1064 lines
51 KiB
Bash
Executable File
1064 lines
51 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# 本地修改 → 上传服务器 → 构建/更新 → 部署 (tlyq.ai)
|
||
#
|
||
# 策略：服务器上直接 npm run build，复用容器内已安装的 node_modules
|
||
#
|
||
# 支持系统：
|
||
# - macOS (本地): zsh + bash 兼容模式
|
||
# - Ubuntu/Debian (服务器): dash (符号链接到 sh) + bash
|
||
# - Rocky Linux/CentOS/RHEL (服务器): bash
|
||
#
|
||
# 用法：bash deploy-ai.sh [选项]
|
||
# 无参数 — 自动检测（初次构建 or 增量更新）
|
||
# --force — 强制完整构建
|
||
# --restart — 仅重启容器（跳过构建）
|
||
# --init — 强制初次完整构建
|
||
|
||
# 不使用 set -e，改用显式错误处理，避免管道命令导致意外退出
|
||
|
||
# ============================================================
|
||
# 脚本目录
|
||
# ============================================================
|
||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
|
||
# ============================================================
|
||
# 颜色和日志
|
||
# ============================================================
|
||
GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; RED='\033[0;31m'; MAGENTA='\033[0;35m'; BOLD='\033[1m'; NC='\033[0m'
|
||
log() { printf "${GREEN}[✓]${NC} %s\n" "$1"; }
|
||
warn() { printf "${YELLOW}[!]${NC} %s\n" "$1"; }
|
||
info() { printf "${CYAN}[i]${NC} %s\n" "$1"; }
|
||
error() { printf "${RED}[✗]${NC} %s\n" "$1"; }
|
||
timing(){ printf " ${CYAN}⏱${NC} %s\n" "$1"; }
|
||
|
||
# 阶段显示函数
|
||
phase_num=0
|
||
phase_start_time=0
|
||
phase() {
|
||
local phase_name="$1"
|
||
phase_num=$((phase_num + 1))
|
||
phase_start_time=$(date +%s)
|
||
echo ""
|
||
printf "${MAGENTA}${BOLD}════════════════════════════════════════════════════════════${NC}\n"
|
||
printf "${MAGENTA}${BOLD} [阶段 ${phase_num}] ${phase_name}${NC}\n"
|
||
printf "${MAGENTA}${BOLD}════════════════════════════════════════════════════════════${NC}\n"
|
||
}
|
||
|
||
phase_done() {
|
||
local end_time=$(date +%s)
|
||
local duration=$((end_time - phase_start_time))
|
||
printf "${GREEN}${BOLD} ✓ 阶段 ${phase_num} 完成 (${duration}s)${NC}\n"
|
||
}
|
||
|
||
phase_fail() {
|
||
local end_time=$(date +%s)
|
||
local duration=$((end_time - phase_start_time))
|
||
printf "${RED}${BOLD} ✗ 阶段 ${phase_num} 失败 (${duration}s)${NC}\n"
|
||
}
|
||
|
||
# ============================================================
|
||
# 检测 macOS 和 Linux sed 差异
|
||
# ============================================================
|
||
is_mac() {
|
||
[[ "$(uname)" == "Darwin" ]]
|
||
}
|
||
|
||
# macOS 的 sed -i 需要空后缀 ''，Linux 不需要
|
||
# sed 原地编辑（处理 macOS BSD sed 与 Linux GNU sed 差异）
|
||
# sed_i: 函数形式，用于直接调用。_sed_i: 变量形式，用于 find -exec（find 只能调用二进制）
|
||
if is_mac; then
|
||
sed_i() { sed -i '' "$@"; }
|
||
_sed_i='sed -i ""'
|
||
else
|
||
sed_i() { sed -i "$@"; }
|
||
_sed_i='sed -i'
|
||
fi
|
||
|
||
# ============================================================
|
||
# 解析参数
|
||
# ============================================================
|
||
FORCE_BUILD=0; ONLY_RESTART=0; INIT_BUILD=0
|
||
while [[ $# -gt 0 ]]; do
|
||
case "$1" in
|
||
--force) FORCE_BUILD=1; info "模式: 强制完整构建"; shift ;;
|
||
--restart) ONLY_RESTART=1; info "模式: 仅重启容器"; shift ;;
|
||
--init) INIT_BUILD=1; info "模式: 初次完整构建"; shift ;;
|
||
*) warn "未知参数: $1"; shift ;;
|
||
esac
|
||
done
|
||
|
||
# ============================================================
|
||
# 部署前合规检查（CLAUDE.md + LESSONS-LEARNED.md）
|
||
# ============================================================
|
||
echo ""
|
||
bash "$(dirname "$0")/check-compliance.sh" || {
|
||
error "合规检查未通过，部署已中止"
|
||
exit 1
|
||
}
|
||
|
||
# ============================================================
|
||
# 选择站点
|
||
# ============================================================
|
||
echo ""
|
||
printf "${CYAN}=========================================${NC}\n"
|
||
printf "${CYAN} 选择要部署的站点 (tlyq.ai)${NC}\n"
|
||
printf "${CYAN}=========================================${NC}\n"
|
||
echo ""
|
||
echo " 1) www.tlyq.ai (图灵引擎官网)"
|
||
echo " 2) cloud.tlyq.ai (图灵智算系统云平台)"
|
||
echo " 3) token.tlyq.ai (Token工厂)"
|
||
echo " 4) issue.tlyq.ai (工单系统)"
|
||
echo " 5) assets.tlyq.ai (资产管理系统)"
|
||
echo " 6) oa.tlyq.ai (OA 统一门户 — 含 nginx 配置)"
|
||
echo " 7) ldap.tlyq.ai (LLDAP 用户目录服务)"
|
||
echo " 8) git.tlyq.ai (Gitea 代码托管)"
|
||
echo " 9) sso.tlyq.ai (Authelia SSO — 统一认证中心)"
|
||
echo " 10) monitor.tlyq.ai (告警监控中心)"
|
||
echo ""
|
||
printf "请输入编号 (1/2/3/4/5/6/7/8/9/10): "
|
||
read -t 30 choice || { echo "超时未输入，退出"; exit 1; }
|
||
|
||
SITE=""; LOCAL_DIR=""; REMOTE_DIR=""; CONTAINER=""
|
||
case "$choice" in
|
||
1) SITE="www"; LOCAL_DIR="/Users/niuniu/programs/docker/www-ai/src"; REMOTE_DIR="/root/docker/www-ai"; CONTAINER="www-ai" ;;
|
||
2) SITE="cloud"; LOCAL_DIR="/Users/niuniu/programs/docker/cloud-ai/html"; REMOTE_DIR="/root/docker/cloud-ai/html" ;;
|
||
3) SITE="token"; LOCAL_DIR="/Users/niuniu/programs/docker/token-ai/html"; REMOTE_DIR="/root/docker/token-ai/html" ;;
|
||
4) SITE="issue"; LOCAL_DIR="/Users/niuniu/programs/docker/issue-ai"; REMOTE_DIR="/root/docker/issue-ai"; CONTAINER="issue-ai" ;;
|
||
5) SITE="assets"; LOCAL_DIR="/Users/niuniu/programs/docker/assets-ai"; REMOTE_DIR="/root/docker/assets-ai"; CONTAINER="assets-ai" ;;
|
||
6) SITE="oa"; LOCAL_DIR="/Users/niuniu/programs/docker/oa-ai"; REMOTE_DIR="/root/docker/oa-ai"; CONTAINER="oa-ai" ;;
|
||
7) SITE="ldap"; LOCAL_DIR="/Users/niuniu/programs/docker/ldap-ai"; REMOTE_DIR="/root/docker/ldap-ai"; CONTAINER="lldap" ;;
|
||
8) SITE="gitea"; LOCAL_DIR="/Users/niuniu/programs/docker/gitea-ai"; REMOTE_DIR="/root/docker/gitea-ai"; CONTAINER="gitea-ai" ;;
|
||
9) SITE="sso"; LOCAL_DIR="/Users/niuniu/programs/docker/sso-ai"; REMOTE_DIR="/root/docker/sso-ai"; CONTAINER="authelia" ;;
|
||
10) SITE="monitor"; LOCAL_DIR="/Users/niuniu/programs/docker/monitor-ai"; REMOTE_DIR="/root/docker/monitor-ai"; CONTAINER="monitor-ai" ;;
