feat(deploy): add update.sh and always rebuild on upgrade

Upgrade no longer exits when Git is already up to date; it still rebuilds the Nexus image to pick up entrypoint changes. Add deploy/update.sh as the one-command entry point.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/README-1panel.md

@@ -56,6 +56,26 @@ bash /opt/nexus/deploy/uninstall-redis-compose.sh --purge-volume
 2. 网站 → 创建站点 → 反向代理 `http://127.0.0.1:8600`
 3. 自定义配置参考：`deploy/1panel/openresty-nexus.conf.example`
 
+## 一键更新（日常）
+
+```bash
+cd /opt/nexus && bash deploy/update.sh
+```
+
+或：`bash deploy/nexus-1panel.sh upgrade` · `nx god` → `b`
+
+| 选项 | 说明 |
+|------|------|
+| `--check` | 仅查 Git 是否有新提交，不重建 |
+| `--no-cache` | 强制无缓存重建镜像（entrypoint 改了必用） |
+| `--no-backup` | 跳过 MySQL 备份 |
+
+远程一条命令：
+
+```bash
+curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/update.sh" | bash
+```
+
 ## 已 clone 到 /opt/nexus
 
 ```bash
@@ -102,7 +122,7 @@ MySQL 密码由你在自建库时设定，安装向导步骤 3 填写。
 | 迁机保留旧密钥 | `nexus-1panel.sh install --from-env /path/to/old/.env` |
 | 显式复用 secrets 文件 | `nexus-1panel.sh install --reuse-secrets`（**勿用于新机**） |
 
-**Gitea 令牌**：公共仓库 `curl | bash` / `git clone` **不需要**配置。仅私人仓库时可选 `/root/.nexus-deploy.env` 或 `nexus-1panel.sh init-token`。
+**Git 凭据**：仓库已公开，`curl | bash`、`git clone`、`git pull` **均无需令牌**。开发机 `git push` 需在 Gitea 网页登录一次或本机配置 git 凭据（与安装脚本无关）。
 
 ## 安装向导 `/app/install.html`
 

deploy/install-nexus-fresh.sh

@@ -125,11 +125,13 @@ install_root_commands() {
         "${NEXUS_ROOT}/deploy/nexus-1panel.sh" \
         "${NEXUS_ROOT}/deploy/sync-install-wizard-to-container.sh" \
         "${NEXUS_ROOT}/deploy/uninstall-redis-compose.sh" \
-        "${NEXUS_ROOT}/deploy/uninstall-mysql-compose.sh" 2>/dev/null || true
+        "${NEXUS_ROOT}/deploy/uninstall-mysql-compose.sh" \
+        "${NEXUS_ROOT}/deploy/update.sh" 2>/dev/null || true
     ln -sf "${NEXUS_ROOT}/deploy/nx" /usr/local/bin/nx
     ln -sf "${NEXUS_ROOT}/deploy/nexus-1panel.sh" /usr/local/bin/nexus-1panel
     ln -sf "${NEXUS_ROOT}/deploy/install-nexus-fresh.sh" /usr/local/bin/nexus-fresh
     ln -sf "${NEXUS_ROOT}/deploy/quick-install.sh" /usr/local/bin/nexus-install
+    ln -sf "${NEXUS_ROOT}/deploy/update.sh" /usr/local/bin/nexus-update
     ln -sf "${NEXUS_ROOT}/deploy/install-1panel-docker.sh" /usr/local/bin/nexus-1panel-docker 2>/dev/null || true
     info "已注册全局命令（root 直接输入即可）:"
     info "  nexus-1panel-docker — 重装服务器（1Panel + Docker + Nexus）"
@@ -137,6 +139,7 @@ install_root_commands() {
     info "  nexus-1panel        — 底层 install/upgrade 脚本"
     info "  nx                  — 主菜单 / nx god 上帝菜单"
     info "  nexus-fresh     — 全新安装脚本"
+    info "  nexus-update    — 一键更新（pull + 重建镜像）"
 }
 
 phase_preflight() {

