Compare commits
260 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Your Name
|
e704b01093 | ||
|
Your Name
|
246070e599 | ||
|
Your Name
|
d93c518a14 | ||
|
Your Name
|
1cfac23c01 | ||
|
Your Name
|
799140f6c4 | ||
|
Your Name
|
8935081ac5 | ||
|
Your Name
|
ab431028c1 | ||
|
Your Name
|
cc2dad7f31 | ||
|
Your Name
|
24b4439b2b | ||
|
Your Name
|
b8af1fc418 | ||
|
Your Name
|
b77a314b36 | ||
|
Your Name
|
d519113734 | ||
|
Your Name
|
65c77155d8 | ||
|
Your Name
|
2deb89b49c | ||
|
Your Name
|
b76295aaec | ||
|
Your Name
|
8311821590 | ||
|
Your Name
|
73fdcafb81 | ||
|
Your Name
|
91d0d4104e | ||
|
Your Name
|
7fa4bd6dff | ||
|
Your Name
|
a20cefcfbd | ||
|
Your Name
|
6183047fd6 | ||
|
Your Name
|
df2c188f5d | ||
|
Your Name
|
2d00d6a8eb | ||
|
Your Name
|
080c1158d4 | ||
|
Your Name
|
facc1e8ae4 | ||
|
Your Name
|
1ecd8e4542 | ||
|
Your Name
|
c6485168b6 | ||
|
Your Name
|
e9af02dd22 | ||
|
Your Name
|
c9baecfdfa | ||
|
Your Name
|
3d5870b404 | ||
|
Your Name
|
afd32118b2 | ||
|
Your Name
|
d0308aaef6 | ||
|
Your Name
|
04dda2c419 | ||
|
Your Name
|
e084d90c61 | ||
|
Your Name
|
24aa8494e5 | ||
|
Your Name
|
5c7775c10c | ||
|
Your Name
|
7a6479dbfa | ||
|
Your Name
|
0fdae981cf | ||
|
Your Name
|
3419ab8a09 | ||
|
Your Name
|
d512460dc9 | ||
|
Your Name
|
0f02e047cc | ||
|
Your Name
|
35583115ff | ||
|
Your Name
|
f745714530 | ||
|
Your Name
|
0d056a45e9 | ||
|
Your Name
|
0ded4a28ec | ||
|
Your Name
|
5ac4a5c7cf | ||
|
Your Name
|
9c5ebdfdbd | ||
|
Your Name
|
c457cb4058 | ||
|
Your Name
|
8b2263916c | ||
|
Your Name
|
293a0d64fe | ||
|
Your Name
|
94fbdf7b2d | ||
|
Your Name
|
e65c9993a2 | ||
|
Your Name
|
ae47eb42de | ||
|
Your Name
|
c570801119 | ||
|
Your Name
|
cba8b3d8f6 | ||
|
Your Name
|
caef4a216b | ||
|
Your Name
|
507b957b4e | ||
|
Your Name
|
c70424a224 | ||
|
Your Name
|
e8c1acba9f | ||
|
Your Name
|
34786737b4 | ||
|
Your Name
|
be633f3e58 | ||
|
Your Name
|
00a3309005 | ||
|
Your Name
|
3d15200cfa | ||
|
Your Name
|
d8aca5bf18 | ||
|
Your Name
|
cb60af4483 | ||
|
Your Name
|
5a5adafb39 | ||
|
Your Name
|
c0296b9d8e | ||
|
Your Name
|
ca4aceba3e | ||
|
Your Name
|
b5dfa8a870 | ||
|
Your Name
|
17cdc96bb0 | ||
|
Your Name
|
6012af0b4d | ||
|
Your Name
|
9bdf7e420f | ||
|
Your Name
|
40d672fdbb | ||
|
Your Name
|
557c8d28c1 | ||
|
Your Name
|
9f7be66356 | ||
|
Your Name
|
ac38442383 | ||
|
Your Name
|
14131f98f0 | ||
|
Your Name
|
64503c0260 | ||
|
Your Name
|
d19f5af807 | ||
|
Your Name
|
463841a740 | ||
|
Your Name
|
36fde6e6ed | ||
|
Your Name
|
1a61fae590 | ||
|
Your Name
|
a50f17941d | ||
|
Your Name
|
362b28199f | ||
|
Your Name
|
5213def150 | ||
|
Your Name
|
5166660f3a | ||
|
Your Name
|
48ef06babb | ||
|
Your Name
|
ede7fbaa64 | ||
|
Your Name
|
4c4d41b8f5 | ||
|
Your Name
|
32feb1b6db | ||
|
Your Name
|
ebe276ea29 | ||
|
Your Name
|
84282e87ae | ||
|
Your Name
|
de8d860244 | ||
|
Your Name
|
3f50a40d25 | ||
|
Your Name
|
dc48f71b25 | ||
|
Your Name
|
913fd16bb9 | ||
|
Your Name
|
deffa8a8f4 | ||
|
Your Name
|
64a8a18287 | ||
|
Your Name
|
cc0ca47d61 | ||
|
Your Name
|
449373f24f | ||
|
Your Name
|
730b665306 | ||
|
Your Name
|
f5bea6f0d2 | ||
|
Your Name
|
c808c28edf | ||
|
Your Name
|
d53309e37e | ||
|
Your Name
|
a8fe7fed0a | ||
|
Your Name
|
f91cd847a9 | ||
|
Your Name
|
993a234152 | ||
|
Your Name
|
e709c72f1f | ||
|
Your Name
|
f7c4b95dd6 | ||
|
Your Name
|
75864fe04f | ||
|
Your Name
|
ae22db4b3e | ||
|
Your Name
|
0b82a3fee7 | ||
|
Your Name
|
d785c78d6d | ||
|
Your Name
|
56906e8fe2 | ||
|
Your Name
|
da234c4e73 | ||
|
Your Name
|
7193b88156 | ||
|
Your Name
|
ac66f5b4e7 | ||
|
Your Name
|
6dd0b487b7 | ||
|
Your Name
|
fe211619aa | ||
|
Your Name
|
0cbda8c840 | ||
|
Your Name
|
5958c21048 | ||
|
Your Name
|
02423cb803 | ||
|
Your Name
|
152852e2c3 | ||
|
Your Name
|
3c7036babf | ||
|
Your Name
|
74de9d303e | ||
|
Your Name
|
ad2e7667d3 | ||
|
Your Name
|
82c297776a | ||
|
Your Name
|
77b332c037 | ||
|
Your Name
|
97be1fd214 | ||
|
Your Name
|
366bdc18fa | ||
|
Your Name
|
280357d7d7 | ||
|
Your Name
|
fd9b7d85b5 | ||
|
Your Name
|
8b82d6bab0 | ||
|
Your Name
|
869f64ac18 | ||
|
Your Name
|
69056491a7 | ||
|
Your Name
|
02f1fa4ef3 | ||
|
Your Name
|
eadf7254a1 | ||
|
Your Name
|
1c70e597a3 | ||
|
Your Name
|
867e2aa552 | ||
|
Your Name
|
a2d392dae7 | ||
|
Your Name
|
8b10f9d64a | ||
|
Your Name
|
b1aa235726 | ||
|
Your Name
|
5afb18b745 | ||
|
Your Name
|
a1b0b2c514 | ||
|
Your Name
|
f591033309 | ||
|
Your Name
|
89fa517693 | ||
|
Your Name
|
973e23e038 | ||
|
Your Name
|
ad7f4d8d62 | ||
|
Your Name
|
fb4e51ec5a | ||
|
Your Name
|
8cd091add8 | ||
|
Your Name
|
6be989c299 | ||
|
Your Name
|
ccb78ed980 | ||
|
Your Name
|
95aa8a610f | ||
|
Your Name
|
9de6ac9904 | ||
|
Your Name
|
cf0725b037 | ||
|
Your Name
|
3943ff4f3a | ||
|
Your Name
|
deb3a94ee6 | ||
|
Your Name
|
99201f48fd | ||
|
Your Name
|
c72631a293 | ||
|
Your Name
|
a1276f38ad | ||
|
Your Name
|
400dcae781 | ||
|
Your Name
|
cdd0be328a | ||
|
Your Name
|
fbf5eadcf2 | ||
|
Your Name
|
9bba58a529 | ||
|
Your Name
|
488838c989 | ||
|
Your Name
|
da43960f38 | ||
|
Your Name
|
5fcc1e22a6 | ||
|
Your Name
|
37ceaef6d9 | ||
|
Your Name
|
d414b945e1 | ||
|
Your Name
|
4ca07fa252 | ||
|
Your Name
|
d2832567c7 | ||
|
Your Name
|
14dc29f241 | ||
|
Your Name
|
b9e8db7a3f | ||
|
Your Name
|
08d0baf762 | ||
|
Your Name
|
9c063a788f | ||
|
Your Name
|
5a42345bc0 | ||
|
Your Name
|
6c5e6a2daa | ||
|
Your Name
|
ac0eb79707 | ||
|
Your Name
|
e37bc6cea9 | ||
|
Your Name
|
2c6f3abbd0 | ||
|
Your Name
|
d5c498549b | ||
|
Your Name
|
07eab6020c | ||
|
Your Name
|
938e700fb3 | ||
|
Your Name
|
424c4efd64 | ||
|
Your Name
|
c08e2a2242 | ||
|
Your Name
|
6108d69b24 | ||
|
Your Name
|
680577fc97 | ||
|
Your Name
|
86bb32f87e | ||
|
Your Name
|
c3c3bae370 | ||
|
Your Name
|
33b7ed93bf | ||
|
Your Name
|
61b891db73 | ||
|
Your Name
|
aa65f10c52 | ||
|
Your Name
|
80d73d1b74 | ||
|
Your Name
|
752a24497c | ||
|
Your Name
|
341d16fd6d | ||
|
Your Name
|
d744d7df8e | ||
|
Your Name
|
4af9acf564 | ||
|
Your Name
|
6354d507df | ||
|
Your Name
|
7e29397235 | ||
|
Your Name
|
4969876ce8 | ||
|
Your Name
|
b676e320de | ||
|
Your Name
|
938d26927f | ||
|
Your Name
|
8530f0e0d5 | ||
|
Your Name
|
cea5730804 | ||
|
Your Name
|
dfc37f6e90 | ||
|
Your Name
|
0bcfeaa6d6 | ||
|
Your Name
|
cb5b4c42de | ||
|
Your Name
|
b36e1d8010 | ||
|
Your Name
|
8a5d4159a4 | ||
|
Your Name
|
c03fe97d18 | ||
|
Your Name
|
e9feaa6cdc | ||
|
Your Name
|
83547c0b2e | ||
|
Your Name
|
2ec24371c5 | ||
|
Your Name
|
8ae4bc48cd | ||
|
Your Name
|
9d34655cc1 | ||
|
Your Name
|
249a1aaed9 | ||
|
Your Name
|
120ae186ef | ||
|
Your Name
|
cca410da33 | ||
|
Your Name
|
26833f00d3 | ||
|
Your Name
|
d4ea03d735 | ||
|
Your Name
|
f262876b25 | ||
|
Your Name
|
bfa50337e5 | ||
|
Your Name
|
305f8d5689 | ||
|
Your Name
|
785ffe2a7e | ||
|
Your Name
|
55b7cbe904 | ||
|
Your Name
|
b9139093f1 | ||
|
Your Name
|
f796ddf0a5 | ||
|
Your Name
|
c9a99f4fb3 | ||
|
Your Name
|
8c8d2a74d5 | ||
|
Your Name
|
302fdcc1a1 | ||
|
Your Name
|
5590391779 | ||
|
Your Name
|
56993e4f98 | ||
|
Your Name
|
cd3c35b5e6 | ||
|
Your Name
|
f0c586a345 | ||
|
Your Name
|
00a6491e59 | ||
|
Your Name
|
7caa880ebd | ||
|
Your Name
|
a584792603 | ||
|
Your Name
|
1a27327036 | ||
|
Your Name
|
814e11588e | ||
|
Your Name
|
73c1776e1e | ||
|
Your Name
|
ead4b2580f | ||
|
Your Name
|
3ba85986ed | ||
|
Your Name
|
3ecd3d75d4 | ||
|
Your Name
|
539c33ef42 | ||
|
Your Name
|
e5b0c2d4ef | ||
|
Your Name
|
4cfed27bf7 | ||
|
Your Name
|
003ca96f07 | ||
|
Your Name
|
9e20898fd0 | ||
|
Your Name
|
cad49e6de1 | ||
|
Your Name
|
06f1e9ee07 | ||
|
Your Name
|
55e14805de | ||
|
Your Name
|
ae94101eb8 | ||
|
Your Name
|
f9045a8404 | ||
|
Your Name
|
05600232b7 | ||
|
Your Name
|
98cb33c3d6 | ||
|
Your Name
|
2cf7602573 | ||
|
Your Name
|
669a62b17a | ||
|
Your Name
|
99e23d7e78 | ||
|
Your Name
|
5ae8855894 | ||
|
Your Name
|
b2617b4e31 |
@@ -0,0 +1,18 @@
|
||||
{
|
||||
"version": "0.0.1",
|
||||
"configurations": [
|
||||
{
|
||||
"name": "Nexus Preview",
|
||||
"runtimeExecutable": "python",
|
||||
"runtimeArgs": ["-m", "http.server", "8765", "--directory", "web/app"],
|
||||
"port": 8765
|
||||
},
|
||||
{
|
||||
"name": "Frontend Dev",
|
||||
"runtimeExecutable": "npm",
|
||||
"runtimeArgs": ["run", "dev"],
|
||||
"cwd": "frontend",
|
||||
"port": 3000
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
{
|
||||
"mcpServers": {
|
||||
"vuetify-mcp": {
|
||||
"command": "npx",
|
||||
"args": ["-y", "@vuetify/mcp", "--remote"]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,69 @@
|
||||
{
|
||||
"permissions": {
|
||||
"allow": [
|
||||
"Bash(git checkout *)",
|
||||
"Bash(python -m py_compile server/database.py server/services/retry_engine.py server/services/sync_engine.py server/api/servers.py server/main.py)",
|
||||
"Bash(git add *)",
|
||||
"Bash(git commit *)",
|
||||
"Bash(python -m py_compile server/api/servers.py)",
|
||||
"Bash(python -m py_compile agent/agent.py)",
|
||||
"Bash(python -m py_compile server/main.py server/api/servers.py)",
|
||||
"Bash(python -m py_compile server/main.py)",
|
||||
"Bash(python -m py_compile server/config.py server/api/servers.py server/services/retry_engine.py server/services/notify.py)",
|
||||
"Bash(python -m py_compile server/config.py)",
|
||||
"Bash(python -m py_compile server/database.py)",
|
||||
"Bash(python -m py_compile server/database.py server/services/scheduler.py server/api/servers.py server/main.py)",
|
||||
"Bash(python -m py_compile server/services/retry_engine.py)",
|
||||
"Bash(python -m py_compile server/config.py server/main.py server/api/servers.py)",
|
||||
"Bash(python -m py_compile agent/agent.py server/api/servers.py)",
|
||||
"Bash(python -m py_compile server/services/sync_engine.py server/services/retry_engine.py server/api/servers.py)",
|
||||
"Bash(xargs python *)",
|
||||
"Bash(echo \"EXIT:$?\")",
|
||||
"Bash(python -m py_compile server/services/sync_engine.py agent/agent.py)",
|
||||
"Bash(python -m py_compile server/api/auth.py server/services/retry_engine.py)",
|
||||
"Bash(python -m py_compile server/main.py server/database.py)",
|
||||
"Bash(python -m py_compile server/config.py server/main.py)",
|
||||
"Bash(python -m py_compile server/services/monitor.py server/main.py)",
|
||||
"Bash(python -m py_compile server/services/monitor.py)",
|
||||
"WebFetch(domain:github.com)",
|
||||
