_NON_INTERACTIVE` | 1 时缺少必要变量会直接报错，不进入问答 |
| `DEPLOY_DOCKER_INSTALL` | Docker Desktop 未安装时使用，`manual` 打开下载地址，`auto` 使用 winget/choco 自动安装 |
| `DEPLOY_NO_WAIT` | 1 时脚本结束或失败不等待按 Enter |
### 5.4 配置文件修改实现（仅 IP 模式）
@@ -126,6 +131,7 @@ Set-Content .env -Value $content -Encoding UTF8 -NoNewline
- **未安装时**： prompt 让用户选择
- `[1] 手动安装`：输出安装说明及 Docker Desktop for Windows 下载链接，退出脚本
- `[2] 自动安装`：通过 winget 或 Chocolatey 安装 Docker Desktop for Windows，安装后需用户重启终端/机器再继续
- 若设置 `DEPLOY_DOCKER_INSTALL=manual|auto`，脚本会直接执行对应分支，不再提示选择
### 5.6 执行策略
@@ -154,15 +160,16 @@ powershell -ExecutionPolicy Bypass -File .\start.ps1
## 7. 实现清单
- [ ] 创建 `start.ps1` 主脚本
- [ ] 实现 `Init-ProjectDir`：项目目录校验
- [ ] 实现 `Run-DeployQuestions`：本地 / 局域网 IP 选择（无域名/HTTPS）
- [ ] 实现 `Setup-EnvFiles`：配置文件生成与替换
- [ ] 实现 `Test-Docker`：Docker 检测，未安装时 prompt「手动安装」或「自动安装」
- [ ] 实现 `Install-Docker`：自动安装 **Docker Desktop for Windows**（winget / Chocolatey）
- [ ] 实现 `Start-Services`：`docker compose` 启动
- [ ] 实现 `Main`：主流程串联
- [ ] 支持 `DEPLOY_DRY_RUN`、`DEPLOY_IP` 环境变量非交互模式
- [x] 创建 `start.ps1` 主脚本
- [x] 实现 `Init-ProjectDir`：项目目录校验
- [x] 实现 `Run-DeployQuestions`：本地 / 局域网 IP 选择（无域名/HTTPS）
- [x] 实现 `Setup-EnvFiles`：配置文件生成与替换
- [x] 实现 `Test-Docker`：Docker 检测，未安装时 prompt「手动安装」或「自动安装」
- [x] 实现 `Install-Docker`：自动安装 **Docker Desktop for Windows**（winget / Chocolatey）
- [x] 实现 `Start-Services`：`docker compose` 启动
- [x] 实现 `Main`：主流程串联
- [x] 支持 `DEPLOY_DRY_RUN`、`DEPLOY_IP` 环境变量非交互模式
- [x] 支持 `DEPLOY_ACCESS=local`、`DEPLOY_NON_INTERACTIVE`、`DEPLOY_DOCKER_INSTALL` 非交互控制
- [x] 在 README 或文档中补充 Windows 部署说明与执行策略
- [x] 创建 `scripts/test-start-ps1-env.py` 验证 .env 替换逻辑
@@ -178,6 +185,12 @@ $env:DEPLOY_DRY_RUN = "1"
$env:DEPLOY_IP = "127.0.0.1"
.\start.ps1
# 或使用本机访问模式变量
$env:DEPLOY_DRY_RUN = "1"
$env:DEPLOY_ACCESS = "local"
$env:DEPLOY_NO_WAIT = "1"
.\start.ps1
# 检查 .env 是否已正确写入
Select-String -Path .env -Pattern "NUXT_PUBLIC_BASE"
```
easyai-proxy.conf.sample
+32 -2
View File
@@ -3,6 +3,12 @@ map $http_upgrade $connection_upgrade {
'' close;
}
# $host 会丢失客户端 authority 中的显式端口；后端公开 URL 推断需保留 $http_host。
map $http_host $easyai_forwarded_host {
default $http_host;
'' $host;
}
# www 域名重定向，使用二级域名注释掉此部分的域名重定向
server {
listen 80;
@@ -32,6 +38,21 @@ server {
listen [::]:80;
server_name 51easyai.com;
# EasyAI response gzip: compress JSON/text API responses; SSE/WebSocket stay uncompressed by content type.
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_comp_level 4;
gzip_proxied any;
gzip_types
application/json
application/javascript
application/xml
text/css
text/plain
text/xml
image/svg+xml;
# ssl 版本控制
ssl_protocols TLSv1.2 TLSv1.3; # 只启用 TLS 1.2 和 TLS 1.3
# 通用安全头部
@@ -68,6 +89,11 @@ server {
add_header Cross-Origin-Resource-Policy "cross-origin" always;
}
# 规范化 API 根路径，确保 https://example.com/api 不会落到前端 location /。
location = /api {
return 308 /api/;
}
location /api/ {
proxy_pass http://127.0.0.1:3001/;
proxy_read_timeout 1200s; # 您已设置，适合长连接
@@ -85,7 +111,9 @@ server {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $host;
proxy_set_header Host $easyai_forwarded_host;
proxy_set_header X-Forwarded-Host $easyai_forwarded_host;
proxy_set_header X-Forwarded-Port $server_port;
}
location /asg-api/ {
@@ -156,7 +184,9 @@ server {
location /mcp {
proxy_pass http://127.0.0.1:3001/mcp;
proxy_read_timeout 300s;
proxy_set_header Host $host;
proxy_set_header Host $easyai_forwarded_host;
proxy_set_header X-Forwarded-Host $easyai_forwarded_host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
https.sh
+146 -19
View File
@@ -1,3 +1,5 @@
#!/bin/bash
if command -v nginx &> /dev/null; then
echo "✅ Nginx 已安装，跳过安装步骤"
else
@@ -104,12 +106,55 @@ else
fi
# ===== 域名配置交互与文件生成 =====
sanitize_domain() {
local domain=$1
domain="${domain#http://}"
domain="${domain#https://}"
domain="${domain%%/*}"
domain="${domain%;}"
echo "$domain" | xargs
}
validate_domain_value() {
local domain=$1
[[ "$domain" =~ ^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$ ]]
}
get_env_domain() {
local domain="${HTTPS_DOMAIN:-${EASYAI_PROXY_DOMAIN:-${DEPLOY_DOMAIN:-}}}"
if [ -z "$domain" ]; then
return 0
fi
domain="$(sanitize_domain "$domain")"
if ! validate_domain_value "$domain"; then
echo "❌ 域名变量格式不正确: $domain" >&2
exit 1
fi
echo "$domain"
}
is_non_interactive() {
[ "${HTTPS_NON_INTERACTIVE:-${DEPLOY_NON_INTERACTIVE:-0}}" = "1" ] || [ "${CI:-}" = "true" ] || [ ! -t 0 ]
}
prompt_domain() {
local domain
domain="$(get_env_domain)"
if [ -n "$domain" ]; then
echo "$domain"
return 0
fi
if is_non_interactive; then
echo "❌ 当前为非交互环境，HTTPS 配置需要传入域名变量" >&2
echo " 请设置 DEPLOY_DOMAIN=<域名> 或 EASYAI_PROXY_DOMAIN=<域名>" >&2
exit 1
fi
while true; do
read -r -p "🌐 请输入域名（例如 demo.example.com）: " domain
domain=$(echo "$domain" | xargs)
if [ -n "$domain" ] && [[ "$domain" =~ ^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$ ]]; then
domain="$(sanitize_domain "$domain")"
if [ -n "$domain" ] && validate_domain_value "$domain"; then
echo "$domain"
return 0
fi
@@ -140,6 +185,14 @@ create_conf_by_template() {
local domain=$1
local target_file=$2
# 始终优先使用仓库维护的完整代理模板，避免仅生成前端 location /。
if [ -f "./easyai-proxy.conf.sample" ]; then
cp "./easyai-proxy.conf.sample" "./$target_file"
sed -i.bak "s/51easyai\.com/$domain/g" "./$target_file"
rm -f "./$target_file.bak"
return 0
fi
if [ -f "./demo.51easyai.com.conf" ]; then
cp "./demo.51easyai.com.conf" "./$target_file"
sed -i.bak "s/www\.demo\.51easyai\.com/www.$domain/g; s/demo\.51easyai\.com/$domain/g" "./$target_file"
@@ -180,6 +233,21 @@ server {
listen [::]:80;
server_name $domain;