|
||
*) echo "无效选择"; exit 1 ;;
|
||
esac
|
||
|
||
echo ""
|
||
log "部署目标: $LOCAL_DIR → $REMOTE_DIR"
|
||
echo ""
|
||
|
||
# ============================================================
|
||
# 链接替换
|
||
# ============================================================
|
||
replace_url() {
|
||
local mode="$1"
|
||
case "$SITE" in
|
||
www)
|
||
cd "$LOCAL_DIR"
|
||
if [[ "$mode" == "prod" ]]; then
|
||
find src -type f -name '*.tsx' -exec $_sed_i \
|
||
-e 's|http://localhost:6174|https://cloud.tlyq.ai|g' \
|
||
-e 's|http://localhost:6175|https://token.tlyq.ai|g' \
|
||
{} + 2>/dev/null || true
|
||
else
|
||
find src -type f -name '*.tsx' -exec $_sed_i \
|
||
-e 's|https://cloud.tlyq.ai|http://localhost:6174|g' \
|
||
-e 's|https://token.tlyq.ai|http://localhost:6175|g' \
|
||
{} + 2>/dev/null || true
|
||
fi ;;
|
||
cloud|token)
|
||
if [[ "$mode" == "prod" ]]; then
|
||
sed_i 's|http://localhost:6173|https://www.tlyq.ai|g' "$LOCAL_DIR/index.html" 2>/dev/null || true
|
||
else
|
||
sed_i 's|https://www.tlyq.ai|http://localhost:6173|g' "$LOCAL_DIR/index.html" 2>/dev/null || true
|
||
fi ;;
|
||
esac
|
||
}
|
||
|
||
# OA 专属 URL 替换（三类：前端导航 / 服务端内部 API / 退出登录）
|
||
replace_oa_urls() {
|
||
local mode="$1" # prod | local
|
||
cd "$LOCAL_DIR"
|
||
if [[ "$mode" == "prod" ]]; then
|
||
# A. 前端导航卡片 → 生产域名
|
||
sed_i \
|
||
-e 's|http://localhost:6177|https://assets.tlyq.ai|g' \
|
||
-e 's|http://localhost:6176|https://issue.tlyq.ai|g' \
|
||
-e 's|http://localhost:6173|https://www.tlyq.ai|g' \
|
||
-e 's|http://localhost:6174|https://cloud.tlyq.ai|g' \
|
||
-e 's|http://localhost:6175|https://token.tlyq.ai|g' \
|
||
src/app/page.tsx
|
||
# B. 服务端内部 API 调用 → Docker 容器名（assets-ai:3000 / issue-ai:3000）
|
||
find src/app/api -name "*.ts" -exec $_sed_i \
|
||
-e "s|'http://localhost:6177'|'http://assets-ai:3000'|g" \
|
||
-e "s|'http://localhost:6176'|'http://issue-ai:3000'|g" \
|
||
-e "s|\`http://localhost:\${site === 'assets' ? 6177 : 6176}\`|\`http://\${site}-ai:3000\`|g" \
|
||
{} +
|
||
# C. 退出登录重定向
|
||
sed_i "s|'http://localhost:6179'|'https://oa.tlyq.ai'|g" src/app/api/auth/logout/route.ts
|
||
else
|
||
# 恢复本地 URL
|
||
sed_i \
|
||
-e 's|https://assets.tlyq.ai|http://localhost:6177|g' \
|
||
-e 's|https://issue.tlyq.ai|http://localhost:6176|g' \
|
||
-e 's|https://www.tlyq.ai|http://localhost:6173|g' \
|
||
-e 's|https://cloud.tlyq.ai|http://localhost:6174|g' \
|
||
-e 's|https://token.tlyq.ai|http://localhost:6175|g' \
|
||
src/app/page.tsx
|
||
find src/app/api -name "*.ts" -exec $_sed_i \
|
||
-e "s|'http://assets-ai:3000'|'http://localhost:6177'|g" \
|
||
-e "s|'http://issue-ai:3000'|'http://localhost:6176'|g" \
|
||
-e "s|\`http://\${site}-ai:3000\`|\`http://localhost:\${site === 'assets' ? 6177 : 6176}\`|g" \
|
||
{} +
|
||
sed_i "s|'https://oa.tlyq.ai'|'http://localhost:6179'|g" src/app/api/auth/logout/route.ts
|
||
fi
|
||
}
|
||
|
||
to_prod() { [[ "$SITE" == "www" || "$SITE" == "cloud" || "$SITE" == "token" ]] && replace_url prod; }
|
||
to_local() { [[ "$SITE" == "www" || "$SITE" == "cloud" || "$SITE" == "token" ]] && replace_url local; }
|
||
# 注意: SIGKILL (kill -9) 无法被 trap 捕获，暴力终止后本地文件可能残留生产 URL
|
||
trap 'to_local; [[ "$SITE" == "oa" ]] && replace_oa_urls local; rm -f /tmp/${SITE}.tar.gz /tmp/shared-deploy.tar.gz' EXIT SIGINT SIGTERM
|
||
[[ "$SITE" == "oa" ]] && replace_oa_urls prod
|
||
to_prod # to_prod() 内部已做 SITE 判断，无需外层条件
|
||
|
||
# ============================================================
|
||
# sso-ai 部署（Docker 容器，无 npm 构建）
|
||
# ============================================================
|
||
deploy_sso() {
|
||
log "部署 sso-ai (Authelia SSO)..."
|
||
|
||
# 1. 上传 docker-compose.yml 和 config/
|
||
log "上传配置文件..."
|
||
scp /Users/niuniu/programs/docker/sso-ai/docker-compose.yml txjp:/root/docker/sso-ai/docker-compose.yml
|
||
# 使用生产配置（configuration.prod.yml → configuration.yml），覆盖前备份
|
||
ssh txjp "cp /root/docker/sso-ai/config/authelia/configuration.yml /root/docker/sso-ai/config/authelia/configuration.yml.\$(date +%Y%m%d_%H%M%S).bak 2>/dev/null || true"
|
||
scp /Users/niuniu/programs/docker/sso-ai/config/authelia/configuration.prod.yml txjp:/root/docker/sso-ai/config/authelia/configuration.yml
|
||
# 确保 TLS 证书存在（首次部署或证书丢失时自动生成）
|
||
ssh txjp "ls /root/docker/sso-ai/config/authelia/certs/cert.pem 2>/dev/null || (mkdir -p /root/docker/sso-ai/config/authelia/certs && openssl req -x509 -newkey rsa:4096 -keyout /root/docker/sso-ai/config/authelia/certs/key.pem -out /root/docker/sso-ai/config/authelia/certs/cert.pem -days 3650 -nodes -subj '/CN=sso.tlyq.ai' 2>/dev/null && echo '已生成自签名证书')"
|
||
# 上传其他 config 文件（如 notifications.yml）
|
||
scp /Users/niuniu/programs/docker/sso-ai/config/authelia/notifications.yml txjp:/root/docker/sso-ai/config/authelia/notifications.yml 2>/dev/null || true
|
||
|
||
# 2. 首次部署：生成密钥
|
||
ssh txjp "if [ ! -f /root/docker/sso-ai/.env ]; then
|
||
echo '首次部署，生成密钥...'
|
||
REDIS_PASSWORD=\$(openssl rand -hex 16)
|
||
AUTHELIA_JWT_SECRET=\$(openssl rand -hex 32)
|
||
AUTHELIA_SESSION_SECRET=\$(openssl rand -hex 32)
|
||
AUTHELIA_STORAGE_ENCRYPTION_KEY=\$(openssl rand -hex 32)
|
||
LLDAP_PASSWORD=\$(docker exec lldap printenv LLDAP_ADMIN_PASSWORD)
|
||
cat > /root/docker/sso-ai/.env << ENVEOF
|
||
REDIS_PASSWORD=\$REDIS_PASSWORD
|
||
AUTHELIA_JWT_SECRET=\$AUTHELIA_JWT_SECRET
|
||
AUTHELIA_SESSION_SECRET=\$AUTHELIA_SESSION_SECRET
|
||
AUTHELIA_STORAGE_ENCRYPTION_KEY=\$AUTHELIA_STORAGE_ENCRYPTION_KEY
|
||
LLDAP_PASSWORD=\$LLDAP_PASSWORD
|
||
ENVEOF
|
||
echo '密钥已生成'
|
||
chmod 600 /root/docker/sso-ai/.env
|
||
else
|
||
echo '已存在 .env，跳过密钥生成'
|
||
chmod 600 /root/docker/sso-ai/.env 2>/dev/null || true
|
||
fi"
|
||
|
||
# 3. 注入占位符真实值（LDAP 密码、JWKS 密钥）
|
||
log "注入 LDAP 密码和 JWKS 密钥..."
