480 lines
14 KiB
Bash
Executable File
480 lines
14 KiB
Bash
Executable File
#!/bin/bash
|
||
|
||
if command -v nginx &> /dev/null; then
|
||
echo "✅ Nginx 已安装，跳过安装步骤"
|
||
else
|
||
echo "🚀 安装 Nginx"
|
||
# 检测系统类型
|
||
if command -v apt &> /dev/null; then
|
||
# Debian/Ubuntu 系统
|
||
apt install -y nginx
|
||
elif command -v yum &> /dev/null; then
|
||
# CentOS/RHEL 系统
|
||
yum install -y nginx
|
||
elif command -v dnf &> /dev/null; then
|
||
# 较新版本的 Fedora/RHEL 系统
|
||
dnf install -y nginx
|
||
else
|
||
echo "❌ 不支持的操作系统：未找到支持的包管理器"
|
||
exit 1
|
||
fi
|
||
fi
|
||
|
||
# 函数：尝试使用指定的包管理器安装
|
||
try_install() {
|
||
local cmd=$1
|
||
if command -v "$cmd" &> /dev/null; then
|
||
echo "📦 尝试使用 $cmd 安装 snapd..."
|
||
if sudo "$cmd" install -y snapd; then
|
||
return 0
|
||
fi
|
||
fi
|
||
return 1
|
||
}
|
||
|
||
# 检查 Certbot 是否已安装
|
||
if command -v certbot &> /dev/null; then
|
||
echo "✅ Certbot 已安装，跳过安装步骤"
|
||
else
|
||
echo "🚀 安装 Certbot"
|
||
|
||
# 检测系统类型
|
||
if [ -f /etc/debian_version ]; then
|
||
# Ubuntu/Debian 系统
|
||
apt install -y certbot python3-certbot-nginx
|
||
# 也可以使用snapd安装
|
||
# apt install -y snapd
|
||
# # 使用snap安装 certbot
|
||
# snap install --classic certbot
|
||
# # Prepare the Certbot command
|
||
# sudo ln -s /snap/bin/certbot /usr/bin/certbot
|
||
elif [ -f /etc/redhat-release ]; then
|
||
# CentOS/RHEL 系统
|
||
# 首先安装 EPEL 仓库
|
||
yum install -y epel-release
|
||
# 安装 snapd
|
||
# 检查是否已安装
|
||
if command -v snap &> /dev/null; then
|
||
echo "✅ snapd 已经安装"
|
||
exit 0
|
||
fi
|
||
|
||
echo "🔍 检测系统包管理器..."
|
||
|
||
# 尝试使用 dnf 安装
|
||
if try_install "dnf"; then
|
||
echo "✅ 使用 dnf 安装 snapd 成功"
|
||
|
||
# 尝试使用 yum 安装
|
||
elif try_install "yum"; then
|
||
echo "✅ 使用 yum 安装 snapd 成功"
|
||
|
||
# 尝试使用 apt-get 安装（适用于 Debian/Ubuntu）
|
||
elif try_install "apt-get"; then
|
||
echo "✅ 使用 apt-get 安装 snapd 成功"
|
||
|
||
else
|
||
echo "❌ 无法安装 snapd，未找到支持的包管理器"
|
||
exit 1
|
||
fi
|
||
|
||
# 启用 snapd 服务
|
||
systemctl enable --now snapd.socket
|
||
|
||
# 创建符号链接
|
||
ln -s /var/lib/snapd/snap /snap
|
||
|
||
# 安装 certbot
|
||
snap install --classic certbot
|
||
# Prepare the Certbot command
|
||
sudo ln -s /snap/bin/certbot /usr/bin/certbot
|
||
else
|
||
echo "❌ 不支持的操作系统"
|
||
exit 1
|
||
fi
|
||
fi
|
||
|
||
# 验证安装
|
||
echo "🔍 验证安装"
|
||
if command -v nginx &> /dev/null && command -v certbot &> /dev/null; then
|
||
echo "✅ Nginx 和 Certbot 安装成功"
|
||
nginx -v
|
||
certbot --version
|
||
else
|
||
echo "❌ 安装验证失败"
|
||
exit 1
|
||
fi
|
||
|
||
# ===== 域名配置交互与文件生成 =====
|
||
sanitize_domain() {
|
||
local domain=$1
|
||
domain="${domain#http://}"
|
||
domain="${domain#https://}"
|
||
domain="${domain%%/*}"
|
||
domain="${domain%;}"
