From cd552a1a4d322dca667ecbd57be19658c76393b2 Mon Sep 17 00:00:00 2001 From: aiyimickey <39365912+aiyimickey@users.noreply.github.com> Date: Fri, 3 Jul 2026 14:37:54 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20deploy-ai.sh=20=E5=85=A8=E9=9D=A2?= =?UTF-8?q?=E5=AE=A1=E6=9F=A5=E4=BF=AE=E5=A4=8D=EF=BC=8815=E9=A1=B9?= =?UTF-8?q?=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - C1: SSO 首次部署自动生成 JWKS 密钥 - C2: 首次部署自动生成 JWT_SECRET / OIDC_CLIENT_SECRET / LOCALADMIN_PASSWORD - H1: LDAP 密码 sed 改用 | 分隔符 - H2: LLDAP 密钥写入改用 printf - H3: OIDC client_secret 从 Authelia 配置自动注入 - H4: to_prod/to_local 改为白名单模式 - M1: 构建失败 return 1 阻断部署 - M2: 部署后清理远程 /tmp 临时文件 - M4: 移除构建日志本地保存 - L1: 修复缩进不一致 - L2: AUTHELIA_URL 仅对 OIDC 站点注入 - L3: monitor nginx reload 前添加 nginx -t - L5: curl -k 添加说明注释 - L6: 磁盘紧急清理时截断容器日志 --- deploy-ai.sh | 103 ++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 73 insertions(+), 30 deletions(-) diff --git a/deploy-ai.sh b/deploy-ai.sh index ebe91a4..8877679 100755 --- a/deploy-ai.sh +++ b/deploy-ai.sh @@ -66,9 +66,9 @@ echo " 3) token.tlyq.ai (Token工厂)" echo " 4) issue.tlyq.ai (工单系统)" echo " 5) assets.tlyq.ai (资产管理系统)" echo " 6) oa.tlyq.ai (OA 统一门户 — 含 nginx 配置)" - echo " 7) ldap.tlyq.ai (LLDAP 用户目录服务)" - echo " 8) git.tlyq.ai (Gitea 代码托管)" - echo " 9) sso.tlyq.ai (Authelia SSO — 统一认证中心)" +echo " 7) ldap.tlyq.ai (LLDAP 用户目录服务)" +echo " 8) git.tlyq.ai (Gitea 代码托管)" +echo " 9) sso.tlyq.ai (Authelia SSO — 统一认证中心)" echo " 10) monitor.tlyq.ai (告警监控中心)" echo "" printf "请输入编号 (1/2/3/4/5/6/7/8/9/10): " @@ -82,8 +82,8 @@ case "$choice" in 4) SITE="issue"; LOCAL_DIR="/Users/niuniu/programs/docker/issue-ai"; REMOTE_DIR="/root/docker/issue-ai"; CONTAINER="issue-ai" ;; 5) SITE="assets"; LOCAL_DIR="/Users/niuniu/programs/docker/assets-ai"; REMOTE_DIR="/root/docker/assets-ai"; CONTAINER="assets-ai" ;; 6) SITE="oa"; LOCAL_DIR="/Users/niuniu/programs/docker/oa-ai"; REMOTE_DIR="/root/docker/oa-ai"; CONTAINER="oa-ai" ;; - 7) SITE="ldap"; LOCAL_DIR="/Users/niuniu/programs/docker/ldap-ai"; REMOTE_DIR="/root/docker/ldap-ai"; CONTAINER="lldap" ;; - 8) SITE="gitea"; LOCAL_DIR="/Users/niuniu/programs/docker/gitea-ai"; REMOTE_DIR="/root/docker/gitea-ai"; CONTAINER="gitea-ai" ;; + 7) SITE="ldap"; LOCAL_DIR="/Users/niuniu/programs/docker/ldap-ai"; REMOTE_DIR="/root/docker/ldap-ai"; CONTAINER="lldap" ;; + 8) SITE="gitea"; LOCAL_DIR="/Users/niuniu/programs/docker/gitea-ai"; REMOTE_DIR="/root/docker/gitea-ai"; CONTAINER="gitea-ai" ;; 9) SITE="sso"; LOCAL_DIR="/Users/niuniu/programs/docker/sso-ai"; REMOTE_DIR="/root/docker/sso-ai"; CONTAINER="authelia" ;; 10) SITE="monitor"; LOCAL_DIR="/Users/niuniu/programs/docker/monitor-ai"; REMOTE_DIR="/root/docker/monitor-ai"; CONTAINER="monitor-ai" ;; *) echo "无效选择"; exit 1 ;; @@ -161,8 +161,8 @@ replace_oa_urls() { fi } -to_prod() { [[ "$SITE" != "issue" && "$SITE" != "assets" && "$SITE" != "oa" ]] && replace_url prod; } -to_local() { [[ "$SITE" != "issue" && "$SITE" != "assets" && "$SITE" != "oa" ]] && replace_url local; } +to_prod() { [[ "$SITE" == "www" || "$SITE" == "cloud" || "$SITE" == "token" ]] && replace_url prod; } +to_local() { [[ "$SITE" == "www" || "$SITE" == "cloud" || "$SITE" == "token" ]] && replace_url local; } trap 'to_local; [[ "$SITE" == "oa" ]] && replace_oa_urls local' EXIT [[ "$SITE" == "oa" ]] && replace_oa_urls prod [[ "$SITE" != "issue" && "$SITE" != "assets" && "$SITE" != "oa" ]] && to_prod @@ -209,7 +209,7 @@ ENVEOF log "注入 LDAP 密码和 JWKS 密钥..." ssh txjp "cd /root/docker/sso-ai && \ LLDAP_PASSWORD=\$(docker exec lldap printenv LLDAP_ADMIN_PASSWORD) && \ - sed -i \"s/PRODUCTION_LDAP_PASSWORD/\$LLDAP_PASSWORD/\" config/authelia/configuration.yml 2>/dev/null || true && \ + sed -i \"s|PRODUCTION_LDAP_PASSWORD|\$LLDAP_PASSWORD|\" config/authelia/configuration.yml 2>/dev/null || true && \ # 如果 JWKS key 仍是占位符，从现有配置或生成新密钥 if grep -q 'OIDC_JWKS_KEY_PLACEHOLDER' config/authelia/configuration.yml; then EXISTING_KEY=\$(cat /root/docker/sso-ai/config/authelia/configuration.yml.bak 2>/dev/null | sed -n '/key: |/,/-----END/{p}' || true) @@ -433,10 +433,12 @@ build_on_server() { || echo 'NEXT_PUBLIC_ASSETS_URL=https://assets.tlyq.ai' >> $REMOTE_DIR/.env" fi - # 确保 AUTHELIA_URL 已设置（退出登录 cookie domain 依赖此变量） - ssh txjp "grep -q 'AUTHELIA_URL' $REMOTE_DIR/.env 2>/dev/null \ - && sed -i 's|AUTHELIA_URL=.*|AUTHELIA_URL=https://sso.tlyq.ai|' $REMOTE_DIR/.env 2>/dev/null \ - || echo 'AUTHELIA_URL=https://sso.tlyq.ai' >> $REMOTE_DIR/.env" + # 确保 AUTHELIA_URL 已设置（仅对使用 OIDC 的站点） + if [[ "$SITE" == "oa" || "$SITE" == "assets" || "$SITE" == "issue" || "$SITE" == "monitor" ]]; then + ssh txjp "grep -q 'AUTHELIA_URL' $REMOTE_DIR/.env 2>/dev/null \ + && sed -i 's|AUTHELIA_URL=.*|AUTHELIA_URL=https://sso.tlyq.ai|' $REMOTE_DIR/.env 2>/dev/null \ + || echo 'AUTHELIA_URL=https://sso.tlyq.ai' >> $REMOTE_DIR/.env" + fi # OIDC 环境变量配置（oa/assets/issue/monitor 站点） if [[ "$SITE" == "oa" || "$SITE" == "assets" || "$SITE" == "issue" || "$SITE" == "monitor" ]]; then @@ -487,6 +489,36 @@ build_on_server() { done < /tmp/.env.prod.template && rm -f /tmp/.env.prod.template" fi + # 自动生成缺失的密钥（首次部署场景） + # JWT_SECRET：所有站点都需要 + if ! ssh txjp "grep -q '^JWT_SECRET=' $REMOTE_DIR/.env 2>/dev/null"; then + JWT_GEN=$(openssl rand -hex 32) + ssh txjp "echo 'JWT_SECRET=${JWT_GEN}' >> $REMOTE_DIR/.env" + info "已自动生成 JWT_SECRET" + fi + # OIDC_CLIENT_SECRET：从 Authelia 配置读取或警告 + if [[ "$SITE" == "oa" || "$SITE" == "assets" || "$SITE" == "issue" || "$SITE" == "monitor" ]]; then + if ! ssh txjp "grep -q '^OIDC_CLIENT_SECRET=' $REMOTE_DIR/.env 2>/dev/null"; then + # 尝试从 Authelia 配置读取对应的 client_secret 哈希 + OIDC_SECRET_KEY="${SITE}_OIDC_SECRET" + OIDC_SECRET_VAL=$(ssh txjp "grep -A1 'client_id:.