feat: deploy-ai.sh 新增 sso-ai 部署支持 + sites-manage-local.sh 新增 gitea

- deploy-ai.sh: 新增选项 9 sso-ai 部署、deploy_sso 函数、密钥生成、LDAP 密码注入
- sites-manage-local.sh: 新增 gitea 支持、localhost → 127.0.0.1

deploy-ai.sh

@@ -68,8 +68,9 @@ echo "  5) assets.tlyq.ai  (资产管理系统)"
 echo "  6) oa.tlyq.ai      (OA 统一门户 — 含 nginx 配置)"
   echo "  7) ldap.tlyq.ai    (LLDAP 用户目录服务)"
   echo "  8) git.tlyq.ai     (Gitea 代码托管)"
+  echo "  9) sso.tlyq.ai     (Authelia SSO — 统一认证中心)"
 echo ""
-printf "请输入编号 (1/2/3/4/5/6/7/8): "
+printf "请输入编号 (1/2/3/4/5/6/7/8/9): "
 read choice
 
 SITE=""; LOCAL_DIR=""; REMOTE_DIR=""; CONTAINER=""
@@ -82,6 +83,7 @@ case "$choice" in
     6) SITE="oa";    LOCAL_DIR="/Users/niuniu/programs/docker/oa-ai";        REMOTE_DIR="/root/docker/oa-ai";        CONTAINER="oa-ai" ;;
 	    7) SITE="ldap";  LOCAL_DIR="/Users/niuniu/programs/docker/ldap-ai";      REMOTE_DIR="/root/docker/ldap-ai";      CONTAINER="lldap" ;;
 	    8) SITE="gitea"; LOCAL_DIR="/Users/niuniu/programs/docker/gitea-ai";   REMOTE_DIR="/root/docker/gitea-ai";    CONTAINER="gitea-ai" ;;
+    9) SITE="sso";   LOCAL_DIR="/Users/niuniu/programs/docker/sso-ai";      REMOTE_DIR="/root/docker/sso-ai";       CONTAINER="authelia" ;;
     *) echo "无效选择"; exit 1 ;;
 esac
 
@@ -163,6 +165,61 @@ trap 'to_local; [[ "$SITE" == "oa" ]] && replace_oa_urls local' EXIT
 [[ "$SITE" == "oa" ]] && replace_oa_urls prod
 [[ "$SITE" != "issue" && "$SITE" != "assets" && "$SITE" != "oa" ]] && to_prod
 