|
||
ssh txjp "cd /root/docker/sso-ai && \
|
||
LLDAP_PASSWORD=\$(docker exec lldap printenv LLDAP_ADMIN_PASSWORD) && \
|
||
python3 -c \"import sys; content=open('config/authelia/configuration.yml').read(); content=content.replace('PRODUCTION_LDAP_PASSWORD', sys.argv[1]); open('config/authelia/configuration.yml','w').write(content)\" \"\$LLDAP_PASSWORD\" && \
|
||
# 如果 JWKS key 仍是占位符，从现有配置或生成新密钥
|
||
if grep -q 'OIDC_JWKS_KEY_PLACEHOLDER' config/authelia/configuration.yml; then
|
||
EXISTING_KEY=\$(cat /root/docker/sso-ai/config/authelia/configuration.yml.bak 2>/dev/null | sed -n '/key: |/,/-----END/{p}' || true)
|
||
if [ -n \"\$EXISTING_KEY\" ]; then
|
||
echo '从备份恢复 JWKS 密钥'
|
||
# 使用 python 替换多行占位符（sed 不便处理）
|
||
python3 -c \"
|
||
import sys
|
||
content = open('config/authelia/configuration.yml').read()
|
||
key = '''\$EXISTING_KEY'''
|
||
content = content.replace('OIDC_JWKS_KEY_PLACEHOLDER', key.strip())
|
||
open('config/authelia/configuration.yml', 'w').write(content)
|
||
\" 2>/dev/null || true
|
||
else
|
||
echo '警告: JWKS 密钥为占位符，需要手动配置'
|
||
fi
|
||
fi && \
|
||
# 检查 OIDC client_secret 占位符
|
||
if grep -q 'OIDC_.*_SECRET_HASH' config/authelia/configuration.yml; then
|
||
echo '警告: 存在 OIDC client_secret 占位符，需要手动替换'
|
||
grep 'OIDC_.*_SECRET_HASH' config/authelia/configuration.yml || true
|
||
fi"
|
||
|
||
# 4. 部署 nginx sso-ai.conf
|
||
log "部署 nginx 配置..."
|
||
scp /Users/niuniu/programs/docker/nginx-proxy-ai/conf.d/sso-ai.conf txjp:/root/docker/nginx-proxy-ai/conf.d/sso-ai.conf
|
||
|
||
# 5. 仅启动 authelia（redis 和 lldap 为独立容器，不通过本 compose 管理）
|
||
log "启动 Authelia..."
|
||
ssh txjp "cd /root/docker/sso-ai && docker compose up -d --no-deps authelia"
|
||
|
||
# 6. 验证
|
||
sleep 5
|
||
ssh txjp "curl -sk https://127.0.0.1:9091/api/health" && log "Authelia 健康检查通过" || warn "Authelia 可能未就绪"
|
||
|
||
# 6.1 检查 OIDC token_endpoint_auth_method 是否匹配（LESSONS-LEARNED #48）
|
||
sleep 3
|
||
if ssh txjp "docker logs authelia --since 30s 2>&1 | grep -q 'Client authentication failed.*token_endpoint_auth_method'"; then
|
||
warn "检测到 OIDC token_endpoint_auth_method 不匹配！检查 Authelia configuration.yml 中所有 client 是否设置了 token_endpoint_auth_method: 'client_secret_post'"
|
||
ssh txjp "docker logs authelia --since 30s 2>&1 | grep 'Client authentication failed' | tail -3"
|
||
else
|
||
log "OIDC token_endpoint_auth_method 一致性检查通过"
|
||
fi
|
||
|
||
# 7. 重载 nginx
|
||
ssh txjp "docker exec nginx-ai nginx -t && docker exec nginx-ai nginx -s reload" && log "nginx 已重载" || warn "nginx 重载失败"
|
||
|
||
log "sso-ai 部署完成"
|
||
}
|
||
|
||
# ============================================================
|
||
# 核心构建函数（服务器上直接 npm run build）
|
||
# ============================================================
|
||
SNAPSHOT_DIR="/root/docker/.snapshots"
|
||
SNAPSHOT_FILE="${SNAPSHOT_DIR}/.snapshot.${SITE}.md5"
|
||
BUILD_START=$(date +%s)
|
||
|
||
# ============================================================
|
||
# 同步 shared 共享库（快照比对，无变化跳过）
|
||
# ============================================================
|
||
SHARED_SNAPSHOT="${SNAPSHOT_DIR}/.snapshot.shared.md5"
|
||
SHARED_LOCAL="/Users/niuniu/programs/docker/shared"
|
||
SHARED_REMOTE="/root/docker/shared"
|
||
|
||
sync_shared() {
|
||
# 统一管理 /root/docker/shared/，各站点通过 shared -> ../shared 符号链接自动解析
|
||
|
||
info "检查 shared 共享库..."
|
||
local local_md5
|
||
if is_mac; then
|
||
local_md5=$(find "$SHARED_LOCAL" \
|
||
-not -path '*/node_modules/*' \
|
||
-not -path '*/.git/*' \
|
||
-not -name '._*' -not -name '.DS_Store' \
|
||
-type f \
|
||
-exec md5 -q {} \; 2>/dev/null \
|
||
| sort \
|
||
| md5 -q)
|
||
else
|
||
local_md5=$(find "$SHARED_LOCAL" \
|
||
-not -path '*/node_modules/*' \
|
||
-not -path '*/.git/*' \
|
||
-not -name '._*' -not -name '.DS_Store' \
|
||
-type f \
|
||
-exec md5sum {} \; 2>/dev/null \
|
||
| sed 's/ .*//' \
|
||
| sort \
|
||
| md5sum | cut -d' ' -f1)
|
||
fi
|
||
|
||
local prev_md5
|
||
prev_md5=$(ssh txjp "cat ${SHARED_SNAPSHOT} 2>/dev/null" 2>/dev/null || echo "")
|
||
|
||
if [[ "$prev_md5" == "$local_md5" ]]; then
|
||
# shared 无变化，仅确保目录存在（防止首次部署或手动清理后死链接）
|
||
ssh txjp "test -d ${SHARED_REMOTE}/lib || (mkdir -p ${SHARED_REMOTE} && echo 'shared 目录异常但快照存在，已恢复空目录')" 2>/dev/null
|
||
return 0
|
||
fi
|
||
|
||
if [[ -z "$prev_md5" ]]; then
|
||
info "shared 首次部署，上传..."
|
||
else
|
||
info "shared 有变化，上传..."
|
||
fi
|
||
|
||
COPYFILE_DISABLE=1 tar czf /tmp/shared-deploy.tar.gz -C /Users/niuniu/programs/docker \
|
||
--exclude='node_modules' --exclude='.git' --exclude='._*' shared/ 2>/dev/null || {
|
||
error "shared 打包失败"
|
||
return 1
|
||
}
|
||
scp /tmp/shared-deploy.tar.gz txjp:/tmp/shared-deploy.tar.gz || {
|
||
error "shared 上传失败"
|
||
return 1
|
||
}
|
||
# 先解压到临时目录，成功后再替换（避免先删后建时解压失败导致 shared 丢失）
|
||
ssh txjp "rm -rf /tmp/shared_tmp && mkdir -p /tmp/shared_tmp && \
|
||
tar xzf /tmp/shared-deploy.tar.gz -C /tmp/shared_tmp && \
|
||
rm -rf ${SHARED_REMOTE} && mkdir -p ${SHARED_REMOTE} && \
|
||
mv /tmp/shared_tmp/shared/* ${SHARED_REMOTE}/ && \
|
||
rm -rf /tmp/shared_tmp && \
|
||
echo '${local_md5}' > ${SHARED_SNAPSHOT}" || {
|
||
error "shared 远端解压或替换失败"
|
||
return 1
|
||
}
|
||
log "shared 已同步到 ${SHARED_REMOTE}"
|
||
# 安装 shared 自身依赖（如 ldapts），确保各站点构建时能正确解析
|
||
ssh txjp "cd ${SHARED_REMOTE} && [ -f package.json ] && npm install --prefer-offline 2>&1 | tail -3" || warn "shared 依赖安装失败，部分站点可能构建异常"
|
||
}
|
||
|
||
# JWT_SECRET 一致性检查（所有 .tlyq.ai 子站点必须共用同一个密钥）
|
||
# 从共享文件读取权威值，校验站点 .env，不一致时自动修正
|
||
check_jwt_secret_consistency() {
|
||
local remote_dir="$1"
|
||
local jwt_secret
|
||
jwt_secret=$(ssh txjp "cat /root/docker/.shared_jwt_secret 2>/dev/null" 2>/dev/null || echo "")
|
||
if [[ -z "$jwt_secret" ]]; then
|
||
jwt_secret=$(openssl rand -hex 32)
|
||
ssh txjp "cat > /root/docker/.shared_jwt_secret && chmod 600 /root/docker/.shared_jwt_secret" << EOF
|
||
${jwt_secret}
|
||
EOF
|
||
info "已生成共享 JWT_SECRET（所有站点共用）"
|
||
fi
|
||
local current_jwt
|
||
current_jwt=$(ssh txjp "grep '^JWT_SECRET=' ${remote_dir}/.env 2>/dev/null | cut -d= -f2" 2>/dev/null || echo "")
|
||
if [[ -z "$current_jwt" ]]; then
|
||
ssh txjp "cat >> ${remote_dir}/.env" << EOF
|
||
JWT_SECRET=${jwt_secret}
|
||
EOF
|
||
info "已为站点写入 JWT_SECRET"
|
||
elif [[ "$current_jwt" != "$jwt_secret" ]]; then
|
||
warn "检测到 JWT_SECRET 与共享密钥不一致，已自动修正"
|
||
ssh txjp "sed -i '/^JWT_SECRET=/d' ${remote_dir}/.env"
|
||
ssh txjp "cat >> ${remote_dir}/.env" << EOF
|
||
JWT_SECRET=${jwt_secret}
|
||
EOF
|
||
fi
|
||
}
|
||
|
||
build_on_server() {
|
||
local extra_env="${1:-}"
|
||
|
||
# 0. 同步 shared 共享库（所有使用 @shared 的站点自动受益）
|
||
sync_shared
|
||
# 确保 shared 自身依赖已安装（如 ldapts），否则站点构建时模块解析失败
|
||
ssh txjp "cd ${SHARED_REMOTE} && [ -f package.json ] && [ ! -d node_modules ] && npm install --prefer-offline 2>&1 | tail -3 || true" 2>/dev/null
|
||
|
||
# 1. 计算源码快照（含 shared，确保 shared 变化也触发重构建）
|
||
log "检查源码是否有变化..."