"Bash(sshpass -p 'root' ssh-copy-id -o StrictHostKeyChecking=no root@192.168.124.10)",
|
||||
"Bash(ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 root@192.168.124.10 \"hostname && uname -a\")",
|
||||
"Bash(apt-get install *)",
|
||||
"Bash(yum install *)",
|
||||
"Read(//c/Users/uzuma/.ssh/**)",
|
||||
"Bash(python -c ' *)",
|
||||
"Bash(ssh -o ConnectTimeout=5 root@192.168.124.10)",
|
||||
"Bash(awk '{print $2}')",
|
||||
"WebFetch(domain:47.76.187.108)",
|
||||
"WebFetch(domain:api.synaglobal.vip)",
|
||||
"Bash(pip install *)",
|
||||
"Bash(where ssh *)",
|
||||
"Bash(ssh -V)",
|
||||
"Bash(cp \"C:\\\\Users\\\\uzuma\\\\Desktop\\\\svn\\\\multi-server-sync\\\\.claude\\\\worktrees\\\\unruffled-shtern-bca88d\\\\.mcp.json\" \"C:\\\\Users\\\\uzuma\\\\Desktop\\\\svn\\\\multi-server-sync\\\\.mcp.json\")",
|
||||
"Bash(cp \"C:\\\\Users\\\\uzuma\\\\Desktop\\\\svn\\\\multi-server-sync\\\\.claude\\\\worktrees\\\\unruffled-shtern-bca88d\\\\mcp\\\\mcp_bridge.py\" \"C:\\\\Users\\\\uzuma\\\\Desktop\\\\svn\\\\multi-server-sync\\\\mcp\\\\mcp_bridge.py\")",
|
||||
"Read(//c/Users/uzuma/Desktop/svn/multi-server-sync/**)",
|
||||
"Read(//c/Users/uzuma/.claude/**)",
|
||||
"WebSearch",
|
||||
"Bash(cmd /c *)",
|
||||
"Bash(echo \"EXIT: $?\")",
|
||||
"Bash(ssh -o StrictHostKeyChecking=no -i /c/Users/uzuma/.ssh/id_rsa_mcp root@47.76.187.108 \"python3 /www/wwwroot/api.synaglobal.vip/mcp/multisync_server.py\")",
|
||||
"Bash(scp -o StrictHostKeyChecking=no -i /c/Users/uzuma/.ssh/id_rsa_mcp \"C:\\\\Users\\\\uzuma\\\\Desktop\\\\svn\\\\multi-server-sync\\\\.claude\\\\worktrees\\\\unruffled-shtern-bca88d\\\\mcp\\\\multisync_server.py\" root@47.76.187.108:/www/wwwroot/api.synaglobal.vip/mcp/multisync_server.py)",
|
||||
"Bash(git push *)",
|
||||
"Bash(claude mcp *)",
|
||||
"Skill(update-config)",
|
||||
"Skill(update-config:*)",
|
||||
"Bash(python -c \"import json; d=json.load\\(open\\(r'C:\\\\Users\\\\uzuma\\\\.claude.json'\\)\\); print\\(json.dumps\\(d.get\\('mcpServers',{}\\), indent=2\\)\\)\")",
|
||||
"mcp__multisync__service",
|
||||
"mcp__multisync__api_call",
|
||||
"mcp__multisync__git_log",
|
||||
"mcp__multisync__deploy",
|
||||
"mcp__multisync__config_view",
|
||||
"mcp__multisync__db_query",
|
||||
"mcp__multisync__logs",
|
||||
"mcp__multisync__run_test",
|
||||
"Bash(python -m py_compile \"C:\\\\Users\\\\uzuma\\\\Desktop\\\\svn\\\\multi-server-sync\\\\.claude\\\\worktrees\\\\unruffled-shtern-bca88d\\\\server\\\\api\\\\servers.py\")",
|
||||
"Bash(python -m py_compile \"C:\\\\Users\\\\uzuma\\\\Desktop\\\\svn\\\\multi-server-sync\\\\.claude\\\\worktrees\\\\unruffled-shtern-bca88d\\\\agent\\\\agent.py\")",
|
||||
"Bash(python -m py_compile \"C:\\\\Users\\\\uzuma\\\\Desktop\\\\svn\\\\multi-server-sync\\\\.claude\\\\worktrees\\\\unruffled-shtern-bca88d\\\\server\\\\services\\\\agent_installer.py\")"
|
||||
]
|
||||
}
|
||||
}
|
||||
+18
-2
@@ -1,9 +1,25 @@
|
||||
{
|
||||
"mcpServers": {
|
||||
"mysql-mcp": {
|
||||
"command": "bash",
|
||||
"args": ["scripts/linux_mcp_mysql.sh"],
|
||||
"command": "wsl",
|
||||
"args": [
|
||||
"-e",
|
||||
"bash",
|
||||
"/mnt/c/Users/uzuma/Desktop/svn/Nexus/.claude/worktrees/suspicious-williams-fe9492/scripts/wsl_mcp_mysql.sh"
|
||||
],
|
||||
"env": {}
|
||||
},
|
||||
"memory": {
|
||||
"command": "cmd",
|
||||
"args": [
|
||||
"/c",
|
||||
"npx",
|
||||
"-y",
|
||||
"@modelcontextprotocol/server-memory"
|
||||
],
|
||||
"env": {
|
||||
"MEMORY_FILE_PATH": "C:\\Users\\uzuma\\Desktop\\svn\\Nexus\\.claude\\worktrees\\suspicious-williams-fe9492\\.claude\\mcp-memory.jsonl"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,44 +0,0 @@
|
||||
---
|
||||
description: 减少盲目搜文件、控制 Read 次数与 token 消耗
|
||||
alwaysApply: true
|
||||
---
|
||||
|
||||
# Agent 探索约束（省 token）
|
||||
|
||||
## 开始前
|
||||
|
||||
1. 读根目录 `AGENTS.md` 的「代码地图」与「问题 → 文件」表
|
||||
2. 架构/API 全览只读 `docs/project/nexus-functional-development-guide.md`（或用户指定的 §），禁止为找结构全库 Grep
|
||||
3. 用户已给出路径/文件名时，只读该路径，禁止扩大范围
|
||||
|
||||
## 搜索顺序
|
||||
|
||||
```
|
||||
AGENTS.md / 功能指南 § → Grep（带 path）→ Read（≤3 个文件）→ 仍不够再扩一圈
|
||||
```
|
||||
|
||||
- **禁止**无 `path` 的全仓库 `Grep` / `Glob`（除非用户明确要求全库）
|
||||
- **Grep 优先于 Read**；Glob 只用于定位文件名，不逐个 Read 全部匹配
|
||||
- 同一任务 **Read 不超过 5 个文件**；找到答案后立即停止
|
||||
- 不要重复 Read 已在本对话出现过的文件
|
||||
|
||||
## 分层定位（禁止跨层乱搜）
|
||||
|
||||
| 层 | 路径 |
|
||||
|----|------|
|
||||
| HTTP 路由 | `server/api/<module>.py` |
|
||||
| 业务 | `server/application/services/` |
|
||||
| 数据访问 | `server/infrastructure/` |
|
||||
| 模型 | `server/domain/models/` |
|
||||
| 前端页 | `frontend/src/pages/` |
|
||||
| 前端路由 | `frontend/src/router/index.ts` |
|
||||
| 前端 API 客户端 | `frontend/src/api/` |
|
||||
|
||||
真实前端源码在 `frontend/src/`，不是 `web/app/*.html`（那是构建产物）。
|
||||
|
||||
## 文档索引
|
||||
|
||||
- 功能 SSOT：`docs/project/nexus-functional-development-guide.md`
|
||||
- 文档导航：`docs/README.md`
|
||||
- 本地路径/MCP：`docs/project/linux-dev-paths.md`
|
||||
- 运维（连机/exec）：用户 Skill `Nexus平台` 或 `docs/project/nexus-1panel-operations-knowledge.md`
|
||||
@@ -11,7 +11,7 @@ alwaysApply: false
|
||||
| 调用方 | 机制 |
|
||||
|--------|------|
|
||||
| 管理端 API | JWT Bearer + 可选 TOTP |
|
||||
| Agent | `X-API-Key`（仅 per-server `agent_api_key`；经 `POST /api/servers/{id}/agent-key` 生成，BL-06 起无 global 回退） |
|
||||
| Agent | `X-API-Key`（全局或 per-server `agent_api_key`） |
|
||||
| WebSocket | JWT query param |
|
||||
| 安装向导 | 无 JWT（仅安装模式可用） |
|
||||
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
{
|
||||
"plugins": {
|
||||
"compound-engineering": {
|
||||
"enabled": true
|
||||
}
|
||||
}
|
||||
}
|
||||
+157
-37
@@ -1,56 +1,176 @@
|
||||
# Nexus 6.0 — Cursor 速查
|
||||
# Nexus 6.0 — Cursor Rules
|
||||
|
||||
> SSOT: [docs/project/nexus-functional-development-guide.md](docs/project/nexus-functional-development-guide.md)
|
||||
> Handoff: [docs/project/AI-HANDOFF-2026-06-03.md](docs/project/AI-HANDOFF-2026-06-03.md)
|
||||
## 项目概述
|
||||
Nexus 是一个 2000+ 服务器运维管理平台。技术栈：FastAPI + Async SQLAlchemy + Redis + WebSocket + Telegram (后端)，Vue 3 + Vuetify 4 + TypeScript SPA (前端，14页面)。项目 ~99% 完成。
|
||||
|
||||
## 栈
|
||||
## 基本信息
|
||||
- 仓库: http://66.154.115.8:3000/admin/Nexus.git
|
||||
- 本地路径: C:\Users\uzuma\Desktop\svn\Nexus
|
||||
- 生产域名: https://api.synaglobal.vip
|
||||
- 生产 IP: 47.254.123.106，后端端口 8600
|
||||
- 部署路径: /www/wwwroot/api.synaglobal.vip/
|
||||
- 管理员: admin / Nexus@2026
|
||||
- 数据库: MySQL nexus/Nexus@2026!@127.0.0.1:3306/nexus
|
||||
- SSH 别名: ssh nexus (key: id_rsa_nexus)
|
||||
|
||||
FastAPI + Async SQLAlchemy + Redis · Vue 3 + Vuetify 4 SPA（15 页）· Vite → `web/app/`
|
||||
## 目录结构
|
||||
```
|
||||
Nexus/
|
||||
├── server/ ← FastAPI 后端 (Clean Architecture 4层)
|
||||
│ ├── api/ ← API 路由
|
||||
│ ├── domain/ ← SQLAlchemy 模型 (14+张表)
|
||||
│ ├── infrastructure/← SSH 连接池 + Redis + Telegram
|
||||
│ ├── background/ ← 后台任务
|
||||
│ └── config.py ← Pydantic Settings + MySQL 覆盖
|
||||
├── frontend/ ← Vue 3 + Vuetify 4 + TypeScript SPA
|
||||
│ └── src/pages/ ← 14 个页面组件
|
||||
├── web/app/ ← Vite 构建输出 (后端 StaticFiles 挂载点)
|
||||
├── deploy/ ← Supervisor + Nginx + 健康检查脚本
|
||||
├── docs/ ← 设计文档/审计/changelog
|
||||
└── .env ← NOT IN GIT (安装向导生成)
|
||||
```
|
||||
|
||||
## 环境（勿在仓库写密码）
|
||||
## 实现原则（强制）
|
||||
|
||||
- 生产: `https://api.synaglobal.vip` · 端口 8600 · `ssh nexus`
|
||||
- 本地: `~/Nexus` 或 `$NEXUS_ROOT` · 见 [linux-dev-paths.md](docs/project/linux-dev-paths.md)
|
||||
- 凭据: 仅 `.env`（不入 git）
|
||||
- **Gitea**：clone/pull 可匿名；**push** 用 `bash scripts/git-push.sh`（凭据在 `deploy/nexus-1panel.secrets.sh`，已 gitignore，勿提交）
|
||||
**所有设计和实现都必须是完美实现。**
|
||||
|
||||
## 关键路径
|
||||
- ❌ 不允许为了实现而实现 — 每一行代码必须有明确的目的和质量标准
|
||||
- ❌ 不允许降级实现 — 不得以「先用着」为由降低安全、架构或代码质量标准
|
||||
- ❌ 不允许妥协实现 — 不得在发现问题后选择绕过而非根治
|
||||
- ❌ 不允许留技术债 — 发现问题必须当场修复，不得标注 TODO/FIXME 延后
|
||||
- ✅ 无法完美实现时必须停下来与用户交流后再换方案，不得擅自从权
|
||||
|
||||
| 用途 | 路径 |
|
||||
|------|------|
|
||||
| 后端入口 | `server/main.py` |
|
||||
| 前端路由 | `frontend/src/router/index.ts` |
|
||||
| API 客户端 | `frontend/src/api/index.ts` |
|
||||
| Sync | `server/api/sync_v2.py` |
|
||||
| 门控 | `deploy/pre_deploy_check.sh` |
|
||||
| 本地验证 | `bash scripts/local_verify.sh` |
|
||||
## 安全铁律（强制）
|
||||
|
||||
## 铁律
|
||||
- ❌ 禁止明文密码出现在前端 JS 变量、localStorage、URL 参数中
|
||||
- ❌ 禁止静默吞错 — except 块不得空 pass 或 return None 掩盖异常
|
||||
- ❌ 禁止硬编码密钥/密码/Token — 必须走配置或环境变量
|
||||
- ❌ 禁止 f-string 拼 SQL — 必须参数化查询
|
||||
- ❌ 禁止未验证的用户输入拼入 shell 命令 — 必须用 shlex.quote() 或 subprocess 参数化
|
||||
- ✅ 敏感操作必须二次验证身份（re-auth pattern）
|
||||
- ✅ API 响应不得返回密码/密钥明文 — 用 password_set 布尔标记
|
||||
- ✅ 所有 CUD 操作必须记录审计日志
|
||||
|
||||
见 `.cursor/rules/perfect-implementation.mdc` · `nexus-security.mdc` — 完美实现、无静默吞错、无明文密钥、CUD 审计。
|
||||
## 文档纪律（强制）
|
||||
|
||||
## Agent Git / diff（省 token、防卡顿）
|
||||
- 新功能/架构变更：先写 docs/design/specs/YYYY-MM-DD-*-design.md，再写代码
|
||||
- 开发前：写 docs/design/plans/ 或 docs/reports/ 技术文档
|
||||
- 项目缺文档的模块：改动时一并补全
|
||||
- 每次修改：在 docs/changelog/YYYY-MM-DD-*.md 留 changelog（行数≥10，不能空壳）
|
||||
|
||||
- **禁止**无路径过滤的全仓 `git diff` / `git diff HEAD`（`web/app/assets` 构建产物可导致数十万行输出）。
|
||||
- **优先**：`git diff --stat` 或 `git diff -- frontend/src server/api tests docs`。
|
||||
- **提交**：只 `git add` 源码与文档；`web/app/assets/*` 由 Docker 内 `vite build` 生成，勿为 diff 把海量 hash 文件纳入上下文。
|
||||
- **部署/门控**：定向 pytest（如 `tests/integration/test_*.py`），避免并行全仓 diff + 本地 build + 远程镜像重建。
|
||||
## 强制文件修改流程（不可跳步）
|
||||
|
||||
## 部署
|
||||
```
|
||||
实现 → WSL本地验证 → ★审计8步★ → 部署 → 健康检查 → 浏览器验证 → changelog
|
||||
```
|
||||
|
||||
默认 **本机 rsync 直传**（不 push Gitea）：
|
||||
进度条（每次改代码必须输出）：
|
||||
```
|
||||
□实现 □WSL验证 □审计8步 □部署 □健康检查 □浏览器验证 □changelog
|
||||
```
|
||||
|
||||
审计8步：登记→全文Read→规则扫描H→Closure表→入口表→输入→Sink→归类→DoD
|
||||
|
||||
## 部署流程
|
||||
|
||||
### 后端部署
|
||||
```bash
|
||||
bash deploy/pre_deploy_check.sh && bash deploy/deploy-production.sh
|
||||
git push origin main
|
||||
ssh nexus "cd /www/wwwroot/api.synaglobal.vip && git fetch --all && git reset --hard origin/main && supervisorctl restart nexus"
|
||||
ssh nexus "sleep 3 && curl -s http://127.0.0.1:8600/health" # 预期: ok
|
||||
```
|
||||
|
||||
仅同步源码（不重建镜像）：`bash deploy/rsync-local-to-server.sh`
|
||||
仍走 Gitea 拉取：`NEXUS_DEPLOY_VIA_GIT=1 bash deploy/deploy-production.sh`
|
||||
|
||||
前端: `cd frontend && npx vite build` → 部署脚本内 tar/scp 到 `web/app/`
|
||||
|
||||
## 进度条（改代码时输出）
|
||||
|
||||
### 前端部署
|
||||
```bash
|
||||
cd frontend && npx vite build && cd ..
