admin/Nexus
1
0
Fork 0
Code Issues Pull Requests Actions 91 Packages Projects Releases Wiki Activity

Compare commits

base: admin/Nexus:bfda70bbe72f027051c83fcb67007ecaa3e6f049
Branches Tags
admin/Nexus:release/20260708-axs admin/Nexus:main admin/Nexus:merge/release-20260708-axs-into-main
..
compare: admin/Nexus:release/20260708-axs
Branches Tags
admin/Nexus:main admin/Nexus:merge/release-20260708-axs-into-main admin/Nexus:release/20260708-axs

5 Commits
bfda70bbe7 .. release/20260708-axs

Author SHA1 Message Date
Codex Release Bot 8363746cf6 docs: clarify release bundle hash verification 2026-07-09 05:14:29 +08:00
Codex Release Bot b49dad8bda chore: ignore local codex virtualenvs 2026-07-09 05:14:04 +08:00
Codex Release Bot 279259092d release: publish gitea allowlist and harden bundle deploy 2026-07-09 05:12:54 +08:00
Codex Release Bot 74149e0d90 docs: add nexus release merge guide 2026-07-09 00:14:19 +08:00
Codex Release Bot 1933f0af6e release: nexus btpanel session fix and app-v2 2026-07-08 22:31:31 +08:00
4194 changed files with 116723 additions and 16085 deletions
Expand all files Collapse all files
.cursor/plans/nexus_全面代码审计_a33e6fc2.plan.md → .cursor/plans/nexus_鍏ㄩ潰浠ｇ爜瀹¤_a33e6fc2.plan.md
View File
.cursor/rules/agent-exploration.mdc
+44
View File
@@ -0,0 +1,44 @@
---
description: 减少盲目搜文件、控制 Read 次数与 token 消耗
alwaysApply: true
---
# Agent 探索约束（省 token）
## 开始前
1. 读根目录 `AGENTS.md` 的「代码地图」与「问题 → 文件」表
2. 架构/API 全览只读 `docs/project/nexus-functional-development-guide.md`（或用户指定的 §），禁止为找结构全库 Grep
3. 用户已给出路径/文件名时，只读该路径，禁止扩大范围
## 搜索顺序
```
AGENTS.md / 功能指南 § → Grep（带 path）→ Read（≤3 个文件）→ 仍不够再扩一圈
```
- **禁止**无 `path` 的全仓库 `Grep` / `Glob`（除非用户明确要求全库）
- **Grep 优先于 Read**；Glob 只用于定位文件名，不逐个 Read 全部匹配
- 同一任务 **Read 不超过 5 个文件**；找到答案后立即停止
- 不要重复 Read 已在本对话出现过的文件
## 分层定位（禁止跨层乱搜）
| 层 | 路径 |
|----|------|
| HTTP 路由 | `server/api/<module>.py` |
| 业务 | `server/application/services/` |
| 数据访问 | `server/infrastructure/` |
| 模型 | `server/domain/models/` |
| 前端页 | `frontend/src/pages/` |
| 前端路由 | `frontend/src/router/index.ts` |
| 前端 API 客户端 | `frontend/src/api/` |
真实前端源码在 `frontend/src/`，不是 `web/app/*.html`（那是构建产物）。
## 文档索引
- 功能 SSOT：`docs/project/nexus-functional-development-guide.md`
- 文档导航：`docs/README.md`
- 本地路径/MCP：`docs/project/linux-dev-paths.md`
- 运维（连机/exec）：用户 Skill `Nexus平台` 或 `docs/project/nexus-1panel-operations-knowledge.md`
.cursor/rules/nexus-security.mdc
+1 -1
View File
@@ -11,7 +11,7 @@ alwaysApply: false
| 调用方 | 机制 |
|--------|------|
| 管理端 API | JWT Bearer + 可选 TOTP |
| Agent | `X-API-Key`（全局或 per-server `agent_api_key`） |
| Agent | `X-API-Key`（仅 per-server `agent_api_key`；经 `POST /api/servers/{id}/agent-key` 生成，BL-06 起无 global 回退） |
| WebSocket | JWT query param |
| 安装向导 | 无 JWT（仅安装模式可用） |
.cursor/settings.json
+7
View File
@@ -0,0 +1,7 @@
{
"plugins": {
"compound-engineering": {
"enabled": true
}
}
}
.cursorrules
+15 -2
View File
@@ -5,13 +5,14 @@
## 栈
FastAPI + Async SQLAlchemy + Redis · Vue 3 + Vuetify 4 SPA（14 页）· Vite → `web/app/`
FastAPI + Async SQLAlchemy + Redis · Vue 3 + Vuetify 4 SPA（15 页）· Vite → `web/app/`
## 环境（勿在仓库写密码）
- 生产: `https://api.synaglobal.vip` · 端口 8600 · `ssh nexus`
- 本地: `~/Nexus` 或 `$NEXUS_ROOT` · 见 [linux-dev-paths.md](docs/project/linux-dev-paths.md)
- 凭据: 仅 `.env`（不入 git）
- **Gitea**：clone/pull 可匿名；**push** 用 `bash scripts/git-push.sh`（凭据在 `deploy/nexus-1panel.secrets.sh`，已 gitignore，勿提交）
## 关键路径
@@ -28,13 +29,25 @@ FastAPI + Async SQLAlchemy + Redis · Vue 3 + Vuetify 4 SPA（14 页）· Vite
见 `.cursor/rules/perfect-implementation.mdc` · `nexus-security.mdc` — 完美实现、无静默吞错、无明文密钥、CUD 审计。
## Agent Git / diff（省 token、防卡顿）
- **禁止**无路径过滤的全仓 `git diff` / `git diff HEAD`（`web/app/assets` 构建产物可导致数十万行输出）。
- **优先**：`git diff --stat` 或 `git diff -- frontend/src server/api tests docs`。
- **提交**：只 `git add` 源码与文档；`web/app/assets/*` 由 Docker 内 `vite build` 生成，勿为 diff 把海量 hash 文件纳入上下文。
- **部署/门控**：定向 pytest（如 `tests/integration/test_*.py`），避免并行全仓 diff + 本地 build + 远程镜像重建。
## 部署
默认 **本机 rsync 直传**（不 push Gitea）：
```bash
bash deploy/pre_deploy_check.sh && bash deploy/deploy-production.sh
```
前端: `cd frontend && npx vite build` → tar/scp（见 `deploy/deploy-frontend.sh`）
仅同步源码（不重建镜像）：`bash deploy/rsync-local-to-server.sh`
仍走 Gitea 拉取：`NEXUS_DEPLOY_VIA_GIT=1 bash deploy/deploy-production.sh`
前端: `cd frontend && npx vite build` → 部署脚本内 tar/scp 到 `web/app/`
## 进度条（改代码时输出）
.dockerignore
+40 -29
View File
@@ -1,29 +1,40 @@
.git
.gitignore
.claude
.cursor
**/__pycache__
**/*.pyc
**/.pytest_cache
**/.mypy_cache
**/.ruff_cache
.coverage
htmlcov/
frontend/node_modules
frontend/dist
node_modules
.env
docker/.env
docker/runtime
tests/
docs/
standards/
*.md
!docker/README.md
web/uploads
backups/
deploy/gate_log.jsonl
.git
.gitignore
.claude
.cursor
**/__pycache__
**/*.pyc
**/.pytest_cache
**/.mypy_cache
**/.ruff_cache
.coverage
htmlcov/
frontend/node_modules
frontend-v2/node_modules
frontend/dist
node_modules
.venv
.venv-*
venv
.pytest_cache
.ruff_cache
.playwright-mcp
2025.2
=2025.2
*.bak-
.env
docker/.env
docker/runtime
tmp/
tests/
docs/
standards/
*.md
!docker/README.md
web/uploads
backups/
deploy/gate_log.jsonl
.env.example
-63
View File
@@ -1,63 +0,0 @@
# Nexus Environment Configuration
# Copy this file to .env and modify values for your deployment.
# Or run the web installer at /app/install.html to auto-generate this file.
#
# Generate secret keys: openssl rand -hex 32
# ── Brand ──
NEXUS_SYSTEM_NAME=Nexus
NEXUS_SYSTEM_TITLE=Nexus — 服务器运维管理平台
# ── Server ──
NEXUS_HOST=0.0.0.0
NEXUS_PORT=8600
# ── Deployment (auto-set by installer) ──
NEXUS_DEPLOY_PATH=/opt/nexus
# Comma-separated frontend origins for CORS
NEXUS_CORS_ORIGINS=http://localhost:8600
# Base URL for Agent heartbeat reporting
NEXUS_API_BASE_URL=http://localhost:8600
# ── Database (MySQL, REQUIRED) ──
NEXUS_DATABASE_URL=mysql+aiomysql://root:password@127.0.0.1:3306/nexus
# Pool params: auto-calculated by installer from MySQL max_connections
# Formula: pool_size = max(20, maxConn*0.4), overflow = max(20, maxConn*0.3)
# Default below matches MySQL max_connections=400 (160+120=280 max)
# install wizard will overwrite these with values tuned to your MySQL instance
NEXUS_DB_POOL_SIZE=160
NEXUS_DB_MAX_OVERFLOW=120
# ── Security (REQUIRED — generate with: openssl rand -hex 32) ──
NEXUS_SECRET_KEY=change-me-use-openssl-rand-hex-32
NEXUS_API_KEY=change-me-use-openssl-rand-hex-32
NEXUS_ENCRYPTION_KEY=
# ── Redis (REQUIRED) ──
NEXUS_REDIS_URL=redis://127.0.0.1:6379/0
# ── SSH ──
NEXUS_SSH_STRICT_HOST_CHECKING=false
# ── Alert Thresholds (%) ──
NEXUS_CPU_ALERT_THRESHOLD=80
NEXUS_MEM_ALERT_THRESHOLD=80
NEXUS_DISK_ALERT_THRESHOLD=80
# ── Health Check ──
NEXUS_HEALTH_CHECK_INTERVAL=60
# ── Telegram Alerts (optional — configure in Settings UI) ──
NEXUS_TELEGRAM_BOT_TOKEN=
NEXUS_TELEGRAM_CHAT_ID=
# ── MySQL MCP (@yclenove/mysql-mcp-server — run: python scripts/sync_mysql_mcp_env.py) ──
# Cursor 从项目根 .env 读取；与 NEXUS_DATABASE_URL 保持一致；默认只读
# MYSQL_HOST=127.0.0.1
# MYSQL_PORT=3306
# MYSQL_USER=root
# MYSQL_PASSWORD=password
# MYSQL_DATABASE=nexus
# MYSQL_READONLY=true # production / MCP read-only
# MYSQL_READONLY=false # local dev: full DML/DDL via MCP
# MYSQL_DATABASE_ALLOWLIST=nexus
.gitea/workflows/ci-cd.yml
+42 -2
View File
@@ -35,18 +35,58 @@ jobs:
run: mypy server/ --ignore-missing-imports
continue-on-error: true # Type errors don't block deployment yet
- name: Run tests with coverage
- name: Run fast tests with coverage
run: |
coverage run -m pytest tests/ -v --tb=short
coverage run -m pytest tests/ -m "not chain and not slow" -q --tb=short
coverage report --fail-under=50
coverage xml
- name: Run chain tests
run: pytest tests/chain -m chain -q --tb=short
continue-on-error: true
- name: Upload coverage report
uses: actions/upload-artifact@v4
with:
name: coverage-report
path: coverage.xml
# ── CI: E2E (main only, optional secrets) ──
e2e:
runs-on: ubuntu-latest
needs: test
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "22"
- name: Install frontend dependencies
working-directory: frontend
run: npm ci
- name: Install Playwright Chromium
working-directory: frontend
run: npx playwright install chromium
- name: Run Playwright E2E
working-directory: frontend
env:
NEXUS_E2E_BASE: ${{ secrets.NEXUS_E2E_BASE || 'http://127.0.0.1:8600' }}
NEXUS_E2E_USER: ${{ secrets.NEXUS_E2E_USER || 'admin' }}
NEXUS_E2E_PASSWORD: ${{ secrets.NEXUS_E2E_PASSWORD }}
run: |
if [ -z "$NEXUS_E2E_PASSWORD" ]; then
echo "NEXUS_E2E_PASSWORD not set — skip E2E"
exit 0
fi
npm run test:e2e
continue-on-error: true
# ── CD: Deploy ──
deploy:
needs: test # Only deploy if tests pass
.gitignore
+90 -85
View File
@@ -1,85 +1,90 @@
# Nexus — Python
__pycache__/
*.py[cod]
*$py.class
*.egg-info/
build/
.eggs/
# Environment (NEVER commit — contains production credentials)
.env
.install_locked
.install_state.json
SECRETS.md
*.pem
.env.*
.venv/
venv/
ENV/
# Agent memory (local MCP persistence, do not commit)
.claude/mcp-memory.jsonl
# MCP tool data (local development artifacts)
.megamemory/
.playwright-mcp/
frontend/test-results/
tmp/
# IDE
.vscode/
.idea/
*.swp
*.swo
*~
# OS
.DS_Store
Thumbs.db
# Logs
*.log
nexus.log
# Node offline cache for WSL install (large tarball)
.cache/
# Test
.pytest_cache/
htmlcov/
.coverage
coverage.xml
# Node (for Tailwind/Alpine.js build)
node_modules/
web/css/tailwind-output.css
# Build output (Vite/Vuetify frontend)
# SPA 构建产物纳入 Git，便于服务器 git pull 部署（见 deploy/deploy-frontend.sh）
# 仍忽略本地临时文件
web/app/assets/.tmp/
# Legacy dist dir (no longer used)
**/dist/
# Uploads
web/uploads/
# Data (sensitive)
web/data/config.php
web/data/*.db
# Backups
backups/
# Docker local secrets
docker/.env
docker/.env.prod
!docker/.env.example
!docker/.env.prod.example
scripts/npm-proxy.env
# Deploy
deploy/*.key
# Backups
backups/
# Nexus — Python
__pycache__/
*.py[cod]
*$py.class
*.egg-info/
build/
.eggs/
# Environment (NEVER commit — contains production credentials)
.env
.install_locked
.install_state.json
SECRETS.md
.git-askpass-nexus.sh
deploy/nexus-1panel.secrets.sh
*.pem
.env.*
.venv/
.venv-*/
venv/
ENV/
# Agent memory (local MCP persistence, do not commit)
.claude/mcp-memory.jsonl
# MCP tool data (local development artifacts)
.megamemory/
.playwright-mcp/
frontend/test-results/
frontend/e2e/.auth/
tmp/
# IDE
.vscode/
.idea/
*.swp
*.swo
*~
# OS
.DS_Store
Thumbs.db
# Logs
*.log
nexus.log
# Node offline cache for WSL install (large tarball)
.cache/
# Test
.pytest_cache/
htmlcov/
.coverage
coverage.xml
# Node (for Tailwind/Alpine.js build)
node_modules/
web/css/tailwind-output.css
# Build output (Vite/Vuetify frontend)
# SPA 构建产物纳入 Git，便于服务器 git pull 部署（见 deploy/deploy-frontend.sh）
# 仍忽略本地临时文件
web/app/assets/.tmp/
# Legacy dist dir (no longer used)
**/dist/
# Uploads
web/uploads/
# Data (sensitive)
web/data/config.php
web/data/*.db
web/data/1panel-hosts.json
# Backups
backups/
# Docker local secrets
docker/.env
docker/.env.prod
!docker/.env.example
!docker/.env.prod.example
scripts/npm-proxy.env
# Deploy
deploy/*.key
# Backups
backups/
.skills/nexus-btpanel-review/SKILL.md
+31
View File
@@ -0,0 +1,31 @@
---
name: nexus-btpanel-review
description: Use when reviewing or changing Nexus BT/宝塔 panel integration, one-click login, API bootstrap, session keepalive fixes, or BT credential handling.
---
# Nexus BT Panel Review
Use for 宝塔/BT panel integration changes.
## Call chain to map
API one-click login -> btpanel_service -> BT API credential lookup/bootstrap -> SSH bootstrap if needed -> login URL/tmp_token -> panel session behavior.
## Required checks
- Do not log or return BT API keys, session cookies, temporary login tokens, SSH private keys, or passwords.
- One-click login should fail closed for real authentication errors, but best-effort environment repair must not block login unless required for correctness.
- Session keepalive/cleanup repair must be idempotent and throttled; do not restart or rewrite BT panel aggressively without explicit approval.
- Respect existing BT panel services and ports. Do not occupy panel, nginx, redis, or mysql ports.
- Old servers with existing BT API credentials must still receive the session-cleanup TTL check before login.
- Record bootstrap state without storing secrets.
## Regression tests
Cover:
- Existing credentials still trigger throttled TTL check.
- Missing SSH auth does not block login URL generation.
- Failed repair is throttled and retried later.
- Temporary login token TTL remains bounded.
- No secret values appear in returned bootstrap/status payloads.
.skills/nexus-security-review/SKILL.md
+40
View File
@@ -0,0 +1,40 @@
---
name: nexus-security-review
description: Use when reviewing or changing Nexus backend/API/security-sensitive code. Focuses on FastAPI admin APIs, SQLAlchemy data access, SSH operations, file manager boundaries, logging redaction, and regression tests.
---
# Nexus Security Review
Use this skill before changing Nexus backend/API code or doing a security pass.
## Required workflow
1. Identify entrypoints: FastAPI router, service method, DB model/session, Redis/lock usage, SSH/BT panel call.
2. Draw the request path in notes: API -> schema -> service -> DB/Redis/SSH/external.
3. Check auth first: admin-only endpoints must depend on the current admin dependency; background/admin tools must still preserve audit logs.
4. Validate every user-controlled value at the schema/API boundary and again before shell/path-sensitive sinks.
5. For every fix, add pytest coverage for the dangerous case and the allowed case.
6. Run focused tests, then full pytest when practical, then git diff --check.
7. Update the Nexus Markdown report with changed files, tests, and residual risks.
## Nexus-specific rules
- Do not print secrets: passwords, SSH keys, tokens, cookies, API keys, .env values, BT panel credentials.
- script_service is an intentional administrator remote shell. Do not report arbitrary shell execution there as a vulnerability. Review only auth, audit trail, timeout, output truncation, and redaction.
- File manager APIs must not unexpectedly operate outside the target path/server chosen by the admin UI.
- Any remote shell command must use shlex.quote; add -- where command options can be confused with filenames.
- Archive extraction must list and validate members before extraction; reject absolute paths, .., backslashes, and special file types.
- Error responses must not expose stack traces or secrets.
- DB access should use SQLAlchemy parameters/query builder, not raw string interpolation.
## Review output
For each finding record:
- Severity: Critical/High/Medium/Low/Hardening
- Call chain
- Evidence file/function
- Exploit or failure boundary
- Fix summary
- Test command/result
- Commit hash if committed
.skills/nexus-ssh-safety/SKILL.md
+29
View File
@@ -0,0 +1,29 @@
---
name: nexus-ssh-safety
description: Use when reviewing or editing Nexus code that executes commands on managed servers over SSH, including file manager, transfer, archive, agent install, and BT panel bootstrap flows.
---
# Nexus SSH Safety
Use for any Nexus feature that builds shell commands or transfers files over SSH.
## Command construction rules
- Prefer argument arrays/local library APIs when available; otherwise quote every dynamic shell token with shlex.quote.
- Insert -- before filename/path operands for commands that parse options:
m, mv, cp, ar, zip, chmod, chown, etc.
- Never concatenate unquoted user input into shell command strings.
- Keep timeouts explicit for network/SSH work; avoid unbounded commands.
- Truncate or sanitize command output before returning it to API clients.
- Do not log secrets or full credential-bearing URLs.
## Path and archive rules
- Normalize paths with POSIX semantics for remote Linux paths.
- Reject empty paths where dangerous, root/system paths for recursive destructive operations, and traversal where the feature expects a bounded directory.
- Archive creation must protect member names beginning with -.
- Archive extraction must validate member names and types before extraction.
- Temporary files/directories must be unique and cleaned best-effort.
## script_service exception
2025.2
+5
View File
@@ -0,0 +1,5 @@
Collecting tzdata
Downloading tzdata-2026.2-py2.py3-none-any.whl.metadata (1.4 kB)
Downloading tzdata-2026.2-py2.py3-none-any.whl (349 kB)
Installing collected packages: tzdata
Successfully installed tzdata-2026.2
AGENTS.md
+54 -2
View File
@@ -6,7 +6,7 @@
## 项目概要
Nexus：2000+ 子机运维平台。后端 FastAPI + MySQL + Redis；前端 **Vue 3 + Vuetify 4 + TypeScript SPA**（14 页，`frontend/src/pages/`）；构建输出 `web/app/`；安装向导 `web/app/install.html`。
Nexus：2000+ 子机运维平台。后端 FastAPI + MySQL + Redis；前端 **Vue 3 + Vuetify 4 + TypeScript SPA**（15 页，`frontend/src/pages/`）；构建输出 `web/app/`；安装向导 `web/app/install.html`。
## 本地开发
@@ -19,6 +19,14 @@ cd frontend && npm run dev # :3000/app/
路径见 [linux-dev-paths.md](docs/project/linux-dev-paths.md)。
## Git（仅本机快照）
- 本地 `git commit` 用于回滚；**不 `git push`**（除非你明确要求）。
- 已移除 `origin` 跟踪，避免误推；原远程：`http://66.154.115.8:3000/admin/Nexus.git`（需恢复时说一声）。
- `.env`、`SECRETS.md`、`*.pem` 已在 `.gitignore`，**勿提交**。
- 改代码仍写 `docs/changelog/YYYY-MM-DD-*.md`（≥10 行）。
- 用户说「提交快照 / commit」时执行。
## 强制约束
- 完美实现：`.cursor/rules/perfect-implementation.mdc`
@@ -32,13 +40,57 @@ cd frontend && npm run dev # :3000/app/
## 部署
默认 **本机 rsync → SSH 生产机**（不 push Gitea）：
```bash
bash deploy/pre_deploy_check.sh
bash deploy/deploy-production.sh # 需 SSH nexus + 用户批准
bash deploy/deploy-production.sh # rsync + Docker upgrade --skip-git + 前端
```
可选：`NEXUS_DEPLOY_VIA_GIT=1` 恢复远程 `git pull`。仅 `git push` 当你明确要求时。
详情见功能指南 §17–18。
## 归档文档
历史审计合并卷：`docs/archive/README.md`
## 代码地图（Agent 先读这里，勿全库搜）
```
server/main.py # 路由挂载入口
server/config.py # 配置（.env + settings 表）
server/api/*.py # HTTP/WebSocket 路由（按模块拆分）
server/application/ # 业务 services
server/infrastructure/ # DB / Redis / SSH / Telegram
server/domain/models/ # SQLAlchemy ORM
frontend/src/pages/ # Vue 页面（15 页 SPA）
frontend/src/router/ # Hash 路由 #/
frontend/src/api/ # 前端 API 客户端
frontend/e2e/ # Playwright 验收
tests/test_*.py # pytest
docs/project/ # 功能/部署 SSOT
deploy/ # 生产部署脚本
scripts/ # 本地验证、MCP、门控
.cursor/mcp.json # mysql-mcp
```
## 问题 → 文件（常见锚点）
| 问什么 | 先看 |
|--------|------|
| 某 API 怎么实现 | `server/main.py` 找 router → `server/api/<模块>.py` |
| 服务器列表/搜索/exec | `server/api/servers.py`, `server/api/scripts.py` |
| 认证/JWT | `server/api/auth.py`, `server/api/dependencies.py` |
| Agent 心跳/安装 | `server/api/agent.py` |
| WebSSH/终端 | `server/api/webssh.py`, `server/api/terminal.py` |
| 同步/文件/搜索 | `server/api/sync_v2.py`, `files.py`, `search.py` |
| 设置/审计/告警 | `server/api/settings.py` |
| 前端某页 UI | `frontend/src/router/index.ts` → `frontend/src/pages/` |
| MySQL MCP | `.cursor/mcp.json`, `scripts/linux_mcp_mysql.sh` |
| 本地开发路径 | `docs/project/linux-dev-paths.md` |
| 14 页/API 全览 | `docs/project/nexus-functional-development-guide.md` §9–10 |
## 探索规则（省 token）
详见 `.cursor/rules/agent-exploration.mdc`。要点：**先地图再 Grep（带 path）→ Read ≤5 个文件 → 停止**。
Dockerfile
+46 -29
View File
@@ -1,29 +1,46 @@
# Nexus 6.0 — API + 静态 SPA (web/app)
FROM python:3.12-slim-bookworm
RUN apt-get update \
&& apt-get install -y --no-install-recommends curl \
&& rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY server/ ./server/
COPY web/app/ ./web/app/
COPY docker/entrypoint.sh ./docker/entrypoint.sh
RUN chmod +x ./docker/entrypoint.sh
ENV PYTHONPATH=/app \
PYTHONUNBUFFERED=1 \
NEXUS_HOST=0.0.0.0 \
NEXUS_PORT=8600
EXPOSE 8600
HEALTHCHECK --interval=30s --timeout=5s --start-period=90s --retries=3 \
CMD curl -sf http://127.0.0.1:8600/health | grep -q '^ok' || exit 1
ENTRYPOINT ["/app/docker/entrypoint.sh"]
CMD ["uvicorn", "server.main:app", "--host", "0.0.0.0", "--port", "8600"]
# Nexus 6.0 - API + static SPA (web/app)
FROM python:3.12-slim-bookworm
ARG DEBIAN_MIRROR=https://mirrors.aliyun.com/debian
ARG DEBIAN_SECURITY_MIRROR=https://mirrors.aliyun.com/debian-security
ARG PIP_INDEX_URL=https://mirrors.aliyun.com/pypi/simple/
ARG PIP_TRUSTED_HOST=mirrors.aliyun.com
RUN set -eux; \
sed -i \
-e "s|http://deb.debian.org/debian-security|${DEBIAN_SECURITY_MIRROR}|g" \
-e "s|http://deb.debian.org/debian|${DEBIAN_MIRROR}|g" \
/etc/apt/sources.list.d/debian.sources; \
apt-get update; \
apt-get install -y --no-install-recommends \
curl \
openssh-client \
rsync \
sshpass; \
rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --index-url "${PIP_INDEX_URL}" --trusted-host "${PIP_TRUSTED_HOST}" -r requirements.txt
COPY server/ ./server/
COPY web/app/ ./web/app/
COPY web/app-v2/ ./web/app-v2/
COPY docker/entrypoint.sh ./docker/entrypoint.sh
RUN chmod +x ./docker/entrypoint.sh
ENV PYTHONPATH=/app \
PYTHONUNBUFFERED=1 \
NEXUS_HOST=0.0.0.0 \
NEXUS_PORT=8600
EXPOSE 8600
HEALTHCHECK --interval=30s --timeout=5s --start-period=90s --retries=3 \
CMD curl -sf http://127.0.0.1:8600/health | grep -q '^ok' || exit 1
ENTRYPOINT ["/app/docker/entrypoint.sh"]
CMD ["uvicorn", "server.main:app", "--host", "0.0.0.0", "--port", "8600"]
Dockerfile.prod
+77 -44
View File
@@ -1,44 +1,77 @@
# Nexus 6.0 — production image (frontend build + API)
# Build: docker compose -f docker/docker-compose.prod.yml build
# See: docs/design/plans/2026-06-04-1panel-docker-production.md
# ── Stage 1: Vue/Vite SPA ──
FROM node:20-bookworm-slim AS frontend
WORKDIR /build/frontend
COPY frontend/package.json frontend/package-lock.json ./
RUN npm ci --ignore-scripts
COPY frontend/ ./
RUN npx vite build
# ── Stage 2: Python API + built static assets ──
FROM python:3.12-slim-bookworm
RUN apt-get update \
&& apt-get install -y --no-install-recommends curl \
&& rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY server/ ./server/
COPY web/agent/ ./web/agent/
COPY --from=frontend /build/web/app ./web/app/
COPY docker/entrypoint.sh ./docker/entrypoint.sh
RUN chmod +x ./docker/entrypoint.sh
ENV PYTHONPATH=/app \
PYTHONUNBUFFERED=1 \
NEXUS_HOST=0.0.0.0 \
NEXUS_PORT=8600
EXPOSE 8600
HEALTHCHECK --interval=30s --timeout=5s --start-period=90s --retries=3 \
CMD curl -sf http://127.0.0.1:8600/health | grep -q '^ok' || exit 1
ENTRYPOINT ["/app/docker/entrypoint.sh"]
CMD ["uvicorn", "server.main:app", "--host", "0.0.0.0", "--port", "8600"]
# Nexus 6.0 鈥?production image (frontend build + API)
# Build: docker compose -f docker/docker-compose.prod.yml build
# See: docs/design/plans/2026-06-04-1panel-docker-production.md
# 鈹€鈹€ Stage 1: Vue/Vite SPA 鈹€鈹€
FROM node:20-bookworm-slim AS frontend
WORKDIR /build/frontend
COPY frontend/package.json frontend/package-lock.json ./
RUN npm ci --ignore-scripts
COPY frontend/ ./
RUN npx vite build
# Stage 1b: React/Vite App V2
FROM node:20-bookworm-slim AS frontend_v2
WORKDIR /build/frontend-v2
COPY frontend-v2/package.json frontend-v2/package-lock.json* ./
RUN if [ -f package-lock.json ]; then npm ci --ignore-scripts; else npm install --ignore-scripts; fi
COPY frontend-v2/ ./
RUN npx vite build
# 鈹€鈹€ Stage 2: Python API + built static assets 鈹€鈹€
FROM python:3.12-slim-bookworm
RUN apt-get update \
&& apt-get install -y --no-install-recommends \
curl \
openssh-client \
rsync \
sshpass \
&& rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY server/ ./server/
COPY web/agent/ ./web/agent/
COPY --from=frontend /build/web/app ./web/app/
COPY --from=frontend_v2 /build/web/app-v2 ./web/app-v2/
# Login wallpaper cache (Vite does not emit this dir; sync also writes here at runtime)
COPY web/app/wallpapers/ ./web/app/wallpapers/
# Install wizard + static SPA assets not emitted by Vite
COPY web/app/install.html ./web/app/install.html
COPY web/app/servers_import_template.csv ./web/app/servers_import_template.csv
RUN mkdir -p ./web/app/vendor
COPY web/app/vendor/tailwindcss-browser.js \
web/app/vendor/theme-init.js \
web/app/vendor/theme.css \
web/app/vendor/alpinejs.min.js \
./web/app/vendor/
COPY docker/entrypoint.sh ./docker/entrypoint.sh
RUN chmod +x ./docker/entrypoint.sh \
&& test -f /app/web/app/install.html \
&& test -f /app/web/app/vendor/alpinejs.min.js \
&& test -f /app/web/app/vendor/tailwindcss-browser.js \
&& test -f /app/web/app/vendor/theme.css \
&& test -f /app/web/app/vendor/theme-init.js
ENV PYTHONPATH=/app \
PYTHONUNBUFFERED=1 \
NEXUS_HOST=0.0.0.0 \
NEXUS_PORT=8600
EXPOSE 8600
HEALTHCHECK --interval=30s --timeout=5s --start-period=90s --retries=3 \
CMD curl -sf http://127.0.0.1:8600/health | grep -q '^ok' || exit 1
ENTRYPOINT ["/app/docker/entrypoint.sh"]
CMD ["uvicorn", "server.main:app", "--host", "0.0.0.0", "--port", "8600"]
README.md
+189
View File
@@ -0,0 +1,189 @@
# Nexus 6.0
面向 **2000+ 服务器** 的运维管理平台：FastAPI + Async SQLAlchemy + Redis + WebSocket + Telegram（后端），Vue 3 + Vuetify 4 + TypeScript SPA（前端 14 页）。
| 项 | 说明 |
|----|------|
| 生产域名 | https://api.synaglobal.vip |
| 默认安装目录 | `/opt/nexus` |
| 后端端口 | `8600`（1Panel 反代到 `http://127.0.0.1:8600`） |
| 安装向导 | `https://你的域名/app/install.html` |
| 文档索引 | [docs/README.md](docs/README.md) |
生产 Docker 栈 **仅含 Nexus 容器**；MySQL / Redis 在宿主机或 1Panel 自行安装。
---
## 一键命令速查（root · 公共仓库 · 无需令牌）
| 场景 | 一条命令 |
|------|----------|
| **仅装 Nexus**（1Panel 已就绪） | `curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" \| bash` |
| **重装服务器**（1Panel + Docker + Nexus） | `curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/install-1panel-docker.sh" \| bash` |
| **一键更新**（pull + 重建镜像） | `curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/update.sh" \| bash` |
| **强制无缓存重建**（entrypoint 变更后） | `curl -fsSL ".../deploy/update.sh" \| bash -s -- --no-cache` |
| **已 clone** | `cd /opt/nexus && bash deploy/update.sh` |
指定资源档位（`1c4g` / `2c8g` 默认 / `4c16g`）：
```bash
curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash -s -- --profile 4c16g
```
**raw 地址**：`http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/<脚本名>`
安装完成后浏览器打开安装向导，完成 MySQL（自建）/ Redis（自建）/ 管理员初始化。
---
## NX 统一运维菜单
装好后在服务器任意目录输入 **`nx`**（`install` / `update` / 首次运行 `nx` 会自动注册 `/usr/local/bin/nx`）：
```bash
nx # 统一菜单：安装 + 一键更新 + 重启 + 日志 + 备份
nx update # 非交互一键更新
nx update --no-cache
nx install-fresh # 全新安装
nx health # 健康检查
```
| 菜单项 | 作用 |
|--------|------|
| `[4] 一键更新` | pull + 重建 Docker 镜像（等同 `deploy/update.sh`） |
| `[5] 重启 Nexus` | 重启 Python 应用 |
| `[6] 日志` | 跟踪容器日志 |
| `[1][2]` | 安装 / 全新安装向导 |
全局命令（符号链接）：
| 命令 | 作用 |
|------|------|
| `nx` | 统一运维菜单 |
| `nexus-update` | 等同 `deploy/update.sh` |
| `nexus-fresh` | 等同 `install-nexus-fresh.sh` |
| `nexus-install` | 等同 `quick-install.sh` |
> `nx god` 已合并进 `nx` 主菜单，仍可作为兼容别名使用。
---
## 部署脚本一览（`deploy/`）
### 1Panel + Docker 生产（主路径）
| 脚本 | 用途 | curl 入口 |
|------|------|-----------|
| [quick-install.sh](deploy/quick-install.sh) | **公共仓库安装入口** | ✅ 上表 |
| [install-1panel-docker.sh](deploy/install-1panel-docker.sh) | 1Panel + Docker + Nexus 全链 | ✅ 上表 |
| [install-nexus-fresh.sh](deploy/install-nexus-fresh.sh) | 全新空库 → 安装向导 | `bash deploy/install-nexus-fresh.sh --skip-clone` |
| [update.sh](deploy/update.sh) | **一键更新**（pull + 重建） | ✅ 上表 |
| [upgrade-1panel-docker.sh](deploy/upgrade-1panel-docker.sh) | 转调 `nexus-1panel.sh upgrade` | — |
| [nexus-1panel.sh](deploy/nexus-1panel.sh) | 安装 / 升级 / check / ports 底层 | — |
| [nx](deploy/nx) | **统一交互菜单** | `nx` |
| [uninstall-mysql-compose.sh](deploy/uninstall-mysql-compose.sh) | 卸载遗留 Compose MySQL 容器 | — |
| [uninstall-redis-compose.sh](deploy/uninstall-redis-compose.sh) | 卸载遗留 Compose Redis 容器 | — |
| [sync-install-wizard-to-container.sh](deploy/sync-install-wizard-to-container.sh) | 热同步 install.html 到容器 | — |
| [download-install-fresh.sh](deploy/download-install-fresh.sh) | 下载安装脚本（私有库可选 Token） | — |
详细说明：[deploy/README-1panel.md](deploy/README-1panel.md)
### 更新选项
```bash
bash deploy/update.sh # 默认：Git 拉取（若有）+ 重建容器
bash deploy/update.sh --check # 仅查 Git
bash deploy/update.sh --no-cache # 无缓存重建镜像
bash deploy/update.sh --no-backup # 跳过 MySQL 备份
```
### Docker Compose 与档位
| 路径 | 用途 |
|------|------|
| [docker/docker-compose.prod.yml](docker/docker-compose.prod.yml) | 生产 Compose（**仅 nexus 服务**） |
| [docker/profiles/1c4g.env](docker/profiles/1c4g.env) | 1 核 4G |
| [docker/profiles/2c8g.env](docker/profiles/2c8g.env) | 2 核 8G（默认） |
| [docker/profiles/4c16g.env](docker/profiles/4c16g.env) | 4 核 16G |
| [docker/README.md](docker/README.md) | 镜像与本地开发说明 |
### 经典 SSH / Supervisor 部署（宝塔 / 裸机）
| 脚本 | 用途 |
|------|------|
| [install.sh](deploy/install.sh) | 传统安装 |
| [upgrade.sh](deploy/upgrade.sh) | 拉代码 + 重启 |
| [deploy-on-server.sh](deploy/deploy-on-server.sh) | 服务器侧部署 |
| [deploy-production.sh](deploy/deploy-production.sh) | 生产发布流程 |
| [deploy-frontend.sh](deploy/deploy-frontend.sh) | 构建 Vue 前端并打包到 `web/app/` |
| [pre_deploy_check.sh](deploy/pre_deploy_check.sh) | **7 道门控** |
| [health_monitor.sh](deploy/health_monitor.sh) | cron 健康检查 |
| [db_backup.sh](deploy/db_backup.sh) | MySQL 备份 |
| [uninstall.sh](deploy/uninstall.sh) | 卸载 |
---
## 迁机 vs 全新安装
| 场景 | 做法 |
|------|------|
| **新 VPS、空库** | `curl \| quick-install.sh` → 1Panel 自建 MySQL/Redis → `/app/install.html` |
| **已有数据、换机** | `nexus-1panel.sh install --from-env` 或 `nx` → 安装向导 |
| **仅升级代码/镜像** | `nx update` 或 `bash deploy/update.sh` |
| **不必重装 VPS** | `cd /opt/nexus && nx update` |
每台新服务器自动生成唯一 `NEXUS_SECRET_KEY` / `NEXUS_API_KEY` / `NEXUS_ENCRYPTION_KEY`（写入 `docker/.env.prod`，备份 `/root/.nexus-install-secrets-*.env`）。MySQL 密码由自建库时自行设定。
---
## 技术栈与目录
```
Nexus/
├── server/ # FastAPI 后端（Clean Architecture）
├── frontend/ # Vue 3 + Vuetify 4 SPA → 构建到 web/app/
├── web/app/ # 静态资源挂载点（构建产物 gitignore）
├── deploy/ # 安装、更新、门控、nx 菜单
├── docker/ # Compose、镜像、profiles
├── docs/ # 设计 / changelog / 审计 / 报告
├── tests/ # API 与集成测试
└── standards/ # 开发与逐行审计标准
```
---
## 开发
```bash
pip install -r requirements.txt
uvicorn server.main:app --reload --port 8600
cd frontend && npm run dev # http://localhost:3000/app/
```
Linux 路径：[docs/project/linux-dev-paths.md](docs/project/linux-dev-paths.md) · [UBUNTU-DEV-README.txt](UBUNTU-DEV-README.txt)
---
## 文档与规范
| 文档 | 说明 |
|------|------|
| [docs/README.md](docs/README.md) | 文档总索引 |
| [docs/project/nexus-functional-development-guide.md](docs/project/nexus-functional-development-guide.md) | 功能 / API / 14 页 |
| [AGENTS.md](AGENTS.md) · [CLAUDE.md](CLAUDE.md) | Agent 薄入口 |
变更：`docs/changelog/` · 门控：`docs/audit/`
---
## 许可与仓库
| 用途 | 地址 |
|------|------|
| 仓库首页 | http://66.154.115.8:3000/admin/Nexus |
| Git | http://66.154.115.8:3000/admin/Nexus.git |
分支 `main` · 提交前跑 `deploy/pre_deploy_check.sh`（7 道门控）
**勿提交**：`deploy/nexus-1panel.secrets.sh`、根目录 `.env`、`SECRETS.md`
deploy/1panel/openresty-nexus.conf.example
+71 -70
View File
@@ -1,70 +1,71 @@
# 1Panel OpenResty — Nexus reverse proxy (paste into site custom config)
# Domain: api.synaglobal.vip
# Upstream: Nexus Docker on 127.0.0.1:8600 (docker-compose.prod.yml)
#
# SSL: configure in 1Panel UI (Let's Encrypt). This snippet assumes HTTPS server block.
upstream nexus_api {
server 127.0.0.1:8600;
keepalive 32;
}
# WebSocket log without query string (JWT must not hit access_log)
log_format nexus_ws '$remote_addr - [$time_local] "$request_method $uri" $status $body_bytes_sent';
client_max_body_size 100m;
location /api/ {
proxy_pass http://nexus_api;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 300s;
proxy_send_timeout 300s;
proxy_connect_timeout 10s;
}
location /ws/ {
access_log /www/sites/api.synaglobal.vip/log/ws.log nexus_ws;
proxy_pass http://nexus_api;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
location /health {
proxy_pass http://nexus_api;
proxy_set_header Host $host;
}
location /app/ {
proxy_pass http://nexus_api;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /agent/ {
proxy_pass http://nexus_api;
proxy_set_header Host $host;
}
# Fallback: install mode or misc routes served by FastAPI
location / {
proxy_pass http://nexus_api;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# 1Panel OpenResty — Nexus reverse proxy (paste into site custom config)
# Domain: api.synaglobal.vip
# Upstream: Nexus Docker on 127.0.0.1:8600 (docker-compose.prod.yml)
#
# SSL: configure in 1Panel UI (Let's Encrypt). This snippet assumes HTTPS server block.
upstream nexus_api {
server 127.0.0.1:8600;
keepalive 32;
}
# WebSocket log without query string (JWT must not hit access_log)
log_format nexus_ws '$remote_addr - [$time_local] "$request_method $uri" $status $body_bytes_sent';
client_max_body_size 500m;
client_body_timeout 600s;
location /api/ {
proxy_pass http://nexus_api;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 600s;
proxy_send_timeout 600s;
proxy_connect_timeout 10s;
}
location /ws/ {
access_log /www/sites/api.synaglobal.vip/log/ws.log nexus_ws;
proxy_pass http://nexus_api;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
location /health {
proxy_pass http://nexus_api;
proxy_set_header Host $host;
}
location /app/ {
proxy_pass http://nexus_api;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /agent/ {
proxy_pass http://nexus_api;
proxy_set_header Host $host;
}
# Fallback: install mode or misc routes served by FastAPI
location / {
proxy_pass http://nexus_api;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
deploy/README-1panel.md
+257
View File
@@ -0,0 +1,257 @@
# 1Panel + Docker 一键部署
> 完整知识文档：[docs/project/nexus-1panel-operations-knowledge.md](../docs/project/nexus-1panel-operations-knowledge.md)
> 巡检归档（2026-06-06）：[docs/project/nexus-god-menu-audit-summary.md](../docs/project/nexus-god-menu-audit-summary.md)
## 脚本速查（公共仓库 · 无需令牌）
| 脚本 | 用途 | 一条命令 |
|------|------|----------|
| `quick-install.sh` | 仅装 Nexus（1Panel 已就绪） | `curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" \| bash` |
| `install-1panel-docker.sh` | 重装服务器全链 | `curl -fsSL ".../install-1panel-docker.sh" \| bash` |
| `install-nexus-fresh.sh` | 全新空库安装 | `bash deploy/install-nexus-fresh.sh --skip-clone` |
| **`update.sh`** | **一键更新** | `curl -fsSL ".../update.sh" \| bash` |
| `nexus-1panel.sh` | 底层 install / upgrade | `bash deploy/nexus-1panel.sh upgrade` |
| `fix-1panel-mysql-grant.sh` | 修复 1045 nexus@Docker | `bash deploy/fix-1panel-mysql-grant.sh` |
| `test-1panel-redis.sh` | Redis 认证诊断 | `REDIS_PASS='...' bash deploy/test-1panel-redis.sh` |
| `verify-1panel-install-wizard.sh` | 一键验收（网络/cron/镜像） | `bash deploy/verify-1panel-install-wizard.sh` |
| `install_ops_cron.sh` | 宿主机 cron（巡检+备份） | `sudo bash deploy/install_ops_cron.sh` |
| `mysql_dump_to_file.sh` | MySQL 备份（Docker exec） | 见 `db_backup.sh` / `nx` 菜单 `[9]` |
| `upgrade.sh` | 自动识别 Docker/Supervisor | `bash deploy/upgrade.sh` |
| **`nx`** | **统一运维菜单** | `nx` |
档位：`--profile 1c4g` · `2c8g`（默认）· `4c16g`
---
## 重装服务器（1Panel + Docker + Nexus）
```bash
curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/install-1panel-docker.sh" | bash
```
4 核 16G：
```bash
curl -fsSL ".../install-1panel-docker.sh" | bash -s -- --profile 4c16g
```
已装 1Panel，只装 Nexus：
```bash
curl -fsSL ".../install-1panel-docker.sh" | bash -s -- --skip-1panel
```
## 仅 Nexus Docker
```bash
curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
```
安装完成后：`https://api.synaglobal.vip/app/install.html`
---
## 一键更新（日常）
```bash
cd /opt/nexus && bash deploy/update.sh
# 或
nx update
# 或菜单
nx # → [4] 一键更新
```
| 选项 | 说明 |
|------|------|
| `--check` | 仅查 Git，不重建 |
| `--no-cache` | 无缓存重建镜像（entrypoint 变更后必用） |
| `--no-backup` | 跳过 MySQL 备份 |
| `--prune` | 清理悬空镜像 |
远程：
```bash
curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/update.sh" | bash
curl -fsSL ".../update.sh" | bash -s -- --no-cache
```
---
## NX 全局命令
安装 / 升级 / 首次运行 `nx` 会自动注册到 `/usr/local/bin`：
```bash
# 手动注册（任意目录可用 nx）
NEXUS_ROOT=/opt/nexus bash /opt/nexus/deploy/install-nx-cli.sh
nx # 统一运维菜单
nexus-update # 等同 update.sh
nexus-fresh # 等同 install-nexus-fresh.sh
nexus-install # 等同 quick-install.sh
```
| 菜单 / 子命令 | 功能 |
|---------------|------|
| `[1]` | 安装向导（档位 / 迁机 / skip-clone） |
| `[2]` | 全新安装 → `/app/install.html` |
| `[3]` | 状态 + `/health` + install.html 归档检查 |
| `[4]` / `nx update` | **一键更新**（备份 + 重建镜像 + 升级后验收） |
| `[5]` | 重启 Nexus 容器 |
| `[6]` | 日志 |
| `[7]` | 启动 / 停止 Compose 栈 |
| `[8]` | 无缓存重建镜像 |
| `[9]` | 立即备份 MySQL |
| `[e]` / `nx cron` | 安装 health_monitor + db_backup crontab |
| `[v]` / `nx verify` | 运行 `verify-1panel-install-wizard.sh` |
---
## 三层守护（1Panel Docker）
| 层 | 机制 | 说明 |
|----|------|------|
| Layer 1 | Compose `restart` + 容器 `healthcheck` | 容器崩溃自动拉起 |
| Layer 2 | Python `self_monitor`（30s） | Redis/MySQL/WebSocket 自检 |
| Layer 3 | 宿主机 `health_monitor.sh`（cron） | `/health` 连续失败 → `docker restart` + 可选 Telegram |
Layer 3 需**在宿主机**安装（容器内无法写 crontab）：
```bash
sudo nx cron
# 或
sudo bash /opt/nexus/deploy/install_ops_cron.sh
```
MySQL 定时备份：每日 03:00 → `/var/backups/nexus/`（`docker exec` 进 1Panel MySQL 容器 dump，**无需**宿主机 `mysqldump`）。
---
## 安装完成后
- 向导锁定后 `install.html` → **`install.html.bak`**，外网 `/app/install.html` 返回 **404**（正常）
- 登录：`https://你的域名/app/`
- 验收：`sudo nx verify`
---
## MySQL / Redis（1Panel 应用商店）
Docker 栈**仅含 Nexus 容器**。MySQL / Redis 在 **1Panel 应用商店**安装。
### 1Panel 官方互联方式（必读）
[1Panel 维护者说明](https://github.com/1Panel-dev/1Panel/issues/11676)：应用商店应用使用 **bridge + `1panel-network`**；**容器之间用容器名通信**（Docker 内置 DNS），不要用 `localhost` / `127.0.0.1` / `host.docker.internal`。
| 场景 | 正确主机 |
|------|----------|
| Nexus → 1Panel MySQL | `1Panel-mysql-xxxx`（容器列表中的名称） |
| Nexus → 1Panel Redis | `1Panel-redis-xxxx` |
| OpenResty → 应用 | `127.0.0.1:端口`（OpenResty 为 host 网络） |
`nx update` / `nexus-1panel.sh` 会：
1. 将 Nexus 加入 **`1panel-network`**（`docker/docker-compose.1panel.yml`）
2. 自动探测 MySQL/Redis 容器名写入 `docker/.env.prod`（含 `NEXUS_REDIS_URL=redis://1Panel-redis-xxxx:6379/0`）
3. 安装向导步骤 3 **预填 MySQL/Redis 容器名**
### 安装步骤
1. **应用商店** → 安装 **MySQL**、**Redis**
2. **数据库** → 创建库 `nexus`、用户 `nexus`（仅授权 `nexus` 库），记下密码
3. `nx update` 后打开安装向导步骤 3（主机应已预填 `1Panel-mysql-…`）
4. 填写 MySQL 密码；Redis：**用户名通常留空** + 应用参数密码（自动尝试 `:pass@` / `default`）
### 常见错误 1045（Access denied for 'nexus'@'172.18.x.x'）
TCP 已通，但 MySQL 用户多为 **`nexus@localhost`**，Docker 内 Nexus 从 **172.x** 连接会被拒绝。
在服务器执行（按提示输入 root 密码与 nexus 密码）：
```bash
cd /opt/nexus && bash deploy/fix-1panel-mysql-grant.sh
```
或一次性：
```bash
MYSQL_ROOT_PASSWORD='1Panel里MySQL的root密码' \
NEXUS_DB_PASSWORD='向导里要填的nexus密码' \
bash /opt/nexus/deploy/fix-1panel-mysql-grant.sh
```
然后安装向导步骤 3：**库名/用户 `nexus`**，主机为 `1Panel-mysql-xxxx`，密码与上面一致。
若仍报 `Can't connect to MySQL/Redis on 'host.docker.internal'`：说明 Nexus **未接入 1panel-network** 或未探测到容器名，在服务器执行：
```bash
cd /opt/nexus && bash deploy/detect-1panel-services.sh
nx update --no-cache
```
步骤 2 会 TCP 检测 MySQL/Redis；步骤 4 验证账号密码。
卸载旧 Compose 容器：
```bash
bash deploy/uninstall-mysql-compose.sh
bash deploy/uninstall-redis-compose.sh
```
---
## 1Panel 反代
**禁止**脚本改 `/opt/1panel/apps/openresty/`。
1. 应用商店 → **OpenResty**
2. 网站 → 反代 `http://127.0.0.1:8600`
3. 参考：`deploy/1panel/openresty-nexus.conf.example`
---
## 密钥
新机自动生成 `NEXUS_SECRET_KEY` / `NEXUS_API_KEY` / `NEXUS_ENCRYPTION_KEY` → `docker/.env.prod`，备份 `/root/.nexus-install-secrets-*.env`。
MySQL 密码在 1Panel 自建库时设定，向导步骤 3 填写。
| 场景 | 命令 |
|------|------|
| 新机 | `curl \| quick-install.sh` |
| 迁机 | `nexus-1panel.sh install --from-env /path/to/.env` |
| 更新 | `update.sh` 或 `nx update` |
**Git**：公开仓库 `clone` / `pull` / `curl | bash` 无需令牌。
---
## 安装向导验收（服务器执行）
在 **1Panel 终端**（root）一键检查网络、容器名预填、cron、镜像版本、本地 `/health`：
```bash
cd /opt/nexus && sudo nx verify
```
**未安装**：通过后再打开 `https://你的域名/app/install.html`。
**已安装**：`install.html` 应 HTTP 404；验收检查 crontab、`mysql_dump_to_file.sh`、容器内 round6/7 代码特性。
常见修复：
```bash
cd /opt/nexus && bash deploy/detect-1panel-services.sh
nx update --no-cache
```
外网 HTTPS 仍失败但脚本本地检查全绿 → 在 1Panel **网站**配置反代 `http://127.0.0.1:8600`（见 `deploy/1panel/openresty-nexus.conf.example`）。
