gaoxiaopei
/
website-scripts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: deploy_sso JWKS 密钥处理 + 配置备份 + 占位符检测

This commit is contained in:
aiyimickey 2026-07-03 13:50:41 +08:00
parent d34c0c7cb5
commit 4ea06ba637
1 changed files with 27 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
deploy-ai.sh
View File

@ -176,6 +176,8 @@ deploy_sso() {
# 1. 上传 docker-compose.yml 和 config/
log "上传配置文件..."
scp /Users/niuniu/programs/docker/sso-ai/docker-compose.yml txjp:/root/docker/sso-ai/docker-compose.yml
# 备份现有配置（用于恢复 JWKS 密钥等动态生成的值）
ssh txjp "cp /root/docker/sso-ai/config/authelia/configuration.yml /root/docker/sso-ai/config/authelia/configuration.yml.bak 2>/dev/null || true"
# 使用生产配置（configuration.prod.yml → configuration.yml）
scp /Users/niuniu/programs/docker/sso-ai/config/authelia/configuration.prod.yml txjp:/root/docker/sso-ai/config/authelia/configuration.yml
# 上传其他 config 文件（如 notifications.yml）
@ -201,11 +203,33 @@ ENVEOF
echo '已存在 .env，跳过密钥生成'
fi"
# 3. 注入 LDAP 密码到 configuration.yml（占位符 → 真实密码）
log "注入 LDAP 密码..."
# 3. 注入占位符真实值（LDAP 密码、JWKS 密钥）
log "注入 LDAP 密码和 JWKS 密钥..."
ssh txjp "cd /root/docker/sso-ai && \
LLDAP_PASSWORD=\$(docker exec lldap printenv LLDAP_ADMIN_PASSWORD) && \
sed -i \"s/PRODUCTION_LDAP_PASSWORD/\$LLDAP_PASSWORD/\" config/authelia/configuration.yml 2>/dev/null || true"
sed -i \"s/PRODUCTION_LDAP_PASSWORD/\$LLDAP_PASSWORD/\" config/authelia/configuration.yml 2>/dev/null || true && \
# 如果 JWKS key 仍是占位符，从现有配置或生成新密钥
if grep -q 'OIDC_JWKS_KEY_PLACEHOLDER' config/authelia/configuration.yml; then
EXISTING_KEY=\$(cat /root/docker/sso-ai/config/authelia/configuration.yml.bak 2>/dev/null | sed -n '/key: |/,/-----END/{p}' || true)
if [ -n \"\$EXISTING_KEY\" ]; then
echo '从备份恢复 JWKS 密钥'
# 使用 python 替换多行占位符（sed 不便处理）
python3 -c \"
import sys
content = open('config/authelia/configuration.yml').read()
key = '''\$EXISTING_KEY'''
content = content.replace('OIDC_JWKS_KEY_PLACEHOLDER', key.strip())
open('config/authelia/configuration.yml', 'w').write(content)
\" 2>/dev/null || true
else
echo '警告: JWKS 密钥为占位符，需要手动配置'
fi
fi && \
# 检查 OIDC client_secret 占位符
if grep -q 'OIDC_.*_SECRET_HASH' config/authelia/configuration.yml; then
echo '警告: 存在 OIDC client_secret 占位符，需要手动替换'
grep 'OIDC_.*_SECRET_HASH' config/authelia/configuration.yml || true
fi"
# 4. 部署 nginx sso-ai.conf
log "部署 nginx 配置..."