From 1232efa191dd9df95a0275ac0478ed7f4f576dc6 Mon Sep 17 00:00:00 2001
From: aiyimickey <39365912+aiyimickey@users.noreply.github.com>
Date: Fri, 3 Jul 2026 14:13:24 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E9=83=A8=E7=BD=B2=E8=84=9A=E6=9C=AC=20.?=
 =?UTF-8?q?env=20=E6=96=87=E4=BB=B6=E8=AE=BE=E7=BD=AE=20600=20=E6=9D=83?=
 =?UTF-8?q?=E9=99=90=EF=BC=88=E9=98=B2=E6=AD=A2=E5=AF=86=E7=A0=81=E6=B3=84?=
 =?UTF-8?q?=E9=9C=B2=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy-ai.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/deploy-ai.sh b/deploy-ai.sh
index a93fcdb..ebe91a4 100755
--- a/deploy-ai.sh
+++ b/deploy-ai.sh
@@ -199,8 +199,10 @@ AUTHELIA_STORAGE_ENCRYPTION_KEY=\$AUTHELIA_STORAGE_ENCRYPTION_KEY
 LLDAP_PASSWORD=\$LLDAP_PASSWORD
 ENVEOF
         echo '密钥已生成'
+        chmod 600 /root/docker/sso-ai/.env
     else
         echo '已存在 .env，跳过密钥生成'
+        chmod 600 /root/docker/sso-ai/.env 2>/dev/null || true
     fi"
 
     # 3. 注入占位符真实值（LDAP 密码、JWKS 密钥）
@@ -488,6 +490,9 @@ build_on_server() {
 	    # 清理可能被上传的本地环境变量文件（.env.local 等会覆盖 .env 中的生产配置）
     ssh txjp "rm -f $REMOTE_DIR/.env.local $REMOTE_DIR/.env.development $REMOTE_DIR/.env.production 2>/dev/null; echo '已清理本地环境文件'"
 
+    # 设置 .env 文件权限为 600（仅 root 可读写，防止密码泄露）
+    ssh txjp "chmod 600 $REMOTE_DIR/.env 2>/dev/null || true"
+
     # 5. 服务器上直接 npm run build（不重建 Docker）
     log "服务器上执行 npm run build..."
     build_start=$(date +%s)