## 安装向导热修复
```bash
cd /opt/nexus && git pull
bash deploy/update.sh --no-cache
# 或仅同步静态:
bash deploy/sync-install-wizard-to-container.sh
```
deploy/apply-release-bundle.sh
+272
View File
@@ -0,0 +1,272 @@
#!/usr/bin/env bash
# Apply a Nexus release tarball on the production host.
#
# Usage:
# sudo bash deploy/apply-release-bundle.sh \
# --tarball /tmp/nexus-release-20260708.tar.gz \
# --sha256 6474d58fdccde668b4c91d5e7454fa08e01e20660e3bcbb363eeadbb7c2346a1 \
# --deploy-path /opt/nexus
#
# Validate only (no backup, no rsync, no rebuild):
# bash deploy/apply-release-bundle.sh --validate-only \
# --tarball /tmp/nexus-release-20260708.tar.gz \
# --sha256 6474d58fdccde668b4c91d5e7454fa08e01e20660e3bcbb363eeadbb7c2346a1
#
# This script intentionally preserves runtime secrets and data:
# - .env
# - docker/.env.prod
# - web/data
set -euo pipefail
TARBALL=""
EXPECTED_SHA256=""
DEPLOY_PATH="${NEXUS_DEPLOY_PATH:-/opt/nexus}"
BACKUP_DIR="${NEXUS_BACKUP_DIR:-/opt/nexus-backups}"
SKIP_REBUILD=0
DRY_RUN=0
VALIDATE_ONLY=0
APPLY_TMP=""
info() { echo -e "\033[0;32m[INFO]\033[0m $*"; }
warn() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
usage() {
sed -n '1,26p' "$0"
}
while [[ $# -gt 0 ]]; do
case "$1" in
--tarball)
TARBALL="${2:-}"
shift 2
;;
--sha256)
EXPECTED_SHA256="${2:-}"
shift 2
;;
--deploy-path)
DEPLOY_PATH="${2:-}"
shift 2
;;
--backup-dir)
BACKUP_DIR="${2:-}"
shift 2
;;
--skip-rebuild)
SKIP_REBUILD=1
shift
;;
--dry-run)
DRY_RUN=1
shift
;;
--validate-only)
VALIDATE_ONLY=1
shift
;;
-h|--help)
usage
exit 0
;;
*)
error "Unknown argument: $1"
usage
exit 2
;;
esac
done
require_cmd() {
command -v "$1" >/dev/null 2>&1 || {
error "Missing required command: $1"
exit 127
}
}
require_runtime_cmds() {
require_cmd tar
require_cmd sha256sum
if [[ "$VALIDATE_ONLY" == 1 ]]; then
return 0
fi
require_cmd rsync
require_cmd curl
}
run() {
echo "+ $*"
if [[ "$DRY_RUN" == 1 ]]; then
return 0
fi
"$@"
}
cleanup() {
if [[ -n "${APPLY_TMP:-}" && -d "$APPLY_TMP" ]]; then
rm -rf "$APPLY_TMP"
fi
}
detect_runtime() {
if [[ -f "${DEPLOY_PATH}/docker/.env.prod" ]] && command -v docker >/dev/null 2>&1; then
echo docker
return
fi
if command -v supervisorctl >/dev/null 2>&1 && supervisorctl status nexus >/dev/null 2>&1; then
echo supervisor
return
fi
echo unknown
}
verify_sha256() {
if [[ -z "$EXPECTED_SHA256" ]]; then
warn "No --sha256 provided; skipping checksum verification"
return 0
fi
local actual
actual="$(sha256sum "$TARBALL" | awk '{print $1}')"
if [[ "$actual" != "$EXPECTED_SHA256" ]]; then
error "SHA256 mismatch"
error "expected: $EXPECTED_SHA256"
error "actual: $actual"
exit 1
fi
info "SHA256 OK: $actual"
}
validate_extracted_tree() {
local src="$1"
for required in server deploy Dockerfile.prod frontend-v2 web/app-v2; do
if [[ ! -e "${src}/${required}" ]]; then
error "Release bundle missing required path: ${required}"
exit 1
fi
done
for forbidden in .env docker/.env.prod web/data .venv-py312-codex frontend-v2/node_modules 2025.2 =2025.2; do
if [[ -e "${src}/${forbidden}" ]]; then
error "Release bundle contains forbidden path: ${forbidden}"
exit 1
fi
done
info "Extracted release tree validation OK"
}
backup_current() {
if [[ ! -d "$DEPLOY_PATH" ]]; then
warn "Deploy path does not exist yet: $DEPLOY_PATH"
return 0
fi
local stamp backup
stamp="$(date +%Y%m%d-%H%M%S)"
backup="${BACKUP_DIR}/nexus-before-${stamp}.tar.gz"
run mkdir -p "$BACKUP_DIR"
info "Backup current deploy path -> $backup"
run tar czf "$backup" \
--exclude='./web/data' \
--exclude='./.venv*' \
--exclude='./venv' \
--exclude='./frontend/node_modules' \
--exclude='./frontend-v2/node_modules' \
-C "$(dirname "$DEPLOY_PATH")" "$(basename "$DEPLOY_PATH")"
}
sync_release() {
local src="$1"
run mkdir -p "$DEPLOY_PATH"
info "Sync release tree -> $DEPLOY_PATH"
run rsync -a --delete \
--exclude='.env' \
--exclude='docker/.env.prod' \
--exclude='web/data' \
"${src}/" "${DEPLOY_PATH}/"
}
rebuild_or_restart() {
if [[ "$SKIP_REBUILD" == 1 ]]; then
warn "--skip-rebuild set; not rebuilding/restarting Nexus"
return 0
fi
local runtime
runtime="$(detect_runtime)"
info "Runtime: $runtime"
case "$runtime" in
docker)
if [[ -x "${DEPLOY_PATH}/deploy/nexus-1panel.sh" || -f "${DEPLOY_PATH}/deploy/nexus-1panel.sh" ]]; then
run env NEXUS_ROOT="$DEPLOY_PATH" bash "${DEPLOY_PATH}/deploy/nexus-1panel.sh" upgrade --skip-git
else
error "Docker runtime detected but deploy/nexus-1panel.sh missing"
exit 1
fi
if [[ -f "${DEPLOY_PATH}/deploy/sync_webapp_to_container.sh" ]]; then
run env NEXUS_ROOT="$DEPLOY_PATH" bash "${DEPLOY_PATH}/deploy/sync_webapp_to_container.sh"
fi
;;
supervisor)
run supervisorctl restart nexus
;;
*)
error "Unknown runtime. Rebuild/restart manually."
exit 1
;;
esac
}
verify_local_endpoints() {
local port health app app_v2
port="$(grep -E '^NEXUS_PUBLISH_PORT=' "${DEPLOY_PATH}/docker/.env.prod" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r" ' || true)"
port="${port:-8600}"
health="$(curl -s "http://127.0.0.1:${port}/health" 2>/dev/null || true)"
app="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app/" 2>/dev/null || echo 000)"
app_v2="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app-v2/" 2>/dev/null || echo 000)"
echo " /health -> ${health}"
echo " /app/ -> ${app}"
echo " /app-v2/ -> ${app_v2}"
if [[ "$health" != "ok" || "$app" != "200" || "$app_v2" != "200" ]]; then
error "Local endpoint verification failed"
exit 1
fi
info "Local endpoint verification OK"
}
main() {
if [[ -z "$TARBALL" ]]; then
error "--tarball is required"
usage
exit 2
fi
[[ -f "$TARBALL" ]] || {
error "Tarball not found: $TARBALL"
exit 1
}
require_runtime_cmds
info "Tarball: $TARBALL"
info "Deploy path: $DEPLOY_PATH"
info "Backup dir: $BACKUP_DIR"
verify_sha256
local extracted
APPLY_TMP="$(mktemp -d /tmp/nexus-release-apply.XXXXXX)"
trap cleanup EXIT
run tar xzf "$TARBALL" -C "$APPLY_TMP"
extracted="${APPLY_TMP}/nexus-release"
validate_extracted_tree "$extracted"
if [[ "$VALIDATE_ONLY" == 1 ]]; then
info "Validate-only mode: tarball checksum and content validation passed"
return 0
fi
backup_current
sync_release "$extracted"
rebuild_or_restart
if [[ "$DRY_RUN" != 1 && "$SKIP_REBUILD" != 1 ]]; then
verify_local_endpoints
fi
info "Release applied successfully"
}
main "$@"
deploy/db_backup.sh
+29 -85
View File
@@ -1,102 +1,46 @@
#!/usr/bin/env bash
# Nexus — MySQL Auto-Backup Script
# Usage: Add to crontab for daily 3AM backup
# 0 3 * * * /path/to/nexus/deploy/db_backup.sh >> /var/log/nexus_backup.log 2>&1
# Nexus — MySQL 定时备份（Docker 1Panel / 宿主机）
#
# Reads DATABASE_URL from .env for connection parameters.
# Retains backups for 30 days, auto-deletes older ones.
# 0 3 * * * NEXUS_ROOT=/opt/nexus /opt/nexus/deploy/db_backup.sh >> /var/log/nexus_backup.log 2>&1
#
# 亦可通过: sudo bash deploy/install_ops_cron.sh
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
ENV_FILE="$PROJECT_DIR/.env"
BACKUP_DIR="$PROJECT_DIR/backups"
RETENTION_DAYS=30
NEXUS_ROOT="${NEXUS_ROOT:-$(dirname "$SCRIPT_DIR")}"
BACKUP_DIR="${NEXUS_BACKUP_DIR:-/var/backups/nexus}"
RETENTION_DAYS="${NEXUS_BACKUP_RETENTION_DAYS:-30}"
DUMP_SH="${SCRIPT_DIR}/mysql_dump_to_file.sh"
# ── Load .env ──
if [ ! -f "$ENV_FILE" ]; then
echo "[$(date)] ERROR: .env not found at $ENV_FILE"
if [[ ! -f "$DUMP_SH" ]]; then
echo "[$(date)] ERROR: missing $DUMP_SH"
exit 1
fi
chmod +x "$DUMP_SH" 2>/dev/null || true
# Parse DATABASE_URL from .env
# Format: mysql+asyncmy://user:password@host:port/dbname
DB_URL=$(grep -E '^NEXUS_DATABASE_URL=' "$ENV_FILE" | head -1 | cut -d= -f2- | tr -d '"' | tr -d "'")
if [ -z "$DB_URL" ]; then
DB_URL=$(grep -E '^DATABASE_URL=' "$ENV_FILE" | head -1 | cut -d= -f2- | tr -d '"' | tr -d "'")
fi
if [ -z "$DB_URL" ]; then
echo "[$(date)] ERROR: DATABASE_URL not found in .env"
exit 1
fi
# Parse mysql URL: mysql+asyncmy://user:pass@host:port/dbname → user pass host port dbname
# Strip scheme
CONN="${DB_URL#*://}"
# Extract user:pass
USERPASS="${CONN%%@*}"
DB_USER="${USERPASS%%:*}"
DB_PASS="${USERPASS#*:}"
# Extract host:port/dbname
HOSTDB="${CONN#*@}"
DB_HOST="${HOSTDB%%:*}"
PORTDB="${HOSTDB#*:}"
DB_PORT="${PORTDB%%/*}"
DB_NAME="${PORTDB#*/}"
# Remove query params
DB_NAME="${DB_NAME%%\?*}"
if [ -z "$DB_NAME" ] || [ -z "$DB_HOST" ] || [ -z "$DB_USER" ]; then
echo "[$(date)] ERROR: Failed to parse DATABASE_URL"
exit 1
fi
# ── Create backup directory ──
mkdir -p "$BACKUP_DIR"
TIMESTAMP="$(date +%Y%m%d_%H%M%S)"
RAW_FILE="${BACKUP_DIR}/nexus_daily_${TIMESTAMP}.sql"
BACKUP_FILE="${RAW_FILE}.gz"
# ── Backup filename ──
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
BACKUP_FILE="$BACKUP_DIR/nexus_${DB_NAME}_${TIMESTAMP}.sql.gz"
# ── Run mysqldump ──
echo "[$(date)] Starting backup: $DB_NAME @ $DB_HOST"
if [ -n "$DB_PASS" ]; then
MYSQL_PWD="$DB_PASS" mysqldump \
-h "$DB_HOST" \
-P "${DB_PORT:-3306}" \
-u "$DB_USER" \
--single-transaction \
--routines \
--triggers \
--set-gtid-purged=OFF \
"$DB_NAME" | gzip > "$BACKUP_FILE"
else
mysqldump \
-h "$DB_HOST" \
-P "${DB_PORT:-3306}" \
-u "$DB_USER" \
--single-transaction \
--routines \
--triggers \
--set-gtid-purged=OFF \
"$DB_NAME" | gzip > "$BACKUP_FILE"
fi
# ── Verify backup ──
if [ -f "$BACKUP_FILE" ]; then
SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
echo "[$(date)] Backup completed: $BACKUP_FILE ($SIZE)"
else
echo "[$(date)] ERROR: Backup file not created!"
echo "[$(date)] Starting backup → $BACKUP_FILE"
if ! NEXUS_ROOT="$NEXUS_ROOT" bash "$DUMP_SH" --output "$RAW_FILE" --root "$NEXUS_ROOT"; then
echo "[$(date)] ERROR: mysqldump failed"
rm -f "$RAW_FILE"
exit 1
fi
# ── Cleanup old backups (retain 30 days) ──
DELETED=$(find "$BACKUP_DIR" -name "nexus_*.sql.gz" -mtime +${RETENTION_DAYS} -delete -print | wc -l)
if [ "$DELETED" -gt 0 ]; then
gzip -f "$RAW_FILE"
if [[ ! -f "$BACKUP_FILE" ]]; then
echo "[$(date)] ERROR: backup file not created"
exit 1
fi
SIZE="$(du -h "$BACKUP_FILE" | cut -f1)"
echo "[$(date)] Backup completed: $BACKUP_FILE ($SIZE)"
DELETED="$(find "$BACKUP_DIR" -name 'nexus_*.sql.gz' -mtime +"${RETENTION_DAYS}" -delete -print 2>/dev/null | wc -l)"
if [[ "$DELETED" -gt 0 ]]; then
echo "[$(date)] Cleaned up $DELETED old backup(s) (>${RETENTION_DAYS} days)"
fi
deploy/deploy-frontend.sh
+82 -33
View File
@@ -1,58 +1,107 @@
#!/bin/bash
#!/usr/bin/env bash
# deploy-frontend.sh — Build Vuetify frontend and deploy to server
#
# Docker 生产：前端在镜像内构建，远程执行 nexus-1panel.sh upgrade
# Supervisor：tar 上传到 web/app + supervisorctl restart
#
# Usage: bash deploy/deploy-frontend.sh
# Run from the Nexus project root directory.
set -euo pipefail
NEXUS_SSH_HOST="${NEXUS_SSH:-nexus}"
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=15)
if [[ -n "${NEXUS_SSH_KEY:-}" ]]; then
SSH_OPTS+=(-i "${NEXUS_SSH_KEY}")
fi
ssh_cmd() { ssh "${SSH_OPTS[@]}" "${NEXUS_SSH_HOST}" "$@"; }
echo "═══ Nexus Frontend Deploy ═══"
# 1. Build
echo "▶ Building frontend..."
REMOTE_RUNTIME=$(ssh_cmd 'bash -s' <<'REMOTE'
set -euo pipefail
docker_cmd() {
if docker "$@" 2>/dev/null; then return 0; fi
sudo docker "$@" 2>/dev/null
}
compose_cmd() {
if docker compose "$@" 2>/dev/null; then return 0; fi
sudo docker compose "$@" 2>/dev/null
}
for d in /opt/nexus /www/wwwroot/api.synaglobal.vip; do
[[ -d "$d/server" ]] || continue
if [[ -f "$d/docker/.env.prod" ]] && compose_cmd version >/dev/null 2>&1; then
prof="$d/docker/.host-profile"
[[ -f "$prof" ]] || prof="$d/docker/profiles/2c8g.env"
if [[ -f "$prof" ]]; then
args=(-f "$d/docker/docker-compose.prod.yml")
docker_cmd network inspect 1panel-network >/dev/null 2>&1 && \
[[ -f "$d/docker/docker-compose.1panel.yml" ]] && \
args+=(-f "$d/docker/docker-compose.1panel.yml")
q=$(cd "$d" && compose_cmd "${args[@]}" \
--env-file "$d/docker/.env.prod" --env-file "$prof" ps -q nexus 2>/dev/null || true)
[[ -n "$q" ]] && echo "docker $d" && exit 0
fi
fi
if [[ -f "$d/deploy/nexus-1panel.sh" ]]; then
q=$(docker_cmd ps --format '{{.Names}}' 2>/dev/null | grep -E '^nexus-prod-nexus-' || true)
[[ -n "$q" ]] && echo "docker $d" && exit 0
fi
if command -v supervisorctl >/dev/null 2>&1 && supervisorctl status nexus >/dev/null 2>&1; then
echo "supervisor $d"
exit 0
fi
done
echo "unknown"
REMOTE
)
RUNTIME="${REMOTE_RUNTIME%% *}"
DEPLOY_PATH="${REMOTE_RUNTIME#* }"
[[ "$DEPLOY_PATH" == "$REMOTE_RUNTIME" ]] && DEPLOY_PATH="/www/wwwroot/api.synaglobal.vip"
echo "Remote runtime: ${RUNTIME} @ ${DEPLOY_PATH}"
echo "▶ Building frontend (local verify)..."
cd frontend && npx vite build && cd ..
echo "✓ Build complete"
# 2. Tar the build output (index.html + assets/)
echo "▶ Packaging..."
tar czf /tmp/nexus-frontend.tar.gz -C web/app index.html assets/
echo "✓ Package ready ($(du -h /tmp/nexus-frontend.tar.gz | cut -f1))"
if [[ "$RUNTIME" == "docker" ]]; then
echo "▶ Docker 生产：重建镜像以包含新前端（非 tar 热更新）..."
ssh_cmd "cd ${DEPLOY_PATH} && sudo env NEXUS_ROOT=${DEPLOY_PATH} bash ${DEPLOY_PATH}/deploy/nexus-1panel.sh upgrade"
else
echo "▶ Packaging..."
tar czf /tmp/nexus-frontend.tar.gz -C web/app index.html assets/
echo "✓ Package ready ($(du -h /tmp/nexus-frontend.tar.gz | cut -f1))"
# 3. Upload to server
echo "▶ Uploading to server..."
scp /tmp/nexus-frontend.tar.gz nexus:/tmp/nexus-frontend.tar.gz
echo "✓ Upload complete"
echo "▶ Uploading to server..."
scp "${SSH_OPTS[@]}" /tmp/nexus-frontend.tar.gz "${NEXUS_SSH_HOST}:/tmp/nexus-frontend.tar.gz"
echo "✓ Upload complete"
# 4. Extract on server + prune orphaned legacy chunks
echo "▶ Deploying on server..."
ssh nexus "cd /www/wwwroot/api.synaglobal.vip/web/app && tar xzf /tmp/nexus-frontend.tar.gz && rm /tmp/nexus-frontend.tar.gz"
echo "▶ Pruning orphaned assets (dry-run first)..."
if ! ssh nexus "python3 /www/wwwroot/api.synaglobal.vip/deploy/prune_frontend_assets.py --dry-run"; then
echo "✗ Prune dry-run failed — aborting (no files deleted)"
exit 1
echo "▶ Deploying on server..."
ssh_cmd "cd ${DEPLOY_PATH}/web/app && tar xzf /tmp/nexus-frontend.tar.gz && rm /tmp/nexus-frontend.tar.gz"
echo "▶ Pruning orphaned assets..."
if ! ssh_cmd "python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py --dry-run"; then
echo "✗ Prune dry-run failed"
exit 1
fi
ssh_cmd "python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py"
echo "✓ Extracted and pruned"
echo "▶ Restarting backend..."
ssh_cmd "supervisorctl restart nexus"
echo "✓ Restarted"
fi
if ! ssh nexus "python3 /www/wwwroot/api.synaglobal.vip/deploy/prune_frontend_assets.py"; then
echo "✗ Prune failed — check index.html references before retry"
exit 1
fi
echo "✓ Extracted and pruned"
# 5. Restart backend
echo "▶ Restarting backend..."
ssh nexus "supervisorctl restart nexus"
echo "✓ Restarted"
# 6. Health check
sleep 3
HEALTH=$(ssh nexus "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8600/health" 2>/dev/null || echo "000")
SPA=$(ssh nexus "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8600/app/" 2>/dev/null || echo "000")
HEALTH=$(ssh_cmd "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8600/health" 2>/dev/null || echo "000")
SPA=$(ssh_cmd "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8600/app/" 2>/dev/null || echo "000")
echo ""
echo "═══ Verification ═══"
echo " /health → $HEALTH"
echo " /app/ → $SPA"
if [ "$HEALTH" = "200" ] && [ "$SPA" = "200" ]; then
if [[ "$HEALTH" == "200" || "$HEALTH" == "ok" ]] && [[ "$SPA" == "200" ]]; then
echo "✓ Deploy successful!"
else
echo "✗ Verification failed — check server logs"
deploy/deploy-on-server.sh
+73
View File
@@ -0,0 +1,73 @@
#!/usr/bin/env bash
# Run ON production server — 自动识别 Docker / Supervisor
#
# Usage (on server):
# cd /opt/nexus && sudo bash deploy/deploy-on-server.sh
# cd /www/wwwroot/api.synaglobal.vip && bash deploy/deploy-on-server.sh
#
# Optional env:
# NEXUS_GITEA_TOKEN — if git pull needs auth
# SKIP_FRONTEND=1 — Supervisor 模式跳过热更新前端 tar
# NEXUS_DEPLOY_PATH — 覆盖自动检测路径
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
# shellcheck source=./detect_deploy_runtime.sh
source "${SCRIPT_DIR}/detect_deploy_runtime.sh"
DEPLOY_PATH="$(resolve_nexus_root "${NEXUS_DEPLOY_PATH:-}" 2>/dev/null || true)"
if [[ -z "$DEPLOY_PATH" ]]; then
echo "ERROR: cannot resolve Nexus root" >&2
exit 1
fi
cd "${DEPLOY_PATH}"
RUNTIME="$(detect_nexus_runtime "$DEPLOY_PATH")"
PORT="$(nexus_publish_port_for "$DEPLOY_PATH")"
echo "═══ Nexus server-side deploy ═══"
echo "Path: ${DEPLOY_PATH}"
echo "Runtime: ${RUNTIME}"
if [[ -n "${NEXUS_GITEA_TOKEN:-}" ]]; then
git remote set-url origin "http://admin:${NEXUS_GITEA_TOKEN}@66.154.115.8:3000/admin/Nexus.git"
fi
if [[ "$RUNTIME" == "docker" ]]; then
echo "▶ Docker upgrade (pull + rebuild)..."
exec env NEXUS_ROOT="$DEPLOY_PATH" bash "$DEPLOY_PATH/deploy/nexus-1panel.sh" upgrade
fi
echo "▶ git fetch + reset --hard origin/main..."
git fetch --all
git reset --hard origin/main
echo " HEAD: $(git log -1 --oneline)"
echo "▶ supervisorctl restart nexus..."
supervisorctl restart nexus
if [[ -f /tmp/nexus-frontend.tar.gz && "${SKIP_FRONTEND:-0}" != "1" ]]; then
echo "▶ extract /tmp/nexus-frontend.tar.gz..."
tar xzf /tmp/nexus-frontend.tar.gz -C web/app
rm -f /tmp/nexus-frontend.tar.gz
if [[ -f deploy/prune_frontend_assets.py ]]; then
python3 deploy/prune_frontend_assets.py --dry-run
python3 deploy/prune_frontend_assets.py
fi
supervisorctl restart nexus
fi
sleep 3
HEALTH=$(curl -s "http://127.0.0.1:${PORT}/health" || true)
SPA=$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}/app/" || echo "000")
echo " /health → ${HEALTH}"
echo " /app/ → ${SPA}"
if [[ "${HEALTH}" == "ok" && "${SPA}" == "200" ]]; then
echo "✓ Server deploy OK"
suggest_ops_cron "$DEPLOY_PATH"
else
echo "✗ Verify failed — check: supervisorctl status nexus" >&2
exit 1
fi
deploy/deploy-production.sh
+157 -21
View File
@@ -1,35 +1,48 @@
#!/usr/bin/env bash
# Full production deploy: push (optional) + backend pull + frontend tar + health
# Full production deploy: local rsync + backend upgrade + frontend + health
#
# 默认从本机工作区 rsync 到生产机，不 push Gitea、不远程 git pull。
#
# Prerequisites on YOUR machine:
# - SSH: ~/.ssh/config Host nexus OR export NEXUS_SSH="root@47.254.123.106"
# - rsync, SSH Host nexus OR export NEXUS_SSH="azureuser@20.24.218.235"
# - Key: export NEXUS_SSH_KEY=~/.ssh/id_rsa_nexus
# - Gitea push access for origin main
#
# Usage:
# cd "$NEXUS_ROOT"
# git add ... && git commit ... && git push origin main # if not pushed yet
# bash deploy/pre_deploy_check.sh
# bash deploy/deploy-production.sh
#
# 仍走 Gitea（仅当显式设置）:
# NEXUS_DEPLOY_VIA_GIT=1 bash deploy/deploy-production.sh
set -euo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "${ROOT}"
SECRETS="${ROOT}/deploy/nexus-1panel.secrets.sh"
if [[ -f "$SECRETS" ]]; then
# shellcheck disable=SC1090
source "$SECRETS"
fi
NEXUS_SSH_HOST="${NEXUS_SSH:-nexus}"
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=15)
if [ -n "${NEXUS_SSH_KEY:-}" ]; then
if [[ -n "${NEXUS_SSH_KEY:-}" ]]; then
SSH_OPTS+=(-i "${NEXUS_SSH_KEY}")
fi
ssh_cmd() { ssh "${SSH_OPTS[@]}" "${NEXUS_SSH_HOST}" "$@"; }
scp_cmd() { scp "${SSH_OPTS[@]}" "$@"; }
DEPLOY_PATH="${NEXUS_DEPLOY_PATH:-/www/wwwroot/api.synaglobal.vip}"
DEPLOY_VIA_GIT="${NEXUS_DEPLOY_VIA_GIT:-0}"
case "${DEPLOY_VIA_GIT}" in
1|true|yes|on) DEPLOY_VIA_GIT=1 ;;
*) DEPLOY_VIA_GIT=0 ;;
esac
echo "═══ Nexus production deploy ═══"
echo "SSH target: ${NEXUS_SSH_HOST}"
echo "Deploy path: ${DEPLOY_PATH}"
echo "Mode: $([[ "$DEPLOY_VIA_GIT" == 1 ]] && echo 'Gitea git pull' || echo 'local rsync')"
if ! ssh_cmd "echo SSH OK" >/dev/null 2>&1; then
echo "ERROR: Cannot SSH to ${NEXUS_SSH_HOST}" >&2
@@ -37,27 +50,150 @@ if ! ssh_cmd "echo SSH OK" >/dev/null 2>&1; then
exit 1
fi
echo "▶ Backend: git pull + restart..."
ssh_cmd "cd ${DEPLOY_PATH} && git fetch --all && git reset --hard origin/main && supervisorctl restart nexus"
REMOTE_DETECT=$(ssh_cmd 'bash -s' <<'REMOTE'
set -euo pipefail
docker_cmd() {
if docker "$@" 2>/dev/null; then return 0; fi
sudo docker "$@" 2>/dev/null
}
compose_cmd() {
if docker compose "$@" 2>/dev/null; then return 0; fi
sudo docker compose "$@" 2>/dev/null
}
for d in /opt/nexus /www/wwwroot/api.synaglobal.vip; do
[[ -d "$d/server" ]] || continue
echo "ROOT=$d"
if [[ -f "$d/docker/.env.prod" ]] && compose_cmd version >/dev/null 2>&1; then
prof="$d/docker/.host-profile"
[[ -f "$prof" ]] || prof="$d/docker/profiles/2c8g.env"
if [[ -f "$prof" ]]; then
args=(-f "$d/docker/docker-compose.prod.yml")
docker_cmd network inspect 1panel-network >/dev/null 2>&1 && \
[[ -f "$d/docker/docker-compose.1panel.yml" ]] && \
args+=(-f "$d/docker/docker-compose.1panel.yml")
q=$(cd "$d" && compose_cmd "${args[@]}" \
--env-file "$d/docker/.env.prod" --env-file "$prof" ps -q nexus 2>/dev/null || true)
[[ -n "$q" ]] && echo RUNTIME=docker && exit 0
fi
fi
if [[ -f "$d/deploy/nexus-1panel.sh" ]] && command -v nx >/dev/null 2>&1; then
q=$(docker_cmd ps --format '{{.Names}}' 2>/dev/null | grep -E '^nexus-prod-nexus-' || true)
[[ -n "$q" ]] && echo RUNTIME=docker && exit 0
fi
if command -v supervisorctl >/dev/null 2>&1 && supervisorctl status nexus >/dev/null 2>&1; then
echo RUNTIME=supervisor
exit 0
fi
echo RUNTIME=unknown
exit 0
done
echo RUNTIME=none
REMOTE
)
echo "▶ Frontend: build + upload..."
cd frontend && npx vite build && cd ..
tar czf /tmp/nexus-frontend.tar.gz -C web/app index.html assets/
scp_cmd /tmp/nexus-frontend.tar.gz "${NEXUS_SSH_HOST}:/tmp/nexus-frontend.tar.gz"
ssh_cmd "cd ${DEPLOY_PATH}/web/app && tar xzf /tmp/nexus-frontend.tar.gz && rm /tmp/nexus-frontend.tar.gz"
if ssh_cmd "test -f ${DEPLOY_PATH}/deploy/prune_frontend_assets.py"; then
ssh_cmd "python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py --dry-run"
ssh_cmd "python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py"
DEPLOY_PATH="${NEXUS_DEPLOY_PATH:-$(echo "$REMOTE_DETECT" | sed -n 's/^ROOT=//p' | head -1)}"
RUNTIME="$(echo "$REMOTE_DETECT" | sed -n 's/^RUNTIME=//p' | head -1)"
if [[ -z "$DEPLOY_PATH" ]]; then
DEPLOY_PATH="${NEXUS_DEPLOY_PATH:-/opt/nexus}"
fi
if [[ -z "$RUNTIME" || "$RUNTIME" == "none" ]]; then
RUNTIME="unknown"
fi
echo "Deploy path: ${DEPLOY_PATH}"
echo "Runtime: ${RUNTIME}"
resolve_deploy_chown() {
if [[ -n "${NEXUS_DEPLOY_CHOWN:-}" ]]; then
echo "${NEXUS_DEPLOY_CHOWN}"
return
fi
if ssh_cmd "getent passwd www >/dev/null 2>&1"; then
echo "www:www"
return
fi
ssh_cmd "stat -c '%U:%G' '${DEPLOY_PATH}'" 2>/dev/null || echo "azureuser:azureuser"
}
DEPLOY_CHOWN="$(resolve_deploy_chown)"
echo "File owner: ${DEPLOY_CHOWN}"
if [[ "$DEPLOY_VIA_GIT" == 1 ]]; then
echo "▶ Git mode: remote git pull..."
if [[ "$RUNTIME" == "docker" ]]; then
ssh_cmd "cd ${DEPLOY_PATH} && sudo git fetch --all && sudo git reset --hard origin/main && \
sudo env NEXUS_ROOT=${DEPLOY_PATH} bash ${DEPLOY_PATH}/deploy/nexus-1panel.sh upgrade"
elif [[ "$RUNTIME" == "supervisor" ]]; then
ssh_cmd "cd ${DEPLOY_PATH} && git fetch --all && git reset --hard origin/main && supervisorctl restart nexus"
else
echo "ERROR: 无法识别远程运行时" >&2
exit 1
fi
else
echo "▶ Local sync → ${DEPLOY_PATH}..."
NEXUS_DEPLOY_PATH="${DEPLOY_PATH}" bash "${ROOT}/deploy/rsync-local-to-server.sh"
if [[ "$RUNTIME" == "docker" ]]; then
echo "▶ Docker: 重建镜像（--skip-git）..."
ssh_cmd "sudo env NEXUS_ROOT=${DEPLOY_PATH} bash ${DEPLOY_PATH}/deploy/nexus-1panel.sh upgrade --skip-git"
elif [[ "$RUNTIME" == "supervisor" ]]; then
echo "▶ Supervisor: restart..."
ssh_cmd "supervisorctl restart nexus"
else
echo "ERROR: 无法识别远程运行时（非 Docker 也非 Supervisor）" >&2
echo " 请手动: ssh ${NEXUS_SSH_HOST} 'sudo nx update'" >&2
exit 1
fi
fi
if [[ "$RUNTIME" == "docker" || "$RUNTIME" == "supervisor" ]]; then
echo "▶ Frontend: local vite build + upload to host web/app..."
cd frontend && npx vite build && cd ..
tar czf /tmp/nexus-frontend.tar.gz -C web/app index.html assets/
scp_cmd /tmp/nexus-frontend.tar.gz "${NEXUS_SSH_HOST}:/tmp/nexus-frontend.tar.gz"
ssh_cmd "cd ${DEPLOY_PATH}/web/app && sudo tar xzf /tmp/nexus-frontend.tar.gz && rm /tmp/nexus-frontend.tar.gz && sudo chown -R ${DEPLOY_CHOWN} ${DEPLOY_PATH}/web/app"
echo "▶ Frontend V2: local vite build:safe + upload to host web/app-v2..."
cd frontend-v2 && npm run build:safe && cd ..
tar czf /tmp/nexus-frontend-v2.tar.gz -C web/app-v2 index.html assets/
scp_cmd /tmp/nexus-frontend-v2.tar.gz "${NEXUS_SSH_HOST}:/tmp/nexus-frontend-v2.tar.gz"
ssh_cmd "sudo mkdir -p ${DEPLOY_PATH}/web/app-v2 && cd ${DEPLOY_PATH}/web/app-v2 && sudo tar xzf /tmp/nexus-frontend-v2.tar.gz && rm /tmp/nexus-frontend-v2.tar.gz && sudo chown -R ${DEPLOY_CHOWN} ${DEPLOY_PATH}/web/app-v2"
if ssh_cmd "test -f ${DEPLOY_PATH}/deploy/prune_frontend_assets.py"; then
ssh_cmd "sudo python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py ${DEPLOY_PATH}/web/app --dry-run"
ssh_cmd "sudo python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py ${DEPLOY_PATH}/web/app"
fi
fi
if [[ "$RUNTIME" == "docker" ]]; then
echo "▶ Sync host web/app and web/app-v2 into container..."
ssh_cmd "sudo env NEXUS_ROOT=${DEPLOY_PATH} NEXUS_PUBLISH_PORT=\$(grep -E '^NEXUS_PUBLISH_PORT=' ${DEPLOY_PATH}/docker/.env.prod 2>/dev/null | cut -d= -f2 | tr -d '\"' || echo 8600) bash ${DEPLOY_PATH}/deploy/sync_webapp_to_container.sh" || {
echo "WARN: web/app sync failed — run sync_webapp_to_container.sh on server manually" >&2
}
fi
sleep 3
HEALTH=$(ssh_cmd "curl -s http://127.0.0.1:8600/health" 2>/dev/null || true)
SPA=$(ssh_cmd "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8600/app/" 2>/dev/null || echo "000")
PORT="$(ssh_cmd "grep -E '^NEXUS_PUBLISH_PORT=' ${DEPLOY_PATH}/docker/.env.prod 2>/dev/null | cut -d= -f2 | tr -d '\"'" 2>/dev/null || true)"
PORT="${PORT:-8600}"
HEALTH=$(ssh_cmd "curl -s http://127.0.0.1:${PORT}/health" 2>/dev/null || true)
SPA=$(ssh_cmd "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:${PORT}/app/" 2>/dev/null || echo "000")
SPA_V2=$(ssh_cmd "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:${PORT}/app-v2/" 2>/dev/null || echo "000")
echo " /health → ${HEALTH}"
echo " /app/ → ${SPA}"
if [ "${HEALTH}" = "ok" ] && [ "${SPA}" = "200" ]; then
echo " /app-v2/ → ${SPA_V2}"
if [[ "${HEALTH}" == "ok" && "${SPA}" == "200" && "${SPA_V2}" == "200" ]]; then
echo "✓ Deploy successful"
if ssh_cmd "command -v crontab >/dev/null && crontab -l 2>/dev/null | grep -q nexus-health-monitor" 2>/dev/null; then
echo "✓ Ops cron (health_monitor) already installed"
else
echo "▶ Installing ops cron (health_monitor + db_backup)…"
if ssh_cmd "sudo env NEXUS_ROOT=${DEPLOY_PATH} bash ${DEPLOY_PATH}/deploy/install_ops_cron.sh" 2>/dev/null; then
echo "✓ Ops cron installed"
else
echo " 提示: 远程 cron 安装失败，可在服务器执行: sudo nx cron"
fi
fi
else
echo "✗ Verification failed — check supervisor logs on server" >&2
echo "✗ Verification failed — check logs on server" >&2
exit 1
fi
deploy/detect-1panel-services.sh
+43
View File
@@ -0,0 +1,43 @@
#!/usr/bin/env bash
# Detect 1Panel App Store MySQL/Redis container names on 1panel-network.
# See: https://github.com/1Panel-dev/1Panel/issues/11676
# https://github.com/1Panel-dev/appstore (mysql/redis → networks: 1panel-network)
set -euo pipefail
network_container_names() {
docker network inspect 1panel-network --format '{{range .Containers}}{{.Name}} {{end}}' 2>/dev/null \
| tr ' ' '\n' | sed '/^$/d'
}
pick_service_container() {
local kind="$1"
local names line
names="$(network_container_names)"
if [[ -z "$names" ]]; then
docker ps --format '{{.Names}}' 2>/dev/null | grep -iE "(^1Panel-${kind}-|${kind})" | head -1 || true
return
fi
line="$(echo "$names" | grep -iE "^1Panel-${kind}-" | head -1 || true)"
if [[ -n "$line" ]]; then
echo "$line"
return
fi
echo "$names" | grep -i "$kind" | head -1 || true
}
if ! docker network inspect 1panel-network >/dev/null 2>&1; then
echo "1panel-network not found" >&2
exit 1
fi
MYSQL_HOST="$(pick_service_container mysql)"
REDIS_HOST="$(pick_service_container redis)"
if [[ -z "$MYSQL_HOST" && -z "$REDIS_HOST" ]]; then
echo "No MySQL/Redis containers on 1panel-network" >&2
exit 2
fi
[[ -n "$MYSQL_HOST" ]] && echo "NEXUS_1PANEL_DB_HOST=${MYSQL_HOST}"
[[ -n "$REDIS_HOST" ]] && echo "NEXUS_1PANEL_REDIS_HOST=${REDIS_HOST}"
deploy/detect_deploy_runtime.sh
+149
View File
@@ -0,0 +1,149 @@
#!/usr/bin/env bash
# Nexus — 部署运行时检测（Docker 1Panel / Supervisor 裸机）
#
# source deploy/detect_deploy_runtime.sh
# ROOT="$(resolve_nexus_root)"
# RUNTIME="$(detect_nexus_runtime "$ROOT")" # docker | supervisor | unknown
set -euo pipefail
_COMPOSE_FILE="docker/docker-compose.prod.yml"
_COMPOSE_1PANEL="docker/docker-compose.1panel.yml"
_ENV_PROD="docker/.env.prod"
resolve_nexus_root() {
local hint="${1:-}"
if [[ -n "$hint" && -d "$hint/server" ]]; then
echo "$hint"
return 0
fi
if [[ -n "${NEXUS_ROOT:-}" && -d "${NEXUS_ROOT}/server" ]]; then
echo "$NEXUS_ROOT"
return 0
fi
if [[ -n "${NEXUS_DEPLOY_PATH:-}" && -d "${NEXUS_DEPLOY_PATH}/server" ]]; then
echo "$NEXUS_DEPLOY_PATH"
return 0
fi
local d
for d in /opt/nexus /www/wwwroot/api.synaglobal.vip; do
if [[ -d "$d/server" ]]; then
echo "$d"
return 0
fi
done
for d in /www/wwwroot/*/; do
[[ -d "${d}server" ]] || continue
echo "${d%/}"
return 0
done
if command -v supervisorctl >/dev/null 2>&1; then
local cwd
cwd="$(supervisorctl status nexus 2>/dev/null | grep -oP 'cwd=\K[^ ,]+' || true)"
if [[ -n "$cwd" && -d "$cwd/server" ]]; then
echo "$cwd"
return 0
fi
fi
return 1
}
_has_1panel_network() {
docker network inspect 1panel-network >/dev/null 2>&1
}
detect_nexus_runtime() {
local root="$1"
if [[ -f "$root/$_ENV_PROD" ]] && command -v docker >/dev/null 2>&1 \
&& docker compose version >/dev/null 2>&1; then
local -a args=(-f "$root/$_COMPOSE_FILE")
if _has_1panel_network && [[ -f "$root/$_COMPOSE_1PANEL" ]]; then
args+=(-f "$root/$_COMPOSE_1PANEL")
fi
local prof q
prof="$root/docker/.host-profile"
[[ -f "$prof" ]] || prof="$root/docker/profiles/2c8g.env"
if [[ -f "$prof" ]]; then
q="$(cd "$root" && docker compose "${args[@]}" \
--env-file "$root/$_ENV_PROD" --env-file "$prof" \
ps -q nexus 2>/dev/null || true)"
if [[ -n "$q" ]]; then
echo docker
return 0
fi
fi
fi
if command -v supervisorctl >/dev/null 2>&1 \
&& supervisorctl status nexus >/dev/null 2>&1; then
echo supervisor
return 0
fi
echo unknown
}
nexus_publish_port_for() {
local root="$1"
local port
port="$(grep -E '^NEXUS_PUBLISH_PORT=' "$root/$_ENV_PROD" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r" ' || true)"
if [[ -z "$port" && -f "$root/.env" ]]; then
port="$(grep -E '^NEXUS_PORT=' "$root/.env" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r" ' || true)"
fi
echo "${port:-8600}"
}
nexus_restart_service() {
local root="$1"
local runtime
runtime="$(detect_nexus_runtime "$root")"
case "$runtime" in
docker)
local cname
cname="$(docker ps --format '{{.Names}}' 2>/dev/null | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true)"
if [[ -n "$cname" ]]; then
docker restart "$cname"
return 0
fi
return 1
;;
supervisor)
supervisorctl restart nexus
;;
*)
return 1
;;
esac
}
nexus_has_ops_cron() {
command -v crontab >/dev/null 2>&1 \
&& crontab -l 2>/dev/null | grep -q 'nexus-health-monitor'
}
suggest_ops_cron() {
local root="$1"
if nexus_has_ops_cron; then
return 0
fi
echo ""
echo "[WARN] 未检测到 health_monitor / db_backup cron"
echo " 建议: sudo bash ${root}/deploy/install_ops_cron.sh"
echo " 或: sudo nx cron"
}
prompt_ops_cron_if_missing() {
local root="$1"
if nexus_has_ops_cron; then
echo "[INFO] Crontab 已含 health_monitor / db_backup"
return 0
fi
suggest_ops_cron "$root"
if [[ ! -t 0 ]]; then
return 0
fi
local ans
read -r -p "现在安装巡检/备份 cron? [Y/n]: " ans
if [[ "$ans" == "n" || "$ans" == "N" ]]; then
echo "[WARN] 已跳过 cron 安装"
return 0
fi
bash "${root}/deploy/install_ops_cron.sh"
}
deploy/download-install-fresh.sh
+53
View File
@@ -0,0 +1,53 @@
#!/usr/bin/env bash
# 下载并执行 install-nexus-fresh.sh（公共仓库无需令牌）
#
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/download-install-fresh.sh" | bash
#
# 推荐直接使用:
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
set -euo pipefail
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
NEXUS_GIT_BRANCH="${NEXUS_GIT_BRANCH:-main}"
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/branch/${NEXUS_GIT_BRANCH}}"
OUT="${OUT:-/tmp/install-nexus-fresh.sh}"
RED='\033[0;31m'
GREEN='\033[0;32m'
NC='\033[0m'
err() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
ok() { echo -e "${GREEN}[OK]${NC} $*"; }
for cf in /root/.nexus-deploy.env /root/.nexus-secrets/nexus.env; do
[[ -f "$cf" ]] && set -a && source "$cf" && set +a
done
download() {
local url base
for base in "${NEXUS_RAW_BASE}" "http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/${NEXUS_GIT_BRANCH}"; do
url="${base}/deploy/install-nexus-fresh.sh"
if curl -fsSL "$url" -o "$OUT" 2>/dev/null && head -1 "$OUT" | grep -q '^#!/'; then
ok "已下载 install-nexus-fresh.sh"
chmod +x "$OUT"
exec bash "$OUT" "$@"
fi
done
if [[ -n "${NEXUS_GITEA_TOKEN:-}" ]]; then
url="http://${NEXUS_GITEA_HOST}/api/v1/repos/admin/Nexus/raw/deploy/install-nexus-fresh.sh?ref=${NEXUS_GIT_BRANCH}"
if curl -fsSL -H "Authorization: token ${NEXUS_GITEA_TOKEN}" "$url" -o "$OUT" 2>/dev/null \
&& head -1 "$OUT" | grep -q '^#!/'; then
ok "已下载（API + 令牌）"
chmod +x "$OUT"
exec bash "$OUT" "$@"
fi
fi
return 1
}
if ! download "$@"; then
err "下载失败，请改用公共仓库一键入口:"
err " curl -fsSL \"${NEXUS_RAW_BASE}/deploy/quick-install.sh\" | bash"
exit 1
fi
deploy/fix-1panel-mysql-grant.sh
+70
View File
@@ -0,0 +1,70 @@
#!/usr/bin/env bash
# Grant nexus@'%' on 1Panel App Store MySQL for Docker (1panel-network) install wizard.
# Fixes: Access denied for user 'nexus'@'172.18.x.x' (1045)
#
# Usage:
# MYSQL_ROOT_PASSWORD='root密码' NEXUS_DB_PASSWORD='nexus密码' bash deploy/fix-1panel-mysql-grant.sh
# bash deploy/fix-1panel-mysql-grant.sh # prompts
set -euo pipefail
NEXUS_DB_NAME="${NEXUS_DB_NAME:-nexus}"
NEXUS_DB_USER="${NEXUS_DB_USER:-nexus}"
info() { echo -e "\033[0;32m[INFO]\033[0m $*"; }
warn() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; exit 1; }
pick_mysql_container() {
local name
if [[ -n "${MYSQL_CONTAINER:-}" ]]; then
echo "$MYSQL_CONTAINER"
return 0
fi
if docker network inspect 1panel-network >/dev/null 2>&1; then
name="$(docker network inspect 1panel-network --format '{{range .Containers}}{{.Name}} {{end}}' \
| tr ' ' '\n' | grep -iE '^1Panel-mysql-' | head -1 || true)"
[[ -n "$name" ]] && echo "$name" && return 0
fi
name="$(docker ps --format '{{.Names}}' | grep -iE '^1Panel-mysql-' | head -1 || true)"
[[ -n "$name" ]] && echo "$name" && return 0
error "未找到 1Panel MySQL 容器（可设 MYSQL_CONTAINER=名称）"
}
prompt_secret() {
local var="$1" prompt="$2"
if [[ -n "${!var:-}" ]]; then
return 0
fi
read -r -s -p "$prompt: " "$var"
echo ""
if [[ -z "${!var:-}" ]]; then
error "$var 不能为空"
fi
}
main() {
[[ "${EUID:-$(id -u)}" -eq 0 ]] || error "请用 root 运行"
local mysql_c
mysql_c="$(pick_mysql_container)"
info "MySQL 容器: $mysql_c"
prompt_secret MYSQL_ROOT_PASSWORD "1Panel MySQL root 密码"
prompt_secret NEXUS_DB_PASSWORD "nexus 用户密码（与安装向导步骤 3 一致）"
info "创建库/用户并授权 ${NEXUS_DB_USER}@'%' → ${NEXUS_DB_NAME}.* ..."