# EasyAI response gzip: compress JSON/text API responses; SSE/WebSocket stay uncompressed by content type.
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_comp_level 4;
gzip_proxied any;
gzip_types
application/json
application/javascript
application/xml
text/css
text/plain
text/xml
image/svg+xml;
location /.well-known/acme-challenge/ {
root /var/www/certbot;
try_files \$uri =404;
@@ -196,24 +264,59 @@ server {
EOF
}
conf_contains_domain() {
local conf_file=$1
local domain=$2
grep -Eq "server_name[^;]*(^|[[:space:]])(www\\.)?${domain//./\\.}([[:space:];]|$)" "./$conf_file"
}
normalize_domain_action() {
local action=$1
action="$(printf '%s' "$action" | tr '[:upper:]' '[:lower:]')"
case "$action" in
1|replace) echo "1" ;;
2|add|"") echo "2" ;;
*)
echo "❌ EASYAI_PROXY_DOMAIN_ACTION 只能是 replace 或 add，当前为: $action" >&2
exit 1
;;
esac
}
upsert_domain_for_conf() {
local conf_file=$1
local env_domain="${2:-}"
local env_action="${3:-}"
local mode
local new_domain
echo "ℹ️ 检测到当前目录已有配置文件: $conf_file"
while true; do
echo "请选择域名处理方式："
echo " 1) 替换当前域名"
echo " 2) 新增一个域名"
read -r -p "请输入选项 (1/2): " mode
case "$mode" in
1|2) break ;;
*) echo "❌ 无效选项，请输入 1 或 2" ;;
esac
done
if [ -n "$env_domain" ]; then
new_domain="$(sanitize_domain "$env_domain")"
if ! validate_domain_value "$new_domain"; then
echo "❌ 域名变量格式不正确: $new_domain"
exit 1
fi
if conf_contains_domain "$conf_file" "$new_domain"; then
echo "ℹ️ 配置文件已包含域名 $new_domain，无需修改。"
return 0
fi
mode="$(normalize_domain_action "$env_action")"
echo "使用变量配置域名: $new_domain, action=$([ "$mode" = "1" ] && echo replace || echo add)"
else
while true; do
echo "请选择域名处理方式："
echo " 1) 替换当前域名"
echo " 2) 新增一个域名"
read -r -p "请输入选项 (1/2): " mode
case "$mode" in
1|2) break ;;
*) echo "❌ 无效选项，请输入 1 或 2" ;;
esac
done
new_domain=$(prompt_domain)
new_domain=$(prompt_domain)
fi
if [ "$mode" = "1" ]; then
local old_domain
@@ -253,7 +356,9 @@ upsert_domain_for_conf() {
detect_existing_proxy_conf() {
local preferred_file=$1
local domain_filter="${2:-}"
local -a candidates=()
local -a matched_candidates=()
local conf
if [ -n "$preferred_file" ] && [ -f "./$preferred_file" ]; then
@@ -271,15 +376,36 @@ detect_existing_proxy_conf() {
return 1
fi
if [ -n "$domain_filter" ]; then
for conf in "${candidates[@]}"; do
if conf_contains_domain "$conf" "$domain_filter"; then
matched_candidates+=("$conf")
fi
done
if [ "${#matched_candidates[@]}" -eq 1 ]; then
echo "${matched_candidates[0]}"
return 0
fi
if [ "${#matched_candidates[@]}" -gt 1 ] && is_non_interactive; then
echo "❌ 多个配置文件都包含 $domain_filter，请通过 EASYAI_PROXY_CONF 指定文件" >&2
exit 1
fi
fi
if [ "${#candidates[@]}" -eq 1 ]; then
echo "${candidates[0]}"
return 0
fi
echo "⚠️ 检测到多个可用配置文件，请选择一个："
if is_non_interactive; then
echo "❌ 检测到多个可用配置文件，请通过 EASYAI_PROXY_CONF 指定文件" >&2
exit 1
fi
echo "⚠️ 检测到多个可用配置文件，请选择一个：" >&2
local i
for i in "${!candidates[@]}"; do
printf " %s) %s\n" "$((i + 1))" "${candidates[$i]}"
printf " %s) %s\n" "$((i + 1))" "${candidates[$i]}" >&2
done
while true; do
read -r -p "请输入序号: " i
@@ -295,9 +421,10 @@ echo "🚀 复制当前目录的配置文件到nginx配置文件目录"
# 支持 EASYAI_PROXY_CONF 指定配置文件（如 51easyai.com.conf）
PREFERRED_CONF_FILE="${EASYAI_PROXY_CONF:-}"
DEFAULT_NEW_CONF_FILE="${EASYAI_PROXY_CONF:-easyai-proxy.conf}"
CONF_FILE=$(detect_existing_proxy_conf "$PREFERRED_CONF_FILE")
HTTPS_DOMAIN_INPUT="$(get_env_domain)"
CONF_FILE=$(detect_existing_proxy_conf "$PREFERRED_CONF_FILE" "$HTTPS_DOMAIN_INPUT")
if [ -n "$CONF_FILE" ]; then
upsert_domain_for_conf "$CONF_FILE"
upsert_domain_for_conf "$CONF_FILE" "$HTTPS_DOMAIN_INPUT" "${EASYAI_PROXY_DOMAIN_ACTION:-}"
else
CONF_FILE="$DEFAULT_NEW_CONF_FILE"
echo "ℹ️ 当前目录未找到可用 nginx 配置文件（*.conf 且包含 server_name）"
@@ -348,7 +475,7 @@ if [ -n "$DOMAINS" ]; then
sudo certbot --nginx \
--non-interactive \
--agree-tos \
--email wangbo@51easyai.com \
--email "${CERTBOT_EMAIL:-wangbo@51easyai.com}" \
--rsa-key-size 2048 \
--preferred-challenges http \
--force-renewal \
@@ -357,4 +484,4 @@ if [ -n "$DOMAINS" ]; then
# 启动 Nginx 服务
echo "启动 Nginx 服务..."
sudo nginx
fi
fi
scripts/Initialize-PublicApiBaseUrl.ps1
+102
View File
@@ -0,0 +1,102 @@
function Get-PublicEnvValue {
param([string]$Content, [string]$Key)
$match = [regex]::Match($Content, "(?m)^$([regex]::Escape($Key))=(.*)$")
if (-not $match.Success) { return "" }
$value = $match.Groups[1].Value.Trim()
if ($value.Length -ge 2) {
$first = $value.Substring(0, 1)
$last = $value.Substring($value.Length - 1, 1)
if (($first -eq "'" -and $last -eq "'") -or ($first -eq '"' -and $last -eq '"')) {
return $value.Substring(1, $value.Length - 2)
}
}
return $value
}
function Set-PublicEnvValue {
param([string]$Content, [string]$Key, [string]$Value)
$pattern = "(?m)^$([regex]::Escape($Key))=.*(?:\r?\n)?"
$replacement = "$Key=$Value`r`n"
if ([regex]::IsMatch($Content, $pattern)) {
return [regex]::Replace($Content, $pattern, $replacement, 1)
}
if ($Content -and -not $Content.EndsWith("`n")) { $Content += "`r`n" }
return $Content + $replacement
}
function ConvertTo-PublicApiBaseUrl {
param([string]$Value)
$normalized = if ($null -eq $Value) { "" } else { $Value.Trim().TrimEnd('/') }
if (-not $normalized) { return $null }
$uri = $null
if (-not [Uri]::TryCreate($normalized, [UriKind]::Absolute, [ref]$uri)) { return $null }
if ($uri.Scheme -notin @("http", "https")) { return $null }
if ($uri.UserInfo -or $uri.Query -or $uri.Fragment) { return $null }
if (-not $uri.Host -or $uri.Port -lt 1 -or $uri.Port -gt 65535) { return $null }
return $normalized
}
function Get-DerivedPublicApiBaseUrl {
param([string]$Content)
$apiUrl = Get-PublicEnvValue $Content "NUXT_PUBLIC_BASE_APIURL"
$absoluteApiUrl = ConvertTo-PublicApiBaseUrl $apiUrl
if ($absoluteApiUrl) { return $absoluteApiUrl }
if (-not $apiUrl.StartsWith('/')) { return $null }
$origin = $null
$socketUrl = Get-PublicEnvValue $Content "NUXT_PUBLIC_BASE_SOCKETURL"
$socketUri = $null
if ([Uri]::TryCreate($socketUrl, [UriKind]::Absolute, [ref]$socketUri) -and
$socketUri.Scheme -in @("ws", "wss")) {
$scheme = if ($socketUri.Scheme -eq "wss") { "https" } else { "http" }
$origin = "${scheme}://$($socketUri.Authority)"
}
if (-not $origin) {
$securityOrigin = (Get-PublicEnvValue $Content "CONFIG_SECURITY_ORIGIN").Split(',')[0].Trim()
$securityUri = $null
if ([Uri]::TryCreate($securityOrigin, [UriKind]::Absolute, [ref]$securityUri) -and
$securityUri.Scheme -in @("http", "https")) {
$origin = "$($securityUri.Scheme)://$($securityUri.Authority)"
}
}
if (-not $origin) { return $null }
return ConvertTo-PublicApiBaseUrl "$($origin.TrimEnd('/'))$apiUrl"
}
function Initialize-PublicApiBaseUrl {
param(
[Parameter(Mandatory = $true)][string]$Path,
[ValidateSet("configure", "upgrade")][string]$Mode = "upgrade",
[string]$Override = $env:DEPLOY_PUBLIC_API_BASE_URL
)
if (-not (Test-Path $Path)) { throw "Environment file not found: $Path" }
$content = Get-Content $Path -Raw -Encoding UTF8
if ($null -eq $content) { $content = "" }
if (-not $Override) { $Override = Get-PublicEnvValue $content "DEPLOY_PUBLIC_API_BASE_URL" }
$current = Get-PublicEnvValue $content "CONFIG_PUBLIC_API_BASE_URL"
if ($Override) {
$selected = ConvertTo-PublicApiBaseUrl $Override
if (-not $selected) { throw "Invalid public API base URL: $Override" }
} elseif ($current) {
if (-not (ConvertTo-PublicApiBaseUrl $current)) {
throw "Invalid CONFIG_PUBLIC_API_BASE_URL: $current"
}
return
} else {
$selected = Get-DerivedPublicApiBaseUrl $content
if (-not $selected) {
throw "Cannot derive CONFIG_PUBLIC_API_BASE_URL. Set a full URL such as https://example.com/api"
}
}
$content = Set-PublicEnvValue $content "CONFIG_PUBLIC_API_BASE_URL" $selected
[System.IO.File]::WriteAllText(
(Resolve-Path $Path),
$content,
[System.Text.UTF8Encoding]::new($false)
)
Write-Host " [OK] Public API base URL: $selected" -ForegroundColor Green
}
scripts/Initialize-SecurityEnv.ps1
+74
View File
@@ -0,0 +1,74 @@
function New-SecuritySecret {
$bytes = New-Object byte[] 48
$rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
try {
$rng.GetBytes($bytes)
} finally {
$rng.Dispose()
}
return [Convert]::ToBase64String($bytes)
}
function Get-EnvValue {
param([string]$Content, [string]$Key)
$match = [regex]::Match($Content, "(?m)^$([regex]::Escape($Key))=(.*)$")
if (-not $match.Success) { return "" }
$value = $match.Groups[1].Value.Trim()
if ($value.Length -ge 2) {
$first = $value.Substring(0, 1)
$last = $value.Substring($value.Length - 1, 1)
if (($first -eq "'" -and $last -eq "'") -or ($first -eq '"' -and $last -eq '"')) {
return $value.Substring(1, $value.Length - 2)
}
}
return $value
}
function Set-EnvValue {
param([string]$Content, [string]$Key, [string]$Value)
$pattern = "(?m)^$([regex]::Escape($Key))=.*(?:\r?\n)?"