*${OIDC_ID}' /root/docker/sso-ai/config/authelia/configuration.yml 2>/dev/null | grep client_secret | head -1 | sed \"s/.*client_secret: *'\\(.*\\)'/\\1/\" || true" 2>/dev/null) + if [[ -n "$OIDC_SECRET_VAL" && "$OIDC_SECRET_VAL" != *"PLACEHOLDER"* ]]; then + ssh txjp "echo 'OIDC_CLIENT_SECRET=${OIDC_SECRET_VAL}' >> $REMOTE_DIR/.env" + info "已从 Authelia 配置注入 OIDC_CLIENT_SECRET" + else + warn "OIDC_CLIENT_SECRET 未设置，请从 Authelia 配置获取并手动配置" + fi + fi + fi + # LOCALADMIN_PASSWORD：monitor 专属 + if [[ "$SITE" == "monitor" ]]; then + if ! ssh txjp "grep -q '^LOCALADMIN_PASSWORD=' $REMOTE_DIR/.env 2>/dev/null"; then + LOCALADMIN_GEN=$(openssl rand -hex 16) + ssh txjp "echo 'LOCALADMIN_PASSWORD=${LOCALADMIN_GEN}' >> $REMOTE_DIR/.env" + info "已自动生成 LOCALADMIN_PASSWORD" + fi + fi + # 清理可能被上传的本地环境变量文件（.env.local 等会覆盖 .env 中的生产配置） ssh txjp "rm -f $REMOTE_DIR/.env.local $REMOTE_DIR/.env.development $REMOTE_DIR/.env.production 2>/dev/null; echo '已清理本地环境文件'" @@ -499,7 +531,6 @@ build_on_server() { # 使用 tee 避免管道导致退出码丢失，并过滤无用输出 ssh txjp "cd ${REMOTE_DIR} && npm run build 2>&1" | \ grep -vE "^(info|warn|npm warn|audited|packages|funding|vulnerability|npm notice|New major)" | \ - tee /tmp/build_output.txt | \ tail -15 build_exit_code=${PIPESTATUS[0]} build_end=$(date +%s) @@ -507,7 +538,8 @@ build_on_server() { timing "构建耗时: ${build_dur}s" if [[ "$build_exit_code" -ne 0 ]]; then - warn "构建可能有警告，请检查上面的输出" + error "构建失败（退出码: $build_exit_code），中止部署" + return 1 fi # 清理 standalone 中的 musl 原生模块（Alpine builder 残留，Debian runner 不兼容） @@ -550,6 +582,8 @@ build_on_server() { if [ "$DISK_USAGE" -gt 95 ]; then warn "磁盘使用率 ${DISK_USAGE}%，执行紧急清理" ssh txjp "docker builder prune -f 2>/dev/null || true" + # 截断容器日志（占磁盘大户） + ssh txjp "truncate -s 0 /var/lib/docker/containers/*/\*-json.log 2>/dev/null || true" elif [ "$DISK_USAGE" -gt 85 ]; then info "磁盘使用率 ${DISK_USAGE}%，执行激进清理（6小时）" ssh txjp "docker builder prune -f --filter 'until=6h' 2>/dev/null || true" @@ -563,6 +597,9 @@ build_on_server() { # 8. 保存快照 ssh txjp "echo '$local_md5' > ${SNAPSHOT_FILE}" + + # 9. 清理远程临时文件（源码包、连通性检查脚本） + ssh txjp "rm -f /tmp/${SITE}.tar.gz /tmp/shared-deploy.tar.gz /tmp/check-conn.js /tmp/.env.prod.template 2>/dev/null || true" } # ============================================================ @@ -659,19 +696,24 @@ CHECKEOF info "同步 LLDAP 邮箱至各站点..." ssh txjp "node /root/docker/oa-ai/scripts/sync-emails-to-sites.js 2>/dev/null" || warn "邮箱同步失败（不影响 OA 主流程）" ;; - ldap) - info "部署 LLDAP..." - scp "$LOCAL_DIR/docker-compose.yml" txjp:$REMOTE_DIR/docker-compose.yml - scp "$LOCAL_DIR/Dockerfile" txjp:$REMOTE_DIR/Dockerfile - ssh txjp "cd $REMOTE_DIR && \ + ldap) + info "部署 LLDAP..." + scp "$LOCAL_DIR/docker-compose.yml" txjp:$REMOTE_DIR/docker-compose.yml + scp "$LOCAL_DIR/Dockerfile" txjp:$REMOTE_DIR/Dockerfile + ssh txjp "cd $REMOTE_DIR && \ if [ ! -f .env ]; then \ - echo 'LLDAP_JWT_SECRET='\$(docker exec lldap printenv LLDAP_JWT_SECRET 2>/dev/null) > .env && \ - echo 'LLDAP_LDAP_USER_PASS='\$(docker exec lldap printenv LLDAP_LDAP_USER_PASS 2>/dev/null) >> .env && \ - echo 'LLDAP_LDAP_BASE_DN=dc=tlyq,dc=ai' >> .env && \ - echo 'LLDAP_HTTP_PORT=17170' >> .env && \ - echo 'LLDAP_LDAP_PORT=3890' >> .env && \ - echo 'LLDAP_DATABASE_PATH=/data/users.db' >> .env && \ - echo 'LLDAP_ADMIN_PASSWORD='\$(docker exec lldap printenv LLDAP_ADMIN_PASSWORD 2>/dev/null) >> .env && \ + LLDAP_JWT=\$(docker exec lldap printenv LLDAP_JWT_SECRET 2>/dev/null) && \ + LLDAP_PASS=\$(docker exec lldap printenv LLDAP_LDAP_USER_PASS 2>/dev/null) && \ + LLDAP_ADMIN=\$(docker exec lldap printenv LLDAP_ADMIN_PASSWORD 2>/dev/null) && \ + printf '%s\n' \ + \"LLDAP_JWT_SECRET=\$LLDAP_JWT\" \ + \"LLDAP_LDAP_USER_PASS=\$LLDAP_PASS\" \ + \"LLDAP_LDAP_BASE_DN=dc=tlyq,dc=ai\" \ + \"LLDAP_HTTP_PORT=17170\" \ + \"LLDAP_LDAP_PORT=3890\" \ + \"LLDAP_DATABASE_PATH=/data/users.db\" \ + \"LLDAP_ADMIN_PASSWORD=\$LLDAP_ADMIN\" \ + > .env && \ fi && \ sed -i '/3890:3890/d' docker-compose.yml 2>/dev/null || true && \ docker compose up -d --build && docker compose restart" @@ -687,7 +729,7 @@ CHECKEOF build_on_server || exit 1 info "部署 nginx 配置..." ssh txjp "cp $REMOTE_DIR/../nginx-proxy-ai/conf.d/monitor-ai.conf /root/docker/nginx-proxy-ai/conf.d/ 2>/dev/null || true - docker exec nginx-ai nginx -s reload 2>/dev/null || true" ;; + docker exec nginx-ai nginx -t && docker exec nginx-ai nginx -s reload" ;; esac # ============================================================ @@ -705,9 +747,9 @@ case "$SITE" in token) URL="https://token.tlyq.ai" ;; issue) URL="https://issue.tlyq.ai" ;; assets) URL="https://assets.tlyq.ai" ;; - oa) URL="https://oa.tlyq.ai" ;; - ldap) URL="http://localhost:6178" ;; - gitea) URL="https://git.tlyq.ai" ;; + oa) URL="https://oa.tlyq.ai" ;; + ldap) URL="http://localhost:6178" ;; + gitea) URL="https://git.tlyq.ai" ;; sso) URL="https://sso.tlyq.ai" ;; monitor) URL="https://monitor.tlyq.ai" ;; esac @@ -715,6 +757,7 @@ esac if [[ "$SITE" == "ldap" ]]; then STATUS=$(ssh txjp "docker exec lldap wget -q -O - http://127.0.0.1:17170 > /dev/null 2>&1 && echo 200 || echo 000" 2>/dev/null || echo "???") else + # -k: 服务器本地使用自签名证书，必须跳过 TLS 验证 STATUS=$(ssh txjp "curl -s -o /dev/null -w '%{http_code}' -k '$URL' 2>/dev/null" 2>/dev/null || echo "???") fi if [[ "$STATUS" == "200" || "$STATUS" == "307" || "$STATUS" == "301" ]]; then