docker exec -i "$mysql_c" mysql -uroot -p"${MYSQL_ROOT_PASSWORD}" <<SQL
CREATE DATABASE IF NOT EXISTS \`${NEXUS_DB_NAME}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER IF NOT EXISTS '${NEXUS_DB_USER}'@'%' IDENTIFIED BY '${NEXUS_DB_PASSWORD}';
ALTER USER '${NEXUS_DB_USER}'@'%' IDENTIFIED BY '${NEXUS_DB_PASSWORD}';
GRANT ALL PRIVILEGES ON \`${NEXUS_DB_NAME}\`.* TO '${NEXUS_DB_USER}'@'%';
FLUSH PRIVILEGES;
SELECT user, host FROM mysql.user WHERE user = '${NEXUS_DB_USER}';
SQL
info "完成。请在安装向导步骤 3 使用: 库/用户=${NEXUS_DB_NAME}/${NEXUS_DB_USER}，密码与上面一致"
info "若已改 install.py，执行: bash deploy/sync-install-wizard-to-container.sh"
}
main "$@"
deploy/gate_log.jsonl
+2826
View File
File diff suppressed because it is too large Load Diff
deploy/health_monitor.sh
+317 -56
View File
@@ -1,70 +1,331 @@
#!/bin/bash
#!/usr/bin/env bash
# Nexus — External Health Monitor (Layer 3 of 3-tier guardian)
# Runs via crontab every minute.
# Does NOT depend on Python — even if Python completely crashes, this script works.
# Runs via crontab every minute. Works on Docker (1Panel) and Supervisor bare-metal.
#
# Guardian layers:
# Layer 1: Supervisor — auto-restart crashed Python process
# Layer 2: Python self_monitor — internal Redis/MySQL/WS checks (30s)
# Layer 3: Shell health_monitor.sh — external HTTP health check (1min cron)
#
# Flow:
# 1. HTTP GET http://127.0.0.1:8600/health
# 2. If fails >= 3 consecutive times → restart via supervisorctl + Telegram alert
# 3. If restart succeeds → Telegram recovery notification
# 4. If restart fails → Telegram "needs human intervention" alert
#
# *** Configure DEPLOY_DIR and NEXUS_SERVICE before deploying ***
# Layer 1: Docker restart policy / Supervisor autorestart
# Layer 2: Python self_monitor (30s)
# Layer 3: This script — HTTP /health, 3 failures → restart + optional Telegram
set -euo pipefail
DEPLOY_DIR="${NEXUS_DEPLOY_DIR:-/opt/nexus}"
NEXUS_SERVICE="${NEXUS_SERVICE:-nexus}"
FAIL_FILE="/tmp/nexus_health_fail_count"
STATE_DIR=""
FAIL_FILE=""
LAST_RESTART_FILE=""
# Legacy paths (cron user may have created root-owned files under /tmp)
LEGACY_FAIL_FILE="/tmp/nexus_health_fail_count"
LEGACY_LAST_RESTART_FILE="/tmp/nexus_health_last_restart"
MAX_FAIL=3
HEALTH_URL="http://127.0.0.1:8600/health"
RESTART_COOLDOWN_SEC="${NEXUS_HEALTH_RESTART_COOLDOWN:-300}"
ENV_PROD="${DEPLOY_DIR}/docker/.env.prod"
# ── Read Telegram config from .env file ──
DOTENV="$DEPLOY_DIR/.env"
BOT_TOKEN=""
CHAT_ID=""
if [ -f "$DOTENV" ]; then
BOT_TOKEN=$(grep '^NEXUS_TELEGRAM_BOT_TOKEN=' "$DOTENV" 2>/dev/null | cut -d'=' -f2- || echo "")
CHAT_ID=$(grep '^NEXUS_TELEGRAM_CHAT_ID=' "$DOTENV" 2>/dev/null | cut -d'=' -f2- || echo "")
fi
send_telegram() {
[ -z "$BOT_TOKEN" ] || [ -z "$CHAT_ID" ] && return 1
curl -sf --max-time 10 "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
-d chat_id="$CHAT_ID" \
-d text="$1" \
-d parse_mode=HTML \
> /dev/null 2>&1
ensure_state_paths() {
if [[ -n "$STATE_DIR" ]]; then
return 0
fi
local preferred="${DEPLOY_DIR}/var/layer3-health"
local fallback="${HOME:-/tmp}/.nexus/layer3-health"
if mkdir -p "$preferred" 2>/dev/null && [[ -w "$preferred" ]]; then
STATE_DIR="$preferred"
elif command -v sudo >/dev/null 2>&1 && sudo mkdir -p "$preferred" 2>/dev/null \
&& sudo chown -R "$(id -un):$(id -gn)" "$preferred" 2>/dev/null \
&& [[ -w "$preferred" ]]; then
STATE_DIR="$preferred"
else
mkdir -p "$fallback"
STATE_DIR="$fallback"
fi
FAIL_FILE="${STATE_DIR}/fail_count"
LAST_RESTART_FILE="${STATE_DIR}/last_restart"
}
# ── Health Check ──
if ! curl -sf --max-time 5 "$HEALTH_URL" > /dev/null 2>&1; then
# Python is NOT responding
FAIL=$(cat "$FAIL_FILE" 2>/dev/null || echo "0")
FAIL=$((FAIL + 1))
echo "$FAIL" > "$FAIL_FILE"
docker_cmd() {
if docker "$@" 2>/dev/null; then
return 0
fi
if command -v sudo >/dev/null 2>&1; then
sudo docker "$@" 2>/dev/null
else
return 1
fi
}
if [ "$FAIL" -ge "$MAX_FAIL" ]; then
# Consecutive failures >= threshold → attempt restart
send_telegram "🔴 <b>Nexus后端连续${MAX_FAIL}次无响应</b>\n正在通过Supervisor自动重启..."
supervisorctl restart "$NEXUS_SERVICE" > /dev/null 2>&1
sleep 5
init_layer3_state() {
ensure_state_paths
chmod 755 "$STATE_DIR" 2>/dev/null || true
if [[ ! -f "$FAIL_FILE" && -f "$LEGACY_FAIL_FILE" ]]; then
cp "$LEGACY_FAIL_FILE" "$FAIL_FILE" 2>/dev/null || true
fi
if [[ ! -f "$LAST_RESTART_FILE" && -f "$LEGACY_LAST_RESTART_FILE" ]]; then
cp "$LEGACY_LAST_RESTART_FILE" "$LAST_RESTART_FILE" 2>/dev/null || true
fi
}
# Verify restart
if curl -sf --max-time 5 "$HEALTH_URL" > /dev/null 2>&1; then
send_telegram "🟢 <b>Nexus后端已恢复</b>\nSupervisor重启成功"
echo "0" > "$FAIL_FILE"
else
send_telegram "🔴 <b>Nexus重启后仍未恢复！请人工介入</b>\nSupervisor重启失败，需要手动检查"
# Don't reset fail count — keep retrying each cron cycle
fi
write_state_file() {
local path="$1" value="$2"
init_layer3_state
printf '%s\n' "$value" >"$path" 2>/dev/null || return 1
}
resolve_publish_port() {
local port
port="$(grep -E '^NEXUS_PUBLISH_PORT=' "$ENV_PROD" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r" ' || true)"
echo "${port:-8600}"
}
PUBLISH_PORT="$(resolve_publish_port)"
HEALTH_URL="http://127.0.0.1:${PUBLISH_PORT}/health"
resolve_nexus_container() {
docker_cmd ps --format '{{.Names}}' 2>/dev/null | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true
}
read_env_var() {
local key="$1" file="$2"
grep -E "^${key}=" "$file" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r"' || true
}
normalize_env_value() {
local v="${1:-}"
v="${v//$'\r'/}"
if [[ ${#v} -ge 2 && ${v:0:1} == '"' && ${v: -1} == '"' ]]; then
v="${v:1:-1}"
v="${v//\\n/$'\n'}"
v="${v//\\\"/\"}"
v="${v//\\\\/\\}"
fi
echo "$v"
}
load_telegram_from_db() {
local cname="$1"
[[ -n "$cname" ]] || return 1
[[ -n "${BOT_TOKEN:-}" && -n "${CHAT_ID:-}" ]] && return 0
local out token chat
out="$(docker_cmd exec "$cname" python3 -c "
import asyncio
from server.config import settings as s
from server.infrastructure.database.session import AsyncSessionLocal
async def main():
async with AsyncSessionLocal() as db:
await s.load_settings_from_db(db)
t = (s.TELEGRAM_BOT_TOKEN or '').strip()
c = (s.TELEGRAM_CHAT_ID or '').strip()
if t and c:
print(t)
print(c)
asyncio.run(main())
" 2>/dev/null)" || true
[[ -n "$out" ]] || return 1
token="$(printf '%s\n' "$out" | sed -n '1p')"
chat="$(printf '%s\n' "$out" | sed -n '2p')"
[[ -n "$token" && -n "$chat" ]] || return 1
BOT_TOKEN="$token"
CHAT_ID="$chat"
}
load_telegram_config() {
local cname="$1" dotenv
BOT_TOKEN=""
CHAT_ID=""
for dotenv in \
"${DEPLOY_DIR}/.env" \
"$ENV_PROD" \
; do
[[ -f "$dotenv" ]] || continue
BOT_TOKEN="$(read_env_var NEXUS_TELEGRAM_BOT_TOKEN "$dotenv")"
CHAT_ID="$(read_env_var NEXUS_TELEGRAM_CHAT_ID "$dotenv")"
[[ -n "$BOT_TOKEN" && -n "$CHAT_ID" ]] && return 0
done
if [[ -n "$cname" ]]; then
local line
while IFS= read -r line; do
case "$line" in
NEXUS_TELEGRAM_BOT_TOKEN=*) BOT_TOKEN="${line#NEXUS_TELEGRAM_BOT_TOKEN=}" ;;
NEXUS_TELEGRAM_CHAT_ID=*) CHAT_ID="${line#NEXUS_TELEGRAM_CHAT_ID=}" ;;
esac
done < <(docker_cmd exec "$cname" grep -E '^NEXUS_TELEGRAM_' /app/.env 2>/dev/null || true)
[[ -n "$BOT_TOKEN" && -n "$CHAT_ID" ]] && return 0
load_telegram_from_db "$cname" || true
fi
BOT_TOKEN="$(normalize_env_value "$BOT_TOKEN")"
CHAT_ID="$(normalize_env_value "$CHAT_ID")"
}
send_telegram() {
local msg="${1}" resp http log="${NEXUS_HEALTH_LOG:-/var/log/nexus_health.log}"
BOT_TOKEN="$(normalize_env_value "${BOT_TOKEN:-}")"
CHAT_ID="$(normalize_env_value "${CHAT_ID:-}")"
[[ -n "$BOT_TOKEN" && -n "$CHAT_ID" ]] || return 1
resp="$(curl -s --max-time 15 -w '\n%{http_code}' \
"https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
-d "chat_id=${CHAT_ID}" \
--data-urlencode "text=${msg}" \
-d "parse_mode=HTML" 2>/dev/null)" || return 1
http="${resp##*$'\n'}"
if [[ "$http" != "200" ]]; then
echo "$(date -Is 2>/dev/null || date) telegram send failed http=${http}" >> "$log" 2>/dev/null || true
return 1
fi
}
bump_fail_count() {
local fail=0
init_layer3_state
if command -v flock >/dev/null 2>&1; then
(
flock -x 9
fail="$(cat "$FAIL_FILE" 2>/dev/null || echo 0)"
fail=$((fail + 1))
write_state_file "$FAIL_FILE" "$fail" || true
) 9>"${FAIL_FILE}.lock"
fail="$(cat "$FAIL_FILE" 2>/dev/null || echo 0)"
else
fail="$(cat "$FAIL_FILE" 2>/dev/null || echo 0)"
fail=$((fail + 1))
write_state_file "$FAIL_FILE" "$fail" || true
fi
echo "$fail"
}
reset_fail_count() {
write_state_file "$FAIL_FILE" "0" || true
}
restart_cooldown_active() {
local now last elapsed
[[ -f "$LAST_RESTART_FILE" ]] || return 1
now="$(date +%s)"
last="$(cat "$LAST_RESTART_FILE" 2>/dev/null || echo 0)"
elapsed=$((now - last))
[[ "$elapsed" -lt "$RESTART_COOLDOWN_SEC" ]]
}
mark_restart_attempt() {
write_state_file "$LAST_RESTART_FILE" "$(date +%s)" || true
}
restart_nexus() {
local cname="$1" via=""
if [[ -n "$cname" ]]; then
docker_cmd restart "$cname" >/dev/null 2>&1 && via="Docker 容器 ${cname}"
elif command -v supervisorctl >/dev/null 2>&1 && supervisorctl status "$NEXUS_SERVICE" >/dev/null 2>&1; then
supervisorctl restart "$NEXUS_SERVICE" >/dev/null 2>&1 && via="Supervisor ${NEXUS_SERVICE}"
else
return 1
fi
echo "$via"
}
telegram_health_fail_cooldown() {
local body
body="$(cat <<EOF
🔴 <b>【Layer 3 宿主机巡检】健康检查连续失败（冷却期内）</b>
宿主机：${HOST_LABEL}
检测地址：${HEALTH_URL}
连续失败：已达 ${MAX_FAIL} 次
Docker 容器：${NEXUS_CONTAINER:-未识别}
具体情况：/health 仍不可达，但距上次自动重启不足 ${RESTART_COOLDOWN_SEC} 秒，本次跳过重启以免频繁抖动
建议操作：查看 docker logs ${NEXUS_CONTAINER:-nexus} 与 ${NEXUS_HEALTH_LOG:-/var/log/nexus_health.log}
时间：${TS_LABEL}
EOF
)"
send_telegram "$body" || true
}
telegram_health_fail_restart() {
local body
body="$(cat <<EOF
🔴 <b>【Layer 3 宿主机巡检】Nexus 连续 ${MAX_FAIL} 次无响应</b>
宿主机：${HOST_LABEL}
检测地址：${HEALTH_URL}
连续失败：${FAIL} 次（阈值 ${MAX_FAIL} 次）
Docker 容器：${NEXUS_CONTAINER:-未识别}
具体情况：宿主机 cron 无法访问 API 健康端点，平台可能已宕机或端口异常
正在执行：自动重启 Nexus 服务…
时间：${TS_LABEL}
EOF
)"
send_telegram "$body" || true
}
telegram_health_recovered() {
local via="$1" body
body="$(cat <<EOF
🟢 <b>【Layer 3 宿主机巡检】Nexus 已自动恢复</b>
宿主机：${HOST_LABEL}
检测地址：${HEALTH_URL}
恢复方式：${via}
具体情况：自动重启后 /health 检测通过，服务已恢复在线
时间：${TS_LABEL}
EOF
)"
send_telegram "$body" || true
}
telegram_health_still_down() {
local via="$1" body
body="$(cat <<EOF
🔴 <b>【Layer 3 宿主机巡检】自动重启后仍未恢复</b>
宿主机：${HOST_LABEL}
检测地址：${HEALTH_URL}
已尝试：${via}
具体情况：重启完成后 /health 仍失败，可能存在数据库/Redis 故障或配置错误
建议操作：立即 SSH 登录排查 docker logs、MySQL、Redis，需人工介入
时间：${TS_LABEL}
EOF
)"
send_telegram "$body" || true
}
telegram_health_restart_failed() {
local body
body="$(cat <<EOF
🔴 <b>【Layer 3 宿主机巡检】无法执行自动重启</b>
宿主机：${HOST_LABEL}
检测地址：${HEALTH_URL}
具体情况：未找到可重启的 Docker 容器或 Supervisor 服务（${NEXUS_SERVICE}）
建议操作：确认 nexus 容器名称与 docker ps 输出，手动执行 docker restart 或 nx update
时间：${TS_LABEL}
EOF
)"
send_telegram "$body" || true
}
NEXUS_CONTAINER="$(resolve_nexus_container)"
load_telegram_config "$NEXUS_CONTAINER"
init_layer3_state
HOST_LABEL="$(hostname -f 2>/dev/null || hostname 2>/dev/null || echo unknown)"
TS_LABEL="$(date '+%Y-%m-%d %H:%M:%S %Z' 2>/dev/null || date)"
if curl -sf --max-time 5 "$HEALTH_URL" > /dev/null 2>&1; then
reset_fail_count
exit 0
fi
FAIL="$(bump_fail_count)"
if [[ "$FAIL" -lt "$MAX_FAIL" ]]; then
exit 0
fi
if restart_cooldown_active; then
telegram_health_fail_cooldown
exit 0
fi
telegram_health_fail_restart
mark_restart_attempt
if VIA="$(restart_nexus "$NEXUS_CONTAINER")"; then
sleep 5
if curl -sf --max-time 5 "$HEALTH_URL" > /dev/null 2>&1; then
telegram_health_recovered "$VIA"
reset_fail_count
else
telegram_health_still_down "$VIA"
fi
else
# Python is responding normally
echo "0" > "$FAIL_FILE"
telegram_health_restart_failed
fi
deploy/install-1panel-docker.sh
+275
View File
@@ -0,0 +1,275 @@
#!/usr/bin/env bash
# =============================================================================
# Nexus 6.0 — 重装服务器一键入口（1Panel + Docker + Nexus）
#
# 适用：全新 VPS / 重装系统后，root 一条命令装完整栈。
#
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/install-1panel-docker.sh" | bash
#
# 4 核 16G + 自定义域名:
# curl -fsSL ".../install-1panel-docker.sh" | bash -s -- --profile 4c16g --domain api.example.com
#
# 已装 1Panel，只装 Nexus Docker:
# curl -fsSL ".../install-1panel-docker.sh" | bash -s -- --skip-1panel
#
# 流程:
# ① 可选：官方 1Panel 安装（含 Docker，交互式）
# ② 检测 / 安装 Docker Compose
# ③ install-nexus-fresh.sh → MySQL + Nexus 容器（Redis 自行安装）
#
# 反代：必须在 1Panel 面板 UI 配置，禁止脚本直接改 /opt/1panel/apps/
# 示例: deploy/1panel/openresty-nexus.conf.example
# =============================================================================
set -euo pipefail
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
NEXUS_GIT_BRANCH="${NEXUS_GIT_BRANCH:-main}"
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/branch/${NEXUS_GIT_BRANCH}}"
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
NEXUS_DOMAIN="${NEXUS_DOMAIN:-api.synaglobal.vip}"
NEXUS_PROFILE="${NEXUS_PROFILE:-2c8g}"
PANEL_INSTALL_URL="${PANEL_INSTALL_URL:-https://resource.1panel.pro/v2/quick_start.sh}"
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
BLUE='\033[0;34m'
NC='\033[0m'
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
step() { echo -e "${CYAN}[STEP]${NC} $*"; }
WITH_1PANEL=auto
SKIP_1PANEL=false
SKIP_DOCKER_INSTALL=false
EXTRA_ARGS=()
usage() {
cat <<EOF
重装服务器 — 1Panel + Docker + Nexus 一键安装
curl -fsSL "${NEXUS_RAW_BASE}/deploy/install-1panel-docker.sh" | bash
选项（传给 bash -s --）:
--with-1panel 未装 1Panel 时先跑官方安装脚本（交互式）
--skip-1panel 跳过 1Panel，只装 Nexus Docker 栈
--skip-docker-install 不自动装 Docker（已在 1Panel 装好）
--profile 2c8g|4c16g|1c4g
--domain NAME
--root PATH
-h, --help
说明:
- 1Panel 官方安装为交互式（端口/用户/密码），装完记下面板地址
- Nexus 密钥按本机自动生成，备份在 /root/.nexus-install-secrets-*.env
- 网站反代请在 1Panel UI 操作，勿手工改 /opt/1panel/apps/
EOF
}
while [[ $# -gt 0 ]]; do
case "$1" in
-h|--help) usage; exit 0 ;;
--with-1panel) WITH_1PANEL=true; shift ;;
--skip-1panel) SKIP_1PANEL=true; WITH_1PANEL=false; shift ;;
--skip-docker-install) SKIP_DOCKER_INSTALL=true; shift ;;
--profile|--domain|--root)
EXTRA_ARGS+=("$1" "$2")
shift 2
;;
--skip-clone|--skip-1panel-check)
EXTRA_ARGS+=("$1")
shift
;;
*) EXTRA_ARGS+=("$1"); shift ;;
esac
done
banner() {
echo ""
echo -e "${BLUE}╔══════════════════════════════════════════════════════════════╗${NC}"
echo -e "${BLUE}║${NC} Nexus — 1Panel + Docker + Nexus 一键安装 ${BLUE}║${NC}"
echo -e "${BLUE}║${NC} 域名: ${NEXUS_DOMAIN} 档位: ${NEXUS_PROFILE} ${BLUE}║${NC}"
echo -e "${BLUE}╚══════════════════════════════════════════════════════════════╝${NC}"
echo ""
}
require_root() {
if [[ "$(id -u)" -ne 0 ]]; then
error "请使用 root 执行（su - 后直接运行）"
exit 1
fi
}
load_deploy_env() {
for cf in /root/.nexus-deploy.env /root/.nexus-secrets/nexus.env; do
[[ -f "$cf" ]] && set -a && source "$cf" && set +a
done
unset NEXUS_SECRET_KEY NEXUS_API_KEY NEXUS_ENCRYPTION_KEY
}
has_1panel() {
command -v 1pctl >/dev/null 2>&1
}
has_docker_compose() {
docker compose version >/dev/null 2>&1
}
phase_1panel() {
if [[ "$SKIP_1PANEL" == true ]]; then
info "跳过 1Panel 安装（--skip-1panel）"
return 0
fi
if has_1panel; then
info "已安装 1Panel"
if 1pctl user-info >/dev/null 2>&1; then
1pctl user-info 2>/dev/null | grep -E '面板地址|面板用户' || true
else
warn "1pctl user-info 失败，面板可能需修复；继续安装 Nexus…"
fi
return 0
fi
if [[ "$WITH_1PANEL" == auto ]]; then
echo ""
warn "未检测到 1Panel（1pctl 不存在）"
echo " ① 先装 1Panel（推荐，含 Docker）再装 Nexus"
echo " ② 跳过 1Panel，仅装 Nexus Docker（需本机已有 Docker）"
echo ""
read -r -p "是否现在安装 1Panel? [Y/n]: " ans
case "${ans:-Y}" in
n|N) WITH_1PANEL=false ;;
*) WITH_1PANEL=true ;;
esac
fi
if [[ "$WITH_1PANEL" != true ]]; then
warn "未安装 1Panel，将仅安装 Nexus Docker 栈"
return 0
fi
step "安装 1Panel（官方脚本，交互式）..."
info "下载: $PANEL_INSTALL_URL"
local tmp
tmp="$(mktemp /tmp/1panel-quick-start.XXXXXX.sh)"
if ! curl -fsSL "$PANEL_INSTALL_URL" -o "$tmp"; then
error "下载 1Panel 安装脚本失败"
exit 1
fi
chmod +x "$tmp"
echo ""
warn "接下来为 1Panel 官方安装向导，请按提示设置端口、安全入口、用户名、密码"
warn "安装目录建议默认 /opt"
echo ""
bash "$tmp"
rm -f "$tmp"
if ! has_1panel; then
error "1Panel 安装后仍未找到 1pctl，请检查安装日志"
exit 1
fi
info "1Panel 安装完成"
1pctl user-info 2>/dev/null || true
echo ""
warn "请在 1Panel → 应用商店 安装 OpenResty（用于 HTTPS 反代）"
read -r -p "OpenResty 已装好或稍后自行安装，按 Enter 继续 Nexus 安装..."
}
install_docker_engine() {
step "安装 Docker Engine + Compose 插件..."
if command -v apt-get >/dev/null 2>&1; then
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get install -y -qq ca-certificates curl >/dev/null
curl -fsSL https://get.docker.com | sh
systemctl enable --now docker 2>/dev/null || true
elif command -v dnf >/dev/null 2>&1; then
dnf install -y -q docker docker-compose-plugin >/dev/null 2>&1 || \
curl -fsSL https://get.docker.com | sh
systemctl enable --now docker 2>/dev/null || true
else
curl -fsSL https://get.docker.com | sh
fi
}
phase_docker() {
step "检测 Docker Compose..."
if has_docker_compose; then
info "Docker Compose: $(docker compose version --short 2>/dev/null || docker compose version | head -1)"
return 0
fi
if [[ "$SKIP_DOCKER_INSTALL" == true ]]; then
error "未检测到 docker compose，且已指定 --skip-docker-install"
error "请在 1Panel → 容器 安装 Docker，或去掉该参数"
exit 1
fi
warn "未检测到 docker compose"
if has_1panel; then
warn "建议在 1Panel → 容器 安装 Docker 后重新运行本脚本"
read -r -p "是否尝试用 get.docker.com 自动安装? [y/N]: " ans
[[ "${ans:-N}" == y || "${ans:-N}" == Y ]] || exit 1
else
info "自动安装 Docker（get.docker.com）..."
fi
install_docker_engine
if ! has_docker_compose; then
error "Docker 安装后仍无 compose 插件，请手动安装 docker-compose-plugin"
exit 1
fi
info "Docker Compose 就绪"
}
download_fresh_installer() {
local name="install-nexus-fresh.sh" dest
dest="$(mktemp /tmp/install-nexus-fresh.XXXXXX.sh)"
local url base
for base in "${NEXUS_RAW_BASE}" "http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/${NEXUS_GIT_BRANCH}"; do
url="${base}/deploy/${name}"
if curl -fsSL "$url" -o "$dest" 2>/dev/null && head -1 "$dest" | grep -q '^#!/'; then
chmod +x "$dest"
echo "$dest"
return 0
fi
done
return 1
}
phase_nexus() {
step "安装 Nexus Docker 栈（MySQL + Nexus；Redis 请自行安装）..."
local installer
if [[ -x "${NEXUS_ROOT}/deploy/install-nexus-fresh.sh" ]]; then
installer="${NEXUS_ROOT}/deploy/install-nexus-fresh.sh"
info "使用本地: $installer"
exec bash "$installer" --skip-1panel-check "${EXTRA_ARGS[@]}"
fi
if installer="$(download_fresh_installer)"; then
info "已下载 install-nexus-fresh.sh"
exec bash "$installer" --skip-1panel-check "${EXTRA_ARGS[@]}"
fi
error "无法获取 install-nexus-fresh.sh，请检查 Gitea 可达性"
exit 1
}
main() {
banner
require_root
load_deploy_env
phase_1panel
phase_docker
phase_nexus
}
# curl | bash 时 stdin 脚本无 BASH_SOURCE[0]，不可配合 set -u 做入口判断
main "$@"
deploy/install-nexus-fresh.sh
+309
View File
@@ -0,0 +1,309 @@
#!/usr/bin/env bash
# =============================================================================
# Nexus 6.0 — 全新安装脚本（1Panel + Docker Compose）
#
# 适用：新机已装 1Panel / Docker，空库，走 /app/install.html 安装向导
# 风格参考 1Panel quick_start.sh：分阶段检查 + 结束输出访问地址
#
# 用法（公共仓库，root 下一条命令，参考 1Panel）:
#
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
#
# 已 clone 到 /opt/nexus:
# cd /opt/nexus && bash deploy/install-nexus-fresh.sh --skip-clone
#
# bash deploy/install-nexus-fresh.sh --profile 4c16g
#
# 公共仓库匿名 clone，无需 Gitea 令牌。NEXUS 密钥由安装脚本按机自动生成。
# =============================================================================
set -euo pipefail
_install_self="$(readlink -f "${BASH_SOURCE[0]}")"
if ! head -1 "$_install_self" | grep -q '^#!/'; then
echo "[ERROR] 脚本文件无效。若用 curl 下载，请改用: bash deploy/download-install-fresh.sh" >&2
exit 1
fi
if grep -qiE '^(Not found|404)' "$_install_self" 2>/dev/null; then
echo "[ERROR] 下载到的是 Gitea 404 页面，不是安装脚本。" >&2
echo " 请: cd /opt/nexus && git pull && sudo bash deploy/install-nexus-fresh.sh --skip-clone" >&2
exit 1
fi
# ── 默认配置（与 SECRETS.md / nexus-1panel 一致）──
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
NEXUS_GITEA_REPO="${NEXUS_GITEA_REPO:-admin/Nexus.git}"
NEXUS_DOMAIN="${NEXUS_DOMAIN:-api.synaglobal.vip}"
NEXUS_PROFILE="${NEXUS_PROFILE:-2c8g}"
NEXUS_GIT_BRANCH="${NEXUS_GIT_BRANCH:-main}"
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-http://66.154.115.8:3000/admin/Nexus/raw/branch/main}"
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
BLUE='\033[0;34m'
NC='\033[0m'
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
step() { echo -e "${CYAN}[STEP]${NC} $*"; }
usage() {
cat <<EOF
Nexus 6.0 全新安装（1Panel + Docker）
sudo bash install-nexus-fresh.sh [选项]
选项:
--domain NAME 公网域名（默认: ${NEXUS_DOMAIN}）
--profile NAME 资源档位 1c4g|2c8g|4c16g（默认: 2c8g）
--root PATH 安装目录（默认: /opt/nexus）
--skip-clone 已在 /opt/nexus，不重新 clone
--skip-1panel-check 不检测 1Panel 是否已安装
-h, --help 显示帮助
安装后请用浏览器打开: https://域名/app/install.html
root 下全局命令: nexus-fresh | nexus-update | nx
EOF
}
SKIP_1PANEL_CHECK=false
SKIP_CLONE=false
while [[ $# -gt 0 ]]; do
case "$1" in
-h|--help) usage; exit 0 ;;
--domain) NEXUS_DOMAIN="$2"; shift 2 ;;
--profile) NEXUS_PROFILE="$2"; shift 2 ;;
--root) NEXUS_ROOT="$2"; shift 2 ;;
--skip-clone) SKIP_CLONE=true; shift ;;
--skip-1panel-check) SKIP_1PANEL_CHECK=true; shift ;;
*) error "未知参数: $1"; usage; exit 1 ;;
esac
done
banner() {
echo ""
echo -e "${BLUE}╔══════════════════════════════════════════════════════════════╗${NC}"
echo -e "${BLUE}║${NC} Nexus 6.0 — 全新安装（1Panel + Docker Compose） ${BLUE}║${NC}"
echo -e "${BLUE}║${NC} 域名: ${NEXUS_DOMAIN} ${BLUE}║${NC}"
echo -e "${BLUE}║${NC} 档位: ${NEXUS_PROFILE} 目录: ${NEXUS_ROOT} ${BLUE}║${NC}"
echo -e "${BLUE}╚══════════════════════════════════════════════════════════════╝${NC}"
echo ""
}
load_credentials() {
step "加载凭据..."
local f
for f in /root/.nexus-deploy.env /root/.nexus-secrets/nexus.env; do
if [[ -f "$f" ]]; then
# shellcheck disable=SC1090
set -a
source "$f"
set +a
info "已加载 $f"
fi
done
if [[ -f "${NEXUS_ROOT}/deploy/nexus-1panel.secrets.sh" ]]; then
# shellcheck disable=SC1090
set -a
source "${NEXUS_ROOT}/deploy/nexus-1panel.secrets.sh"
set +a
info "已加载 ${NEXUS_ROOT}/deploy/nexus-1panel.secrets.sh（可选）"
fi
unset NEXUS_SECRET_KEY NEXUS_API_KEY NEXUS_ENCRYPTION_KEY
info "全新安装：NEXUS 密钥将在 docker/.env.prod 中按本机自动生成"
}
install_root_commands() {
[[ -d "${NEXUS_ROOT}/deploy" ]] || return 0
NEXUS_ROOT="$NEXUS_ROOT" bash "${NEXUS_ROOT}/deploy/install-nx-cli.sh" || true
info "全局命令: nx · nexus-update · nexus-fresh · nexus-install · nexus-1panel"
}
phase_preflight() {
step "阶段 1/6 — 环境检查"
if [[ "$(id -u)" -ne 0 ]]; then
error "请切换到 root 再执行（不要用 sudo 包一层）:"
error " su -"
error " bash $0 ..."
exit 1
fi
info "运行用户: root（无需 sudo）"
if [[ ! -f /etc/os-release ]]; then
error "无法识别操作系统"
exit 1
fi
# shellcheck disable=SC1091
source /etc/os-release
info "系统: ${NAME:-Linux} ${VERSION_ID:-}"
case "${ID:-}" in
ubuntu|debian) info "受支持的分支: Debian/Ubuntu ✓" ;;
centos|rhel|rocky|almalinux) info "受支持的分支: RHEL 系 ✓" ;;
*) warn "未在官方列表中测试，可能仍可运行" ;;
esac
local mem_kb
mem_kb="$(awk '/MemTotal/ {print $2}' /proc/meminfo 2>/dev/null || echo 0)"
if [[ "$mem_kb" -lt 3500000 ]]; then
warn "内存 < 4GB，建议档位 1c4g: --profile 1c4g"
else
info "内存: $((mem_kb / 1024 / 1024)) GiB 量级"
fi
}
phase_1panel() {
step "阶段 2/6 — 1Panel / Docker"
if [[ "$SKIP_1PANEL_CHECK" != true ]]; then
if command -v 1pctl >/dev/null 2>&1; then
info "检测到 1Panel (1pctl)"
if 1pctl version >/dev/null 2>&1; then
info "1Panel: $(1pctl version 2>/dev/null | head -1 || true)"
fi
else
warn "未检测到 1pctl — 若尚未安装 1Panel，可先执行:"
warn " curl -sSL https://resource.1panel.pro/v2/quick_start.sh -o quick_start.sh"
warn " bash quick_start.sh"
read -r -p "继续安装 Nexus? [y/N]: " cont
[[ "$cont" == "y" || "$cont" == "Y" ]] || exit 0
fi
fi
if ! docker compose version >/dev/null 2>&1; then
error "未检测到 docker compose"
error "请在 1Panel → 容器 中安装 Docker，或: apt install -y docker.io docker-compose-v2"
exit 1
fi
info "Docker Compose: $(docker compose version --short 2>/dev/null || docker compose version | head -1)"
}
phase_packages() {
step "阶段 3/6 — 依赖包"
if command -v apt-get >/dev/null 2>&1; then
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get install -y -qq git curl openssl ca-certificates iproute2 >/dev/null 2>&1 || true
elif command -v dnf >/dev/null 2>&1; then
dnf install -y -q git curl openssl ca-certificates iproute >/dev/null 2>&1 || true
fi
info "git / curl 就绪"
}
git_clone_url() {
if [[ -z "${NEXUS_GITEA_TOKEN:-}" ]]; then
echo "http://${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
else
echo "http://admin:${NEXUS_GITEA_TOKEN}@${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
fi
}
phase_clone() {
step "阶段 4/6 — 获取 Nexus 代码"
if [[ "$SKIP_CLONE" == true ]]; then
if [[ ! -d "${NEXUS_ROOT}/.git" ]]; then
error "--skip-clone 但 ${NEXUS_ROOT} 不是 git 仓库"
exit 1
fi
load_credentials
info "跳过 clone，使用现有 ${NEXUS_ROOT}"
info "版本: $(git -C "$NEXUS_ROOT" log -1 --oneline 2>/dev/null || echo '?')"
chmod +x "${NEXUS_ROOT}/deploy/"*.sh 2>/dev/null || true
return 0
fi
load_credentials
local url
url="$(git_clone_url)"
if [[ -z "${NEXUS_GITEA_TOKEN:-}" ]]; then
info "公共仓库：匿名 git clone（无需令牌）"
fi
mkdir -p "$(dirname "$NEXUS_ROOT")"
if [[ -d "${NEXUS_ROOT}/.git" ]]; then
info "仓库已存在，同步 ${NEXUS_GIT_BRANCH}..."