+# ============================================================
+# sso-ai 部署（Docker 容器，无 npm 构建）
+# ============================================================
+deploy_sso() {
+    log "部署 sso-ai (Authelia SSO)..."
+
+    # 1. 上传 docker-compose.yml 和 config/
+    log "上传配置文件..."
+    scp /Users/niuniu/programs/docker/sso-ai/docker-compose.yml txjp:/root/docker/sso-ai/docker-compose.yml
+    scp -r /Users/niuniu/programs/docker/sso-ai/config txjp:/root/docker/sso-ai/config
+
+    # 2. 首次部署：生成密钥
+    ssh txjp "if [ ! -f /root/docker/sso-ai/.env ]; then
+        echo '首次部署，生成密钥...'
+        REDIS_PASSWORD=\$(openssl rand -hex 16)
+        AUTHELIA_JWT_SECRET=\$(openssl rand -hex 32)
+        AUTHELIA_SESSION_SECRET=\$(openssl rand -hex 32)
+        AUTHELIA_STORAGE_ENCRYPTION_KEY=\$(openssl rand -hex 32)
+        LLDAP_PASSWORD=\$(docker exec lldap printenv LLDAP_ADMIN_PASSWORD)
+        cat > /root/docker/sso-ai/.env << ENVEOF
+REDIS_PASSWORD=\$REDIS_PASSWORD
+AUTHELIA_JWT_SECRET=\$AUTHELIA_JWT_SECRET
+AUTHELIA_SESSION_SECRET=\$AUTHELIA_SESSION_SECRET
+AUTHELIA_STORAGE_ENCRYPTION_KEY=\$AUTHELIA_STORAGE_ENCRYPTION_KEY
+LLDAP_PASSWORD=\$LLDAP_PASSWORD
+ENVEOF
+        echo '密钥已生成'
+    else
+        echo '已存在 .env，跳过密钥生成'
+    fi"
+
+    # 3. 注入 LDAP 密码到 configuration.yml
+    log "注入 LDAP 密码..."
+    ssh txjp "cd /root/docker/sso-ai && \
+        LLDAP_PASSWORD=\$(docker exec lldap printenv LLDAP_ADMIN_PASSWORD) && \
+        sed -i \"s/password: 'placeholder'/password: '\$LLDAP_PASSWORD'/\" config/authelia/configuration.yml 2>/dev/null || true"
+
+    # 4. 部署 nginx sso-ai.conf
+    log "部署 nginx 配置..."
+    scp /Users/niuniu/programs/docker/nginx-proxy-ai/conf.d/sso-ai.conf txjp:/root/docker/nginx-proxy-ai/conf.d/sso-ai.conf
+
+    # 5. 启动容器
+    log "启动 Authelia..."
+    ssh txjp "cd /root/docker/sso-ai && docker compose up -d"
+
+    # 6. 验证
+    sleep 5
+    ssh txjp "curl -sk https://127.0.0.1:9091/api/health" && log "Authelia 健康检查通过" || warn "Authelia 可能未就绪"
+
+    # 7. 重载 nginx
+    ssh txjp "docker exec nginx-ai nginx -t && docker exec nginx-ai nginx -s reload" && log "nginx 已重载" || warn "nginx 重载失败"
+
+    log "sso-ai 部署完成"
+}
+
 # ============================================================
 # 核心构建函数（服务器上直接 npm run build）
 # ============================================================
@@ -469,6 +526,8 @@ CHECKEOF
 	        scp "$LOCAL_DIR/docker-compose.yml" txjp:$REMOTE_DIR/docker-compose.yml
 	        ssh txjp "cd $REMOTE_DIR && docker compose up -d && docker restart nginx-ai"
 	        log "Gitea 已部署" ;;
+    sso)
+        deploy_sso ;;
 esac
 
 # ============================================================
@@ -489,6 +548,7 @@ case "$SITE" in
 	    oa)    URL="https://oa.tlyq.ai" ;;
 		    ldap)  URL="http://localhost:6178" ;;
 			    gitea) URL="https://git.tlyq.ai" ;;
+    sso)   URL="https://sso.tlyq.ai" ;;
 esac
 
 if [[ "$SITE" == "ldap" ]]; then

sites-manage-cloud.sh

@@ -4,7 +4,8 @@
 # 本地 Mac 运行 → 通过 SSH 操作 txjp 服务器
 # 云服务器运行 → 直接操作本地 Docker
 #
-# 用法：bash sites-manage-cloud.sh <命令> [站点名...]
+# 用法：bash sites-manage-cloud.sh [命令] [站点名...]
+# 不加命令默认 status
 #       站点名：ldap www cloud token gitea issue assets oa nginx
 #               ai（上述全部）、all（同 ai）
 
@@ -157,7 +158,7 @@ remote_status() {
 
 show_help() {
   echo ""
-  printf "${CYAN}用法:${NC} bash sites-manage-cloud.sh <命令> [站点名...]\n"
+  printf "${CYAN}用法:${NC} bash sites-manage-cloud.sh [命令] [站点名...]\n"
   echo ""
   echo "  当前环境: ${LABEL}"
   echo ""
@@ -190,14 +191,9 @@ show_help() {
 # ============================================================
 # 入口
 # ============================================================
-ACTION=${1:-}
+ACTION=${1:-status}
 shift || true
 
