From 4ea06ba637d4167202a2f20eea7805a08d35c12b Mon Sep 17 00:00:00 2001
From: aiyimickey <39365912+aiyimickey@users.noreply.github.com>
Date: Fri, 3 Jul 2026 13:50:41 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20deploy=5Fsso=20JWKS=20=E5=AF=86=E9=92=A5?=
 =?UTF-8?q?=E5=A4=84=E7=90=86=20+=20=E9=85=8D=E7=BD=AE=E5=A4=87=E4=BB=BD?=
 =?UTF-8?q?=20+=20=E5=8D=A0=E4=BD=8D=E7=AC=A6=E6=A3=80=E6=B5=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy-ai.sh | 30 +++++++++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/deploy-ai.sh b/deploy-ai.sh
index 0b8e71f..a93fcdb 100755
--- a/deploy-ai.sh
+++ b/deploy-ai.sh
@@ -176,6 +176,8 @@ deploy_sso() {
     # 1. 上传 docker-compose.yml 和 config/
     log "上传配置文件..."
     scp /Users/niuniu/programs/docker/sso-ai/docker-compose.yml txjp:/root/docker/sso-ai/docker-compose.yml
+    # 备份现有配置（用于恢复 JWKS 密钥等动态生成的值）
+    ssh txjp "cp /root/docker/sso-ai/config/authelia/configuration.yml /root/docker/sso-ai/config/authelia/configuration.yml.bak 2>/dev/null || true"
     # 使用生产配置（configuration.prod.yml → configuration.yml）
     scp /Users/niuniu/programs/docker/sso-ai/config/authelia/configuration.prod.yml txjp:/root/docker/sso-ai/config/authelia/configuration.yml
     # 上传其他 config 文件（如 notifications.yml）
@@ -201,11 +203,33 @@ ENVEOF
         echo '已存在 .env，跳过密钥生成'
     fi"
 
-    # 3. 注入 LDAP 密码到 configuration.yml（占位符 → 真实密码）
-    log "注入 LDAP 密码..."
+    # 3. 注入占位符真实值（LDAP 密码、JWKS 密钥）
+    log "注入 LDAP 密码和 JWKS 密钥..."
     ssh txjp "cd /root/docker/sso-ai && \
         LLDAP_PASSWORD=\$(docker exec lldap printenv LLDAP_ADMIN_PASSWORD) && \
-        sed -i \"s/PRODUCTION_LDAP_PASSWORD/\$LLDAP_PASSWORD/\" config/authelia/configuration.yml 2>/dev/null || true"
+        sed -i \"s/PRODUCTION_LDAP_PASSWORD/\$LLDAP_PASSWORD/\" config/authelia/configuration.yml 2>/dev/null || true && \
+        # 如果 JWKS key 仍是占位符，从现有配置或生成新密钥
+        if grep -q 'OIDC_JWKS_KEY_PLACEHOLDER' config/authelia/configuration.yml; then
+            EXISTING_KEY=\$(cat /root/docker/sso-ai/config/authelia/configuration.yml.bak 2>/dev/null | sed -n '/key: |/,/-----END/{p}' || true)
+            if [ -n \"\$EXISTING_KEY\" ]; then
+                echo '从备份恢复 JWKS 密钥'
+                # 使用 python 替换多行占位符（sed 不便处理）
+                python3 -c \"
+import sys
+content = open('config/authelia/configuration.yml').read()
+key = '''\$EXISTING_KEY'''
+content = content.replace('OIDC_JWKS_KEY_PLACEHOLDER', key.strip())
+open('config/authelia/configuration.yml', 'w').write(content)
+\" 2>/dev/null || true
+            else
+                echo '警告: JWKS 密钥为占位符，需要手动配置'
+            fi
+        fi && \
+        # 检查 OIDC client_secret 占位符
+        if grep -q 'OIDC_.*_SECRET_HASH' config/authelia/configuration.yml; then
+            echo '警告: 存在 OIDC client_secret 占位符，需要手动替换'
+            grep 'OIDC_.*_SECRET_HASH' config/authelia/configuration.yml || true
+        fi"
 
     # 4. 部署 nginx sso-ai.conf
     log "部署 nginx 配置..."