admin/Nexus
1
0
Fork 0
Code Issues Pull Requests Actions 82 Packages Projects Releases Wiki Activity
Files
74149e0d909a09e462720e5d2fe9ac1d7832d4ec
Nexus/deploy/nexus-1panel.sh
T

1346 lines
45 KiB
Bash
Raw Normal View History

release: nexus btpanel session fix and app-v2
2026-07-08 22:31:31 +08:00
#!/usr/bin/env bash
# Nexus 6.0 — 1Panel + Docker 一键安装 / 升级（参数已全部内置，无需 export）
#
# 新机 1Panel 终端一条命令:
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/nexus-1panel.sh" | bash -s install
#
# 已 clone 到 /opt/nexus:
# cd /opt/nexus && bash deploy/nexus-1panel.sh install --skip-clone
#
# 其他:
# bash deploy/nexus-1panel.sh install --profile 4c16g
# bash deploy/nexus-1panel.sh upgrade
# bash deploy/nexus-1panel.sh check
# bash deploy/nexus-1panel.sh ports
#
# 公共仓库匿名 clone，无需 Gitea 令牌。
# 仅私人仓库可选: deploy/nexus-1panel.secrets.sh 或 /root/.nexus-deploy.env
# 或 clone 时 URL 带令牌，脚本会从 git remote 自动解析
set -euo pipefail
# ═══════════════════════════════════════════════════════════════════
# 内置路径/域名（无敏感信息，可提交 Git）
# ═══════════════════════════════════════════════════════════════════
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
NEXUS_GITEA_REPO="${NEXUS_GITEA_REPO:-admin/Nexus.git}"
NEXUS_DOMAIN="${NEXUS_DOMAIN:-api.synaglobal.vip}"
NEXUS_PROFILE="${NEXUS_PROFILE:-2c8g}"
NEXUS_FROM_ENV="${NEXUS_FROM_ENV:-/www/wwwroot/api.synaglobal.vip/.env}"
NEXUS_BACKUP_DIR="${NEXUS_BACKUP_DIR:-/var/backups/nexus}"
NEXUS_DEPLOY_ENV="${NEXUS_DEPLOY_ENV:-/root/.nexus-deploy.env}"
NEXUS_PUBLISH_PORT="${NEXUS_PUBLISH_PORT:-8600}"
GIT_BRANCH="${NEXUS_GIT_BRANCH:-main}"
COMPOSE_FILE="docker/docker-compose.prod.yml"
COMPOSE_1PANEL="docker/docker-compose.1panel.yml"
ENV_PROD="docker/.env.prod"
HOST_PROFILE_FILE="docker/.host-profile"
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
NC='\033[0m'
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
step() { echo -e "${CYAN}[STEP]${NC} $*"; }
SKIP_CLONE=false
SKIP_GIT=false
FRESH_INSTALL=false
REUSE_SECRETS=false
FROM_ENV="${NEXUS_FROM_ENV}"
NO_BACKUP=false
REQUIRE_BACKUP=false
PRUNE_IMAGES=false
NO_CACHE=false
CHECK_ONLY=false
DRY_RUN=false
CUSTOM_CPUS=""
CUSTOM_MEM_GB=""
usage() {
cat <<'EOF'
Nexus 1Panel 一键脚本
bash deploy/nexus-1panel.sh install [选项] 克隆/配置/启动
bash deploy/nexus-1panel.sh upgrade [选项] 拉代码+备份+重建
bash deploy/nexus-1panel.sh check 检查远程是否有更新
bash deploy/nexus-1panel.sh ports 检查 Gitea/8600/80/443 与防火墙
bash deploy/nexus-1panel.sh init-token <令牌> 覆盖内置 Gitea 令牌（一般不需要）
资源档位（三选一）:
--profile 2c8g|4c16g|1c4g 预设（默认 2c8g = 2核8G）
--cpus N --mem-gb N 自动匹配最近预设
安装选项:
--skip-clone 已在 /opt/nexus，仅 pull
--fresh 全新安装（本机自动生成唯一密钥 + /app/install.html）
--from-env PATH 从旧 .env 迁机导入密钥
--reuse-secrets 使用 secrets 文件中的 NEXUS 密钥（勿用于新机）
--domain NAME 覆盖域名
升级选项:
--no-backup --require-backup --prune --no-cache --dry-run --check（仅查 Git，不重建）
Git: 公共仓库匿名 clone（无需令牌）；私人仓库见 init-token
EOF
exit 0
}
script_dir() {
dirname "$(readlink -f "${BASH_SOURCE[0]}")"
}
secrets_file_path() {
echo "$(script_dir)/nexus-1panel.secrets.sh"
}
load_token_from_git_remote() {
local root="${1:-$NEXUS_ROOT}"
[[ -n "${NEXUS_GITEA_TOKEN:-}" ]] && return 0
[[ -d "${root}/.git" ]] || return 0
local url
url="$(git -C "$root" remote get-url origin 2>/dev/null || true)"
if [[ "$url" =~ http://[^:]+:([^@]+)@ ]]; then
NEXUS_GITEA_TOKEN="${BASH_REMATCH[1]}"
info "已从 git remote 解析 Gitea 令牌"
fi
}
load_secrets() {
local secrets_file
secrets_file="$(secrets_file_path)"
if [[ -f "$secrets_file" ]]; then
# shellcheck disable=SC1090
set -a
source "$secrets_file"
set +a
info "已加载 $secrets_file"
fi
if [[ -f "$NEXUS_DEPLOY_ENV" ]]; then
# shellcheck disable=SC1090
set -a
source "$NEXUS_DEPLOY_ENV"
set +a
info "已加载 $NEXUS_DEPLOY_ENV"
fi
load_token_from_git_remote "$NEXUS_ROOT"
if [[ "$FRESH_INSTALL" == true ]]; then
unset NEXUS_SECRET_KEY NEXUS_API_KEY NEXUS_ENCRYPTION_KEY
info "全新安装：忽略 secrets 中的 NEXUS 密钥，将为本机自动生成"
fi
}
resolve_profile() {
if [[ -n "$CUSTOM_CPUS" && -n "$CUSTOM_MEM_GB" ]]; then
local c m
c="$CUSTOM_CPUS"
m="$CUSTOM_MEM_GB"
if [[ "$c" -le 1 && "$m" -le 4 ]]; then
NEXUS_PROFILE="1c4g"
elif [[ "$c" -le 2 && "$m" -le 8 ]]; then
NEXUS_PROFILE="2c8g"
else
NEXUS_PROFILE="4c16g"
fi
info "规格 ${c}C${m}G → 档位 ${NEXUS_PROFILE}"
return 0
fi
case "$NEXUS_PROFILE" in
1c4g|2c8g|4c16g) ;;
*)
error "未知档位: $NEXUS_PROFILE（可用: 1c4g, 2c8g, 4c16g）"
exit 1
;;
esac
}
profile_env_file() {
local root="$1"
echo "$root/docker/profiles/${NEXUS_PROFILE}.env"
}
save_host_profile() {
local root="$1"
echo "$NEXUS_PROFILE" >"$root/$HOST_PROFILE_FILE"
}
load_saved_profile() {
local root="$1"
if [[ -f "$root/$HOST_PROFILE_FILE" ]]; then
NEXUS_PROFILE="$(tr -d '\r\n' <"$root/$HOST_PROFILE_FILE")"
info "使用已保存档位: $NEXUS_PROFILE"
fi
}
apply_pool_to_env_prod() {
local root="$1" prof="$2"
local env_file="$root/$ENV_PROD"
[[ -f "$env_file" ]] || return 0
local pool overflow
pool="$(grep -E '^NEXUS_DB_POOL_SIZE=' "$prof" | cut -d= -f2-)"
overflow="$(grep -E '^NEXUS_DB_MAX_OVERFLOW=' "$prof" | cut -d= -f2-)"
[[ -n "$pool" ]] && sed -i "s|^NEXUS_DB_POOL_SIZE=.*|NEXUS_DB_POOL_SIZE=${pool}|" "$env_file"
[[ -n "$overflow" ]] && sed -i "s|^NEXUS_DB_MAX_OVERFLOW=.*|NEXUS_DB_MAX_OVERFLOW=${overflow}|" "$env_file"
}
has_1panel_network() {
docker network inspect 1panel-network >/dev/null 2>&1 \
|| sudo docker network inspect 1panel-network >/dev/null 2>&1
}
upsert_env_var() {
local file="$1" key="$2" val="$3"
if grep -qE "^${key}=" "$file" 2>/dev/null; then
sed -i "s|^${key}=.*|${key}=${val}|" "$file"
else
echo "${key}=${val}" >>"$file"
fi
}
migrate_redis_url_host() {
local old_url="$1" new_host="$2"
python3 - "$old_url" "$new_host" <<'PY'
import sys
from urllib.parse import quote, unquote, urlparse
old_url, new_host = sys.argv[1], sys.argv[2]
u = urlparse(old_url)
if u.scheme != "redis":
sys.exit(0)
password = unquote(u.password or "")
if not password and u.username:
password = unquote(u.username)
if password and new_host:
print(f"redis://:{quote(password, safe='')}@{new_host}:6379/0")
PY
}
# Prefer wizard-written redis://:pass@host from nexus-state or .env.prod; avoid clobbering on nx update.
resolve_nexus_redis_url() {
local redis_host="$1"
local env_file="$2"
local vol_url="" existing="" migrated="" host_lc="${redis_host,,}"
local state_vol
state_vol="$(docker volume ls -q --filter name=nexus-state 2>/dev/null | head -1 || true)"
if [[ -n "$state_vol" ]]; then
vol_url="$(docker run --rm -v "${state_vol}:/data" alpine sh -c \
"grep '^NEXUS_REDIS_URL=' /data/.env 2>/dev/null | cut -d= -f2- | tr -d '\"'" 2>/dev/null || true)"
if [[ -n "$vol_url" ]]; then
if [[ "${vol_url,,}" == *"${host_lc}"* ]]; then
echo "$vol_url"
return 0
fi
if [[ "$vol_url" == *"@"* ]]; then
migrated="$(migrate_redis_url_host "$vol_url" "$redis_host" 2>/dev/null || true)"
if [[ -n "$migrated" ]]; then
echo "$migrated"
return 0
fi
fi
fi
fi
if [[ -f "$env_file" ]]; then
existing="$(grep '^NEXUS_REDIS_URL=' "$env_file" 2>/dev/null | cut -d= -f2- | tr -d '"' || true)"
if [[ -n "$existing" && "$existing" == *"@"* ]]; then
if [[ "${existing,,}" == *"${host_lc}"* ]]; then
echo "$existing"
return 0
fi
migrated="$(migrate_redis_url_host "$existing" "$redis_host" 2>/dev/null || true)"
if [[ -n "$migrated" ]]; then
echo "$migrated"
return 0
fi
fi
fi
echo "redis://${redis_host}:6379/0"
}
nexus_container_name() {
docker ps --format '{{.Names}}' | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true
}
nexus_publish_port() {
local root="$1"
local env_file="$root/$ENV_PROD"
local port
port="$(grep -E '^NEXUS_PUBLISH_PORT=' "$env_file" 2>/dev/null | cut -d= -f2- | tr -d '"' || true)"
echo "${port:-8600}"
}
nexus_container_has_install_lock() {
local cname="$1"
docker exec "$cname" test -f /app/.install_locked 2>/dev/null \
|| docker exec "$cname" test -f /var/lib/nexus/.install_locked 2>/dev/null
}
restore_install_lock_in_container() {
local cname="$1"
[[ -n "$cname" ]] || return 0
docker exec "$cname" sh -c '
if [ ! -f /app/.install_locked ] && [ -f /var/lib/nexus/.install_locked ]; then
cp /var/lib/nexus/.install_locked /app/.install_locked
chmod 600 /app/.install_locked
fi
' 2>/dev/null || true
}
nexus_on_1panel_network() {
local cname="$1"
[[ -n "$cname" ]] || return 1
docker inspect "$cname" --format '{{range $k, $v := .NetworkSettings.Networks}}{{$k}} {{end}}' 2>/dev/null \
| grep -qw '1panel-network'
}
verify_nexus_1panel_network() {
local root="$1"
if ! has_1panel_network; then
return 0
fi
local cname
cname="$(nexus_container_name)"
[[ -n "$cname" ]] || return 0
restore_install_lock_in_container "$cname"
if nexus_on_1panel_network "$cname"; then
info "已验证 Nexus 接入 1panel-network"
return 0
fi
error "Nexus 容器 ${cname} 未接入 1panel-network，无法解析 1Panel MySQL/Redis 主机名"
warn "正在叠加 docker-compose.1panel.yml 重新创建容器..."