git -C "$NEXUS_ROOT" remote set-url origin "$url" 2>/dev/null || true
git -C "$NEXUS_ROOT" fetch origin "$NEXUS_GIT_BRANCH" --prune
git -C "$NEXUS_ROOT" reset --hard "origin/${NEXUS_GIT_BRANCH}"
else
if [[ -d "$NEXUS_ROOT" ]] && [[ -n "$(ls -A "$NEXUS_ROOT" 2>/dev/null)" ]]; then
error "目录非空且不是 git 仓库: $NEXUS_ROOT"
exit 1
fi
rm -rf "$NEXUS_ROOT"
info "克隆 → $NEXUS_ROOT"
git clone "$url" "$NEXUS_ROOT"
git -C "$NEXUS_ROOT" checkout "$NEXUS_GIT_BRANCH" 2>/dev/null || true
fi
load_credentials
info "版本: $(git -C "$NEXUS_ROOT" log -1 --oneline)"
chmod +x "${NEXUS_ROOT}/deploy/"*.sh 2>/dev/null || true
}
phase_install_stack() {
step "阶段 5/6 — Docker 构建与启动（全新库，约 10～20 分钟）"
export NEXUS_ROOT NEXUS_DOMAIN NEXUS_PROFILE
bash "${NEXUS_ROOT}/deploy/nexus-1panel.sh" install \
--fresh \
--skip-clone \
--profile "$NEXUS_PROFILE" \
--domain "$NEXUS_DOMAIN"
}
phase_post() {
step "阶段 6/6 — 收尾"
install_root_commands
local port health
port="8600"
health="$(curl -sf "http://127.0.0.1:${port}/health" 2>/dev/null || echo "pending")"
echo ""
echo -e "${GREEN}╔══════════════════════════════════════════════════════════════╗${NC}"
echo -e "${GREEN}║${NC} ${GREEN}Nexus 全新安装完成${NC} ${GREEN}║${NC}"
echo -e "${GREEN}╠══════════════════════════════════════════════════════════════╣${NC}"
echo -e "${GREEN}║${NC} 本地健康: http://127.0.0.1:${port}/health → ${health} ${GREEN}║${NC}"
echo -e "${GREEN}║${NC} ${GREEN}║${NC}"
echo -e "${GREEN}║${NC} ${YELLOW}① 浏览器完成安装向导（必做）${NC} ${GREEN}║${NC}"
echo -e "${GREEN}║${NC} https://${NEXUS_DOMAIN}/app/install.html ${GREEN}║${NC}"
echo -e "${GREEN}║${NC} ${GREEN}║${NC}"
echo -e "${GREEN}║${NC} ${YELLOW}② 1Panel 创建网站并反代${NC} ${GREEN}║${NC}"
echo -e "${GREEN}║${NC} 目标: http://127.0.0.1:${port} ${GREEN}║${NC}"
echo -e "${GREEN}║${NC} 示例: ${NEXUS_ROOT}/deploy/1panel/openresty-nexus.conf.example ${GREEN}║${NC}"
echo -e "${GREEN}║${NC} ${GREEN}║${NC}"
echo -e "${GREEN}║${NC} ${YELLOW}③ 日常运维${NC} ${GREEN}║${NC}"
echo -e "${GREEN}║${NC} nx # 统一菜单（一键更新 / 重启 / 日志） ${GREEN}║${NC}"
echo -e "${GREEN}║${NC} nexus-update # 等同 deploy/update.sh ${GREEN}║${NC}"
echo -e "${GREEN}╚══════════════════════════════════════════════════════════════╝${NC}"
echo ""
}
warn_if_already_installed() {
local env_prod="${NEXUS_ROOT}/docker/.env.prod" cname
[[ -f "$env_prod" ]] || return 0
cname="$(docker ps --format '{{.Names}}' 2>/dev/null | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true)"
if [[ -n "$cname" ]] && docker exec "$cname" test -f /var/lib/nexus/.install_locked 2>/dev/null; then
warn "检测到已安装并锁定的 Nexus（将清除 nexus-state 卷内配置并重建）"
read -r -p "确认继续全新安装? [y/N]: " ok
[[ "$ok" == "y" || "$ok" == "Y" ]] || exit 0
fi
}
main() {
banner
if [[ "$SKIP_CLONE" == true && -d "${NEXUS_ROOT}/deploy" ]]; then
install_root_commands
fi
warn_if_already_installed
phase_preflight
phase_1panel
phase_packages
phase_clone
phase_install_stack
phase_post
}
main "$@"
deploy/install-nx-cli.sh
+68
View File
@@ -0,0 +1,68 @@
#!/usr/bin/env bash
# 注册 Nexus 全局 CLI（/usr/local/bin）— install / upgrade / nx 均会调用
#
# NEXUS_ROOT=/opt/nexus bash deploy/install-nx-cli.sh
#
set -euo pipefail
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
BIN_DIR="${NEXUS_BIN_DIR:-/usr/local/bin}"
DEPLOY="${NEXUS_ROOT}/deploy"
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
if [[ ! -d "$DEPLOY" ]]; then
error "未找到 $DEPLOY"
exit 1
fi
if [[ "$(id -u)" -ne 0 ]]; then
warn "非 root：无法写入 $BIN_DIR，请使用 root 执行或: sudo bash $DEPLOY/install-nx-cli.sh"
exit 0
fi
chmod +x \
"$DEPLOY/nx" \
"$DEPLOY/update.sh" \
"$DEPLOY/nexus-1panel.sh" \
"$DEPLOY/install-nexus-fresh.sh" \
"$DEPLOY/quick-install.sh" \
"$DEPLOY/install-1panel-docker.sh" \
"$DEPLOY/upgrade-1panel-docker.sh" \
"$DEPLOY/sync-install-wizard-to-container.sh" \
"$DEPLOY/uninstall-mysql-compose.sh" \
"$DEPLOY/uninstall-redis-compose.sh" \
"$DEPLOY/install-nx-cli.sh" \
2>/dev/null || true
mkdir -p "$BIN_DIR"
link_cli() {
local src="$1" name="$2"
if [[ ! -f "$src" ]]; then
warn "跳过 $name（缺少 $src）"
return 0
fi
ln -sf "$src" "${BIN_DIR}/${name}"
}
link_cli "$DEPLOY/nx" nx
link_cli "$DEPLOY/update.sh" nexus-update
link_cli "$DEPLOY/install-nexus-fresh.sh" nexus-fresh
link_cli "$DEPLOY/quick-install.sh" nexus-install
link_cli "$DEPLOY/nexus-1panel.sh" nexus-1panel
link_cli "$DEPLOY/install-1panel-docker.sh" nexus-1panel-docker
if command -v nx >/dev/null 2>&1; then
info "全局命令已就绪: nx → $(readlink -f "$(command -v nx)" 2>/dev/null || command -v nx)"
else
error "nx 未出现在 PATH 中，请确认 $BIN_DIR 在 PATH 内"
exit 1
fi
deploy/install.sh
+1 -1
View File
@@ -416,7 +416,7 @@ server {
}
# Upload limit
client_max_body_size 100m;
client_max_body_size 500m;
# Well-known for SSL cert validation
location ~ \\.well-known {
deploy/install_ops_cron.sh
+81
View File
@@ -0,0 +1,81 @@
#!/usr/bin/env bash
# Nexus — 安装/更新 host crontab：health_monitor + db_backup
#
# sudo bash deploy/install_ops_cron.sh
# NEXUS_ROOT=/opt/nexus sudo bash deploy/install_ops_cron.sh
set -euo pipefail
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
DEPLOY_DIR="${NEXUS_ROOT}/deploy"
HEALTH_MARKER="nexus-health-monitor"
BACKUP_MARKER="nexus-mysql-backup"
HEALTH_LOG="${NEXUS_HEALTH_LOG:-/var/log/nexus_health.log}"
BACKUP_LOG="${NEXUS_BACKUP_LOG:-/var/log/nexus_backup.log}"
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
if [[ "$(id -u)" -ne 0 ]]; then
error "请使用 root 运行: sudo bash $0"
exit 1
fi
ensure_crontab() {
if command -v crontab >/dev/null 2>&1; then
return 0
fi
warn "未检测到 crontab，尝试安装 cron 包…"
if command -v apt-get >/dev/null 2>&1; then
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get install -y -qq cron
systemctl enable --now cron 2>/dev/null || systemctl enable --now crond 2>/dev/null || true
elif command -v yum >/dev/null 2>&1; then
yum install -y cronie
systemctl enable --now crond 2>/dev/null || true
fi
if ! command -v crontab >/dev/null 2>&1; then
error "无法安装 crontab（请手动: apt install cron）"
exit 1
fi
info "cron 已安装"
}
ensure_crontab
for f in \
"${DEPLOY_DIR}/health_monitor.sh" \
"${DEPLOY_DIR}/db_backup.sh" \
"${DEPLOY_DIR}/mysql_dump_to_file.sh" \
; do
if [[ ! -f "$f" ]]; then
error "缺少脚本: $f"
exit 1
fi
chmod +x "$f" 2>/dev/null || true
done
touch "$HEALTH_LOG" "$BACKUP_LOG" 2>/dev/null || true
chmod 644 "$HEALTH_LOG" "$BACKUP_LOG" 2>/dev/null || true
HEALTH_LINE="* * * * * NEXUS_DEPLOY_DIR=${NEXUS_ROOT} bash ${DEPLOY_DIR}/health_monitor.sh >> ${HEALTH_LOG} 2>&1 # ${HEALTH_MARKER}"
BACKUP_LINE="0 3 * * * NEXUS_ROOT=${NEXUS_ROOT} bash ${DEPLOY_DIR}/db_backup.sh >> ${BACKUP_LOG} 2>&1 # ${BACKUP_MARKER}"
existing="$(crontab -l 2>/dev/null || true)"
filtered="$(printf '%s\n' "$existing" | grep -v "$HEALTH_MARKER" | grep -v "$BACKUP_MARKER" | grep -v 'deploy/health_monitor.sh' | grep -v 'deploy/db_backup.sh' || true)"
{
printf '%s\n' "$filtered" | sed '/^[[:space:]]*$/d'
echo "$HEALTH_LINE"
echo "$BACKUP_LINE"
} | crontab -
info "已写入 crontab:"
crontab -l | grep -E "$HEALTH_MARKER|$BACKUP_MARKER" || true
info "健康巡检日志: $HEALTH_LOG"
info "MySQL 备份日志: $BACKUP_LOG"
deploy/mysql_dump_to_file.sh
+196
View File
@@ -0,0 +1,196 @@
#!/usr/bin/env bash
# Nexus — MySQL dump（Docker 1Panel / 宿主机 mysqldump 通用）
#
# bash deploy/mysql_dump_to_file.sh --output /path/dump.sql [--root /opt/nexus]
# bash deploy/mysql_dump_to_file.sh --output /path/dump.sql --db-url 'mysql+aiomysql://...'
#
# 策略（按序）:
# 1. DB host 为运行中容器名 → docker exec 该容器内 mysqldump（连 127.0.0.1）
# 2. 宿主机有 mysqldump 且 host 可解析 → 本机 mysqldump
# 3. 1panel-network 存在 → docker run --rm mysql:8 客户端
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
OUTPUT=""
DB_URL=""
usage() {
cat <<'EOF'
用法: mysql_dump_to_file.sh --output FILE.sql [--root /opt/nexus] [--db-url URL]
EOF
}
while [[ $# -gt 0 ]]; do
case "$1" in
--output|-o) OUTPUT="$2"; shift 2 ;;
--root) NEXUS_ROOT="$2"; shift 2 ;;
--db-url) DB_URL="$2"; shift 2 ;;
-h|--help) usage; exit 0 ;;
*) echo "未知参数: $1" >&2; usage; exit 1 ;;
esac
done
if [[ -z "$OUTPUT" ]]; then
echo "缺少 --output" >&2
usage
exit 1
fi
resolve_db_url() {
if [[ -n "$DB_URL" ]]; then
echo "$DB_URL"
return 0
fi
local cname url
cname="$(docker ps --format '{{.Names}}' 2>/dev/null | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true)"
if [[ -n "$cname" ]]; then
url="$(docker exec "$cname" grep -E '^NEXUS_DATABASE_URL=' /app/.env 2>/dev/null | head -1 | cut -d= -f2- | tr -d '"' | tr -d "'" || true)"
[[ -n "$url" ]] && echo "$url" && return 0
fi
for f in \
"${NEXUS_ROOT}/docker/.env.prod" \
"${NEXUS_ROOT}/.env" \
; do
[[ -f "$f" ]] || continue
url="$(grep -E '^NEXUS_DATABASE_URL=' "$f" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '"' | tr -d "'" || true)"
[[ -n "$url" ]] && echo "$url" && return 0
done
return 1
}
DB_URL="$(resolve_db_url || true)"
if [[ -z "$DB_URL" ]]; then
echo "未找到 NEXUS_DATABASE_URL" >&2
exit 1
fi
python3 - "$DB_URL" "$OUTPUT" <<'PY'
import shutil
import subprocess
import sys
import urllib.parse
def docker_names() -> set[str]:
r = subprocess.run(
["docker", "ps", "--format", "{{.Names}}"],
capture_output=True,
text=True,
check=False,
)
return {ln.strip() for ln in (r.stdout or "").splitlines() if ln.strip()}
def network_exists(name: str) -> bool:
return (
subprocess.run(
["docker", "network", "inspect", name],
capture_output=True,
check=False,
).returncode
== 0
)
def write_dump(cmd: list[str], env: dict[str, str], out: str) -> int:
r = subprocess.run(cmd, env=env, capture_output=True, text=True)
if r.returncode != 0:
sys.stderr.write(r.stderr or r.stdout or "mysqldump failed\n")
return r.returncode
with open(out, "w", encoding="utf-8") as fh:
fh.write(r.stdout)
return 0
def dump_flags(db: str) -> list[str]:
return [
"--single-transaction",
"--routines",
"--triggers",
"--set-gtid-purged=OFF",
db,
]
url = sys.argv[1].replace("mysql+aiomysql://", "mysql://", 1)
url = url.replace("mysql+asyncmy://", "mysql://", 1)
out = sys.argv[2]
p = urllib.parse.urlparse(url)
user = urllib.parse.unquote(p.username or "")
password = urllib.parse.unquote(p.password or "")
host = p.hostname or "127.0.0.1"
if host == "host.docker.internal":
host = "127.0.0.1"
port = str(p.port or 3306)
db = (p.path or "/nexus").lstrip("/").split("?")[0]
env = {**__import__("os").environ, "MYSQL_PWD": password}
names = docker_names()
# 1) MySQL 跑在 Docker 容器内（1Panel 常见：URL host = 容器名）
if host in names:
cmd = [
"docker",
"exec",
"-e",
f"MYSQL_PWD={password}",
host,
"mysqldump",
"-h",
"127.0.0.1",
"-P",
port,
"-u",
user,
*dump_flags(db),
]
rc = write_dump(cmd, env, out)
if rc == 0:
sys.exit(0)
sys.stderr.write(f"docker exec {host} mysqldump 失败，尝试其它方式…\n")
# 2) 宿主机 mysqldump
if shutil.which("mysqldump"):
cmd = [
"mysqldump",
"-h",
host,
"-P",
port,
"-u",
user,
*dump_flags(db),
]
rc = write_dump(cmd, env, out)
if rc == 0:
sys.exit(0)
# 3) 临时 mysql 客户端容器（1panel-network）
for net in ("1panel-network", "bridge"):
if not network_exists(net):
continue
cmd = [
"docker",
"run",
"--rm",
"--network",
net,
"-e",
f"MYSQL_PWD={password}",
"mysql:8.0",
"mysqldump",
"-h",
host,
"-P",
port,
"-u",
user,
*dump_flags(db),
]
rc = write_dump(cmd, env, out)
if rc == 0:
sys.exit(0)
sys.stderr.write("所有 mysqldump 策略均失败（无宿主机客户端且 Docker 回退不可用）\n")
sys.exit(1)
PY
deploy/nexus-1panel.sh
+1353
View File
File diff suppressed because it is too large Load Diff
deploy/nginx_http.conf
+1 -1
View File
@@ -75,5 +75,5 @@ server {
error_log {{LOG_DIR}}/{{SERVER_NAME}}_nexus.error.log;
# ── Upload limit ──
client_max_body_size 100m;
client_max_body_size 500m;
}
deploy/nginx_https.conf
+1 -1
View File
@@ -109,5 +109,5 @@ server {
error_log {{LOG_DIR}}/{{SERVER_NAME}}.error.log;
# ── Upload limit ──
client_max_body_size 100m;
client_max_body_size 500m;
}
deploy/nx
+452
View File
@@ -0,0 +1,452 @@
#!/usr/bin/env bash
# Nexus NX — 统一运维菜单（安装 + 升级 + 日常运维）
#
# nx 交互菜单
# nx update 一键更新（等同 deploy/update.sh）
# nx update --no-cache 无缓存重建镜像
# nx install-fresh 全新安装
# nx health 健康检查
#
set -euo pipefail
NX_SELF="$(readlink -f "${BASH_SOURCE[0]}")"
NX_DIR="$(cd "$(dirname "$NX_SELF")" && pwd)"
# shellcheck source=./nexus-1panel.sh
source "${NX_DIR}/nexus-1panel.sh"
pause_enter() {
echo ""
read -r -p "按 Enter 继续..."
}
clear_screen() {
if [[ -t 1 ]]; then
clear 2>/dev/null || true
fi
}
is_stack_installed() {
[[ -d "${NEXUS_ROOT}/.git" && -f "${NEXUS_ROOT}/${ENV_PROD}" ]]
}
detect_runtime() {
if is_stack_installed && docker compose version >/dev/null 2>&1; then
local prof q
prof="$(profile_env_file "$NEXUS_ROOT")"
if [[ -f "$prof" && -f "$NEXUS_ROOT/$ENV_PROD" ]]; then
local -a det_args=(-f "$COMPOSE_FILE")
if has_1panel_network && [[ -f "$NEXUS_ROOT/$COMPOSE_1PANEL" ]]; then
det_args+=(-f "$COMPOSE_1PANEL")
fi
q="$(cd "$NEXUS_ROOT" && docker compose "${det_args[@]}" \
--env-file "$ENV_PROD" --env-file "$prof" ps -q nexus 2>/dev/null || true)"
if [[ -n "$q" ]]; then
NX_RUNTIME="docker"
return 0
fi
fi
fi
if command -v supervisorctl >/dev/null 2>&1 && supervisorctl status nexus >/dev/null 2>&1; then
NX_RUNTIME="supervisor"
return 0
fi
NX_RUNTIME="none"
}
install_nx_cli() {
NEXUS_ROOT="$(cd "${NX_DIR}/.." && pwd)" \
bash "${NX_DIR}/install-nx-cli.sh" 2>/dev/null || true
}
menu_header() {
local title="$1"
clear_screen
echo ""
echo "╔══════════════════════════════════════════════════════════╗"
printf "║ Nexus NX — %-44s║\n" "$title"
echo "╠══════════════════════════════════════════════════════════╣"
echo "║ 域名: ${NEXUS_DOMAIN} 目录: ${NEXUS_ROOT}"
if is_stack_installed; then
detect_runtime
echo "║ 运行: ${NX_RUNTIME} 档位: $(cat "${NEXUS_ROOT}/${HOST_PROFILE_FILE}" 2>/dev/null || echo "${NEXUS_PROFILE}")"
if [[ -d "${NEXUS_ROOT}/.git" ]]; then
echo "║ 版本: $(git -C "${NEXUS_ROOT}" log -1 --oneline 2>/dev/null || echo '?')"
fi
else
echo "║ 状态: 未安装"
fi
echo "╚══════════════════════════════════════════════════════════╝"
echo ""
}
run_install() {
local profile="${1:-2c8g}" extra="${2:-}"
NEXUS_PROFILE="$profile"
SKIP_CLONE=false
FRESH_INSTALL=false
NO_BACKUP=false
PRUNE_IMAGES=false
FROM_ENV="${NEXUS_FROM_ENV}"
case "$extra" in
skip-clone) SKIP_CLONE=true ;;
fresh) FRESH_INSTALL=true ;;
from-env) FROM_ENV="${NEXUS_FROM_ENV}" ;;
esac
load_secrets
cmd_install
install_nx_cli
pause_enter
}
menu_install() {
while true; do
menu_header "安装"
cat <<'EOF'
[1] 一键安装（默认 2核8G / 2c8g）
[2] 安装 — 4核16G（4c16g）
[3] 安装 — 1核4G（1c4g）
[4] 自定义规格（输入 CPU 与内存 GB）
[5] 已 clone 到 /opt/nexus，仅 pull + 启动（--skip-clone）
[6] 全新安装（install-nexus-fresh.sh → /app/install.html）
[7] 检查端口 / 防火墙（不安装）
[0] 返回
EOF
read -r -p "请选择: " choice
case "$choice" in
1) run_install 2c8g "" ;;
2) run_install 4c16g "" ;;
3) run_install 1c4g "" ;;
4)
read -r -p "CPU 核数: " cpus
read -r -p "内存 GB: " mem
CUSTOM_CPUS="$cpus"
CUSTOM_MEM_GB="$mem"
run_install 2c8g ""
;;
5) run_install 2c8g skip-clone ;;
6)
if [[ -x "${NX_DIR}/install-nexus-fresh.sh" ]]; then
bash "${NX_DIR}/install-nexus-fresh.sh" --profile "${NEXUS_PROFILE:-2c8g}"
else
run_install 2c8g fresh
fi
;;
7)
require_root
load_secrets
check_ports_preflight "$NEXUS_ROOT"
if is_stack_installed; then
check_ports_post "$NEXUS_ROOT"
fi
pause_enter
;;
0) return 0 ;;
*) warn "无效选项" ; sleep 1 ;;
esac
done
}
ops_restart_nexus() {
step "重启 Nexus（Python）..."
if [[ "$NX_RUNTIME" == "docker" ]]; then
compose_cmd "$NEXUS_ROOT" restart nexus
elif [[ "$NX_RUNTIME" == "supervisor" ]]; then
supervisorctl restart nexus
else
error "未检测到运行中的 Nexus"
return 1
fi
sleep 3
verify_health "$NEXUS_ROOT" "重启" || true
}
ops_restart_stack() {
step "重启 Compose 栈..."
compose_cmd "$NEXUS_ROOT" restart
sleep 5
verify_health "$NEXUS_ROOT" "重启" || true
}
ops_stop_stack() {
warn "将停止 Nexus 容器（MySQL/Redis 为外置服务，不受影响）"
read -r -p "确认? [y/N]: " c
[[ "$c" == "y" || "$c" == "Y" ]] || return 0
compose_cmd "$NEXUS_ROOT" stop
info "已停止"
}
ops_start_stack() {
compose_cmd "$NEXUS_ROOT" up -d --remove-orphans
verify_nexus_1panel_network "$NEXUS_ROOT" || return 1
verify_health "$NEXUS_ROOT" "启动" || true
}
ops_logs() {
local svc="${1:-nexus}"
echo ""
read -r -p "跟踪日志行数 [80]: " n
n="${n:-80}"
compose_cmd "$NEXUS_ROOT" logs --tail="$n" -f "$svc"
}
ops_status() {
if [[ "$NX_RUNTIME" == "docker" ]]; then
compose_cmd "$NEXUS_ROOT" ps
elif [[ "$NX_RUNTIME" == "supervisor" ]]; then
supervisorctl status nexus
fi
echo ""
local port h code
port="$(nexus_publish_port "$NEXUS_ROOT")"
h=$(curl -sf "http://127.0.0.1:${port}/health" 2>/dev/null || echo "fail")
info "/health → ${h}"
local cname
cname="$(nexus_container_name 2>/dev/null || true)"
code=$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app/install.html" 2>/dev/null || echo "000")
if [[ -n "$cname" ]] && nexus_container_has_install_lock "$cname"; then
if [[ "$code" == "404" ]]; then
info "/app/install.html → 已归档 (HTTP 404)"
else
warn "/app/install.html → 应已归档但 HTTP ${code}"
fi
else
info "/app/install.html → HTTP ${code}"
fi
}
ops_backup_now() {
NO_BACKUP=false
backup_mysql "$NEXUS_ROOT"
}
ops_install_cron() {
bash "${NX_DIR}/install_ops_cron.sh"
}
ops_update() {
local args=()
PRUNE_IMAGES=false
NO_BACKUP=false
NO_CACHE=false
read -r -p "跳过 MySQL 备份? [y/N]: " nb
[[ "$nb" == "y" || "$nb" == "Y" ]] && args+=(--no-backup)
read -r -p "无缓存重建镜像? [y/N]: " nc
[[ "$nc" == "y" || "$nc" == "Y" ]] && args+=(--no-cache)
read -r -p "升级后清理悬空镜像? [y/N]: " pr
[[ "$pr" == "y" || "$pr" == "Y" ]] && args+=(--prune)
bash "${NX_DIR}/update.sh" "${args[@]}"
pause_enter
}
require_installed() {
if ! is_stack_installed; then
warn "尚未安装，请先使用菜单 [1] 安装"
pause_enter
return 1
fi
require_root
load_secrets
load_saved_profile "$NEXUS_ROOT"
detect_runtime
return 0
}
menu_main() {
load_secrets
while true; do
menu_header "运维菜单"
cat <<'EOF'
── 安装 ──
[1] 安装向导（新机 / 迁机 / 档位）
[2] 全新安装 → /app/install.html
── 日常运维（需已安装）──
[3] 状态 + 健康检查
[4] 一键更新（pull + 重建镜像）★
[5] 重启 Nexus（Python）
[6] 查看 Nexus 日志
[7] 启动 / 停止 Compose 栈
[8] 重建镜像并启动（--build nexus）
[9] 备份 MySQL
[e] 安装巡检/备份 cron（health_monitor + db_backup）
[v] 1Panel 安装/运维验收脚本
── 其它 ──
[a] 检查 Git 是否有更新
[b] 端口 / 防火墙检查
[c] 进入 Nexus 容器 shell
[d] 1Panel 反代说明
[0] 退出
EOF
read -r -p "请选择: " choice
case "$choice" in
1) menu_install ;;
2)
require_root
if is_stack_installed; then
warn "将执行全新安装（清除 nexus-state 卷内旧配置并重建容器）"
read -r -p "确认继续? [y/N]: " fresh_ok
[[ "$fresh_ok" == "y" || "$fresh_ok" == "Y" ]] || continue
fi
exec bash "${NX_DIR}/install-nexus-fresh.sh" --profile "${NEXUS_PROFILE:-2c8g}"
;;
3)
require_root
if is_stack_installed; then
load_saved_profile "$NEXUS_ROOT"
detect_runtime
ops_status
else
check_ports_preflight "$NEXUS_ROOT"
fi
pause_enter
;;
4)
require_installed || continue
ops_update
;;
5)
require_installed || continue
ops_restart_nexus
pause_enter
;;
6)
require_installed || continue
ops_logs nexus
;;
7)
require_installed || continue
echo " [1] 启动 [2] 停止 [3] 重启栈"
read -r -p "选: " s
case "$s" in
1) ops_start_stack ;;
2) ops_stop_stack ;;
3) ops_restart_stack ;;
*) warn "无效" ;;
esac
pause_enter
;;
8)
require_installed || continue
read -r -p "无缓存重建? [y/N]: " nc
if [[ "$nc" == "y" || "$nc" == "Y" ]]; then
compose_cmd "$NEXUS_ROOT" build --no-cache nexus
fi
compose_cmd "$NEXUS_ROOT" up -d --build --remove-orphans nexus
verify_nexus_1panel_network "$NEXUS_ROOT" || true
verify_health "$NEXUS_ROOT" "重建" || true
pause_enter
;;
9)
require_installed || continue
ops_backup_now
pause_enter
;;
e|E)
require_root
ops_install_cron
pause_enter
;;
v|V)
require_root
bash "${NX_DIR}/verify-1panel-install-wizard.sh"
pause_enter
;;
a|A)
require_root
cmd_check
pause_enter
;;
b|B)
require_root
check_ports_preflight "$NEXUS_ROOT"
is_stack_installed && check_ports_post "$NEXUS_ROOT" || true
pause_enter
;;
c|C)
require_installed || continue
compose_cmd "$NEXUS_ROOT" exec nexus bash || compose_cmd "$NEXUS_ROOT" exec nexus sh
;;
d|D)
info "1Panel → 网站 → 创建站点 ${NEXUS_DOMAIN}"
info "反向代理: http://127.0.0.1:$(nexus_publish_port "$NEXUS_ROOT")"
info "示例: ${NEXUS_ROOT}/deploy/1panel/openresty-nexus.conf.example"
pause_enter
;;
0) exit 0 ;;
*) warn "无效选项"; sleep 1 ;;
esac
done
}
nx_main() {
local sub="${1:-}"
install_nx_cli
load_secrets
case "$sub" in
""|menu|god|ops|admin)
# god/ops 已合并进主菜单，保留别名兼容
[[ "$sub" == "god" || "$sub" == "ops" || "$sub" == "admin" ]] && \
warn "「上帝菜单」已合并进 nx 主菜单，直接选对应项即可"
menu_main
;;
install) menu_install ;;
update|upgrade)
require_root
shift || true
exec bash "${NX_DIR}/update.sh" "$@"
;;
install-fresh|fresh)
require_root
exec bash "${NX_DIR}/install-nexus-fresh.sh" "$@"
;;
install-auto|auto)
require_root
if is_stack_installed; then
warn "已安装，install-auto 将执行升级而非重复安装"
exec bash "${NX_DIR}/update.sh"
else
run_install "${NEXUS_PROFILE:-2c8g}" ""
fi
;;
health)
require_root
is_stack_installed && ops_status || check_ports_preflight "$NEXUS_ROOT"
;;
cron)
require_root
ops_install_cron
;;
verify)
require_root
bash "${NX_DIR}/verify-1panel-install-wizard.sh"
;;
-h|--help)
cat <<EOF
用法: nx [子命令]
(无) 统一运维菜单（安装 + 升级 + 重启 + 日志）
update 一键更新（等同 bash deploy/update.sh）
install-fresh 全新安装（/app/install.html）
install-auto 非交互安装（默认 2c8g）
health 健康检查
cron 安装 health_monitor + db_backup crontab
verify 运行 1Panel 验收脚本
god / ops 已合并进主菜单（兼容别名）
curl 入口:
安装 curl -fsSL .../deploy/quick-install.sh | bash
更新 curl -fsSL .../deploy/update.sh | bash
EOF
;;
*)
main "$@"
;;
esac
}
chmod +x "${NX_DIR}/nx" 2>/dev/null || true
nx_main "$@"
deploy/pre_deploy_check.sh
+69 -20
View File
@@ -1,6 +1,6 @@
#!/bin/bash
# Nexus Pre-deploy Gate Check (v2 — 7 gates)
# 在部署前强制检查 7 道门控，任何一道不过则阻止部署
# Nexus Pre-deploy Gate Check (v3 — 8 gates)
# 在部署前强制检查 8 道门控，任何一道不过则阻止部署
#
# 门控1: CHANGELOG — docs/changelog/ 下必须有今天的 .md 文件（且行数≥10）
# 门控2: AUDIT — docs/audit/ 下必须有今天的审计记录（且包含关键段落）
@@ -9,6 +9,7 @@
# 门控5: IMPORT — python -c "import server.main" 成功
# 门控6: SECURITY — bandit -r server/ 无 HIGH/MEDIUM
# 门控7: REVIEW — 审计文件包含 Closure表+文件清单+DoD，且文件清单与 git diff 交叉验证
# 门控8: AI_REVIEW — cursor-agent 审查 HEAD~1..HEAD；缓存 docs/reviews/<head_sha>.json
#
# 用法: bash deploy/pre_deploy_check.sh
# 退出码: 0=全部通过, 1=至少一道门未过
@@ -22,7 +23,7 @@ DEPLOY_DIR="${NEXUS_DEPLOY_DIR:-${_REPO_ROOT}}"
TODAY=$(date +%Y-%m-%d)
TIMESTAMP=$(date -Iseconds)
GATES_PASSED=0
GATES_TOTAL=7
GATES_TOTAL=8
BLOCKED=0
GATE_RESULTS=""
@@ -53,14 +54,14 @@ gate_log() {
}
echo "========================================"
echo " Nexus Pre-deploy Gate Check (v2)"
echo " Nexus Pre-deploy Gate Check (v3)"
echo " Date: ${TODAY}"
echo " Gates: ${GATES_TOTAL}"
echo "========================================"
echo ""
# ── Gate 1: Changelog (存在 + 行数≥10) ──
echo -n "Gate 1/7: Changelog ... "
echo -n "Gate 1/8: Changelog ... "
CHANGELOG_DIR="${DEPLOY_DIR}/docs/changelog"
if ls "${CHANGELOG_DIR}/${TODAY}-"*.md 1>/dev/null 2>&1; then
FILE=$(ls -t "${CHANGELOG_DIR}/${TODAY}-"*.md 2>/dev/null | head -1)
@@ -86,7 +87,7 @@ else
fi
# ── Gate 2: Audit (存在 + 关键段落) ──
echo -n "Gate 2/7: Audit ... "
echo -n "Gate 2/8: Audit ... "
AUDIT_DIR="${DEPLOY_DIR}/docs/audit"
if ls "${AUDIT_DIR}/${TODAY}-"*.md 1>/dev/null 2>&1; then
FILE=$(ls -t "${AUDIT_DIR}/${TODAY}-"*.md 2>/dev/null | head -1)
@@ -117,7 +118,7 @@ else
fi
# ── Gate 3: Test (必须存在 + 必须通过) ──
echo -n "Gate 3/7: Test ... "
echo -n "Gate 3/8: Test ... "
TEST_SCRIPT="${DEPLOY_DIR}/tests/test_api.py"
if [ ! -f "${TEST_SCRIPT}" ]; then
echo -e "${RED}BLOCK${NC}"
@@ -126,15 +127,43 @@ if [ ! -f "${TEST_SCRIPT}" ]; then
BLOCKED=1
gate_log "test" "BLOCK" "script not found"
else
TEST_OUTPUT=$(cd "${DEPLOY_DIR}" && python3 "${TEST_SCRIPT}" 2>&1) || true
# Always hit local API for gate 3 (ignore shell NEXUS_TEST_BASE used by import/e2e scripts)
TEST_OUTPUT=$(cd "${DEPLOY_DIR}" && env -u NEXUS_TEST_BASE NEXUS_TEST_BASE=http://127.0.0.1:8600 python3 "${TEST_SCRIPT}" 2>&1) || true
FAIL_COUNT=$(echo "${TEST_OUTPUT}" | grep -cE "^\s+\[FAIL\]" 2>/dev/null || true)
FAIL_COUNT=${FAIL_COUNT:-0}
GATE3_PASSED=0
if [ "${FAIL_COUNT}" -gt 0 ] || echo "${TEST_OUTPUT}" | grep -qE "[0-9]+ test(s) failed"; then
echo -e "${RED}BLOCK${NC}"
echo " └─ Tests failed. Output:"
echo "${TEST_OUTPUT}" | head -20 | sed 's/^/ │ /'
BLOCKED=1
gate_log "test" "BLOCK" "tests failed"
# 本机未起 :8600 时，若失败均为 Connection refused，回退 pytest 专项
NON_CONN_FAILS=$(echo "${TEST_OUTPUT}" | grep -E "^\s+\[FAIL\]" | grep -vcE "Connection refused|Errno 111" 2>/dev/null || true)
NON_CONN_FAILS=${NON_CONN_FAILS:-0}
if [ "${FAIL_COUNT}" -gt 0 ] && [ "${NON_CONN_FAILS}" -eq 0 ]; then
PYTEST_BIN=$(_pick_bin pytest || true)
FALLBACK_TESTS="tests/test_btpanel_ssh_bootstrap.py tests/test_terminal_quick_commands.py tests/test_gate_ai_review.py"
if [ -n "${PYTEST_BIN}" ]; then
echo -e "${YELLOW}fallback${NC}"
echo " └─ Local :8600 unreachable — running pytest gate batch"
FALLBACK_OUTPUT=$(cd "${DEPLOY_DIR}" && "${PYTEST_BIN}" ${FALLBACK_TESTS} -q 2>&1) || FALLBACK_RC=$?
FALLBACK_RC=${FALLBACK_RC:-0}
if [ "${FALLBACK_RC}" -eq 0 ]; then
echo -e " └─ ${GREEN}PASS${NC} (pytest fallback)"
GATES_PASSED=$((GATES_PASSED + 1))
gate_log "test" "PASS" "pytest fallback :8600 down"
GATE3_PASSED=1
else
echo -e " └─ ${RED}BLOCK${NC} pytest fallback failed:"
echo "${FALLBACK_OUTPUT}" | tail -15 | sed 's/^/ │ /'
BLOCKED=1
gate_log "test" "BLOCK" "pytest fallback failed"
fi
fi
fi
if [ "${GATE3_PASSED}" -eq 0 ]; then
echo -e "${RED}BLOCK${NC}"
echo " └─ Tests failed. Output:"
echo "${TEST_OUTPUT}" | head -20 | sed 's/^/ │ /'
BLOCKED=1
gate_log "test" "BLOCK" "tests failed"
fi
else
echo -e "${GREEN}PASS${NC}"
echo " └─ All tests passed"
@@ -144,7 +173,7 @@ else
fi
# ── Gate 4: Lint (ruff — F only: undefined names, unused imports) ──
echo -n "Gate 4/7: Lint ... "
echo -n "Gate 4/8: Lint ... "
RUFF_BIN=$(_pick_bin ruff || true)
if [ -n "${RUFF_BIN}" ]; then
LINT_OUTPUT=$(cd "${DEPLOY_DIR}" && "${RUFF_BIN}" check server/ --select F 2>&1) || true
@@ -171,7 +200,7 @@ else
fi
# ── Gate 5: Import (python -c "import server.main") ──
echo -n "Gate 5/7: Import ... "
echo -n "Gate 5/8: Import ... "
IMPORT_PYTHON=""
for p in "${DEPLOY_DIR}/.venv/bin/python3" "${DEPLOY_DIR}/venv/bin/python3"; do
if [ -x "${p}" ]; then
@@ -206,7 +235,7 @@ else
fi
# ── Gate 6: Security (bandit — HIGH only) ──
echo -n "Gate 6/7: Security ... "
echo -n "Gate 6/8: Security ... "
BANDIT_BIN=$(_pick_bin bandit || true)
if [ -n "${BANDIT_BIN}" ]; then
SEC_OUTPUT=$(cd "${DEPLOY_DIR}" && "${BANDIT_BIN}" -r server/ -f txt -ll 2>&1) || true
@@ -233,18 +262,18 @@ else
fi
# ── Gate 7: Review (审计文件交叉验证) ──
echo -n "Gate 7/7: Review ... "
echo -n "Gate 7/8: Review ... "
if ls "${AUDIT_DIR}/${TODAY}-"*.md 1>/dev/null 2>&1; then
FILE=$(ls -t "${AUDIT_DIR}/${TODAY}-"*.md 2>/dev/null | head -1)
# 检查审计文件中是否列出了实际改动的文件
REVIEW_OK=1
# 如果是git仓库，交叉验证改动文件
if command -v git &>/dev/null && [ -d "${DEPLOY_DIR}/.git" ]; then
CHANGED_FILES=$(cd "${DEPLOY_DIR}" && git diff --name-only HEAD~1 2>/dev/null || true)
CHANGED_FILES=$(cd "${DEPLOY_DIR}" && git diff --name-only HEAD~1..HEAD 2>/dev/null || true)
for CF in ${CHANGED_FILES}; do
# 跳过非代码文件
# 跳过非代码文件与门控运行日志
case "${CF}" in
docs/*|CLAUDE.md|*.md) continue ;;
docs/*|CLAUDE.md|*.md|deploy/gate_log.jsonl|web/app/assets/*) continue ;;
esac
# 检查审计文件是否提到了这个文件
if ! grep -q "$(basename "${CF}")" "${FILE}" 2>/dev/null; then
@@ -272,6 +301,26 @@ else
gate_log "review" "BLOCK" "no audit file"
fi
# ── Gate 8: AI Review (cursor-agent + docs/reviews cache) ──
echo -n "Gate 8/8: AI Review ... "
AI_REVIEW_OUT=$(cd "${DEPLOY_DIR}" && python3 "${DEPLOY_DIR}/scripts/gate_ai_review.py" 2>&1) || AI_REVIEW_RC=$?
AI_REVIEW_RC=${AI_REVIEW_RC:-0}
if [ "${AI_REVIEW_RC}" -eq 0 ]; then
echo -e "${GREEN}PASS${NC}"
echo "${AI_REVIEW_OUT}" | sed 's/^/ └─ /' | head -5
GATES_PASSED=$((GATES_PASSED + 1))
if echo "${AI_REVIEW_OUT}" | grep -qi "skip"; then
gate_log "ai_review" "PASS" "skipped no code"
else
gate_log "ai_review" "PASS" "ok"
fi
else
echo -e "${RED}BLOCK${NC}"
echo "${AI_REVIEW_OUT}" | sed 's/^/ │ /' | head -12
BLOCKED=1
gate_log "ai_review" "BLOCK" "see gate_ai_review.py output"
fi
# ── Pre-flight: shell scripts LF ──
echo -n "Pre-flight: Shell EOL (LF) ... "
if bash "${DEPLOY_DIR}/deploy/check_shell_eol.sh" >/dev/null 2>&1; then
deploy/preflight-release-host.sh
+197
View File
@@ -0,0 +1,197 @@
#!/usr/bin/env bash
# Nexus production host preflight before applying a release tarball.
#
# Usage:
# bash deploy/preflight-release-host.sh \
# --tarball /tmp/nexus-release-20260708.tar.gz \
# --sha256 a4eb8f35f0b98d40c1ad83117bfc652e7686ffc7d55f6bf90fcfd433a2ad6701 \
# --deploy-path /opt/nexus
set -euo pipefail
TARBALL=""
EXPECTED_SHA256=""
DEPLOY_PATH="${NEXUS_DEPLOY_PATH:-/opt/nexus}"
MIN_FREE_MB="${NEXUS_RELEASE_MIN_FREE_MB:-1024}"
info() { echo -e "\033[0;32m[INFO]\033[0m $*"; }
warn() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
usage() {
sed -n '1,12p' "$0"
}
while [[ $# -gt 0 ]]; do
case "$1" in
--tarball)
TARBALL="${2:-}"
shift 2
;;
--sha256)
EXPECTED_SHA256="${2:-}"
shift 2
;;
--deploy-path)
DEPLOY_PATH="${2:-}"
shift 2
;;
--min-free-mb)
MIN_FREE_MB="${2:-}"
shift 2
;;
-h|--help)
usage
exit 0
;;
*)
error "Unknown argument: $1"
usage
exit 2
;;
esac
done
check_cmd() {
local cmd="$1"
if command -v "$cmd" >/dev/null 2>&1; then
info "command OK: $cmd"
return 0
fi
error "missing command: $cmd"
return 1
}
docker_cmd() {
if docker "$@" 2>/dev/null; then return 0; fi
sudo docker "$@" 2>/dev/null
}
detect_runtime() {
if [[ -f "${DEPLOY_PATH}/docker/.env.prod" ]] && command -v docker >/dev/null 2>&1; then
echo docker
return
fi
if command -v supervisorctl >/dev/null 2>&1 && supervisorctl status nexus >/dev/null 2>&1; then
echo supervisor
return
fi
echo unknown
}
verify_tarball() {
if [[ -z "$TARBALL" ]]; then
warn "--tarball not provided; skipping tarball checksum/content checks"
return 0
fi
[[ -f "$TARBALL" ]] || {
error "tarball not found: $TARBALL"
return 1
}
info "tarball exists: $TARBALL"
if [[ -n "$EXPECTED_SHA256" ]]; then
local actual
actual="$(sha256sum "$TARBALL" | awk '{print $1}')"
if [[ "$actual" != "$EXPECTED_SHA256" ]]; then
error "SHA256 mismatch: expected=$EXPECTED_SHA256 actual=$actual"
return 1
fi
info "SHA256 OK: $actual"
else
warn "--sha256 not provided; checksum not verified"
fi
tar tzf "$TARBALL" nexus-release/server nexus-release/deploy nexus-release/web/app-v2 >/dev/null
info "tarball required paths OK"
}
check_deploy_path() {
if [[ -d "$DEPLOY_PATH" ]]; then
info "deploy path exists: $DEPLOY_PATH"
else
warn "deploy path does not exist yet: $DEPLOY_PATH"
fi
if [[ -f "${DEPLOY_PATH}/.env" ]]; then
info "runtime .env preserved path exists"
else
warn "${DEPLOY_PATH}/.env not found"
fi
if [[ -f "${DEPLOY_PATH}/docker/.env.prod" ]]; then
info "docker/.env.prod exists"
else
warn "${DEPLOY_PATH}/docker/.env.prod not found"
fi
if [[ -d "${DEPLOY_PATH}/web/data" ]]; then
info "web/data exists"
else
warn "${DEPLOY_PATH}/web/data not found"
fi
}
check_disk_space() {
local target free_mb
target="$DEPLOY_PATH"
[[ -e "$target" ]] || target="$(dirname "$DEPLOY_PATH")"
free_mb="$(df -Pm "$target" | awk 'NR==2 {print $4}')"
if [[ -z "$free_mb" ]]; then
warn "unable to determine free disk space for $target"
return 0
fi
if (( free_mb < MIN_FREE_MB )); then
error "low disk space on $target: ${free_mb}MB < ${MIN_FREE_MB}MB"
return 1
fi
info "disk free OK: ${free_mb}MB >= ${MIN_FREE_MB}MB"
}
check_runtime() {
local runtime
runtime="$(detect_runtime)"
info "runtime detected: $runtime"
case "$runtime" in
docker)
docker_cmd ps --format '{{.Names}}' | grep -E 'nexus-prod-nexus|nexus-nexus-1' >/dev/null \
&& info "Nexus docker container found" \
|| warn "Nexus docker container not found by known name pattern"
;;
supervisor)
supervisorctl status nexus || true
;;
*)
warn "runtime unknown; apply script may require manual restart"
;;
esac
}
check_local_endpoint() {
local port health app app_v2
port="$(grep -E '^NEXUS_PUBLISH_PORT=' "${DEPLOY_PATH}/docker/.env.prod" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r" ' || true)"
port="${port:-8600}"
health="$(curl -s "http://127.0.0.1:${port}/health" 2>/dev/null || true)"
app="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app/" 2>/dev/null || echo 000)"
app_v2="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app-v2/" 2>/dev/null || echo 000)"
echo " current /health -> ${health:-<empty>}"
echo " current /app/ -> ${app}"
echo " current /app-v2/ -> ${app_v2}"
}
main() {
local failures=0
for cmd in tar sha256sum df awk grep sed curl; do
check_cmd "$cmd" || failures=$((failures + 1))
done
check_cmd rsync || failures=$((failures + 1))
verify_tarball || failures=$((failures + 1))
check_deploy_path
check_disk_space || failures=$((failures + 1))
check_runtime
check_local_endpoint
if (( failures > 0 )); then
error "preflight failed: ${failures} blocking issue(s)"
return 1
fi
info "preflight OK"
}
main "$@"
deploy/quick-install.sh
+124
View File
@@ -0,0 +1,124 @@
#!/usr/bin/env bash
# =============================================================================
# Nexus 6.0 — 公共仓库一键安装入口（参考 1Panel quick_start.sh）
#
# root 登录后一条命令:
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
#
# 或保存后执行:
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" -o /tmp/quick-install.sh
# bash /tmp/quick-install.sh
#
# 可选参数会传给 install-nexus-fresh.sh，例如:
# bash /tmp/quick-install.sh --profile 4c16g
# =============================================================================
set -euo pipefail
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
NEXUS_GITEA_REPO="${NEXUS_GITEA_REPO:-admin/Nexus.git}"
NEXUS_GIT_BRANCH="${NEXUS_GIT_BRANCH:-main}"
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/branch/${NEXUS_GIT_BRANCH}}"
RED='\033[0;31m'
GREEN='\033[0;32m'
CYAN='\033[0;36m'
BLUE='\033[0;34m'
NC='\033[0m'
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
step() { echo -e "${CYAN}[STEP]${NC} $*"; }
usage() {
cat <<EOF
Nexus 公共仓库一键安装
curl -fsSL "${NEXUS_RAW_BASE}/deploy/quick-install.sh" | bash
可选参数: --profile 4c16g --domain 你的域名 --skip-1panel-check
EOF
}
validate_script_file() {
local f="$1"
if [[ ! -f "$f" ]] || ! head -1 "$f" | grep -q '^#!/'; then
return 1
fi
if grep -qiE '^(Not found|404)' "$f" 2>/dev/null; then
return 1
fi
return 0
}
download_script() {
local name="$1" dest="$2"
local url base
for base in \
"${NEXUS_RAW_BASE}" \
"http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/${NEXUS_GIT_BRANCH}"; do
url="${base}/deploy/${name}"
if curl -fsSL "$url" -o "$dest" 2>/dev/null && validate_script_file "$dest"; then
info "已下载 ${name}"
return 0
fi
done
return 1
}
run_via_git() {
local url="http://${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
if [[ -n "${NEXUS_GITEA_TOKEN:-}" ]]; then
url="http://admin:${NEXUS_GITEA_TOKEN}@${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
fi
step "改用 git clone..."
mkdir -p "$(dirname "$NEXUS_ROOT")"
if [[ -d "${NEXUS_ROOT}/.git" ]]; then
git -C "$NEXUS_ROOT" remote set-url origin "$url" 2>/dev/null || true
git -C "$NEXUS_ROOT" fetch origin "$NEXUS_GIT_BRANCH" --depth 1 2>/dev/null || \
git -C "$NEXUS_ROOT" fetch origin "$NEXUS_GIT_BRANCH" --prune
git -C "$NEXUS_ROOT" reset --hard "origin/${NEXUS_GIT_BRANCH}" 2>/dev/null || \
git -C "$NEXUS_ROOT" pull
else
rm -rf "$NEXUS_ROOT"
git clone --depth 1 -b "$NEXUS_GIT_BRANCH" "$url" "$NEXUS_ROOT"
fi
chmod +x "${NEXUS_ROOT}/deploy/"*.sh 2>/dev/null || true
exec bash "${NEXUS_ROOT}/deploy/install-nexus-fresh.sh" --skip-clone "$@"
}
main() {
if [[ "$(id -u)" -ne 0 ]]; then
error "请使用 root 执行（su - 后直接运行，不要用 sudo 包一层）"
exit 1
fi
for cf in /root/.nexus-deploy.env /root/.nexus-secrets/nexus.env; do
[[ -f "$cf" ]] && set -a && source "$cf" && set +a
done
unset NEXUS_SECRET_KEY NEXUS_API_KEY NEXUS_ENCRYPTION_KEY
echo ""
echo -e "${BLUE}╔══════════════════════════════════════════════════════════════╗${NC}"
echo -e "${BLUE}║${NC} Nexus 6.0 — 公共仓库一键安装 ${BLUE}║${NC}"
echo -e "${BLUE}╚══════════════════════════════════════════════════════════════╝${NC}"
echo ""
case "${1:-}" in
-h|--help) usage; exit 0 ;;
esac
local tmp
tmp="$(mktemp /tmp/install-nexus-fresh.XXXXXX.sh)"
if download_script "install-nexus-fresh.sh" "$tmp"; then
chmod +x "$tmp"
exec bash "$tmp" "$@"
fi
step "raw 下载失败，尝试 git clone..."