|
||||
tar czf /tmp/nexus-frontend.tar.gz -C web/app index.html assets/
|
||||
scp /tmp/nexus-frontend.tar.gz nexus:/tmp/nexus-frontend.tar.gz
|
||||
ssh nexus "cd /www/wwwroot/api.synaglobal.vip/web/app && tar xzf /tmp/nexus-frontend.tar.gz && rm /tmp/nexus-frontend.tar.gz"
|
||||
```
|
||||
□实现 □本地验证 □审计8步 □部署 □健康检查 □浏览器验证 □changelog
|
||||
|
||||
### 本地开发
|
||||
```bash
|
||||
cd frontend && npm run dev # http://localhost:3000/app/
|
||||
```
|
||||
|
||||
## 7道门控 (deploy/pre_deploy_check.sh)
|
||||
|
||||
1. Changelog门 — 文件存在且行数≥10
|
||||
2. Audit门 — 文件存在且含 Step3+Closure+DoD
|
||||
3. Test门 — test_api.py 必须存在且通过
|
||||
4. Lint门 — ruff check server/ 零错误
|
||||
5. Import门 — import server.main 成功
|
||||
6. Security门 — bandit 无 HIGH/MEDIUM
|
||||
7. Review门 — 审计文件包含实际改动文件清单
|
||||
|
||||
## 已确认的关键决策
|
||||
|
||||
| 不可改项 | 原因 |
|
||||
|---------|------|
|
||||
| API_KEY | 加密一致性 + 子服务器认证 |
|
||||
| SECRET_KEY | 加密回退密钥 |
|
||||
| DATABASE_URL | 启动必需 |
|
||||
| ENCRYPTION_KEY | 凭据加密 |
|
||||
|
||||
| 可改项 | 说明 |
|
||||
|--------|------|
|
||||
| system_name/title | 前端显示 |
|
||||
| pool_size/overflow | 安装向导自动推荐 |
|
||||
| redis_url | Redis 连接 |
|
||||
| 告警阈值 | 默认 80% |
|
||||
| Telegram 配置 | 告警推送 |
|
||||
|
||||
## 关键文件速查
|
||||
|
||||
| 用途 | 文件路径 |
|
||||
|------|----------|
|
||||
| 后端入口 | server/main.py |
|
||||
| 数据模型 | server/domain/models/__init__.py |
|
||||
| JWT 认证 | server/api/auth_jwt.py |
|
||||
| 登录 API | server/api/auth.py |
|
||||
| WebSSH | server/api/webssh.py |
|
||||
| WebSocket | server/api/websocket.py |
|
||||
| 设置 CRUD | server/api/settings.py |
|
||||
| 服务器 CRUD | server/api/servers.py |
|
||||
| 快捷命令 | server/api/terminal.py |
|
||||
| Agent 心跳 | server/api/agent.py |
|
||||
| 同步引擎 | server/application/services/sync_engine_v2.py |
|
||||
| 前端入口 | frontend/src/main.ts |
|
||||
| 路由 | frontend/src/router/index.ts |
|
||||
| API 客户端 | frontend/src/api/index.ts |
|
||||
| Auth Store | frontend/src/stores/auth.ts |
|
||||
| 登录页 | frontend/src/pages/LoginPage.vue |
|
||||
| 终端页 | frontend/src/pages/TerminalPage.vue |
|
||||
| Vite 配置 | frontend/vite.config.mts |
|
||||
|
||||
## 已知待续事项（2026-06-01）
|
||||
|
||||
已修复：批量 Agent、JWT 60min+refresh、script-callback API Key、未知心跳丢弃、Admin 列迁移 — 见 `docs/changelog/2026-06-01-bug-remediation.md`。
|
||||
|
||||
| 优先级 | 问题 | 文件 |
|
||||
|--------|------|------|
|
||||
| P2 | 422 handler 是否精简 | server/main.py |
|
||||
| UX | 终端命令栏高亮对齐 | TerminalPage.vue |
|
||||
| 验收 | 告警/Telegram、WebSSH、Sync、三层守护 | 见 handoff §八 |
|
||||
|
||||
## 协作方式（单 Agent）
|
||||
|
||||
- 只与用户直接对话，不分派管理组/工程部/测试部/产品部/设计部，不自动加载 Skill 包。
|
||||
- 规范见 `.cursor/rules/no-department-agents.mdc`、`standards/`、`docs/design/`。
|
||||
|
||||
## 测试分工（强制）
|
||||
|
||||
**由 Agent 完成全部测试与修复验证；用户仅在 Agent 报告通过后做最终验收。**
|
||||
|
||||
Agent 在宣称「已修复 / 可交付」前必须自行完成（有证据：命令输出、生产 URL、浏览器抽测记录）：
|
||||
|
||||
1. 本地：`ruff` / `import server.main` / `frontend` type-check（若改前端）
|
||||
2. 能跑则跑：`pytest tests/` 或 `tests/test_api.py`
|
||||
3. 生产或 WSL：`/health`、`test_api`、关键页面浏览器验证
|
||||
4. 更新 `docs/changelog/` + 必要时 `docs/reports/*-verification.md`
|
||||
|
||||
**禁止**把「请你试一下」「请人工确认」当作交付终点；未验证不得让用户代测 bug 是否修好。
|
||||
|
||||
用户终验：Agent 提交「验收清单」后，用户做最后一遍业务确认即可。
|
||||
|
||||
## 用中文回复
|
||||
|
||||
@@ -1,40 +0,0 @@
|
||||
.git
|
||||
.gitignore
|
||||
.claude
|
||||
.cursor
|
||||
**/__pycache__
|
||||
**/*.pyc
|
||||
**/.pytest_cache
|
||||
**/.mypy_cache
|
||||
**/.ruff_cache
|
||||
.coverage
|
||||
htmlcov/
|
||||
|
||||
frontend/node_modules
|
||||
frontend-v2/node_modules
|
||||
frontend/dist
|
||||
node_modules
|
||||
.venv
|
||||
.venv-*
|
||||
venv
|
||||
.pytest_cache
|
||||
.ruff_cache
|
||||
.playwright-mcp
|
||||
2025.2
|
||||
=2025.2
|
||||
*.bak-
|
||||
|
||||
.env
|
||||
docker/.env
|
||||
docker/runtime
|
||||
tmp/
|
||||
|
||||
tests/
|
||||
docs/
|
||||
standards/
|
||||
*.md
|
||||
!docker/README.md
|
||||
|
||||
web/uploads
|
||||
backups/
|
||||
deploy/gate_log.jsonl
|
||||
@@ -1,16 +0,0 @@
|
||||
# EditorConfig — keep LF for code deployed to Ubuntu
|
||||
# https://editorconfig.org
|
||||
|
||||
root = true
|
||||
|
||||
[*]
|
||||
charset = utf-8
|
||||
end_of_line = lf
|
||||
insert_final_newline = true
|
||||
trim_trailing_whitespace = true
|
||||
|
||||
[*.{bat,cmd}]
|
||||
end_of_line = crlf
|
||||
|
||||
[*.md]
|
||||
trim_trailing_whitespace = false
|
||||
@@ -0,0 +1,63 @@
|
||||
# Nexus Environment Configuration
|
||||
# Copy this file to .env and modify values for your deployment.
|
||||
# Or run the web installer at /app/install.html to auto-generate this file.
|
||||
#
|
||||
# Generate secret keys: openssl rand -hex 32
|
||||
|
||||
# ── Brand ──
|
||||
NEXUS_SYSTEM_NAME=Nexus
|
||||
NEXUS_SYSTEM_TITLE=Nexus — 服务器运维管理平台
|
||||
|
||||
# ── Server ──
|
||||
NEXUS_HOST=0.0.0.0
|
||||
NEXUS_PORT=8600
|
||||
|
||||
# ── Deployment (auto-set by installer) ──
|
||||
NEXUS_DEPLOY_PATH=/opt/nexus
|
||||
# Comma-separated frontend origins for CORS
|
||||
NEXUS_CORS_ORIGINS=http://localhost:8600
|
||||
# Base URL for Agent heartbeat reporting
|
||||
NEXUS_API_BASE_URL=http://localhost:8600
|
||||
|
||||
# ── Database (MySQL, REQUIRED) ──
|
||||
NEXUS_DATABASE_URL=mysql+aiomysql://root:password@127.0.0.1:3306/nexus
|
||||
# Pool params: auto-calculated by installer from MySQL max_connections
|
||||
# Formula: pool_size = max(20, maxConn*0.4), overflow = max(20, maxConn*0.3)
|
||||
# Default below matches MySQL max_connections=400 (160+120=280 max)
|
||||
# install wizard will overwrite these with values tuned to your MySQL instance
|
||||
NEXUS_DB_POOL_SIZE=160
|
||||
NEXUS_DB_MAX_OVERFLOW=120
|
||||
|
||||
# ── Security (REQUIRED — generate with: openssl rand -hex 32) ──
|
||||
NEXUS_SECRET_KEY=change-me-use-openssl-rand-hex-32
|
||||
NEXUS_API_KEY=change-me-use-openssl-rand-hex-32
|
||||
NEXUS_ENCRYPTION_KEY=
|
||||
|
||||
# ── Redis (REQUIRED) ──
|
||||
NEXUS_REDIS_URL=redis://127.0.0.1:6379/0
|
||||
|
||||
# ── SSH ──
|
||||
NEXUS_SSH_STRICT_HOST_CHECKING=false
|
||||
|
||||
# ── Alert Thresholds (%) ──
|
||||
NEXUS_CPU_ALERT_THRESHOLD=80
|
||||
NEXUS_MEM_ALERT_THRESHOLD=80
|
||||
NEXUS_DISK_ALERT_THRESHOLD=80
|
||||
|
||||
# ── Health Check ──
|
||||
NEXUS_HEALTH_CHECK_INTERVAL=60
|
||||
|
||||
# ── Telegram Alerts (optional — configure in Settings UI) ──
|
||||
NEXUS_TELEGRAM_BOT_TOKEN=
|
||||
NEXUS_TELEGRAM_CHAT_ID=
|
||||
|
||||
# ── MySQL MCP (@yclenove/mysql-mcp-server — run: python scripts/sync_mysql_mcp_env.py) ──
|
||||
# Cursor 从项目根 .env 读取；与 NEXUS_DATABASE_URL 保持一致；默认只读
|
||||
# MYSQL_HOST=127.0.0.1
|
||||
# MYSQL_PORT=3306
|
||||
# MYSQL_USER=root
|
||||
# MYSQL_PASSWORD=password
|
||||
# MYSQL_DATABASE=nexus
|
||||
# MYSQL_READONLY=true # production / MCP read-only
|
||||
# MYSQL_READONLY=false # local dev: full DML/DDL via MCP
|
||||
# MYSQL_DATABASE_ALLOWLIST=nexus
|
||||
+5
-24
@@ -1,28 +1,9 @@
|
||||
# Line endings: Ubuntu production + bash scripts require LF in git.
|
||||
# Windows dev: set `git config core.autocrlf false` and rely on this file.
|
||||
|
||||
# Shell scripts must always use LF line endings (CRLF breaks bash execution on Linux)
|
||||
*.sh text eol=lf
|
||||
*.py text eol=lf
|
||||
*.vue text eol=lf
|
||||
*.ts text eol=lf
|
||||
*.mts text eol=lf
|
||||
*.mjs text eol=lf
|
||||
*.css text eol=lf
|
||||
*.scss text eol=lf
|
||||
*.html text eol=lf
|
||||
*.js text eol=lf
|
||||
*.json text eol=lf
|
||||
*.yaml text eol=lf
|
||||
*.yml text eol=lf
|
||||
*.toml text eol=lf
|
||||
*.ini text eol=lf
|
||||
*.sql text eol=lf
|
||||
*.md text eol=lf
|
||||
*.txt text eol=lf
|
||||
.env.example text eol=lf
|
||||
.gitattributes text eol=lf
|
||||
.editorconfig text eol=lf
|
||||
|
||||
# Python files should also use LF
|
||||
*.py text eol=lf
|
||||
|
||||
# Windows batch files keep CRLF
|
||||
*.bat text eol=crlf
|
||||
*.cmd text eol=crlf
|
||||
*.ps1 text eol=crlf
|
||||
|
||||
@@ -35,58 +35,18 @@ jobs:
|
||||
run: mypy server/ --ignore-missing-imports
|
||||
continue-on-error: true # Type errors don't block deployment yet
|
||||
|
||||
- name: Run fast tests with coverage
|
||||
- name: Run tests with coverage
|
||||
run: |
|
||||
coverage run -m pytest tests/ -m "not chain and not slow" -q --tb=short
|
||||
coverage run -m pytest tests/ -v --tb=short
|
||||
coverage report --fail-under=50
|
||||
coverage xml
|
||||
|
||||
- name: Run chain tests
|
||||
run: pytest tests/chain -m chain -q --tb=short
|
||||
continue-on-error: true
|
||||
|
||||
- name: Upload coverage report
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: coverage-report
|
||||
path: coverage.xml
|
||||
|
||||
# ── CI: E2E (main only, optional secrets) ──
|
||||
e2e:
|
||||
runs-on: ubuntu-latest
|
||||
needs: test
|
||||
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: "22"
|
||||
|
||||
- name: Install frontend dependencies
|
||||
working-directory: frontend
|
||||
run: npm ci
|
||||
|
||||
- name: Install Playwright Chromium
|
||||
working-directory: frontend
|
||||
run: npx playwright install chromium
|
||||
|
||||
- name: Run Playwright E2E
|
||||
working-directory: frontend
|
||||
env:
|
||||
NEXUS_E2E_BASE: ${{ secrets.NEXUS_E2E_BASE || 'http://127.0.0.1:8600' }}
|
||||
NEXUS_E2E_USER: ${{ secrets.NEXUS_E2E_USER || 'admin' }}
|
||||
NEXUS_E2E_PASSWORD: ${{ secrets.NEXUS_E2E_PASSWORD }}
|
||||
run: |
|
||||
if [ -z "$NEXUS_E2E_PASSWORD" ]; then
|
||||
echo "NEXUS_E2E_PASSWORD not set — skip E2E"
|
||||
exit 0
|
||||
fi
|
||||
npm run test:e2e
|
||||
continue-on-error: true
|
||||
|
||||
# ── CD: Deploy ──
|
||||
deploy:
|
||||
needs: test # Only deploy if tests pass
|
||||
|
||||
+5
-17
@@ -1,4 +1,4 @@
|
||||
# Nexus — Python
|
||||
# Nexus — Python
|
||||
__pycache__/
|
||||
*.py[cod]
|
||||
*$py.class
|
||||
@@ -11,12 +11,9 @@ build/
|
||||
.install_locked
|
||||
.install_state.json
|
||||
SECRETS.md
|
||||
.git-askpass-nexus.sh
|
||||
deploy/nexus-1panel.secrets.sh
|
||||
*.pem
|
||||
.env.*
|
||||
.venv/
|
||||
.venv-*/
|
||||
venv/
|
||||
ENV/
|
||||
|
||||
@@ -27,7 +24,6 @@ ENV/
|
||||
.megamemory/
|
||||
.playwright-mcp/
|
||||
frontend/test-results/
|
||||
frontend/e2e/.auth/
|
||||
tmp/
|
||||
|
||||
# IDE
|
||||
@@ -59,9 +55,9 @@ node_modules/
|
||||
web/css/tailwind-output.css
|
||||
|
||||
# Build output (Vite/Vuetify frontend)
|
||||
# SPA 构建产物纳入 Git，便于服务器 git pull 部署（见 deploy/deploy-frontend.sh）
|
||||
# 仍忽略本地临时文件
|
||||
web/app/assets/.tmp/
|
||||
# Vite outputs directly to web/app/ — ignore generated assets
|
||||
web/app/index.html
|
||||
web/app/assets/
|
||||
# Legacy dist dir (no longer used)
|
||||
**/dist/
|
||||
|
||||
@@ -71,20 +67,12 @@ web/uploads/
|
||||
# Data (sensitive)
|
||||
web/data/config.php
|
||||
web/data/*.db
|
||||
web/data/1panel-hosts.json
|
||||
|
||||
# Backups
|
||||
backups/
|
||||
|
||||
# Docker local secrets
|
||||
docker/.env
|
||||
docker/.env.prod
|
||||
!docker/.env.example
|
||||
!docker/.env.prod.example
|
||||
scripts/npm-proxy.env
|
||||
|
||||
# Deploy
|
||||
deploy/*.key
|
||||
|
||||
# Backups
|
||||
backups/
|
||||
backups/
|
||||
@@ -1,31 +0,0 @@
|
||||
---
|
||||
name: nexus-btpanel-review
|
||||
description: Use when reviewing or changing Nexus BT/宝塔 panel integration, one-click login, API bootstrap, session keepalive fixes, or BT credential handling.