|
||
echo "$domain" | xargs
|
||
}
|
||
|
||
validate_domain_value() {
|
||
local domain=$1
|
||
[[ "$domain" =~ ^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$ ]]
|
||
}
|
||
|
||
get_env_domain() {
|
||
local domain="${HTTPS_DOMAIN:-${EASYAI_PROXY_DOMAIN:-${DEPLOY_DOMAIN:-}}}"
|
||
if [ -z "$domain" ]; then
|
||
return 0
|
||
fi
|
||
domain="$(sanitize_domain "$domain")"
|
||
if ! validate_domain_value "$domain"; then
|
||
echo "❌ 域名变量格式不正确: $domain" >&2
|
||
exit 1
|
||
fi
|
||
echo "$domain"
|
||
}
|
||
|
||
is_non_interactive() {
|
||
[ "${HTTPS_NON_INTERACTIVE:-${DEPLOY_NON_INTERACTIVE:-0}}" = "1" ] || [ "${CI:-}" = "true" ] || [ ! -t 0 ]
|
||
}
|
||
|
||
prompt_domain() {
|
||
local domain
|
||
domain="$(get_env_domain)"
|
||
if [ -n "$domain" ]; then
|
||
echo "$domain"
|
||
return 0
|
||
fi
|
||
|
||
if is_non_interactive; then
|
||
echo "❌ 当前为非交互环境，HTTPS 配置需要传入域名变量" >&2
|
||
echo " 请设置 DEPLOY_DOMAIN=<域名> 或 EASYAI_PROXY_DOMAIN=<域名>" >&2
|
||
exit 1
|
||
fi
|
||
|
||
while true; do
|
||
read -r -p "🌐 请输入域名（例如 demo.example.com）: " domain
|
||
domain="$(sanitize_domain "$domain")"
|
||
if [ -n "$domain" ] && validate_domain_value "$domain"; then
|
||
echo "$domain"
|
||
return 0
|
||
fi
|
||
echo "❌ 域名格式不正确，请重新输入。"
|
||
done
|
||
}
|
||
|
||
escape_sed() {
|
||
echo "$1" | sed 's/[.[\*^$()+?{}|/]/\\&/g'
|
||
}
|
||
|
||
get_primary_domain_from_conf() {
|
||
local conf_file=$1
|
||
awk '
|
||
/server_name/ {
|
||
for (i = 2; i <= NF; i++) {
|
||
gsub(";", "", $i)
|
||
if ($i !~ /^www\./ && $i !~ /^\*/ && $i != "localhost") {
|
||
print $i
|
||
exit
|
||
}
|
||
}
|
||
}
|
||
' "$conf_file"
|
||
}
|
||
|
||
create_conf_by_template() {
|
||
local domain=$1
|
||
local target_file=$2
|
||
|
||
if [ -f "./demo.51easyai.com.conf" ]; then
|
||
cp "./demo.51easyai.com.conf" "./$target_file"
|
||
sed -i.bak "s/www\.demo\.51easyai\.com/www.$domain/g; s/demo\.51easyai\.com/$domain/g" "./$target_file"
|
||
rm -f "./$target_file.bak"
|
||
return 0
|
||
fi
|
||
|
||
if [ -f "./2.conf" ]; then
|
||
cp "./2.conf" "./$target_file"
|
||
sed -i.bak "s/www\.2/www.$domain/g; s/\b2\b/$domain/g" "./$target_file"
|
||
rm -f "./$target_file.bak"
|
||
return 0
|
||
fi
|
||
|
||
cat > "./$target_file" <<EOF
|
||
map \$http_upgrade \$connection_upgrade {
|
||
default upgrade;
|
||
'' close;
|
||
}
|
||
|
||
server {
|
||
listen 80;
|
||
listen [::]:80;
|
||
server_name www.$domain;
|
||
|
||
location /.well-known/acme-challenge/ {
|
||
root /var/www/certbot;
|
||
try_files \$uri =404;
|
||
}
|
||
|
||
location / {
|
||
return 301 https://$domain\$request_uri;
|
||
}
|
||
}
|
||
|
||
server {
|
||
listen 80;
|
||
listen [::]:80;
|
||
server_name $domain;