$replacement = "$Key=$Value`r`n"
if ([regex]::IsMatch($Content, $pattern)) {
return [regex]::Replace($Content, $pattern, $replacement, 1)
}
if ($Content -and -not $Content.EndsWith("`n")) { $Content += "`r`n" }
return $Content + $replacement
}
function Initialize-SecurityEnv {
param(
[Parameter(Mandatory = $true)][string]$Path,
[ValidateSet("new", "upgrade")][string]$Mode = "upgrade"
)
if (-not (Test-Path $Path)) { throw "Environment file not found: $Path" }
$content = Get-Content $Path -Raw -Encoding UTF8
if ($null -eq $content) { $content = "" }
$definitions = @(
@{ Key = "CONFIG_JWT_SECRET"; Legacy = "this is a very secret secret"; MinLength = 32 }
)
if ($Mode -eq "new") {
$definitions += @(
@{ Key = "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY"; Legacy = ""; MinLength = 32 },
@{ Key = "CONFIG_OTP_HASH_SECRET"; Legacy = ""; MinLength = 32 },
@{ Key = "CONFIG_AUDIT_HASH_PEPPER"; Legacy = ""; MinLength = 32 },
@{ Key = "CONFIG_AUDIT_INTEGRITY_KEY"; Legacy = ""; MinLength = 32 },
@{ Key = "CONFIG_INITIAL_ADMIN_PASSWORD"; Legacy = ""; MinLength = 12 }
)
}
foreach ($definition in $definitions) {
$current = Get-EnvValue $content $definition.Key
$needsInitialization = $current.Length -lt $definition.MinLength -or
($definition.Legacy -and $current -eq $definition.Legacy)
if (-not $needsInitialization) { continue }
$content = Set-EnvValue $content $definition.Key (New-SecuritySecret)
Write-Host " [OK] Initialized security secret: $($definition.Key)" -ForegroundColor Green
}
[System.IO.File]::WriteAllText(
(Resolve-Path $Path),
$content,
[System.Text.UTF8Encoding]::new($false)
)
}
scripts/Test-PublicApiBaseUrl.ps1
+93
View File
@@ -0,0 +1,93 @@
#Requires -Version 5.1
$ErrorActionPreference = "Stop"
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
. (Join-Path $scriptDir "Initialize-PublicApiBaseUrl.ps1")
$tempDir = Join-Path ([System.IO.Path]::GetTempPath()) ("easyai-public-url-" + [Guid]::NewGuid())
[System.IO.Directory]::CreateDirectory($tempDir) | Out-Null
function Write-TestEnv {
param([string]$Name, [string[]]$Lines)
$path = Join-Path $tempDir $Name
[System.IO.File]::WriteAllText($path, ($Lines -join "`r`n") + "`r`n", [System.Text.UTF8Encoding]::new($false))
return $path
}
function Assert-PublicUrl {
param([string]$Path, [string]$Expected)
$content = Get-Content $Path -Raw -Encoding UTF8
$actual = Get-PublicEnvValue $content "CONFIG_PUBLIC_API_BASE_URL"
if ($actual -ne $Expected) { throw "Expected '$Expected', got '$actual'" }
}
try {
$existing = Write-TestEnv "existing.env" @(
"CONFIG_PUBLIC_API_BASE_URL=https://existing.example.com:8443/api",
"NUXT_PUBLIC_BASE_APIURL=/api"
)
Initialize-PublicApiBaseUrl -Path $existing -Mode upgrade
Assert-PublicUrl $existing "https://existing.example.com:8443/api"
$absolute = Write-TestEnv "absolute.env" @(
"CONFIG_PUBLIC_API_BASE_URL=",
"NUXT_PUBLIC_BASE_APIURL=http://10.0.0.8:4100"
)
Initialize-PublicApiBaseUrl -Path $absolute -Mode upgrade
Assert-PublicUrl $absolute "http://10.0.0.8:4100"
$websocket = Write-TestEnv "websocket.env" @(
"CONFIG_PUBLIC_API_BASE_URL=",
"NUXT_PUBLIC_BASE_APIURL=/api",
"NUXT_PUBLIC_BASE_SOCKETURL=wss://demo.example.com/socket.io"
)
Initialize-PublicApiBaseUrl -Path $websocket -Mode upgrade
Assert-PublicUrl $websocket "https://demo.example.com/api"
$securityOrigin = Write-TestEnv "security-origin.env" @(
"CONFIG_PUBLIC_API_BASE_URL=",
"NUXT_PUBLIC_BASE_APIURL=/api",
"NUXT_PUBLIC_BASE_SOCKETURL=",
"CONFIG_SECURITY_ORIGIN=http://demo.example.com,https://demo.example.com"
)
Initialize-PublicApiBaseUrl -Path $securityOrigin -Mode upgrade
Assert-PublicUrl $securityOrigin "http://demo.example.com/api"
$fileOverride = Write-TestEnv "file-override.env" @(
"CONFIG_PUBLIC_API_BASE_URL=",
"DEPLOY_PUBLIC_API_BASE_URL=https://proxy.example.com:9443/custom-api",
"NUXT_PUBLIC_BASE_APIURL=/api"
)
Initialize-PublicApiBaseUrl -Path $fileOverride -Mode upgrade
Assert-PublicUrl $fileOverride "https://proxy.example.com:9443/custom-api"
$explicitOverride = Write-TestEnv "explicit-override.env" @(
"CONFIG_PUBLIC_API_BASE_URL=",
"NUXT_PUBLIC_BASE_APIURL=/api"
)
Initialize-PublicApiBaseUrl `
-Path $explicitOverride `
-Mode configure `
-Override "http://192.168.1.20:4567"
Assert-PublicUrl $explicitOverride "http://192.168.1.20:4567"
$invalid = Write-TestEnv "invalid.env" @(
"CONFIG_PUBLIC_API_BASE_URL=ftp://bad.example.com/api",
"NUXT_PUBLIC_BASE_APIURL=https://good.example.com/api"
)
$blocked = $false
try { Initialize-PublicApiBaseUrl -Path $invalid -Mode upgrade } catch { $blocked = $true }
if (-not $blocked) { throw "Invalid existing CONFIG_PUBLIC_API_BASE_URL must block startup" }
$unresolved = Write-TestEnv "unresolved.env" @(
"CONFIG_PUBLIC_API_BASE_URL=",
"NUXT_PUBLIC_BASE_APIURL=/api"
)
$blocked = $false
try { Initialize-PublicApiBaseUrl -Path $unresolved -Mode upgrade } catch { $blocked = $true }
if (-not $blocked) { throw "Unresolved public API URL must block startup" }
Write-Host "Public API base URL PowerShell tests passed" -ForegroundColor Green
} finally {
Remove-Item $tempDir -Recurse -Force -ErrorAction SilentlyContinue
}
scripts/init-public-api-base-url.sh
Executable
+157
View File
@@ -0,0 +1,157 @@
#!/bin/bash
# 初始化并持久化后端对外公开 API 地址。不会 source .env，避免执行其中内容。
public_url_read_env_value() {
local file="$1"
local key="$2"
local value
value="$(awk -v key="$key" 'index($0, key "=") == 1 { print substr($0, length(key) + 2); exit }' "$file")"
value="$(printf '%s' "$value" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
case "$value" in
\"*\") value="${value#\"}"; value="${value%\"}" ;;
\'*\') value="${value#\'}"; value="${value%\'}" ;;
esac
printf '%s' "$value"
}
public_url_write_env_value() {
local file="$1"
local key="$2"
local value="$3"
local tmp
tmp="$(mktemp "${file}.tmp.XXXXXX")"
awk -v key="$key" -v value="$value" '
BEGIN { replaced = 0 }
index($0, key "=") == 1 {
if (!replaced) {
print key "=" value
replaced = 1
}
next
}
{ print }
END {
if (!replaced) print key "=" value
}
' "$file" > "$tmp"
chmod 600 "$tmp"
mv "$tmp" "$file"
}
public_url_normalize() {
local value
value="$(printf '%s' "$1" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
while [ "${value%/}" != "$value" ]; do value="${value%/}"; done
printf '%s' "$value"
}
public_url_validate() {
local value rest authority host port
value="$(public_url_normalize "$1")"
case "$value" in
http://*|https://*) ;;
*) return 1 ;;
esac
case "$value" in
*[[:space:]@?#]*) return 1 ;;
esac
rest="${value#*://}"
authority="${rest%%/*}"
[ -n "$authority" ] || return 1
if [[ "$authority" == \[* ]]; then
[[ "$authority" =~ ^\[[0-9A-Fa-f:.]+\](:[0-9]+)?$ ]] || return 1
if [[ "$authority" == *]:* ]]; then port="${authority##*:}"; fi
else
[[ "$authority" =~ ^[A-Za-z0-9._-]+(:[0-9]+)?$ ]] || return 1
if [[ "$authority" == *:* ]]; then
host="${authority%:*}"
port="${authority##*:}"
[ -n "$host" ] || return 1
fi
fi
