d0be2fdcf1
fix(deploy): SSH secrets 加载、Docker 运行时检测与外网探测脚本修复
...
使 deploy-production.sh 可读本机 secrets 并在非 docker 组用户下用 sudo 识别 1Panel 栈；修复 security_probe_external.sh 的 curl shift 误用与 WebSocket 自动 venv。
2026-06-07 17:34:27 +08:00
72d82d737b
fix(security): BL-07 WS 403 澄清与 code-review 跟进加固
...
外网无 token WebSocket 的 HTTP 403 为应用层拒绝而非反代故障；边端 agent
在中心 401 时停止心跳重试；install 锁定路由级 404 且归档失败 fail-closed。
同步安全规范与 BL-06 一致，门控 7/7 PASS。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-07 12:12:49 +08:00
eab35a35be
fix(security): BL-06 强制 Agent per-server key 并合并心跳单次查库
...
移除 Agent 认证与安装链路的 global API_KEY 回退，收口 risk-acceptance 接受项 2；巡检补修心跳重复 get_server 并加 assert_called_once 回归测试。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-07 11:17:41 +08:00
e5e2582743
fix(security): 外网攻击面加固 BL-01～05
...
收紧 PUBLIC 路径误匹配、强制 health/detail 与壁纸 sync 鉴权、默认关闭 OpenAPI；
安装锁定后 /api/install/* 统一 404；附探测脚本、测试与审计文档。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-07 01:45:10 +08:00
722917bfc9
fix(api): API 全量巡检 B1–B6 修复 server_ids 上限与 pending 审计
...
限制健康检查/推送/脚本执行的 server_ids 规模，补齐 pending 重试失败与删除审计，并附分批巡检报告。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 23:57:46 +08:00
ac17f91106
docs(audit): 14 页 API 契约审计与凭据轮询 SSOT 收尾
...
记录凭据轮询/pending 契约对照与生产验证，更新功能指南与附录 J，并将 pending 相关类型集中到 api.ts。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 23:50:05 +08:00
9ee5c8a708
docs(project): nx 上帝菜单巡检 round1–10 归档总结
...
新增 nexus-god-menu-audit-summary.md 汇总巡检交付与日常速查，并链入文档索引。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 23:25:44 +08:00
fb9dbcb11a
docs(deploy): 同步 1Panel 运维 SSOT（round4–8 能力）
...
README 与知识文档补全 nx cron/备份/验收；卸载脚本提示改为 1Panel 容器名。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 23:23:27 +08:00
72e46cef32
fix(deploy): 升级后镜像验收与 verify 脚本修复
...
验收检查容器内 round6/7 特性；修复 host.docker.internal 引号；nx verify 与升级后自动验收。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 23:21:44 +08:00
e5d482264d
fix(install): 向导守护 UI 与升级后 cron 交互提示
...
Docker 完成页展示 Layer 3 cron 步骤与 host_deploy_root；TTY 下 nx update 可一键安装巡检/备份 crontab。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 23:20:23 +08:00
c9e08799f9
fix(install): 守护配置对齐宿主机 cron 与验收检查
...
Nexus CI/CD / test (push) Waiting to run
Nexus CI/CD / deploy (push) Blocked by required conditions
Nexus Pre-commit Checks / quick-check (push) Waiting to run
Docker 向导提示 nx cron/宿主机路径；裸机 cron 含 db_backup；验收脚本检查 cron 与 MySQL 备份能力。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 23:11:02 +08:00
89865ec690
fix(deploy): 部署脚本自动识别 Docker 与 Supervisor 运行时
...
upgrade/deploy-production 等分流到 nexus-1panel upgrade；升级完成后提示安装 nx cron。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 23:07:47 +08:00
ba69bc3355
fix(deploy): git pull 后备份脚本不依赖可执行位
...
db_backup/backup_mysql 改为检测文件存在并用 bash 调用；install_ops_cron 一并 chmod 备份脚本。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 22:39:10 +08:00
49f159a8ce
fix(deploy): install_ops_cron 自动安装 cron 包
...
生产 Azure 主机默认无 crontab，安装脚本现会 apt install cron 并启用服务。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 22:38:43 +08:00
4e1347ba45
fix(deploy): Docker 感知 MySQL 备份与 nx cron 安装
...
升级/定时备份通过 docker exec 1Panel MySQL 容器 dump，不再依赖宿主机 mysqldump；nx 菜单新增巡检与备份 crontab 安装。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 22:37:49 +08:00
61b8d7d419
fix(deploy): health_monitor Docker 适配与巡检第三轮修补
...