|
||
|
||
# EasyAI response gzip: compress JSON/text API responses; SSE/WebSocket stay uncompressed by content type.
|
||
gzip on;
|
||
gzip_vary on;
|
||
gzip_min_length 1024;
|
||
gzip_comp_level 4;
|
||
gzip_proxied any;
|
||
gzip_types
|
||
application/json
|
||
application/javascript
|
||
application/xml
|
||
text/css
|
||
text/plain
|
||
text/xml
|
||
image/svg+xml;
|
||
|
||
location /.well-known/acme-challenge/ {
|
||
root /var/www/certbot;
|
||
try_files \$uri =404;
|
||
}
|
||
|
||
location / {
|
||
proxy_pass http://127.0.0.1:3010/;
|
||
proxy_set_header X-Real-IP \$remote_addr;
|
||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||
proxy_set_header Host \$host;
|
||
}
|
||
}
|
||
EOF
|
||
}
|
||
|
||
conf_contains_domain() {
|
||
local conf_file=$1
|
||
local domain=$2
|
||
grep -Eq "server_name[^;]*(^|[[:space:]])(www\\.)?${domain//./\\.}([[:space:];]|$)" "./$conf_file"
|
||
}
|
||
|
||
normalize_domain_action() {
|
||
local action=$1
|
||
action="$(printf '%s' "$action" | tr '[:upper:]' '[:lower:]')"
|
||
case "$action" in
|
||
1|replace) echo "1" ;;
|
||
2|add|"") echo "2" ;;
|
||
*)
|
||
echo "❌ EASYAI_PROXY_DOMAIN_ACTION 只能是 replace 或 add，当前为: $action" >&2
|
||
exit 1
|
||
;;
|
||
esac
|
||
}
|
||
|
||
upsert_domain_for_conf() {
|
||
local conf_file=$1
|
||
local env_domain="${2:-}"
|
||
local env_action="${3:-}"
|
||
local mode
|
||
local new_domain
|
||
|
||
echo "ℹ️ 检测到当前目录已有配置文件: $conf_file"
|
||
if [ -n "$env_domain" ]; then
|
||
new_domain="$(sanitize_domain "$env_domain")"
|
||
if ! validate_domain_value "$new_domain"; then
|
||
echo "❌ 域名变量格式不正确: $new_domain"
|
||
exit 1
|
||
fi
|
||
if conf_contains_domain "$conf_file" "$new_domain"; then
|
||
echo "ℹ️ 配置文件已包含域名 $new_domain，无需修改。"
|
||
return 0
|
||
fi
|
||
mode="$(normalize_domain_action "$env_action")"
|
||
echo "使用变量配置域名: $new_domain, action=$([ "$mode" = "1" ] && echo replace || echo add)"
|
||
else
|
||
while true; do
|
||
echo "请选择域名处理方式："
|
||
echo " 1) 替换当前域名"
|
||
echo " 2) 新增一个域名"
|
||
read -r -p "请输入选项 (1/2): " mode
|
||
case "$mode" in
|
||
1|2) break ;;
|
||
*) echo "❌ 无效选项，请输入 1 或 2" ;;
|
||
esac
|
||
done
|
||
|
||
new_domain=$(prompt_domain)
|
||
fi
|
||
|
||
if [ "$mode" = "1" ]; then
|
||
local old_domain
|
||
old_domain=$(get_primary_domain_from_conf "./$conf_file")
|
||
if [ -z "$old_domain" ]; then
|
||
echo "⚠️ 未能自动识别旧域名，将直接尝试新增域名。"
|
||
mode="2"
|
||
else
|
||
