From e5929694c30c3350eb687be9437c4013c53bd001 Mon Sep 17 00:00:00 2001
From: r <r@local>
Date: Sun, 21 Jun 2026 10:01:40 +0800
Subject: [PATCH] =?UTF-8?q?fix(btpanel):=20bootstrap=20=E5=86=99=E5=85=A5?=
 =?UTF-8?q?=20panel/config/api.json?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

宝塔读取 config/api.json 而非 data/api.json，错误路径导致白名单与 token 不生效。

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../2026-06-21-btpanel-api-json-path-fix.md   | 26 +++++++++++++++++++
 .../infrastructure/btpanel/ssh_bootstrap.py   |  2 +-
 2 files changed, 27 insertions(+), 1 deletion(-)
 create mode 100644 docs/changelog/2026-06-21-btpanel-api-json-path-fix.md

diff --git a/docs/changelog/2026-06-21-btpanel-api-json-path-fix.md b/docs/changelog/2026-06-21-btpanel-api-json-path-fix.md
new file mode 100644
index 00000000..8780618f
--- /dev/null
+++ b/docs/changelog/2026-06-21-btpanel-api-json-path-fix.md
@@ -0,0 +1,26 @@
+# 2026-06-21 宝塔 bootstrap 写入正确 api.json 路径
+
+## 摘要
+
+SSH bootstrap 将 API 配置写入 `/www/server/panel/data/api.json`，而宝塔面板实际读取 `/www/server/panel/config/api.json`，导致白名单与 token 未生效，所有代理 API 返回「IP校验失败」。
+
+## 动机
+
+生产验收：8 台已 configured 服务器全部代理失败；子机 exec 显示 `config/api.json` 白名单仍为旧 IP `172.96.253.26`，与 `data/api.json` 不一致。
+
+## 涉及文件
+
+- `server/infrastructure/btpanel/ssh_bootstrap.py` — `API_PATH` 改为 `panel/config/api.json`
+- `tests/test_btpanel_ssh_bootstrap.py` — `exit_code=0` 回归用例（上一轮）
+
+## 迁移 / 重启
+
+- 需部署 API 后，对已 configured 服务器**重新执行 bootstrap**（手动或批量）以合并白名单与 token 到正确文件。
+- 无需 DB 迁移。
+
+## 验证
+
+```bash
+.venv/bin/pytest tests/test_btpanel_ssh_bootstrap.py -q
+# 生产：POST /api/btpanel/servers/{id}/bootstrap 后 GET .../system/total 应返回真实指标而非 IP 错误
+```
diff --git a/server/infrastructure/btpanel/ssh_bootstrap.py b/server/infrastructure/btpanel/ssh_bootstrap.py
index 8169ce29..9ec203ab 100644
--- a/server/infrastructure/btpanel/ssh_bootstrap.py
+++ b/server/infrastructure/btpanel/ssh_bootstrap.py
@@ -19,7 +19,7 @@ import json, os, secrets, sys, subprocess
 
 PANEL_ROOT = "/www/server/panel"
 DATA_DIR = os.path.join(PANEL_ROOT, "data")
-API_PATH = os.path.join(DATA_DIR, "api.json")
+API_PATH = os.path.join(PANEL_ROOT, "config", "api.json")
 
 def read_text(path, default=""):
     try: