47 lines
1.9 KiB
Markdown
47 lines
1.9 KiB
Markdown
|
# 2026-06-06 — 1Panel 配置 / 安装向导 / nx update 根治
|
||
|
|
|
||
|
|
## 摘要
|
||
|
|
|
||
|
|
根治安装向导 `/state` 敏感信息泄露、`init-db` db_port NameError、`nx update` 无门控与回滚、配置多层不一致等问题。
|
||
|
|
|
||
|
|
## 动机
|
||
|
|
|
||
|
|
生产 1Panel 审计发现：升级可覆盖 Redis 密码 URL、向导状态 API 返回明文 token、MySQL 连接失败时抛 NameError、备份失败会阻断或半残升级。
|
||
|
|
|
||
|
|
## 涉及文件
|
||
|
|
|
||
|
|
- `server/api/install.py` — 白名单 `/state`、`db_port` 修复、修复后清空 `redis_pass`
|
||
|
|
- `web/app/install.html` — `sessionStorage` token、无 token 提示
|
||
|
|
- `server/config.py` — 连接池占位注释
|
||
|
|
- `docker/docker-compose.prod.yml`、`docker-compose.1panel.yml`、`docker/README.md`、`docker/.env.prod.example`
|
||
|
|
- `deploy/nexus-1panel.sh` — 门控、回滚、PENDING 回写、卷双写、Redis 迁移、备份容错
|
||
|
|
- `deploy/update.sh` — 管道执行 ROOT 回退
|
||
|
|
- `deploy/sync-install-wizard-to-container.sh` — 非静默、可配置端口
|
||
|
|
- `tests/test_security_unit.py` — 脱敏与 redis_pass 清理回归
|
||
|
|
- `docs/design/specs/2026-06-06-1panel-config-hardening-design.md`
|
||
|
|
- `docs/project/nexus-1panel-operations-knowledge.md`
|
||
|
|
|
||
|
|
## 迁移 / 重启
|
||
|
|
|
||
|
|
- 无需 DB 迁移
|
||
|
|
- 需 `nx update` 或重建镜像使部署脚本与后端生效
|
||
|
|
- 已锁定环境升级后 `NEXUS_INSTALL_WIZARD_PENDING` 应变为 `0`
|
||
|
|
|
||
|
|
## 验证方式
|
||
|
|
|
||
|
|
```bash
|
||
|
|
.venv/bin/pytest tests/test_security_unit.py -q
|
||
|
|
.venv/bin/python -c "import server.main"
|
||
|
|
ruff check server/ --select F
|
||
|
|
# 生产
|
||
|
|
sudo nx update
|
||
|
|
bash deploy/verify-1panel-install-wizard.sh
|
||
|
|
curl -s http://127.0.0.1:8600/api/install/state | jq .
|
||
|
|
```
|
||
|
|
|
||
|
|
## 运维注意
|
||
|
|
|
||
|
|
- 密钥/Redis URL 轮换：改 `docker/.env.prod` 后 `nx update` 会 `sync_env_prod_to_volume` 双写卷内 `.env`
|
||
|
|
- 升级加 `--require-backup` 可在 mysqldump 失败时中止
|
||
|
|
- 推荐 `cd /opt/nexus && bash deploy/update.sh`，避免 `curl | bash` 路径解析失败
|