run_via_git "$@"
}
# curl | bash 时 stdin 脚本无 BASH_SOURCE[0]，不可配合 set -u 做入口判断
main "$@"
deploy/rsync-local-to-server.sh
+112
View File
@@ -0,0 +1,112 @@
#!/usr/bin/env bash
# Sync local Nexus working tree to production host (no Gitea push/pull).
# Transfer via tar|ssh; remote ownership auto-detected (www:www on BT, else deploy path owner).
#
# Usage:
# bash deploy/rsync-local-to-server.sh
# NEXUS_DEPLOY_PATH=/opt/nexus bash deploy/rsync-local-to-server.sh
set -euo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "${ROOT}"
SECRETS="${ROOT}/deploy/nexus-1panel.secrets.sh"
if [[ -f "$SECRETS" ]]; then
# shellcheck disable=SC1090
source "$SECRETS"
fi
NEXUS_SSH_HOST="${NEXUS_SSH:-nexus}"
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=15)
if [[ -n "${NEXUS_SSH_KEY:-}" ]]; then
SSH_OPTS+=(-i "${NEXUS_SSH_KEY}")
fi
ssh_cmd() { ssh "${SSH_OPTS[@]}" "${NEXUS_SSH_HOST}" "$@"; }
if ! ssh_cmd "echo SSH OK" >/dev/null 2>&1; then
echo "ERROR: Cannot SSH to ${NEXUS_SSH_HOST}" >&2
exit 1
fi
DEPLOY_PATH="${NEXUS_DEPLOY_PATH:-}"
if [[ -z "$DEPLOY_PATH" ]]; then
DEPLOY_PATH="$(ssh_cmd 'for d in /opt/nexus /www/wwwroot/api.synaglobal.vip; do [[ -d "$d/server" ]] && echo "$d" && exit 0; done; echo /opt/nexus')"
fi
resolve_deploy_chown() {
if [[ -n "${NEXUS_DEPLOY_CHOWN:-}" ]]; then
echo "${NEXUS_DEPLOY_CHOWN}"
return
fi
if ssh_cmd "getent passwd www >/dev/null 2>&1"; then
echo "www:www"
return
fi
ssh_cmd "stat -c '%U:%G' '${DEPLOY_PATH}'" 2>/dev/null || echo "azureuser:azureuser"
}
DEPLOY_CHOWN="$(resolve_deploy_chown)"
echo "═══ Nexus local → server sync ═══"
echo "SSH target: ${NEXUS_SSH_HOST}"
echo "Remote path: ${DEPLOY_PATH}"
echo "Owner: ${DEPLOY_CHOWN}"
TAR_EXCLUDES=(
--exclude='.git'
--exclude='.env'
--exclude='.env.*'
--exclude='SECRETS.md'
--exclude='deploy/nexus-1panel.secrets.sh'
--exclude='docker/.env.prod'
--exclude='web/data'
--exclude='frontend/node_modules'
--exclude='frontend-v2/node_modules'
--exclude='node_modules'
--exclude='.venv'
--exclude='.venv-*'
--exclude='venv'
--exclude='__pycache__'
--exclude='.pytest_cache'
--exclude='.ruff_cache'
--exclude='.cursor'
--exclude='.playwright-mcp'
--exclude='.install_locked'
--exclude='.install_state.json'
--exclude='web/app/assets'
--exclude='tmp'
--exclude='2025.2'
--exclude='=2025.2'
--exclude='*.bak-'
--exclude='frontend/test-results'
--exclude='frontend/e2e/.auth'
)
echo "▶ tar stream → ${DEPLOY_PATH} ..."
tar -C "${ROOT}" -czf - "${TAR_EXCLUDES[@]}" . | \
ssh "${SSH_OPTS[@]}" "${NEXUS_SSH_HOST}" "sudo tar -xzf - -C '${DEPLOY_PATH}'"
echo "▶ chown ${DEPLOY_CHOWN} (skip docker/.env.prod, web/data, .env) ..."
ssh_cmd "sudo bash -s" <<REMOTE
set -euo pipefail
root='${DEPLOY_PATH}'
own='${DEPLOY_CHOWN}'
chown_tree() {
local p="\$1"
[[ -e "\$p" ]] || return 0
sudo chown -R "\$own" "\$p"
}
for top in server deploy scripts tests standards docs frontend web; do
chown_tree "\$root/\$top"
done
if [[ -d "\$root/docker" ]]; then
while IFS= read -r -d '' p; do
sudo chown -R "\$own" "\$p"
done < <(find "\$root/docker" \( -path "\$root/docker/.env.prod" \) -prune -o -print0)
fi
for f in pyproject.toml requirements.txt requirements-dev.txt AGENTS.md CLAUDE.md; do
[[ -f "\$root/\$f" ]] && sudo chown "\$own" "\$root/\$f"
done
REMOTE
echo "✓ sync complete (owner ${DEPLOY_CHOWN})"
deploy/sync-install-wizard-to-container.sh
+96
View File
@@ -0,0 +1,96 @@
#!/usr/bin/env bash
# Sync install wizard static files into the running Nexus prod container.
# Primary fix: Dockerfile.prod bakes these into the image on build.
# This script is a safety net after upgrade if an old image is still running.
set -euo pipefail
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
NEXUS_PUBLISH_PORT="${NEXUS_PUBLISH_PORT:-8600}"
CONTAINER="${NEXUS_CONTAINER:-}"
info() { echo -e "\033[0;32m[INFO]\033[0m $*"; }
warn() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
resolve_container() {
if [[ -n "$CONTAINER" ]]; then
return 0
fi
CONTAINER="$(docker ps --format '{{.Names}}' | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true)"
if [[ -z "$CONTAINER" ]]; then
error "未找到运行中的 Nexus 容器（可设 NEXUS_CONTAINER=名称）"
exit 1
fi
info "容器: $CONTAINER"
}
sync_file() {
local src="$1" dest="$2"
if [[ ! -f "$src" ]]; then
error "缺少源文件: $src"
exit 1
fi
docker exec "$CONTAINER" mkdir -p "$(dirname "$dest")"
docker cp "$src" "${CONTAINER}:${dest}"
}
wizard_archived_in_container() {
docker exec "$CONTAINER" test -f /app/.install_locked 2>/dev/null \
|| docker exec "$CONTAINER" test -f /var/lib/nexus/.install_locked 2>/dev/null \
|| docker exec "$CONTAINER" test -f /app/web/app/install.html.bak 2>/dev/null
}
main() {
local app="$NEXUS_ROOT/web/app"
local wizard_archived=false
if [[ ! -f "$app/install.html" ]]; then
error "仓库中无 $app/install.html，请先 git pull"
exit 1
fi
resolve_container
if wizard_archived_in_container; then
wizard_archived=true
info "安装已锁定或向导已归档，跳过静态/Python 热同步"
local code
code="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${NEXUS_PUBLISH_PORT}/app/install.html" 2>/dev/null || echo 000)"
if [[ "$code" == "404" ]]; then
info "/app/install.html 已归档 → HTTP 404"
exit 0
fi
warn "/app/install.html 应已归档但返回 HTTP $code"
exit 1
fi
info "同步安装向导静态文件..."
sync_file "$app/install.html" /app/web/app/install.html
sync_file "$app/vendor/tailwindcss-browser.js" /app/web/app/vendor/tailwindcss-browser.js
sync_file "$app/vendor/theme-init.js" /app/web/app/vendor/theme-init.js
sync_file "$app/vendor/theme.css" /app/web/app/vendor/theme.css
sync_file "$app/vendor/alpinejs.min.js" /app/web/app/vendor/alpinejs.min.js
local install_py="$NEXUS_ROOT/server/api/install.py" code
if [[ -f "$install_py" ]]; then
info "同步 install.py（Docker Redis env-check 修复）..."
sync_file "$install_py" /app/server/api/install.py
info "重启 Nexus 容器以加载 Python 变更..."
docker restart "$CONTAINER" >/dev/null
for _ in $(seq 1 30); do
if curl -sf "http://127.0.0.1:${NEXUS_PUBLISH_PORT}/health" >/dev/null 2>&1; then
break
fi
sleep 2
done
else
warn "未找到 $install_py，跳过 Python 热同步"
fi
code="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${NEXUS_PUBLISH_PORT}/app/install.html" 2>/dev/null || echo 000)"
if [[ "$code" == "200" ]]; then
info "/app/install.html → HTTP 200"
else
warn "/app/install.html → HTTP $code（请检查 Nexus 是否在 ${NEXUS_PUBLISH_PORT} 监听）"
exit 1
fi
}
main "$@"
deploy/sync_webapp_to_container.sh
+119
View File
@@ -0,0 +1,119 @@
#!/usr/bin/env bash
# Sync Git-tracked web/app and web/app-v2 into the running Nexus Docker container.
#
# Root cause: Dockerfile.prod runs vite build inside the image; Docker layer cache
# can produce asset hashes that differ from committed web/app on the host.
#
# Usage (on production host after git pull / upgrade):
# NEXUS_ROOT=/opt/nexus bash deploy/sync_webapp_to_container.sh
#
# Called automatically from deploy/nexus-1panel.sh cmd_upgrade and deploy-production.sh.
set -euo pipefail
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
CONTAINER="${NEXUS_CONTAINER:-}"
NEXUS_PUBLISH_PORT="${NEXUS_PUBLISH_PORT:-8600}"
info() { echo -e "\033[0;32m[INFO]\033[0m $*"; }
warn() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
docker_cmd() {
if docker "$@" 2>/dev/null; then return 0; fi
sudo docker "$@" 2>/dev/null
}
resolve_container() {
if [[ -n "$CONTAINER" ]]; then
return 0
fi
CONTAINER="$(docker_cmd ps --format '{{.Names}}' | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true)"
if [[ -z "$CONTAINER" ]]; then
error "未找到运行中的 Nexus 容器（可设 NEXUS_CONTAINER=名称）"
exit 1
fi
info "容器: $CONTAINER"
}
verify_entry_bundle() {
local html bundle_path code
html="$(curl -sf "http://127.0.0.1:${NEXUS_PUBLISH_PORT}/app/" 2>/dev/null || true)"
bundle_path="$(printf '%s' "$html" | sed -n 's/.*src="\(\/app\/assets\/index-[^"]*\.js\)".*/\1/p' | head -1)"
if [[ -z "$bundle_path" ]]; then
error "/app/ index.html 未解析到主 bundle"
exit 1
fi
code="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${NEXUS_PUBLISH_PORT}${bundle_path}" 2>/dev/null || echo 000)"
if [[ "$code" != "200" ]]; then
error "主 bundle ${bundle_path} → HTTP ${code}"
exit 1
fi
info "入口校验 OK: ${bundle_path} → HTTP 200"
}
verify_app_v2_entry_bundle() {
local html bundle_path code
html="$(curl -sf "http://127.0.0.1:${NEXUS_PUBLISH_PORT}/app-v2/" 2>/dev/null || true)"
bundle_path="$(printf '%s' "$html" | sed -n 's/.*src="\(\/app-v2\/assets\/[^"]*\.js\)".*/\1/p' | head -1)"
if [[ -z "$bundle_path" ]]; then
error "/app-v2/ index.html 未解析到主 bundle"
exit 1
fi
code="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${NEXUS_PUBLISH_PORT}${bundle_path}" 2>/dev/null || echo 000)"
if [[ "$code" != "200" ]]; then
error "V2 主 bundle ${bundle_path} → HTTP ${code}"
exit 1
fi
info "V2 入口校验 OK: ${bundle_path} → HTTP 200"
}
main() {
local app="${NEXUS_ROOT}/web/app"
local app_v2="${NEXUS_ROOT}/web/app-v2"
if [[ ! -f "${app}/index.html" ]]; then
error "缺少 ${app}/index.html，请先 git pull"
exit 1
fi
if [[ ! -d "${app}/assets" ]]; then
error "缺少 ${app}/assets"
exit 1
fi
if [[ ! -f "${app_v2}/index.html" ]]; then
error "缺少 ${app_v2}/index.html，请先构建 frontend-v2"
exit 1
fi
if [[ ! -d "${app_v2}/assets" ]]; then
error "缺少 ${app_v2}/assets"
exit 1
fi
resolve_container
info "同步 web/app → 容器 /app/web/app ..."
docker_cmd exec "$CONTAINER" rm -rf /app/web/app/assets
docker_cmd exec "$CONTAINER" mkdir -p /app/web/app
docker_cmd cp "${app}/index.html" "${CONTAINER}:/app/web/app/index.html"
docker_cmd cp "${app}/assets" "${CONTAINER}:/app/web/app/assets"
if [[ -f "${app}/favicon.ico" ]]; then
docker_cmd cp "${app}/favicon.ico" "${CONTAINER}:/app/web/app/favicon.ico" 2>/dev/null || true
fi
info "同步 web/app-v2 → 容器 /app/web/app-v2 ..."
docker_cmd exec "$CONTAINER" rm -rf /app/web/app-v2/assets
docker_cmd exec "$CONTAINER" mkdir -p /app/web/app-v2
docker_cmd cp "${app_v2}/index.html" "${CONTAINER}:/app/web/app-v2/index.html"
docker_cmd cp "${app_v2}/assets" "${CONTAINER}:/app/web/app-v2/assets"
if [[ -x "${NEXUS_ROOT}/deploy/prune_frontend_assets.py" ]]; then
info "容器内 prune 未引用 assets（可选）..."
docker_cmd exec "$CONTAINER" python3 /app/deploy/prune_frontend_assets.py --dry-run 2>/dev/null || \
warn "容器内 prune 跳过（脚本或路径不可用）"
fi
verify_entry_bundle
verify_app_v2_entry_bundle
info "web/app 与 web/app-v2 同步完成"
}
main "$@"
deploy/test-1panel-redis.sh
+91
View File
@@ -0,0 +1,91 @@
#!/usr/bin/env bash
# Diagnose 1Panel Redis auth from Nexus container network perspective.
# Usage:
# REDIS_PASS='redis_WP3NyN' bash deploy/test-1panel-redis.sh
# bash deploy/test-1panel-redis.sh # prompts for password
set -euo pipefail
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
ENV_PROD="${NEXUS_ROOT}/docker/.env.prod"
info() { echo -e "\033[0;32m[INFO]\033[0m $*"; }
ok() { echo -e "\033[0;32m[OK]\033[0m $*"; }
fail() { echo -e "\033[0;31m[FAIL]\033[0m $*"; }
pick_redis_container() {
if [[ -n "${REDIS_CONTAINER:-}" ]]; then
echo "$REDIS_CONTAINER"
return 0
fi
local h
h="$(grep -E '^NEXUS_1PANEL_REDIS_HOST=' "$ENV_PROD" 2>/dev/null | cut -d= -f2- || true)"
if [[ -n "$h" ]]; then
echo "$h"
return 0
fi
if [[ -x "$NEXUS_ROOT/deploy/detect-1panel-services.sh" ]]; then
h="$("$NEXUS_ROOT/deploy/detect-1panel-services.sh" 2>/dev/null | sed -n 's/^NEXUS_1PANEL_REDIS_HOST=//p' | head -1)"
[[ -n "$h" ]] && echo "$h" && return 0
fi
docker ps --format '{{.Names}}' | grep -iE '^1Panel-redis-' | head -1 || true
}
try_ping() {
local label="$1" url="$2"
local nexus
nexus="$(docker ps --format '{{.Names}}' | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true)"
if [[ -z "$nexus" ]]; then
fail "未找到 Nexus 容器"
return 1
fi
if docker exec "$nexus" python3 -c "
import redis
r = redis.Redis.from_url('${url}', socket_timeout=3)
print(r.ping())
" 2>/dev/null | grep -q True; then
ok "$label → $url"
return 0
fi
fail "$label"
return 1
}
main() {
local redis_host pass
redis_host="$(pick_redis_container)"
[[ -n "$redis_host" ]] || { fail "未找到 Redis 容器/主机名"; exit 1; }
info "Redis 主机: $redis_host"
if [[ -z "${REDIS_PASS:-}" ]]; then
read -r -s -p "1Panel Redis 密码（应用参数）: " pass
echo ""
else
pass="$REDIS_PASS"
fi
echo ""
info "从 Nexus 容器内尝试多种 URL 格式（807f4c2 修复后）..."
local any=0
try_ping "无认证" "redis://${redis_host}:6379/0" && any=1 || true
if [[ -n "$pass" ]]; then
try_ping "仅密码 (:pass@)" "redis://:${pass}@${redis_host}:6379/0" && any=1 || true
try_ping "default 用户" "redis://default:${pass}@${redis_host}:6379/0" && any=1 || true
info "跳过 root 用户探测 — 1Panel Redis 无 root 账号"
fi
echo ""
if [[ "$any" -eq 1 ]]; then
ok "至少一种格式可用"
echo ""
info "安装向导步骤 3：1Panel Redis 无账号，只填密码（后端自动用 :pass@ 或 default）"
info "已有 .env 时写入 NEXUS_REDIS_URL，例如:"
info " redis://:${pass}@${redis_host}:6379/0"
info " 或 redis://default:${pass}@${redis_host}:6379/0"
exit 0
fi
fail "全部失败。请在 1Panel → Redis → 参数 核对密码，或检查 Nexus 是否在 1panel-network"
info "本机: docker exec -it ${redis_host} redis-cli -u 'redis://:密码@127.0.0.1:6379' ping"
exit 1
}
main "$@"
deploy/uninstall-mysql-compose.sh
+121
View File
@@ -0,0 +1,121 @@
#!/usr/bin/env bash
# =============================================================================
# 卸载 Nexus 旧版 Compose 内置 MySQL 容器
#
# bash deploy/uninstall-mysql-compose.sh
# bash deploy/uninstall-mysql-compose.sh --purge-volume
# =============================================================================
set -euo pipefail
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
COMPOSE_FILE="${COMPOSE_FILE:-docker/docker-compose.prod.yml}"
PURGE_VOLUME=false
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
usage() {
cat <<EOF
卸载 Nexus Compose 遗留 MySQL 容器
bash deploy/uninstall-mysql-compose.sh [--purge-volume]
说明:
- 不卸载宿主机/1Panel 自建的 MySQL
- 卸载后请自建库 nexus + 用户，安装向导步骤 3 填写连接信息
EOF
}
compose_env_args() {
local_env=()
[[ -f "${NEXUS_ROOT}/docker/.env.prod" ]] && local_env+=(--env-file "${NEXUS_ROOT}/docker/.env.prod")
local prof="${NEXUS_ROOT}/docker/.host-profile"
if [[ -f "$prof" ]]; then
local p
p="$(tr -d '\r\n' <"$prof")"
[[ -f "${NEXUS_ROOT}/docker/profiles/${p}.env" ]] && local_env+=(--env-file "${NEXUS_ROOT}/docker/profiles/${p}.env")
fi
}
while [[ $# -gt 0 ]]; do
case "$1" in
-h|--help) usage; exit 0 ;;
--purge-volume) PURGE_VOLUME=true; shift ;;
*) error "未知参数: $1"; usage; exit 1 ;;
esac
done
[[ "$(id -u)" -eq 0 ]] || { error "请使用 root 执行"; exit 1; }
removed=0
stop_rm_container() {
local name="$1"
if docker ps -a --format '{{.Names}}' | grep -qx "$name"; then
info "停止并删除容器: $name"
docker stop "$name" >/dev/null 2>&1 || true
docker rm -f "$name" >/dev/null 2>&1 || true
removed=$((removed + 1))
fi
}
for pattern in nexus-prod-mysql-1 nexus-prod-mysql nexus-mysql-1; do
stop_rm_container "$pattern"
done
while IFS= read -r c; do
[[ -z "$c" ]] && continue
stop_rm_container "$c"
done < <(docker ps -a --format '{{.Names}}' | grep -iE 'nexus.*mysql|mysql.*nexus' || true)
compose_env_args
if [[ -f "${NEXUS_ROOT}/${COMPOSE_FILE}" ]] && grep -q '^ mysql:' "${NEXUS_ROOT}/${COMPOSE_FILE}" 2>/dev/null; then
warn "compose 仍含 mysql 服务，尝试 compose rm..."
(cd "$NEXUS_ROOT" && docker compose -f "$COMPOSE_FILE" "${local_env[@]}" stop mysql 2>/dev/null || true)
(cd "$NEXUS_ROOT" && docker compose -f "$COMPOSE_FILE" "${local_env[@]}" rm -f mysql 2>/dev/null || true)
removed=$((removed + 1))
elif [[ -f "${NEXUS_ROOT}/${COMPOSE_FILE}" && -f "${NEXUS_ROOT}/docker/.env.prod" ]]; then
info "Compose --remove-orphans（从 nexus-prod 项目移除 mysql 孤儿容器）..."
compose_files=(-f "${NEXUS_ROOT}/${COMPOSE_FILE}")
if docker network inspect 1panel-network >/dev/null 2>&1 \
&& [[ -f "${NEXUS_ROOT}/docker/docker-compose.1panel.yml" ]]; then
compose_files+=(-f "${NEXUS_ROOT}/docker/docker-compose.1panel.yml")
fi
(cd "$NEXUS_ROOT" && docker compose "${compose_files[@]}" "${local_env[@]}" up -d --remove-orphans 2>/dev/null || true)
while IFS= read -r c; do
[[ -z "$c" ]] && continue
stop_rm_container "$c"
done < <(docker ps -a --format '{{.Names}}' | grep -iE 'nexus.*mysql|mysql.*nexus' || true)
fi
if [[ "$PURGE_VOLUME" == true ]]; then
while IFS= read -r vol; do
[[ -z "$vol" ]] && continue
info "删除数据卷: $vol"
docker volume rm "$vol" 2>/dev/null || warn "无法删除卷 $vol"
done < <(docker volume ls -q | grep -iE 'nexus.*mysql|mysql.*nexus' || true)
fi
leftover="$(docker ps -a --format '{{.Names}}' | grep -iE 'nexus.*mysql|mysql.*nexus' || true)"
if [[ -n "$leftover" ]]; then
warn "仍有 MySQL 相关容器:"
echo "$leftover" | sed 's/^/ /'
warn "若确认为 Compose 遗留，可: docker rm -f <容器名>"
elif [[ "$removed" -gt 0 ]]; then
info "Compose MySQL 容器已卸载。"
else
info "未发现 Nexus Compose MySQL 容器。"
fi
echo ""
info "当前 Nexus 栈:"
docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}' | grep -i nexus || docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'
echo ""
info "下一步：1Panel 应用商店安装 MySQL → nx update 探测容器名 → 向导步骤 3 使用 1Panel-mysql-xxxx"
deploy/uninstall-redis-compose.sh
+114
View File
@@ -0,0 +1,114 @@
#!/usr/bin/env bash
# =============================================================================
# 卸载 Nexus 旧版 Compose 内置 Redis 容器
#
# 适用：已从 docker-compose.prod.yml 移除 redis 服务，改用宿主机/1Panel 自建 Redis。
# 不会卸载 apt/1Panel 安装的 Redis，仅删除 Docker 容器与（可选）数据卷。
#
# bash deploy/uninstall-redis-compose.sh
# bash deploy/uninstall-redis-compose.sh --purge-volume # 同时删 redis-data 卷
# =============================================================================
set -euo pipefail
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
COMPOSE_FILE="${COMPOSE_FILE:-docker/docker-compose.prod.yml}"
PURGE_VOLUME=false
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
usage() {
cat <<EOF
卸载 Nexus Compose 遗留 Redis 容器
bash deploy/uninstall-redis-compose.sh [--purge-volume]
选项:
--purge-volume 删除 nexus-prod_redis-data 数据卷（不可恢复）
-h, --help 显示帮助
说明:
- 不卸载宿主机 redis-server / 1Panel 应用商店 Redis
- 卸载后请在宿主机安装 Redis，安装向导步骤 2 须能 ping 通
EOF
}
while [[ $# -gt 0 ]]; do
case "$1" in
-h|--help) usage; exit 0 ;;
--purge-volume) PURGE_VOLUME=true; shift ;;
*) error "未知参数: $1"; usage; exit 1 ;;
esac
done
if [[ "$(id -u)" -ne 0 ]]; then
error "请使用 root 执行"
exit 1
fi
removed=0
stop_rm_container() {
local name="$1"
if docker ps -a --format '{{.Names}}' | grep -qx "$name"; then
info "停止并删除容器: $name"
docker stop "$name" >/dev/null 2>&1 || true
docker rm "$name" >/dev/null 2>&1 || true
removed=$((removed + 1))
fi
}
# 常见 Compose 命名
for pattern in nexus-prod-redis-1 nexus-prod-redis nexus-redis-1; do
stop_rm_container "$pattern"
done
# 名称含 nexus 且含 redis 的容器
while IFS= read -r c; do
[[ -z "$c" ]] && continue
stop_rm_container "$c"
done < <(docker ps -a --format '{{.Names}}' | grep -iE 'nexus.*redis|redis.*nexus' || true)
# 若旧 compose 仍定义 redis 服务
if [[ -f "${NEXUS_ROOT}/${COMPOSE_FILE}" ]]; then
if grep -q '^ redis:' "${NEXUS_ROOT}/${COMPOSE_FILE}" 2>/dev/null; then
warn "compose 仍含 redis 服务，尝试 compose rm..."
local_env=()
[[ -f "${NEXUS_ROOT}/docker/.env.prod" ]] && local_env+=(--env-file "${NEXUS_ROOT}/docker/.env.prod")
prof="${NEXUS_ROOT}/docker/.host-profile"
if [[ -f "$prof" ]]; then
p="$(tr -d '\r\n' <"$prof")"
[[ -f "${NEXUS_ROOT}/docker/profiles/${p}.env" ]] && local_env+=(--env-file "${NEXUS_ROOT}/docker/profiles/${p}.env")
fi
(cd "$NEXUS_ROOT" && docker compose -f "$COMPOSE_FILE" "${local_env[@]}" stop redis 2>/dev/null || true)
(cd "$NEXUS_ROOT" && docker compose -f "$COMPOSE_FILE" "${local_env[@]}" rm -f redis 2>/dev/null || true)
removed=$((removed + 1))
fi
fi
if [[ "$PURGE_VOLUME" == true ]]; then
while IFS= read -r vol; do
[[ -z "$vol" ]] && continue
info "删除数据卷: $vol"
docker volume rm "$vol" 2>/dev/null || warn "无法删除卷 $vol（可能被占用）"
done < <(docker volume ls -q | grep -iE 'nexus.*redis|redis.*nexus' || true)
fi
echo ""
if [[ "$removed" -gt 0 ]]; then
info "Compose Redis 容器已卸载。"
else
info "未发现 Nexus Compose Redis 容器（可能已删除）。"
fi
echo ""
info "下一步：1Panel 应用商店安装 Redis → nx update 写入 NEXUS_1PANEL_REDIS_HOST"
echo " 向导 Redis URL：redis://:密码@1Panel-redis-xxxx:6379/0（无 root 用户）"
echo " 诊断：bash deploy/test-1panel-redis.sh"
deploy/update.sh
+32
View File
@@ -0,0 +1,32 @@
#!/usr/bin/env bash
# Nexus 6.0 — 一键更新（拉代码 + 重建镜像 + 重启）
#
# 已在 /opt/nexus:
# bash deploy/update.sh
# bash deploy/update.sh --no-cache # 强制无缓存重建（entrypoint/Dockerfile 变更后）
#
# 远程一条命令（推荐在仓库目录执行，管道模式会回退 /opt/nexus）:
# cd /opt/nexus && bash deploy/update.sh
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/update.sh" | bash
#
set -euo pipefail
_resolve_nexus_root() {
local src="${BASH_SOURCE[0]:-}"
if [[ -n "$src" && "$src" != /dev/fd/* && "$src" != "-" && -f "$src" ]]; then
cd "$(dirname "$(readlink -f "$src")")/.." && pwd
return
fi
if [[ -d /opt/nexus ]]; then
echo "警告: 通过管道执行无法解析脚本路径，已回退 /opt/nexus；推荐: cd /opt/nexus && bash deploy/update.sh" >&2
echo /opt/nexus
return
fi
echo "错误: 无法定位 Nexus 根目录；请 cd /opt/nexus && bash deploy/update.sh" >&2
exit 1
}
ROOT="$(_resolve_nexus_root)"
NEXUS_ROOT="$ROOT" bash "$ROOT/deploy/install-nx-cli.sh" 2>/dev/null || true
exec bash "$ROOT/deploy/nexus-1panel.sh" upgrade "$@"
deploy/upgrade-1panel-docker.sh
+3
View File
@@ -0,0 +1,3 @@
#!/usr/bin/env bash
# 兼容入口 — 请优先使用 deploy/nexus-1panel.sh
exec "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/nexus-1panel.sh" upgrade "$@"
deploy/upgrade.sh
+49 -55
View File
@@ -1,16 +1,17 @@
#!/bin/bash
# ================================================================
# Nexus 6.0 — Upgrade Script
#!/usr/bin/env bash
# Nexus 6.0 — Upgrade Script（自动识别 Docker / Supervisor）
#
# Usage:
# sudo bash upgrade.sh # auto-detect deploy dir
# sudo bash upgrade.sh --deploy-dir /opt/nexus # specify deploy dir
# sudo bash deploy/upgrade.sh
# sudo bash deploy/upgrade.sh --deploy-dir /opt/nexus
#
# Safe: git pull + pip install + restart. Database is NOT touched.
# ================================================================
# Docker 1Panel：委托 deploy/nexus-1panel.sh upgrade（拉代码 + 备份 + 重建镜像）
# Supervisor 裸机：git pull + venv pip + supervisorctl restart
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
# shellcheck source=./detect_deploy_runtime.sh
source "${SCRIPT_DIR}/detect_deploy_runtime.sh"
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
@@ -21,98 +22,90 @@ warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
error() { echo -e "${RED}[ERROR]${NC} $*"; }
DEPLOY_DIR=""
EXTRA_ARGS=()
while [[ $# -gt 0 ]]; do
case $1 in
case "$1" in
--deploy-dir) DEPLOY_DIR="$2"; shift 2 ;;
--no-backup|--require-backup|--no-cache|--prune|--check|--dry-run)
EXTRA_ARGS+=("$1"); shift ;;
-h|--help)
echo "Usage: sudo bash upgrade.sh [--deploy-dir PATH]"
exit 0 ;;
*) shift ;;
cat <<'EOF'
用法: sudo bash deploy/upgrade.sh [--deploy-dir PATH] [nexus-1panel 升级选项]
Docker 环境自动走 nexus-1panel.sh upgrade；Supervisor 环境走 venv + supervisorctl。
EOF
exit 0
;;
*) EXTRA_ARGS+=("$1"); shift ;;
esac
done
# Auto-detect deploy directory
if [ -z "$DEPLOY_DIR" ]; then
# Check common locations
for d in /opt/nexus /www/wwwroot/*/; do
if [ -d "$d/server" ] && [ -d "$d/web" ]; then
DEPLOY_DIR="$d"
break
fi
done
# Try from Supervisor config
if [ -z "$DEPLOY_DIR" ]; then
DEPLOY_DIR=$(supervisorctl status nexus 2>/dev/null | grep -oP 'cwd=\K[^ ,]+' || true)
fi
if [[ -z "$DEPLOY_DIR" ]]; then
DEPLOY_DIR="$(resolve_nexus_root 2>/dev/null || true)"
fi
if [ -z "$DEPLOY_DIR" ] || [ ! -d "$DEPLOY_DIR/server" ]; then
error "Cannot find Nexus installation. Use --deploy-dir to specify."
if [[ -z "$DEPLOY_DIR" || ! -d "$DEPLOY_DIR/server" ]]; then
error "找不到 Nexus 安装目录，请使用 --deploy-dir 指定"
exit 1
fi
RUNTIME="$(detect_nexus_runtime "$DEPLOY_DIR")"
if [[ "$RUNTIME" == "docker" ]]; then
info "检测到 Docker Compose 运行时，委托 nexus-1panel.sh upgrade"
exec env NEXUS_ROOT="$DEPLOY_DIR" bash "$DEPLOY_DIR/deploy/nexus-1panel.sh" upgrade "${EXTRA_ARGS[@]}"
fi
VENV_DIR="$DEPLOY_DIR/venv"
ENV_FILE="$DEPLOY_DIR/.env"
echo ""
echo "=========================================="
echo " Nexus 6.0 Upgrade"
echo " Nexus 6.0 Upgrade (Supervisor)"
echo "=========================================="
echo " Deploy: $DEPLOY_DIR"
echo ""
# 1. Pull latest code
info "Step 1/4: Updating source code..."
if [ -d "$DEPLOY_DIR/.git" ]; then
if [[ -d "$DEPLOY_DIR/.git" ]]; then
cd "$DEPLOY_DIR"
OLD_REV=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
OLD_REV="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
git pull --ff-only 2>/dev/null || {
error "git pull failed. You may have local changes."
error "Resolve conflicts manually: cd $DEPLOY_DIR && git status"
error "git pull failed. Resolve conflicts: cd $DEPLOY_DIR && git status"
exit 1
}
NEW_REV=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
if [ "$OLD_REV" = "$NEW_REV" ]; then
NEW_REV="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
if [[ "$OLD_REV" == "$NEW_REV" ]]; then
info " Already up to date (no new commits)"
else
info " Updated: ${OLD_REV:0:8}..${NEW_REV:0:8}"
fi
else
warn " Not a git repo. Skip git pull (update files manually)"
warn " Not a git repo. Skip git pull"
fi
# 2. Update Python dependencies
info "Step 2/4: Updating Python dependencies..."
if [ -d "$VENV_DIR/bin" ]; then
if [[ -d "$VENV_DIR/bin" ]]; then
"$VENV_DIR/bin/pip" install -q --upgrade pip
"$VENV_DIR/bin/pip" install -q -r "$DEPLOY_DIR/requirements.txt" 2>/dev/null || {
warn " pip install had some warnings, but continuing..."
warn " pip install had warnings, continuing..."
}
else
error " venv not found at $VENV_DIR. Run install.sh first."
exit 1
fi
# 3. Restart application
info "Step 3/4: Restarting Nexus..."
supervisorctl restart nexus >/dev/null 2>&1 || {
warn " supervisorctl restart failed. Try manually: supervisorctl restart nexus"
warn " supervisorctl restart failed. Try: supervisorctl restart nexus"
}
# 4. Health check
info "Step 4/4: Verifying health..."
# Read port from .env or default
PORT=8600
if [ -f "$ENV_FILE" ]; then
PORT_FROM_ENV=$(grep '^NEXUS_PORT=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2 || true)
[ -n "$PORT_FROM_ENV" ] && PORT="$PORT_FROM_ENV"
fi
PORT="$(nexus_publish_port_for "$DEPLOY_DIR")"
HEALTH_OK=false
for i in $(seq 1 15); do
if curl -sf "http://127.0.0.1:$PORT/health" >/dev/null 2>&1; then
for _ in $(seq 1 15); do
if curl -sf "http://127.0.0.1:${PORT}/health" >/dev/null 2>&1; then
HEALTH_OK=true
break
fi
@@ -120,11 +113,12 @@ for i in $(seq 1 15); do
done
echo ""
if [ "$HEALTH_OK" = true ]; then
if [[ "$HEALTH_OK" == true ]]; then
echo -e " ${GREEN}Upgrade complete! Nexus is healthy.${NC}"
suggest_ops_cron "$DEPLOY_DIR"
else
echo -e " ${YELLOW}Health check pending. Verify manually:${NC}"
echo " curl http://127.0.0.1:$PORT/health"
echo " curl http://127.0.0.1:${PORT}/health"
echo " supervisorctl status nexus"
fi
echo ""
deploy/verify-1panel-install-wizard.sh
+437
View File
@@ -0,0 +1,437 @@
#!/usr/bin/env bash
# Verify 1Panel + Docker install wizard readiness (run on the VPS as root).
# See: deploy/README-1panel.md
set -euo pipefail
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
ENV_PROD="${NEXUS_ROOT}/docker/.env.prod"
COMPOSE_FILE="${NEXUS_ROOT}/docker/docker-compose.prod.yml"
COMPOSE_1PANEL="${NEXUS_ROOT}/docker/docker-compose.1panel.yml"
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'
pass() { echo -e "${GREEN}[PASS]${NC} $*"; }
fail() { echo -e "${RED}[FAIL]${NC} $*"; FAILURES=$((FAILURES + 1)); }
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; WARNS=$((WARNS + 1)); }
info() { echo -e " $*"; }
FAILURES=0
WARNS=0
INSTALL_WIZARD_ARCHIVED=false
PUBLISH_PORT=8600
require_root() {
if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
fail "请用 root 运行（1Panel 终端默认 root）"
exit 1
fi
}
resolve_nexus_container() {
NEXUS_CONTAINER="$(docker ps --format '{{.Names}}' | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true)"
if [[ -z "$NEXUS_CONTAINER" ]]; then
fail "未找到运行中的 Nexus 容器"
info "修复: cd $NEXUS_ROOT && nx update --no-cache"
return 1
fi
pass "Nexus 容器: $NEXUS_CONTAINER"
}
check_repo() {
if [[ ! -d "$NEXUS_ROOT/.git" ]]; then
fail "仓库不存在: $NEXUS_ROOT"
return 1
fi
local sha msg
sha="$(git -C "$NEXUS_ROOT" rev-parse --short HEAD 2>/dev/null || echo unknown)"
msg="$(git -C "$NEXUS_ROOT" log -1 --oneline 2>/dev/null || true)"
pass "Git: $msg"
if git -C "$NEXUS_ROOT" merge-base --is-ancestor b25d079 HEAD 2>/dev/null; then
pass "已包含 b25d079（1Panel 容器名 sync 修复）"
else
warn "早于 b25d079 — 步骤 3 可能仍预填 host.docker.internal"
info "修复: cd $NEXUS_ROOT && nx update --no-cache"
fi
if git -C "$NEXUS_ROOT" merge-base --is-ancestor 3b2856f HEAD 2>/dev/null; then
pass "已包含 3b2856f+（Redis :pass@ 自动解析，无 root）"
else
warn "早于 3b2856f — Redis 认证可能仍误用 root"
info "修复: cd $NEXUS_ROOT && git pull && bash deploy/sync-install-wizard-to-container.sh"
fi
}
check_env_prod() {
if [[ ! -f "$ENV_PROD" ]]; then
fail "缺少 $ENV_PROD"
info "修复: bash $NEXUS_ROOT/deploy/install-nexus-fresh.sh --skip-clone"
return 1
fi
pass "docker/.env.prod 存在"
PUBLISH_PORT="$(grep -E '^NEXUS_PUBLISH_PORT=' "$ENV_PROD" 2>/dev/null | cut -d= -f2- | tr -d '\r" ' || true)"
PUBLISH_PORT="${PUBLISH_PORT:-8600}"
pass "NEXUS_PUBLISH_PORT=$PUBLISH_PORT"
if grep -qE '^NEXUS_INSTALL_WIZARD_PENDING=1' "$ENV_PROD"; then
pass "NEXUS_INSTALL_WIZARD_PENDING=1（安装模式）"
else
warn "NEXUS_INSTALL_WIZARD_PENDING≠1 — entrypoint 可能已写 /app/.env"
fi
local db redis
db="$(grep -E '^NEXUS_1PANEL_DB_HOST=' "$ENV_PROD" 2>/dev/null | cut -d= -f2- || true)"
redis="$(grep -E '^NEXUS_1PANEL_REDIS_HOST=' "$ENV_PROD" 2>/dev/null | cut -d= -f2- || true)"
if [[ -n "$db" ]]; then
pass "NEXUS_1PANEL_DB_HOST=$db"
else
fail "未设置 NEXUS_1PANEL_DB_HOST"
info "修复: bash $NEXUS_ROOT/deploy/detect-1panel-services.sh && nx update"
fi
if [[ -n "$redis" ]]; then
pass "NEXUS_1PANEL_REDIS_HOST=$redis"
local rurl
rurl="$(grep -E '^NEXUS_REDIS_URL=' "$ENV_PROD" 2>/dev/null | cut -d= -f2- || true)"
if [[ "$rurl" == *"$redis"* ]]; then
pass "NEXUS_REDIS_URL 已指向 Redis 容器"
else
warn "NEXUS_REDIS_URL 未含 $redis — nx update 会同步"
fi
else
fail "未设置 NEXUS_1PANEL_REDIS_HOST"
info "修复: 在 1Panel 应用商店安装 Redis 后执行 nx update"
fi
}
check_1panel_network() {
if ! docker network inspect 1panel-network >/dev/null 2>&1; then
fail "1panel-network 不存在"
info "修复: 在 1Panel 应用商店安装 MySQL + Redis（会自动创建网络）"
return 1
fi
pass "1panel-network 存在"
if [[ -n "${NEXUS_CONTAINER:-}" ]]; then
if docker inspect "$NEXUS_CONTAINER" --format '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} {{end}}' \
| grep -q '1panel-network'; then
pass "Nexus 已接入 1panel-network"
else
fail "Nexus 未接入 1panel-network"
info "修复: cd $NEXUS_ROOT && nx update --no-cache"
fi
fi
if [[ -x "$NEXUS_ROOT/deploy/detect-1panel-services.sh" ]]; then
info "探测结果:"
"$NEXUS_ROOT/deploy/detect-1panel-services.sh" | sed 's/^/ /' || true
fi
}
probe_from_container() {
[[ -n "${NEXUS_CONTAINER:-}" ]] || return 0
local db redis
db="$(grep -E '^NEXUS_1PANEL_DB_HOST=' "$ENV_PROD" 2>/dev/null | cut -d= -f2- || true)"
redis="$(grep -E '^NEXUS_1PANEL_REDIS_HOST=' "$ENV_PROD" 2>/dev/null | cut -d= -f2- || true)"
if [[ -n "$db" ]]; then
if docker exec "$NEXUS_CONTAINER" python3 -c "
import socket
s=socket.socket(); s.settimeout(3); s.connect(('$db', 3306)); s.close()
" 2>/dev/null; then
pass "容器内 TCP → MySQL $db:3306"
else
fail "容器内无法连接 MySQL $db:3306"
info "检查 MySQL 容器是否运行、Nexus 是否在 1panel-network"
fi
fi
if [[ -n "$redis" ]]; then
if docker exec "$NEXUS_CONTAINER" python3 -c "
import socket
s=socket.socket(); s.settimeout(3); s.connect(('$redis', 6379)); s.close()
" 2>/dev/null; then
pass "容器内 TCP → Redis $redis:6379"
else
fail "容器内无法连接 Redis $redis:6379"
fi
fi
}
check_app_env_redis_url() {
[[ -n "${NEXUS_CONTAINER:-}" ]] || return 0
if ! docker exec "$NEXUS_CONTAINER" test -f /app/.env 2>/dev/null; then
return 0
fi
local rurl
rurl="$(docker exec "$NEXUS_CONTAINER" grep -E '^NEXUS_REDIS_URL=' /app/.env 2>/dev/null | cut -d= -f2- | tr -d '"' || true)"
if [[ -z "$rurl" ]]; then
warn "/app/.env 无 NEXUS_REDIS_URL"
return 0
fi
if [[ "$rurl" == *"://root:"* ]]; then
fail "NEXUS_REDIS_URL 含 root 用户（1Panel Redis 无 root 账号）"
info "修复: redis://:密码@1Panel-redis-xxxx:6379/0 — 见 deploy/test-1panel-redis.sh"
elif [[ "$rurl" == *"1Panel-redis"* ]] || [[ "$rurl" == *"://:"* ]]; then
pass "NEXUS_REDIS_URL 格式合理（容器名或 :pass@）"
else
warn "NEXUS_REDIS_URL 可能未指向 1Panel Redis: $rurl"
fi
}
check_install_mode() {
[[ -n "${NEXUS_CONTAINER:-}" ]] || return 0
if docker exec "$NEXUS_CONTAINER" test -f /app/.env 2>/dev/null; then
warn "/app/.env 已存在 — 安装向导可能已进入步骤 3+ 或误写 env"
check_app_env_redis_url
info "若需重来: 删卷 nexus-state 中 .env 并设 NEXUS_INSTALL_WIZARD_PENDING=1 后 nx update"
else
pass "/app/.env 不存在（安装模式 OK）"
fi
if docker exec "$NEXUS_CONTAINER" test -f /app/.install_locked 2>/dev/null \
|| docker exec "$NEXUS_CONTAINER" test -f /var/lib/nexus/.install_locked 2>/dev/null \
|| docker exec "$NEXUS_CONTAINER" test -f /app/web/app/install.html.bak 2>/dev/null; then
pass "安装向导已锁定/已归档 — 应访问 /app/ 登录"
INSTALL_WIZARD_ARCHIVED=true
fi
local hosts_json
hosts_json="$(docker exec "$NEXUS_CONTAINER" cat /app/web/data/1panel-hosts.json 2>/dev/null || true)"
if [[ -n "$hosts_json" ]]; then
pass "1panel-hosts.json: $hosts_json"
else
warn "无 1panel-hosts.json（依赖容器环境变量，nx update 会写入）"
fi
}
check_ops_cron() {
if [[ "${INSTALL_WIZARD_ARCHIVED:-false}" != true ]]; then
return 0
fi
if ! command -v crontab >/dev/null 2>&1; then
warn "未安装 cron/crontab — Layer 3 宿主机巡检不可用"
info "修复: sudo bash $NEXUS_ROOT/deploy/install_ops_cron.sh"
return 0
fi
local cron
cron="$(crontab -l 2>/dev/null || true)"
if echo "$cron" | grep -q 'nexus-health-monitor\|deploy/health_monitor.sh'; then
pass "Crontab 含 health_monitor"
else
warn "Crontab 未配置 health_monitor（Layer 3 巡检）"
info "修复: sudo nx cron"
fi
if echo "$cron" | grep -q 'nexus-mysql-backup\|deploy/db_backup.sh'; then
pass "Crontab 含 db_backup"
else
warn "Crontab 未配置 db_backup（每日 MySQL 备份）"
info "修复: sudo nx cron"
fi
}
check_mysql_backup() {
if [[ "${INSTALL_WIZARD_ARCHIVED:-false}" != true ]]; then
return 0
fi
local dump_sh="${NEXUS_ROOT}/deploy/mysql_dump_to_file.sh"
if [[ -f "$dump_sh" ]]; then
pass "mysql_dump_to_file.sh 存在"
else
warn "缺少 mysql_dump_to_file.sh — 升级前无法备份 MySQL"
info "修复: cd $NEXUS_ROOT && git pull && nx update"
return 0
fi
if [[ -d /var/backups/nexus ]] && ls /var/backups/nexus/nexus_*.sql.gz >/dev/null 2>&1; then
local latest
latest="$(ls -t /var/backups/nexus/nexus_*.sql.gz 2>/dev/null | head -1)"
pass "已有 MySQL 备份: $(basename "$latest")"
else
warn "尚无 MySQL 备份文件（/var/backups/nexus）"
info "可手动: sudo bash $NEXUS_ROOT/deploy/db_backup.sh"
fi
}
check_http_local() {
local health code
health="$(curl -sf "http://127.0.0.1:${PUBLISH_PORT}/health" 2>/dev/null || true)"
if [[ "$health" == "ok" ]]; then
pass "/health → ok"
else
fail "/health 非 ok（当前: ${health:-无响应}）"
info "修复: docker logs --tail=80 $NEXUS_CONTAINER"
return 1
fi
code="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PUBLISH_PORT}/app/install.html" 2>/dev/null || echo 000)"
if [[ "${INSTALL_WIZARD_ARCHIVED:-false}" == true ]]; then
if [[ "$code" == "404" ]]; then
pass "/app/install.html 已归档 → HTTP 404"
else
fail "/app/install.html 应已归档但 HTTP $code"
info "修复: nx update（会执行 archive_install_wizard_in_container）"
fi
return 0
fi
if [[ "$code" == "200" ]]; then
pass "/app/install.html → HTTP 200"
else
fail "/app/install.html → HTTP $code"
info "修复: bash $NEXUS_ROOT/deploy/sync-install-wizard-to-container.sh"
fi
}
check_install_api() {
if [[ "${INSTALL_WIZARD_ARCHIVED:-false}" == true ]]; then
pass "安装 API 已关闭（向导已锁定，/api/install/* 返回 403 为预期）"
return 0
fi
local status env_json
status="$(curl -sf "http://127.0.0.1:${PUBLISH_PORT}/api/install/status" 2>/dev/null || true)"
if [[ -n "$status" ]]; then
pass "/api/install/status → $status"
if echo "$status" | grep -q '"installed":true'; then
warn "installed=true — 向导已完成，请访问 /app/ 登录"
fi
else
fail "/api/install/status 无响应"
fi
env_json="$(curl -sf "http://127.0.0.1:${PUBLISH_PORT}/api/install/env-check" 2>/dev/null || true)"
if [[ -z "$env_json" ]]; then
fail "/api/install/env-check 无响应"
return 1
fi
if echo "$env_json" | grep -q 'docker_defaults'; then
local db_host
db_host="$(echo "$env_json" | python3 -c "
import json,sys
d=json.load(sys.stdin)
print((d.get('docker_defaults') or {}).get('db_host',''))
" 2>/dev/null || true)"
if [[ -n "$db_host" && "$db_host" != "host.docker.internal" ]]; then
pass "步骤 3 预填 db_host=$db_host"
elif [[ "$db_host" == "host.docker.internal" ]]; then
fail "步骤 3 仍预填 host.docker.internal"
info "修复: nx update --no-cache（需 b25d079+）"
fi
else
warn "env-check 无 docker_defaults（非 Docker 模式？）"
fi
if echo "$env_json" | grep -q '1Panel-mysql'; then
pass "env-check MySQL 探测含 1Panel 容器名"
elif echo "$env_json" | grep -q 'host.docker.internal'; then
warn "env-check MySQL 仍指向 host.docker.internal"
fi
}
check_container_image_features() {
[[ -n "${NEXUS_CONTAINER:-}" ]] || return 0
local host_sha py_ok html_file html_ok host_root_ok
host_sha="$(git -C "$NEXUS_ROOT" rev-parse --short HEAD 2>/dev/null || echo unknown)"
pass "宿主机 Git: $host_sha"
if docker exec "$NEXUS_CONTAINER" grep -q '_host_deploy_root' /app/server/api/install.py 2>/dev/null; then
pass "容器 install.py 含 host_deploy_root（round6+）"
py_ok=1
else
warn "容器 install.py 较旧 — 需 nx update 重建镜像"
fi
html_file="/app/web/app/install.html"
if docker exec "$NEXUS_CONTAINER" test -f /app/web/app/install.html.bak 2>/dev/null; then
html_file="/app/web/app/install.html.bak"
fi
if docker exec "$NEXUS_CONTAINER" grep -q 'install_ops_cron' "$html_file" 2>/dev/null; then
pass "容器 install.html 含 Layer 3 cron 指引（round7+）"
html_ok=1
else
warn "容器 install.html 较旧 — 需 nx update 重建镜像"
fi
host_root_ok="$(docker exec "$NEXUS_CONTAINER" printenv NEXUS_HOST_ROOT 2>/dev/null || true)"
if [[ -n "$host_root_ok" ]]; then
pass "NEXUS_HOST_ROOT=$host_root_ok"
else
warn "容器未注入 NEXUS_HOST_ROOT — nx update 重建后可修复"
fi
if [[ -n "${py_ok:-}" && -n "${html_ok:-}" ]]; then
info "镜像与宿主机代码特性对齐（重建后验收）"
else
info "修复: cd $NEXUS_ROOT && sudo nx update"
fi
}
check_openresty_hint() {
local domain code
domain="$(grep -E '^NEXUS_API_BASE_URL=' "$ENV_PROD" 2>/dev/null | sed 's|.*https\?://||;s|/.*||' || echo api.synaglobal.vip)"
code="$(curl -sk -o /dev/null -w '%{http_code}' --connect-timeout 5 "https://${domain}/health" 2>/dev/null || echo 000)"
if [[ "$code" == "200" ]] && curl -sk "https://${domain}/health" 2>/dev/null | grep -q '^ok$'; then
pass "HTTPS https://${domain}/health → ok"
else
warn "HTTPS https://${domain}/health → HTTP $code（外网可能未配 OpenResty 反代）"
info "1Panel → 网站 → 反代 http://127.0.0.1:8600"
info "参考: $NEXUS_ROOT/deploy/1panel/openresty-nexus.conf.example"
fi
}
print_next_steps() {
local domain
domain="$(grep -E '^NEXUS_API_BASE_URL=' "$ENV_PROD" 2>/dev/null | sed 's|.*https\?://||;s|/.*||' || echo '你的域名')"
echo ""
if [[ "${INSTALL_WIZARD_ARCHIVED:-false}" == true ]]; then
echo "=========================================="
echo " 已安装 — 日常运维"
echo "=========================================="
echo " 登录: https://${domain}/app/"
echo " 更新: cd $NEXUS_ROOT && nx update"
echo " 巡检 cron: sudo nx cron"
echo " 手动备份: sudo bash $NEXUS_ROOT/deploy/db_backup.sh"
echo " 验收: bash $NEXUS_ROOT/deploy/verify-1panel-install-wizard.sh"
echo ""
return 0
fi
echo "=========================================="
echo " 安装向导后续步骤"
echo "=========================================="
echo "1. 1Panel 数据库 → 建库 nexus、用户 nexus（仅授权 nexus 库）"
echo "2. 浏览器打开: https://${domain}/app/install.html"
echo "3. 步骤 2：MySQL/Redis TCP 应显示 ✓（容器名:端口）"
echo "4. 步骤 3：确认 db_host/redis_host 为 1Panel-mysql/redis-xxxx，填 MySQL 密码"
echo "5. 步骤 4：连接检测全绿 → 创建 admin"
echo "6. 步骤 5：锁定安装"
echo ""
if [[ "$FAILURES" -gt 0 ]]; then
echo "先修复上方 [FAIL]，再执行:"
echo " cd $NEXUS_ROOT && nx update --no-cache"
fi
}
main() {
require_root
echo "Nexus 1Panel 安装向导验收 — $(date -Iseconds)"
echo "NEXUS_ROOT=$NEXUS_ROOT"
echo ""
check_repo || true
check_env_prod || true
resolve_nexus_container || true
check_1panel_network || true
probe_from_container || true
check_install_mode || true
check_http_local || true
check_install_api || true
check_ops_cron || true
check_mysql_backup || true
check_container_image_features || true
check_openresty_hint || true
print_next_steps
if [[ "$FAILURES" -gt 0 ]]; then
echo ""
fail "合计 $FAILURES 项未通过"
exit 1
fi
echo ""
if [[ "${INSTALL_WIZARD_ARCHIVED:-false}" == true ]]; then
pass "验收通过 — 安装已完成，请访问 /app/ 登录"
if [[ "$WARNS" -gt 0 ]]; then
warn "有 ${WARNS} 项 [WARN]（cron/备份等建议项，不阻断登录）"
fi
else
pass "验收通过 — 可打开安装向导完成步骤 1–5"
fi
}
main "$@"
docker-compose.yml
+15 -8
View File
@@ -1,8 +1,8 @@
# Nexus 6.0 — Docker Compose (dev / staging)
# Nexus 6.0 鈥?Docker Compose (dev / staging)
# Usage:
# cp docker/.env.example docker/.env # or: python docker/generate_env.py
# docker compose up -d --build
# open http://localhost:8600/app/
# docker compose --env-file docker/.env up -d --build
# open http://localhost:18600/app/
name: nexus
@@ -24,7 +24,7 @@ services:
retries: 8
start_period: 40s
ports:
- "${MYSQL_PUBLISH_PORT:-3306}:3306"
- "${MYSQL_PUBLISH_PORT:-13306}:3306"
redis:
image: redis:7-alpine
@@ -38,12 +38,18 @@ services:
timeout: 3s
retries: 8
ports:
- "${REDIS_PUBLISH_PORT:-6379}:6379"
- "${REDIS_PUBLISH_PORT:-16379}:6379"
nexus:
build:
context: .