if [ -n "${port:-}" ]; then
[[ "$port" =~ ^[0-9]+$ ]] || return 1
[ "$port" -ge 1 ] && [ "$port" -le 65535 ] || return 1
fi
}
public_url_derive_from_env() {
local file="$1"
local api_url socket_url security_origin origin scheme combined
api_url="$(public_url_read_env_value "$file" "NUXT_PUBLIC_BASE_APIURL")"
if public_url_validate "$api_url"; then
public_url_normalize "$api_url"
return 0
fi
[[ "$api_url" == /* ]] || return 1
socket_url="$(public_url_read_env_value "$file" "NUXT_PUBLIC_BASE_SOCKETURL")"
if [[ "$socket_url" =~ ^(ws|wss)://([^/?#[:space:]]+) ]]; then
scheme="http"
[ "${BASH_REMATCH[1]}" = "wss" ] && scheme="https"
origin="${scheme}://${BASH_REMATCH[2]}"
fi
if [ -z "${origin:-}" ]; then
security_origin="$(public_url_read_env_value "$file" "CONFIG_SECURITY_ORIGIN")"
security_origin="${security_origin%%,*}"
security_origin="$(public_url_normalize "$security_origin")"
if [[ "$security_origin" =~ ^(https?://[^/]+) ]]; then
origin="${BASH_REMATCH[1]}"
fi
fi
[ -n "${origin:-}" ] || return 1
combined="$(public_url_normalize "${origin}${api_url}")"
public_url_validate "$combined" || return 1
printf '%s' "$combined"
}
init_public_api_base_url() {
local file="${1:-.env}"
local mode="${2:-upgrade}"
local override="${3:-${DEPLOY_PUBLIC_API_BASE_URL:-}}"
local current selected
if [ ! -f "$file" ]; then
echo "❌ 环境配置文件不存在: $file" >&2
return 1
fi
if [ "$mode" != "configure" ] && [ "$mode" != "upgrade" ]; then
echo "❌ 公开 API 地址初始化模式无效: $mode（仅支持 configure/upgrade）" >&2
return 1
fi
if [ -z "$override" ]; then
override="$(public_url_read_env_value "$file" "DEPLOY_PUBLIC_API_BASE_URL")"
fi
current="$(public_url_read_env_value "$file" "CONFIG_PUBLIC_API_BASE_URL")"
if [ -n "$override" ]; then
selected="$(public_url_normalize "$override")"
elif [ -n "$current" ]; then
if ! public_url_validate "$current"; then
echo "❌ CONFIG_PUBLIC_API_BASE_URL 配置无效: $current" >&2
return 1
fi
return 0
else
selected="$(public_url_derive_from_env "$file")" || {
echo "❌ 无法从现有前端配置推导 CONFIG_PUBLIC_API_BASE_URL" >&2
echo " 请设置完整地址，例如 https://example.com/api" >&2
return 1
}
fi
if ! public_url_validate "$selected"; then
echo "❌ 公开 API 地址配置无效: $selected" >&2
return 1
fi
selected="$(public_url_normalize "$selected")"
public_url_write_env_value "$file" "CONFIG_PUBLIC_API_BASE_URL" "$selected"
echo " ✓ 已配置公开 API 地址: $selected"
}
if [ "${BASH_SOURCE[0]}" = "$0" ]; then
init_public_api_base_url "${1:-.env}" "${2:-upgrade}" "${3:-}"
fi
scripts/init-security-env.sh
+95
View File
@@ -0,0 +1,95 @@
#!/bin/bash
# 为本地 .env 初始化持久化安全密钥。只处理空值和已知历史默认值，
# 已存在的自定义值保持不变；数据库中的 JWT 轮转配置仍由后端优先使用。
generate_security_secret() {
if command -v openssl >/dev/null 2>&1; then
openssl rand -base64 48 | tr -d '\r\n'
return
fi
if [ -r /dev/urandom ]; then
od -An -N48 -tx1 /dev/urandom | tr -d ' \r\n'
return
fi
echo "❌ 无法生成安全随机值：需要 openssl 或 /dev/urandom" >&2
return 1
}
read_env_value() {
local file="$1"
local key="$2"
local value
value="$(awk -v key="$key" 'index($0, key "=") == 1 { print substr($0, length(key) + 2); exit }' "$file")"
value="$(printf '%s' "$value" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
case "$value" in
\"*\") value="${value#\"}"; value="${value%\"}" ;;
\'*\') value="${value#\'}"; value="${value%\'}" ;;
esac
printf '%s' "$value"
}
write_env_value() {
local file="$1"
local key="$2"
local value="$3"
local tmp
tmp="$(mktemp "${file}.tmp.XXXXXX")"
awk -v key="$key" -v value="$value" '
BEGIN { replaced = 0 }
index($0, key "=") == 1 {
if (!replaced) {
print key "=" value
replaced = 1
}
next
}
{ print }
END {
if (!replaced) print key "=" value
}
' "$file" > "$tmp"
chmod 600 "$tmp"
mv "$tmp" "$file"
}
ensure_security_secret() {
local file="$1"
local key="$2"
local legacy_value="${3:-}"
local minimum_length="${4:-32}"
local current
current="$(read_env_value "$file" "$key")"
if [ "${#current}" -ge "$minimum_length" ] && { [ -z "$legacy_value" ] || [ "$current" != "$legacy_value" ]; }; then
return 0
fi
write_env_value "$file" "$key" "$(generate_security_secret)"
echo " ✓ 已初始化安全密钥: ${key}"
}
init_security_env() {
local file="${1:-.env}"
local mode="${2:-upgrade}"
if [ ! -f "$file" ]; then
echo "❌ 环境配置文件不存在: $file" >&2
return 1
fi
if [ "$mode" != "new" ] && [ "$mode" != "upgrade" ]; then
echo "❌ 安全环境初始化模式无效: $mode（仅支持 new/upgrade）" >&2
return 1
fi
ensure_security_secret "$file" "CONFIG_JWT_SECRET" "this is a very secret secret"
if [ "$mode" = "new" ]; then
ensure_security_secret "$file" "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY"
ensure_security_secret "$file" "CONFIG_OTP_HASH_SECRET"
ensure_security_secret "$file" "CONFIG_AUDIT_HASH_PEPPER"
ensure_security_secret "$file" "CONFIG_AUDIT_INTEGRITY_KEY"
ensure_security_secret "$file" "CONFIG_INITIAL_ADMIN_PASSWORD" "" 12
fi
chmod 600 "$file"
}
if [ "${BASH_SOURCE[0]}" = "$0" ]; then
init_security_env "${1:-.env}" "${2:-upgrade}"
fi
scripts/test-deployment-public-url.sh
Executable
+97
View File
@@ -0,0 +1,97 @@
#!/bin/bash
set -euo pipefail
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
TMP_DIR="$(mktemp -d)"
trap 'rm -rf "$TMP_DIR"' EXIT
cp \
"$REPO_ROOT/start.sh" \
"$REPO_ROOT/https.sh" \
"$REPO_ROOT/docker-compose.yml" \
"$REPO_ROOT/.env.sample" \
"$REPO_ROOT/.env.tools.sample" \
"$REPO_ROOT/.env.ASG.sample" \
"$REPO_ROOT/.env.AMS.sample" \
"$REPO_ROOT/easyai-proxy.conf.sample" \
"$TMP_DIR/"
mkdir -p "$TMP_DIR/scripts"
cp \
"$REPO_ROOT/scripts/init-security-env.sh" \
"$REPO_ROOT/scripts/init-public-api-base-url.sh" \
"$TMP_DIR/scripts/"
cd "$TMP_DIR"
reset_case() {
rm -f \
.env \
.env.tools \
.env.ASG \
.env.AMS \
easyai-proxy.conf \
demo.example.com.conf
}
sed -i.bak 's/^SERVER_HTTP_PORT=.*/SERVER_HTTP_PORT=4100/' .env.sample
rm -f .env.sample.bak
DEPLOY_NON_INTERACTIVE=1 \
DEPLOY_DRY_RUN=1 \
DEPLOY_ACCESS=ip \
DEPLOY_IP=10.0.0.8 \
bash start.sh >/dev/null
grep -qx 'NUXT_PUBLIC_BASE_APIURL=http://10.0.0.8:4100' .env
grep -qx 'CONFIG_PUBLIC_API_BASE_URL=http://10.0.0.8:4100' .env
if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
docker compose config --quiet
fi
reset_case
DEPLOY_NON_INTERACTIVE=1 \
DEPLOY_DRY_RUN=1 \
DEPLOY_ACCESS=domain \
DEPLOY_DOMAIN=demo.example.com \
DEPLOY_HTTPS=false \
bash start.sh >/dev/null
grep -qx 'NUXT_PUBLIC_BASE_SOCKETURL=ws://demo.example.com/socket.io' .env
grep -qx 'CONFIG_PUBLIC_API_BASE_URL=http://demo.example.com/api' .env
grep -q 'proxy_set_header X-Forwarded-Host $easyai_forwarded_host;' demo.example.com.conf
grep -q 'proxy_set_header X-Forwarded-Port $server_port;' demo.example.com.conf
grep -q "proxy_set_header X-Original-Prefix '/api';" demo.example.com.conf
grep -q 'location = /api {' demo.example.com.conf
# 直接验证 https.sh 的缺省配置生成函数会采用完整模板，而不是只代理 3010。
eval "$(awk '
/^create_conf_by_template\(\)/ { capture = 1 }
/^conf_contains_domain\(\)/ { capture = 0 }
capture { print }
' https.sh)"
create_conf_by_template demo.example.com easyai-proxy.conf
grep -q 'server_name demo.example.com;' easyai-proxy.conf
grep -q 'location = /api {' easyai-proxy.conf
grep -q 'location /api/ {' easyai-proxy.conf
grep -q 'proxy_pass http://127.0.0.1:3001/;' easyai-proxy.conf
grep -q 'location /socket.io {' easyai-proxy.conf
grep -q 'proxy_set_header X-Forwarded-Host $easyai_forwarded_host;' easyai-proxy.conf
reset_case
DEPLOY_NON_INTERACTIVE=1 \
DEPLOY_DRY_RUN=1 \
DEPLOY_ACCESS=domain \
DEPLOY_DOMAIN=demo.example.com \
DEPLOY_HTTPS=true \
bash start.sh >/dev/null
grep -qx 'NUXT_PUBLIC_BASE_SOCKETURL=wss://demo.example.com/socket.io' .env
grep -qx 'CONFIG_PUBLIC_API_BASE_URL=https://demo.example.com/api' .env
reset_case
DEPLOY_NON_INTERACTIVE=1 \
DEPLOY_DRY_RUN=1 \
DEPLOY_ACCESS=ip \
DEPLOY_IP=10.0.0.8 \
DEPLOY_PUBLIC_API_BASE_URL=https://edge.example.com:8443/custom-api \
bash start.sh >/dev/null
grep -qx 'CONFIG_PUBLIC_API_BASE_URL=https://edge.example.com:8443/custom-api' .env
echo "Deployment public URL dry-run tests passed"
scripts/test-public-api-base-url.sh
Executable
+93
View File
@@ -0,0 +1,93 @@
#!/bin/bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=scripts/init-public-api-base-url.sh
. "${SCRIPT_DIR}/init-public-api-base-url.sh"
TMP_DIR="$(mktemp -d)"
trap 'rm -rf "$TMP_DIR"' EXIT
fail() {
echo "FAIL: $*" >&2
exit 1
}
assert_env_value() {
local file="$1"
local expected="$2"
local actual
actual="$(public_url_read_env_value "$file" "CONFIG_PUBLIC_API_BASE_URL")"
[ "$actual" = "$expected" ] || fail "expected $expected, got $actual"
}
write_env() {
local file="$1"
shift
printf '%s\n' "$@" > "$file"
}
existing="$TMP_DIR/existing.env"
write_env "$existing" \
"CONFIG_PUBLIC_API_BASE_URL=https://existing.example.com:8443/api" \
"NUXT_PUBLIC_BASE_APIURL=/api"
init_public_api_base_url "$existing" upgrade >/dev/null
assert_env_value "$existing" "https://existing.example.com:8443/api"
absolute="$TMP_DIR/absolute.env"
write_env "$absolute" \
"CONFIG_PUBLIC_API_BASE_URL=" \
"NUXT_PUBLIC_BASE_APIURL=http://10.0.0.8:4100"
init_public_api_base_url "$absolute" upgrade >/dev/null
assert_env_value "$absolute" "http://10.0.0.8:4100"
websocket="$TMP_DIR/websocket.env"
write_env "$websocket" \
"CONFIG_PUBLIC_API_BASE_URL=" \
"NUXT_PUBLIC_BASE_APIURL=/api" \
"NUXT_PUBLIC_BASE_SOCKETURL=wss://demo.example.com/socket.io"
init_public_api_base_url "$websocket" upgrade >/dev/null
assert_env_value "$websocket" "https://demo.example.com/api"
security_origin="$TMP_DIR/security-origin.env"
write_env "$security_origin" \
"CONFIG_PUBLIC_API_BASE_URL=" \
"NUXT_PUBLIC_BASE_APIURL=/api" \
"NUXT_PUBLIC_BASE_SOCKETURL=" \
"CONFIG_SECURITY_ORIGIN=http://demo.example.com,https://demo.example.com"
init_public_api_base_url "$security_origin" upgrade >/dev/null
assert_env_value "$security_origin" "http://demo.example.com/api"
file_override="$TMP_DIR/file-override.env"
write_env "$file_override" \
"CONFIG_PUBLIC_API_BASE_URL=" \
"DEPLOY_PUBLIC_API_BASE_URL=https://proxy.example.com:9443/custom-api" \
"NUXT_PUBLIC_BASE_APIURL=/api"
init_public_api_base_url "$file_override" upgrade >/dev/null
assert_env_value "$file_override" "https://proxy.example.com:9443/custom-api"
explicit_override="$TMP_DIR/explicit-override.env"
write_env "$explicit_override" \
"CONFIG_PUBLIC_API_BASE_URL=" \
"NUXT_PUBLIC_BASE_APIURL=/api"
init_public_api_base_url "$explicit_override" configure "http://192.168.1.20:4567" >/dev/null
assert_env_value "$explicit_override" "http://192.168.1.20:4567"
invalid="$TMP_DIR/invalid.env"
write_env "$invalid" \
"CONFIG_PUBLIC_API_BASE_URL=ftp://bad.example.com/api" \
"NUXT_PUBLIC_BASE_APIURL=https://good.example.com/api"
if init_public_api_base_url "$invalid" upgrade >/dev/null 2>&1; then
fail "invalid existing CONFIG_PUBLIC_API_BASE_URL must block startup"
fi
unresolved="$TMP_DIR/unresolved.env"
write_env "$unresolved" \
"CONFIG_PUBLIC_API_BASE_URL=" \
"NUXT_PUBLIC_BASE_APIURL=/api"
if init_public_api_base_url "$unresolved" upgrade >/dev/null 2>&1; then
fail "unresolved public API URL must block startup"
fi
echo "Public API base URL shell tests passed"
start.ps1
+74 -9
View File
@@ -22,6 +22,8 @@ $script:LogFile = Join-Path $script:Root "start.ps1.log"
$script:DeployDryRun = ($env:DEPLOY_DRY_RUN -eq "1")
$script:DeployIP = ""
$script:SkipDeployQuestions = $false
$script:SecurityEnvMode = "upgrade"
$script:PublicApiBaseUrlCandidate = ""
$script:DockerDesktopUrl = "https://desktop.docker.com/win/main/amd64/Docker%20Desktop%20Installer.exe"
function Write-Log {
@@ -98,6 +100,27 @@ function Run-DeployQuestions {
return
}
if ($env:DEPLOY_ACCESS) {
$mode = $env:DEPLOY_ACCESS.Trim().ToLowerInvariant()
switch ($mode) {
{ $_ -in @("local", "localhost", "127.0.0.1") } {
$script:DeployIP = "127.0.0.1"
Step "Using DEPLOY_ACCESS=$($env:DEPLOY_ACCESS), IP=$($script:DeployIP)"
return
}
{ $_ -in @("lan", "ip") } {
Fail "DEPLOY_ACCESS=$($env:DEPLOY_ACCESS) requires DEPLOY_IP, for example: `$env:DEPLOY_IP='192.168.1.10'"
}
default {
Fail "DEPLOY_ACCESS only supports local or lan on Windows, current value: $($env:DEPLOY_ACCESS)"
}
}
}
if ($env:DEPLOY_NON_INTERACTIVE -eq "1" -or $env:CI -eq "true") {
Fail "Non-interactive deployment requires DEPLOY_IP or DEPLOY_ACCESS=local."
}
Write-Host "Choose mode:"
Write-Host " [1] Local only (127.0.0.1)"
Write-Host " [2] LAN access"
@@ -138,14 +161,26 @@ function Setup-EnvFiles {
Ensure-FileFromSample ".env.tools" ".env.tools.sample"
Ensure-FileFromSample ".env.ASG" ".env.ASG.sample"
Ensure-FileFromSample ".env.AMS" ".env.AMS.sample"
if (-not (Test-Path ".env")) { $script:SecurityEnvMode = "new" }
Ensure-FileFromSample ".env" ".env.sample"
$content = Get-Content ".env" -Raw -Encoding UTF8
if (-not $content) { $content = "" }
$content = Upsert-Env $content "NUXT_PUBLIC_BASE_APIURL" "http://$($script:DeployIP):3001"
$serverPortMatch = [regex]::Match($content, '(?m)^SERVER_HTTP_PORT=(\d+)$')
$serverPort = if ($serverPortMatch.Success) { $serverPortMatch.Groups[1].Value } else { "3001" }
$publicApiBaseUrl = "http://$($script:DeployIP):$serverPort"
$content = Upsert-Env $content "NUXT_PUBLIC_BASE_APIURL" $publicApiBaseUrl
$content = Upsert-Env $content "NUXT_PUBLIC_BASE_SOCKETURL" "ws://$($script:DeployIP):3002"
$content = Upsert-Env $content "NUXT_PUBLIC_SG_APIURL" "http://$($script:DeployIP):3003"
$webPortMatch = [regex]::Match($content, '(?m)^WEB_PORT=(\d+)$')
$webPort = if ($webPortMatch.Success) { $webPortMatch.Groups[1].Value } else { "3010" }
$content = Upsert-Env $content "CONFIG_SECURITY_ORIGIN" "http://$($script:DeployIP):$webPort"
$script:PublicApiBaseUrlCandidate = if ($env:DEPLOY_PUBLIC_API_BASE_URL) {
$env:DEPLOY_PUBLIC_API_BASE_URL
} else {
$publicApiBaseUrl
}
[System.IO.File]::WriteAllText((Join-Path $script:Root ".env"), $content, [System.Text.UTF8Encoding]::new($false))
Ok ".env configured for IP=$($script:DeployIP)"
@@ -277,6 +312,19 @@ function Test-Docker {
}
Warn "Docker Desktop not detected."