|
||
# 平台兼容：macOS md5 -q / Linux md5sum
|
||
FIND_EXCLUDE="-not -path '*/node_modules/*' -not -path '*/.next/*' -not -path '*/out/*' -not -path '*/data/*' -not -path '*/reports/*' -not -path '*/docs/*' -not -path '*/.env.local' -not -path '*/.env.development' -not -path '*/.env.production' -not -path '*/.git/*' -not -name '._*' -not -name '.DS_Store'"
|
||
if is_mac; then
|
||
local_md5=$( (find "$LOCAL_DIR" $FIND_EXCLUDE -type f -exec md5 -q {} \; ; \
|
||
find "$SHARED_LOCAL" -not -path '*/node_modules/*' -not -path '*/.git/*' -not -name '._*' -not -name '.DS_Store' -type f -exec md5 -q {} \; 2>/dev/null) \
|
||
| sort | md5 -q)
|
||
else
|
||
local_md5=$( (find "$LOCAL_DIR" $FIND_EXCLUDE -type f -exec md5sum {} \; ; \
|
||
find "$SHARED_LOCAL" -not -path '*/node_modules/*' -not -path '*/.git/*' -not -name '._*' -not -name '.DS_Store' -type f -exec md5sum {} \; 2>/dev/null) \
|
||
| sed 's/ .*//' | sort | md5sum | cut -d' ' -f1)
|
||
fi
|
||
echo " 源码快照: ${local_md5}"
|
||
|
||
prev_md5=$(ssh txjp "cat ${SNAPSHOT_FILE} 2>/dev/null" 2>/dev/null || echo "")
|
||
|
||
if [[ "$FORCE_BUILD" == "1" || "$INIT_BUILD" == "1" ]]; then
|
||
info "强制构建模式"
|
||
MODE="force"
|
||
elif [[ -z "$prev_md5" ]]; then
|
||
info "首次部署，执行完整构建"
|
||
MODE="init"
|
||
elif [[ "$prev_md5" == "$local_md5" ]]; then
|
||
info "源码无变化，跳过构建，仅重启容器"
|
||
MODE="skip"
|
||
else
|
||
info "检测到源码变化，执行增量构建"
|
||
MODE="update"
|
||
fi
|
||
|
||
if [[ "$ONLY_RESTART" == "1" ]]; then
|
||
MODE="restart"
|
||
info "强制重建容器，跳过构建"
|
||
ssh txjp "cd $REMOTE_DIR && docker compose down && docker compose up -d"
|
||
return 0
|
||
fi
|
||
|
||
if [[ "$MODE" == "skip" || "$MODE" == "restart" ]]; then
|
||
ssh txjp "cd $REMOTE_DIR && docker compose down && docker compose up -d"
|
||
log "容器已重启"
|
||
return 0
|
||
fi
|
||
|
||
# 2. 打包源码（不含 node_modules）
|
||
log "打包源码..."
|
||
pack_start=$(date +%s)
|
||
COPYFILE_DISABLE=1 tar czf /tmp/${SITE}.tar.gz -C "$LOCAL_DIR" \
|
||
--exclude='node_modules' --exclude='.next' --exclude='out' \
|
||
--exclude='data' --exclude='./reports/*.docx' --exclude='docs' \
|
||
--exclude='.env' --exclude='.env.local' --exclude='.env.development' --exclude='.env.production' \
|
||
--exclude='.git' --exclude='._*' --exclude='shared' . || {
|
||
error "打包失败"
|
||
return 1
|
||
}
|
||
pack_end=$(date +%s)
|
||
pack_dur=$((pack_end - pack_start))
|
||
local pkg_size
|
||
pkg_size=$(du -h /tmp/${SITE}.tar.gz 2>/dev/null | cut -f1 || echo "未知")
|
||
timing "打包耗时: ${pack_dur}s (${pkg_size})"
|
||
|
||
# 3. 上传
|
||
log "上传源码包..."
|
||
scp /tmp/${SITE}.tar.gz txjp:/tmp/${SITE}.tar.gz || {
|
||
error "上传失败"
|
||
return 1
|
||
}
|
||
|
||
# 4. 解压源码到 /tmp（独立于目标目录，避免 rsync --delete 误删源文件）
|
||
log "解压源码并准备依赖..."
|
||
ssh txjp "\
|
||
rm -rf /tmp/deploy_${SITE} && mkdir -p /tmp/deploy_${SITE} && \
|
||
tar xzf /tmp/${SITE}.tar.gz -C /tmp/deploy_${SITE} 2>/dev/null || true && \
|
||
rsync -a --delete \
|
||
--exclude='node_modules' --exclude='.next' --exclude='data' --exclude='/reports/*.docx' --exclude='docs' \
|
||
--exclude='.env' --exclude='.env.local' --exclude='.env.development' --exclude='.env.production' \
|
||
--exclude='._*' --exclude='shared' \
|
||
/tmp/deploy_${SITE}/ ${REMOTE_DIR}/ && \
|
||
rm -rf /tmp/deploy_${SITE}"
|
||
|
||
# 确保 shared 符号链接正确（打包时已排除，需要重新创建）
|
||
ssh txjp "cd $REMOTE_DIR && if [ ! -L shared ]; then
|
||
rm -rf shared 2>/dev/null || true
|
||
ln -s ../shared shared
|
||
echo 'shared 符号链接已创建'
|
||
fi"
|
||
|
||
# 首次：上传 docker-compose.yml（新增 .next 卷挂载），重启容器应用
|
||
ssh txjp "cd $REMOTE_DIR && docker compose up -d"
|
||
|
||
# 如果 host 上没有 node_modules，从容器内复制一份
|
||
ssh txjp "if [ ! -d '${REMOTE_DIR}/node_modules' ]; then
|
||
echo ' 首次：复制容器内 node_modules 到主机...'
|
||
docker cp ${CONTAINER}:/app/node_modules ${REMOTE_DIR}/node_modules
|
||
echo ' 完成'
|
||
fi"
|
||
|
||
# 安装可能新增的依赖（已有依赖走缓存，很快）
|
||
log "安装新增依赖..."