-if [ -z "$ACTION" ]; then
-  show_help
-  exit 0
-fi
-
 mapfile -t TARGETS < <(expand_sites "$@")
 if [ ${#TARGETS[@]} -eq 0 ]; then
   mapfile -t TARGETS < <(expand_sites ai)

sites-manage-local.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # 本地站点管理：启动 / 停止 / 重启 / 状态
 # 用法：bash sites-manage-local.sh [start|stop|restart|status] [站点名...]
-# 不加参数则交互选择
+# 不加参数默认 status
 #
 # 站点名：
 #   cc:     www-cc  cloud-cc  token-cc
@@ -15,6 +15,7 @@ ISSUE_DIR="$BASE_DIR/issue-ai"
 ASSETS_DIR="$BASE_DIR/assets-ai"
 LDAP_DIR="$BASE_DIR/ldap-ai"
 OA_DIR="$BASE_DIR/oa-ai"
+GITEA_DIR="$BASE_DIR/gitea-ai"
 OA_PORT=6179
 
 # 颜色
@@ -27,6 +28,7 @@ err()  { printf "${RED}[✗]${NC} %s\n" "$1"; }
 ISSUE_PORT=6176
 ASSETS_PORT=6177
 LDAP_WEB_PORT=6178
+GITEA_PORT=3000
 
 is_port()       { lsof -i :"$1" >/dev/null 2>&1; }
 is_running()    { docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^$1$"; }
@@ -104,11 +106,12 @@ start_all() {
             assets)   node_start assets-ai "$ASSETS_DIR" $ASSETS_PORT "/tmp/assets-ai-dev.log" ;;
             ldap)    docker_start lldap "$LDAP_DIR"
                      if is_port $LDAP_WEB_PORT; then
-                         log "LLDAP Web UI: http://localhost:$LDAP_WEB_PORT"
+                         log "LLDAP Web UI: http://127.0.0.1:$LDAP_WEB_PORT"
                      fi ;;
             oa)      node_start oa-ai "$OA_DIR" $OA_PORT "/tmp/oa-ai-dev.log" ;;
+            gitea)   docker_start gitea-ai "$GITEA_DIR" ;;
             cc)       start_all www-cc cloud-cc token-cc ;;
-            ai)       start_all ldap www-ai cloud-ai token-ai issue assets oa ;;
+            ai)       start_all ldap www-ai cloud-ai token-ai issue assets oa gitea ;;
             all)      start_all cc ai ;;
             *)        err "未知站点: $name" ;;
         esac
@@ -128,8 +131,9 @@ stop_all() {
             assets)   node_stop assets-ai $ASSETS_PORT ;;
             ldap)    docker_stop lldap "$LDAP_DIR" ;;
             oa)      node_stop oa-ai $OA_PORT ;;
+            gitea)   docker_stop gitea-ai "$GITEA_DIR" ;;
             cc)       stop_all www-cc cloud-cc token-cc ;;
-            ai)       stop_all ldap www-ai cloud-ai token-ai issue assets oa ;;
+            ai)       stop_all ldap www-ai cloud-ai token-ai issue assets oa gitea ;;
             all)      stop_all cc ai ;;
             *)        err "未知站点: $name" ;;
         esac
@@ -152,9 +156,9 @@ show_status() {
     local expanded=()
     for t in "${targets[@]}"; do
         case $t in
-            all) eval "expanded=(www-cc cloud-cc token-cc ldap www-ai cloud-ai token-ai issue assets oa)" ;;
+            all) eval "expanded=(www-cc cloud-cc token-cc ldap www-ai cloud-ai token-ai issue assets oa gitea)" ;;
             cc)  eval "expanded=(\${expanded[@]} www-cc cloud-cc token-cc)" ;;
-            ai)  eval "expanded=(\${expanded[@]} ldap www-ai cloud-ai token-ai issue assets oa)" ;;
+            ai)  eval "expanded=(\${expanded[@]} ldap www-ai cloud-ai token-ai issue assets oa gitea)" ;;
             *)   expanded+=($t) ;;
         esac
     done
@@ -216,6 +220,14 @@ show_status() {
                     printf "  ${RED}●${NC} %-12s 未运行\n" "$name"
                 fi
                 ;;
+            gitea)
+                if is_running gitea-ai; then
+                    printf "  ${GREEN}●${NC} %-12s 运行中 (port %d)\n" "$name" $GITEA_PORT
+                    running=$((running + 1))
+                else
+                    printf "  ${RED}●${NC} %-12s 未运行\n" "$name"
+                fi
+                ;;
         esac
     done
     echo ""
@@ -225,18 +237,19 @@ show_status() {
     printf "${CYAN}=========================================${NC}\n"
     echo ""
     echo "  cc 站点:"
-    echo "    www-cc    http://localhost:5173"
+    echo "    www-cc    http://127.0.0.1:5173"
-    echo "    cloud-cc  http://localhost:5174"
+    echo "    cloud-cc  http://127.0.0.1:5174"
-    echo "    token-cc  http://localhost:5175"
+    echo "    token-cc  http://127.0.0.1:5175"
     echo ""
     echo "  ai 站点:"
-    echo "    www-ai    http://localhost:6173"
+    echo "    www-ai    http://127.0.0.1:6173"
-    echo "    cloud-ai  http://localhost:6174"
+    echo "    cloud-ai  http://127.0.0.1:6174"
-    echo "    token-ai  http://localhost:6175"
+    echo "    token-ai  http://127.0.0.1:6175"
-    echo "    ldap      http://localhost:$LDAP_WEB_PORT (LLDAP Web UI)"
+    echo "    ldap      http://127.0.0.1:$LDAP_WEB_PORT (LLDAP Web UI)"
-    echo "    oa        http://localhost:$OA_PORT"
+    echo "    oa        http://127.0.0.1:$OA_PORT"
-    echo "    issue     http://localhost:$ISSUE_PORT"
+    echo "    issue     http://127.0.0.1:$ISSUE_PORT"
-    echo "    assets    http://localhost:$ASSETS_PORT"
+    echo "    assets    http://127.0.0.1:$ASSETS_PORT"
+    echo "    gitea     http://127.0.0.1:$GITEA_PORT"
     echo ""
 }
 