compose_cmd "$root" up -d --no-build --remove-orphans
sleep 2
cname="$(nexus_container_name)"
restore_install_lock_in_container "$cname"
if nexus_on_1panel_network "$cname"; then
info "已修复：Nexus 已接入 1panel-network"
return 0
fi
error "修复失败：Nexus 仍未接入 1panel-network"
return 1
}
set_install_complete() {
local root="$1"
local env_file="$root/$ENV_PROD"
local cname
[[ -f "$env_file" ]] || return 0
cname="$(nexus_container_name)"
[[ -n "$cname" ]] || return 0
restore_install_lock_in_container "$cname"
if nexus_container_has_install_lock "$cname"; then
archive_install_wizard_in_container "$cname"
upsert_env_var "$env_file" "NEXUS_INSTALL_WIZARD_PENDING" "0"
info "安装已完成：NEXUS_INSTALL_WIZARD_PENDING=0"
fi
}
sync_env_prod_to_volume() {
local root="$1"
local env_file="$root/$ENV_PROD"
local state_vol cname
state_vol="$(docker volume ls -q --filter name=nexus-state 2>/dev/null | head -1 || true)"
[[ -n "$state_vol" && -f "$env_file" ]] || return 0
cname="$(nexus_container_name)"
[[ -n "$cname" ]] || return 0
restore_install_lock_in_container "$cname"
nexus_container_has_install_lock "$cname" || return 0
python3 - "$env_file" "$state_vol" <<'PY'
import re
import subprocess
import sys
from pathlib import Path
env_file = Path(sys.argv[1])
vol = sys.argv[2]
keys = (
"NEXUS_SECRET_KEY",
"NEXUS_API_KEY",
"NEXUS_ENCRYPTION_KEY",
"NEXUS_REDIS_URL",
"NEXUS_DATABASE_URL",
"NEXUS_TELEGRAM_BOT_TOKEN",
"NEXUS_TELEGRAM_CHAT_ID",
)
prod = {}
for line in env_file.read_text(encoding="utf-8").splitlines():
m = re.match(r"^([A-Z0-9_]+)=(.*)$", line.strip())
if m and m.group(1) in keys and m.group(2).strip():
prod[m.group(1)] = m.group(2).strip().strip('"')
if not prod:
sys.exit(0)
cur = subprocess.run(
["docker", "run", "--rm", "-v", f"{vol}:/data", "alpine", "cat", "/data/.env"],
capture_output=True,
text=True,
)
text = cur.stdout if cur.returncode == 0 else ""
if not text.strip():
sys.exit(0)
lines = text.splitlines()
out = []
seen = set()
for line in lines:
key = line.split("=", 1)[0].strip() if "=" in line else ""
if key in prod:
out.append(f'{key}={prod[key]}')
seen.add(key)
else:
out.append(line)
for key, val in prod.items():
if key not in seen:
out.append(f'{key}={val}')
new_text = "\n".join(out).rstrip() + "\n"
subprocess.run(
["docker", "run", "--rm", "-i", "-v", f"{vol}:/data", "alpine", "sh", "-c", "cat > /data/.env && chmod 600 /data/.env"],
input=new_text,
text=True,
check=True,
)
print("synced")
PY
info "已将 docker/.env.prod 密钥/URL 同步至 nexus-state 卷"
}
tag_rollback_image() {
local root="$1" old_id
old_id="$(docker ps --filter "name=nexus-prod-nexus" --format '{{.Image}}' 2>/dev/null | head -1 || true)"
if [[ -z "$old_id" ]]; then
old_id="$(compose_cmd "$root" images -q nexus 2>/dev/null | head -1 || true)"
fi
if [[ -n "$old_id" ]]; then
docker tag "$old_id" "nexus-prod-nexus:rollback" 2>/dev/null || true
info "已标记回滚镜像 nexus-prod-nexus:rollback"
fi
}
gate_new_image_import() {
local root="$1" img
img="$(compose_cmd "$root" images -q nexus 2>/dev/null | head -1 || true)"
if [[ -z "$img" ]]; then
error "镜像门控失败：未找到 nexus 镜像"
return 1
fi
if ! docker run --rm --entrypoint python3 "$img" -c "import server.main" >/dev/null 2>&1; then
error "镜像门控失败：import server.main"
return 1
fi
info "镜像门控通过 (import server.main)"
return 0
}
rollback_compose_upgrade() {
local root="$1"
if docker image inspect nexus-prod-nexus:rollback >/dev/null 2>&1; then
warn "健康检查失败，回滚至上一镜像..."
docker tag nexus-prod-nexus:rollback nexus-prod-nexus:latest 2>/dev/null || true
compose_cmd "$root" up -d --no-build --remove-orphans
if ! verify_nexus_1panel_network "$root"; then
error "回滚后仍未接入 1panel-network"
return 1
fi
return 0
fi
warn "无回滚镜像 nexus-prod-nexus:rollback，跳过自动回滚"
return 1
}
write_1panel_hosts_volume() {
local mysql_host="${1:-}" redis_host="${2:-}"
[[ -n "$mysql_host" || -n "$redis_host" ]] || return 0
local vol json
vol="$(docker volume ls -q --filter name=nexus-web-data 2>/dev/null | head -1 || true)"
if [[ -z "$vol" ]]; then
warn "未找到 nexus-web-data 卷，跳过写入 1panel-hosts.json"
return 0
fi
json="{"
if [[ -n "$mysql_host" ]]; then
json+="\"db_host\":\"${mysql_host}\""
[[ -n "$redis_host" ]] && json+=","
fi
if [[ -n "$redis_host" ]]; then
json+="\"redis_host\":\"${redis_host}\""
fi
json+="}"
if printf '%s' "$json" | docker run --rm -i -v "${vol}:/data" alpine:3.19 \
sh -c 'cat > /data/1panel-hosts.json && chmod 644 /data/1panel-hosts.json'; then
info "已写入卷 ${vol} → web/data/1panel-hosts.json"
else
warn "写入 1panel-hosts.json 失败（向导仍可读 .env.prod 环境变量）"
fi
}
sync_1panel_service_hosts() {
local root="$1"
local env_file="$root/$ENV_PROD"
local detect="$root/deploy/detect-1panel-services.sh"
[[ -f "$env_file" ]] || return 0
if ! has_1panel_network; then
warn "未找到 1panel-network — 请先在 1Panel 应用商店安装 MySQL/Redis"
return 0
fi
if [[ ! -x "$detect" ]]; then
chmod +x "$detect" 2>/dev/null || true
fi
if [[ ! -x "$detect" ]]; then