|
||
ssh txjp "cd ${REMOTE_DIR} && npm install --prefer-offline 2>&1 | tail -5" || {
|
||
error "npm install 失败"
|
||
return 1
|
||
}
|
||
|
||
if [[ -n "$extra_env" ]]; then
|
||
ssh txjp "sed -i 's|ASSETS_API_URL=.*|ASSETS_API_URL=${extra_env}|' $REMOTE_DIR/.env 2>/dev/null \
|
||
|| echo 'ASSETS_API_URL=${extra_env}' >> $REMOTE_DIR/.env"
|
||
fi
|
||
|
||
# assets 站点需要 NEXT_PUBLIC_ISSUE_URL（构建时内嵌到 JS bundle）和 ISSUE_API_URL（运行时，容器内网地址）
|
||
if [[ "$SITE" == "assets" ]]; then
|
||
ssh txjp "grep -q 'NEXT_PUBLIC_ISSUE_URL' $REMOTE_DIR/.env 2>/dev/null \
|
||
&& sed -i 's|NEXT_PUBLIC_ISSUE_URL=.*|NEXT_PUBLIC_ISSUE_URL=https://issue.tlyq.ai/tickets|' $REMOTE_DIR/.env 2>/dev/null \
|
||
|| echo 'NEXT_PUBLIC_ISSUE_URL=https://issue.tlyq.ai/tickets' >> $REMOTE_DIR/.env"
|
||
ssh txjp "grep -q 'ISSUE_API_URL' $REMOTE_DIR/.env 2>/dev/null \
|
||
&& sed -i 's|ISSUE_API_URL=.*|ISSUE_API_URL=http://issue-ai:3000/api|' $REMOTE_DIR/.env 2>/dev/null \
|
||
|| echo 'ISSUE_API_URL=http://issue-ai:3000/api' >> $REMOTE_DIR/.env"
|
||
fi
|
||
|
||
# issue 站点需要 NEXT_PUBLIC_ASSETS_URL（构建时内嵌到 JS bundle）
|
||
if [[ "$SITE" == "issue" ]]; then
|
||
ssh txjp "grep -q 'NEXT_PUBLIC_ASSETS_URL' $REMOTE_DIR/.env 2>/dev/null \
|
||
&& sed -i 's|NEXT_PUBLIC_ASSETS_URL=.*|NEXT_PUBLIC_ASSETS_URL=https://assets.tlyq.ai|' $REMOTE_DIR/.env 2>/dev/null \
|
||
|| echo 'NEXT_PUBLIC_ASSETS_URL=https://assets.tlyq.ai' >> $REMOTE_DIR/.env"
|
||
fi
|
||
|
||
# 确保 AUTHELIA_URL 已设置（仅对使用 OIDC 的站点）
|
||
if [[ "$SITE" == "oa" || "$SITE" == "assets" || "$SITE" == "issue" || "$SITE" == "monitor" ]]; then
|
||
ssh txjp "grep -q 'AUTHELIA_URL' $REMOTE_DIR/.env 2>/dev/null \
|
||
&& sed -i 's|AUTHELIA_URL=.*|AUTHELIA_URL=https://sso.tlyq.ai|' $REMOTE_DIR/.env 2>/dev/null \
|
||
|| echo 'AUTHELIA_URL=https://sso.tlyq.ai' >> $REMOTE_DIR/.env"
|
||
fi
|
||
|
||
# OIDC 环境变量配置（oa/assets/issue/monitor 站点）
|
||
if [[ "$SITE" == "oa" || "$SITE" == "assets" || "$SITE" == "issue" || "$SITE" == "monitor" ]]; then
|
||
# 根据站点设置 OIDC 变量
|
||
case "$SITE" in
|
||
oa) OIDC_ID="oa-oidc"; OIDC_URI="https://oa.tlyq.ai/api/auth/callback" ;;
|
||
assets) OIDC_ID="assets-oidc"; OIDC_URI="https://assets.tlyq.ai/api/auth/callback" ;;
|
||
issue) OIDC_ID="issue-oidc"; OIDC_URI="https://issue.tlyq.ai/api/auth/callback" ;;
|
||
monitor) OIDC_ID="monitor-oidc"; OIDC_URI="https://monitor.tlyq.ai/api/auth/callback" ;;
|
||
esac
|
||
|
||
# 确保 OIDC_CLIENT_ID 已设置
|
||
ssh txjp "grep -q 'OIDC_CLIENT_ID' $REMOTE_DIR/.env 2>/dev/null \
|
||
&& sed -i 's|OIDC_CLIENT_ID=.*|OIDC_CLIENT_ID=${OIDC_ID}|' $REMOTE_DIR/.env 2>/dev/null \
|
||
|| echo 'OIDC_CLIENT_ID=${OIDC_ID}' >> $REMOTE_DIR/.env"
|
||
|
||
# 确保 OIDC_REDIRECT_URI 已设置
|
||
ssh txjp "grep -q 'OIDC_REDIRECT_URI' $REMOTE_DIR/.env 2>/dev/null \
|
||
&& sed -i 's|OIDC_REDIRECT_URI=.*|OIDC_REDIRECT_URI=${OIDC_URI}|' $REMOTE_DIR/.env 2>/dev/null \
|
||
|| echo 'OIDC_REDIRECT_URI=${OIDC_URI}' >> $REMOTE_DIR/.env"
|
||
|
||
# 确保 OIDC_CLIENT_SECRET 已设置（从 Authelia 配置读取）
|
||
if ! ssh txjp "grep -q 'OIDC_CLIENT_SECRET' $REMOTE_DIR/.env 2>/dev/null"; then
|
||
warn "OIDC_CLIENT_SECRET 未设置，请手动配置"
|
||
fi
|
||
fi
|
||
|
||
# 使用 .env.prod 模板补充缺失的环境变量
|
||
ENV_PROD="$LOCAL_DIR/config/.env.prod"
|
||
if [[ -f "$ENV_PROD" ]]; then
|
||
info "使用 .env.prod 模板补充缺失变量..."
|
||
# 上传模板到服务器临时目录
|
||
scp "$ENV_PROD" txjp:/tmp/.env.prod.template
|
||
# 逐行检查：模板中有但 .env 中没有的变量，追加到 .env
|
||
ssh txjp "while IFS= read -r line; do
|
||
# 跳过注释和空行
|
||
[[ \"\$line\" =~ ^#.*$ ]] && continue
|
||
[[ -z \"\$line\" ]] && continue
|
||
# 提取变量名
|
||
varname=\"\$(echo \"\$line\" | cut -d= -f1)\"
|
||
# 如果 .env 中没有此变量，追加（跳过占位符值）
|
||
if ! grep -q \"^\${varname}=\" $REMOTE_DIR/.env 2>/dev/null; then
|
||
# 跳过 __PLACEHOLDER__ 格式的值（需要真实密钥）
|
||
if [[ ! \"\$line\" =~ __.*__ ]]; then
|
||
echo \"\$line\" >> $REMOTE_DIR/.env
|
||
fi
|
||
fi
|
||
done < /tmp/.env.prod.template && rm -f /tmp/.env.prod.template"
|
||
fi
|
||
|
||
# 自动生成缺失的密钥（首次部署场景）
|
||
# 先确保 .env 文件存在且权限为 600（防止后续写入期间权限暴露）
|
||
ssh txjp "touch $REMOTE_DIR/.env && chmod 600 $REMOTE_DIR/.env" 2>/dev/null
|
||
|
||
# JWT_SECRET 一致性检查（所有 .tlyq.ai 子站点必须共用同一个密钥）
|
||
check_jwt_secret_consistency "$REMOTE_DIR"
|
||
# OIDC_CLIENT_SECRET：从服务器现有 .env 读取（Authelia 配置存储的是 bcrypt 哈希，不可逆用）
|
||
# 全程在服务器侧执行，避免 secret 跨 SSH 边界传输
|
||
if [[ "$SITE" == "oa" || "$SITE" == "assets" || "$SITE" == "issue" || "$SITE" == "monitor" ]]; then
|
||
if ! ssh txjp "grep -q '^OIDC_CLIENT_SECRET=' $REMOTE_DIR/.env 2>/dev/null"; then
|
||
ssh txjp "
|
||
found=0
|
||
for d in oa-ai assets-ai issue-ai monitor-ai; do
|
||
if [ \"\$d\" != \"${SITE}-ai\" ] && [ -f /root/docker/\$d/.env ]; then
|
||
val=\$(grep '^OIDC_CLIENT_SECRET=' /root/docker/\$d/.env 2>/dev/null | head -1 | cut -d= -f2)
|
||
if [ -n \"\$val\" ] && [ \"\$val\" != *SECRET_HASH* ] && [ \"\$val\" != *PLACEHOLDER* ] && ! echo \"\$val\" | grep -q '^__.*__\$'; then
|
||
echo \"OIDC_CLIENT_SECRET=\$val\" >> $REMOTE_DIR/.env
|
||
found=1
|
||
break
|
||
fi
|
||
fi
|
||
done
|
||
if [ \$found -eq 0 ]; then
|
||
echo 'ERROR: OIDC_CLIENT_SECRET 未设置且无法从其他站点获取，请手动配置后重新部署' >&2
|
||
exit 1
|
||
fi
|
||
" && info "已从其他站点复用 OIDC_CLIENT_SECRET" || {
|
||
error "OIDC_CLIENT_SECRET 未设置且无法从其他站点获取，请手动配置后重新部署"
|
||
return 1
|
||
}
|
||
fi
|
||
fi
|
||
# LOCALADMIN_PASSWORD：monitor 专属
|
||
if [[ "$SITE" == "monitor" ]]; then
|
||
if ! ssh txjp "grep -q '^LOCALADMIN_PASSWORD=' $REMOTE_DIR/.env 2>/dev/null"; then
|
||
LOCALADMIN_GEN=$(openssl rand -hex 16)
|
||
ssh txjp "cat >> $REMOTE_DIR/.env" << EOF
|
||
LOCALADMIN_PASSWORD=${LOCALADMIN_GEN}
|
||
EOF
|
||
info "已自动生成 LOCALADMIN_PASSWORD"
|
||
fi
|
||
fi
|
||
|
||
# INTERNAL_API_KEY：所有 .tlyq.ai 子站点必须共用同一个密钥
|
||
if ! ssh txjp "grep -q '^INTERNAL_API_KEY=' $REMOTE_DIR/.env 2>/dev/null"; then
|
||
local shared_key
|
||
shared_key=$(ssh txjp "cat /root/docker/.shared_internal_key 2>/dev/null" 2>/dev/null || echo "")
|
||
if [[ -z "$shared_key" ]]; then
|
||
shared_key=$(openssl rand -hex 16)
|
||
ssh txjp "cat > /root/docker/.shared_internal_key" << EOF
|
||
${shared_key}
|
||
EOF
|
||
info "已生成共享 INTERNAL_API_KEY"
|
||
fi
|
||
ssh txjp "cat >> $REMOTE_DIR/.env" << EOF
|
||
INTERNAL_API_KEY=${shared_key}
|
||
EOF
|
||
info "已为站点写入 INTERNAL_API_KEY"
|
||
fi
|
||
|
||
# 清理可能被上传的本地环境变量文件（.env.local 等会覆盖 .env 中的生产配置）
|
||
ssh txjp "rm -f $REMOTE_DIR/.env.local $REMOTE_DIR/.env.development $REMOTE_DIR/.env.production 2>/dev/null; echo '已清理本地环境文件'"
|
||
|
||
# 设置 .env 文件权限为 600（仅 root 可读写，防止密码泄露）
|
||
ssh txjp "chmod 600 $REMOTE_DIR/.env 2>/dev/null || true"
|
||
|
||
# 5. 检查宿主机与容器 node 版本一致性（防止 native 模块 ABI 不兼容）
|
||
HOST_NODE_VER=$(ssh txjp "node -v 2>/dev/null | cut -d. -f1 | tr -d 'v'" 2>/dev/null || echo "0")
|
||
if [[ "$HOST_NODE_VER" != "" && "$HOST_NODE_VER" != "20" ]]; then
|
||
warn "宿主机 node 版本 (v${HOST_NODE_VER}) 与容器内 node:20-alpine 不一致，native 模块（如 bcrypt）可能出现 ABI 不兼容"
|
||
fi
|
||
|
||
# 6. 服务器上直接 npm run build（不重建 Docker）
|
||
log "服务器上执行 npm run build..."