dockerfile: Dockerfile
network: host
args:
DEBIAN_MIRROR: https://mirrors.aliyun.com/debian
DEBIAN_SECURITY_MIRROR: https://mirrors.aliyun.com/debian-security
PIP_INDEX_URL: https://mirrors.aliyun.com/pypi/simple/
PIP_TRUSTED_HOST: mirrors.aliyun.com
restart: unless-stopped
depends_on:
mysql:
@@ -51,7 +57,7 @@ services:
redis:
condition: service_healthy
ports:
- "${NEXUS_PUBLISH_PORT:-8600}:8600"
- "${NEXUS_PUBLISH_PORT:-18600}:8600"
environment:
MYSQL_HOST: mysql
MYSQL_PORT: "3306"
@@ -64,11 +70,11 @@ services:
NEXUS_DEPLOY_PATH: /app
NEXUS_DATABASE_URL: mysql+aiomysql://nexus:${MYSQL_PASSWORD:-nexus_dev_pass}@mysql:3306/nexus
NEXUS_REDIS_URL: redis://redis:6379/0
NEXUS_CORS_ORIGINS: ${NEXUS_CORS_ORIGINS:-http://localhost:8600,http://127.0.0.1:8600}
NEXUS_CORS_ORIGINS: ${NEXUS_CORS_ORIGINS:-http://localhost:18600,http://127.0.0.1:18600,http://localhost:8600,http://127.0.0.1:8600}
NEXUS_SECRET_KEY: ${NEXUS_SECRET_KEY:-}
NEXUS_API_KEY: ${NEXUS_API_KEY:-}
NEXUS_ENCRYPTION_KEY: ${NEXUS_ENCRYPTION_KEY:-}
NEXUS_API_BASE_URL: ${NEXUS_API_BASE_URL:-http://localhost:8600}
NEXUS_API_BASE_URL: ${NEXUS_API_BASE_URL:-http://localhost:18600}
env_file:
- path: docker/.env
required: false
@@ -87,3 +93,4 @@ volumes:
redis-data:
nexus-state:
nexus-web-data:
docker/.env.example
-18
View File
@@ -1,18 +0,0 @@
# Copy to docker/.env (or run: python docker/generate_env.py)
# Used by docker compose for nexus service — never commit docker/.env
MYSQL_ROOT_PASSWORD=change_me_root
MYSQL_PASSWORD=change_me_nexus
# Leave empty to use install wizard at http://localhost:8600/app/install.html
# Or run generate_env.py to fill these three:
NEXUS_SECRET_KEY=
NEXUS_API_KEY=
NEXUS_ENCRYPTION_KEY=
NEXUS_CORS_ORIGINS=http://localhost:8600,http://127.0.0.1:8600
NEXUS_API_BASE_URL=http://localhost:8600
# Optional host port overrides
# NEXUS_PUBLISH_PORT=8600
# MYSQL_PUBLISH_PORT=3306
docker/.env.prod.example
-21
View File
@@ -1,21 +0,0 @@
# Production Compose env — copy to docker/.env.prod (never commit)
# Migrate NEXUS_* secrets from Baota /www/wwwroot/.../.env UNCHANGED.
MYSQL_ROOT_PASSWORD=change_me_root_strong
MYSQL_PASSWORD=change_me_nexus_strong
# Required — copy from production .env (do NOT regenerate)
NEXUS_SECRET_KEY=
NEXUS_API_KEY=
NEXUS_ENCRYPTION_KEY=
# Public URL
NEXUS_CORS_ORIGINS=https://api.synaglobal.vip
NEXUS_API_BASE_URL=https://api.synaglobal.vip
# 2 vCPU / 8 GiB host (matches docker/mysql-prod-2c8g.cnf + compose limits)
NEXUS_DB_POOL_SIZE=30
NEXUS_DB_MAX_OVERFLOW=20
# Optional
# NEXUS_PUBLISH_PORT=8600
docker/README.md
+11 -8
View File
@@ -41,15 +41,16 @@ docker compose build --no-cache nexus
## 服务
| 服务 | 端口 | 说明 |
|------|------|------|
| nexus | 8600 | FastAPI + 静态 `/app/` |
| mysql | 3306 | 数据库 `nexus` |
| redis | 6379 | 仅容器内网（未映射到主机） |
| 环境 | Compose 服务 | 说明 |
|------|-------------|------|
| 本地开发 `docker-compose.yml` | nexus + mysql + redis | 一键本地联调 |
| 生产 `docker-compose.prod.yml` | **仅 nexus** | MySQL/Redis 宿主机或 1Panel 自建 |
生产 1Panel：`docker/.env.prod` 可含 `NEXUS_REDIS_URL`（供 `nx update` 探测同步），**不经 Compose 注入容器**；运行时 Redis/MySQL URL 以安装向导写入的 `/app/.env`（`nexus-state` 卷）为准。MySQL `NEXUS_DATABASE_URL` 仅由向导步骤 3 写入。
## 生产注意
- 修改 `MYSQL_*` 与 `NEXUS_*` 为强密码，勿使用 `generate_env.py` 默认值上生产。
- 修改 `NEXUS_*` 为强密码；MySQL 使用自建库强密码。
- 建议前置 Nginx/TLS，仅暴露 443。
- 多实例部署需共享 MySQL、Redis；后台任务由 Redis primary lock 保证单实例执行。
@@ -60,9 +61,11 @@ cp docker/.env.prod.example docker/.env.prod # 从宝塔 .env 迁入密钥
docker compose -f docker/docker-compose.prod.yml --env-file docker/.env.prod up -d --build
```
- 镜像：`Dockerfile.prod`（含 `npm ci` + `vite build`）
- 镜像：`Dockerfile.prod`（含 `npm ci` + `vite build` + **`web/app/install.html` 安装向导**）
- 仅绑定 `127.0.0.1:8600`；OpenResty 反代见 `deploy/1panel/openresty-nexus.conf.example`
- **2C8G 调优**：`docker/mysql-prod-2c8g.cnf`（buffer pool 1G、`max_connections=120`）+ 容器 `mem_limit` + `NEXUS_DB_POOL_SIZE=30`
- **2C8G 调优**：`docker/profiles/2c8g.env`（`NEXUS_MEM_LIMIT` + `NEXUS_DB_POOL_SIZE=30`）；外置 MySQL 可参考 `docker/mysql-prod-2c8g.cnf` 手工调优
- 完整迁移步骤：`docs/design/plans/2026-06-04-1panel-docker-production.md`
- 一键安装：`bash deploy/install-1panel-docker.sh`
- 一键升级：`bash deploy/upgrade-1panel-docker.sh`（`--check` 仅查更新）
详见 `docs/design/specs/2026-06-03-docker-design.md`。
docker/docker-compose.1panel.yml
+12
View File
@@ -0,0 +1,12 @@
# 1Panel overlay — join Nexus to 1panel-network (App Store MySQL/Redis use this network).
# Applied automatically when `docker network inspect 1panel-network` succeeds (deploy/nexus-1panel.sh).
services:
nexus:
networks:
- 1panel-network
networks:
1panel-network:
external: true
name: 1panel-network
docker/docker-compose.prod.yml
+16 -66
View File
@@ -1,101 +1,53 @@
# Nexus 6.0 — production Compose (1Panel / bare Docker host)
# Tuned for 2 vCPU / 8 GiB — see docker/mysql-prod-2c8g.cnf
# MySQL / Redis 不在 Compose 内 — 请在宿主机或 1Panel 自行安装
#
# Usage:
# cp docker/.env.prod.example docker/.env.prod # fill secrets from Baota .env
# docker compose -f docker/docker-compose.prod.yml --env-file docker/.env.prod up -d --build
# bash deploy/nexus-1panel.sh install --profile 2c8g
# docker compose -f docker/docker-compose.prod.yml \
# --env-file docker/.env.prod --env-file docker/profiles/2c8g.env up -d --build
#
# OpenResty on host proxies https://api.synaglobal.vip → 127.0.0.1:8600
name: nexus-prod
services:
mysql:
image: mysql:8.4
restart: unless-stopped
environment:
MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:?set MYSQL_ROOT_PASSWORD}
MYSQL_DATABASE: nexus
MYSQL_USER: nexus
MYSQL_PASSWORD: ${MYSQL_PASSWORD:?set MYSQL_PASSWORD}
volumes:
- mysql-data:/var/lib/mysql
- ./mysql-prod-2c8g.cnf:/etc/mysql/conf.d/99-nexus-2c8g.cnf:ro
mem_limit: 2g
cpus: 1.5
healthcheck:
test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -uroot -p\"$$MYSQL_ROOT_PASSWORD\" || exit 1"]
interval: 10s
timeout: 5s
retries: 8
start_period: 40s
networks:
- nexus-internal
redis:
image: redis:7-alpine
restart: unless-stopped
command:
- redis-server
- --appendonly
- "yes"
- --maxmemory
- 256mb
- --maxmemory-policy
- allkeys-lru
volumes:
- redis-data:/data
mem_limit: 384m
cpus: 0.5
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 10s
timeout: 3s
retries: 8
networks:
- nexus-internal
nexus:
build:
context: ..
dockerfile: Dockerfile.prod
restart: unless-stopped
depends_on:
mysql:
condition: service_healthy
redis:
condition: service_healthy
extra_hosts:
- "host.docker.internal:host-gateway"
ports:
- "127.0.0.1:${NEXUS_PUBLISH_PORT:-8600}:8600"
environment:
MYSQL_HOST: mysql
MYSQL_PORT: "3306"
REDIS_HOST: redis
REDIS_PORT: "6379"
NEXUS_PERSIST_DIR: /var/lib/nexus
NEXUS_DOCKER_WRITE_ENV: "1"
NEXUS_HOST: "0.0.0.0"
NEXUS_PORT: "8600"
NEXUS_DEPLOY_PATH: /app
NEXUS_DATABASE_URL: mysql+aiomysql://nexus:${MYSQL_PASSWORD}@mysql:3306/nexus
NEXUS_REDIS_URL: redis://redis:6379/0
NEXUS_HOST_ROOT: ${NEXUS_HOST_ROOT:-/opt/nexus}
# Redis URL 仅来自 /app/.env（安装向导 + entrypoint export_app_env），勿在此注入以免覆盖密码
NEXUS_1PANEL_DB_HOST: ${NEXUS_1PANEL_DB_HOST:-}
NEXUS_1PANEL_REDIS_HOST: ${NEXUS_1PANEL_REDIS_HOST:-}
NEXUS_CORS_ORIGINS: ${NEXUS_CORS_ORIGINS:?set NEXUS_CORS_ORIGINS}
NEXUS_SECRET_KEY: ${NEXUS_SECRET_KEY:?set NEXUS_SECRET_KEY}
NEXUS_API_KEY: ${NEXUS_API_KEY:?set NEXUS_API_KEY}
NEXUS_ENCRYPTION_KEY: ${NEXUS_ENCRYPTION_KEY:-}
NEXUS_ENCRYPTION_KEY: ${NEXUS_ENCRYPTION_KEY:?set NEXUS_ENCRYPTION_KEY}
NEXUS_INSTALL_WIZARD_PENDING: ${NEXUS_INSTALL_WIZARD_PENDING:-0}
NEXUS_API_BASE_URL: ${NEXUS_API_BASE_URL:?set NEXUS_API_BASE_URL}
NEXUS_DB_POOL_SIZE: ${NEXUS_DB_POOL_SIZE:-30}
NEXUS_DB_MAX_OVERFLOW: ${NEXUS_DB_MAX_OVERFLOW:-20}
volumes:
- nexus-state:/var/lib/nexus
- nexus-web-data:/app/web/data
mem_limit: 2g
cpus: 1.5
mem_limit: ${NEXUS_MEM_LIMIT:-2g}
cpus: ${NEXUS_CPUS:-1.5}
healthcheck:
test: ["CMD", "curl", "-sf", "http://127.0.0.1:8600/health"]
test: ["CMD-SHELL", "curl -sf http://127.0.0.1:8600/health | grep -q '^ok' || exit 1"]
interval: 30s
timeout: 5s
retries: 5
retries: 3
start_period: 90s
networks:
- nexus-internal
@@ -105,7 +57,5 @@ networks:
driver: bridge
volumes:
mysql-data:
redis-data:
nexus-state:
nexus-web-data:
docker/entrypoint.sh
+116 -13
View File
@@ -20,12 +20,94 @@ s.close()
done
}
restore_persisted_env() {
if [ -f "${PERSIST_ENV}" ]; then
cp "${PERSIST_ENV}" /app/.env
chmod 600 /app/.env
echo "entrypoint: restored .env from ${PERSIST_ENV}"
wait_tcp_optional() {
host="$1"
port="$2"
tries="${3:-15}"
label="${4:-service}"
echo "entrypoint: waiting for ${label} ${host}:${port} (max ${tries} tries)..."
n=0
while [ "$n" -lt "$tries" ]; do
if python3 -c "
import socket
s = socket.socket()
s.settimeout(2)
s.connect(('${host}', ${port}))
s.close()
" 2>/dev/null; then
echo "entrypoint: ${label} ready at ${host}:${port}"
return 0
fi
n=$((n + 1))
sleep 2
done
echo "entrypoint: warn — ${label} not reachable at ${host}:${port}; install on host or set URL in .env"
return 0
}
restore_persisted_install_lock() {
if [ "${NEXUS_INSTALL_WIZARD_PENDING:-0}" = "1" ]; then
return 0
fi
PERSIST_LOCK="${PERSIST_DIR}/.install_locked"
if [ -f "${PERSIST_LOCK}" ] && [ ! -f /app/.install_locked ]; then
cp "${PERSIST_LOCK}" /app/.install_locked
chmod 600 /app/.install_locked
echo "entrypoint: restored .install_locked from ${PERSIST_LOCK}"
fi
}
archive_install_wizard_if_locked() {
if [ "${NEXUS_INSTALL_WIZARD_PENDING:-0}" = "1" ]; then
rm -f /app/.install_locked "${PERSIST_DIR}/.install_locked" 2>/dev/null || true
if [ -f /app/web/app/install.html.bak ] && [ ! -f /app/web/app/install.html ]; then
mv /app/web/app/install.html.bak /app/web/app/install.html
echo "entrypoint: restored install.html from .bak (wizard pending)"
fi
return 0
fi
if [ ! -f /app/.install_locked ] && [ ! -f "${PERSIST_DIR}/.install_locked" ]; then
return 0
fi
if [ -f /app/web/app/install.html.bak ]; then
if [ -f /app/web/app/install.html ]; then
rm -f /app/web/app/install.html
echo "entrypoint: removed install.html (wizard archived as install.html.bak)"
fi
return 0
fi
if [ -f /app/web/app/install.html ]; then
mv /app/web/app/install.html /app/web/app/install.html.bak
echo "entrypoint: archived install.html → install.html.bak"
fi
}
restore_persisted_env() {
if [ "${NEXUS_INSTALL_WIZARD_PENDING:-0}" = "1" ]; then
return 0
fi
if [ ! -f "${PERSIST_ENV}" ]; then
return 0
fi
if ! grep -q '^NEXUS_DATABASE_URL=' "${PERSIST_ENV}" 2>/dev/null; then
echo "entrypoint: warn — ${PERSIST_ENV} missing NEXUS_DATABASE_URL; skip restore (complete install wizard)"
return 0
fi
cp "${PERSIST_ENV}" /app/.env
chmod 600 /app/.env
echo "entrypoint: restored .env from ${PERSIST_ENV}"
}
# Compose may inject placeholder NEXUS_REDIS_URL (no password). Wizard .env wins.
export_app_env() {
if [ ! -f /app/.env ]; then
return 0
fi
set -a
# shellcheck disable=SC1091
. /app/.env
set +a
echo "entrypoint: exported NEXUS_* from /app/.env (overrides Compose placeholders)"
}
write_env_from_environment() {
@@ -38,6 +120,14 @@ write_env_from_environment() {
if [ -z "${NEXUS_SECRET_KEY:-}" ]; then
return 0
fi
if [ "${NEXUS_INSTALL_WIZARD_PENDING:-}" = "1" ]; then
echo "entrypoint: install wizard pending — skip writing /app/.env"
return 0
fi
if [ -z "${NEXUS_DATABASE_URL:-}" ]; then
echo "entrypoint: skip writing /app/.env — NEXUS_DATABASE_URL not set (use /app/install.html)"
return 0
fi
mkdir -p "${PERSIST_DIR}"
{
echo "# Generated by docker/entrypoint.sh — do not commit"
@@ -48,25 +138,38 @@ write_env_from_environment() {
echo "entrypoint: wrote .env from container environment"
}
persist_env_on_exit() {
persist_state_on_exit() {
if [ -f /app/.env ]; then
mkdir -p "${PERSIST_DIR}"
cp /app/.env "${PERSIST_ENV}"
chmod 600 "${PERSIST_ENV}" 2>/dev/null || true
fi
if [ -f /app/.install_locked ]; then
mkdir -p "${PERSIST_DIR}"
cp /app/.install_locked "${PERSIST_DIR}/.install_locked"
chmod 600 "${PERSIST_DIR}/.install_locked" 2>/dev/null || true
fi
}
trap persist_env_on_exit EXIT INT TERM
trap persist_state_on_exit EXIT INT TERM
MYSQL_HOST="${MYSQL_HOST:-mysql}"
MYSQL_PORT="${MYSQL_PORT:-3306}"
REDIS_HOST="${REDIS_HOST:-redis}"
REDIS_PORT="${REDIS_PORT:-6379}"
# MySQL / Redis 均由用户自行安装在宿主机；安装向导阶段不阻塞启动
if [ "${NEXUS_INSTALL_WIZARD_PENDING:-0}" != "1" ] && [ "${NEXUS_SKIP_MYSQL_WAIT:-0}" != "1" ]; then
MYSQL_HOST="${NEXUS_1PANEL_DB_HOST:-${MYSQL_HOST:-host.docker.internal}}"
MYSQL_PORT="${MYSQL_PORT:-3306}"
wait_tcp_optional "${MYSQL_HOST}" "${MYSQL_PORT}" 30 "MySQL"
fi
wait_tcp "${MYSQL_HOST}" "${MYSQL_PORT}"
wait_tcp "${REDIS_HOST}" "${REDIS_PORT}"
if [ "${NEXUS_INSTALL_WIZARD_PENDING:-0}" != "1" ] && [ "${NEXUS_SKIP_REDIS_WAIT:-0}" != "1" ]; then
REDIS_HOST="${NEXUS_1PANEL_REDIS_HOST:-${REDIS_HOST:-host.docker.internal}}"
REDIS_PORT="${REDIS_PORT:-6379}"
wait_tcp_optional "${REDIS_HOST}" "${REDIS_PORT}" 15 "Redis"
fi
restore_persisted_install_lock
archive_install_wizard_if_locked
restore_persisted_env
write_env_from_environment
export_app_env
exec "$@"
docker/generate_env.py
+18 -30
View File
@@ -3,47 +3,35 @@
from __future__ import annotations
import base64
import secrets
import sys
from pathlib import Path
ROOT = Path(__file__).resolve().parent.parent
if str(ROOT) not in sys.path:
sys.path.insert(0, str(ROOT))
from scripts.generate_nexus_secrets import ( # noqa: E402
generate_nexus_secrets,
write_env_prod,
)
OUT = ROOT / "docker" / ".env"
EXAMPLE = ROOT / "docker" / ".env.example"
def _token(n: int = 32) -> str:
return secrets.token_urlsafe(n)
def main() -> None:
if OUT.exists():
raise SystemExit(f"Refusing to overwrite existing {OUT} — delete it first.")
mysql_root = _token(24)
mysql_pass = _token(24)
secret = _token(32)
api_key = _token(24)
# Fernet-compatible (same as install wizard)
enc_key = base64.urlsafe_b64encode(secrets.token_bytes(32)).decode()
text = EXAMPLE.read_text(encoding="utf-8")
lines: list[str] = []
for line in text.splitlines():
if line.startswith("MYSQL_ROOT_PASSWORD="):
lines.append(f"MYSQL_ROOT_PASSWORD={mysql_root}")
elif line.startswith("MYSQL_PASSWORD="):
lines.append(f"MYSQL_PASSWORD={mysql_pass}")
elif line.startswith("NEXUS_SECRET_KEY="):
lines.append(f"NEXUS_SECRET_KEY={secret}")
elif line.startswith("NEXUS_API_KEY="):
lines.append(f"NEXUS_API_KEY={api_key}")
elif line.startswith("NEXUS_ENCRYPTION_KEY="):
lines.append(f"NEXUS_ENCRYPTION_KEY={enc_key}")
else:
lines.append(line)
OUT.write_text("\n".join(lines) + "\n", encoding="utf-8", newline="\n")
secrets_map = generate_nexus_secrets()
write_env_prod(
EXAMPLE,
OUT,
domain="localhost",
secrets_map=secrets_map,
profile_env=None,
wizard_pending=False,
)
print(f"Wrote {OUT}")
print("Next: docker compose up -d --build")
docker/mysql-prod-1c4g.cnf
+20
View File
@@ -0,0 +1,20 @@
# MySQL 8.4 — Nexus production tuning for 1 vCPU / 4 GiB host (minimal)
[mysqld]
character-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci
innodb_buffer_pool_size = 512M
innodb_log_file_size = 128M
max_connections = 80
innodb_read_io_threads = 2
innodb_write_io_threads = 2
table_open_cache = 1000
tmp_table_size = 32M
max_heap_table_size = 32M
[client]
default-character-set = utf8mb4
docker/mysql-prod-2c8g.cnf
+25 -25
View File
@@ -1,25 +1,25 @@
# MySQL 8.4 — Nexus production tuning for 2 vCPU / 8 GiB host
# Mounted by docker/docker-compose.prod.yml (see docs/design/plans/2026-06-04-1panel-docker-production.md)
[mysqld]
character-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci
# ~1 GiB for InnoDB (leave RAM for Nexus, Redis, 1Panel, OS)
innodb_buffer_pool_size = 1024M
innodb_log_file_size = 256M
# Nexus async pool default 30+20; leave headroom for admin/migrations
max_connections = 120
# 2 vCPU: avoid aggressive IO threads
innodb_read_io_threads = 4
innodb_write_io_threads = 4
# Sensible defaults on small VMs
table_open_cache = 2000
tmp_table_size = 64M
max_heap_table_size = 64M
[client]
default-character-set = utf8mb4
# MySQL 8.4 — Nexus production tuning for 2 vCPU / 8 GiB host
# Mounted by docker/docker-compose.prod.yml (see docs/design/plans/2026-06-04-1panel-docker-production.md)
[mysqld]
character-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci
# ~1 GiB for InnoDB (leave RAM for Nexus, Redis, 1Panel, OS)
innodb_buffer_pool_size = 1024M
innodb_log_file_size = 256M
# Nexus async pool default 30+20; leave headroom for admin/migrations
max_connections = 120
# 2 vCPU: avoid aggressive IO threads
innodb_read_io_threads = 4
innodb_write_io_threads = 4
# Sensible defaults on small VMs
table_open_cache = 2000
tmp_table_size = 64M
max_heap_table_size = 64M
[client]
default-character-set = utf8mb4
docker/mysql-prod-4c16g.cnf
+20
View File
@@ -0,0 +1,20 @@
# MySQL 8.4 — Nexus production tuning for 4 vCPU / 16 GiB host
[mysqld]
character-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci
innodb_buffer_pool_size = 4096M
innodb_log_file_size = 512M
max_connections = 200
innodb_read_io_threads = 8
innodb_write_io_threads = 8
table_open_cache = 4000
tmp_table_size = 128M
max_heap_table_size = 128M
[client]
default-character-set = utf8mb4
docker/profiles/1c4g.env
+5
View File
@@ -0,0 +1,5 @@
# Host profile: 1 vCPU / 4 GiB
NEXUS_MEM_LIMIT=1g
NEXUS_CPUS=1
NEXUS_DB_POOL_SIZE=15
NEXUS_DB_MAX_OVERFLOW=10
docker/profiles/2c8g.env
+5
View File
@@ -0,0 +1,5 @@
# Host profile: 2 vCPU / 8 GiB — default production
NEXUS_MEM_LIMIT=2g
NEXUS_CPUS=1.5
NEXUS_DB_POOL_SIZE=30
NEXUS_DB_MAX_OVERFLOW=20
docker/profiles/4c16g.env
+5
View File
@@ -0,0 +1,5 @@
# Host profile: 4 vCPU / 16 GiB
NEXUS_MEM_LIMIT=4g
NEXUS_CPUS=3
NEXUS_DB_POOL_SIZE=50
NEXUS_DB_MAX_OVERFLOW=30
docs/Nexus-功能说明书.html
-733
View File
@@ -1,733 +0,0 @@
<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width,initial-scale=1.0">
<title>Nexus 6.0 — 功能说明书</title>
<style>
*{box-sizing:border-box;margin:0;padding:0}
body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;background:#0f172a;color:#e2e8f0;line-height:1.6}
a{color:#60a5fa;text-decoration:none}
a:hover{text-decoration:underline}
/* Layout */
.wrap{max-width:960px;margin:0 auto;padding:32px 24px 80px}
/* Header */
.hero{text-align:center;padding:48px 0 40px;border-bottom:1px solid #1e293b;margin-bottom:40px}
.hero h1{font-size:2.2rem;font-weight:700;color:#f8fafc;letter-spacing:-0.02em}
.hero .sub{font-size:1rem;color:#64748b;margin-top:8px}
.badge{display:inline-block;margin:4px;padding:3px 10px;border-radius:999px;font-size:0.72rem;font-weight:600}
.badge-blue{background:#1e3a5f;color:#60a5fa;border:1px solid #2563eb55}
.badge-green{background:#14371f;color:#4ade80;border:1px solid #16a34a55}
.badge-amber{background:#3d2a00;color:#fbbf24;border:1px solid #d9770655}
.badge-red{background:#3b1212;color:#f87171;border:1px solid #dc262655}
/* TOC */
.toc{background:#1e293b;border:1px solid #334155;border-radius:12px;padding:20px 24px;margin-bottom:36px}
.toc h2{font-size:0.85rem;font-weight:700;color:#94a3b8;text-transform:uppercase;letter-spacing:.08em;margin-bottom:12px}
.toc ol{padding-left:18px;column-count:2;column-gap:24px}
.toc li{margin:5px 0;font-size:0.88rem}
/* Section */
.section{margin-bottom:48px}
.section-title{font-size:1.4rem;font-weight:700;color:#f1f5f9;padding-bottom:10px;border-bottom:2px solid #334155;margin-bottom:24px;display:flex;align-items:center;gap:10px}
.section-title .icon{font-size:1.2rem}
/* Card */
.card{background:#1e293b;border:1px solid #334155;border-radius:12px;padding:24px;margin-bottom:16px}
.card-title{font-size:1.05rem;font-weight:600;color:#f1f5f9;margin-bottom:6px;display:flex;align-items:center}
.card-title .num{display:inline-flex;align-items:center;justify-content:center;width:22px;height:22px;border-radius:50%;background:#334155;font-size:0.7rem;font-weight:700;color:#94a3b8;margin-right:8px;shrink:0}
.card-desc{color:#94a3b8;font-size:0.88rem;margin-bottom:14px}
/* Info rows */
.info-grid{display:grid;grid-template-columns:1fr;gap:10px}
.info-block{border-radius:8px;padding:12px 14px}
.info-block.usage{background:#0f2d1f;border:1px solid #166534}
.info-block.warn{background:#2a1a00;border:1px solid #92400e}
.info-block.note{background:#1a1f2e;border:1px solid #4338ca}
.info-title{font-size:0.72rem;font-weight:700;text-transform:uppercase;letter-spacing:.08em;margin-bottom:6px}
.info-title.u{color:#4ade80}
.info-title.w{color:#fbbf24}
.info-title.n{color:#818cf8}
.info-block ul{padding-left:16px;font-size:0.86rem;color:#cbd5e1}
.info-block li{margin:4px 0}
.info-block p{font-size:0.86rem;color:#cbd5e1}
/* Sub table */
.feat-table{width:100%;border-collapse:collapse;font-size:0.86rem;margin-top:10px}
.feat-table th{text-align:left;color:#64748b;font-weight:600;font-size:0.75rem;text-transform:uppercase;padding:6px 10px;border-bottom:1px solid #334155}
.feat-table td{padding:7px 10px;border-bottom:1px solid #1e293b;color:#cbd5e1;vertical-align:top}
.feat-table tr:last-child td{border-bottom:none}
/* Footer */
footer{text-align:center;color:#334155;font-size:0.8rem;margin-top:60px;padding-top:24px;border-top:1px solid #1e293b}
code{background:#334155;color:#7dd3fc;padding:2px 6px;border-radius:4px;font-size:0.83em;font-family:monospace}
</style>
</head>
<body>
<div class="wrap">
<!-- HERO -->
<div class="hero">
<h1>⚡ Nexus 6.0</h1>
<p class="sub">服务器运维管理平台 — 全站功能说明书 · 2026-05-23</p>
<p class="sub" style="margin-top:10px;font-size:0.85rem">
Markdown 维护版：<code>docs/project/nexus-full-site-features.md</code> ·
AI 接续：<code>docs/project/AI-HANDOFF-2026-05-23.md</code>
</p>
<div style="margin-top:14px">
<span class="badge badge-blue">FastAPI</span>
<span class="badge badge-blue">SQLAlchemy 2.0</span>
<span class="badge badge-blue">Redis 7</span>
<span class="badge badge-blue">asyncssh</span>
<span class="badge badge-blue">Tailwind v4</span>
<span class="badge badge-green">2000+ 服务器</span>
<span class="badge badge-green">JWT + TOTP</span>
</div>
</div>
<!-- TOC -->
<div class="toc">
<h2>目录</h2>
<ol>
<li><a href="#sitemap">全站页面地图</a></li>
<li><a href="#network">网络与通道</a></li>
<li><a href="#auth">认证与访问控制</a></li>
<li><a href="#dashboard">仪表盘</a></li>
<li><a href="#alerts">告警中心</a></li>
<li><a href="#servers">服务器管理</a></li>
<li><a href="#assets">资产管理</a></li>
<li><a href="#webssh">Web SSH</a></li>
<li><a href="#commands">命令与推送日志</a></li>
<li><a href="#push">批量文件推送</a></li>
<li><a href="#scripts">脚本与执行历史</a></li>
<li><a href="#files">远程文件管理</a></li>
<li><a href="#schedules">定时调度</a></li>
<li><a href="#credentials">凭据管理</a></li>
<li><a href="#retries">重试队列</a></li>
<li><a href="#search">全局搜索</a></li>
<li><a href="#settings">系统设置</a></li>
<li><a href="#audit">审计日志</a></li>
<li><a href="#install">安装向导</a></li>
<li><a href="#guardian">3 层守护</a></li>
<li><a href="#agent">子机 Agent</a></li>
<li><a href="#background">后台任务</a></li>
<li><a href="#acceptance">开发验收标准</a></li>
<li><a href="#notimpl">未实现 / 已否决</a></li>
</ol>
</div>
<!-- 0. SITEMAP -->
<div class="section" id="sitemap">
<div class="section-title"><span class="icon">🗺</span> 全站页面地图（18 页）</div>
<div class="card">
<table class="feat-table">
<tr><th>页面</th><th>路径</th><th>功能</th></tr>
<tr><td>安装向导</td><td><code>/app/install.html</code></td><td>无 .env 时安装中心机</td></tr>
<tr><td>登录</td><td><code>/app/login.html</code></td><td>JWT + TOTP + 防暴破</td></tr>
<tr><td>仪表盘</td><td><code>/app/index.html</code></td><td>统计、WS 刷新统计</td></tr>
<tr><td>服务器</td><td><code>/app/servers.html</code></td><td>CRUD、Agent 安装/升级、漂移徽章</td></tr>
<tr><td>资产管理</td><td><code>/app/assets.html</code></td><td>Platform / Node</td></tr>
<tr><td>文件管理</td><td><code>/app/files.html</code></td><td>SSH 浏览与文件操作</td></tr>
<tr><td>推送</td><td><code>/app/push.html</code></td><td>rsync 批量 + dry-run</td></tr>
<tr><td>脚本库</td><td><code>/app/scripts.html</code></td><td>脚本 CRUD、直接执行</td></tr>
<tr><td>执行历史</td><td><code>/app/script-executions.html</code></td><td>停止/重试/日志</td></tr>
<tr><td>凭据</td><td><code>/app/credentials.html</code></td><td>DB 凭据 + 密码预设</td></tr>
<tr><td>定时调度</td><td><code>/app/schedules.html</code></td><td>Cron 推送或脚本</td></tr>
<tr><td>重试队列</td><td><code>/app/retries.html</code></td><td>推送失败重试</td></tr>
<tr><td>命令日志</td><td><code>/app/commands.html</code></td><td>WebSSH 命令 + 推送日志</td></tr>
<tr><td>告警中心</td><td><code>/app/alerts.html</code></td><td>告警历史与统计</td></tr>
<tr><td>审计</td><td><code>/app/audit.html</code></td><td>操作审计、多维过滤</td></tr>
<tr><td>设置</td><td><code>/app/settings.html</code></td><td>阈值、Telegram、白名单、TOTP</td></tr>
<tr><td>WebSSH</td><td><code>/app/terminal.html</code></td><td>xterm 终端</td></tr>
</table>
<p class="card-desc" style="margin-top:12px">共享：<code>layout.js</code>（侧栏/移动适配）、<code>api.js</code>（JWT、toast、全局搜索）</p>
</div>
</div>
<!-- NETWORK -->
<div class="section" id="network">
<div class="section-title"><span class="icon">🔌</span> 网络与通道模型</div>
<div class="card">
<table class="feat-table">
<tr><th>方向</th><th>端口</th><th>用途</th><th>必须</th></tr>
<tr><td>子机 → 中心</td><td><strong>443 出站</strong></td><td>Agent 心跳、长任务 curl 回调</td><td>✅</td></tr>
<tr><td>中心 → 子机</td><td><strong>22 入站</strong></td><td>推送、文件、脚本、健康检查、Agent 安装</td><td>✅</td></tr>
<tr><td>子机本机</td><td><code>127.0.0.1:8601</code></td><td>Agent HTTP（可不暴露公网）</td><td>可选</td></tr>
</table>
<div class="info-block note" style="margin-top:12px"><div class="info-title n">说明</div><p>脚本执行与手动健康检查已改走 <strong>SSH</strong>，不依赖公网 8601。宝塔环境请用系统 Python 3.12 + <code>install.sh</code> venv，勿用面板 Python 项目管理器托管 Agent。</p></div>
</div>
</div>
<!-- 1. AUTH -->
<div class="section" id="auth">
<div class="section-title"><span class="icon">🔒</span> 1. 认证与访问控制</div>
<div class="card">
<div class="card-title"><span class="num">1</span> JWT 登录 + 自动刷新</div>
<p class="card-desc">管理员通过用户名+密码登录，获取 Access Token（30 分钟）和 Refresh Token（7 天）。前端到期前 2 分钟自动换新 Token，无感续期。</p>
<div class="info-grid">
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>访问 <code>/app/login.html</code>，输入管理员账号密码</li>
<li>Token 存于 <code>localStorage</code>，关闭浏览器后 7 天内免登录</li>
<li>8 小时无操作自动退出</li>
</ul></div>
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
<li>JWT 存于 localStorage，XSS 漏洞可能导致 Token 泄露（已做 CSP 缓解）</li>
<li>无 RBAC：只有一个管理员角色，鉴权即信任</li>
<li>不支持多管理员角色区分</li>
</ul></div>
</div>
</div>
<div class="card">
<div class="card-title"><span class="num">2</span> TOTP 双因素认证</div>
<p class="card-desc">可选启用 Google Authenticator 兼容的 TOTP。登录时先验密码，再验 6 位动态码（30 秒窗口）。</p>
<div class="info-grid">
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>进入「设置」→「安全设置」→ 启用 / <strong>重新绑定</strong> TOTP，扫描二维码</li>
<li>禁用 TOTP 需同时提供当前密码 + TOTP 码</li>
</ul></div>
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
<li>TOTP 秘钥丢失无法恢复，需提前备份</li>
<li>系统时间偏差 &gt;30s 会导致验证失败（接受 ±1 窗口共 90s）</li>
</ul></div>
</div>
</div>
<div class="card">
<div class="card-title"><span class="num">3</span> 登录防暴破</div>
<p class="card-desc">同一 IP + 用户名 15 分钟内失败 5 次，账号自动锁定并返回 HTTP 429。</p>
<div class="info-block note"><div class="info-title n">注意</div><p>锁定基于 IP + 用户名组合，更换 IP 可绕过。适合防自动化爆破，不防分布式攻击。</p></div>
</div>
<div class="card">
<div class="card-title"><span class="num">4</span> 登录 IP 白名单</div>
<p class="card-desc">可在设置中开启「仅允许白名单 IP 登录」。支持手动 IP/CIDR，以及从<strong>代理订阅 URL</strong>解析节点 IP（每 2 小时自动刷新，与手动列表合并）。</p>
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>「设置」→「登录 IP 白名单」→ 总开关 + 订阅地址 + 手动 IP</li>
<li>非白名单 IP 登录被拒绝并记审计</li>
</ul></div>
</div>
</div>
<!-- 2. DASHBOARD -->
<div class="section" id="dashboard">
<div class="section-title"><span class="icon">📊</span> 2. 仪表盘与实时告警</div>
<div class="card">
<div class="card-title"><span class="num">1</span> 实时统计面板</div>
<p class="card-desc">首页展示服务器总数、在线数、离线数、告警中台数、最近推送记录。数据来源 Redis（实时）+ MySQL（历史），通过 WebSocket 触发刷新。</p>
<div class="info-grid">
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>在线状态取自 Redis <code>heartbeat:{id}</code>，子机 60s 上报一次</li>
<li>告警计数 = Redis <code>alerts:*</code> key 数量</li>
<li>WS 断线会自动重连（3 次指数退避）</li>
</ul></div>
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
<li>在线状态最多滞后 60s（子机心跳间隔）</li>
<li>Redis 不可用时统计退化为 MySQL 数据，可能不准</li>
</ul></div>
</div>
</div>
<div class="card">
<div class="card-title"><span class="num">2</span> 告警通知（Telegram）</div>
<p class="card-desc">CPU / 内存 / 磁盘超过阈值（默认 80%）时，通过 Telegram Bot 推送告警；恢复后发送恢复通知。同服务器同指标 5 分钟内不重复推送。</p>
<div class="info-grid">
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>「设置」配置 <code>TELEGRAM_BOT_TOKEN</code> + <code>TELEGRAM_CHAT_ID</code></li>
<li>阈值可在设置页调整（CPU/内存/磁盘各独立）</li>
<li>浏览器仪表盘<strong>只显示计数，不弹窗、不响铃</strong>（设计决策）</li>
</ul></div>
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
<li>浏览器仪表盘不弹告警列表；历史见「告警中心」页</li>
<li>Telegram Bot 被封或网络不通时告警静默失败（有日志）</li>
<li>告警防抖 key 存于进程内存，重启后防抖状态重置</li>
</ul></div>
</div>
</div>
</div>
<!-- ALERTS -->
<div class="section" id="alerts">
<div class="section-title"><span class="icon">🔔</span> 告警中心</div>
<div class="card">
<div class="card-title"><span class="num">1</span> 告警历史（alerts.html）</div>
<p class="card-desc">将 CPU/内存/磁盘告警与恢复事件持久化到 <code>alert_logs</code>，支持分页、按服务器/类型/日期筛选，以及近 7 日统计图表数据。</p>
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>侧栏「告警中心」查看历史列表</li>
<li>API：<code>GET /api/alert-history/</code>、<code>GET /api/alert-history/stats</code></li>
</ul></div>
</div>
<div class="card">
<div class="card-title"><span class="num">2</span> 分项 Telegram 开关</div>
<p class="card-desc">设置页可单独关闭某类告警的 Telegram 推送（告警/恢复/系统/时钟漂移等），便于后续扩展通道。</p>
</div>
</div>
<!-- 3. SERVERS -->
<div class="section" id="servers">
<div class="section-title"><span class="icon">🖥</span> 3. 服务器管理</div>
<div class="card">
<div class="card-title"><span class="num">1</span> 服务器 CRUD</div>
<p class="card-desc">增删改查服务器配置，支持 SSH 密钥 / 密码双认证，可按平台类型（Platform）和节点（Node 树）分组。</p>
<div class="info-grid">
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>新增服务器：填写名称、域名/IP、SSH 端口、认证方式</li>
<li>认证方式选「密钥」时粘贴私钥内容，自动 Fernet 加密存储</li>
<li>支持 <code>platform_id</code> / <code>node_id</code> 分组归类</li>
<li>服务器列表分页显示（默认 50 条/页）</li>
</ul></div>
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
<li>批量导入（CSV）未实现，2000 台需逐一或通过 API 批量添加</li>
<li>删除服务器同时删除关联推送日志（CASCADE）</li>
</ul></div>
</div>
</div>
<div class="card">
<div class="card-title"><span class="num">2</span> 健康检查</div>
<p class="card-desc">手动触发 <code>POST /api/servers/check</code>：经 <strong>SSH</strong> 执行 Python 采集 CPU/内存/磁盘（<code>remote_probe</code>），<strong>不需要</strong>公网 8601。</p>
<div class="info-block note"><div class="info-title n">与在线状态区别</div><p>列表「在线」主要来自 Agent <strong>443 心跳</strong>；健康检查用于即时 SSH 探活与指标快照。</p></div>
</div>
<div class="card">
<div class="card-title"><span class="num">4</span> Agent 安装与升级</div>
<p class="card-desc">服务器详情「Agent 安装」：复制 <code>install.sh</code> 命令或一键 SSH 安装（带日志）；安装后轮询在线。升级通过 SSH 拉取最新 <code>agent.py</code> 并 restart。</p>
<div class="info-block warn"><div class="info-title w">注意</div><ul>