|
||||
---
|
||||
|
||||
# Nexus BT Panel Review
|
||||
|
||||
Use for 宝塔/BT panel integration changes.
|
||||
|
||||
## Call chain to map
|
||||
|
||||
API one-click login -> btpanel_service -> BT API credential lookup/bootstrap -> SSH bootstrap if needed -> login URL/tmp_token -> panel session behavior.
|
||||
|
||||
## Required checks
|
||||
|
||||
- Do not log or return BT API keys, session cookies, temporary login tokens, SSH private keys, or passwords.
|
||||
- One-click login should fail closed for real authentication errors, but best-effort environment repair must not block login unless required for correctness.
|
||||
- Session keepalive/cleanup repair must be idempotent and throttled; do not restart or rewrite BT panel aggressively without explicit approval.
|
||||
- Respect existing BT panel services and ports. Do not occupy panel, nginx, redis, or mysql ports.
|
||||
- Old servers with existing BT API credentials must still receive the session-cleanup TTL check before login.
|
||||
- Record bootstrap state without storing secrets.
|
||||
|
||||
## Regression tests
|
||||
|
||||
Cover:
|
||||
|
||||
- Existing credentials still trigger throttled TTL check.
|
||||
- Missing SSH auth does not block login URL generation.
|
||||
- Failed repair is throttled and retried later.
|
||||
- Temporary login token TTL remains bounded.
|
||||
- No secret values appear in returned bootstrap/status payloads.
|
||||
@@ -1,40 +0,0 @@
|
||||
---
|
||||
name: nexus-security-review
|
||||
description: Use when reviewing or changing Nexus backend/API/security-sensitive code. Focuses on FastAPI admin APIs, SQLAlchemy data access, SSH operations, file manager boundaries, logging redaction, and regression tests.
|
||||
---
|
||||
|
||||
# Nexus Security Review
|
||||
|
||||
Use this skill before changing Nexus backend/API code or doing a security pass.
|
||||
|
||||
## Required workflow
|
||||
|
||||
1. Identify entrypoints: FastAPI router, service method, DB model/session, Redis/lock usage, SSH/BT panel call.
|
||||
2. Draw the request path in notes: API -> schema -> service -> DB/Redis/SSH/external.
|
||||
3. Check auth first: admin-only endpoints must depend on the current admin dependency; background/admin tools must still preserve audit logs.
|
||||
4. Validate every user-controlled value at the schema/API boundary and again before shell/path-sensitive sinks.
|
||||
5. For every fix, add pytest coverage for the dangerous case and the allowed case.
|
||||
6. Run focused tests, then full pytest when practical, then git diff --check.
|
||||
7. Update the Nexus Markdown report with changed files, tests, and residual risks.
|
||||
|
||||
## Nexus-specific rules
|
||||
|
||||
- Do not print secrets: passwords, SSH keys, tokens, cookies, API keys, .env values, BT panel credentials.
|
||||
- script_service is an intentional administrator remote shell. Do not report arbitrary shell execution there as a vulnerability. Review only auth, audit trail, timeout, output truncation, and redaction.
|
||||
- File manager APIs must not unexpectedly operate outside the target path/server chosen by the admin UI.
|
||||
- Any remote shell command must use shlex.quote; add -- where command options can be confused with filenames.
|
||||
- Archive extraction must list and validate members before extraction; reject absolute paths, .., backslashes, and special file types.
|
||||
- Error responses must not expose stack traces or secrets.
|
||||
- DB access should use SQLAlchemy parameters/query builder, not raw string interpolation.
|
||||
|
||||
## Review output
|
||||
|
||||
For each finding record:
|
||||
|
||||
- Severity: Critical/High/Medium/Low/Hardening
|
||||
- Call chain
|
||||
- Evidence file/function
|
||||
- Exploit or failure boundary
|
||||
- Fix summary
|
||||
- Test command/result
|
||||
- Commit hash if committed
|
||||
@@ -1,29 +0,0 @@
|
||||
---
|
||||
name: nexus-ssh-safety
|
||||
description: Use when reviewing or editing Nexus code that executes commands on managed servers over SSH, including file manager, transfer, archive, agent install, and BT panel bootstrap flows.
|
||||
---
|
||||
|
||||
# Nexus SSH Safety
|
||||
|
||||
Use for any Nexus feature that builds shell commands or transfers files over SSH.
|
||||
|
||||
## Command construction rules
|
||||
|
||||
- Prefer argument arrays/local library APIs when available; otherwise quote every dynamic shell token with shlex.quote.
|
||||
- Insert -- before filename/path operands for commands that parse options:
|
||||
m, mv, cp, ar, zip, chmod, chown, etc.
|
||||
- Never concatenate unquoted user input into shell command strings.
|
||||
- Keep timeouts explicit for network/SSH work; avoid unbounded commands.
|
||||
- Truncate or sanitize command output before returning it to API clients.
|
||||
- Do not log secrets or full credential-bearing URLs.
|
||||
|
||||
## Path and archive rules
|
||||
|
||||
- Normalize paths with POSIX semantics for remote Linux paths.
|
||||
- Reject empty paths where dangerous, root/system paths for recursive destructive operations, and traversal where the feature expects a bounded directory.
|
||||
- Archive creation must protect member names beginning with -.
|
||||
- Archive extraction must validate member names and types before extraction.
|
||||
- Temporary files/directories must be unique and cleaned best-effort.
|
||||
|
||||
## script_service exception
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
Collecting tzdata
|
||||
Downloading tzdata-2026.2-py2.py3-none-any.whl.metadata (1.4 kB)
|
||||
Downloading tzdata-2026.2-py2.py3-none-any.whl (349 kB)
|
||||
Installing collected packages: tzdata
|
||||
Successfully installed tzdata-2026.2
|
||||
@@ -1,96 +1,180 @@
|
||||
# Nexus 6.0 — Agent 入口（薄 stub）
|
||||
# Nexus 6.0 — Project Memory
|
||||
|
||||
> **长文 SSOT**: [docs/project/nexus-functional-development-guide.md](docs/project/nexus-functional-development-guide.md) + [附录](docs/project/nexus-functional-development-guide-appendix.md)
|
||||
> **会话接续**: [docs/project/AI-HANDOFF-2026-06-03.md](docs/project/AI-HANDOFF-2026-06-03.md)
|
||||
> **文档总索引**: [docs/README.md](docs/README.md)
|
||||
## 项目概述
|
||||
Nexus 是一个 2000+ 服务器运维管理平台，从旧的 MultiSync (PHP + AdminLTE + pymysql) 完全重构为 Clean Architecture (FastAPI + Async SQLAlchemy + Redis + WebSocket + Telegram)。前端已全面迁移到 Tailwind CSS v4 + Alpine.js，PHP 依赖已移除。
|
||||
|
||||
## 项目概要
|
||||
## 仓库结构
|
||||
- **唯一仓库**: Nexus (Gitea, 仓库地址在 .env 中配置)
|
||||
- **不再使用** multi-server-sync 仓库（旧项目，仅保留历史）
|
||||
- **部署路径**: 由 `NEXUS_DEPLOY_PATH` 环境变量决定（安装向导自动写入 .env）
|
||||
- **域名/CORS**: 由 `NEXUS_CORS_ORIGINS` 环境变量决定（安装向导自动写入）
|
||||
|
||||
Nexus：2000+ 子机运维平台。后端 FastAPI + MySQL + Redis；前端 **Vue 3 + Vuetify 4 + TypeScript SPA**（15 页，`frontend/src/pages/`）；构建输出 `web/app/`；安装向导 `web/app/install.html`。
|
||||
|
||||
## 本地开发
|
||||
|
||||
```bash
|
||||
docker compose up -d mysql redis
|
||||
bash scripts/start-dev.sh # API :8600
|
||||
bash scripts/local_verify.sh # L2b
|
||||
cd frontend && npm run dev # :3000/app/
|
||||
## 目录结构 (仓库根目录)
|
||||
```
|
||||
Nexus/
|
||||
├── server/ ← Python FastAPI后端 (Clean Architecture 4层)
|
||||
│ ├── api/ ← API路由 (含 install.py 安装向导API)
|
||||
│ ├── domain/ ← SQLAlchemy模型 (14张表)
|
||||
│ ├── infrastructure/← SSH连接池 + Redis + Telegram
|
||||
│ ├── background/ ← 后台任务 (心跳刷新/自检/调度/重试)
|
||||
│ └── config.py ← Pydantic Settings + MySQL覆盖
|
||||
├── web/app/ ← Tailwind+Alpine.js 纯静态前端 (12个HTML页面)
|
||||
│ ├── install.html ← 安装向导 (5步)
|
||||
│ ├── login.html ← JWT登录+TOTP双因素
|
||||
│ └── ... ← index/servers/files/push/scripts等
|
||||
├── deploy/ ← Supervisor配置 + Shell健康检查脚本
|
||||
├── docs/ ← 项目文档
|
||||
├── tests/ ← 测试
|
||||
├── .env ← NOT IN GIT (安装向导生成)
|
||||
└── requirements.txt ← Python依赖
|
||||
```
|
||||
|
||||
路径见 [linux-dev-paths.md](docs/project/linux-dev-paths.md)。
|
||||
## 启动模式
|
||||
- **安装模式** (无 .env): 仅 `/api/install/` + 静态文件可用，其他路由返回503
|
||||
- **正常模式** (有 .env): 完整初始化 DB/Redis/后台任务
|
||||
|
||||
## Git（仅本机快照）
|
||||
## 实现原则（强制）
|
||||
|
||||
- 本地 `git commit` 用于回滚；**不 `git push`**（除非你明确要求）。
|
||||
- 已移除 `origin` 跟踪，避免误推；原远程：`http://66.154.115.8:3000/admin/Nexus.git`（需恢复时说一声）。
|
||||
- `.env`、`SECRETS.md`、`*.pem` 已在 `.gitignore`，**勿提交**。
|
||||
- 改代码仍写 `docs/changelog/YYYY-MM-DD-*.md`（≥10 行）。
|
||||
- 用户说「提交快照 / commit」时执行。
|
||||
**所有设计和实现都必须是完美实现。** 详见 `.cursor/rules/perfect-implementation.mdc`。
|
||||
|
||||
## 强制约束
|
||||
| 禁止 | 要求 |
|
||||
|------|------|
|
||||
| 为实现而实现、降级、妥协、技术债（TODO/FIXME 延后） | 每一变更达到安全/架构/质量标准 |
|
||||
| 无法完美实现时擅自从权换方案 | 停下与用户沟通，确认后再换方案 |
|
||||
| 无文档直接开发 | 设计文档 → 技术文档 → 代码 |
|
||||
| 改代码不写 changelog | 每次修改记录到 `docs/changelog/YYYY-MM-DD-*.md` |
|
||||
|
||||
- 完美实现：`.cursor/rules/perfect-implementation.mdc`
|
||||
- 安全 / 后端 / 前端：`.cursor/rules/nexus-*.mdc`
|
||||
- 改代码必 `docs/changelog/YYYY-MM-DD-*.md`（≥10 行）
|
||||
- 测试由 Agent 完成；用户只做终验
|
||||
文档路径：设计 `docs/design/specs/` · 技术 `docs/design/plans/` 或 `docs/reports/` · 变更 `docs/changelog/`
|
||||
|
||||
## 不可改
|
||||
## AI 接续与标准（切换会话必读）
|
||||
|
||||
`API_KEY` · `SECRET_KEY` · `ENCRYPTION_KEY` · `DATABASE_URL`
|
||||
| 文档 | 路径 |
|
||||
|------|------|
|
||||
| 接续 SSOT | `docs/project/AI-HANDOFF-2026-05-23.md` |
|
||||
| **标准转接包（全量）** | `docs/project/standards-transfer-package.md` |
|
||||
| 验收 L0～L5 | `docs/project/development-acceptance-standard.md` |
|
||||
| 系统开发 / 逐行审计 | `standards/system-development-standard.md`、`standards/line-walk-audit-standard-v2.md`、`standards/audit-core-principles.md` |
|
||||
|
||||
## 部署
|
||||
逐行审查与开发规范**同等强制**（8 步、Closure 全表、FINDING 须 `文件:行号`、单回复 ≤5 文件）。
|
||||
|
||||
默认 **本机 rsync → SSH 生产机**（不 push Gitea）：
|
||||
## Cursor 规则与 MCP
|
||||
|
||||
```bash
|
||||
bash deploy/pre_deploy_check.sh
|
||||
bash deploy/deploy-production.sh # rsync + Docker upgrade --skip-git + 前端
|
||||
- 规则：`.cursor/rules/`（`perfect-implementation` + `nexus-*` + `audit-line-review` + `no-department-agents`）
|
||||
- 不安装项目级 Skill 包（已移除 superpowers-zh）；TDD/调试/验收按 `standards/` 由 Agent 直接执行
|
||||
- MySQL MCP：`docs/project/mysql-mcp-setup.md` · 配置后运行 `python scripts/sync_mysql_mcp_env.py`
|
||||
|
||||
## 已确认的关键决策
|
||||
|
||||
| 决策 | 选择 | 原因 |
|
||||
|------|------|------|
|
||||
| API_KEY | ❌ 禁改，UI不显示 | 加密一致性 + 子服务器认证 |
|
||||
| SECRET_KEY | ❌ 禁改 | 加密回退密钥 |
|
||||
| DATABASE_URL | ❌ 禁改 | 启动必需 |
|
||||
| system_name/title | ✅ 可改 | 前端显示 |
|
||||
| pool_size/overflow | ✅ 可改 | 安装向导自动推荐 |
|
||||
| redis_url | ✅ 可改 | Redis连接 |
|
||||
| 告警阈值 (CPU/mem/disk) | ✅ 可改 | 监控参数 (默认80%) |
|
||||
| Telegram配置 | ✅ 可改 | 告警推送 |
|
||||