|
||
build_start=$(date +%s)
|
||
# 使用 tee 避免管道导致退出码丢失，并过滤无用输出
|
||
ssh txjp "cd ${REMOTE_DIR} && npm run build 2>&1" | \
|
||
grep -vE "^(info|warn|npm warn|audited|packages|funding|vulnerability|npm notice|New major)" | \
|
||
tail -50
|
||
build_exit_code=${PIPESTATUS[0]} # PIPESTATUS 为 bash 内建变量，脚本已声明 #!/usr/bin/env bash
|
||
build_end=$(date +%s)
|
||
build_dur=$((build_end - build_start))
|
||
timing "构建耗时: ${build_dur}s"
|
||
|
||
if [[ "$build_exit_code" -ne 0 ]]; then
|
||
error "构建失败（退出码: $build_exit_code），中止部署"
|
||
return 1
|
||
fi
|
||
|
||
# 构建新鲜度检查（自动检测 Node.js standalone 部署）
|
||
if ssh txjp "test -f $REMOTE_DIR/.next/standalone/server.js" 2>/dev/null; then
|
||
BUILD_MTIME=$(ssh txjp "stat -c %Y $REMOTE_DIR/.next/standalone/server.js" 2>/dev/null || echo 0)
|
||
SRC_MTIME=$(ssh txjp "find $REMOTE_DIR/src -type f \( -name '*.ts' -o -name '*.tsx' \) -exec stat -c %Y {} + 2>/dev/null | sort -rn | head -1" 2>/dev/null || echo 0)
|
||
if [ "$BUILD_MTIME" -lt "$SRC_MTIME" ] 2>/dev/null; then
|
||
warn "构建产物旧于源码！请确保 npm run build 已重新执行"
|
||
else
|
||
info "构建新鲜度检查通过"
|
||
fi
|
||
fi
|
||
|
||
# 静态导出站点（www）：next build 产出 out/，移至 html/ 供 nginx 托管
|
||
if [[ "$SITE" == "www" ]]; then
|
||
ssh txjp "cd ${REMOTE_DIR} && rm -rf html && mv out html 2>/dev/null" || {
|
||
error "静态导出目录迁移失败（out/ → html/）"
|
||
return 1
|
||
}
|
||
info "静态导出已迁移至 html/"
|
||
fi
|
||
|
||
# 清理 standalone 中的 musl 原生模块（Alpine builder 残留，Debian runner 不兼容）
|
||
if [[ "$SITE" == "www" || "$SITE" == "issue" || "$SITE" == "assets" || "$SITE" == "oa" || "$SITE" == "monitor" ]]; then
|
||
ssh txjp "rm -rf $REMOTE_DIR/.next/standalone/node_modules/@img/sharp-linuxmusl-x64 \
|
||
$REMOTE_DIR/.next/standalone/node_modules/@img/sharp-libvips-linuxmusl-x64 \
|
||
$REMOTE_DIR/.next/standalone/node_modules/@next/swc-linux-x64-musl 2>/dev/null; echo '已清理 musl 残留'"
|
||
fi
|
||
|
||
# 6. 同步 docker-compose.yml（确保服务器 compose 与本地一致）
|
||
local compose_src="$(echo "$LOCAL_DIR" | sed 's|/src$||')"
|
||
scp "$compose_src/docker-compose.yml" "txjp:$REMOTE_DIR/docker-compose.yml" 2>/dev/null || warn "docker-compose.yml 上传失败"
|
||
|
||
# 7. 重建容器（应用 .next 卷挂载；若存在 Dockerfile 则 --build 确保原生模块兼容；
|
||
# 无论有无 Dockerfile，restart 确保 Next.js 进程重新加载 .next）
|
||
log "重建容器..."
|
||
local build_flag=""
|
||
if ssh txjp "test -f $REMOTE_DIR/Dockerfile" 2>/dev/null; then
|
||
build_flag="--build"
|
||
else
|
||
info "无 Dockerfile，跳过镜像重建"
|
||
fi
|
||
|
||
# Docker 无法跟随指向构建上下文外的符号链接，临时将 shared 符号链接替换为实际目录
|
||
ssh txjp "cd $REMOTE_DIR && if [ -L shared ]; then
|
||
target=\$(readlink shared)
|
||
cp -r \$target shared_tmp && rm shared && mv shared_tmp shared && \
|
||
echo 'shared 符号链接已临时替换为实际目录' || \
|
||
{ echo '错误: shared 符号链接替换失败'; exit 1; }
|
||
fi" || {
|
||
error "shared 符号链接替换失败，中止部署"
|
||
return 1
|
||
}
|
||
|
||
ssh txjp "cd $REMOTE_DIR && docker compose up -d $build_flag && docker compose restart"
|
||
|
||
# 恢复 shared 符号链接（仅当目录非符号链接且上级 shared 存在时）
|
||
ssh txjp "cd $REMOTE_DIR && if [ -d shared ] && [ ! -L shared ] && [ -d ../shared ]; then
|
||
rm -rf shared
|
||
ln -s ../shared shared
|
||
echo 'shared 符号链接已恢复'
|
||
fi"
|
||
|
||
# 7. 清理构建产生的悬空镜像和缓存（调用独立清理脚本）
|
||
log "清理构建缓存..."
|
||
bash "${SCRIPT_DIR}/docker-cache-cleanup.sh" --default
|
||
|
||
# 8. 保存快照
|
||
ssh txjp "mkdir -p ${SNAPSHOT_DIR} && echo '$local_md5' > ${SNAPSHOT_FILE}"
|
||
|
||
# 9. 清理远程临时文件（源码包、连通性检查脚本）
|
||
ssh txjp "rm -f /tmp/${SITE}.tar.gz /tmp/shared-deploy.tar.gz /tmp/check-conn.js /tmp/.env.prod.template 2>/dev/null || true"
|
||
}
|
||
|
||
# ============================================================
|
||
# 执行部署
|
||
# ============================================================
|
||
echo ""
|
||
printf "${BOLD}${CYAN}=========================================${NC}\n"
|
||
printf "${BOLD}${CYAN} 开始部署: ${SITE}.tlyq.ai${NC}\n"
|
||
printf "${BOLD}${CYAN}=========================================${NC}\n"
|
||
DEPLOY_START=$(date +%s)
|
||
case "$SITE" in
|
||
www)
|
||
phase "打包配置文件"
|
||
scp /Users/niuniu/programs/docker/www-ai/docker-compose.yml txjp:$REMOTE_DIR/docker-compose.yml
|
||
scp /Users/niuniu/programs/docker/www-ai/nginx.conf txjp:$REMOTE_DIR/nginx.conf
|
||
phase_done
|
||
|
||
phase "构建与部署"
|
||
build_on_server || { phase_fail; exit 1; }
|
||
phase_done ;;
|
||
cloud)
|
||
phase "上传静态文件"
|
||
info "上传 index.html..."