warn "未找到 detect-1panel-services.sh，跳过 1Panel 容器名探测"
return 0
fi
local line mysql_host="" redis_host="" detect_out
if ! detect_out="$("$detect" 2>&1)"; then
warn "1Panel 容器探测: ${detect_out:-无 MySQL/Redis 容器运行}"
return 0
fi
while IFS= read -r line; do
case "$line" in
NEXUS_1PANEL_DB_HOST=*)
mysql_host="${line#NEXUS_1PANEL_DB_HOST=}"
upsert_env_var "$env_file" NEXUS_1PANEL_DB_HOST "$mysql_host"
info "1Panel MySQL 容器: $mysql_host（安装向导将预填为数据库主机）"
;;
NEXUS_1PANEL_REDIS_HOST=*)
redis_host="${line#NEXUS_1PANEL_REDIS_HOST=}"
upsert_env_var "$env_file" NEXUS_1PANEL_REDIS_HOST "$redis_host"
local redis_url
redis_url="$(resolve_nexus_redis_url "$redis_host" "$env_file")"
upsert_env_var "$env_file" "NEXUS_REDIS_URL" "$redis_url"
if [[ "$redis_url" == *"@"* ]]; then
info "1Panel Redis 容器: $redis_host（NEXUS_REDIS_URL 已保留向导密码）"
else
info "1Panel Redis 容器: $redis_host（NEXUS_REDIS_URL 占位，向导步骤 3 填密码后写入卷 .env）"
fi
;;
esac
done <<<"$detect_out"
write_1panel_hosts_volume "$mysql_host" "$redis_host"
}
compose_cmd() {
local root="$1"
shift
local prof
prof="$(profile_env_file "$root")"
if [[ ! -f "$prof" ]]; then
error "缺少档位文件: $prof"
exit 1
fi
cd "$root"
local -a compose_args=(-f "$COMPOSE_FILE")
if has_1panel_network && [[ -f "$COMPOSE_1PANEL" ]]; then
compose_args+=(-f "$COMPOSE_1PANEL")
fi
docker compose "${compose_args[@]}" --env-file "$ENV_PROD" --env-file "$prof" "$@"
}
rand_secret() {
openssl rand -hex 24 2>/dev/null || head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n'
}
rand_pass() {
openssl rand -hex 16 2>/dev/null || head -c 16 /dev/urandom | od -An -tx1 | tr -d ' \n'
}
read_env_val() {
local file="$1" key="$2"
grep -E "^${key}=" "$file" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r"' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//'
}
parse_gitea_endpoint() {
local hp="${NEXUS_GITEA_HOST}"
GITEA_HOST="${hp%%:*}"
GITEA_PORT="${hp##*:}"
if [[ "$GITEA_HOST" == "$GITEA_PORT" || -z "$GITEA_PORT" ]]; then
GITEA_PORT=3000
fi
}
nexus_publish_port() {
local root="${1:-}"
local p="${NEXUS_PUBLISH_PORT:-8600}"
if [[ -n "$root" && -f "$root/$ENV_PROD" ]]; then
local v
v="$(read_env_val "$root/$ENV_PROD" NEXUS_PUBLISH_PORT)"
[[ -n "$v" ]] && p="$v"
fi
echo "$p"
}
tcp_reachable() {
local host="$1" port="$2" t="${3:-3}"
if command -v nc >/dev/null 2>&1; then
nc -z -w "$t" "$host" "$port" 2>/dev/null
return $?
fi
if command -v timeout >/dev/null 2>&1; then
timeout "$t" bash -c "exec 3<>/dev/tcp/${host}/${port}" 2>/dev/null \
&& { exec 3<&- 3>&-; return 0; }
else
bash -c "exec 3<>/dev/tcp/${host}/${port}" 2>/dev/null \
&& { exec 3<&- 3>&-; return 0; }
fi
return 1
}
local_port_listening() {
local port="$1"
if command -v ss >/dev/null 2>&1; then
ss -tlnH 2>/dev/null | grep -qE ":${port}[[:space:]]"
return $?
fi
if command -v netstat >/dev/null 2>&1; then
netstat -tln 2>/dev/null | grep -qE ":${port}[[:space:]]"
return $?
fi
curl -sf --max-time 2 "http://127.0.0.1:${port}/health" >/dev/null 2>&1
}
firewall_may_block_port() {
local port="$1"
if command -v ufw >/dev/null 2>&1; then
local st
st="$(ufw status 2>/dev/null | head -1 || true)"
if [[ "$st" == *"active"* ]]; then
ufw status 2>/dev/null | grep -qE "${port}/tcp[[:space:]]+ALLOW" && return 1
return 0
fi
fi
if command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state 2>/dev/null | grep -qi running; then
firewall-cmd --list-ports 2>/dev/null | grep -q "${port}/tcp" && return 1
firewall-cmd --list-services 2>/dev/null | grep -qE '^(http|https)$' \
&& [[ "$port" == "80" || "$port" == "443" ]] && return 1
return 0
fi
return 1
}
remind_firewall() {
local port="$1" label="$2"
if firewall_may_block_port "$port"; then
warn "防火墙可能未放行 ${port}/tcp（${label}）"
warn " 本机: ufw allow ${port}/tcp 或 1Panel → 主机 → 防火墙"
warn " 云厂商控制台: 安全组入站放行 ${port}/tcp"
fi
}
check_ports_preflight() {
local root="${1:-$NEXUS_ROOT}"
local nport issues=0
parse_gitea_endpoint
nport="$(nexus_publish_port "$root")"
step "检查端口与防火墙..."
if tcp_reachable "$GITEA_HOST" "$GITEA_PORT"; then
info "Gitea ${GITEA_HOST}:${GITEA_PORT} — 可达（git 拉取）"
else
warn "Gitea ${GITEA_HOST}:${GITEA_PORT} — 无法连接，clone/pull 会失败"
warn " 请确认 Gitea 在线，且本机出站与该端口未被防火墙/安全组拦截"
issues=$((issues + 1))
fi
if local_port_listening "$nport"; then
info "127.0.0.1:${nport} — 已有监听（可能为旧 Nexus 实例）"
else
info "127.0.0.1:${nport} — 尚未监听（安装后将由 Compose 绑定）"
fi
for spec in "80:HTTP" "443:HTTPS"; do
local p="${spec%%:*}" label="${spec##*:}"
if local_port_listening "$p"; then
info "本机 :${p} — 已监听（${label} / 1Panel）"
else
warn "本机 :${p} — 未监听，外网 ${label} 暂不可用"
warn " 安装完成后: 1Panel → 网站 → 反代 http://127.0.0.1:${nport} 并申请 SSL"
issues=$((issues + 1))
fi
remind_firewall "$p" "${label} 公网"
done
remind_firewall 22 "SSH（远程维护）"
if [[ "$issues" -gt 0 ]]; then
warn "共 ${issues} 项端口提醒（可继续安装，但请先处理 Gitea 不可达问题）"
else
info "端口预检通过"
fi
echo ""
}
check_ports_post() {
local root="$1"
local nport health_ext
nport="$(nexus_publish_port "$root")"
step "检查服务端口..."