| Agent心跳间隔 | 60s | 不太频繁 |
|
||||
| Redis→MySQL刷新 | 10min | 降低MySQL负载 |
|
||||
| 心跳数据流 | Agent→Redis→前端直读→10min→MySQL | 前端实时, MySQL只存历史 |
|
||||
| 告警推送 | WebSocket→前端 + Telegram | 即时感知 |
|
||||
| Python守护 | 3层: Supervisor + Python自检(30s) + Shell(cron 1min) | 全覆盖 |
|
||||
| 安装向导 | install.html + FastAPI API | 纯Python，无PHP依赖 |
|
||||
| 配置源 | 安装向导→config.json+settings表(MySQL)+.env(Python) | 三写一致 |
|
||||
| Agent告警心跳 | CPU/内存>80% 或变化>10% 时主动上报 | 智能监控 |
|
||||
| 仓库统一 | 所有代码统一在Nexus仓库 | 不再用两个仓库 |
|
||||
|
||||
## 实现状态 (Phase A+B+C+D+E) — ~99% 完成
|
||||
|
||||
### ✅ 已完成 (全部6步 + 技术债务 + UX增强)
|
||||
| 模块 | 文件 | 说明 |
|
||||
|------|------|------|
|
||||
| **Step 0: 基础设施** | | Redis + WebSocket |
|
||||
| E1 WebSocket推送 | server/api/websocket.py | alert/recovery/system broadcast |
|
||||
| E2 心跳→Redis+告警 | server/api/agent.py | Redis write + threshold detection |
|
||||
| E3 Redis→MySQL刷新 | server/background/heartbeat_flush.py | 10min batch |
|
||||
| **Step 1: 数据层** | | 14张表 |
|
||||
| E4 load_settings_from_db | server/config.py | MySQL overrides mutable settings |
|
||||
| **Step 2: 认证层** | | JWT + TOTP |
|
||||
| **Step 3: Web SSH** | | asyncssh + xterm.js |
|
||||
| E5 asyncssh连接池 | server/infrastructure/ssh/asyncssh_pool.py | 引用计数模式 |
|
||||
| E6 WebSSH前端 | web/app/terminal.html | xterm.js + Koko协议 + 自动resize |
|
||||
| **Step 4: Sync引擎** | | 4种同步模式 |
|
||||
| **Step 5: 前端迁移** | | Tailwind+Alpine.js |
|
||||
| E7 13个前端页面 | web/app/*.html | 含install.html安装向导 |
|
||||
| E8 安装向导API | server/api/install.py | 6端点, 无JWT, 临时引擎 |
|
||||
| E9 条件启动模式 | server/main.py | 无.env=安装模式 |
|
||||
| **后台任务** | | |
|
||||
| E10 Python自检 | server/background/self_monitor.py | 30s loop |
|
||||
| E11 Telegram推送 | server/infrastructure/telegram/__init__.py | alert/recovery/system |
|
||||
| E12 /health端点 | server/api/health.py | Shell health_monitor.sh checks this |
|
||||
| **技术债务** | | |
|
||||
| D1 ✅ paramiko删除 | — | pool.py已删除, 全部迁移asyncssh |
|
||||
| D2 ✅ install迁移 | server/api/install.py | PHP→install.html+API |
|
||||
| D3 ✅ WebSSH前端 | web/app/terminal.html | xterm.js+Koko协议+全屏 |
|
||||
| **安全增强** | | |
|
||||
| S1 JWT全局保护 | server/api/*.py | 所有业务API都有JWT验证 |
|
||||
| S2 审计日志 | server/api/*.py | 所有CUD操作记录审计日志 |
|
||||
| S3 登录防暴破 | server/application/services/auth_service.py | 失败计数+15min锁定+429状态码 |
|
||||
| **前端UX增强** | | |
|
||||
| UX1 共享布局 | web/app/layout.js | 11页面统一侧边栏+全局搜索+用户信息 |
|
||||
| UX2 Toast通知 | web/app/api.js | 全局toast()函数，4种类型 |
|
||||
| UX3 全局搜索 | server/api/search.py | 跨服务器/脚本/凭据/调度搜索 |
|
||||
| UX4 服务器详情 | web/app/servers.html | 点击展开详情面板(系统信息/同步日志/SSH会话) |
|
||||
| UX5 脚本编辑 | web/app/scripts.html | 点击脚本名编辑+执行结果格式化 |
|
||||
| UX6 推送增强 | web/app/push.html | 逐服务器状态+进度条+推送历史 |
|
||||
| UX7 审计分页 | web/app/audit.html | 分页控件+操作过滤+每页50条 |
|
||||
| UX8 重试操作 | web/app/retries.html | 手动重试+删除按钮+状态过滤 |
|
||||
| UX9 文件浏览 | web/app/files.html | 面包屑导航+目录排序+父目录链接 |
|
||||
| UX10 登录安全 | web/app/login.html | 密码可见切换+失败计数+429锁定+shake动画 |
|
||||
| **P1功能补全** | | |
|
||||
| P1-1 资产管理 | web/app/assets.html | Platform/Node管理页面 |
|
||||
| P1-2 服务器表单 | web/app/servers.html | 补全platform/node/protocols字段 |
|
||||
| P1-3 Push对接 | web/app/push.html + sync_v2.py | target_path对接+统一SyncEngineV2 |
|
||||
| P1-4 安全设置 | web/app/settings.html | TOTP QR码+修改密码+API Key复制 |
|
||||
| P1-5 WebSSH授权 | server/api/webssh.py | SSH凭据验证+4003关闭码+审计 |
|
||||
| P1-6 Agent认证 | server/api/agent.py | 每服务器API Key + 全局回退 |
|
||||
| P1-7 Config去重 | server/application/services/sync_engine_v2.py | sed去重+备份+_rollback_config() |
|
||||
| **P2安全增强** | | |
|
||||
| P2-1 告警防抖 | server/api/websocket.py | 5分钟冷却+Telegram去重+恢复重置 |
|
||||
| P2-2 命令日志 | web/app/commands.html | 命令/会话双视图+服务器过滤+危险命令高亮 |
|
||||
| P2-3 DB分页 | server/infrastructure/database/server_repo.py | DB层offset/limit+count |
|
||||
| P2-4 Dashboard实时 | web/app/index.html | WS触发stats刷新+声音+标签页闪烁 |
|
||||
| P2-5 移动适配 | web/app/layout.js | <768px侧边栏overlay+backdrop+表格滚动 |
|
||||
| P2-6 会话安全 | server/api/auth_jwt.py + api.js | 8小时超时+JWT updated_at+刷新重用检测 |
|
||||
| P2-7 凭据加密 | server/api/servers.py | Server.password/ssh_key_private Fernet加密存储 |
|
||||
| P2-8 凭据脱敏 | server/api/scripts.py + servers.py | API响应不返回密码，password_set布尔标记 |
|
||||
| P2-9 DB备份 | deploy/db_backup.sh | mysqldump+30天保留+cron集成 |
|
||||
|
||||
### 🔄 待测试
|
||||
- T1: 心跳Redis写入验证
|
||||
- T2: WebSocket连接测试
|
||||
- T3: 3层守护测试 (kill Python→Supervisor重启)
|
||||
- T4: Telegram推送测试
|
||||
- T5: install.html 5步流程测试
|
||||
|
||||
### 测试流程 (用户确认)
|
||||
1. WSL本地基础测试 → 2. 推到仓库 → 3. 外网服务器正式测试
|
||||
|
||||
## 配置三写机制
|
||||
安装向导 Step 3 POST处理同时写入：
|
||||
1. `web/data/config.json` — 共享配置 (API_BASE_URL, DB_*, API_KEY)
|
||||
2. `.env` — Python后端启动必需 (NEXUS_前缀)
|
||||
3. `settings` MySQL表 — 共享动态配置 (api_key, thresholds, Telegram等)
|
||||
|
||||
不可改项 (SECRET_KEY/API_KEY/ENCRYPTION_KEY/DATABASE_URL) 不在MySQL覆盖映射中。
|
||||
|
||||
## 3层守护机制
|
||||
- **Layer 1**: Supervisor — Python崩溃自动重启
|
||||
- **Layer 2**: Python self_monitor — 每30s检查Redis/MySQL/WebSocket
|
||||
- **Layer 3**: Shell health_monitor.sh — 每分钟HTTP GET /health, 连续3次失败→supervisorctl restart + Telegram
|
||||
|
||||
## 数据流
|
||||
```
|
||||
|
||||
可选：`NEXUS_DEPLOY_VIA_GIT=1` 恢复远程 `git pull`。仅 `git push` 当你明确要求时。
|
||||
|
||||
详情见功能指南 §17–18。
|
||||
|
||||
## 归档文档
|
||||
|
||||
历史审计合并卷：`docs/archive/README.md`
|
||||
|
||||
## 代码地图（Agent 先读这里，勿全库搜）
|
||||
|
||||
Agent心跳(60s) → Redis(实时) → 前端直读 → 10min批量 → MySQL(历史)
|
||||
告警: CPU/mem/disk > threshold → WebSocket推送浏览器 + Telegram推送手机
|
||||
恢复: 之前告警的指标恢复正常 → 自动推送恢复通知
|
||||
Redis心跳key: heartbeat:{server_id} (HSET, TTL=600s)
|
||||
Redis告警key: alerts:{server_id} (SET, TTL=3600s)
|
||||
```
|
||||
server/main.py # 路由挂载入口
|
||||
server/config.py # 配置（.env + settings 表）
|
||||
server/api/*.py # HTTP/WebSocket 路由（按模块拆分）
|
||||
server/application/ # 业务 services
|
||||
server/infrastructure/ # DB / Redis / SSH / Telegram
|
||||
server/domain/models/ # SQLAlchemy ORM
|
||||
frontend/src/pages/ # Vue 页面（15 页 SPA）
|
||||
frontend/src/router/ # Hash 路由 #/
|
||||
frontend/src/api/ # 前端 API 客户端
|
||||
frontend/e2e/ # Playwright 验收
|
||||
tests/test_*.py # pytest
|
||||
docs/project/ # 功能/部署 SSOT
|
||||
deploy/ # 生产部署脚本
|
||||
scripts/ # 本地验证、MCP、门控
|
||||
.cursor/mcp.json # mysql-mcp
|
||||
```
|
||||
|
||||
## 问题 → 文件（常见锚点）
|
||||
|
||||
| 问什么 | 先看 |
|
||||
|--------|------|
|
||||
| 某 API 怎么实现 | `server/main.py` 找 router → `server/api/<模块>.py` |
|
||||
| 服务器列表/搜索/exec | `server/api/servers.py`, `server/api/scripts.py` |
|
||||
| 认证/JWT | `server/api/auth.py`, `server/api/dependencies.py` |
|
||||
| Agent 心跳/安装 | `server/api/agent.py` |
|
||||
| WebSSH/终端 | `server/api/webssh.py`, `server/api/terminal.py` |
|
||||
| 同步/文件/搜索 | `server/api/sync_v2.py`, `files.py`, `search.py` |
|
||||
| 设置/审计/告警 | `server/api/settings.py` |
|
||||
| 前端某页 UI | `frontend/src/router/index.ts` → `frontend/src/pages/` |
|
||||
| MySQL MCP | `.cursor/mcp.json`, `scripts/linux_mcp_mysql.sh` |
|
||||
| 本地开发路径 | `docs/project/linux-dev-paths.md` |
|
||||
| 14 页/API 全览 | `docs/project/nexus-functional-development-guide.md` §9–10 |
|
||||
|
||||
## 探索规则（省 token）
|
||||
|
||||
详见 `.cursor/rules/agent-exploration.mdc`。要点：**先地图再 Grep（带 path）→ Read ≤5 个文件 → 停止**。
|
||||
|
||||
@@ -1,28 +1,278 @@
|
||||
# Nexus 6.0 — Agent 入口（薄 stub）
|
||||
# Nexus 6.0 — Project Memory
|
||||
|
||||
> 与 [AGENTS.md](AGENTS.md) 相同入口；长文见 [docs/project/nexus-functional-development-guide.md](docs/project/nexus-functional-development-guide.md)。
|
||||
## 项目概述
|
||||
Nexus 是一个 2000+ 服务器运维管理平台，从旧的 MultiSync (PHP + AdminLTE + pymysql) 完全重构为 Clean Architecture (FastAPI + Async SQLAlchemy + Redis + WebSocket + Telegram)。前端已全面迁移到 Tailwind CSS v4 + Alpine.js，PHP 依赖已移除。
|
||||
|
||||
## 快速链接
|
||||
## 仓库结构
|
||||
- **唯一仓库**: Nexus (Gitea, 仓库地址在 .env 中配置)
|
||||
- **不再使用** multi-server-sync 仓库（旧项目，仅保留历史）
|
||||
- **部署路径**: 由 `NEXUS_DEPLOY_PATH` 环境变量决定（安装向导自动写入 .env）
|
||||
- **域名/CORS**: 由 `NEXUS_CORS_ORIGINS` 环境变量决定（安装向导自动写入）
|
||||
|
||||
| 用途 | 路径 |
|
||||
## 目录结构 (仓库根目录)
|
||||
```
|
||||
Nexus/
|
||||
├── server/ ← Python FastAPI后端 (Clean Architecture 4层)
|
||||
│ ├── api/ ← API路由 (含 install.py 安装向导API)
|
||||
│ ├── domain/ ← SQLAlchemy模型 (14张表)
|
||||
│ ├── infrastructure/← SSH连接池 + Redis + Telegram
|
||||
│ ├── background/ ← 后台任务 (心跳刷新/自检/调度/重试)
|
||||
│ └── config.py ← Pydantic Settings + MySQL覆盖
|
||||
├── web/app/ ← Tailwind+Alpine.js 纯静态前端 (12个HTML页面)
|
||||
│ ├── install.html ← 安装向导 (5步)
|
||||
│ ├── login.html ← JWT登录+TOTP双因素
|
||||
│ └── ... ← index/servers/files/push/scripts等
|
||||
├── deploy/ ← Supervisor配置 + Shell健康检查脚本
|
||||
├── docs/ ← 项目文档
|
||||
├── tests/ ← 测试
|
||||
├── .env ← NOT IN GIT (安装向导生成)
|
||||
└── requirements.txt ← Python依赖
|
||||
```
|
||||
|
||||
## 启动模式
|
||||
- **安装模式** (无 .env): 仅 `/api/install/` + 静态文件可用，其他路由返回503
|
||||
- **正常模式** (有 .env): 完整初始化 DB/Redis/后台任务
|
||||
|
||||
## 已确认的关键决策
|
||||
|
||||
| 决策 | 选择 | 原因 |
|
||||
|------|------|------|
|
||||
| API_KEY | ❌ 禁改，UI不显示 | 加密一致性 + 子服务器认证 |
|
||||
| SECRET_KEY | ❌ 禁改 | 加密回退密钥 |
|
||||
| DATABASE_URL | ❌ 禁改 | 启动必需 |
|
||||
| system_name/title | ✅ 可改 | 前端显示 |
|
||||
| pool_size/overflow | ✅ 可改 | 安装向导自动推荐 |
|
||||
| redis_url | ✅ 可改 | Redis连接 |
|
||||
| 告警阈值 (CPU/mem/disk) | ✅ 可改 | 监控参数 (默认80%) |
|
||||
| Telegram配置 | ✅ 可改 | 告警推送 |
|
||||
| Agent心跳间隔 | 60s | 不太频繁 |
|
||||
| Redis→MySQL刷新 | 10min | 降低MySQL负载 |
|
||||
| 心跳数据流 | Agent→Redis→前端直读→10min→MySQL | 前端实时, MySQL只存历史 |
|
||||
| 告警推送 | WebSocket→前端 + Telegram | 即时感知 |
|
||||
| Python守护 | 3层: Supervisor + Python自检(30s) + Shell(cron 1min) | 全覆盖 |
|
||||
| 安装向导 | install.html + FastAPI API | 纯Python，无PHP依赖 |
|
||||
| 配置源 | 安装向导→config.json+settings表(MySQL)+.env(Python) | 三写一致 |
|
||||
| Agent告警心跳 | CPU/内存>80% 或变化>10% 时主动上报 | 智能监控 |
|
||||
| 仓库统一 | 所有代码统一在Nexus仓库 | 不再用两个仓库 |
|
||||
|
||||
## 实现状态 (Phase A+B+C+D+E) — ~99% 完成
|
||||
|
||||
### ✅ 已完成 (全部6步 + 技术债务 + UX增强)
|
||||
| 模块 | 文件 | 说明 |
|
||||
|------|------|------|
|
||||
| **Step 0: 基础设施** | | Redis + WebSocket |
|
||||
| E1 WebSocket推送 | server/api/websocket.py | alert/recovery/system broadcast |
|
||||
| E2 心跳→Redis+告警 | server/api/agent.py | Redis write + threshold detection |
|
||||
| E3 Redis→MySQL刷新 | server/background/heartbeat_flush.py | 10min batch |
|
||||
| **Step 1: 数据层** | | 14张表 |
|
||||
| E4 load_settings_from_db | server/config.py | MySQL overrides mutable settings |
|
||||
| **Step 2: 认证层** | | JWT + TOTP |
|
||||
| **Step 3: Web SSH** | | asyncssh + xterm.js |
|
||||
| E5 asyncssh连接池 | server/infrastructure/ssh/asyncssh_pool.py | 引用计数模式 |
|
||||
| E6 WebSSH前端 | web/app/terminal.html | xterm.js + Koko协议 + 自动resize |