|
||
scp "$LOCAL_DIR"/index.html txjp:$REMOTE_DIR/index.html || { error "cloud index.html 上传失败"; phase_fail; exit 1; }
|
||
scp "$LOCAL_DIR"/nginx.conf txjp:$REMOTE_DIR/nginx.conf 2>/dev/null || true
|
||
scp /Users/niuniu/programs/docker/cloud-ai/docker-compose.yml txjp:$REMOTE_DIR/docker-compose.yml 2>/dev/null || true
|
||
phase_done
|
||
|
||
phase "重启容器"
|
||
ssh txjp "docker restart ${SITE}-ai"
|
||
phase_done ;;
|
||
token)
|
||
phase "上传静态文件"
|
||
info "上传 index.html..."
|
||
scp "$LOCAL_DIR"/index.html txjp:$REMOTE_DIR/index.html || { error "token index.html 上传失败"; phase_fail; exit 1; }
|
||
scp "$LOCAL_DIR"/nginx.conf txjp:$REMOTE_DIR/nginx.conf 2>/dev/null || true
|
||
scp /Users/niuniu/programs/docker/token-ai/docker-compose.yml txjp:$REMOTE_DIR/docker-compose.yml 2>/dev/null || true
|
||
phase_done
|
||
|
||
phase "重启容器"
|
||
ssh txjp "docker restart ${SITE}-ai"
|
||
phase_done ;;
|
||
issue)
|
||
phase "构建与部署"
|
||
build_on_server "http://assets-ai:3000/api" || { phase_fail; exit 1; }
|
||
phase_done
|
||
|
||
phase "部署 nginx 路由"
|
||
ssh txjp "cp $REMOTE_DIR/../nginx-proxy-ai/conf.d/issue-ai.conf /root/docker/nginx-proxy-ai/conf.d/ 2>/dev/null || true
|
||
docker exec nginx-ai nginx -t && docker exec nginx-ai nginx -s reload"
|
||
phase_done
|
||
|
||
# 验证 issue→assets API 连通性（带重试，应对同时部署时目标容器暂不可达）
|
||
phase "检查 API 连通性"
|
||
info "检查 issue→assets API 连通性..."
|
||
ssh txjp 'cat > /tmp/check-conn.js' << 'CHECKEOF'
|
||
const http = require("http");
|
||
const url = process.env.ASSETS_API_URL + "/assets?pageSize=1";
|
||
const key = process.env.ASSETS_API_KEY || "";
|
||
let attempt = 0;
|
||
function tryConnect() {
|
||
attempt++;
|
||
http.get(url, {headers:{"Authorization":"Bearer "+key}}, (res) => {
|
||
if (res.statusCode === 200) { console.log("连通正常: HTTP 200 (第"+attempt+"次)"); process.exit(0); }
|
||
console.error("连通失败: HTTP", res.statusCode, "(第"+attempt+"次)");
|
||
if (attempt < 3) { console.error("10s 后重试..."); setTimeout(tryConnect, 10000); }
|
||
else { console.error("已达最大重试次数，请检查 ASSETS_API_KEY 是否在 assets-ai 中注册"); process.exit(1); }
|
||
}).on("error", (e) => {
|
||
console.error("连接失败:", e.message, "(第"+attempt+"次)");
|
||
if (attempt < 3) { console.error("10s 后重试..."); setTimeout(tryConnect, 10000); }
|
||
else { console.error("已达最大重试次数"); process.exit(1); }
|
||
});
|
||
}
|
||
tryConnect();
|
||
CHECKEOF
|
||
CONN_CHECK=$(ssh txjp "docker cp /tmp/check-conn.js issue-ai:/tmp/check-conn.js && docker exec issue-ai sh -c 'cd /app && NODE_PATH=/app/node_modules node /tmp/check-conn.js'" 2>&1)
|
||
if [ $? -ne 0 ]; then
|
||
warn "issue→assets API 连通性检查失败！站点已正常部署，请检查 ASSETS_API_KEY 是否在 assets-ai 中注册"
|
||
echo " $CONN_CHECK"
|
||
else
|
||
log "issue→assets API 连通性正常"
|
||
fi
|
||
phase_done ;;
|
||
assets)
|
||
phase "构建与部署"
|
||
build_on_server || { phase_fail; exit 1; }
|
||
phase_done
|
||
|
||
phase "部署 nginx 路由"
|
||
ssh txjp "cp $REMOTE_DIR/../nginx-proxy-ai/conf.d/assets-ai.conf /root/docker/nginx-proxy-ai/conf.d/ 2>/dev/null || true
|
||
docker exec nginx-ai nginx -t && docker exec nginx-ai nginx -s reload"
|
||
phase_done
|
||
|
||
# 验证 assets→issue API 连通性（带重试，应对同时部署时目标容器暂不可达）
|
||
phase "检查 API 连通性"
|
||
info "检查 assets→issue API 连通性..."
|
||
ssh txjp 'cat > /tmp/check-conn.js' << 'CHECKEOF'
|
||
const http = require("http");
|
||
const url = process.env.ISSUE_API_URL + "/tickets?pageSize=1";
|
||
const key = process.env.ISSUE_API_KEY || "";
|
||
let attempt = 0;
|
||
function tryConnect() {
|
||
attempt++;
|
||
http.get(url, {headers:{"Authorization":"Bearer "+key}}, (res) => {
|
||
if (res.statusCode === 200) { console.log("连通正常: HTTP 200 (第"+attempt+"次)"); process.exit(0); }
|
||
console.error("连通失败: HTTP", res.statusCode, "(第"+attempt+"次)");
|
||
if (attempt < 3) { console.error("10s 后重试..."); setTimeout(tryConnect, 10000); }
|
||
else { console.error("已达最大重试次数，请检查 ISSUE_API_KEY 是否在 issue-ai 中注册"); process.exit(1); }
|
||
}).on("error", (e) => {
|
||
console.error("连接失败:", e.message, "(第"+attempt+"次)");
|
||
if (attempt < 3) { console.error("10s 后重试..."); setTimeout(tryConnect, 10000); }
|
||
else { console.error("已达最大重试次数"); process.exit(1); }
|
||
});
|
||
}
|
||
tryConnect();
|
||
CHECKEOF
|
||
CONN_CHECK=$(ssh txjp "docker cp /tmp/check-conn.js assets-ai:/tmp/check-conn.js && docker exec assets-ai sh -c 'cd /app && NODE_PATH=/app/node_modules node /tmp/check-conn.js'" 2>&1)
|
||
if [ $? -ne 0 ]; then
|
||
warn "assets→issue API 连通性检查失败！站点已正常部署，请检查 ISSUE_API_KEY 是否在 issue-ai 中注册"
|
||
echo " $CONN_CHECK"
|
||
else
|
||
log "assets→issue API 连通性正常"
|
||
fi
|
||
phase_done ;;
|
||
oa)
|
||
phase "构建与部署"
|
||
build_on_server || { phase_fail; exit 1; }
|
||
phase_done
|
||
|
||
phase "配置环境变量"
|
||
# 注入 LLDAP admin 密码（OA OIDC callback 需要验证 LLDAP 用户存在性）
|
||
info "注入 LLDAP admin 密码到 OA .env..."
|
||
ssh txjp "
|
||
LLDAP_ADMIN_PASS=\$(docker exec lldap printenv LLDAP_ADMIN_PASSWORD 2>/dev/null || echo '')
|
||
if [ -n \"\$LLDAP_ADMIN_PASS\" ]; then
|
||
grep -q '^LLDAP_ADMIN_PASSWORD=' $REMOTE_DIR/.env 2>/dev/null \
|
||
&& sed -i \"s|^LLDAP_ADMIN_PASSWORD=.*|LLDAP_ADMIN_PASSWORD=\$LLDAP_ADMIN_PASS|\" $REMOTE_DIR/.env \
|
||
|| echo \"LLDAP_ADMIN_PASSWORD=\$LLDAP_ADMIN_PASS\" >> $REMOTE_DIR/.env
|
||
fi
|
||
"
|
||
phase_done
|
||
|
||
phase "部署 nginx 配置"
|
||
ssh txjp "cp $REMOTE_DIR/../nginx-proxy-ai/conf.d/oa-ai.conf /root/docker/nginx-proxy-ai/conf.d/ 2>/dev/null || true
|
||
docker exec nginx-ai nginx -t && docker exec nginx-ai nginx -s reload"
|
||
phase_done
|
||
|
||
phase "同步数据"
|
||
# 批量同步 LLDAP email 至各站点（新服务器首次部署填充历史数据）
|
||
info "同步 LLDAP 邮箱至各站点..."