if local_port_listening "$nport"; then
info "Nexus 127.0.0.1:${nport} — 已监听"
else
warn "127.0.0.1:${nport} — 未监听，请执行: cd $root && docker compose ... ps"
fi
if local_port_listening 443; then
health_ext="$(curl -sk --max-time 8 -o /dev/null -w '%{http_code}' "https://${NEXUS_DOMAIN}/health" 2>/dev/null || echo "000")"
if [[ "$health_ext" == "200" ]]; then
info "https://${NEXUS_DOMAIN}/health — 外网可达 (HTTP 200)"
else
warn "https://${NEXUS_DOMAIN}/health — 返回 HTTP ${health_ext}"
warn " 若外网打不开: 1Panel 反代是否指向 127.0.0.1:${nport}，安全组是否放行 443"
fi
else
warn "本机 443 未监听 — 请在 1Panel 创建站点并启用 HTTPS，否则浏览器无法访问 ${NEXUS_DOMAIN}"
remind_firewall 443 "HTTPS"
fi
if ! local_port_listening 80; then
info "本机 80 未监听（仅 HTTPS 时正常）"
fi
echo ""
}
cmd_ports() {
require_root
check_ports_preflight "$NEXUS_ROOT"
if [[ -f "$NEXUS_ROOT/$ENV_PROD" ]]; then
check_ports_post "$NEXUS_ROOT"
fi
}
require_root() {
if [[ "$(id -u)" -ne 0 ]]; then
error "请切换到 root 执行（su -），不要用 sudo 包一层"
exit 1
fi
}
require_token() {
if [[ -n "${NEXUS_GITEA_TOKEN:-}" ]]; then
return 0
fi
info "未配置 Gitea 令牌，按公共仓库匿名 clone/pull"
}
git_remote_url() {
if [[ -n "${NEXUS_GITEA_TOKEN:-}" ]]; then
echo "http://admin:${NEXUS_GITEA_TOKEN}@${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
else
echo "http://${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
fi
}
ensure_packages() {
if command -v apt-get >/dev/null 2>&1; then
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get install -y -qq git curl openssl ca-certificates >/dev/null 2>&1 || true
fi
}
ensure_docker() {
if docker compose version >/dev/null 2>&1; then
info "Docker Compose: $(docker compose version --short 2>/dev/null || docker compose version)"
return 0
fi
error "未检测到 docker compose。请在 1Panel → 容器 安装 Docker。"
exit 1
}
clone_or_pull() {
local url
url="$(git_remote_url)"
if [[ "$SKIP_CLONE" == true ]]; then
if [[ ! -d "$NEXUS_ROOT/.git" ]]; then
error "--skip-clone 但 $NEXUS_ROOT 不是 git 仓库"
exit 1
fi
info "在 $NEXUS_ROOT 执行 git pull..."
git -C "$NEXUS_ROOT" remote set-url origin "$url" 2>/dev/null || true
git -C "$NEXUS_ROOT" fetch origin "$GIT_BRANCH" --prune
git -C "$NEXUS_ROOT" reset --hard "origin/${GIT_BRANCH}"
return 0
fi
mkdir -p "$(dirname "$NEXUS_ROOT")"
if [[ -d "$NEXUS_ROOT/.git" ]]; then
info "仓库已存在，同步 origin/${GIT_BRANCH}..."
git -C "$NEXUS_ROOT" remote set-url origin "$url" 2>/dev/null || true
git -C "$NEXUS_ROOT" fetch origin "$GIT_BRANCH" --prune
git -C "$NEXUS_ROOT" reset --hard "origin/${GIT_BRANCH}"
return 0
fi
if [[ -d "$NEXUS_ROOT" ]] && [[ -n "$(ls -A "$NEXUS_ROOT" 2>/dev/null)" ]]; then
error "目录非空且不是 git 仓库: $NEXUS_ROOT"
exit 1
fi
rm -rf "$NEXUS_ROOT"
info "克隆 Nexus → $NEXUS_ROOT ..."
git clone "$url" "$NEXUS_ROOT"
git -C "$NEXUS_ROOT" checkout "$GIT_BRANCH" 2>/dev/null || true
}
write_temp_secrets_env() {
local f
f="$(mktemp /tmp/nexus-secrets-import.XXXXXX.env)"
{
printf 'NEXUS_SECRET_KEY=%s\n' "$NEXUS_SECRET_KEY"
printf 'NEXUS_API_KEY=%s\n' "$NEXUS_API_KEY"
printf 'NEXUS_ENCRYPTION_KEY=%s\n' "$NEXUS_ENCRYPTION_KEY"
} >"$f"
chmod 600 "$f"
echo "$f"
}
write_env_prod() {
local root="$1"
local env_file="$root/$ENV_PROD"
local example="$root/docker/.env.prod.example"
local gen="$root/scripts/generate_nexus_secrets.py"
local prof backup tmp
if [[ ! -f "$example" ]]; then
error "缺少 $example"
exit 1
fi
if [[ ! -f "$gen" ]]; then
error "缺少 $gen"
exit 1
fi
if [[ -f "$env_file" ]]; then
warn "$env_file 已存在，仅更新域名与连接池"
sed -i "s|^NEXUS_CORS_ORIGINS=.*|NEXUS_CORS_ORIGINS=https://${NEXUS_DOMAIN}|" "$env_file"
sed -i "s|^NEXUS_API_BASE_URL=.*|NEXUS_API_BASE_URL=https://${NEXUS_DOMAIN}|" "$env_file"
apply_pool_to_env_prod "$root" "$(profile_env_file "$root")"
chmod 600 "$env_file"
return 0
fi
prof="$(profile_env_file "$root")"
backup="/root/.nexus-install-secrets-$(date +%Y%m%d%H%M%S).env"
if [[ -n "$FROM_ENV" && -f "$FROM_ENV" ]]; then
info "迁机：从 $FROM_ENV 导入密钥..."