deploy/nexus-1panel.sh

@@ -54,6 +54,7 @@ REUSE_SECRETS=false
 FROM_ENV="${NEXUS_FROM_ENV}"
 NO_BACKUP=false
 PRUNE_IMAGES=false
+NO_CACHE=false
 CHECK_ONLY=false
 DRY_RUN=false
 CUSTOM_CPUS=""
@@ -81,7 +82,7 @@ Nexus 1Panel 一键脚本
   --domain NAME                 覆盖域名
 
 升级选项:
-  --no-backup  --prune  --dry-run
+  --no-backup  --prune  --no-cache  --dry-run  --check（仅查 Git，不重建）
 
 Git: 公共仓库匿名 clone（无需令牌）；私人仓库见 init-token
 EOF
@@ -770,10 +771,8 @@ cmd_upgrade() {
     resolve_profile
     check_ports_preflight "$NEXUS_ROOT"
     git_fetch
+    show_pending || true
 
-    if ! show_pending; then
-        exit 0
-    fi
     if [[ "$CHECK_ONLY" == true ]]; then
         exit 0
     fi
@@ -782,13 +781,30 @@ cmd_upgrade() {
         exit 0
     fi
 
-    backup_mysql "$NEXUS_ROOT"
-    git_upgrade
+    local behind
+    behind="$(commits_behind)"
+    if [[ "$behind" != "0" ]]; then
+        backup_mysql "$NEXUS_ROOT"
+        git_upgrade
+    else
+        info "Git 已最新，仍重建 Docker 镜像与容器（避免旧 entrypoint 缓存）"
+        if [[ "$NO_BACKUP" != true ]]; then
+            backup_mysql "$NEXUS_ROOT"
+        fi
+    fi
+
     apply_pool_to_env_prod "$NEXUS_ROOT" "$(profile_env_file "$NEXUS_ROOT")"
     save_host_profile "$NEXUS_ROOT"
     purge_legacy_bundled_services "$NEXUS_ROOT"
+    if [[ "$NO_CACHE" == true ]]; then
+        step "无缓存重建 Nexus 镜像..."
+        compose_cmd "$NEXUS_ROOT" build --no-cache nexus
+    fi
     step "重建容器（--remove-orphans 清理旧 mysql/redis）..."
     compose_cmd "$NEXUS_ROOT" up -d --build --remove-orphans
+    if [[ -x "$NEXUS_ROOT/deploy/sync-install-wizard-to-container.sh" ]]; then
+        NEXUS_ROOT="$NEXUS_ROOT" bash "$NEXUS_ROOT/deploy/sync-install-wizard-to-container.sh" || true
+    fi
     if [[ "$PRUNE_IMAGES" == true ]]; then
         docker image prune -f >/dev/null 2>&1 || true
     fi
@@ -838,6 +854,7 @@ parse_common_upgrade() {
             --branch) GIT_BRANCH="$2"; shift 2 ;;
             --no-backup) NO_BACKUP=true; shift ;;
             --prune|--prune-images) PRUNE_IMAGES=true; shift ;;
+            --no-cache|--rebuild) NO_CACHE=true; shift ;;
             --dry-run) DRY_RUN=true; shift ;;
             --check) CHECK_ONLY=true; shift ;;
             *)

deploy/update.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Nexus 6.0 — 一键更新（拉代码 + 重建镜像 + 重启）
+#
+# 已在 /opt/nexus:
+#   bash deploy/update.sh
+#   bash deploy/update.sh --no-cache    # 强制无缓存重建（entrypoint/Dockerfile 变更后）
+#
+# 远程一条命令:
+#   curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/update.sh" | bash
+#
+set -euo pipefail
+ROOT="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/.." && pwd)"
+exec bash "$ROOT/deploy/nexus-1panel.sh" upgrade "$@"