Docker 生产用 docker restart；读 .env.prod 端口与容器 Telegram；已归档跳过全量热同步。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 22:25:27 +08:00
954bdbd972
fix(deploy): 验收脚本已安装时输出正确通过文案
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 21:54:03 +08:00
314bece418
fix(deploy): 验收脚本已安装时跳过 install API 检查
...
锁定后 /api/install/* 返回 403 属预期，不应判 FAIL。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 21:53:43 +08:00
687e059a86
fix(deploy): 上帝菜单巡检第二轮 — 全新安装卷冲突与验收修正
...
FRESH 清除 nexus-state 旧锁；PENDING=1 时 entrypoint 不恢复旧 env；验收脚本已安装期望 404。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 21:53:03 +08:00
baacdb0252
fix(deploy): 已归档安装向导时 sync 脚本验收期望 404
...
避免 nx update 因 install.html 已移除而误报失败。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 21:31:06 +08:00
58bdf820dc
fix(install): 安装锁定后将 install.html 归档为 .bak
...
防止已安装环境继续提供安装向导静态页；entrypoint 与升级脚本避免容器重建后恢复。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 21:30:15 +08:00
dd66d99f2d
fix(deploy): nx 上帝菜单巡检修补 1panel-network 与升级竞态
...
purge 阶段 compose 叠加 1panel overlay；菜单启动/重建与回滚后校验网络；install-auto 已安装改走 update。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 21:27:01 +08:00
107b089b16
fix(1panel): 安装锁持久化与升级后 1panel-network 校验
...
防止 nx update 重建容器后丢失安装锁、未接入 1panel-network 导致 MySQL/Redis 不可达。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 20:52:13 +08:00
1f5daebeed
fix(deploy): nx update 在 set -u 下 local root 同行展开报错
...
拆分 nexus_publish_port/set_install_complete/sync_env_prod_to_volume 的 local 声明，
避免 env_file="$root/..." 在 root 赋值前展开导致 unbound variable。
2026-06-06 20:38:11 +08:00
4ba45abf38
feat(servers): 凭据轮询登录与连接失败列表
...
- 密码/SSH密钥预设增加用户名；快速添加(IP)轮询全部预设尝试 SSH 登录
- 成功入 servers 列表；失败写入 pending_servers 并支持重试/删除
- 新增 credential_poller、try_ssh_login 与 add-by-ip/pending API
2026-06-06 20:08:48 +08:00
5a56e5a8cb
fix(1panel): 安装向导脱敏、配置一致性与 nx update 门控回滚
...
- /state 白名单脱敏；init-db db_port 修复；connection-check 后清空 redis_pass
- install.html sessionStorage token 与无 token 友好提示
- nx update: 镜像 import 门控、健康失败自动回滚、PENDING=0 回写、卷双写
- Redis 容器改名密码迁移；备份失败默认 WARN；update.sh 管道 ROOT 回退
2026-06-06 17:40:30 +08:00
850038a3ec
fix(install): 安装向导 Redis 密码不被 nx update/Compose 覆盖
...
Compose 不再注入 NEXUS_REDIS_URL；nx update 保留卷内带密码 URL；步骤 4 可从 install state 修复无密码 URL。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 11:34:26 +08:00
beb802802a
chore: 添加 scripts/git-push.sh 与本地 Gitea secrets 约定
...
push 读取 deploy/nexus-1panel.secrets.sh（gitignore），clone/pull 仍可匿名。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 11:22:07 +08:00
476d87c678
docs: Gitea 公共仓库无需凭据
...
更新 .cursorrules 与 linux-dev-paths，明确不配置/探测 GITEA token。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 11:13:07 +08:00
49f88a2cd8
fix(install): Docker .env 持久化与 entrypoint 覆盖 Compose 占位符
...
向导 init-db 后立即同步 nexus-state 卷；entrypoint 跳过不完整 env 并在启动前 source /app/.env，避免缺 DATABASE_URL 与无密码 REDIS_URL 导致容器崩溃。
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 11:08:22 +08:00
b11360015d
fix(install): 1Panel Redis 无账号与步骤 4 URL 自愈
...
Nexus CI/CD / test (push) Waiting to run
Nexus CI/CD / deploy (push) Blocked by required conditions
Nexus Pre-commit Checks / quick-check (push) Waiting to run
确立 Redis 仅密码认证（:pass@/default），隐藏误导性用户名字段；
connection-check 自动修正错误 NEXUS_REDIS_URL，并更新运维文档与验收脚本。
2026-06-06 07:51:52 +08:00
3b2856f388
fix(install): auto-resolve 1Panel Redis auth (:pass@ / default)
...