python3 "$gen" write-prod \
--template "$example" \
--output "$env_file" \
--domain "$NEXUS_DOMAIN" \
--profile-env "$prof" \
--from-env "$FROM_ENV" \
--backup "$backup"
elif [[ "$FRESH_INSTALL" == true ]]; then
info "全新安装：为本机生成唯一 NEXUS 密钥（MySQL/Redis 请自行安装）..."
python3 "$gen" write-prod \
--template "$example" \
--output "$env_file" \
--domain "$NEXUS_DOMAIN" \
--profile-env "$prof" \
--fresh \
--wizard-pending \
--backup "$backup"
info "密钥备份: $backup（仅本机，勿复制到其他服务器）"
info "完成后访问 https://${NEXUS_DOMAIN}/app/install.html"
elif [[ "$REUSE_SECRETS" == true && -n "${NEXUS_SECRET_KEY:-}" && -n "${NEXUS_API_KEY:-}" && -n "${NEXUS_ENCRYPTION_KEY:-}" ]]; then
warn "使用 secrets 中的 NEXUS 密钥（仅迁机/复用，新机勿用 --reuse-secrets）"
tmp="$(write_temp_secrets_env)"
python3 "$gen" write-prod \
--template "$example" \
--output "$env_file" \
--domain "$NEXUS_DOMAIN" \
--profile-env "$prof" \
--from-env "$tmp" \
--backup "$backup"
rm -f "$tmp"
else
info "未迁机导入：为本机生成唯一密钥..."
python3 "$gen" write-prod \
--template "$example" \
--output "$env_file" \
--domain "$NEXUS_DOMAIN" \
--profile-env "$prof" \
--fresh \
--wizard-pending \
--backup "$backup"
info "密钥备份: $backup"
if [[ "$FRESH_INSTALL" != true ]]; then
info "完成后访问 https://${NEXUS_DOMAIN}/app/install.html"
fi
fi
chmod 600 "$env_file"
info "已写入 $env_file"
}
purge_legacy_bundled_services() {
local root="$1"
local s
for s in \
"$root/deploy/uninstall-mysql-compose.sh" \
"$root/deploy/uninstall-redis-compose.sh"; do
if [[ -x "$s" ]]; then
step "清理遗留 Compose 内置服务: $(basename "$s")"
NEXUS_ROOT="$root" bash "$s" || true
fi
done
}
reset_nexus_state_volume_for_fresh() {
local vol
vol="$(docker volume ls -q --filter name=nexus-state 2>/dev/null | head -1 || true)"
[[ -n "$vol" ]] || return 0
warn "全新安装：清除 nexus-state 卷内旧 .env / .install_locked"
docker run --rm -v "${vol}:/data" alpine:3.19 \
sh -c 'rm -f /data/.env /data/.install_locked' 2>/dev/null || true
}
restore_install_wizard_html_in_container() {
local cname="$1"
[[ -n "$cname" ]] || return 0
docker exec "$cname" sh -c '
rm -f /app/.install_locked
if [ -f /app/web/app/install.html.bak ] && [ ! -f /app/web/app/install.html ]; then
mv /app/web/app/install.html.bak /app/web/app/install.html
fi
' 2>/dev/null || true
}
compose_up() {
local root="$1" cname
save_host_profile "$root"
purge_legacy_bundled_services "$root"
sync_1panel_service_hosts "$root"
if [[ "$FRESH_INSTALL" == true ]]; then
reset_nexus_state_volume_for_fresh
fi
if has_1panel_network; then
info "已接入 1panel-network（MySQL/Redis 使用 1Panel 容器名互联）"
fi
info "档位: ${NEXUS_PROFILE}（仅 Nexus 容器；MySQL/Redis 请自行安装）"
info "构建并启动（首次约 10～20 分钟）..."
compose_cmd "$root" up -d --build --remove-orphans
verify_nexus_1panel_network "$root" || return 1
if [[ "$FRESH_INSTALL" == true ]]; then
cname="$(nexus_container_name)"
restore_install_wizard_html_in_container "$cname"
fi
}
archive_install_wizard_in_container() {
local cname="$1"
[[ -n "$cname" ]] || return 0
docker exec "$cname" sh -c '
if [ -f /app/web/app/install.html.bak ]; then
rm -f /app/web/app/install.html
elif [ -f /app/web/app/install.html ]; then
mv /app/web/app/install.html /app/web/app/install.html.bak
fi
' 2>/dev/null || true
}
verify_install_wizard() {
local root="$1"
local port="${2:-$(nexus_publish_port "$root")}"
local code cname
cname="$(nexus_container_name)"
if [[ -n "$cname" ]] && nexus_container_has_install_lock "$cname"; then
archive_install_wizard_in_container "$cname"
code=$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app/install.html" 2>/dev/null || echo "000")
if [[ "$code" == "404" ]]; then
info " /app/install.html 已归档 → HTTP 404"
return 0
fi
warn " 已锁定但 /app/install.html → HTTP $code"
return 1
fi
code=$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app/install.html" 2>/dev/null || echo "000")
if [[ "$code" == "200" ]]; then
info " /app/install.html → HTTP 200"
return 0
fi
warn " /app/install.html → HTTP $code（尝试同步静态文件…）"
if [[ -x "$root/deploy/sync-install-wizard-to-container.sh" ]]; then
NEXUS_PUBLISH_PORT="$port" NEXUS_ROOT="$root" bash "$root/deploy/sync-install-wizard-to-container.sh" || true
code=$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app/install.html" 2>/dev/null || echo "000")
if [[ "$code" == "200" ]]; then
info " /app/install.html → HTTP 200（已同步）"
return 0
fi
fi
warn " 请重建镜像: cd $root && docker compose -f docker/docker-compose.prod.yml --env-file docker/.env.prod build --no-cache nexus"
return 1
}
verify_health() {
local root="$1" title="${2:-安装}"
local i health spa port
port="$(nexus_publish_port "$root")"
info "等待服务就绪 (端口 ${port})..."