$installMode = if ($env:DEPLOY_DOCKER_INSTALL) { $env:DEPLOY_DOCKER_INSTALL.Trim().ToLowerInvariant() } else { "" }
if (-not [string]::IsNullOrWhiteSpace($installMode)) {
switch ($installMode) {
{ $_ -in @("manual", "1") } { Start-Process $script:DockerDesktopUrl; Wait-ForExit; exit 1 }
{ $_ -in @("auto", "2") } { Install-DockerDesktop }
default { Fail "DEPLOY_DOCKER_INSTALL only supports manual or auto, current value: $($env:DEPLOY_DOCKER_INSTALL)" }
}
}
if ($env:DEPLOY_NON_INTERACTIVE -eq "1" -or $env:CI -eq "true") {
Fail "Docker Desktop not detected. Set DEPLOY_DOCKER_INSTALL=manual or DEPLOY_DOCKER_INSTALL=auto, or install Docker Desktop first."
}
Write-Host "Choose:"
Write-Host " [1] Manual install (open URL and exit)"
Write-Host " [2] Auto install (winget/choco)"
@@ -311,14 +359,21 @@ function Start-Services {
function Main {
Init-ProjectDir
if ((Test-Path ".env") -and -not $env:DEPLOY_FORCE_RECONFIG -and -not $env:DEPLOY_IP) {
$answer = (Read-Host "Existing .env found. Reconfigure? [y/N]").Trim().ToLower()
$yes = ($answer.Length -gt 0) -and ($answer[0] -eq [char]121)
if (-not $yes) {
if ((Test-Path ".env") -and -not $env:DEPLOY_FORCE_RECONFIG -and -not $env:DEPLOY_IP -and -not $env:DEPLOY_ACCESS) {
if ($env:DEPLOY_NON_INTERACTIVE -eq "1" -or $env:CI -eq "true") {
$line = Get-Content ".env" -Encoding UTF8 | Where-Object { $_ -like "NUXT_PUBLIC_BASE_APIURL=*" } | Select-Object -First 1
if ($line -and $line -like "*:3001*") { $script:DeployIP = ($line -replace ".*http://", "" -replace ":3001.*", "").Trim() }
if ($line -match '^NUXT_PUBLIC_BASE_APIURL=http://([^/:]+)(?::\d+)?(?:/.*)?$') { $script:DeployIP = $Matches[1] }
$script:SkipDeployQuestions = $true
Step "Using existing env config"
} else {
$answer = (Read-Host "Existing .env found. Reconfigure? [y/N]").Trim().ToLower()
$yes = ($answer.Length -gt 0) -and ($answer[0] -eq [char]121)
if (-not $yes) {
$line = Get-Content ".env" -Encoding UTF8 | Where-Object { $_ -like "NUXT_PUBLIC_BASE_APIURL=*" } | Select-Object -First 1
if ($line -match '^NUXT_PUBLIC_BASE_APIURL=http://([^/:]+)(?::\d+)?(?:/.*)?$') { $script:DeployIP = $Matches[1] }
$script:SkipDeployQuestions = $true
Step "Using existing env config"
}
}
}
@@ -331,6 +386,16 @@ function Main {
Ensure-FileFromSample ".env.AMS" ".env.AMS.sample"
}
. (Join-Path $script:Root "scripts\Initialize-SecurityEnv.ps1")
Initialize-SecurityEnv -Path (Join-Path $script:Root ".env") -Mode $script:SecurityEnvMode
. (Join-Path $script:Root "scripts\Initialize-PublicApiBaseUrl.ps1")
$publicUrlMode = if ($script:SkipDeployQuestions) { "upgrade" } else { "configure" }
Initialize-PublicApiBaseUrl `
-Path (Join-Path $script:Root ".env") `
-Mode $publicUrlMode `
-Override $script:PublicApiBaseUrlCandidate
if ($script:DeployDryRun) {
Warn "dry-run mode: skip docker and services"
} else {
@@ -347,7 +412,7 @@ function Main {
Write-Host ""
Write-Host " 预期访问: " -NoNewline; Write-Host "http://${ip}:3010" -ForegroundColor Cyan
Write-Host ""
Write-Host " 默认管理员: admin / 123456（启动服务后用于登录）" -ForegroundColor DarkGray
Write-Host " 初始管理员: admin；随机密码保存在 .env 的 CONFIG_INITIAL_ADMIN_PASSWORD" -ForegroundColor DarkGray
} else {
Write-Host "================================" -ForegroundColor Green
Write-Host " 部署成功" -ForegroundColor Green
@@ -355,9 +420,9 @@ function Main {
Write-Host ""
Write-Host " 访问地址: " -NoNewline; Write-Host "http://${ip}:3010" -ForegroundColor Cyan
Write-Host ""
Write-Host " -------- 默认管理员（首次登录后请修改密码）--------" -ForegroundColor Yellow
Write-Host " -------- 初始管理员（首次登录后请修改密码）--------" -ForegroundColor Yellow
Write-Host " 账号: " -NoNewline; Write-Host "admin" -ForegroundColor White
Write-Host " 密码: " -NoNewline; Write-Host "123456" -ForegroundColor White
Write-Host " 密码位置: " -NoNewline; Write-Host ".env -> CONFIG_INITIAL_ADMIN_PASSWORD" -ForegroundColor White
}
Write-Host ""
Wait-ForExit
start.sh
+124 -17
View File
@@ -23,10 +23,58 @@ init_project_dir() {
}
# ==================== 配置变量（支持环境变量非交互模式） ====================
DEPLOY_MODE="" # ip | domain
DEPLOY_IP=""
DEPLOY_DOMAIN=""
DEPLOY_ACCESS="${DEPLOY_ACCESS:-}" # ip | domain
DEPLOY_MODE="" # ip | domain | skip
DEPLOY_IP="${DEPLOY_IP:-}"
DEPLOY_DOMAIN="${DEPLOY_DOMAIN:-}"
DEPLOY_HTTPS_ENV="${DEPLOY_HTTPS_INPUT:-${DEPLOY_HTTPS:-}}"
DEPLOY_HTTPS=false
SECURITY_ENV_MODE="upgrade"
PUBLIC_API_BASE_URL_CANDIDATE=""
is_non_interactive() {
[ "${DEPLOY_NON_INTERACTIVE:-0}" = "1" ] || [ "${CI:-}" = "true" ] || [ ! -t 0 ]
}
require_interactive() {
local missing_hint=$1
if is_non_interactive; then
echo "❌ 当前为非交互环境，无法继续问答配置"
echo " 请通过环境变量传入: ${missing_hint}"
exit 1
fi
}
normalize_bool() {
local value
value="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
case "$value" in
1|true|yes|y|on) echo "true" ;;
0|false|no|n|off|"") echo "false" ;;
*)
echo "❌ 布尔变量值不合法: $1（支持 true/false/1/0/yes/no/y/n/on/off）" >&2
return 1
;;
esac
}
set_deploy_https_from_env_or_default() {
local normalized
if ! normalized="$(normalize_bool "${DEPLOY_HTTPS_ENV:-false}")"; then
exit 1
fi
DEPLOY_HTTPS="$normalized"
}
infer_deploy_access_from_env() {
if [ -z "$DEPLOY_ACCESS" ]; then
if [ -n "$DEPLOY_DOMAIN" ]; then
DEPLOY_ACCESS="domain"
elif [ -n "$DEPLOY_IP" ]; then
DEPLOY_ACCESS="ip"
fi
fi
}
sanitize_domain() {
local domain="$1"
@@ -66,6 +114,8 @@ prompt_or_env() {
return
fi
require_interactive "$env_name"
if [ -n "$default" ]; then
read -r -p "${prompt_text} [$default]: " input
eval "$var_name=\"${input:-$default}\""
@@ -82,6 +132,8 @@ run_deploy_questions() {
echo "================================"
echo ""
infer_deploy_access_from_env
# 非交互模式：环境变量已完整设置则直接使用（CI/自动化部署）
if [ -n "$DEPLOY_ACCESS" ]; then
if [ "$DEPLOY_ACCESS" = "ip" ] && [ -n "$DEPLOY_IP" ]; then
@@ -96,14 +148,19 @@ run_deploy_questions() {
exit 1
fi
DEPLOY_MODE="domain"
DEPLOY_HTTPS="${DEPLOY_HTTPS_INPUT:-false}"
set_deploy_https_from_env_or_default
echo "使用环境变量: 域名模式, 域名=$DEPLOY_DOMAIN"
return
fi
if [ "$DEPLOY_ACCESS" != "ip" ] && [ "$DEPLOY_ACCESS" != "domain" ]; then
echo "❌ DEPLOY_ACCESS 只能是 ip 或 domain，当前为: $DEPLOY_ACCESS"
exit 1
fi
fi
# 1. IP 或域名访问
if [ -z "$DEPLOY_ACCESS" ]; then
require_interactive "DEPLOY_ACCESS=ip DEPLOY_IP=<服务器IP> 或 DEPLOY_ACCESS=domain DEPLOY_DOMAIN=<域名>"
echo "1. 通过 IP 地址还是域名访问？"
echo " [1] IP 地址（需开放 3001、3002、3003 端口）"
echo " [2] 域名"
@@ -140,9 +197,10 @@ run_deploy_questions() {
fi
# 3.1 是否启用 HTTPS
if [ -n "$DEPLOY_HTTPS_INPUT" ]; then
DEPLOY_HTTPS=$DEPLOY_HTTPS_INPUT
if [ -n "$DEPLOY_HTTPS_ENV" ]; then
set_deploy_https_from_env_or_default
else
require_interactive "DEPLOY_HTTPS=true 或 DEPLOY_HTTPS=false"
read -r -p "3.1 是否签名 HTTPS 证书？原来已经有 HTTPS 证书这里选择 N，第一次部署或者原来没有证书选 Y [y/N]: " https_choice
DEPLOY_HTTPS=false
if [[ "$https_choice" =~ ^[yY] ]]; then
@@ -177,19 +235,37 @@ setup_env_files() {
# 4/5. 配置 .env
if [ ! -f .env ]; then
cp .env.sample .env
SECURITY_ENV_MODE="new"
fi
local web_port server_port public_scheme socket_scheme
web_port="$(awk -F= '$1 == "WEB_PORT" { print $2; exit }' .env | tr -d '[:space:]')"
web_port="${web_port:-3010}"
server_port="$(awk -F= '$1 == "SERVER_HTTP_PORT" { print $2; exit }' .env | tr -d '[:space:]')"
server_port="${server_port:-3001}"
if [ "$DEPLOY_MODE" = "ip" ]; then
# IP 模式
sed -i.bak "s|^NUXT_PUBLIC_BASE_APIURL=.*|NUXT_PUBLIC_BASE_APIURL=http://${DEPLOY_IP}:3001|" .env
sed -i.bak "s|^NUXT_PUBLIC_BASE_APIURL=.*|NUXT_PUBLIC_BASE_APIURL=http://${DEPLOY_IP}:${server_port}|" .env
sed -i.bak "s|^NUXT_PUBLIC_BASE_SOCKETURL=.*|NUXT_PUBLIC_BASE_SOCKETURL=ws://${DEPLOY_IP}:3002|" .env
sed -i.bak "s|^NUXT_PUBLIC_SG_APIURL=.*|NUXT_PUBLIC_SG_APIURL=http://${DEPLOY_IP}:3003|" .env
sed -i.bak "s|^CONFIG_SECURITY_ORIGIN=.*|CONFIG_SECURITY_ORIGIN=http://${DEPLOY_IP}:${web_port}|" .env
PUBLIC_API_BASE_URL_CANDIDATE="${DEPLOY_PUBLIC_API_BASE_URL:-http://${DEPLOY_IP}:${server_port}}"
echo " ✓ .env 已配置为 IP 模式 (${DEPLOY_IP})"
else
# 域名模式
public_scheme="http"
socket_scheme="ws"
if [ "$DEPLOY_HTTPS" = true ]; then
public_scheme="https"
socket_scheme="wss"
fi
sed -i.bak "s|^NUXT_PUBLIC_BASE_APIURL=.*|NUXT_PUBLIC_BASE_APIURL=/api|" .env
sed -i.bak "s|^NUXT_PUBLIC_BASE_SOCKETURL=.*|NUXT_PUBLIC_BASE_SOCKETURL=wss://${DEPLOY_DOMAIN}/socket.io|" .env
sed -i.bak "s|^NUXT_PUBLIC_BASE_SOCKETURL=.*|NUXT_PUBLIC_BASE_SOCKETURL=${socket_scheme}://${DEPLOY_DOMAIN}/socket.io|" .env
sed -i.bak "s|^NUXT_PUBLIC_SG_APIURL=.*|NUXT_PUBLIC_SG_APIURL=/asg-api|" .env
# 域名模式同时允许同域 HTTP/HTTPS，兼容首次签证书和复用既有证书两种流程。
sed -i.bak "s|^CONFIG_SECURITY_ORIGIN=.*|CONFIG_SECURITY_ORIGIN=https://${DEPLOY_DOMAIN},http://${DEPLOY_DOMAIN}|" .env
PUBLIC_API_BASE_URL_CANDIDATE="${DEPLOY_PUBLIC_API_BASE_URL:-${public_scheme}://${DEPLOY_DOMAIN}/api}"
echo " ✓ .env 已配置为域名模式 (${DEPLOY_DOMAIN})"
# 7. Nginx 配置（域名模式）
@@ -308,17 +384,22 @@ install_docker() {
sudo yum install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
elif [[ "$OS_FAMILY" == "macOS" ]]; then
echo "⚠️ 检测到 macOS，未找到 Docker。"
echo "请选择安装方式："
echo " [1] 自动安装 Docker Desktop（需要 Homebrew）"
echo " [2] 手动安装（默认）"
read -r -p "请选择 [1/2]: " mac_install_choice
mac_install_choice="${DEPLOY_MAC_DOCKER_INSTALL:-${DEPLOY_DOCKER_INSTALL:-}}"
if [ -z "$mac_install_choice" ]; then
require_interactive "DEPLOY_MAC_DOCKER_INSTALL=auto 或 DEPLOY_MAC_DOCKER_INSTALL=manual"
echo "请选择安装方式："
echo " [1] 自动安装 Docker Desktop（需要 Homebrew）"
echo " [2] 手动安装（默认）"
read -r -p "请选择 [1/2]: " mac_install_choice
fi
mac_install_choice="$(printf '%s' "$mac_install_choice" | tr '[:upper:]' '[:lower:]')"
case "${mac_install_choice:-2}" in
1)
1|auto)
if ! install_docker_macos; then
exit 1
fi
;;
2)
2|manual)
echo " 请手动安装 Docker Desktop: https://www.docker.com/products/docker-desktop/"
echo " 安装并启动 Docker Desktop 后，重新运行 ./start.sh"
exit 1
@@ -379,14 +460,20 @@ run_https_setup() {
# ==================== 主流程 ====================
main() {
init_project_dir
infer_deploy_access_from_env
# 检查是否已有 .env 且非强制重新配置
if [ -f .env ] && [ -z "$DEPLOY_FORCE_RECONFIG" ] && [ -z "$DEPLOY_ACCESS" ]; then
echo "📁 检测到已有 .env 配置"
read -r -p "是否重新配置部署方式？[y/N]: " reconfigure
if [[ ! "$reconfigure" =~ ^[yY] ]]; then
if is_non_interactive; then
echo "⏭️ 使用现有配置继续..."
DEPLOY_MODE="skip"
else
read -r -p "是否重新配置部署方式？[y/N]: " reconfigure
if [[ ! "$reconfigure" =~ ^[yY] ]]; then
echo "⏭️ 使用现有配置继续..."
DEPLOY_MODE="skip"
fi
fi
fi
@@ -408,6 +495,21 @@ main() {
fi
fi
# 空值或历史默认值只在首次发现时生成并写回 .env，后续启动保持稳定。
# 数据库中的后台 JWT 轮转配置由后端优先使用，不受此处影响。
# shellcheck source=scripts/init-security-env.sh
. ./scripts/init-security-env.sh
init_security_env .env "$SECURITY_ENV_MODE"
# 在拉取镜像或重建服务前完成公开地址迁移；非法或无法推导时立即终止。
# shellcheck source=scripts/init-public-api-base-url.sh
. ./scripts/init-public-api-base-url.sh
if [ "$DEPLOY_MODE" = "skip" ]; then
init_public_api_base_url .env upgrade "${DEPLOY_PUBLIC_API_BASE_URL:-}"
else
init_public_api_base_url .env configure "$PUBLIC_API_BASE_URL_CANDIDATE"
fi
if [ "$DEPLOY_DRY_RUN" = "1" ]; then
echo ""
echo "⚠️ dry-run 模式：跳过 Docker 安装和服务启动"
@@ -415,6 +517,7 @@ main() {
else
install_docker
start_services
export DEPLOY_DOMAIN
run_https_setup
fi
@@ -425,7 +528,11 @@ main() {
if [ "$DEPLOY_MODE" = "ip" ] && [ -n "$DEPLOY_IP" ]; then
echo "访问地址: http://${DEPLOY_IP}:3010"
elif [ "$DEPLOY_MODE" = "domain" ] && [ -n "$DEPLOY_DOMAIN" ]; then
echo "访问地址: http://${DEPLOY_DOMAIN} (配置 Nginx 后)"
if [ "$DEPLOY_HTTPS" = true ]; then
echo "访问地址: https://${DEPLOY_DOMAIN}"
else
echo "访问地址: http://${DEPLOY_DOMAIN} (配置 Nginx 后)"
fi
if [ "$DEPLOY_HTTPS" = true ]; then
echo "HTTPS 已启用"
fi
update.ps1
+77 -16
View File
@@ -33,6 +33,7 @@ trap {
function Wait-ForExit {
if ($env:CI -eq "true") { return }
if ($env:UPDATE_NO_WAIT -eq "1") { return }
Write-Host ""
Read-Host "按 Enter 键退出"
}
@@ -46,7 +47,17 @@ function Write-Warn { param($Msg) Write-Host "⚠️ $Msg" -ForegroundColor Yell
if ($args -contains "-h" -or $args -contains "--help") {
Write-Host "用法: .\update.ps1"
Write-Host ""
Write-Host "脚本将提示选择更新方式，默认拉取仓库并更新镜像。"
Write-Host "默认拉取仓库并更新镜像；也可通过环境变量跳过交互选择。"
Write-Host ""
Write-Host "环境变量:"
Write-Host " UPDATE_MODE=full|image"
Write-Host " full 更新并拉取仓库（git pull）+ 更新镜像并重启"
Write-Host " image 仅更新镜像并重启（跳过 git pull）"