<li>安装脚本：Python 3.12 venv、监听 <code>127.0.0.1:8601</code>，无需公网放行 8601</li>
<li>时钟漂移：心跳带 <code>agent_time</code>，列表显示 warn/crit 徽章</li>
</ul></div>
</div>
<div class="card">
<div class="card-title"><span class="num">3</span> 每服务器 API Key</div>
<p class="card-desc">为每台服务器单独生成 Agent API Key（格式 <code>nxs-xxx</code>），用于该服务器子机与中心通信的专属认证。</p>
<div class="info-grid">
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>服务器详情 → 「生成 Agent Key」，完整 Key 仅本次显示，立即复制到子机 <code>config.json</code></li>
<li>列表页只显示前 8 位用于识别</li>
</ul></div>
<div class="info-block warn"><div class="info-title w">注意</div><ul>
<li>Key 生成后无法再次查看（一次性展示设计）</li>
<li>丢失需重新生成并更新子机配置</li>
</ul></div>
</div>
</div>
</div>
<!-- ASSETS -->
<div class="section" id="assets">
<div class="section-title"><span class="icon">🗂</span> 资产管理</div>
<div class="card">
<div class="card-title"><span class="num">1</span> Platform 与 Node</div>
<p class="card-desc"><code>assets.html</code> 管理资产类型模板（Platform）与树形节点（Node），服务器表单可关联分组。</p>
<p class="card-desc">API：<code>/api/assets/platforms</code>、<code>/api/assets/nodes</code>（含 tree）</p>
</div>
<div class="card">
<div class="card-title"><span class="num">2</span> SSH 会话与命令（只读查询）</div>
<p class="card-desc">同页或「命令日志」可查询 <code>ssh_sessions</code>、<code>command_logs</code>（WebSSH 产生）。</p>
</div>
</div>
<!-- 4. WEB SSH -->
<div class="section" id="webssh">
<div class="section-title"><span class="icon">💻</span> 4. Web SSH 终端</div>
<div class="card">
<div class="card-title"><span class="num">1</span> 浏览器终端</div>
<p class="card-desc">基于 xterm.js + asyncssh，在浏览器内打开远程服务器 SSH 会话，支持全屏、自动 resize、彩色输出。</p>
<div class="info-grid">
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>服务器列表点击「终端」→ 弹出 <code>/app/terminal.html?server_id=X</code></li>
<li>认证：先获取短效 webssh-token（15 分钟），绑定到该服务器，再建 WebSocket</li>
<li>支持窗口 resize 自动通知远程 shell</li>
</ul></div>
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
<li>Token 通过 URL 参数传递（?token=...），HTTPS 下安全；HTTP 下有风险</li>
<li>不支持文件上传 / 拖拽（需用文件管理页）</li>
<li>会话不录像（已明确否决）</li>
<li>网络中断 WebSocket 不会自动重连，需刷新页面</li>
</ul></div>
</div>
</div>
</div>
<!-- COMMANDS -->
<div class="section" id="commands">
<div class="section-title"><span class="icon">💻</span> 命令与推送日志</div>
<div class="card">
<div class="card-title"><span class="num">1</span> WebSSH 会话与命令</div>
<p class="card-desc"><code>commands.html</code>：会话列表、命令列表（危险命令高亮）、按服务器过滤。数据来自 WebSSH，直接 SSH 不记录。</p>
</div>
<div class="card">
<div class="card-title"><span class="num">2</span> 推送日志</div>
<p class="card-desc">同页「推送日志」Tab：rsync 批量推送历史，支持服务器/状态/同步模式/触发方式过滤与分页。</p>
</div>
</div>
<!-- 5. PUSH -->
<div class="section" id="push">
<div class="section-title"><span class="icon">📤</span> 5. 批量文件推送</div>
<div class="card">
<div class="card-title"><span class="num">1</span> rsync 批量推送</div>
<p class="card-desc">将源目录通过 rsync-over-SSH 推送到选定的服务器列表，支持 4 种同步模式，内置分批（50 台/批）并发（10 路）控制。</p>
<table class="feat-table">
<tr><th>同步模式</th><th>rsync 参数</th><th>适用场景</th></tr>
<tr><td>增量同步</td><td><code>-az</code></td><td>日常更新，只同步有变动的文件</td></tr>
<tr><td>全量同步</td><td><code>-az --delete</code></td><td>强制目标与源完全一致，会删除目标多余文件</td></tr>
<tr><td>校验和</td><td><code>-az --checksum</code></td><td>按文件内容而非时间戳判断差异</td></tr>
<tr><td>直接覆盖</td><td><code>-az --inplace</code></td><td>不用临时文件，直接覆盖（大文件节省空间）</td></tr>
</table>
<div class="info-grid" style="margin-top:12px">
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
<li><strong>全量同步（--delete）会不可逆删除</strong>目标目录多余文件，务必先「预览」</li>
<li>rsync 在中心机运行，中心机需能 SSH 到所有子机</li>
<li>失败的服务器自动加入重试队列（指数退避，最多 100 次）</li>
</ul></div>
</div>
</div>
<div class="card">
<div class="card-title"><span class="num">2</span> 推送前预览（dry-run）</div>
<p class="card-desc">选中全量/覆盖模式时，页面显示橙色警告，引导先对首台服务器运行 <code>rsync --dry-run --stats</code>，查看待传输/删除文件数量后再决定是否推送。</p>
<div class="info-grid">
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>选择「全量同步」→ 出现橙色预览按钮 → 点击 → 展示首台服务器变动摘要</li>
<li>可展开「详细文件列表」（最多 200 行）</li>
<li>预览不阻塞推送，看完数据自行决定是否点「开始推送」</li>
</ul></div>
<div class="info-block warn"><div class="info-title w">注意</div><ul>
<li>仅预览第一台选中的服务器，其余服务器可能略有差异</li>
<li>预览需 SSH 连通，与真实推送消耗相同时间（通常 &lt;5s）</li>
</ul></div>
</div>
</div>
<div class="card">
<div class="card-title"><span class="num">3</span> 失败自动重试队列</div>
<p class="card-desc">推送失败的服务器自动进入 <code>push_retry_jobs</code> 队列，后台每 5 分钟按指数退避重试（60s → 120s → 240s...，最大 64 分钟）。</p>
<div class="info-block note"><div class="info-title n">注意</div><p>最多重试 100 次。可在「重试」页手动强制立即重试或删除任务。</p></div>
</div>
</div>
<!-- 6. SCRIPTS -->
<div class="section" id="scripts">
<div class="section-title"><span class="icon">📜</span> 脚本与执行历史</div>
<div class="card">
<div class="card-title"><span class="num">1</span> 脚本库管理</div>
<p class="card-desc">维护可复用 Shell 脚本库（按 ops/deploy/check/cleanup 分类），一键下发到选定的服务器。</p>
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>「脚本」页 → 新建脚本 → 填写名称/类别/内容</li>
<li>点击脚本名 → 编辑；点击「执行」→ 选择服务器 → 运行</li>
<li>支持直接输入临时命令（无需保存到库）</li>
</ul></div>
</div>
<div class="card">
<div class="card-title"><span class="num">2</span> 批量执行（短任务 / 长任务）</div>
<p class="card-desc">短任务：同步等待结果（默认 30s 超时）。长任务：nohup 后台运行，完成后 curl 回调中心记录结果。</p>
<div class="info-grid">
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>选择服务器 → 填写命令 → 「执行」</li>
<li>执行走 <strong>SSH 22</strong>（结果含 <code>channel: ssh</code>），无需子机公网 8601</li>
<li>长任务：nohup + 子机 curl 回调中心（需 HTTPS <code>NEXUS_API_BASE_URL</code>）</li>
<li>「执行历史」页：停止 / 重试 / 标记卡住 / 拉取 nexus-job 日志</li>
</ul></div>
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
<li><code>rm -rf /</code> 等危险命令被中心<strong>拦截（400）</strong>，但仅匹配预设规则</li>
<li>长任务依赖子机能访问中心 <code>NEXUS_API_BASE_URL</code>（必须配置且使用 HTTPS）</li>
<li>执行历史默认保留 2 小时 Redis 热数据，60s 刷入 MySQL</li>
<li>执行命令时密码等敏感 $DB_* 变量存储时已脱敏（替换为 ***）</li>
</ul></div>
</div>
</div>
<div class="card">
<div class="card-title"><span class="num">3</span> $DB_* 数据库凭据替换</div>
<p class="card-desc">脚本中使用 <code>$DB_USER</code> / <code>$DB_PASS</code> / <code>$DB_HOST</code> / <code>$DB_PORT</code> / <code>$DB_NAME</code> 占位符，执行时自动替换为选定的数据库凭据，密码不出现在脚本文本或日志中。</p>
<div class="info-block note"><div class="info-title n">注意</div><p>替换在中心机完成后发往子机，子机接收到的已是明文命令；传输通过 HTTPS，子机侧无加密保护。</p></div>
</div>
</div>
<!-- 7. FILES -->
<div class="section" id="files">
<div class="section-title"><span class="icon">📁</span> 7. 远程文件管理</div>
<div class="card">
<div class="card-title"><span class="num">1</span> 目录浏览</div>
<p class="card-desc">通过 SSH exec（<code>ls -la</code>）浏览指定服务器的远程目录，支持面包屑导航和目录点击进入。</p>
<div class="info-grid">
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>「文件管理」→ 选服务器 → 输入路径 → 「浏览」（或按 Enter）</li>
<li>点击目录名进入子目录，点击「..」返回上级</li>
<li>文件按 目录优先 / 字母顺序 排列</li>
</ul></div>
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
<li>无左侧树状面板（每次需手动导航）</li>
<li>显示的文件大小为 <code>ls</code> 输出的字节数，大文件不友好</li>
</ul></div>
</div>
</div>
<div class="card">
<div class="card-title"><span class="num">2</span> 文件操作（删除/重命名/新建目录）</div>
<p class="card-desc">鼠标悬停文件/目录行显示操作按钮，通过 SSH exec 在远程执行操作。</p>
<table class="feat-table">
<tr><th>操作</th><th>命令</th><th>触发方式</th></tr>
<tr><td>删除文件</td><td><code>rm -f path</code></td><td>悬停 → 🗑 → confirm 弹窗</td></tr>
<tr><td>删除目录</td><td><code>rm -rf path</code></td><td>悬停 → 🗑 → 额外警告弹窗</td></tr>
<tr><td>重命名</td><td><code>mv src dst</code></td><td>悬停 → ✏ → prompt 输入新名</td></tr>
<tr><td>新建目录</td><td><code>mkdir -p path</code></td><td>右上角 📁+ → prompt 输入名</td></tr>
</table>
<div class="info-block warn" style="margin-top:10px"><div class="info-title w">缺点 / 注意</div><ul>
<li>删除目录（rm -rf）<strong>不可恢复</strong>，浏览器弹窗确认无法替代真正的安全保障</li>
<li>无文件编辑器（已明确否决，用 WebSSH vim/nano 代替）</li>
<li>无文件上传功能（可用 SFTP API 或 WebSSH scp）</li>
<li>无文件内容预览</li>
</ul></div>
</div>
</div>
<!-- 8. SCHEDULES -->
<div class="section" id="schedules">
<div class="section-title"><span class="icon">⏰</span> 8. 定时调度</div>
<div class="card">
<div class="card-title"><span class="num">1</span> Cron 调度（推送 + 脚本）</div>
<p class="card-desc">支持两种 <code>schedule_type</code>：<strong>文件推送</strong> 或 <strong>脚本执行</strong>。5 字段 Cron，后台每 60s 检查（仅 Primary Worker）。</p>
<div class="info-grid">
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>「定时」→ 选类型 → 填 Cron、目标服务器</li>
<li>脚本型：选脚本库 ID 或内联内容，可设超时与长任务</li>
<li>示例：<code>0 2 * * *</code> = 每天凌晨 2 点</li>
</ul></div>
<div class="info-block warn"><div class="info-title w">注意</div><ul>
<li>Cron 精度受 60s 检查间隔限制</li>
<li>脚本调度同样走 SSH 执行通道</li>
</ul></div>
</div>
</div>
</div>
<!-- RETRIES -->
<div class="section" id="retries">
<div class="section-title"><span class="icon">🔄</span> 重试队列</div>
<div class="card">
<p class="card-desc"><code>retries.html</code> 管理推送失败任务：<code>retry_runner</code> 每 5 分钟指数退避；可手动立即重试或删除。</p>
</div>
</div>
<!-- SEARCH -->
<div class="section" id="search">
<div class="section-title"><span class="icon">🔍</span> 全局搜索</div>
<div class="card">
<p class="card-desc">侧栏搜索框调用 <code>GET /api/search/</code>，跨服务器、脚本、凭据、定时任务关键字匹配。</p>
</div>
</div>
<!-- 9. CREDENTIALS -->
<div class="section" id="credentials">
<div class="section-title"><span class="icon">🔑</span> 9. 凭据管理</div>
<div class="card">
<div class="card-title"><span class="num">1</span> 数据库凭据</div>
<p class="card-desc">存储 MySQL/PostgreSQL 连接信息，密码 Fernet 加密，API 响应不含密码（仅元数据）。供脚本执行时通过 $DB_* 变量引用。</p>
<div class="info-block warn"><div class="info-title w">注意</div><p>凭据只加密存储，子机接收到的命令已含明文连接信息（仅在中心→子机的 HTTPS 传输中受保护）。</p></div>
</div>
<div class="card">
<div class="card-title"><span class="num">2</span> 密码预设</div>
<p class="card-desc">存储 SSH 密码模板（Fernet 加密），可在推送配置中引用，避免重复输入常用密码。</p>
<div class="info-block note"><div class="info-title n">注意</div><p>密码预设不能用于脚本 $DB_PASS 替换，只用于推送密码模板。</p></div>
</div>
</div>
<!-- 10. SETTINGS -->
<div class="section" id="settings">
<div class="section-title"><span class="icon">⚙️</span> 10. 系统设置</div>
<div class="card">
<div class="card-title"><span class="num">1</span> 可配置项</div>
<table class="feat-table">
<tr><th>设置项</th><th>说明</th><th>是否可改</th></tr>
<tr><td>系统名称 / 标题</td><td>品牌展示名称</td><td>✅ 可改</td></tr>
<tr><td>告警阈值（CPU/内存/磁盘）</td><td>超过阈值触发 Telegram 告警，默认 80%</td><td>✅ 可改</td></tr>
<tr><td>Redis URL</td><td>Redis 连接地址</td><td>✅ 可改</td></tr>
<tr><td>数据库连接池大小</td><td>pool_size / max_overflow</td><td>✅ 可改</td></tr>
<tr><td>Telegram Bot Token / Chat ID</td><td>告警推送配置</td><td>✅ 可改</td></tr>
<tr><td>SECRET_KEY / API_KEY / ENCRYPTION_KEY</td><td>核心安全密钥</td><td>❌ 不可改（需改 .env 重启）</td></tr>
<tr><td>DATABASE_URL</td><td>数据库连接</td><td>❌ 不可改</td></tr>
</table>
</div>
<div class="card">
<div class="card-title"><span class="num">2</span> Telegram</div>
<p class="card-desc">配置 Bot Token / Chat ID；<strong>测试发送</strong>；通过 getUpdates <strong>检测 Chat ID</strong>；各告警类型独立开关。</p>
</div>
<div class="card">
<div class="card-title"><span class="num">3</span> TOTP 与 API Key</div>
<p class="card-desc">TOTP 启用/禁用/<strong>重新绑定</strong>；全局 API Key 需密码二次验证后查看（记审计）。</p>
</div>
<div class="card">
<div class="card-title"><span class="num">4</span> 登录 IP 白名单</div>
<p class="card-desc">总开关、订阅 URL（2h 刷新）、手动 IP、解析预览（见「认证」章节）。</p>
</div>
</div>
<!-- 11. AUDIT -->
<div class="section" id="audit">
<div class="section-title"><span class="icon">📋</span> 11. 审计日志</div>
<div class="card">
<div class="card-title"><span class="num">1</span> 操作审计</div>
<p class="card-desc">所有 CUD 操作（创建/更新/删除服务器、推送、执行脚本、登录、改密码等）自动写入 <code>audit_logs</code>，记录操作人、IP、目标、详情。</p>
<div class="info-grid">
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>「审计」页：日期起止、管理员用户名、操作类型（分组下拉）</li>
<li>每页 50 条分页</li>
</ul></div>
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
<li>无日志导出（已否决 CSV/JSON）</li>
<li>审计日志不会自动清理，长期需归档</li>
</ul></div>
</div>
</div>
</div>
<!-- 12. INSTALL -->
<div class="section" id="install">
<div class="section-title"><span class="icon">🚀</span> 12. 安装向导</div>
<div class="card">
<div class="card-title"><span class="num">1</span> 5 步安装向导</div>
<p class="card-desc">无 <code>.env</code> 文件时系统进入安装模式，访问 <code>/app/install.html</code> 完成 5 步配置：欢迎 → 数据库 → Redis → 管理员账号 → 完成。自动生成 API Key / Secret Key / Encryption Key。</p>
<div class="info-grid">
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
<li>安装完成后 <code>.env</code> 自动生成，安装 API 除 GET /status 外全部锁定（返回 403）</li>
<li>重装需手动删除 <code>.env</code> 并重启</li>
</ul></div>
<div class="info-block warn"><div class="info-title w">注意</div><ul>
<li>安装过程未验证数据库/Redis 连接成功才允许进入下一步（应在步骤中手动验证）</li>
<li>安装模式下除 install API 和静态文件外，其余 API 返回 503</li>
</ul></div>
</div>
</div>
</div>
<!-- 13. GUARDIAN -->
<div class="section" id="guardian">
<div class="section-title"><span class="icon">🛡</span> 13. 三层守护机制</div>
<div class="card">
<div class="card-title"><span class="num">1</span> 三层守护</div>
<table class="feat-table">
<tr><th>层级</th><th>机制</th><th>触发条件</th><th>动作</th></tr>
<tr><td>Layer 1</td><td>Supervisor</td><td>Python 进程崩溃</td><td>自动重启</td></tr>
<tr><td>Layer 2</td><td>Python self_monitor（30s）</td><td>Redis/MySQL 不可达</td><td>发 Telegram 告警/恢复</td></tr>
<tr><td>Layer 3</td><td>Shell cron（1 分钟）</td><td>连续 3 次 /health 失败</td><td>supervisorctl restart + Telegram</td></tr>
</table>
<div class="info-block warn" style="margin-top:10px"><div class="info-title w">注意</div><p>Shell cron 依赖宝塔/系统 crontab 配置，部署时需手动添加定时任务。</p></div>
</div>
</div>
<!-- 14. AGENT -->
<div class="section" id="agent">
<div class="section-title"><span class="icon">🤖</span> 14. 子机 Agent</div>
<div class="card">
<div class="card-title"><span class="num">1</span> Agent 功能</div>
<p class="card-desc">部署在每台被管服务器上的轻量服务：<strong>心跳走 443 出站</strong>；HTTP 仅本机 <code>127.0.0.1:8601</code>。中心侧脚本已改 <strong>SSH</strong>，/exec 端点保留供兼容。</p>
<table class="feat-table">
<tr><th>能力</th><th>说明</th></tr>
<tr><td>心跳</td><td>POST 中心 <code>/api/agent/heartbeat</code>，写 Redis，智能加急</td></tr>
<tr><td>时钟漂移</td><td><code>agent_time</code> 与中心比对，warn/crit + Telegram</td></tr>
<tr><td>IP 白名单</td><td><code>allowed_ips</code> 限制访问本机 Agent HTTP</td></tr>
<tr><td>长任务回调</td><td>POST <code>/api/agent/script-callback</code></td></tr>
<tr><td>安装</td><td><code>web/agent/install.sh</code> — python3.12 venv + systemd</td></tr>
</table>
<div class="info-block warn" style="margin-top:12px"><div class="info-title w">注意</div><ul>
<li>升级 API 存在，建议与 venv 安装脚本对齐后使用</li>
<li>长任务回调需子机出站访问中心 HTTPS</li>
</ul></div>
</div>
</div>
<!-- BACKGROUND -->
<div class="section" id="background">
<div class="section-title"><span class="icon">⚙</span> 后台任务（Primary Worker）</div>
<div class="card">
<table class="feat-table">
<tr><th>任务</th><th>间隔</th><th>说明</th></tr>
<tr><td>heartbeat_flush</td><td>10min</td><td>Redis 心跳 → MySQL</td></tr>
<tr><td>self_monitor</td><td>30s</td><td>Redis/MySQL/WS 自检 + Telegram</td></tr>
<tr><td>schedule_runner</td><td>60s</td><td>Cron 调度</td></tr>
<tr><td>retry_runner</td><td>5min</td><td>推送重试</td></tr>
<tr><td>ip_allowlist_refresh</td><td>2h</td><td>订阅 IP 刷新</td></tr>
<tr><td>script_execution_flush</td><td>60s</td><td>执行记录 Redis→MySQL</td></tr>
</table>
</div>
</div>
<!-- ACCEPTANCE -->
<div class="section" id="acceptance">
<div class="section-title"><span class="icon">✅</span> 标准与验收（与团队同等严谨）</div>
<div class="card">
<p class="card-desc"><strong>全量标准转接</strong>：<code>docs/project/standards-transfer-package.md</code> — 含 Cursor 规则、<code>standards/</code> 三件套、逐行八步 DoD、设计/上线清单。下一任 AI <strong>不得降低</strong>执行力度。</p>
<table class="feat-table">
<tr><th>类别</th><th>权威路径</th></tr>
<tr><td>标准转接包</td><td><code>docs/project/standards-transfer-package.md</code></td></tr>
<tr><td>验收 L0～L5</td><td><code>development-acceptance-standard.md</code></td></tr>
<tr><td>系统开发</td><td><code>standards/system-development-standard.md</code></td></tr>
<tr><td>逐行审计 v2</td><td><code>standards/line-walk-audit-standard-v2.md</code></td></tr>
<tr><td>审计原则</td><td><code>standards/audit-core-principles.md</code></td></tr>
<tr><td>Cursor</td><td><code>.cursor/rules/*.mdc</code>（含 audit-line-review）</td></tr>
</table>
<p class="card-desc" style="margin-top:12px">逐行审查：8 步/文件、Closure 全表含 SAFE、FINDING 必须 <code>文件:行号</code>、单回复 ≤5 文件。AI 接续：HANDOFF + 全站功能 + 标准转接包。</p>
</div>
</div>
<!-- 15. NOT IMPL -->
<div class="section" id="notimpl">
<div class="section-title"><span class="icon">🚫</span> 15. 未实现 / 已否决功能</div>
<div class="card">
<table class="feat-table">
<tr><th>功能</th><th>状态</th><th>原因 / 替代方案</th></tr>
<tr><td>文件编辑器（Monaco/ACE）</td><td><span class="badge badge-red">已否决</span></td><td>运维场景用 WebSSH + vim/nano；嵌入编辑器增加复杂度无实质收益</td></tr>
<tr><td>会话录像（asciicast）</td><td><span class="badge badge-red">已否决</span></td><td>命令日志已满足审计需求</td></tr>
<tr><td>RBAC 权限体系</td><td><span class="badge badge-red">已否决</span></td><td>鉴权即信任，单管理员模型；增加 RBAC 代价远超收益</td></tr>
<tr><td>移动端适配</td><td><span class="badge badge-red">已否决</span></td><td>2000 台服务器运维不会用手机操作</td></tr>
<tr><td>批量服务器导入（CSV）</td><td><span class="badge badge-amber">未实现</span></td><td>可通过 API 批量 POST /api/servers/ 实现</td></tr>
<tr><td>文件上传到远程服务器</td><td><span class="badge badge-amber">未实现</span></td><td>可用 WebSSH scp / 推送功能代替</td></tr>
<tr><td>文件内容预览</td><td><span class="badge badge-amber">未实现</span></td><td>可通过 WebSSH cat 查看</td></tr>
<tr><td>WebSSH 断线自动重连</td><td><span class="badge badge-amber">未实现</span></td><td>当前需刷新页面；计划自动重试+按钮</td></tr>
<tr><td>仪表盘历史趋势图</td><td><span class="badge badge-amber">未实现</span></td><td>仅实时 Redis 指标</td></tr>
<tr><td>宝塔 API 监控集成</td><td><span class="badge badge-amber">未实现</span></td><td>可选；参考 btpanel-skills</td></tr>
<tr><td>Agent mTLS</td><td><span class="badge badge-amber">讨论中</span></td><td>未实现</td></tr>
<tr><td>首次部署 E2E（T1～T5、T-SE）</td><td><span class="badge badge-amber">待验证</span></td><td>见 production-verification-checklist.md</td></tr>
</table>
</div>
</div>
<!-- FOOTER -->
<footer>
<p>Nexus 6.0 全站功能说明书 · 2026-05-23（对齐代码库）</p>
<p style="margin-top:6px">
<a href="project/nexus-full-site-features.md">全站功能</a> ·
<a href="project/standards-transfer-package.md">标准转接</a> ·
<a href="project/development-acceptance-standard.md">验收标准</a> ·
<a href="project/AI-HANDOFF-2026-05-23.md">AI 接续</a>
</p>
<p style="margin-top:4px">Python 3.12 / FastAPI 0.115 / MySQL 8.4 / Redis 7 / asyncssh 2.17 / Tailwind v4</p>
</footer>
</div>
</body>
</html>
docs/README.md
+17 -4
View File
@@ -17,7 +17,9 @@
| [project/risk-acceptance-single-operator.md](project/risk-acceptance-single-operator.md) | 单人运维风险接受 |
| [project/script-execution.md](project/script-execution.md) | 脚本执行 |
| [project/alert-push-policy.md](project/alert-push-policy.md) | 告警策略 |
| [project/deploy.md](project/deploy.md) | 部署补充 |
| [project/deploy.md](project/deploy.md) | 部署补充（宝塔/裸机） |
| [project/nexus-1panel-operations-knowledge.md](project/nexus-1panel-operations-knowledge.md) | **1Panel + Docker 运维知识 SSOT** |
| [project/nexus-god-menu-audit-summary.md](project/nexus-god-menu-audit-summary.md) | **nx 上帝菜单巡检归档**（2026-06-06 round1–10） |
| [project/production-verification-checklist.md](project/production-verification-checklist.md) | L5 清单 |
根目录 [AGENTS.md](../AGENTS.md) · [CLAUDE.md](../CLAUDE.md) · [.cursorrules](../.cursorrules) 为薄入口。
@@ -47,7 +49,18 @@
---
## 4. 设计与标准
## 4. 测试（全站用例 SSOT）
| 文档 | 说明 |
|------|------|
| [testing/test-case-matrix.md](testing/test-case-matrix.md) | **152 条** UT/IT/CH/E2E/MCP 编号用例 |
| [testing/mcp-browser-playbook.md](testing/mcp-browser-playbook.md) | Agent Playwright MCP 点页规程 |
| [design/specs/2026-06-08-full-site-testing-strategy-design.md](design/specs/2026-06-08-full-site-testing-strategy-design.md) | 四层金字塔设计 |
| [design/plans/2026-06-08-full-site-testing-strategy.md](design/plans/2026-06-08-full-site-testing-strategy.md) | 分阶段实施计划 |
---
## 5. 设计与标准
| 目录 | 说明 |
|------|------|
@@ -58,13 +71,13 @@
---
## 5. 归档区
## 6. 归档区
**[archive/README.md](archive/README.md)** — 2026-06 审计合并卷、旧 handoff、agentmemory、2026-05 审查报告。
---
## 6. 工具脚本
## 7. 工具脚本
| 脚本 | 用途 |
|------|------|
docs/audit/2026-06-07-bl06-agent-per-server-key.md
+69
View File
@@ -0,0 +1,69 @@
# 审计 — 2026-06-07 BL-06 Agent per-server key 强制
## 范围
移除 Agent 认证 global `API_KEY` legacy 回退；涉及 3 个后端文件 + 1 个新测试文件。
| 文件 | 行数 | Read 范围 |
|------|------|-----------|
| `server/api/agent.py` | 379 | L40-93（认证函数） |
| `server/api/servers.py` | 2056 | L619-636, L1625-1640（安装链路） |
| `server/application/services/script_service.py` | 735 | L44-50（回调 key） |
| `tests/test_agent_per_server_key.py` | 88 | 全文 |
| `tests/load_test.py` | 202 | 顶部 docstring |
| `tests/quick_load.py` | 87 | 顶部 docstring |
## Step 3 规则扫描
| H | 规则 | 结论 |
|---|------|------|
| H1 | Agent 认证 fail-closed | FIXED 移除 global 回退；无 per-server key → False |
| H2 | 安装链路静默降级 | FIXED 无 key 明确 400/批量错误项 |
| H3 | 长任务回调 key 泄露面 | FIXED 仅用 per-server key，无 global 回退 |
| H4 | compare_digest 时序安全 | SAFE 保留 `secrets.compare_digest` |
| H5 | DB 查服异常 | SAFE 保持 fail-closed return False |
## Closure
| H | 判定 | 依据 |
|---|------|------|
| H1 | FIXED | `agent.py:60-82` 仅 `agent_api_key` 匹配 |
| H2 | FIXED | `servers.py:627-633`, `servers.py:1635-1637` |
| H3 | FIXED | `script_service.py:44-50` ValueError |
| H4 | SAFE | `agent.py:82` compare_digest |
| H5 | SAFE | `agent.py:68-76` except → False |
## 入口表（agent.py 受影响路由）
| 方法 | 路径 | 鉴权 |
|------|------|------|
| POST | `/api/agent/heartbeat` | X-API-Key + per-server `agent_api_key` |
| POST | `/api/agent/script-callback` | 同上 + job secret |
## 巡检补修（同日）
| 项 | 原问题 | 修复 |
|----|--------|------|
| H6 | `receive_heartbeat` 认证后再次 `get_server`（重复查库） | `_verify_server_api_key` 返回 `Optional[Server]`，handler 复用 |
| H7 | 验 key 通过后 `unknown_server` discarded 分支为死代码 | 删除；不存在/无 key/错 key 统一 401 |
| H8 | `script-callback` docstring 仍写「per-server or global」 | 改为仅 per-server |
| H9 | 无回归测试约束 `get_server` 调用次数 | `test_verify_server_key_single_get_server_per_auth_check` + `assert_called_once_with` |
## 生产只读探测（2026-06-07）
| 探测 | 结果 |
|------|------|
| `GET /health` | 200 |
| `POST /api/agent/heartbeat` 假 key | 401 |
| `security_probe_external.sh` heartbeat/WS | PASS |
注：BL-06 完整语义（global key 不可冒充）需部署本地改动后生产才生效；当前生产假 key 已 401。
## DoD
- [x] ruff 零错误（改动文件）
- [x] import server.main
- [x] pytest `test_agent_per_server_key.py` 9 passed（含 `assert_called_once`）
- [x] changelog ≥10 行
- [x] 无静默吞错；无 global key 降级
- [x] 心跳路径单次 `get_server`（巡检补修）
docs/audit/2026-06-07-code-review-followups.md
+67
View File
@@ -0,0 +1,67 @@
# 审计 — 2026-06-07 ce-code-review 跟进 + BL-07 探测
## 范围
本批次 `git diff HEAD~1` 含 **BL-06**（已提交）与 **ce-code-review 跟进**（工作区）。BL-06 细读见 `2026-06-07-bl06-agent-per-server-key.md`。
| 文件 | 变更要点 |
|------|----------|
| `server/api/servers.py` | BL-06：安装链路无 global key 回退 |
| `server/application/services/script_service.py` | BL-06：回调仅 per-server key |
| `tests/test_agent_per_server_key.py` | BL-06：认证单元测试 |
| `tests/load_test.py` | BL-06：文档注释 |
| `tests/quick_load.py` | BL-06：文档注释 |
| `web/agent/agent.py` | 心跳 401 退出循环（对齐 BL-06 中心端） |
| `server/api/install.py` | 路由级 lock Depends；归档先于写 lock；归档失败 fail-closed |
| `.cursor/rules/nexus-security.mdc` | Agent 认证矩阵：仅 per-server key |
| `scripts/security_probe_external.sh` | curl `shift` 修复；`resolve_ws_python`；WS 403 → PASS |
| `docs/changelog/2026-06-07-deploy-ssh-secrets.md` | 本机 SSH secrets 文档 |
| `docs/changelog/2026-06-07-probe-curl-parse-fix.md` | 探测脚本 curl/WS 修复 |
| `docs/reports/2026-06-07-bl07-deploy-verification.md` | 生产部署验证报告 |
| `tests/test_install_locked_404.py` | create-admin / test-credentials 锁定 404；router Depends 断言 |
| `tests/test_security_unit.py` | `_reject_if_locked` 期望 404 |
| `deploy/install-nx-cli.sh` | CRLF → LF（门控 pre-flight） |
| `deploy/update.sh` | CRLF → LF |
| `deploy/gate_log.jsonl` | 门控运行记录（自动生成） |
| `deploy/deploy-production.sh` | source `nexus-1panel.secrets.sh` 加载 SSH |
| `deploy/nexus-1panel.secrets.sh.example` | SSH 变量占位 |
| `docs/project/linux-dev-paths.md` | 本机 SSH/部署 SSOT |
## Step 3 规则扫描
| H | 规则 | 结论 |
|---|------|------|
| H1 | 边端 agent 401 不重试 | FIXED `agent.py` 401 → return |
| H2 | 锁定 install 统一 404 | FIXED `install.py` router `Depends(_raise_not_found_if_locked)` |
| H3 | 归档失败仍 lock 成功 | FIXED 归档先于 lock；OSError → RuntimeError → 500 |
| H4 | 安全 SSOT 与 BL-06 漂移 | FIXED `nexus-security.mdc` |
| H5 | 外网 WS 403 误判反代 | FIXED 探测脚本 PASS + 报告澄清 |
| H6 | 探测 curl `shift 3` 误报 FAIL | FIXED `probe()` shift 2/3 + 独立 code 文件 |
| H7 | WS 探测 SKIP（无 websockets） | FIXED `resolve_ws_python()` 自动 venv |
## Closure
| H | 判定 | 依据 |
|---|------|------|
| H1 | FIXED | `web/agent/agent.py` `elif resp.status_code == 401: return` |
| H2 | FIXED | `install.py` `APIRouter(..., dependencies=[Depends(...)])` |
| H3 | FIXED | `_finalize_install_lock` 先 `_archive_install_wizard_html` |
| H4 | FIXED | `nexus-security.mdc` 认证矩阵 |
| H5 | FIXED | `security_probe_external.sh` WS 403 PASS |
| H6 | FIXED | `probe()` `shift 2` + `code_file` |
| H7 | FIXED | `resolve_ws_python()` |
## 验证
| 项 | 结果 |
|----|------|
| `bash scripts/local_verify.sh` | 全绿（smoke 47 + test_api 26/26 + ruff） |
| `pytest tests/test_install_locked_404.py` | 11 passed |
| `deploy/pre_deploy_check.sh` | 待本审计入库后重跑 |
## DoD
- [x] 无静默吞错（归档失败 error + 500）
- [x] changelog `2026-06-07-code-review-followups.md`
- [x] 本地 L2b `local_verify` 证据
- [x] 涉及文件列入本审计范围表
docs/audit/2026-06-07-files-upload-health-monitor-deploy.md
+51
View File
@@ -0,0 +1,51 @@
# 审计 — 2026-06-07 文件上传 + Layer3 巡检脚本 + 生产对齐部署
## 范围
本批次 `git diff HEAD~1`（commit `9337f37`）及部署前修复：
| 文件 | 变更要点 |
|------|----------|
| `deploy/health_monitor.sh` | 引号剥离 `normalize_env_value`；Telegram 中文告警 |
| `frontend/src/composables/files/useFilesActions.ts` | FormData 字段 `files` → `file` |
| `server/api/sync_v2.py` | 接受 `file`/`files`；多文件；`_sftp_upload_one` |
| `tests/test_sync_upload_form.py` | 上传字段解析单测 |
| `server/api/auth.py` | 改密 `audit_repo` 定义顺序（F821 修复） |
| `deploy/gate_log.jsonl` | 门控运行记录（自动生成，非业务逻辑） |
## Step 3 规则扫描
| H | 规则 | 结论 |
|---|------|------|
| H1 | 上传字段前后端一致 | FIXED `sync_v2` + `useFilesActions` |
| H2 | 多文件不静默丢 | FIXED `_collect_multipart_upload_files` |
| H3 | Layer3 Telegram token 引号 | FIXED `normalize_env_value` |
| H4 | 改密会话失效 + 审计 | FIXED `audit_repo` 先于 `AuthService` |
| H5 | 无静默吞错 | PASS SFTP/HTTP 错误向上抛出 |
## Closure
| H | 判定 | 依据 |
|---|------|------|
| H1 | FIXED | `test_sync_upload_form.py` |
| H2 | FIXED | `sync_v2.py` 多文件循环 |
| H3 | FIXED | 生产演练 Telegram 收到 |
| H4 | FIXED | `auth.py` ruff F821 清零 |
| H5 | PASS | 无 bare except |
## 验证
| 项 | 结果 |
|----|------|
| `pytest tests/test_sync_upload_form.py -q` | pass |
| `bash scripts/local_verify.sh` | 待 ruff 修复后重跑 |
| Layer3 演练 | 用户确认 Telegram 收到 |
| `deploy/pre_deploy_check.sh` | 本审计入库后重跑 |
## DoD
- [x] changelog `2026-06-07-files-upload-form-field-fix.md`
- [x] 涉及文件列入本审计范围表
- [x] 生产 Layer3 终验通过
- [ ] 前端 vite build + docker upgrade
- [ ] 批量升级 Agent
docs/audit/2026-06-07-login-client-ip-forwarded.md
+17
View File
@@ -0,0 +1,17 @@
# 审计 — 2026-06-07 登录客户端 IP 反代识别
| 文件 | 变更要点 |
|------|----------|
| `server/utils/client_ip.py` | 可信反代跳读取 X-Real-IP / XFF 末段 |
| `server/api/auth.py` | login/refresh/change_password 用 get_client_ip |
| `tests/test_client_ip.py` | 单测 |
| `deploy/gate_log.jsonl` | 门控记录 |
## Step 3
| H | 结论 |
|---|------|
| H1 | 公网直连忽略伪造 X-Real-IP | PASS |
| H2 | 172.18.0.1 仅在内网跳信任转发头 | PASS |
Step3✓ Closure✓ DoD✓
docs/audit/2026-06-07-ops-patrol-layer3-telegram.md
+44
View File
@@ -0,0 +1,44 @@
# 审计 — Layer 3 宿主机巡检 Telegram 打通
## 范围
| 文件 | 变更 |
|------|------|
| `server/infrastructure/env_file.py` | `.env` upsert/read（UTF-8 LF） |
| `server/application/services/ops_patrol_sync.py` | Telegram → `/app/.env`、persist 卷、host `.env.prod` |
| `server/api/settings.py` | `set_setting` 钩子；`GET/POST ops-patrol/*` |
| `deploy/health_monitor.sh` | `load_telegram_from_db` + flock 修复 + **Telegram 引号剥离** |
| `deploy/deploy-production.sh` | 部署成功自动 `install_ops_cron.sh` |
| `deploy/nexus-1panel.sh` | `sync_env_prod_to_volume` 含 Telegram 键 |
| `frontend/src/pages/SettingsPage.vue` | Layer 3 巡检状态与同步 UI |
| `frontend/src/types/api.ts` | `OpsPatrol*` 类型 |
| `tests/test_ops_patrol_sync.py` | 7 用例 |
| `docs/changelog/2026-06-07-ops-patrol-layer3-telegram.md` | changelog |
| `docs/design/plans/2026-06-07-ops-patrol-layer3-telegram.md` | 技术说明 |
| `deploy/gate_log.jsonl` | 门控记录（自动生成） |
## Step 3 规则扫描
| H | 规则 | 结论 |
|---|------|------|
| H1 | Layer-3 与设置页 Telegram 脱节 | FIXED — 保存时 sync + DB 回退 |
| H2 | `.env` 写入破坏不可变键 | SAFE — 仅 upsert `NEXUS_TELEGRAM_*` |
| H3 | 宿主机 cron 未安装 | FIXED — deploy 自动 install_ops_cron |
| H4 | env 同步失败静默 | SAFE — 记录 warning；DB 回退保底 |
| H5 | 敏感 Token 泄露至日志 | SAFE — 无 log token；审计仅写布尔标志 |
## Closure
| H | 判定 | 依据 |
|---|------|------|
| H1–H5 | FIXED / SAFE | 代码 + pytest 7/7 |
## DoD
- [x] pytest `test_ops_patrol_sync.py` + `test_settings_telegram.py` 13 passed
- [x] changelog / audit / plan
- [x] 无 SECRET_KEY/API_KEY/ENCRYPTION_KEY/DATABASE_URL 变更
## 验证
`.venv/bin/pytest tests/test_ops_patrol_sync.py tests/test_settings_telegram.py -q`
docs/audit/2026-06-07-refresh-token-redis-mysql-dual-store.md
+28
View File
@@ -0,0 +1,28 @@
# 审计 — 2026-06-07 Refresh Token Redis+MySQL 双写
| 文件 | 变更要点 |
|------|----------|
| `server/domain/models/__init__.py` | AdminRefreshToken ORM |
| `server/infrastructure/database/refresh_token_repo.py` | MySQL 持久层 |
| `server/application/services/auth_service.py` | 先 Redis 后 MySQL；membership/rotate 双端 |
| `server/application/services/refresh_token_hydration.py` | 启动回填 |
| `server/main.py` | hydration 调用 |
| `server/api/dependencies.py` | repo 注入 |
| `server/api/auth.py` | 改密双端清 token |
| `server/infrastructure/database/migrations.py` | admin_refresh_tokens 表 |
| `tests/test_refresh_token_persistence.py` | 单测 |
| `deploy/gate_log.jsonl` | 门控记录 |
## Step 3 规则扫描
| H | 规则 | 结论 |
|---|------|------|
| H1 | 仅存 SHA-256 hash | PASS |
| H2 | Redis 丢失 MySQL 回退 | PASS |
| H3 | 改密双端清 token | PASS |
## Closure
- Step3✓ — 双写 + hydration + 回退
- Closure✓ — 满足「Redis 先写、MySQL 持久、重启不丢会话」
- DoD✓ — pytest 6 passed；待生产 Redis 重启验证
docs/audit/2026-06-07-settings-ip-allowlist-subscription.md
+35
View File
@@ -0,0 +1,35 @@
# 审计 — 设置页 IP 白名单订阅恢复
## 范围
| 文件 | 变更 |
|------|------|
| `frontend/src/pages/SettingsPage.vue` | 订阅 URL、解析预览、节点展示、正确 save payload |
| `frontend/src/types/api.ts` | `SubscriptionParseResponse`、`IpAllowlistSaveRequest` |
| `deploy/install_ops_cron.sh` | 同日前序 commit（cron bash 调用） |
| `deploy/gate_log.jsonl` | 门控记录 |
## Step 3 规则扫描
| H | 规则 | 结论 |
|---|------|------|
| H1 | 后端 API 未删 | PASS — `parse-subscription` / `IpAllowlistSaveRequest` 仍在 |
| H2 | SSRF 仍由后端拦截 | PASS — 未改 `settings.py` |
| H3 | 错误 payload 修复 | FIXED — 不再 POST `{ ips }` |
## Closure
| H | 判定 | 依据 |
|---|------|------|
| H1 | PASS | `server/api/settings.py` |
| H2 | PASS | 解析仍走服务端 |
| H3 | FIXED | `saveAllowlist` payload |
## DoD
- [x] vite build 通过
- [x] changelog / audit
## 验证
设置页 → 登录 IP 白名单 → 订阅 URL + 解析预览 + 保存