for i in $(seq 1 60); do
health=$(curl -sf "http://127.0.0.1:${port}/health" 2>/dev/null || true)
if [[ "$health" == "ok" ]]; then
spa=$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app/" 2>/dev/null || echo "000")
verify_install_wizard "$root" "$port" || true
echo ""
info "═══ ${title}完成 ═══"
info " 档位: ${NEXUS_PROFILE}"
info " /health → ok"
info " /app/ → HTTP $spa"
info " 目录: $root"
if [[ -d "$root/.git" ]]; then
info " 版本: $(git -C "$root" log -1 --oneline)"
fi
echo ""
info "1Panel → 网站 → 反代 http://127.0.0.1:${port} 域名: ${NEXUS_DOMAIN}"
info "配置示例: $root/deploy/1panel/openresty-nexus.conf.example"
if [[ "$FRESH_INSTALL" == true ]] || ! grep -qE '^NEXUS_SECRET_KEY=.+$' "$root/$ENV_PROD" 2>/dev/null; then
info "浏览器: https://${NEXUS_DOMAIN}/app/install.html"
else
info "浏览器: https://${NEXUS_DOMAIN}/app/"
fi
echo ""
NEXUS_ROOT="$root" bash "$root/deploy/install-nx-cli.sh" 2>/dev/null || true
info "运维菜单: nx 或 nexus-update"
check_ports_post "$root"
return 0
fi
sleep 5
done
error "健康检查超时"
check_ports_post "$root" || true
compose_cmd "$root" logs --tail=80 nexus || true
return 1
}
ensure_repo() {
if [[ ! -d "$NEXUS_ROOT/.git" ]]; then
error "未找到 $NEXUS_ROOT，请先: bash $0 install"
exit 1
fi
if [[ ! -f "$NEXUS_ROOT/$ENV_PROD" ]]; then
error "缺少 $NEXUS_ROOT/$ENV_PROD"
exit 1
fi
}
git_fetch() {
local url
url="$(git_remote_url)"
git -C "$NEXUS_ROOT" remote set-url origin "$url" 2>/dev/null || true
git -C "$NEXUS_ROOT" fetch origin "$GIT_BRANCH" --prune
}
commits_behind() {
git -C "$NEXUS_ROOT" rev-list "HEAD..origin/${GIT_BRANCH}" --count 2>/dev/null || echo "0"
}
show_pending() {
local behind
behind="$(commits_behind)"
info "当前: $(git -C "$NEXUS_ROOT" log -1 --oneline)"
info "远程: $(git -C "$NEXUS_ROOT" log -1 --oneline "origin/${GIT_BRANCH}")"
if [[ "$behind" == "0" ]]; then
info "已是最新。"
return 1
fi
warn "落后 ${behind} 个提交:"
git -C "$NEXUS_ROOT" log --oneline "HEAD..origin/${GIT_BRANCH}"
return 0
}
backup_mysql() {
local root="$1" ts file dump_sh
if [[ "$NO_BACKUP" == true ]]; then
warn "已跳过备份 (--no-backup)"
return 0
fi
dump_sh="${root}/deploy/mysql_dump_to_file.sh"
if [[ ! -f "$dump_sh" ]]; then
warn "缺少 $dump_sh，跳过 MySQL 备份"
return 0
fi
mkdir -p "$NEXUS_BACKUP_DIR"
ts="$(date +%Y%m%d-%H%M%S)"
file="${NEXUS_BACKUP_DIR}/nexus-before-upgrade-${ts}.sql"
step "备份 MySQL → $file"
if ! NEXUS_ROOT="$root" bash "$dump_sh" --output "$file" --root "$root"; then
if [[ "$REQUIRE_BACKUP" == true ]]; then
error "mysqldump 失败，已中止（--require-backup）"
rm -f "$file"
exit 1
fi
warn "mysqldump 失败，继续升级（加 --require-backup 可在备份失败时中止）"
rm -f "$file"
return 0
fi
gzip -f "$file"
info "备份: ${file}.gz"
}
git_upgrade() {
local before after
before="$(git -C "$NEXUS_ROOT" rev-parse HEAD)"
step "同步 origin/${GIT_BRANCH}"
git -C "$NEXUS_ROOT" reset --hard "origin/${GIT_BRANCH}"
after="$(git -C "$NEXUS_ROOT" rev-parse HEAD)"
info "代码: ${before:0:7} → ${after:0:7}"
}
cmd_init_token() {
require_root
local tok="${1:-}"
if [[ -z "$tok" ]]; then
error "用法: $0 init-token <Gitea令牌>"
exit 1
fi
printf 'NEXUS_GITEA_TOKEN=%s\n' "$tok" >"$NEXUS_DEPLOY_ENV"
chmod 600 "$NEXUS_DEPLOY_ENV"
info "已写入 $NEXUS_DEPLOY_ENV"
}
cmd_install() {
echo ""
echo "=========================================="
echo " Nexus 1Panel 一键安装"
echo " 域名: ${NEXUS_DOMAIN} 档位: ${NEXUS_PROFILE}"
echo "=========================================="
echo ""
require_root
require_token
resolve_profile
ensure_packages
ensure_docker
check_ports_preflight "$NEXUS_ROOT"
clone_or_pull
NEXUS_ROOT="$NEXUS_ROOT" bash "$NEXUS_ROOT/deploy/install-nx-cli.sh" 2>/dev/null || true
write_env_prod "$NEXUS_ROOT"
compose_up "$NEXUS_ROOT"
verify_health "$NEXUS_ROOT" "安装" || exit 1
}
cmd_upgrade() {
echo ""
echo "=========================================="
echo " Nexus 1Panel 一键升级"
echo "=========================================="
echo ""
require_root
require_token
ensure_docker
ensure_repo
load_saved_profile "$NEXUS_ROOT"
resolve_profile
check_ports_preflight "$NEXUS_ROOT"
if [[ "$SKIP_GIT" == true ]]; then
info "跳过 Git 同步（本机 rsync 已推送代码）"
else
git_fetch
show_pending || true
fi
if [[ "$CHECK_ONLY" == true ]]; then
exit 0
fi
if [[ "$DRY_RUN" == true ]]; then
info "dry-run 结束。"
exit 0
fi
if [[ "$SKIP_GIT" == true ]]; then
info "本机直传模式：跳过 git reset，仍备份并重建镜像"
if [[ "$NO_BACKUP" != true ]]; then
backup_mysql "$NEXUS_ROOT"
fi
else
local behind
behind="$(commits_behind)"
if [[ "$behind" != "0" ]]; then
backup_mysql "$NEXUS_ROOT"
git_upgrade
else
info "Git 已最新，仍重建 Docker 镜像与容器（避免旧 entrypoint 缓存）"
if [[ "$NO_BACKUP" != true ]]; then
backup_mysql "$NEXUS_ROOT"
fi
fi
fi
apply_pool_to_env_prod "$NEXUS_ROOT" "$(profile_env_file "$NEXUS_ROOT")"
upsert_env_var "$NEXUS_ROOT/$ENV_PROD" "NEXUS_HOST_ROOT" "$NEXUS_ROOT"
save_host_profile "$NEXUS_ROOT"
purge_legacy_bundled_services "$NEXUS_ROOT"
sync_1panel_service_hosts "$NEXUS_ROOT"
sync_env_prod_to_volume "$NEXUS_ROOT"
tag_rollback_image "$NEXUS_ROOT"
if [[ "$NO_CACHE" == true ]]; then
step "无缓存重建 Nexus 镜像..."