|
||||
| **Step 4: Sync引擎** | | 4种同步模式 |
|
||||
| **Step 5: 前端迁移** | | Tailwind+Alpine.js |
|
||||
| E7 13个前端页面 | web/app/*.html | 含install.html安装向导 |
|
||||
| E8 安装向导API | server/api/install.py | 6端点, 无JWT, 临时引擎 |
|
||||
| E9 条件启动模式 | server/main.py | 无.env=安装模式 |
|
||||
| **后台任务** | | |
|
||||
| E10 Python自检 | server/background/self_monitor.py | 30s loop |
|
||||
| E11 Telegram推送 | server/infrastructure/telegram/__init__.py | alert/recovery/system |
|
||||
| E12 /health端点 | server/api/health.py | Shell health_monitor.sh checks this |
|
||||
| **技术债务** | | |
|
||||
| D1 ✅ paramiko删除 | — | pool.py已删除, 全部迁移asyncssh |
|
||||
| D2 ✅ install迁移 | server/api/install.py | PHP→install.html+API |
|
||||
| D3 ✅ WebSSH前端 | web/app/terminal.html | xterm.js+Koko协议+全屏 |
|
||||
| **安全增强** | | |
|
||||
| S1 JWT全局保护 | server/api/*.py | 所有业务API都有JWT验证 |
|
||||
| S2 审计日志 | server/api/*.py | 所有CUD操作记录审计日志 |
|
||||
| S3 登录防暴破 | server/application/services/auth_service.py | 失败计数+15min锁定+429状态码 |
|
||||
| **前端UX增强** | | |
|
||||
| UX1 共享布局 | web/app/layout.js | 11页面统一侧边栏+全局搜索+用户信息 |
|
||||
| UX2 Toast通知 | web/app/api.js | 全局toast()函数，4种类型 |
|
||||
| UX3 全局搜索 | server/api/search.py | 跨服务器/脚本/凭据/调度搜索 |
|
||||
| UX4 服务器详情 | web/app/servers.html | 点击展开详情面板(系统信息/同步日志/SSH会话) |
|
||||
| UX5 脚本编辑 | web/app/scripts.html | 点击脚本名编辑+执行结果格式化 |
|
||||
| UX6 推送增强 | web/app/push.html | 逐服务器状态+进度条+推送历史 |
|
||||
| UX7 审计分页 | web/app/audit.html | 分页控件+操作过滤+每页50条 |
|
||||
| UX8 重试操作 | web/app/retries.html | 手动重试+删除按钮+状态过滤 |
|
||||
| UX9 文件浏览 | web/app/files.html | 面包屑导航+目录排序+父目录链接 |
|
||||
| UX10 登录安全 | web/app/login.html | 密码可见切换+失败计数+429锁定+shake动画 |
|
||||
| **P1功能补全** | | |
|
||||
| P1-1 资产管理 | web/app/assets.html | Platform/Node管理页面 |
|
||||
| P1-2 服务器表单 | web/app/servers.html | 补全platform/node/protocols字段 |
|
||||
| P1-3 Push对接 | web/app/push.html + sync_v2.py | target_path对接+统一SyncEngineV2 |
|
||||
| P1-4 安全设置 | web/app/settings.html | TOTP QR码+修改密码+API Key复制 |
|
||||
| P1-5 WebSSH授权 | server/api/webssh.py | SSH凭据验证+4003关闭码+审计 |
|
||||
| P1-6 Agent认证 | server/api/agent.py | 每服务器API Key + 全局回退 |
|
||||
| P1-7 Config去重 | server/application/services/sync_engine_v2.py | sed去重+备份+_rollback_config() |
|
||||
| **P2安全增强** | | |
|
||||
| P2-1 告警防抖 | server/api/websocket.py | 5分钟冷却+Telegram去重+恢复重置 |
|
||||
| P2-2 命令日志 | web/app/commands.html | 命令/会话双视图+服务器过滤+危险命令高亮 |
|
||||
| P2-3 DB分页 | server/infrastructure/database/server_repo.py | DB层offset/limit+count |
|
||||
| P2-4 Dashboard实时 | web/app/index.html | WS触发stats刷新+声音+标签页闪烁 |
|
||||
| P2-5 移动适配 | web/app/layout.js | <768px侧边栏overlay+backdrop+表格滚动 |
|
||||
| P2-6 会话安全 | server/api/auth_jwt.py + api.js | 8小时超时+JWT updated_at+刷新重用检测 |
|
||||
| P2-7 凭据加密 | server/api/servers.py | Server.password/ssh_key_private Fernet加密存储 |
|
||||
| P2-8 凭据脱敏 | server/api/scripts.py + servers.py | API响应不返回密码，password_set布尔标记 |
|
||||
| P2-9 DB备份 | deploy/db_backup.sh | mysqldump+30天保留+cron集成 |
|
||||
| **P3运维增强** | | |
|
||||
| P3-1 Nginx重定向 | deploy/nginx_https.conf | 注释化301规则：裸页面路径→/app/前缀 |
|
||||
| P3-2 自定义404 | server/main.py | StarletteHTTPExceptionHandler返回空白HTML，隐藏FastAPI标识 |
|
||||
|
||||
### 🔄 待测试
|
||||
- T1: 心跳Redis写入验证
|
||||
- T2: WebSocket连接测试
|
||||
- T3: 3层守护测试 (kill Python→Supervisor重启)
|
||||
- T4: Telegram推送测试
|
||||
- T5: install.html 5步流程测试
|
||||
|
||||
### 测试流程 (用户确认)
|
||||
1. WSL本地基础测试 → 2. 推到仓库 → 3. 外网服务器正式测试
|
||||
|
||||
## 配置三写机制
|
||||
安装向导 Step 3 POST处理同时写入：
|
||||
1. `web/data/config.json` — 共享配置 (API_BASE_URL, DB_*, API_KEY)
|
||||
2. `.env` — Python后端启动必需 (NEXUS_前缀)
|
||||
3. `settings` MySQL表 — 共享动态配置 (api_key, thresholds, Telegram等)
|
||||
|
||||
不可改项 (SECRET_KEY/API_KEY/ENCRYPTION_KEY/DATABASE_URL) 不在MySQL覆盖映射中。
|
||||
|
||||
## 3层守护机制
|
||||
- **Layer 1**: Supervisor — Python崩溃自动重启
|
||||
- **Layer 2**: Python self_monitor — 每30s检查Redis/MySQL/WebSocket
|
||||
- **Layer 3**: Shell health_monitor.sh — 每分钟HTTP GET /health, 连续3次失败→supervisorctl restart + Telegram
|
||||
|
||||
## 实现原则（强制 — 见 `.cursor/rules/perfect-implementation.mdc`）
|
||||
|
||||
**所有设计和实现都必须是完美实现。**
|
||||
|
||||
- ❌ 不允许为了实现而实现 — 每一行代码必须有明确的目的和质量标准
|
||||
- ❌ 不允许降级实现 — 不得以「先用着」为由降低安全、架构或代码质量标准
|
||||
- ❌ 不允许妥协实现 — 不得在发现问题后选择绕过而非根治
|
||||
- ❌ 不允许留技术债 — 发现问题必须当场修复，不得标注 TODO/FIXME 延后
|
||||
- ✅ 无法完美实现时必须停下来与用户交流后再换方案，不得擅自从权
|
||||
|
||||
**文档纪律：**
|
||||
|
||||
- 新功能/架构变更：先写 `docs/design/specs/YYYY-MM-DD-*-design.md`，再写代码
|
||||
- 开发前：写 `docs/design/plans/` 或 `docs/reports/` 技术文档（文件清单、步骤、测试、回滚）
|
||||
- 项目缺文档的模块：改动时一并补全
|
||||
- 每次修改：在 `docs/changelog/YYYY-MM-DD-*.md` 留 changelog
|
||||
|
||||
---
|
||||
|
||||
## 强制文件修改流程（不可跳步）
|
||||
|
||||
```
|
||||
实现 → WSL本地验证 → ★审计8步★ → 部署 → 健康检查 → 浏览器验证 → changelog
|
||||
```
|
||||
|
||||
**进度条（每次改代码必须输出，每完成一步打勾）：**
|
||||
|
||||
```
|
||||
□实现 □WSL验证 □审计8步 □部署 □健康检查 □浏览器验证 □changelog
|
||||
```
|
||||
|
||||
用户只需看：没打勾的格子在打勾的格子后面 = 跳步了。
|
||||
跳步 = 严重过程违规，用户说「你跳步了」必须立即停止并补完。
|
||||
|
||||
审计8步（我内部执行，用户不需要检查细节）：登记→全文Read→规则扫描H→Closure表→入口表→输入→Sink→归类→DoD
|
||||
审查4维度30项：安全12+逻辑8+性能5+质量5
|
||||
三个铁律：每个文件都要审、每行代码都要看、每个结论都要有证据
|
||||
|
||||
**程序门控 v2（deploy 时自动检查 7 道，不过不让部署）：**
|
||||
|
||||
| # | 门 | 检查内容 | 防什么 |
|
||||
|---|----|---------|--------|
|
||||
| 1 | Changelog门 | 文件存在 **且行数≥10** | 空壳changelog |
|
||||
| 2 | Audit门 | 文件存在 **且含 Step3+Closure+DoD** | 空壳审计 |
|
||||
| 3 | Test门 | test_api.py **必须存在**且通过 | 删测试绕过 |
|
||||
| 4 | Lint门 | `ruff check server/` 零错误 | 代码质量问题 |
|
||||
| 5 | Import门 | `import server.main` 成功 | 语法/导入错误 |
|
||||
| 6 | Security门 | `bandit` 无 HIGH/MEDIUM | 安全反模式 |
|
||||
| 7 | Review门 | 审计文件包含实际改动文件清单 | 假审查 |
|
||||
|
||||
门控脚本: `deploy/pre_deploy_check.sh`（7门）
|
||||
门控日志: `deploy/gate_log.jsonl`（每次检查自动追加记录）
|
||||
MCP deploy 工具在 git pull + restart 前自动执行门控检查，任何一门不过返回 `🚫 DEPLOY BLOCKED`
|
||||
MCP gate_log 工具可查看历史门控记录
|
||||
审计模板: `docs/audit/TEMPLATE.md`
|
||||
Lint配置: `ruff.toml`
|
||||
开发依赖: `requirements-dev.txt`（ruff, bandit, pytest）
|
||||
|
||||
## 部署流程（SSH + SCP，不是 MCP deploy）
|
||||
|
||||
**MCP deploy 不可用**（GitHub 等 SaaS 的远程服务器 git pull 无凭据），实际部署用 SSH 命令直接操作：
|
||||
|
||||
### 后端部署
|
||||
|
||||
```bash
|
||||
# 1. Push 本地到 Gitea
|
||||
git push origin main
|
||||
|
||||
# 2. 服务器拉取最新代码 + 重启
|
||||
ssh nexus "cd /www/wwwroot/api.synaglobal.vip && git fetch --all && git reset --hard origin/main && supervisorctl restart nexus"
|
||||
|
||||
# 3. 健康检查
|
||||
ssh nexus "sleep 3 && curl -s http://127.0.0.1:8600/health"
|
||||
# 预期: "ok"（纯文本，非 JSON）
|
||||
```
|
||||
|
||||
### 前端部署（Vuetify SPA）
|
||||
|
||||
Vite 直接输出到 `web/app/`（后端 StaticFiles 挂载点），无需 dist 复制步骤：
|
||||
|
||||
```bash
|
||||
# 一键部署脚本（构建+打包+上传+提取+重启+验证）
|
||||
bash deploy/deploy-frontend.sh
|
||||
|
||||
# 或手动步骤：
|
||||
cd frontend && npx vite build && cd ..
|
||||
tar czf /tmp/nexus-frontend.tar.gz -C web/app index.html assets/
|
||||
scp /tmp/nexus-frontend.tar.gz nexus:/tmp/nexus-frontend.tar.gz
|
||||
ssh nexus "cd /www/wwwroot/api.synaglobal.vip/web/app && tar xzf /tmp/nexus-frontend.tar.gz && rm /tmp/nexus-frontend.tar.gz"
|
||||
ssh nexus "supervisorctl restart nexus"
|
||||
```
|
||||
|
||||
**注意**: 前端构建产物 (`web/app/index.html`, `web/app/assets/`) 已在 `.gitignore` 中，不进入 git。每次部署需重新构建+上传。
|
||||
|
||||
### 浏览器验证
|
||||
```bash
|
||||
curl -s -o /dev/null -w "%{http_code}" http://47.254.123.106:8600/app/ # 预期: 200
|
||||
```
|
||||
|
||||
### 部署常遇问题
|
||||
| 问题 | 解决 |
|
||||
|------|------|
|
||||
| 功能 / API / 14 页 | `docs/project/nexus-functional-development-guide.md` |
|
||||
| 附录（sync 端点、调用链） | `docs/project/nexus-functional-development-guide-appendix.md` |
|
||||
| 当前 handoff | `docs/project/AI-HANDOFF-2026-06-03.md` |
|
||||
| 本地验证 | `bash scripts/local_verify.sh` |
|
||||
| 验收 L0–L5 | `docs/project/development-acceptance-standard.md` |
|
||||
| 风险接受（单人运维） | `docs/project/risk-acceptance-single-operator.md` |
|
||||
| 文档索引 | `docs/README.md` |
|
||||
| 历史归档 | `docs/archive/README.md` |
|
||||
| `/app/` 返回 404 | AppAuthMiddleware 拦截 — 确认 `/app/` 和 `/app/index.html` 在 `_APP_PUBLIC_PATHS` 中 |
|
||||
| `/app/` 返回旧 HTML (Tailwind/Alpine) | `git reset --hard` 恢复了旧文件 — 需要重新 tar+scp 前端构建产物 |
|
||||
| MCP deploy → git pull 失败 `could not read Username` | 服务器 remote URL 没配 token，用 `git remote set-url` |
|
||||
| Gate 2 Audit BLOCKED | 创建 `docs/audit/YYYY-MM-DD-topic.md`，含 Step3+Closure+DoD |
|
||||
| Gate 3 Test BLOCKED (401) | 服务器 .env 中 `NEXUS_TEST_ADMIN_PASSWORD` 与数据库不一致 |
|
||||
| Gate 6 Security BLOCKED (bandit HIGH) | md5 → sha256 等，参看 bandit 报告修复 |
|
||||
| Gate 7 Review BLOCKED | 审计文件缺少实际改动文件清单 |
|
||||
|
||||
## 栈
|
||||
### 部署信息速查
|
||||
- **部署用户**: root
|
||||
- **部署目录**: `/www/wwwroot/api.synaglobal.vip/`
|
||||
- **Supervisor 服务名**: `nexus`
|
||||
- **Supervisor 配置**: `/www/server/panel/plugin/supervisor/etc/supervisor.conf`
|
||||
- **SSH 别名**: `ssh nexus` (47.254.123.106, key: id_rsa_nexus)
|
||||
- **后端端口**: 8600
|
||||
- **Gitea Token SHA**: `26fee743a9332895b55f79b2dbe2e931dc7c2fe5` (nexus-deploy-token, write:repository)
|
||||
|
||||
FastAPI · Vue 3 SPA · Hash 路由 `#/` · 门控 `deploy/pre_deploy_check.sh`（7 道）
|
||||
|
||||
## 流程
|
||||
**用户审查清单（验证AI是否偷懒）：**
|
||||
1. 看 `deploy/gate_log.jsonl` — 每次门控都有记录，没有记录 = 没过门控
|
||||
2. 看审计文件 — 必须有 Closure 表（每个H的判定+依据）、Step 3 规则扫描、DoD
|
||||
3. 看进度条 — ☑必须在□前面，否则跳步
|
||||
4. 看 changelog — 行数≥10，不能是空壳
|
||||
|
||||
## 数据流
|
||||
```
|
||||
实现 → local_verify → 审计（按 diff 量级）→ changelog →（批准）部署
|
||||
Agent心跳(60s) → Redis(实时) → 前端直读 → 10min批量 → MySQL(历史)
|
||||
告警: CPU/mem/disk > threshold → WebSocket推送浏览器 + Telegram推送手机
|
||||
恢复: 之前告警的指标恢复正常 → 自动推送恢复通知
|
||||
Redis心跳key: heartbeat:{server_id} (HSET, TTL=600s)
|
||||
Redis告警key: alerts:{server_id} (SET, TTL=3600s)
|
||||
```
|
||||
|
||||
强制规则：`.cursor/rules/` · `standards/`
|
||||
|
||||
-46
@@ -1,46 +0,0 @@
|
||||
# Nexus 6.0 - API + static SPA (web/app)
|
||||
FROM python:3.12-slim-bookworm
|
||||
|
||||
ARG DEBIAN_MIRROR=https://mirrors.aliyun.com/debian
|
||||
ARG DEBIAN_SECURITY_MIRROR=https://mirrors.aliyun.com/debian-security
|
||||
ARG PIP_INDEX_URL=https://mirrors.aliyun.com/pypi/simple/
|
||||
ARG PIP_TRUSTED_HOST=mirrors.aliyun.com
|
||||
|
||||
RUN set -eux; \
|
||||
sed -i \
|
||||
-e "s|http://deb.debian.org/debian-security|${DEBIAN_SECURITY_MIRROR}|g" \
|
||||
-e "s|http://deb.debian.org/debian|${DEBIAN_MIRROR}|g" \
|
||||
/etc/apt/sources.list.d/debian.sources; \
|
||||
apt-get update; \
|
||||
apt-get install -y --no-install-recommends \
|
||||
curl \
|
||||
openssh-client \
|
||||
rsync \
|
||||
sshpass; \
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
COPY requirements.txt .