@@ -245,7 +258,7 @@ show_status() {
 # ============================================================
 show_help() {
     echo ""
-    printf "${CYAN}用法:${NC} bash sites-manage-local.sh <命令> [站点名...]\n"
+    printf "${CYAN}用法:${NC} bash sites-manage-local.sh [命令] [站点名...]\n"
     echo ""
     echo "  命令:"
     echo "    start    启动站点"
@@ -255,9 +268,9 @@ show_help() {
     echo ""
     echo "  站点名（可指定多个，空格分隔）:"
     echo "    www-cc  cloud-cc  token-cc"
-    echo "    ldap     www-ai  cloud-ai  token-ai  issue  assets  oa"
+    echo "    ldap     www-ai  cloud-ai  token-ai  issue  assets  oa  gitea"
     echo "    cc      — tlyq.cc 全部 (www-cc cloud-cc token-cc)"
-    echo "    ai      — tlyq.ai 全部 (ldap www-ai cloud-ai token-ai issue assets oa)"
+    echo "    ai      — tlyq.ai 全部 (ldap www-ai cloud-ai token-ai issue assets oa gitea)"
     echo "    all     — 全部站点"
     echo ""
     echo "示例:"
@@ -275,14 +288,9 @@ show_help() {
 # 检查 Docker 服务
 check_docker
 
-ACTION=${1:-}
+ACTION=${1:-status}
 shift || true
 
-if [ -z "$ACTION" ]; then
-    show_help
-    exit 0
-fi
-
 # 解析站点列表
 if [ $# -eq 0 ]; then
     case $ACTION in