compose_cmd "$NEXUS_ROOT" build --no-cache nexus
else
step "重建 Nexus 镜像..."
compose_cmd "$NEXUS_ROOT" build nexus
fi
if ! gate_new_image_import "$NEXUS_ROOT"; then
exit 1
fi
step "重建容器（--remove-orphans 清理旧 mysql/redis）..."
compose_cmd "$NEXUS_ROOT" up -d --no-build --remove-orphans
if ! verify_nexus_1panel_network "$NEXUS_ROOT"; then
rollback_compose_upgrade "$NEXUS_ROOT" || true
exit 1
fi
local port wiz_code i health
port="$(nexus_publish_port "$NEXUS_ROOT")"
for i in $(seq 1 30); do
health="$(curl -sf "http://127.0.0.1:${port}/health" 2>/dev/null || true)"
[[ "$health" == "ok" ]] && break
sleep 2
done
cname="$(nexus_container_name)"
if [[ -n "$cname" ]] && nexus_container_has_install_lock "$cname"; then
archive_install_wizard_in_container "$cname"
info "安装已锁定，跳过 install.html 热同步"
else
wiz_code="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app/install.html" 2>/dev/null || echo "000")"
if [[ "$wiz_code" != "200" && -x "$NEXUS_ROOT/deploy/sync-install-wizard-to-container.sh" ]]; then
NEXUS_PUBLISH_PORT="$port" NEXUS_ROOT="$NEXUS_ROOT" bash "$NEXUS_ROOT/deploy/sync-install-wizard-to-container.sh"
fi
fi
set_install_complete "$NEXUS_ROOT"
if [[ "$PRUNE_IMAGES" == true ]]; then
docker image prune -f >/dev/null 2>&1 || true
fi
NEXUS_ROOT="$NEXUS_ROOT" bash "$NEXUS_ROOT/deploy/install-nx-cli.sh" 2>/dev/null || true
if [[ -x "$NEXUS_ROOT/deploy/sync_webapp_to_container.sh" ]]; then
step "同步 Git web/app 进容器（消除镜像 vite 缓存 hash 漂移）..."
NEXUS_PUBLISH_PORT="$port" NEXUS_ROOT="$NEXUS_ROOT" bash "$NEXUS_ROOT/deploy/sync_webapp_to_container.sh" || {
warn "web/app 同步失败，继续健康检查（请手动执行 sync_webapp_to_container.sh）"
}
fi
if ! verify_health "$NEXUS_ROOT" "升级"; then
rollback_compose_upgrade "$NEXUS_ROOT" || true
exit 1
fi
# shellcheck source=./detect_deploy_runtime.sh
if [[ -f "$NEXUS_ROOT/deploy/detect_deploy_runtime.sh" ]]; then
# shellcheck disable=SC1091
source "$NEXUS_ROOT/deploy/detect_deploy_runtime.sh"
if [[ -t 0 ]]; then
prompt_ops_cron_if_missing "$NEXUS_ROOT"
else
suggest_ops_cron "$NEXUS_ROOT"
fi
fi
local vcname
vcname="$(nexus_container_name)"
if [[ -n "$vcname" ]] && nexus_container_has_install_lock "$vcname" \
&& [[ -x "$NEXUS_ROOT/deploy/verify-1panel-install-wizard.sh" ]]; then
step "升级后验收..."
NEXUS_ROOT="$NEXUS_ROOT" bash "$NEXUS_ROOT/deploy/verify-1panel-install-wizard.sh" || \
warn "验收脚本报告 FAIL — 见上方输出"
fi
}
cmd_check() {
require_root
require_token
ensure_repo
git_fetch
show_pending || true
}
parse_common_install() {
while [[ $# -gt 0 ]]; do
case "$1" in
-h|--help) usage ;;
--skip-clone) SKIP_CLONE=true; shift ;;
--fresh) FRESH_INSTALL=true; shift ;;
--reuse-secrets) REUSE_SECRETS=true; shift ;;
--profile) NEXUS_PROFILE="$2"; shift 2 ;;
--cpus) CUSTOM_CPUS="$2"; shift 2 ;;
--mem-gb|--memory-gb) CUSTOM_MEM_GB="$2"; shift 2 ;;
--domain) NEXUS_DOMAIN="$2"; shift 2 ;;
--from-env) FROM_ENV="$2"; shift 2 ;;
--root) NEXUS_ROOT="$2"; shift 2 ;;
--no-backup) NO_BACKUP=true; shift ;;
--prune|--prune-images) PRUNE_IMAGES=true; shift ;;
--dry-run) DRY_RUN=true; shift ;;
*)
error "未知参数: $1"
usage
;;
esac
done
}
parse_common_upgrade() {
while [[ $# -gt 0 ]]; do
case "$1" in
-h|--help) usage ;;
--skip-git) SKIP_GIT=true; shift ;;
--profile) NEXUS_PROFILE="$2"; shift 2 ;;
--cpus) CUSTOM_CPUS="$2"; shift 2 ;;
--mem-gb|--memory-gb) CUSTOM_MEM_GB="$2"; shift 2 ;;
--root) NEXUS_ROOT="$2"; shift 2 ;;
--branch) GIT_BRANCH="$2"; shift 2 ;;
--no-backup) NO_BACKUP=true; shift ;;
--require-backup) REQUIRE_BACKUP=true; shift ;;
--prune|--prune-images) PRUNE_IMAGES=true; shift ;;
--no-cache|--rebuild) NO_CACHE=true; shift ;;
--dry-run) DRY_RUN=true; shift ;;
--check) CHECK_ONLY=true; shift ;;
*)
error "未知参数: $1"
usage
;;
esac
done
}
main() {
local cmd="${1:-install}"
shift || true
load_secrets
case "$cmd" in
install)
parse_common_install "$@"
cmd_install
;;
upgrade)
parse_common_upgrade "$@"
cmd_upgrade
;;
check)
CHECK_ONLY=true
parse_common_upgrade "$@"
cmd_check
;;
init-token)
cmd_init_token "${1:-}"
;;
ports)
cmd_ports
;;
-h|--help|help)
usage
;;
*)
error "未知子命令: $cmd"
usage
;;
esac
}
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
main "$@"
fi
Reference in New Issue Copy Permalink