|
||||
RUN pip install --no-cache-dir --index-url "${PIP_INDEX_URL}" --trusted-host "${PIP_TRUSTED_HOST}" -r requirements.txt
|
||||
|
||||
COPY server/ ./server/
|
||||
COPY web/app/ ./web/app/
|
||||
COPY web/app-v2/ ./web/app-v2/
|
||||
COPY docker/entrypoint.sh ./docker/entrypoint.sh
|
||||
RUN chmod +x ./docker/entrypoint.sh
|
||||
|
||||
ENV PYTHONPATH=/app \
|
||||
PYTHONUNBUFFERED=1 \
|
||||
NEXUS_HOST=0.0.0.0 \
|
||||
NEXUS_PORT=8600
|
||||
|
||||
EXPOSE 8600
|
||||
|
||||
HEALTHCHECK --interval=30s --timeout=5s --start-period=90s --retries=3 \
|
||||
CMD curl -sf http://127.0.0.1:8600/health | grep -q '^ok' || exit 1
|
||||
|
||||
ENTRYPOINT ["/app/docker/entrypoint.sh"]
|
||||
CMD ["uvicorn", "server.main:app", "--host", "0.0.0.0", "--port", "8600"]
|
||||
|
||||
|
||||
@@ -1,77 +0,0 @@
|
||||
# Nexus 6.0 鈥?production image (frontend build + API)
|
||||
# Build: docker compose -f docker/docker-compose.prod.yml build
|
||||
# See: docs/design/plans/2026-06-04-1panel-docker-production.md
|
||||
|
||||
# 鈹€鈹€ Stage 1: Vue/Vite SPA 鈹€鈹€
|
||||
FROM node:20-bookworm-slim AS frontend
|
||||
WORKDIR /build/frontend
|
||||
|
||||
COPY frontend/package.json frontend/package-lock.json ./
|
||||
RUN npm ci --ignore-scripts
|
||||
|
||||
COPY frontend/ ./
|
||||
RUN npx vite build
|
||||
|
||||
|
||||
# Stage 1b: React/Vite App V2
|
||||
FROM node:20-bookworm-slim AS frontend_v2
|
||||
WORKDIR /build/frontend-v2
|
||||
|
||||
COPY frontend-v2/package.json frontend-v2/package-lock.json* ./
|
||||
RUN if [ -f package-lock.json ]; then npm ci --ignore-scripts; else npm install --ignore-scripts; fi
|
||||
|
||||
COPY frontend-v2/ ./
|
||||
RUN npx vite build
|
||||
# 鈹€鈹€ Stage 2: Python API + built static assets 鈹€鈹€
|
||||
FROM python:3.12-slim-bookworm
|
||||
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
curl \
|
||||
openssh-client \
|
||||
rsync \
|
||||
sshpass \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
COPY requirements.txt .
|
||||
RUN pip install --no-cache-dir -r requirements.txt
|
||||
|
||||
COPY server/ ./server/
|
||||
COPY web/agent/ ./web/agent/
|
||||
COPY --from=frontend /build/web/app ./web/app/
|
||||
COPY --from=frontend_v2 /build/web/app-v2 ./web/app-v2/
|
||||
# Login wallpaper cache (Vite does not emit this dir; sync also writes here at runtime)
|
||||
COPY web/app/wallpapers/ ./web/app/wallpapers/
|
||||
# Install wizard + static SPA assets not emitted by Vite
|
||||
COPY web/app/install.html ./web/app/install.html
|
||||
COPY web/app/servers_import_template.csv ./web/app/servers_import_template.csv
|
||||
RUN mkdir -p ./web/app/vendor
|
||||
COPY web/app/vendor/tailwindcss-browser.js \
|
||||
web/app/vendor/theme-init.js \
|
||||
web/app/vendor/theme.css \
|
||||
web/app/vendor/alpinejs.min.js \
|
||||
./web/app/vendor/
|
||||
COPY docker/entrypoint.sh ./docker/entrypoint.sh
|
||||
RUN chmod +x ./docker/entrypoint.sh \
|
||||
&& test -f /app/web/app/install.html \
|
||||
&& test -f /app/web/app/vendor/alpinejs.min.js \
|
||||
&& test -f /app/web/app/vendor/tailwindcss-browser.js \
|
||||
&& test -f /app/web/app/vendor/theme.css \
|
||||
&& test -f /app/web/app/vendor/theme-init.js
|
||||
|
||||
ENV PYTHONPATH=/app \
|
||||
PYTHONUNBUFFERED=1 \
|
||||
NEXUS_HOST=0.0.0.0 \
|
||||
NEXUS_PORT=8600
|
||||
|
||||
EXPOSE 8600
|
||||
|
||||
HEALTHCHECK --interval=30s --timeout=5s --start-period=90s --retries=3 \
|
||||
CMD curl -sf http://127.0.0.1:8600/health | grep -q '^ok' || exit 1
|
||||
|
||||
ENTRYPOINT ["/app/docker/entrypoint.sh"]
|
||||
CMD ["uvicorn", "server.main:app", "--host", "0.0.0.0", "--port", "8600"]
|
||||
|
||||
|
||||
+316
-7
@@ -1,11 +1,320 @@
|
||||
# Nexus 6.0 项目交接（已 supersede）
|
||||
# Nexus 6.0 项目交接文档
|
||||
|
||||
请以以下文档为准：
|
||||
> **⚠️ 2026-05-23 起请以 SSOT 为准**: [`AI-HANDOFF`](docs/project/AI-HANDOFF-2026-05-23.md) · **全量标准** [`standards-transfer-package`](docs/project/standards-transfer-package.md) · 验收 [`development-acceptance-standard`](docs/project/development-acceptance-standard.md)
|
||||
> 本文保留历史结构；端口模型、待办 backlog、验证清单、否决项均以 SSOT 为准。
|
||||
|
||||
| 文档 | 路径 |
|
||||
## 项目概述
|
||||
|
||||
**项目名称**: Nexus 6.0
|
||||
**类型**: 2000+ 服务器运维管理平台
|
||||
**架构**: Clean Architecture (FastAPI + Async SQLAlchemy + Redis + WebSocket + Telegram)
|
||||
**前端**: Tailwind CSS v4 + Alpine.js（18 个 HTML 页面，含 `alerts.html`）
|
||||
**状态**: 核心代码 ~98% 完成；**尚未部署**；待办见 SSOT §4、验证见 SSOT §5
|
||||
|
||||
---
|
||||
|
||||
## 仓库信息
|
||||
|
||||
- **仓库地址**: Gitea (地址在 .env 中配置)
|
||||
- **当前工作目录**: `C:\Users\uzuma\Desktop\svn\Nexus\.claude\worktrees\suspicious-williams-fe9492`
|
||||
- **Git分支**: 当前在 worktree 分支
|
||||
|
||||
---
|
||||
|
||||
## 技术栈
|
||||
|
||||
| 层级 | 技术 |
|
||||
|------|------|
|
||||
| 功能开发 SSOT | [docs/project/nexus-functional-development-guide.md](docs/project/nexus-functional-development-guide.md) |
|
||||
| 会话接续 | [docs/project/AI-HANDOFF-2026-06-03.md](docs/project/AI-HANDOFF-2026-06-03.md) |
|
||||
| 文档总索引 | [docs/README.md](docs/README.md) |
|
||||
| 后端框架 | FastAPI (Python 3.9+) |
|
||||
| 数据库 | MySQL 8.0 + Async SQLAlchemy 2.0 |
|
||||
| 缓存 | Redis |
|
||||
| 实时通信 | WebSocket |
|
||||
| SSH连接 | asyncssh (连接池模式) |
|
||||
| 告警推送 | Telegram Bot API |
|
||||
| 前端 | Tailwind CSS v4 + Alpine.js |
|
||||
| 进程守护 | Supervisor + Python自检 + Shell健康检查 |
|
||||
|
||||
历史全文：[docs/archive/project/PROJECT_HANDOVER.md](docs/archive/project/PROJECT_HANDOVER.md)
|
||||
---
|
||||
|
||||
## 目录结构
|
||||
|
||||
```
|
||||
Nexus/
|
||||
├── server/ # Python FastAPI 后端
|
||||
│ ├── api/ # API路由层 (15个模块)
|
||||
│ │ ├── agent.py # Agent心跳接收
|
||||
│ │ ├── assets.py # Platform/Node资产管理
|
||||
│ │ ├── auth.py # JWT登录/TOTP
|
||||
│ │ ├── auth_jwt.py # JWT验证中间件
|
||||
│ │ ├── files.py # 文件浏览
|
||||
│ │ ├── install.py # 安装向导API
|
||||
│ │ ├── push.py # 推送调度
|
||||
│ │ ├── scripts.py # 脚本库管理
|
||||
│ │ ├── servers.py # 服务器CRUD
|
||||
│ │ ├── settings.py # 系统设置
|
||||
│ │ ├── sync_v2.py # 同步引擎v2 (4种模式)
|
||||
│ │ ├── webssh.py # WebSSH终端
|
||||
│ │ └── websocket.py # WebSocket告警推送
|
||||
│ ├── application/ # 应用服务层
|
||||
│ │ └── services/ # 业务逻辑 (SyncEngineV2等)
|
||||
│ ├── domain/ # 领域层
|
||||
│ │ └── models/ # SQLAlchemy ORM (14张表)
|
||||
│ ├── infrastructure/ # 基础设施层
|
||||
│ │ ├── database/ # 数据库访问 (Repository模式)
|
||||
│ │ ├── redis/ # Redis客户端
|
||||
│ │ ├── ssh/ # SSH连接池 (asyncssh)
|
||||
│ │ └── telegram/ # Telegram推送
|
||||
│ ├── background/ # 后台任务
|
||||
│ │ ├── self_monitor.py # Python自检 (30s)
|
||||
│ │ ├── heartbeat_flush.py # Redis→MySQL刷新 (10min)
|
||||
│ │ ├── scheduler.py # 定时推送调度
|
||||
│ │ └── retry_worker.py # 失败重试队列
|
||||
│ └── config.py # Pydantic Settings
|
||||
├── web/app/ # 前端页面 (15个HTML)
|
||||
│ ├── install.html # 安装向导 (5步)
|
||||
│ ├── login.html # JWT登录+TOTP
|
||||
│ ├── index.html # 仪表盘
|
||||
│ ├── servers.html # 服务器管理
|
||||
│ ├── assets.html # Platform/Node管理
|
||||
│ ├── push.html # 文件推送
|
||||
│ ├── scripts.html # 脚本库
|
||||
│ ├── commands.html # 命令日志查询
|
||||
│ ├── files.html # 远程文件浏览
|
||||
│ ├── settings.html # 系统设置
|
||||
│ ├── audit.html # 审计日志
|
||||
│ ├── retries.html # 重试队列
|
||||
│ ├── terminal.html # WebSSH终端
|
||||
│ ├── api.js # 共享API模块 (JWT+Toast)
|
||||
│ └── layout.js # 共享布局组件
|
||||
├── deploy/ # 部署配置
|
||||
│ ├── supervisor/ # Supervisor配置
|
||||
│ ├── nginx/ # Nginx配置
|
||||
│ └── db_backup.sh # 数据库备份脚本
|
||||
├── docs/ # 项目文档
|
||||
├── requirements.txt # Python依赖
|
||||
└── test_p1_p2.py # 验证测试脚本
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 数据库模型 (14张表)
|
||||
|
||||
| 表名 | 说明 |
|
||||
|------|------|
|
||||
| `admins` | 管理员用户 (JWT+TOTP支持) |
|
||||
| `servers` | 服务器资产 (核心表) |
|
||||
| `platforms` | 平台类型模板 |
|
||||
| `nodes` | 资产节点树 |
|
||||
| `sync_logs` | 同步操作日志 |
|
||||
| `push_schedules` | 定时推送调度 |
|
||||
| `push_retry_jobs` | 失败重试队列 |
|
||||
| `audit_logs` | 审计日志 |
|
||||
| `scripts` | 脚本库 |
|
||||
| `script_executions` | 脚本执行记录 |
|
||||
| `password_presets` | SSH密码预设 |
|
||||
| `db_credentials` | 数据库凭据 |
|
||||
| `ssh_sessions` | WebSSH会话 |
|
||||
| `command_logs` | SSH命令日志 |
|
||||
| `login_attempts` | 登录防暴破记录 |
|
||||
| `settings` | 系统配置键值对 |
|
||||
|
||||
---
|
||||
|
||||
## 核心功能清单
|
||||
|
||||
### P0 核心功能 (已完成)
|
||||
- [x] JWT认证 + TOTP双因素
|
||||
- [x] 登录防暴破 (15分钟锁定)
|
||||
- [x] Agent心跳上报 (Redis实时)
|
||||
- [x] WebSocket实时告警推送
|
||||
- [x] Telegram告警通知
|
||||
- [x] 安装向导 (5步)
|
||||
|
||||
### P1 功能 (已完成)
|
||||
- [x] Platform/Node资产管理
|
||||
- [x] 服务器详情面板 (点击展开)
|
||||
- [x] WebSSH终端 (xterm.js)
|
||||
- [x] 推送页面增强 (逐服务器状态+进度条)
|
||||
- [x] 脚本编辑+执行结果格式化
|
||||
- [x] 全局Toast通知系统
|
||||
- [x] 审计日志分页+过滤
|
||||
- [x] 重试队列手动操作
|
||||
- [x] 文件浏览 (面包屑导航)
|
||||
|
||||
### P2 功能 (已完成)
|
||||
- [x] 告警聚合防抖 (5分钟冷却)
|
||||
- [x] 命令日志查询页面
|
||||
- [x] 服务器列表DB级分页
|
||||
- [x] Dashboard WebSocket实时刷新
|
||||
- [x] 移动端响应式适配
|
||||
- [x] 会话安全加固 (8小时超时)
|
||||
- [x] 服务器凭据Fernet加密存储
|
||||
- [x] 凭据API脱敏 (password_set标记)
|
||||
- [x] 数据库自动备份脚本
|
||||
|
||||
### Sync引擎v2 (4种模式)
|
||||
- [x] S1: 文件同步 (rsync)
|
||||
- [x] S2: 命令批量执行 (SSH)
|
||||
- [x] S3: 配置推送 (sysctl) + 去重 + 回滚
|
||||
- [x] S4: SFTP文件传输
|
||||
|
||||
---
|
||||
|
||||
## 关键Bug修复记录
|
||||
|
||||
| 任务ID | 问题 | 修复内容 |
|
||||
|--------|------|----------|
|
||||
| #81 | DateTime默认求值BUG | 添加`_utcnow()`可调用函数，替换所有`default=datetime.now()` |
|
||||
| #82 | session.py logger未定义 | 添加`import logging`和`logger`定义，移除@property死代码 |
|
||||
| #83 | 审计日志缺失 | 验证所有CUD端点都有审计记录 |
|
||||
| #84 | 模型缺失索引 | 添加7个索引(login_attempts, audit_logs等) |
|
||||
|
||||
---
|
||||
|
||||
## 环境配置
|
||||
|
||||
### 必需环境变量 (.env文件)
|
||||
```bash
|
||||
# 数据库
|
||||
DATABASE_URL=mysql+aiomysql://user:pass@localhost/nexus
|
||||
|
||||
# 安全密钥 (安装时生成)
|
||||
SECRET_KEY=xxx
|
||||
API_KEY=xxx
|
||||
ENCRYPTION_KEY=xxx
|
||||
|
||||
# Redis
|
||||
REDIS_URL=redis://localhost:6379/0
|
||||
|
||||
# Telegram告警 (可选)
|
||||
TELEGRAM_BOT_TOKEN=xxx
|
||||
TELEGRAM_CHAT_ID=xxx
|
||||
|
||||
# 告警阈值
|
||||
CPU_ALERT_THRESHOLD=80
|
||||
MEM_ALERT_THRESHOLD=80
|
||||
DISK_ALERT_THRESHOLD=80
|
||||
```
|
||||
|
||||
### 启动模式
|
||||
- **安装模式** (无.env): 仅 `/api/install/` + 静态文件可用
|
||||
- **正常模式** (有.env): 完整初始化 DB/Redis/后台任务
|
||||
|
||||
---
|
||||
|
||||
## 部署步骤
|
||||
|
||||
### 1. 安装依赖
|
||||
```bash
|
||||
pip install -r requirements.txt
|
||||
```
|
||||
|
||||
### 2. 运行安装向导
|
||||
访问 `http://localhost:8000/app/install.html`
|
||||
- Step 1: 数据库配置
|
||||
- Step 2: Redis配置
|
||||
- Step 3: 安全密钥生成
|
||||
- Step 4: Telegram配置 (可选)
|
||||
- Step 5: 创建管理员账号
|
||||
|
||||
### 3. 启动服务 (Supervisor)
|
||||
```bash
|
||||
# 复制配置
|
||||
cp deploy/supervisor/nexus.conf /etc/supervisor/conf.d/
|
||||
supervisorctl reread
|
||||
supervisorctl update
|
||||
supervisorctl start nexus
|
||||
```
|
||||
|
||||
### 4. 验证运行
|
||||
```bash
|
||||
# 健康检查
|
||||
curl http://localhost:8000/health
|
||||
|
||||
# 运行测试
|
||||
python test_p1_p2.py
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 团队分工建议
|
||||
|
||||
| 角色 | 职责 | 相关文件 |
|
||||
|------|------|----------|
|
||||
| **后端开发** | API开发、业务逻辑 | `server/api/*.py`, `server/application/services/*.py` |
|
||||
| **前端开发** | UI页面、交互逻辑 | `web/app/*.html`, `web/app/api.js`, `web/app/layout.js` |
|
||||
| **DevOps** | 部署、监控、备份 | `deploy/`, `supervisor/`, `nginx/` |
|
||||
| **DBA** | 数据库优化、迁移 | `server/domain/models/`, `server/infrastructure/database/` |
|
||||
| **安全** | 审计、加密、认证 | `server/api/auth*.py`, 凭据加密逻辑 |
|
||||
|
||||
---
|
||||
|
||||
## 监控与告警
|
||||
|
||||
### 3层守护机制
|
||||
1. **Supervisor**: Python崩溃自动重启
|
||||
2. **Python自检** (`self_monitor.py`): 30秒检查Redis/MySQL/WebSocket
|
||||
3. **Shell健康检查** (`health_monitor.sh`): 1分钟HTTP检查，3次失败重启
|
||||
|
||||
### 告警通道
|
||||
- WebSocket → 前端实时通知
|
||||
- Telegram → 手机推送
|
||||
|
||||
### 关键指标
|
||||
- Agent心跳间隔: 60秒
|
||||
- Redis→MySQL刷新: 10分钟
|
||||
- 会话超时: 8小时
|
||||
- 告警冷却: 5分钟
|
||||
|
||||
---
|
||||
|
||||
## 测试验证
|
||||
|
||||
### 已完成的测试
|
||||
```bash
|
||||
# 模块导入测试 (19/19通过)
|
||||
python -c "import server.domain.models; ..."
