fix(deploy): private Gitea raw 404 — use clone or token API download

Anonymous curl saved "Not found." causing "Not: command not found";
add download-install-fresh.sh, --skip-clone, and script self-check.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/README-1panel.md

@@ -3,11 +3,14 @@
 ## 全新安装（1Panel 风格，推荐新机）
 
 ```bash
-curl -sSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/install-nexus-fresh.sh" -o /tmp/install-nexus-fresh.sh
-sudo bash /tmp/install-nexus-fresh.sh
-# 4核16G: sudo bash /tmp/install-nexus-fresh.sh --profile 4c16g
+echo 'NEXUS_GITEA_TOKEN=你的令牌' > /root/.nexus-deploy.env && chmod 600 /root/.nexus-deploy.env
+git clone "http://admin:你的令牌@66.154.115.8:3000/admin/Nexus.git" /opt/nexus
+cd /opt/nexus && sudo bash deploy/install-nexus-fresh.sh --skip-clone
+# 4核16G: 加 --profile 4c16g
 ```
 
+私人仓库无法用匿名 `curl .../raw/...`（会下到 `Not found.`）。
+
 安装完成后浏览器打开 `https://api.synaglobal.vip/app/install.html` 完成向导。
 
 ## NX 菜单（日常运维）

deploy/download-install-fresh.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# 从私人 Gitea 下载 install-nexus-fresh.sh 并执行（解决匿名 raw 404 → "Not: command not found"）
+#
+# 用法:
+#   echo 'NEXUS_GITEA_TOKEN=你的令牌' > /root/.nexus-deploy.env && chmod 600 /root/.nexus-deploy.env
+#   curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/download-install-fresh.sh" -o /tmp/dl.sh
+#   sudo bash /tmp/dl.sh
+#
+# 推荐（已 clone 时无需下载）:
+#   cd /opt/nexus && git pull && sudo bash deploy/install-nexus-fresh.sh --skip-clone
+
+set -euo pipefail
+
+NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
+NEXUS_GIT_BRANCH="${NEXUS_GIT_BRANCH:-main}"
+OUT="${OUT:-/tmp/install-nexus-fresh.sh}"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m'
+
+err() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
+
+for cf in /root/.nexus-deploy.env /root/.nexus-secrets/nexus.env; do
+    [[ -f "$cf" ]] && set -a && source "$cf" && set +a && break
+done
+
+if [[ -z "${NEXUS_GITEA_TOKEN:-}" ]]; then
+    err "缺少 NEXUS_GITEA_TOKEN"
+    err "  echo 'NEXUS_GITEA_TOKEN=...' > /root/.nexus-deploy.env && chmod 600 /root/.nexus-deploy.env"
+    exit 1
+fi
+
+API_URL="http://${NEXUS_GITEA_HOST}/api/v1/repos/admin/Nexus/raw/deploy/install-nexus-fresh.sh?ref=${NEXUS_GIT_BRANCH}"
+
+if ! curl -fsSL -H "Authorization: token ${NEXUS_GITEA_TOKEN}" "$API_URL" -o "$OUT"; then
+    err "下载失败: $API_URL"
+    exit 1
+fi
+
+if ! head -1 "$OUT" | grep -q '^#!/'; then
+    err "下载内容不是有效脚本（私人仓库 raw 需令牌，勿用无认证 curl）"
+    err "文件开头: $(head -1 "$OUT" | cut -c1-80)"
+    exit 1
+fi
+
+chmod +x "$OUT"
+echo -e "${GREEN}[OK]${NC} 已下载 $OUT"
+exec bash "$OUT" "$@"