local old_domain_escaped
|
||
local new_domain_escaped
|
||
old_domain_escaped=$(escape_sed "$old_domain")
|
||
new_domain_escaped=$(escape_sed "$new_domain")
|
||
sed -i.bak "s/www\\.$old_domain_escaped/www.$new_domain_escaped/g; s/$old_domain_escaped/$new_domain_escaped/g" "./$conf_file"
|
||
rm -f "./$conf_file.bak"
|
||
echo "✅ 已将域名从 $old_domain 替换为 $new_domain"
|
||
fi
|
||
fi
|
||
|
||
if [ "$mode" = "2" ]; then
|
||
local changed=0
|
||
if ! grep -Eq "server_name[^;]*[[:space:]]$new_domain([[:space:];]|$)" "./$conf_file"; then
|
||
sed -i.bak "/server_name/s/;/ $new_domain;/g" "./$conf_file"
|
||
changed=1
|
||
fi
|
||
if ! grep -Eq "server_name[^;]*[[:space:]]www\\.$new_domain([[:space:];]|$)" "./$conf_file"; then
|
||
sed -i.bak "/server_name/s/;/ www.$new_domain;/g" "./$conf_file"
|
||
changed=1
|
||
fi
|
||
rm -f "./$conf_file.bak"
|
||
if [ "$changed" -eq 1 ]; then
|
||
echo "✅ 已新增域名：$new_domain（含 www.$new_domain）"
|
||
else
|
||
echo "ℹ️ 配置文件已包含该域名，无需新增。"
|
||
fi
|
||
fi
|
||
}
|
||
|
||
detect_existing_proxy_conf() {
|
||
local preferred_file=$1
|
||
local domain_filter="${2:-}"
|
||
local -a candidates=()
|
||
local -a matched_candidates=()
|
||
local conf
|
||
|
||
if [ -n "$preferred_file" ] && [ -f "./$preferred_file" ]; then
|
||
echo "$preferred_file"
|
||
return 0
|
||
fi
|
||
|
||
while IFS= read -r conf; do
|
||
if grep -Eq "^[[:space:]]*server_name[[:space:]]+" "./$conf"; then
|
||
candidates+=("$conf")
|
||
fi
|
||
done < <(ls -1 *.conf 2>/dev/null || true)
|
||
|
||
if [ "${#candidates[@]}" -eq 0 ]; then
|
||
return 1
|
||
fi
|
||
|
||
if [ -n "$domain_filter" ]; then
|
||
for conf in "${candidates[@]}"; do
|
||
if conf_contains_domain "$conf" "$domain_filter"; then
|
||
matched_candidates+=("$conf")
|
||
fi
|
||
done
|
||
if [ "${#matched_candidates[@]}" -eq 1 ]; then
|
||
echo "${matched_candidates[0]}"
|
||
return 0
|
||
fi
|
||
if [ "${#matched_candidates[@]}" -gt 1 ] && is_non_interactive; then
|
||
echo "❌ 多个配置文件都包含 $domain_filter，请通过 EASYAI_PROXY_CONF 指定文件" >&2
|
||
exit 1
|
||
fi
|
||
fi
|
||
|
||
if [ "${#candidates[@]}" -eq 1 ]; then
|
||
echo "${candidates[0]}"
|
||
return 0
|
||
fi
|
||
|
||
if is_non_interactive; then
|
||
echo "❌ 检测到多个可用配置文件，请通过 EASYAI_PROXY_CONF 指定文件" >&2
|
||
exit 1
|
||
fi
|
||
|
||
echo "⚠️ 检测到多个可用配置文件，请选择一个：" >&2
|
||
local i
|
||
for i in "${!candidates[@]}"; do
|
||
printf " %s) %s\n" "$((i + 1))" "${candidates[$i]}" >&2