Stop prefilling root; probe multiple Redis URL formats on credential
check and persist the URL that works for init-db.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 07:15:57 +08:00
9d9fbc62f5
docs: add 1Panel operations knowledge SSOT and Redis test script
...
Consolidate install wizard, networking, URL formats, and troubleshooting
into docs/project/nexus-1panel-operations-knowledge.md.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 07:08:42 +08:00
807f4c2448
fix(install): correct Redis URL auth for 1Panel root user
...
Password must use redis://:pass@ or redis://root:pass@ host; wizard adds
redis_user field defaulting to root on 1Panel Docker installs.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 06:59:45 +08:00
da061d35db
feat(install): require MySQL/Redis credential check at wizard step 3
...
Add test-credentials API and UI gate before init-db writes .env.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 06:47:22 +08:00
d0544c9bd2
fix(1panel): grant nexus@% for Docker MySQL 1045 on install
...
Add fix-1panel-mysql-grant.sh and clearer install wizard errors when
1Panel MySQL only allows nexus@localhost.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 06:19:19 +08:00
3f5eacae60
feat(deploy): add 1Panel install wizard verify script
...
Server-side checklist for 1panel-network, container host sync, and
install API defaults before completing /app/install.html.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 06:05:15 +08:00
b25d0798f6
fix(1panel): sync MySQL/Redis container hosts on nx update
...
Upgrade was skipping 1panel-network detection; wizard now overrides stale host.docker.internal from volume/API defaults.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 05:47:43 +08:00
6b1d23c7d7
fix(1panel): sync Redis URL to container name on 1panel-network
...
Update NEXUS_REDIS_URL when detecting 1Panel-redis-*; add Redis TCP precheck and connection errors matching MySQL.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 05:39:52 +08:00
6951b8049f
fix(1panel): join 1panel-network and connect MySQL/Redis by container name
...
Per 1Panel App Store architecture, bridge apps must use Docker DNS on 1panel-network instead of host.docker.internal.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 05:35:04 +08:00
da0424a268
fix(install): MySQL TCP probe and clearer host.docker.internal errors
...
Step 2 now detects whether host MySQL is listening; init-db fails fast with 1Panel setup guidance on error 2003.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 05:22:16 +08:00
569263dddb
fix(install): remove redundant Redis/MySQL host hints in wizard step 3
...
Docker defaults already prefill host.docker.internal; drop duplicate 1Panel install reminders from the form.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 05:08:55 +08:00
646929ddff
feat(deploy): register nx globally via install-nx-cli.sh
...
Centralize chmod and /usr/local/bin symlinks; install, upgrade, update, and every nx invocation refresh the global nx command.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 04:43:00 +08:00
0a7c5ee617
fix(deploy): set executable bit on nx and refresh symlinks on update
...
Git tracked deploy/nx as 644 so /usr/local/bin/nx failed with Permission denied after pull; update.sh now chmods CLI scripts before upgrade.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 04:39:33 +08:00
93400b7793
fix(install): split Redis install check (step 2) from connection test (step 4)
...
Step 2 only TCP-probes host Redis without blocking the wizard; step 4 runs /connection-check on MySQL and Redis from .env before creating the admin account.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 04:32:47 +08:00
a5aa5f81ad
docs(deploy): merge nx god into unified menu and expand README
...
Consolidate install and ops into a single nx menu with one-click update via update.sh; document all curl install/update entry points in the root README.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 04:27:11 +08:00
86c865e710
feat(deploy): add update.sh and always rebuild on upgrade
...
Upgrade no longer exits when Git is already up to date; it still rebuilds the Nexus image to pick up entrypoint changes. Add deploy/update.sh as the one-command entry point.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 04:16:15 +08:00
1bd69077a2
fix(deploy): auto-remove legacy Compose MySQL containers on upgrade
...
Run uninstall-mysql-compose before install/upgrade and pass --remove-orphans so nexus-prod mysql orphans are stopped after the service is dropped from compose.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 03:32:00 +08:00
f37ebf8621
feat(docker): remove bundled MySQL from production Compose stack
...
Production installs now run only the Nexus container; MySQL and Redis are self-hosted on the machine or 1Panel, with install wizard defaults pointing at host.docker.internal.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 03:27:57 +08:00
e42dc77127
feat(deploy): add redis compose uninstall; require Redis in install wizard
...
Step 2 blocks until Redis connects; uninstall-redis-compose.sh removes legacy
nexus-prod-redis container without touching host/1Panel Redis.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-06 02:51:52 +08:00
Nexus Agent