|
||
ssh txjp "node /root/docker/oa-ai/scripts/sync-emails-to-sites.js 2>/dev/null" || warn "邮箱同步失败（不影响 OA 主流程）"
|
||
phase_done ;;
|
||
ldap)
|
||
phase "部署 LLDAP"
|
||
scp "$LOCAL_DIR/docker-compose.yml" txjp:$REMOTE_DIR/docker-compose.yml
|
||
scp "$LOCAL_DIR/Dockerfile" txjp:$REMOTE_DIR/Dockerfile
|
||
ssh txjp "cd $REMOTE_DIR && \
|
||
if [ ! -f .env ]; then \
|
||
if docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^lldap\$'; then \
|
||
LLDAP_JWT=\$(docker exec lldap printenv LLDAP_JWT_SECRET 2>/dev/null || echo '') && \
|
||
LLDAP_PASS=\$(docker exec lldap printenv LLDAP_LDAP_USER_PASS 2>/dev/null || echo '') && \
|
||
LLDAP_ADMIN=\$(docker exec lldap printenv LLDAP_ADMIN_PASSWORD 2>/dev/null || echo '') ; \
|
||
else \
|
||
LLDAP_JWT=\$(openssl rand -hex 32) ; \
|
||
LLDAP_PASS=\$(openssl rand -hex 16) ; \
|
||
LLDAP_ADMIN=\$(openssl rand -hex 16) ; \
|
||
echo '首次部署，已生成随机密码' ; \
|
||
fi && \
|
||
printf '%s\n' \
|
||
\"LLDAP_JWT_SECRET=\$LLDAP_JWT\" \
|
||
\"LLDAP_LDAP_USER_PASS=\$LLDAP_PASS\" \
|
||
\"LLDAP_LDAP_BASE_DN=dc=tlyq,dc=ai\" \
|
||
\"LLDAP_HTTP_PORT=17170\" \
|
||
\"LLDAP_LDAP_PORT=3890\" \
|
||
\"LLDAP_DATABASE_PATH=/data/users.db\" \
|
||
\"LLDAP_ADMIN_PASSWORD=\$LLDAP_ADMIN\" \
|
||
> .env && \
|
||
fi && \
|
||
chmod 600 .env && \
|
||
sed -i '/3890:3890/d' docker-compose.yml 2>/dev/null || true && \
|
||
docker compose up -d --build && docker compose restart"
|
||
log "LLDAP 已部署"
|
||
phase_done ;;
|
||
gitea)
|
||
phase "部署 Gitea"
|
||
scp "$LOCAL_DIR/docker-compose.yml" txjp:$REMOTE_DIR/docker-compose.yml
|
||
# 同步证书目录（若本地存在）
|
||
[ -d "$LOCAL_DIR/cert" ] && scp -r "$LOCAL_DIR"/cert/* txjp:$REMOTE_DIR/cert/ 2>/dev/null || true
|
||
ssh txjp "cd $REMOTE_DIR && docker compose up -d && docker restart nginx-ai"
|
||
log "Gitea 已部署"
|
||
phase_done ;;
|
||
sso)
|
||
phase "部署 Authelia SSO"
|
||
deploy_sso
|
||
phase_done ;;
|
||
monitor)
|
||
phase "构建与部署"
|
||
build_on_server || { phase_fail; exit 1; }
|
||
phase_done
|
||
|
||
phase "部署 nginx 配置"
|
||
ssh txjp "cp $REMOTE_DIR/../nginx-proxy-ai/conf.d/monitor-ai.conf /root/docker/nginx-proxy-ai/conf.d/ 2>/dev/null || true
|
||
docker exec nginx-ai nginx -t && docker exec nginx-ai nginx -s reload"
|
||
phase_done ;;
|
||
esac
|
||
|
||
# ============================================================
|
||
# 运行时合规检查（LESSONS-LEARNED）
|
||
# ============================================================
|
||
phase "运行时合规检查"
|
||
|
||
# LL #7: SSL 证书覆盖目标域名（仅 tlyq.ai 站点）
|
||
if [[ "$SITE" != "ldap" ]]; then
|
||
CERT_DOMAIN=$(ssh txjp "openssl x509 -in /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem -noout -text 2>/dev/null | grep 'DNS:'" 2>/dev/null || echo "")
|
||
if echo "$CERT_DOMAIN" | grep -q "${SITE}.tlyq.ai"; then
|
||
log "SSL 证书覆盖 ${SITE}.tlyq.ai"
|
||
else
|
||
warn "SSL 证书可能未覆盖 ${SITE}.tlyq.ai（LESSONS-LEARNED #7）"
|
||
fi
|
||
fi
|
||
|
||
# LL #20: nginx 重载后确认可用
|
||
if ssh txjp "docker exec nginx-ai nginx -t 2>&1" 2>/dev/null | grep -q "successful"; then
|
||
log "nginx 配置检查通过"
|
||
else
|
||
warn "nginx 配置检查未通过，请检查 upstream 容器状态（LESSONS-LEARNED #20/#21）"
|
||
fi
|
||
|
||
# LL #22/#23: 数据库文件可访问（仅含 DB 站点）
|
||
case "$SITE" in
|
||
issue|assets|oa|monitor|gitea)
|
||
DB_PATH=""
|
||
case "$SITE" in
|
||
issue) DB_PATH="/app/data/issue.db" ;;
|
||
assets) DB_PATH="/app/data/assets.db" ;;
|
||
oa) DB_PATH="/data/other-sites/assets/assets.db /data/other-sites/issue/issue.db" ;;
|
||
monitor) DB_PATH="/app/data/monitor.db" ;;
|
||
gitea) DB_PATH="/data/gitea.db" ;;
|
||
esac
|
||
for db in $DB_PATH; do
|
||
if ssh txjp "docker exec ${CONTAINER} test -f $db" 2>/dev/null; then
|
||
log "数据库文件 $db 可访问"
|
||
else
|
||
warn "数据库文件 $db 不可访问（LESSONS-LEARNED #22/#23）"
|
||
fi
|
||
done
|
||
;;
|
||
esac
|
||
|
||
# 构建新鲜度检查：编译产物必须新于源码（自动适配所有 Next.js 站点）
|
||
if ssh txjp "test -f /root/docker/${REMOTE_DIR}/.next/standalone/server.js" 2>/dev/null; then
|
||
BUILD_MTIME=$(ssh txjp "stat -c %Y /root/docker/${REMOTE_DIR}/.next/standalone/server.js" 2>/dev/null || echo 0)
|
||
SRC_MTIME=$(ssh txjp "find /root/docker/${REMOTE_DIR}/src -type f \( -name '*.ts' -o -name '*.tsx' \) -exec stat -c %Y {} + 2>/dev/null | sort -rn | head -1" 2>/dev/null || echo 0)
|
||
if [ "$BUILD_MTIME" -lt "$SRC_MTIME" ] 2>/dev/null; then
|
||
warn "构建产物旧于源码！请确保 npm run build 已重新执行"
|
||
else
|
||
log "构建新鲜度检查通过"
|
||
fi
|
||
fi
|
||
|
||
# ============================================================
|
||
# 验证
|
||
# ============================================================
|
||
phase "验证部署"
|
||
BUILD_END=$(date +%s)
|
||
TOTAL_DUR=$((BUILD_END - BUILD_START))
|
||
|
||
URL=""
|
||
case "$SITE" in
|
||
www) URL="https://www.tlyq.ai" ;;
|
||
cloud) URL="https://cloud.tlyq.ai" ;;
|
||
token) URL="https://token.tlyq.ai" ;;
|
||
issue) URL="https://issue.tlyq.ai" ;;
|
||
assets) URL="https://assets.tlyq.ai" ;;
|
||
oa) URL="https://oa.tlyq.ai" ;;
|
||
ldap) URL="http://localhost:6178" ;;
|
||
gitea) URL="https://git.tlyq.ai" ;;
|
||
sso) URL="https://sso.tlyq.ai" ;;
|
||
monitor) URL="https://monitor.tlyq.ai" ;;
|
||
esac
|
||
|
||
if [[ "$SITE" == "ldap" ]]; then
|
||
STATUS=$(ssh txjp "docker exec lldap wget -q -O - http://127.0.0.1:17170 > /dev/null 2>&1 && echo 200 || echo 000" 2>/dev/null || echo "???")
|
||
else
|
||
STATUS=$(ssh txjp "curl -s -o /dev/null -w '%{http_code}' '$URL' 2>/dev/null" 2>/dev/null || echo "???")
|
||
fi
|
||
if [[ "$STATUS" == "200" || "$STATUS" == "307" || "$STATUS" == "301" ]]; then
|
||
phase_done
|
||
echo ""
|
||
printf "${GREEN}${BOLD}════════════════════════════════════════════════════════════${NC}\n"
|
||
printf "${GREEN}${BOLD} 🎉 部署成功！${NC}\n"
|
||
printf "${GREEN}${BOLD} 总耗时: ${TOTAL_DUR}s | 访问: $URL${NC}\n"
|
||
printf "${GREEN}${BOLD}════════════════════════════════════════════════════════════${NC}\n"
|
||
exit 0
|
||
else
|
||
phase_done
|
||
warn "返回状态码: $STATUS，请检查"
|
||
exit 1
|
||
fi
|