|
||
done
|
||
while true; do
|
||
read -r -p "请输入序号: " i
|
||
if [[ "$i" =~ ^[0-9]+$ ]] && [ "$i" -ge 1 ] && [ "$i" -le "${#candidates[@]}" ]; then
|
||
echo "${candidates[$((i - 1))]}"
|
||
return 0
|
||
fi
|
||
echo "❌ 无效序号，请重新输入。"
|
||
done
|
||
}
|
||
|
||
echo "🚀 复制当前目录的配置文件到nginx配置文件目录"
|
||
# 支持 EASYAI_PROXY_CONF 指定配置文件（如 51easyai.com.conf）
|
||
PREFERRED_CONF_FILE="${EASYAI_PROXY_CONF:-}"
|
||
DEFAULT_NEW_CONF_FILE="${EASYAI_PROXY_CONF:-easyai-proxy.conf}"
|
||
HTTPS_DOMAIN_INPUT="$(get_env_domain)"
|
||
CONF_FILE=$(detect_existing_proxy_conf "$PREFERRED_CONF_FILE" "$HTTPS_DOMAIN_INPUT")
|
||
if [ -n "$CONF_FILE" ]; then
|
||
upsert_domain_for_conf "$CONF_FILE" "$HTTPS_DOMAIN_INPUT" "${EASYAI_PROXY_DOMAIN_ACTION:-}"
|
||
else
|
||
CONF_FILE="$DEFAULT_NEW_CONF_FILE"
|
||
echo "ℹ️ 当前目录未找到可用 nginx 配置文件（*.conf 且包含 server_name）"
|
||
input_domain=$(prompt_domain)
|
||
create_conf_by_template "$input_domain" "$CONF_FILE"
|
||
echo "✅ 已根据域名 $input_domain 创建配置文件: ./$CONF_FILE"
|
||
fi
|
||
|
||
cp "./$CONF_FILE" "/etc/nginx/conf.d/$CONF_FILE"
|
||
echo "🚀 重载nginx"
|
||
sudo nginx -s reload
|
||
|
||
# 停止 Nginx 服务以释放 80 端口
|
||
sudo nginx -s stop
|
||
|
||
echo "🚀 使用certbot 自动配置证书"
|
||
# 从 Nginx 配置文件中提取所有域名
|
||
SERVER_NAME_LINES=$(
|
||
if [ -f "/etc/nginx/conf.d/$CONF_FILE" ]; then
|
||
grep "server_name" "/etc/nginx/conf.d/$CONF_FILE" 2>/dev/null || true
|
||
else
|
||
find /etc/nginx/conf.d/ -name "*.conf" -exec grep "server_name" {} \; 2>/dev/null || true
|
||
fi
|
||
)
|
||
|
||
DOMAINS=$(echo "$SERVER_NAME_LINES" | \
|
||
grep -v "#" | \
|
||
awk '{for(i=2;i<=NF;i++) if($i!=";") print $i}' | \
|
||
sed 's/;//g' | \
|
||
sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | \
|
||
grep -E '^[A-Za-z0-9.-]+$' | \
|
||
grep -vE '^(\*|localhost)$' | \
|
||
sort -u | \
|
||
tr '\n' ' ')
|
||
|
||
if [ -n "$DOMAINS" ]; then
|
||
# 停止 Nginx 服务
|
||
echo "停止 Nginx 服务..."
|
||
sudo nginx -s stop
|
||
|
||
# 构建域名参数字符串
|
||
DOMAIN_ARGS=()
|
||
for domain in $DOMAINS; do
|
||
DOMAIN_ARGS+=("-d" "$domain")
|
||
done
|
||
|
||
# 使用 certbot --nginx 插件安装证书
|
||
sudo certbot --nginx \
|
||
--non-interactive \
|
||
--agree-tos \
|
||
--email "${CERTBOT_EMAIL:-wangbo@51easyai.com}" \
|
||
--rsa-key-size 2048 \
|
||
--preferred-challenges http \
|
||
--force-renewal \
|
||
"${DOMAIN_ARGS[@]}"
|
||
|
||
# 启动 Nginx 服务
|
||
echo "启动 Nginx 服务..."
|
||
sudo nginx
|
||
fi
|