Write-Host " UPDATE_SKIP_REPO_UPDATE=true|false"
Write-Host " true 等同 UPDATE_MODE=image"
Write-Host " false 等同 UPDATE_MODE=full"
Write-Host " UPDATE_NO_WAIT=1"
Write-Host " 结束或失败时不等待按 Enter"
exit 0
}
@@ -58,24 +69,62 @@ if (-not (Test-Path $composePath)) { Write-Err "未找到 docker-compose.yml，
Set-Location $scriptDir
Write-Step "📁 项目目录: $scriptDir"
# ==================== 命令行内选择 ====================
Write-Host ""
Write-Host "请选择更新方式："
Write-Host " [1] 更新并拉取仓库（git pull）+ 更新镜像并重启（默认）"
Write-Host " [2] 仅更新镜像并重启（跳过 git pull）"
$choice = Read-Host "请选择 [1/2，回车默认 1]"
if ([string]::IsNullOrWhiteSpace($choice)) { $choice = "1" }
$skipRepoUpdate = $false
switch ($choice) {
"2" { $skipRepoUpdate = $true }
"1" { }
default {
Write-Warn "无效选择，将使用默认：更新并拉取仓库"
$skipRepoUpdate = $false
function ConvertTo-BoolEnv {
param([string]$Value)
$v = if ($null -eq $Value) { "" } else { $Value.Trim().ToLowerInvariant() }
switch ($v) {
{ $_ -in @("1", "true", "yes", "y", "on") } { return $true }
{ $_ -in @("0", "false", "no", "n", "off", "") } { return $false }
default { Write-Err "布尔变量值不合法: $Value（支持 true/false/1/0/yes/no/y/n/on/off）" }
}
}
function Resolve-UpdateMode {
if (-not [string]::IsNullOrWhiteSpace($env:UPDATE_SKIP_REPO_UPDATE)) {
$skip = ConvertTo-BoolEnv $env:UPDATE_SKIP_REPO_UPDATE
Write-Step "使用环境变量: UPDATE_SKIP_REPO_UPDATE=$skip"
return $skip
}
if (-not [string]::IsNullOrWhiteSpace($env:UPDATE_MODE)) {
$mode = $env:UPDATE_MODE.Trim().ToLowerInvariant()
switch ($mode) {
{ $_ -in @("full", "repo", "pull", "git", "1") } {
Write-Step "使用环境变量: UPDATE_MODE=$($env:UPDATE_MODE)"
return $false
}
{ $_ -in @("image", "images", "docker", "skip-git", "skip_repo", "skip-repo", "2") } {
Write-Step "使用环境变量: UPDATE_MODE=$($env:UPDATE_MODE)"
return $true
}
default { Write-Err "UPDATE_MODE 只能是 full 或 image，当前为: $($env:UPDATE_MODE)" }
}
}
if ($env:UPDATE_NON_INTERACTIVE -eq "1" -or $env:CI -eq "true") {
Write-Step "使用默认更新方式: 更新并拉取仓库（git pull）+ 更新镜像并重启"
return $false
}
Write-Host ""
Write-Host "请选择更新方式："
Write-Host " [1] 更新并拉取仓库（git pull）+ 更新镜像并重启（默认）"
Write-Host " [2] 仅更新镜像并重启（跳过 git pull）"
$choice = Read-Host "请选择 [1/2，回车默认 1]"
if ([string]::IsNullOrWhiteSpace($choice)) { $choice = "1" }
switch ($choice) {
"2" { return $true }
"1" { return $false }
default {
Write-Warn "无效选择，将使用默认：更新并拉取仓库"
return $false
}
}
}
$skipRepoUpdate = Resolve-UpdateMode
# ==================== 拉取仓库 ====================
if (-not $skipRepoUpdate) {
Write-Host ""
@@ -123,6 +172,18 @@ if (-not $skipRepoUpdate) {
Write-Host ""
}
# 空值或历史默认值只初始化一次并写回 .env；已有自定义值及数据库轮转配置不受影响。
if (-not (Test-Path ".env")) { Write-Err "未找到 .env，请先执行 start.ps1 完成初始化" }
. (Join-Path $scriptDir "scripts\Initialize-SecurityEnv.ps1")
Initialize-SecurityEnv -Path (Join-Path $scriptDir ".env") -Mode "upgrade"
# 在更新镜像和重建服务前迁移并校验后端公开 API 地址。
. (Join-Path $scriptDir "scripts\Initialize-PublicApiBaseUrl.ps1")
Initialize-PublicApiBaseUrl `
-Path (Join-Path $scriptDir ".env") `
-Mode "upgrade" `
-Override $env:DEPLOY_PUBLIC_API_BASE_URL
# ==================== Docker 检查 ====================
function Test-DockerInstalled {
$docker = Get-Command docker -ErrorAction SilentlyContinue
update.sh
+85 -12
View File
@@ -6,7 +6,15 @@ set -e # 发生错误时终止脚本执行
if [[ "${1:-}" =~ ^(-h|--help)$ ]]; then
echo "用法: $0"
echo ""
echo "脚本将提示选择更新方式，默认拉取仓库并更新镜像。"
echo "默认拉取仓库并更新镜像；也可通过环境变量跳过交互选择。"
echo ""
echo "环境变量:"
echo " UPDATE_MODE=full|image"
echo " full 更新并拉取仓库（git pull）+ 更新镜像并重启"
echo " image 仅更新镜像并重启（跳过 git pull）"
echo " UPDATE_SKIP_REPO_UPDATE=true|false"
echo " true 等同 UPDATE_MODE=image"
echo " false 等同 UPDATE_MODE=full"
exit 0
fi
@@ -15,18 +23,68 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
cd "$SCRIPT_DIR"
# 命令行内选择更新方式（默认：更新并拉取仓库）
echo ""
echo "请选择更新方式："
echo " [1] 更新并拉取仓库（git pull）+ 更新镜像并重启（默认）"
echo " [2] 仅更新镜像并重启（跳过 git pull）"
read -r -p "请选择 [1/2，回车默认 1]: " choice
choice="${choice:-1}"
SKIP_REPO_UPDATE=false
case "$choice" in
2) SKIP_REPO_UPDATE=true ;;
1) ;;
*) echo "❌ 无效选择，将使用默认：更新并拉取仓库"; SKIP_REPO_UPDATE=false ;;
esac
normalize_bool() {
local value
value="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
case "$value" in
1|true|yes|y|on) echo "true" ;;
0|false|no|n|off|"") echo "false" ;;
*)
echo "❌ 布尔变量值不合法: $1（支持 true/false/1/0/yes/no/y/n/on/off）" >&2
return 1
;;
esac
}
resolve_update_mode() {
local mode
if [ -n "${UPDATE_SKIP_REPO_UPDATE:-}" ]; then
mode="$(normalize_bool "$UPDATE_SKIP_REPO_UPDATE")" || exit 1
SKIP_REPO_UPDATE="$mode"
echo "使用环境变量: UPDATE_SKIP_REPO_UPDATE=$SKIP_REPO_UPDATE"
return
fi
if [ -n "${UPDATE_MODE:-}" ]; then
mode="$(printf '%s' "$UPDATE_MODE" | tr '[:upper:]' '[:lower:]')"
case "$mode" in
full|repo|pull|git|1)
SKIP_REPO_UPDATE=false
;;
image|images|docker|skip-git|skip_repo|skip-repo|2)
SKIP_REPO_UPDATE=true
;;
*)
echo "❌ UPDATE_MODE 只能是 full 或 image，当前为: $UPDATE_MODE"
exit 1
;;
esac
echo "使用环境变量: UPDATE_MODE=$UPDATE_MODE"
return
fi
if [ "${UPDATE_NON_INTERACTIVE:-0}" = "1" ] || [ "${CI:-}" = "true" ] || [ ! -t 0 ]; then
echo "使用默认更新方式: 更新并拉取仓库（git pull）+ 更新镜像并重启"
SKIP_REPO_UPDATE=false
return
fi
echo ""
echo "请选择更新方式："
echo " [1] 更新并拉取仓库（git pull）+ 更新镜像并重启（默认）"
echo " [2] 仅更新镜像并重启（跳过 git pull）"
read -r -p "请选择 [1/2，回车默认 1]: " choice
choice="${choice:-1}"
case "$choice" in
2) SKIP_REPO_UPDATE=true ;;
1) ;;
*) echo "❌ 无效选择，将使用默认：更新并拉取仓库"; SKIP_REPO_UPDATE=false ;;
esac
}
resolve_update_mode
# 拉取整个仓库更新
if [ "$SKIP_REPO_UPDATE" = false ]; then
@@ -64,6 +122,21 @@ else
echo ""
fi
# 升级已有部署时，将空值或历史默认 JWT 密钥一次性替换为持久化随机值。
# 已存在的自定义值保持不变，数据库 JWT 轮转配置仍由后端优先使用。
if [ ! -f .env ]; then
echo "❌ 未找到 .env，请先执行 start.sh 完成初始化"
exit 1
fi
# shellcheck source=scripts/init-security-env.sh
. ./scripts/init-security-env.sh
init_security_env .env upgrade
# 在更新镜像和重建服务前迁移并校验后端公开 API 地址。
# shellcheck source=scripts/init-public-api-base-url.sh
. ./scripts/init-public-api-base-url.sh
init_public_api_base_url .env upgrade "${DEPLOY_PUBLIC_API_BASE_URL:-}"
echo "==========================="
echo "🚀 开始自动安装 Docker 和 Docker Compose"
echo "==========================="