deploy/install-nexus-fresh.sh

@@ -5,12 +5,16 @@
 # 适用：新机已装 1Panel / Docker，空库，走 /app/install.html 安装向导
 # 风格参考 1Panel quick_start.sh：分阶段检查 + 结束输出访问地址
 #
-# 用法:
-#   curl -sSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/install-nexus-fresh.sh" -o /tmp/install-nexus-fresh.sh
-#   sudo bash /tmp/install-nexus-fresh.sh
+# 用法（私人 Gitea 勿用无认证 raw，会下到 "Not found."）:
 #
-#   sudo bash /tmp/install-nexus-fresh.sh --profile 4c16g
-#   sudo bash /tmp/install-nexus-fresh.sh --domain nexus.example.com
+#   推荐 — 已 clone:
+#     cd /opt/nexus && sudo bash deploy/install-nexus-fresh.sh --skip-clone
+#
+#   或 — 带令牌下载后执行:
+#     echo 'NEXUS_GITEA_TOKEN=...' > /root/.nexus-deploy.env && chmod 600 /root/.nexus-deploy.env
+#     sudo bash deploy/download-install-fresh.sh
+#
+#   sudo bash deploy/install-nexus-fresh.sh --profile 4c16g
 #
 # 凭据（任选其一，无需 export）:
 #   - /root/.nexus-deploy.env
@@ -20,6 +24,17 @@
 
 set -euo pipefail
 
+_install_self="$(readlink -f "${BASH_SOURCE[0]}")"
+if ! head -1 "$_install_self" | grep -q '^#!/'; then
+    echo "[ERROR] 脚本文件无效。若用 curl 下载，请改用: bash deploy/download-install-fresh.sh" >&2
+    exit 1
+fi
+if grep -qiE '^(Not found|404)' "$_install_self" 2>/dev/null; then
+    echo "[ERROR] 下载到的是 Gitea 404 页面，不是安装脚本。" >&2
+    echo "  请: cd /opt/nexus && git pull && sudo bash deploy/install-nexus-fresh.sh --skip-clone" >&2
+    exit 1
+fi
+
 # ── 默认配置（与 SECRETS.md / nexus-1panel 一致）──
 NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
 NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
@@ -51,6 +66,7 @@ Nexus 6.0 全新安装（1Panel + Docker）
   --domain NAME       公网域名（默认: ${NEXUS_DOMAIN}）
   --profile NAME      资源档位 1c4g|2c8g|4c16g（默认: 2c8g）
   --root PATH         安装目录（默认: /opt/nexus）
+  --skip-clone        已在 /opt/nexus，不重新 clone
   --skip-1panel-check 不检测 1Panel 是否已安装
   -h, --help          显示帮助
 
@@ -60,6 +76,7 @@ EOF
 }
 
 SKIP_1PANEL_CHECK=false
+SKIP_CLONE=false
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
@@ -67,6 +84,7 @@ while [[ $# -gt 0 ]]; do
         --domain) NEXUS_DOMAIN="$2"; shift 2 ;;
         --profile) NEXUS_PROFILE="$2"; shift 2 ;;
         --root) NEXUS_ROOT="$2"; shift 2 ;;
+        --skip-clone) SKIP_CLONE=true; shift ;;
         --skip-1panel-check) SKIP_1PANEL_CHECK=true; shift ;;
         *) error "未知参数: $1"; usage; exit 1 ;;
     esac
@@ -180,6 +198,17 @@ git_clone_url() {
 
 phase_clone() {
     step "阶段 4/6 — 获取 Nexus 代码"
+    if [[ "$SKIP_CLONE" == true ]]; then
+        if [[ ! -d "${NEXUS_ROOT}/.git" ]]; then
+            error "--skip-clone 但 ${NEXUS_ROOT} 不是 git 仓库"
+            exit 1
+        fi
+        load_credentials
+        info "跳过 clone，使用现有 ${NEXUS_ROOT}"
+        info "版本: $(git -C "$NEXUS_ROOT" log -1 --oneline 2>/dev/null || echo '?')"
+        chmod +x "${NEXUS_ROOT}/deploy/"*.sh 2>/dev/null || true
+        return 0
+    fi
     load_credentials
     if [[ -z "${NEXUS_GITEA_TOKEN:-}" ]]; then
         error "缺少 Gitea 令牌，无法 clone 私人仓库"