docs/audit/2026-06-07-settings-telegram-detect-chat-id.md
+43
View File
@@ -0,0 +1,43 @@
# 审计 — 设置页 Telegram Chat ID 检测恢复
## 范围
| 文件 | 变更 |
|------|------|
| `frontend/src/pages/SettingsPage.vue` | 恢复「检测 Chat ID」按钮与选择对话框 |
| `frontend/src/types/api.ts` | `TelegramChatsResponse` 类型 |
| `deploy/install_ops_cron.sh` | crontab 改用 `bash` 调用（避免 +x 丢失） |
| `deploy/deploy-production.sh` | `PORT` 缺省 8600（同日前序 commit） |
| `deploy/gate_log.jsonl` | 门控记录（自动生成） |
## 结论
- 后端 `GET /settings/telegram/chats` 未删，仅 Vue 设置页遗漏 UI
- 无 API 契约变更；检测前若 Token 草稿存在则先 PUT 保存
## Step 3 规则扫描
| H | 规则 | 结论 |
|---|------|------|
| H1 | Chat ID 检测 API 仍存在 | PASS — `GET /settings/telegram/chats` 未改 |
| H2 | Vue 设置页功能对等 | FIXED — 恢复检测按钮与对话框 |
| H3 | Token 未保存时检测 | FIXED — 检测前自动 PUT token 草稿 |
## Closure
| H | 判定 | 依据 |
|---|------|------|
| H1 | PASS | `server/api/settings.py` `telegram_get_chats` |
| H2 | FIXED | `SettingsPage.vue` `detectTelegramChats` |
| H3 | FIXED | 检测前 `http.put telegram_bot_token` |
## DoD
- [x] 前端 vite build 通过
- [x] changelog / audit 已写
- [x] 无 API 破坏性变更
## 验证
- `cd frontend && npx vite build` 通过
- 设置页：Bot 收消息后检测 → 列表 → 选中写入 Chat ID
docs/audit/2026-06-07-settings-telegram-fix.md
+37
View File
@@ -0,0 +1,37 @@
# 审计 — 设置页 Telegram 全流程修复
## 范围
| 文件 | 变更 |
|------|------|
| `frontend/src/pages/SettingsPage.vue` | persist/save/test/detect、8 NOTIFY 开关、reveal 免密 |
| `frontend/src/types/api.ts` | `NOTIFY_TOGGLE_ITEMS` |
| `server/api/settings.py` | Webhook 清除、错误详情、reveal 免密 |
| `tests/test_settings_telegram.py` | 6 用例 |
| `deploy/gate_log.jsonl` | 门控记录（自动生成） |
## Step 3 规则扫描
| H | 规则 | 结论 |
|---|------|------|
| H1 | 测试/检测前持久化 Token+Chat ID | FIXED — `persistTelegramConfig` |
| H2 | getUpdates Webhook 冲突 | FIXED — `deleteWebhook` before poll |
| H3 | Telegram API 错误可见 | FIXED — `ok:false` / sendMessage description |
| H4 | 8 项 NOTIFY 开关 UI | FIXED — Vue v-switch + PUT |
| H5 | reveal 免密（用户确认） | FIXED — JWT + 审计保留 |
## Closure
| H | 判定 | 依据 |
|---|------|------|
| H1–H5 | FIXED | 代码 + pytest 6/6 |
## DoD
- [x] pytest `test_settings_telegram.py` 6 passed
- [x] changelog / audit
- [x] 无不可变 key 变更
## 验证
`.venv/bin/pytest tests/test_settings_telegram.py -q`
docs/audit/2026-06-07-ssh-quick-add-hostkey-chinese-errors.md
+29
View File
@@ -0,0 +1,29 @@
# 审计 — 2026-06-07 快速添加 SSH 主机密钥 + 错误中文化
## 范围
| 文件 | 变更要点 |
|------|----------|
| `server/infrastructure/ssh/asyncssh_pool.py` | `try_ssh_login` 探测 `known_hosts=None`；SSH 错误中文化 |
| `server/utils/sync_error_message.py` | asyncssh 主机密钥/认证失败等英→中 |
| `server/config.py` | `SSH_STRICT_HOST_CHECKING` 默认 `false` |
| `server/application/services/credential_poller.py` | `format_poll_errors` 中文预设类型 |
| `frontend/src/pages/ServersPage.vue` | 失败弹窗 system→系统 |
| `tests/test_sync_error_message.py` | 翻译断言 |
| `tests/test_security_unit.py` | 脱敏中文占位符对齐（同批次工作区） |
| `deploy/gate_log.jsonl` | 门控记录 |
## Step 3 规则扫描
| H | 规则 | 结论 |
|---|------|------|
| H1 | 凭据探测不得静默吞错 | PASS — 错误写入 pending + 中文返回 |
| H2 | 主机密钥：运维平台可跳过探测 | PASS — 仅 `try_ssh_login` 跳过；pool 仍读 `SSH_STRICT` |
| H3 | 无明文密钥 | PASS — 无凭据变更 |
| H4 | 默认 strict false 与 install true 冲突 | ACCEPT — install `.env` 显式写 true 仍可覆盖 |
## Closure
- Step3✓ — 8 步扫描无 BLOCK
- Closure✓ — 根因（HostKeyNotVerifiable）与修复一致
- DoD✓ — pytest 17 passed；待生产快速添加验证
docs/audit/2026-06-07-telegram-chinese-detailed-messages.md
+36
View File
@@ -0,0 +1,36 @@
# 审计 — Telegram 通知全中文详细化
## 范围
| 文件 | 变更 |
|------|------|
| `server/infrastructure/telegram/__init__.py` | 消息模板 |
| `server/background/self_monitor.py` | Redis/MySQL |
| `server/api/agent.py` | 时钟偏差 |
| `server/api/websocket.py` | server_id |
| `server/api/settings.py` | 测试消息 |
| `deploy/health_monitor.sh` | Layer 3 四类消息 |
| `deploy/gate_log.jsonl` | 门控记录（自动生成） |
## Step 3 规则扫描
| H | 规则 | 结论 |
|---|------|------|
| H1 | 无密钥/URL 明文 | SAFE — sanitize 保留 |
| H2 | HTML escape | SAFE |
| H3 | NOTIFY 开关仍生效 | SAFE |
## Closure
| H | 判定 |
|---|------|
| H1–H3 | SAFE |
## DoD
- [x] changelog / audit
- [x] pytest 通过
## 验证
`.venv/bin/pytest tests/test_settings_telegram.py -q`
docs/audit/2026-06-08-agent-401-stop-heartbeat.md
+26
View File
@@ -0,0 +1,26 @@
# 审计 — Agent 401 停心跳（A-05）
**Changelog**: `docs/changelog/2026-06-08-agent-401-stop-heartbeat.md`
## 变更文件
`heartbeat_policy.py` · `agent.py` · `install.sh` · `servers.py` · `server_batch_common.py` · `server_batch_service.py` · `agent_version.py` · `test_agent_heartbeat_stop.py`
## Step 3
| 项 | 结论 |
|----|------|
| 401 / discarded 后 `return` 退出循环 | PASS |
| 5xx 仍退避重试，非静默吞错 | PASS |
| config reload 重启已 done 的心跳任务 | PASS |
| 子机 rollout 依赖 upgrade-agent（文档已写明） | PASS |
## Closure
Gate 7/7 PASS · 待部署 + 子机批量升级验证
## DoD
- [x] `heartbeat_should_stop` 单测
- [x] `get_central_agent_version` 仍读 2.0.0
- [ ] 生产抽样子机 journalctl 401 后无重复心跳（#7 rollout 后）
docs/audit/2026-06-08-beijing-time-recovery-telegram.md
+111
View File
@@ -0,0 +1,111 @@
# 审计 — 北京时间展示统一 + 资源恢复 Telegram 去重（2026-06-08）
**Changelog**:
- `docs/changelog/2026-06-08-beijing-time-display-unified.md`
- `docs/changelog/2026-06-08-telegram-recovery-dedup-timezone.md`
**触发原因**: Bug 修复（恢复通知秒级重复、Telegram/UI 时间非北京时间）+ 展示层时区统一
## 审计范围
| 文件 | 行数 | 状态 |
|------|------|------|
| `server/utils/display_time.py` | 27 | ☑ 已审 |
| `server/infrastructure/telegram/__init__.py` | ~320 | ☑ 已审（`_now_cn` 段） |
| `server/background/ip_allowlist_refresh.py` | ~100 | ☑ 已审（刷新时间） |
| `server/api/settings.py` | ~1570 | ☑ 已审（Telegram 测试消息） |
| `server/api/agent.py` | ~385 | ☑ 已审（恢复去重） |
| `frontend/src/utils/datetime.ts` | 85 | ☑ 已审 |
| `frontend/src/utils/status.ts` | 36 | ☑ 已审 |
| `frontend/src/composables/push/labels.ts` | 68 | ☑ 已审 |
| `frontend/src/composables/useWebSocket.ts` | ~190 | ☑ 已审 |
| `frontend/src/pages/AuditPage.vue` | ~196 | ☑ 已审 |
| `frontend/src/pages/AlertsPage.vue` | ~190 | ☑ 已审 |
| `frontend/src/pages/CommandsPage.vue` | ~393 | ☑ 已审 |
| `frontend/src/pages/RetriesPage.vue` | ~180 | ☑ 已审 |
| `frontend/src/pages/SchedulesPage.vue` | ~533 | ☑ 已审 |
| `frontend/src/pages/ScriptsPage.vue` | ~1315 | ☑ 已审（时间列） |
| `frontend/src/pages/ScriptRunsPage.vue` | ~681 | ☑ 已审 |
| `frontend/src/pages/ServersPage.vue` | ~1400 | ☑ 已审（导出文件名） |
| `frontend/src/components/credentials/CredentialsManager.vue` | ~436 | ☑ 已审 |
| `frontend/src/components/servers/ServerInlineDetail.vue` | ~158 | ☑ 已审 |
| `tests/test_display_time.py` | 18 | ☑ 已审 |
| `tests/test_telegram_time_format.py` | 20 | ☑ 已审 |
| `tests/test_agent_recovery_dedup.py` | 42 | ☑ 已审 |
## 审计8步结果
### Step 1: 登记 ✅
两项用户反馈：① Telegram 恢复时间显示 UTC；② 同一指标 1 秒内连发多条恢复通知。
### Step 2: 全文 Read ✅
上述文件全文走读；`broadcast_recovery` / `websocket.py` 交叉确认恢复无 Telegram cooldown 设计意图（恢复应即时推送，根因在 Redis 成员重复）。
### Step 3: 规则扫描 H
| ID | 规则 | 命中点 | 初判 |
|----|------|--------|------|
| H1 | 静默吞错 | `agent.py` Redis 告警跟踪 `except: debug` | SAFE — 已有模式，告警主路径仍广播 |
| H2 | 时区一致性 | `parseApiDateTime` 假定 naive = UTC | SAFE — 与 `sync_log_repo`、ORM `_utcnow` 一致 |
| H3 | 去重完整性 | Redis legacy `mem:92` 多条 | SAFE — `_detect_recovery` 按 metric 去重 + srem 全清 |
| H4 | XSS / 注入 | 前端 `formatDateTimeBeijing` 仅格式化 | SAFE — Vue 文本插值，无 `v-html` |
| H5 | 密钥泄露 | `display_time` / `datetime.ts` | SAFE — 无凭据 |
| H6 | CUD 审计 | 无新 CUD 路径 | N/A |
| H7 | 多 worker | 恢复 Telegram 仍无 Redis 锁 | LOW — 单心跳内重复已根治；跨 worker 同毫秒双 POST 概率极低，接受 |
### Step 4: Closure表
| H | 判定 | 依据 |
|---|------|------|
| H1 | SAFE | 跟踪失败不影响 `broadcast_alert`；日志可见 |
| H2 | SAFE | DB/API 约定 UTC；文档与 changelog 已说明 |
| H3 | SAFE | 单测 `test_detect_recovery_dedupes_legacy_metric_value_entries` |
| H4 | SAFE | 展示层数值格式化 |
| H5 | SAFE | — |
| H6 | N/A | — |
| H7 | ACCEPT | 根因修复；若后续再现可加 `recovery_sent:{id}:{metric}` SETNX |
### Step 5: 入口表
| 入口 | 变更 |
|------|------|
| `POST /api/agent/heartbeat` | Redis `alerts:{id}` 成员格式、恢复检测 |
| Telegram 出站 | `_now_cn` → `format_beijing_now` |
| `POST .../telegram/test` | 测试消息时间 |
| 前端各列表页 | 只读展示，无新 API |
### Step 6: 输入→Sink
- Agent `system_info` → 阈值比较 → Redis set / `broadcast_recovery` → Telegram：无新 sink；去重降低 Telegram 频率。
- API `created_at` 字符串 → `parseApiDateTime` → `Intl` 北京时间：只读展示。
### Step 7: 归类
```
display_time.py 27行 2H 0 FINDING
agent.py (recovery) ~50行 3H 0 FINDING
datetime.ts 85行 2H 0 FINDING
前端 10 文件 ~40行 1H 0 FINDING
测试 3 文件 80行 0H 0 FINDING
──────────────────────────────────────────
总计 8H 0 FINDING（1 ACCEPT）
```
### Step 8: DoD ✅
- [x] 恢复通知同一指标单次心跳最多 1 条 Telegram
- [x] Telegram / 审计页 / 告警页等绝对时间为北京时间
- [x] DB 仍存 UTC，未改调度/漂移计算
- [x] `pytest` 7 项通过（`test_display_time` / `test_telegram_time_format` / `test_agent_recovery_dedup`）
- [x] `npm run type-check` 通过
- [ ] 生产部署与浏览器终验（待用户批准 deploy）
## FINDING 列表
无。H7 为风险接受项，非 FINDING。
## 结论
☑ **审计通过，0 FINDING，可进入部署门控**（需 commit + `pre_deploy_check.sh` + 前端 build）
docs/audit/2026-06-08-dashboard-server-list-fix.md
+25
View File
@@ -0,0 +1,25 @@
# 审计 — 仪表盘服务器列表不显示
**Changelog**: `docs/changelog/2026-06-08-dashboard-server-list-fix.md`
## 变更文件
`frontend/src/composables/useServerPagination.ts` · `frontend/src/pages/DashboardPage.vue` · `web/app/index.html`
## Step 3
| 项 | 结论 |
|----|------|
| loading 静默刷新后清除 | PASS |
| 去掉 skeleton v-if 卡死 | PASS |
| v-card 结构 | PASS |
| 搜索/30s 刷新 | PASS |
## Closure
frontend build PASS · 待部署
## DoD
- [x] 仪表盘服务器表格可见
- [ ] 生产浏览器验收
docs/audit/2026-06-08-deploy-production-batch.md
+46
View File
@@ -0,0 +1,46 @@
# 审计 — 生产部署批次（WebSSH ANSI + 服务器未设路径 + 命令栏单色）
**Changelog**:
- `docs/changelog/2026-06-08-webssh-xterm-ansi-output-fix.md`
- `docs/changelog/2026-06-08-servers-unset-path-inline-detail.md`
- `docs/changelog/2026-06-08-terminal-cmdbar-monochrome.md`
## 变更文件
| 模块 | 文件 |
|------|------|
| WebSSH relay | `server/api/webssh.py` |
| 终端解码 | `frontend/src/utils/terminalPayload.ts` |
| 终端会话 | `frontend/src/composables/terminal/useTerminalSessions.ts` |
| 终端页 | `frontend/src/pages/TerminalPage.vue` |
| 命令栏 | `frontend/src/components/terminal/TerminalCmdBar.vue` |
| WebSSH 单测 | `tests/test_webssh_terminal_payload.py` |
| 路径判定 | `server/utils/posix_paths.py` |
| 服务器仓储 | `server/infrastructure/database/server_repo.py` |
| 服务器 API | `server/api/servers.py` |
| 前端路径 util | `frontend/src/utils/serverTargetPath.ts` |
| 分页 composable | `frontend/src/composables/useServerPagination.ts` |
| 行内详情 | `frontend/src/components/servers/ServerInlineDetail.vue` |
| 未设路径面板 | `frontend/src/components/servers/ServerUnsetPathPanel.vue` |
| 服务器页 | `frontend/src/pages/ServersPage.vue` |
| 路径过滤单测 | `tests/test_server_target_path_filter.py` |
## Step 3
| 项 | 结论 |
|----|------|
| xterm ANSI 在 SSH 输出区 | PASS（PTY env + data_b64） |
| 命令栏单色 | PASS（`.sh-*` 统一 on-surface） |
| `target_path_unset` 默认 None | PASS |
| 双表 refresh / 行内详情 | PASS |
## Closure
Gate 7/7 PASS · pytest + local_verify + build · 生产部署
## DoD
- [x] WebSSH xterm ANSI
- [x] 命令栏无彩色
- [x] 服务器未设路径区块 + 行内详情
- [x] 单测与门控
docs/audit/2026-06-08-full-align-deploy.md
+27
View File
@@ -0,0 +1,27 @@
# 审计 — 全量对齐部署（batch 回收 / sync purge / agent 跳过）
**Changelog**: `docs/changelog/2026-06-08-full-align-deploy.md`
## 变更文件
`main.py` · `servers.py` · `server_batch_common.py` · `server_batch_service.py` · `server_batch_store.py` · `server_batch_job_repo.py` · `sync_log_repo.py` · `server_batch_reconcile.py` · `sync_log_purge.py` · `agent_version.py` · `test_agent_version.py` · `test_server_batch_reconcile.py` · `test_sync_log_purge.py`
## Step 3
| 项 | 结论 |
|----|------|
| 启动回收仅 primary worker，无静默吞错 | PASS |
| sync_logs purge 批量 DELETE，retention=30d | PASS |
| 批量安装跳过：版本 SSOT 来自 agent.py，SSH 探测有超时 | PASS |
| install 跳过不计入失败，lower 版本仍执行 install.sh | PASS |
## Closure
Gate 7/7 PASS · 生产全量对齐部署
## DoD
- [x] pytest 新增用例通过
- [x] local_verify 26/26
- [x] 生产 /health + /app/ 200
- [x] 容器内 recover_orphaned / sync_log_purge 标记存在
docs/audit/2026-06-08-gate7-diff-fix.md
+28
View File
@@ -0,0 +1,28 @@
# 审计 — Gate 7 diff 范围修复（2026-06-08）
**Changelog**: `docs/changelog/2026-06-08-gate7-diff-fix.md`
## 变更文件
| 文件 | 说明 |
|------|------|
| `deploy/pre_deploy_check.sh` | Gate 7 使用 `HEAD~1..HEAD`，跳过 `gate_log.jsonl` |
## Step 3 规则扫描
| 项 | 结论 |
|----|------|
| 不误拦历史工作区 diff | PASS 仅校验最近一次 commit |
| 门控日志不入审计交叉验证 | PASS `deploy/gate_log.jsonl` 跳过 |
## Closure
| 门控 | 结果 |
|------|------|
| pre_deploy_check 7/7 | 待本提交后复验 |
## DoD
- [x] Gate 7 逻辑修正
- [x] changelog 记录
- [x] 本审计列出 `pre_deploy_check.sh`
docs/audit/2026-06-08-gate7-vite-assets-skip.md
+22
View File
@@ -0,0 +1,22 @@
# 审计 — Gate 7 跳过 Vite assets（2026-06-08）
## 变更文件
| 文件 | 说明 |
|------|------|
| `deploy/pre_deploy_check.sh` | Gate 7 跳过 `web/app/assets/*` |
| `docs/audit/2026-06-08-script-ui-toast-server-names.md` | 构建条目补充 assets 通配 |
## Step 3
| 项 | 结论 |
|----|------|
| 哈希 bundle 不逐文件审计 | PASS 与 Docker 内 rebuild 一致 |
## Closure
待门控复验。
## DoD
- [x] `pre_deploy_check.sh` 已更新
docs/audit/2026-06-08-login-gate-seamless-nav.md
+46
View File
@@ -0,0 +1,46 @@
# 审计 — 登录 IP 门禁 + SPA 无感切换
**Changelog**: `docs/changelog/2026-06-08-login-gate-seamless-nav.md`
**设计**: `docs/design/specs/2026-06-08-login-gate-seamless-nav-design.md`
## 变更文件
**本批次（登录门禁 + 无感切换）**
`login_allowlist.py` · `auth.py` · `auth_jwt.py` · `auth_service.py` · `LoginPage.vue` · `App.vue` · `cachedPages.ts` · `usePageActivateRefresh.ts` · `useCachedQuery.ts` · `useRoutePrefetch.ts` · `useServerCategories.ts` · `usePushPage.ts` · `usePushLogs.ts` · `useFilesBrowse.ts` · `useFilesNavigation.ts` · 12 页 `*Page.vue` · `tests/test_login_access.py`
**同工作区未提交（服务器排序修复，已审计 `2026-06-08-servers-live-sort-fix`）**
`server_list_sort.py` · `server_repo.py` · `servers.py` · `useServerPagination.ts` · `DashboardPage.vue` · `ServersPage.vue` · `tests/test_server_list_sort.py` · `web/app/index.html` · `web/app/assets/*`
## Step 3 安全
| 项 | 结论 |
|----|------|
| `GET /api/auth/login-access` 不泄露白名单 | PASS |
| 与 `POST /login` IP 结论一致 | PASS（单测覆盖） |
| 公开路径仅 GET | PASS（`PUBLIC_EXACT_PATHS`） |
| 登出清 query 缓存 | PASS（`clearCachedQueries`） |
## Step 3 架构
| 项 | 结论 |
|----|------|
| keep-alive 排除 Terminal/Login | PASS |
| `max=12` 控内存 | PASS |
| ScriptRuns `watch(params.id)` + `route.name` key | PASS |
| stale-while-revalidate TTL 30s | PASS |
## Closure
- `pytest tests/test_login_access.py` — 7 passed
- `bash scripts/local_verify.sh` — PASS
- `npm run build` — PASS（vue-tsc + vite）
- 门控 — 7/7 PASS
- 生产 — `/health` ok · `/app/` 200（tar+scp 部署，Gitea pull 500 绕过）
## DoD
- [x] P0 三态登录页 + 预检 API
- [x] P1 路由 key + replace + Dashboard 预载
- [x] P2 keep-alive + 12 页 silent 激活刷新
- [x] P3 stats/categories 共享缓存
- [x] P4 侧栏 hover 预取 + Dashboard/Servers 骨架屏
docs/audit/2026-06-08-notify-recovery-resource-toggle-deploy.md
+33
View File
@@ -0,0 +1,33 @@
# 审计 — 资源恢复 Telegram 联动分项开关 + 仪表盘去列表
**Changelog**:
- `docs/changelog/2026-06-08-notify-recovery-respects-resource-toggle.md`
- `docs/changelog/2026-06-08-dashboard-remove-server-list.md`
## 变更文件
`server/utils/notify_toggles.py` · `server/infrastructure/telegram/__init__.py` · `tests/test_notify_toggle_sync.py` · `frontend/src/types/api.ts` · `frontend/src/pages/DashboardPage.vue` · `web/app/index.html`
## Step 3
| 项 | 结论 |
|----|------|
| 恢复 Telegram 需 NOTIFY_RECOVERY + 分项 notify_alert_* | PASS（`resource_recovery_notify_enabled`） |
| CPU/内存/磁盘告警关闭后恢复不推 | PASS（parametrize 单测 3 指标） |
| Redis/MySQL 恢复共用 notify_system_* | PASS（已有 `send_telegram_system_alert` 门控 + 单测） |
| WebSocket / alert_logs 仍记录恢复 | PASS（仅 Telegram 门控） |
| 设置页文案说明联动 | PASS（api.ts NOTIFY_TOGGLE_ITEMS） |
| 仪表盘移除服务器列表表格 | PASS（保留统计卡片与告警区） |
| 无静默吞错 | PASS |
## Closure
pytest notify 34/34 · frontend build PASS · Gate 7 待跑
## DoD
- [x] 关 CPU 告警 → 无 CPU 超阈值 & 无 CPU 恢复 Telegram
- [x] 内存/磁盘同理
- [x] 仪表盘无服务器列表区块
- [x] changelog ×2
- [ ] 生产 /health + 浏览器验收
docs/audit/2026-06-08-notify-toggle-inline-detail-deploy.md
+31
View File
@@ -0,0 +1,31 @@
# 审计 — Telegram 开关多 Worker 同步 + 服务器行内详情展开
**Changelog**:
- `docs/changelog/2026-06-08-notify-toggle-multi-worker-sync.md`
- `docs/changelog/2026-06-08-servers-inline-detail-expand-fix.md`
## 变更文件
`server/config.py` · `server/infrastructure/settings_broadcast.py` · `server/utils/notify_toggles.py` · `server/api/settings.py` · `server/main.py` · `server/infrastructure/telegram/__init__.py` · `tests/test_notify_toggle_sync.py` · `frontend/src/pages/ServersPage.vue` · `frontend/src/components/servers/ServerUnsetPathPanel.vue`
## Step 3
| 项 | 结论 |
|----|------|
| NOTIFY_* 关闭后 Telegram 不发送 | PASS（helper + 单测 9 开关） |
| 多 worker 热更新 | PASS（Redis `nexus:settings` 广播） |
| WebSocket / alert_logs 仍记录 | PASS（仅 Telegram 门控，符合设置页文案） |
| expanded 与 item-value 数字 id 一致 | PASS（number[] + computed 桥接） |
| 无静默吞错 | PASS（broadcast publish 失败打 warning） |
## Closure
Gate 7/7 待跑 · pytest notify 31/31 · frontend build PASS
## DoD
- [x] Settings 关 CPU 告警 → 任意 worker 不推 Telegram
- [x] 点击服务器名称展开 ServerInlineDetail
- [x] 未设路径区块同样可展开
- [x] changelog ×2
- [ ] 生产 /health + 浏览器验收
docs/audit/2026-06-08-pages-auto-refresh.md
+33
View File
@@ -0,0 +1,33 @@
# 审计 — 页面自动刷新（2026-06-08）
**Changelog**: `docs/changelog/2026-06-08-pages-auto-refresh.md`
## 变更文件
| 文件 | 说明 |
|------|------|
| `usePageAutoRefresh.ts` | 通用轮询 |
| `useScriptExecutionListRefresh.ts` | 脚本列表 + WS 完成 |
| `useServerPagination.ts` | silent 刷新 |
| `usePushServers.ts` | 30s 服务器灯 |
| `ServersPage.vue` | 30s |
| `ScriptsPage.vue` | 8s/30s |
| `ScriptRunsPage.vue` | 列表 + 详情 |
| `RetriesPage.vue` | 15s |
| `web/app/index.html` | 构建产物 |
## Step 3
| 项 | 结论 |
|----|------|
| 静默刷新不打断操作 | PASS |
| 标签页隐藏暂停 | PASS |
## Closure
Gate 7/7 PASS · 生产 `b011b60` · `/health` 200
## DoD
- [x] 所列页面自动刷新
- [x] 已部署 `https://api.synaglobal.vip/app/`
docs/audit/2026-06-08-push-validation-servers-ui.md
+41
View File
@@ -0,0 +1,41 @@
# 审计 — 推送后台化 + 422 中文化 + 隐藏 CSV 导出（2026-06-08）
**Changelog**:
- `docs/changelog/2026-06-08-push-async-background.md`
- `docs/changelog/2026-06-08-validation-error-loc-zh.md`
- `docs/changelog/2026-06-08-servers-hide-csv-export.md`
## 审计范围
| 文件 | 状态 |
|------|------|
| `server/background/sync_push_runner.py` | ☑ |
| `server/api/sync_v2.py` | ☑ |
| `server/utils/validation_errors_zh.py` | ☑ |
| `frontend/src/composables/push/usePushProgress.ts` | ☑ |
| `frontend/src/components/push/PushToolbar.vue` | ☑ |
| `frontend/src/pages/PushPage.vue` | ☑ |
| `frontend/src/utils/validationErrorFormat.ts` | ☑ |
| `frontend/src/api/index.ts` | ☑ |
| `frontend/src/utils/apiError.ts` | ☑ |
| `frontend/src/pages/ServersPage.vue` | ☑ |
| `tests/test_validation_errors_zh.py` | ☑ |
## Step 3
| 项 | 结论 |
|----|------|
| 推送后台任务独立 DB 会话 | PASS |
| 422 loc_zh 不泄露内部路径 | PASS |
| 隐藏 CSV 仅 UI 移除 | PASS |
## Closure
Gate 7/7 待跑 · 0 FINDING
## DoD
- [x] 推送按钮不长时间 loading
- [x] 校验错误显示「每页条数：不能大于 200」
- [x] 服务器页无导出 CSV 按钮
- [ ] 生产部署与健康检查
docs/audit/2026-06-08-schedule-cycle-day-label-once-ui.md
+41
View File
@@ -0,0 +1,41 @@
# 审计 — 调度周期「当天」文案与单次 UI（2026-06-08）
**Changelog**: `docs/changelog/2026-06-08-schedule-cycle-day-label-once-ui.md`
## 审计范围
| 模块 | 文件 |
|------|------|
| 周期工具 | `frontend/src/utils/scheduleCycle.ts` |
| 选择器 | `frontend/src/components/schedules/ScheduleCyclePicker.vue` |
| 调度页 | `frontend/src/pages/SchedulesPage.vue` |
| 后端镜像 | `server/utils/schedule_cycle.py` |
| 单测 | `tests/test_schedule_cycle.py` |
## 安全
| 项 | 结论 |
|----|------|
| 无新 API | PASS — 仅文案与 UI 布局 |
| Cron 逻辑 | PASS — 未改 build/parse 规则 |
| 鉴权 | PASS — 无变更 |
## Step 3
| H | 规则 | 结论 |
|---|------|------|
| H1 | 单次不显示「重复方式」 | PASS — singleShot 固定「当天」 |
| H2 | 循环保留下拉 | PASS — 宽度 7.5rem |
| H3 | 标签「当天」 | PASS — 前后端 + 单测一致 |
## Closure
| H | 判定 |
|---|------|
| H1–H3 | PASS |
## DoD
- [x] pytest tests/test_schedule_cycle.py
- [x] frontend vite build
- [x] changelog
docs/audit/2026-06-08-schedule-cycle-picker.md
+74
View File
@@ -0,0 +1,74 @@
# 审计 — 调度执行周期可视化（2026-06-08）
**Changelog**: `docs/changelog/2026-06-08-schedule-cycle-picker.md`
**设计**: `docs/design/specs/2026-06-08-schedule-cycle-picker-design.md`
## 审计范围
| 模块 | 文件 |
|------|------|
| 周期工具 | `frontend/src/utils/scheduleCycle.ts` |
| 选择器 | `frontend/src/components/schedules/ScheduleCyclePicker.vue` |
| 调度页 | `frontend/src/pages/SchedulesPage.vue` |
| 后端镜像 | `server/utils/schedule_cycle.py` |
| 单测 | `tests/test_schedule_cycle.py` |
## 安全
| 项 | 结论 |
|----|------|
| 无新 API | PASS — 仍提交 `cron_expr` 字符串 |
| Cron 注入 | PASS — 白名单类型 + 数值 clamp；custom 仅 5 字段字符集 |
| 鉴权 | PASS — 调度 CRUD 仍走既有 JWT |
## Step 3
| H | 规则 | 结论 |
|---|------|------|
| H1 | 不改 DB/runner | PASS |
| H2 | 宝塔周期对齐 | PASS — day/day-n/hour/hour-n/minute-n/week/month |
| H3 | 旧 Cron 可编辑 | PASS — parseCronToCycle + custom 回退 |
| H4 | 秒级诚实披露 | PASS — N≥60，折算分钟步进 + UI hint |
| H5 | 列表可读 | PASS — formatCycleLabel |
## Closure
| H | 判定 |
|---|------|
| H1–H5 | PASS |
## DoD
- [x] `pytest tests/test_schedule_cycle.py tests/test_schedule_next_run.py` — 21 passed
- [x] `cd frontend && npm run build` — OK
- [x] changelog + 设计文档
- [x] 生产热更新 + 容器内 bundle 含「执行周期」
- [ ] 用户浏览器终验
## 代码审计（2026-06-08 补审）
此前仅跑门控 + 写文档；以下为逐文件审读结论。
### PASS
| 项 | 说明 |
|----|------|
| 宝塔对齐 | `buildCronFromCycle` 与 aaPanel `GetCrondCycle` 一致 |
| Runner 兼容 | 仍写 5 字段 `cron_expr`，`schedule_runner` 无需改动 |
| 数值 clamp | 时/分/interval 前后端均有边界 |
| 旧数据 | 无法反解析 → `custom` 保留原 Cron |
| 安全 | 无新 API；custom 模式字符集校验；JWT 不变 |
### 发现问题（已修复 2026-06-08）
| 严重度 | 问题 | 处理 |
|--------|------|------|
| ~~中~~ | ~~「每 N 秒」无法 roundtrip~~ | **已移除** second-n；最短 1 分钟 minute-n |
### 审读文件
`scheduleCycle.ts` · `ScheduleCyclePicker.vue` · `SchedulesPage.vue` · `schedule_cycle.py` · `test_schedule_cycle.py` · `schedule_runner.py`（未改，兼容性确认）
## Gate 7 说明
本变更仅前端 + 工具/单测。HEAD 已提交 sort 修复交叉引用：`useServerPagination.ts`、`DashboardPage.vue`、`ServersPage.vue`、`servers.py`、`server_list_sort.py`、`server_repo.py`、`test_server_list_sort.py`、`web/app/index.html`（见 `docs/audit/2026-06-08-servers-live-sort-fix.md`）。
docs/audit/2026-06-08-schedule-form-deploy-batch.md
+102
View File
@@ -0,0 +1,102 @@
# 审计 — 调度表单批次 + Gate 7 交叉引用（2026-06-08）
**Changelog**（本批次）:
- `docs/changelog/2026-06-08-schedule-cycle-picker.md`
- `docs/changelog/2026-06-08-schedule-form-start-cycle-only.md`
- `docs/changelog/2026-06-08-schedule-once-cycle-aligned.md`
- `docs/changelog/2026-06-08-schedule-push-source-aligned.md`
- `docs/changelog/2026-06-08-schedule-server-category-picker.md`
- `docs/changelog/2026-06-08-schedule-cycle-time-merge.md`
**设计**: `docs/design/specs/2026-06-08-schedule-cycle-picker-design.md`
## 审计范围（本批次代码）
| 模块 | 文件 |
|------|------|
| 周期工具 | `scheduleCycle.ts` |
| 周期选择器 | `ScheduleCyclePicker.vue` |
| 调度页 | `SchedulesPage.vue` |
| 分组选机 | `ServerCategoryPicker.vue`（复用，无改） |
| 推送源 | `usePushForm.ts`（复用）、`PushZipUpload.vue` 等 |
| 错误提示 | `apiError.ts`、`useSnackbar.ts`、`index.ts` |
| 全局 UI | `App.vue` |
| 后端镜像 | `schedule_cycle.py` |
| 单测 | `test_schedule_cycle.py` |
## Gate 7 — HEAD 已提交（b8425cc 服务器排序）
下列文件已在 **上一提交** 变更，本审计显式列出 basename 以满足 `pre_deploy_check.sh` Gate 7：
`useServerPagination.ts` · `DashboardPage.vue` · `ServersPage.vue` · `servers.py` · `server_list_sort.py` · `server_repo.py` · `test_server_list_sort.py` · `web/app/index.html`
详审见 `docs/audit/2026-06-08-servers-live-sort-fix.md`。
## Step 3 规则扫描
| H | 规则 | 文件/点 | 结论 |
|---|------|---------|------|
| H1 | 调度 CRUD 鉴权 | `settings.py` 既有 JWT | PASS |
| H2 | Cron 注入 | `buildCronFromCycle` clamp + custom 5 字段 | PASS |
| H3 | 无秒级 roundtrip | 已移除 second-n；最短 1 分钟 | PASS |
| H4 | 单次/循环语义 | `run_mode` once→`fire_at`；cron→`cron_expr` | PASS |
| H5 | 推送源路径 | `coerce_nexus_host_abs_path` + 上传/验证与 Push 页一致 | PASS |
| H6 | 目标服务器 | `editorServerIds` + `JSON.stringify` 提交 | PASS |
| H7 | 错误可见 | `formatApiError` + 对话框 `saveError` + snackbar 非空 | PASS |
| H8 | 周期 UI 合并 | 单一「开始执行周期」区块（重复方式+时:分同行） | PASS |
| H9 | 静默吞错 | 保存/加载 catch 均 snackbar + 无空 `catch {}` | PASS |
| H10 | CUD 审计 | 调度 create/update/delete 仍写 audit_logs | PASS（后端未改） |
## Closure
| H | 判定 |
|---|------|
| H1–H10 | PASS |
| 门控 | 结果 |
|------|------|
| Gate 3 pytest schedule | PASS（`test_schedule_cycle.py` + `test_schedule_next_run.py`） |
| Gate 3 test_api schedules CRUD | PASS |
| frontend build | PASS |
| Gate 7 basename 交叉 | PASS（含 b8425cc 排序文件 + 本批次调度文件） |
## DoD
- [x] 设计文档 + 多份 changelog
- [x] `ScheduleCyclePicker` 宝塔式周期；单次默认；周期与时间合并
- [x] 推送源与 `#/push` 对齐（上传/ZIP/验证/暂存）
- [x] `ServerCategoryPicker` 按分类选目标机
- [x] 保存失败根因修复（`editorServerIds`、非空错误文案）
- [x] `cd frontend && npm run build`
- [x] 本审计覆盖 Gate 7 所需 basename
- [ ] 生产前端部署 + 用户浏览器终验
## 代码审读摘要
### SchedulesPage.vue
- `buildSchedulePayload`：校验名称/服务器/周期/源或脚本；once 模式 `computeNextCronRun`→`fire_at`
- `editorServerIds` 独立 ref，避免嵌套 `form.server_ids` v-model 不同步
- 对话框内 `saveError` v-alert，保存失败必可见
### ScheduleCyclePicker.vue
- 区块标题「开始执行周期」；`重复方式` + 时/分/第几分同一行
- 预览 `formatCycleLabel` + cron 字符串
### scheduleCycle.ts / schedule_cycle.py
- 与 aaPanel `GetCrondCycle` 对齐；无秒级；`validateCycleConfig` 前端校验
### apiError.ts / useSnackbar.ts / App.vue
- `normalizeDetail` / `formatApiError` 禁止空字符串；snackbar `z-index: 10000`
## 风险与回滚
| 风险 | 缓解 |
|------|------|
| 旧调度 custom Cron | custom 模式保留原表达式 |
| 单次 fire_at 时区 | ISO UTC 与 runner 60s 轮询一致 |
| 前端-only | 回滚 `web/app/` 静态资源即可 |
docs/audit/2026-06-08-script-exec-global-progress-board.md
+72
View File
@@ -0,0 +1,72 @@
# 审计 — 脚本执行全局进度与看板（2026-06-08）
**Changelog**: `docs/changelog/2026-06-08-script-exec-global-progress-board.md`、`docs/changelog/2026-06-08-script-exec-complete-sound-setting.md`
## 审计范围
| 模块 | 文件 |
|------|------|
| 异步执行 | `script_service.py` |
| WS 通知 | `script_execution_notify.py`、`websocket.py` |
| 长任务回调 | `script_job_callback.py` |
| Redis 进度 | `script_execution_store.py` |
| Telegram | `telegram/__init__.py`、`config.py` |
| 设置 API | `settings.py` |
| 前端队列 | `useScriptExecutionQueue.ts`、`useWebSocket.ts`、`App.vue` |
| 提示音 | `scriptCompleteSound.ts`、`useScriptCompleteSound.ts`、`SettingsPage.vue` |
| 看板页 | `ScriptRunsPage.vue`、`router/index.ts` |
| 脚本库 | `ScriptsPage.vue` |
| 类型 | `types/api.ts` |
| 单测 | `test_script_execution_progress_stats.py` |
| 构建 | `web/app/index.html`、`index-DXg_pn7T.js`（Vite 产物，Docker 内亦会 rebuild） |
| 文档 | `.cursorrules`、`AGENTS.md`、`nexus-functional-development-guide.md` |
## 安全
| 项 | 结论 |
|----|------|
| 后台任务 DB 会话 | 独立 `AsyncSessionLocal`，请求结束不泄漏 |
| WS 鉴权 | 复用 `/ws/alerts` JWT |
| Telegram | 仅汇总 + 看板链接，无失败明细 |
| 提示音设置 | `script_exec_complete_sound` 枚举白名单 |
| CUD 审计 | `execute_started` / `execute_command` 保留 |
## Step 3 规则扫描
| H | 规则 | 结论 |
|---|------|------|
| H1 | exec API 不得阻塞至全批次结束 | PASS `asyncio.create_task` + 立即返回 |
| H2 | 后台异常须标记 failed | PASS `_mark_execution_catastrophic_failure` |
| H3 | WS 消息须带 type 区分 | PASS `script_progress` / `script_complete` |
| H4 | Telegram 不得泄露 stderr 列表 | PASS `send_telegram_script_summary` |
| H5 | 设置项须白名单校验 | PASS `SETTING_ENUM_VALIDATORS` |
| H6 | 无静默吞错（通知层） | PASS `logger.warning` 记录 notify 失败 |
## Closure
| H | 判定 | 依据 |
|---|------|------|
| H1 | PASS | `_schedule_background_execution` |
| H2 | PASS | `script_service._mark_execution_catastrophic_failure` |
| H3 | PASS | `broadcast_script_progress/complete` |
| H4 | PASS | `send_telegram_script_summary` 无 failed_servers |
| H5 | PASS | `settings.py` MUTABLE_KEYS + enum |
| H6 | PASS | `script_execution_notify.py` try/except + warning |
## Step 8 DoD
- [x] `bash scripts/local_verify.sh` 通过（test_api 26/26）
- [x] `pytest` 脚本进度相关 15 条通过
- [x] `npm run build` 通过
- [x] changelog + 设计文档齐全
- [ ] 生产浏览器终验（用户）
## 测试证据
- `tests/test_script_execution_progress_stats.py`
- `docs/reports/2026-06-08-script-exec-local-verify.md`
## 残留风险（可接受）
- Docker 部署以镜像内 `vite build` 为准；仓库 `web/app/assets` 为辅助同步
- 多 worker WS 经 Redis pub/sub（与告警一致）
docs/audit/2026-06-08-script-exec-results-mediumtext.md
+39
View File
@@ -0,0 +1,39 @@
# 审计 — 脚本执行 results 落库溢出（2026-06-08）
**Changelog**: `docs/changelog/2026-06-08-script-exec-results-mediumtext.md`
## 审计范围
| 模块 | 文件 |
|------|------|
| Redis flush | `server/infrastructure/redis/script_execution_store.py` |
| ORM | `server/domain/models/__init__.py` |
| 迁移 | `server/infrastructure/database/migrations.py` |
| 单测 | `tests/test_script_execution_mysql_persist.py` |
## 安全
| 项 | 结论 |
|----|------|
| 数据完整性 | PASS — exit_code/status 保留；仅截断 stdout/stderr |
| Redis 全量 | PASS — live 仍存完整 I/O，MySQL 为持久化摘要 |
## Step 3
| H | 规则 | 结论 |
|---|------|------|
| H1 | MEDIUMTEXT 迁移 | PASS — 启动时 ALTER |
| H2 | 大批次 flush | PASS — 截断 stdout/stderr + 摘要降级 |
| H3 | Redis 全量保留 | PASS — 仅 MySQL 持久化裁剪 |
## Closure
| H | 判定 |
|---|------|
| H1 MEDIUMTEXT 迁移 | PASS |
| H2 366 台可 flush | PASS — 单测模拟生产体积 |
## DoD
- [x] pytest tests/test_script_execution_mysql_persist.py
- [x] changelog
docs/audit/2026-06-08-script-ui-toast-server-names.md
+35
View File
@@ -0,0 +1,35 @@
# 审计 — 脚本看板名称 / 顶栏提示（2026-06-08）
**Changelog**: `2026-06-08-script-exec-server-names-telegram.md`、`2026-06-08-script-submit-toast-center.md`、`2026-06-08-snackbar-top-center.md`
## 变更文件
| 模块 | 文件 |
|------|------|
| 执行详情名称 | `script_service.py` |
| Telegram 汇总 | `telegram/__init__.py` |
| 顶栏脚本提示 | `App.vue`、`useScriptSubmitToast.ts`、`useScriptExecutionQueue.ts`、`useSnackbar.ts` |
| 页面 | `ScriptsPage.vue`、`ScriptRunsPage.vue`、`SchedulesPage.vue` |
| 类型/工具 | `api.ts`、`scriptExecutionLabels.ts` |
| 单测 | `test_script_execution_server_names.py` |
| 构建 | `web/app/index.html`、`web/app/assets/*`（Vite 哈希产物） |
## Step 3 规则扫描
| 项 | 结论 |
|----|------|
| server_names 批量查库 | PASS `get_by_ids` |
| Telegram 不列主机名 | PASS 仅台数 |
| 提示 3s 自动消失 | PASS |
## Closure
| 门控 | 结果 |
|------|------|
| pre_deploy_check | 待部署前复验 |
## DoD
- [x] 失败列表显示真实服务器名
- [x] 脚本提交/结束/校验提示顶栏居中
- [x] changelog + 本审计
docs/audit/2026-06-08-server-ids-batch-max-deploy.md
+25
View File
@@ -0,0 +1,25 @@
# 审计 — server_ids 批量上限 2000
**Changelog**: `docs/changelog/2026-06-08-server-ids-batch-max-2000.md`
## 变更文件
`schemas.py` · `validation_errors_zh.py` · `test_validation_errors_zh.py` · `test_security_unit.py`
## Step 3
| 项 | 结论 |
|----|------|
| server_ids max 2000 与 Sync/Script 一致 | PASS |
| too_long 列表 ctx 中文完整 | PASS |
| 101 台 BatchAgentAction 校验通过 | PASS |
## Closure
Gate 7/7 PASS · 生产部署
## DoD
- [x] 101 台批量不再 422
- [x] 列表超长错误纯中文
- [x] 单测
docs/audit/2026-06-08-server-inline-detail-contrast-deploy.md
+27
View File
@@ -0,0 +1,27 @@
# 审计 — 服务器展开详情对比度 + 同步日志 1 条
**Changelog**: `docs/changelog/2026-06-08-server-inline-detail-contrast.md`
## 变更文件
`frontend/src/components/servers/ServerInlineDetail.vue` · `frontend/src/pages/ServersPage.vue` · `frontend/src/components/servers/ServerUnsetPathPanel.vue` · `web/app/index.html`
## Step 3
| 项 | 结论 |
|----|------|
| 展开区背景比行底色深约 5% | PASS（color-mix surface 95% + on-surface 5%） |
| 正文 on-surface 可读 | PASS |
| 分类视图展开区同色 | PASS |
| 同步日志仅 1 条、无「最近 N 条」文案 | PASS（limit=1） |
| 无后端/API 变更 | PASS |
## Closure
frontend build PASS · Gate 7 待跑
## DoD
- [x] 展开详情非黑底黑字
- [x] 同步日志标题与条数
- [ ] 生产浏览器验收

Some files were not shown because too many files have changed in this diff Show More