|
||||
|
||||
# 功能测试 (7/7通过)
|
||||
python test_p1_p2.py
|
||||
# - JWT updated_at claim
|
||||
# - JWT password invalidation
|
||||
# - Alert dedup cooldown
|
||||
# - Server repo pagination
|
||||
# - Config dedup command
|
||||
# - Server dict no password
|
||||
# - Admin.updated_at field
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 注意事项
|
||||
|
||||
### ⚠️ 安全相关
|
||||
1. **API_KEY**: 禁止修改，用于Agent认证
|
||||
2. **SECRET_KEY**: 禁止修改，用于JWT签名
|
||||
3. **ENCRYPTION_KEY**: 禁止修改，用于凭据加密
|
||||
4. 生产环境必须修改默认密码
|
||||
|
||||
### ⚠️ 数据库迁移
|
||||
首次启动会自动执行 `_apply_migrations()`:
|
||||
- 添加 `admins.updated_at` 列
|
||||
- 创建7个索引 (如果不存在)
|
||||
|
||||
### ⚠️ 文件权限
|
||||
- SSH私钥文件需要正确权限 (600)
|
||||
- 日志目录需要写权限
|
||||
|
||||
---
|
||||
|
||||
## 联系方式
|
||||
|
||||
- 项目文档: `docs/`
|
||||
- 配置文件: `.env` (不提交到Git)
|
||||
- 测试脚本: `test_p1_p2.py`
|
||||
|
||||
---
|
||||
|
||||
**交接日期**: 2026/05/22
|
||||
**代码状态**: ✅ 开发完成，待部署测试
|
||||
**Git提交**: 建议提交当前worktree更改到主分支
|
||||
|
||||
@@ -1,189 +0,0 @@
|
||||
# Nexus 6.0
|
||||
|
||||
面向 **2000+ 服务器** 的运维管理平台：FastAPI + Async SQLAlchemy + Redis + WebSocket + Telegram（后端），Vue 3 + Vuetify 4 + TypeScript SPA（前端 14 页）。
|
||||
|
||||
| 项 | 说明 |
|
||||
|----|------|
|
||||
| 生产域名 | https://api.synaglobal.vip |
|
||||
| 默认安装目录 | `/opt/nexus` |
|
||||
| 后端端口 | `8600`（1Panel 反代到 `http://127.0.0.1:8600`） |
|
||||
| 安装向导 | `https://你的域名/app/install.html` |
|
||||
| 文档索引 | [docs/README.md](docs/README.md) |
|
||||
|
||||
生产 Docker 栈 **仅含 Nexus 容器**；MySQL / Redis 在宿主机或 1Panel 自行安装。
|
||||
|
||||
---
|
||||
|
||||
## 一键命令速查（root · 公共仓库 · 无需令牌）
|
||||
|
||||
| 场景 | 一条命令 |
|
||||
|------|----------|
|
||||
| **仅装 Nexus**（1Panel 已就绪） | `curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" \| bash` |
|
||||
| **重装服务器**（1Panel + Docker + Nexus） | `curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/install-1panel-docker.sh" \| bash` |
|
||||
| **一键更新**（pull + 重建镜像） | `curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/update.sh" \| bash` |
|
||||
| **强制无缓存重建**（entrypoint 变更后） | `curl -fsSL ".../deploy/update.sh" \| bash -s -- --no-cache` |
|
||||
| **已 clone** | `cd /opt/nexus && bash deploy/update.sh` |
|
||||
|
||||
指定资源档位（`1c4g` / `2c8g` 默认 / `4c16g`）：
|
||||
|
||||
```bash
|
||||
curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash -s -- --profile 4c16g
|
||||
```
|
||||
|
||||
**raw 地址**：`http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/<脚本名>`
|
||||
|
||||
安装完成后浏览器打开安装向导，完成 MySQL（自建）/ Redis（自建）/ 管理员初始化。
|
||||
|
||||
---
|
||||
|
||||
## NX 统一运维菜单
|
||||
|
||||
装好后在服务器任意目录输入 **`nx`**（`install` / `update` / 首次运行 `nx` 会自动注册 `/usr/local/bin/nx`）：
|
||||
|
||||
```bash
|
||||
nx # 统一菜单：安装 + 一键更新 + 重启 + 日志 + 备份
|
||||
nx update # 非交互一键更新
|
||||
nx update --no-cache
|
||||
nx install-fresh # 全新安装
|
||||
nx health # 健康检查
|
||||
```
|
||||
|
||||
| 菜单项 | 作用 |
|
||||
|--------|------|
|
||||
| `[4] 一键更新` | pull + 重建 Docker 镜像（等同 `deploy/update.sh`） |
|
||||
| `[5] 重启 Nexus` | 重启 Python 应用 |
|
||||
| `[6] 日志` | 跟踪容器日志 |
|
||||
| `[1][2]` | 安装 / 全新安装向导 |
|
||||
|
||||
全局命令（符号链接）：
|
||||
|
||||
| 命令 | 作用 |
|
||||
|------|------|
|
||||
| `nx` | 统一运维菜单 |
|
||||
| `nexus-update` | 等同 `deploy/update.sh` |
|
||||
| `nexus-fresh` | 等同 `install-nexus-fresh.sh` |
|
||||
| `nexus-install` | 等同 `quick-install.sh` |
|
||||
|
||||
> `nx god` 已合并进 `nx` 主菜单，仍可作为兼容别名使用。
|
||||
|
||||
---
|
||||
|
||||
## 部署脚本一览（`deploy/`）
|
||||
|
||||
### 1Panel + Docker 生产（主路径）
|
||||
|
||||
| 脚本 | 用途 | curl 入口 |
|
||||
|------|------|-----------|
|
||||
| [quick-install.sh](deploy/quick-install.sh) | **公共仓库安装入口** | ✅ 上表 |
|
||||
| [install-1panel-docker.sh](deploy/install-1panel-docker.sh) | 1Panel + Docker + Nexus 全链 | ✅ 上表 |
|
||||
| [install-nexus-fresh.sh](deploy/install-nexus-fresh.sh) | 全新空库 → 安装向导 | `bash deploy/install-nexus-fresh.sh --skip-clone` |
|
||||
| [update.sh](deploy/update.sh) | **一键更新**（pull + 重建） | ✅ 上表 |
|
||||
| [upgrade-1panel-docker.sh](deploy/upgrade-1panel-docker.sh) | 转调 `nexus-1panel.sh upgrade` | — |
|
||||
| [nexus-1panel.sh](deploy/nexus-1panel.sh) | 安装 / 升级 / check / ports 底层 | — |
|
||||
| [nx](deploy/nx) | **统一交互菜单** | `nx` |
|
||||
| [uninstall-mysql-compose.sh](deploy/uninstall-mysql-compose.sh) | 卸载遗留 Compose MySQL 容器 | — |
|
||||
| [uninstall-redis-compose.sh](deploy/uninstall-redis-compose.sh) | 卸载遗留 Compose Redis 容器 | — |
|
||||
| [sync-install-wizard-to-container.sh](deploy/sync-install-wizard-to-container.sh) | 热同步 install.html 到容器 | — |
|
||||
| [download-install-fresh.sh](deploy/download-install-fresh.sh) | 下载安装脚本（私有库可选 Token） | — |
|
||||
|
||||
详细说明：[deploy/README-1panel.md](deploy/README-1panel.md)
|
||||
|
||||
### 更新选项
|
||||
|
||||
```bash
|
||||
bash deploy/update.sh # 默认：Git 拉取（若有）+ 重建容器
|
||||
bash deploy/update.sh --check # 仅查 Git
|
||||
bash deploy/update.sh --no-cache # 无缓存重建镜像
|
||||
bash deploy/update.sh --no-backup # 跳过 MySQL 备份
|
||||
```
|
||||
|
||||
### Docker Compose 与档位
|
||||
|
||||
| 路径 | 用途 |
|
||||
|------|------|
|
||||
| [docker/docker-compose.prod.yml](docker/docker-compose.prod.yml) | 生产 Compose（**仅 nexus 服务**） |
|
||||
| [docker/profiles/1c4g.env](docker/profiles/1c4g.env) | 1 核 4G |
|
||||
| [docker/profiles/2c8g.env](docker/profiles/2c8g.env) | 2 核 8G（默认） |
|
||||
| [docker/profiles/4c16g.env](docker/profiles/4c16g.env) | 4 核 16G |
|
||||
| [docker/README.md](docker/README.md) | 镜像与本地开发说明 |
|
||||
|
||||
### 经典 SSH / Supervisor 部署（宝塔 / 裸机）
|
||||
|
||||
| 脚本 | 用途 |
|
||||
|------|------|
|
||||
| [install.sh](deploy/install.sh) | 传统安装 |
|
||||
| [upgrade.sh](deploy/upgrade.sh) | 拉代码 + 重启 |
|
||||
| [deploy-on-server.sh](deploy/deploy-on-server.sh) | 服务器侧部署 |
|
||||
| [deploy-production.sh](deploy/deploy-production.sh) | 生产发布流程 |
|
||||
| [deploy-frontend.sh](deploy/deploy-frontend.sh) | 构建 Vue 前端并打包到 `web/app/` |
|
||||
| [pre_deploy_check.sh](deploy/pre_deploy_check.sh) | **7 道门控** |
|
||||
| [health_monitor.sh](deploy/health_monitor.sh) | cron 健康检查 |
|
||||
| [db_backup.sh](deploy/db_backup.sh) | MySQL 备份 |
|
||||
| [uninstall.sh](deploy/uninstall.sh) | 卸载 |
|
||||
|
||||
---
|
||||
|
||||
## 迁机 vs 全新安装
|
||||
|
||||
| 场景 | 做法 |
|
||||
|------|------|
|
||||
| **新 VPS、空库** | `curl \| quick-install.sh` → 1Panel 自建 MySQL/Redis → `/app/install.html` |
|
||||
| **已有数据、换机** | `nexus-1panel.sh install --from-env` 或 `nx` → 安装向导 |
|
||||
| **仅升级代码/镜像** | `nx update` 或 `bash deploy/update.sh` |
|
||||
| **不必重装 VPS** | `cd /opt/nexus && nx update` |
|
||||
|
||||
每台新服务器自动生成唯一 `NEXUS_SECRET_KEY` / `NEXUS_API_KEY` / `NEXUS_ENCRYPTION_KEY`（写入 `docker/.env.prod`，备份 `/root/.nexus-install-secrets-*.env`）。MySQL 密码由自建库时自行设定。
|
||||
|
||||
---
|
||||
|
||||
## 技术栈与目录
|
||||
|
||||
```
|
||||
Nexus/
|
||||
├── server/ # FastAPI 后端（Clean Architecture）
|
||||
├── frontend/ # Vue 3 + Vuetify 4 SPA → 构建到 web/app/
|
||||
├── web/app/ # 静态资源挂载点（构建产物 gitignore）
|
||||
├── deploy/ # 安装、更新、门控、nx 菜单
|
||||
├── docker/ # Compose、镜像、profiles
|
||||
├── docs/ # 设计 / changelog / 审计 / 报告
|
||||
├── tests/ # API 与集成测试
|
||||
└── standards/ # 开发与逐行审计标准
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 开发
|
||||
|
||||
```bash
|
||||
pip install -r requirements.txt
|
||||
uvicorn server.main:app --reload --port 8600
|
||||
|
||||
cd frontend && npm run dev # http://localhost:3000/app/
|
||||
```
|
||||
|
||||
Linux 路径：[docs/project/linux-dev-paths.md](docs/project/linux-dev-paths.md) · [UBUNTU-DEV-README.txt](UBUNTU-DEV-README.txt)
|
||||
|
||||
---
|
||||
|
||||
## 文档与规范
|
||||
|
||||
| 文档 | 说明 |
|
||||
|------|------|
|
||||
| [docs/README.md](docs/README.md) | 文档总索引 |
|
||||
| [docs/project/nexus-functional-development-guide.md](docs/project/nexus-functional-development-guide.md) | 功能 / API / 14 页 |
|
||||
| [AGENTS.md](AGENTS.md) · [CLAUDE.md](CLAUDE.md) | Agent 薄入口 |
|
||||
|
||||
变更：`docs/changelog/` · 门控：`docs/audit/`
|
||||
|
||||
---
|
||||
|
||||
## 许可与仓库
|
||||
|
||||
| 用途 | 地址 |
|
||||
|------|------|
|
||||
| 仓库首页 | http://66.154.115.8:3000/admin/Nexus |
|
||||
| Git | http://66.154.115.8:3000/admin/Nexus.git |
|
||||
|
||||
分支 `main` · 提交前跑 `deploy/pre_deploy_check.sh`（7 道门控）
|
||||
|
||||
**勿提交**：`deploy/nexus-1panel.secrets.sh`、根目录 `.env`、`SECRETS.md`
|
||||
@@ -1,49 +0,0 @@
|
||||
Nexus — Ubuntu 离线开发包
|
||||
========================
|
||||
|
||||
解压：
|
||||
mkdir -p ~/Nexus && tar xzf nexus-ubuntu-dev-2026-06-03.tar.gz -C ~/
|
||||
cd ~/Nexus
|
||||
|
||||
Python 后端：
|
||||
sudo apt install -y python3 python3-venv python3-pip git curl build-essential
|
||||
python3 -m venv .venv && source .venv/bin/activate
|
||||
pip install -r requirements.txt -r requirements-dev.txt
|
||||
# 复制已有 .env，或执行下方 generate + sync_root_env
|
||||
|
||||
MySQL + Redis（Docker）：
|
||||
sudo apt install -y docker.io docker-compose-v2
|
||||
sudo usermod -aG docker "$USER" # 重新登录后免 sudo docker
|
||||
python3 docker/generate_env.py
|
||||
python3 docker/sync_root_env.py # 生成根目录 .env（127.0.0.1 + 较小连接池）
|
||||
docker compose up -d mysql redis # Redis 已映射 6379 供宿主机 uvicorn
|
||||
# 首次空库：先不要 sync_root_env，无 .env 启动 uvicorn 走 /app/install.html 向导
|
||||
|
||||
启动 API：
|
||||
bash scripts/start-dev.sh
|
||||
# 或一键验证：bash scripts/local_verify.sh
|
||||
|
||||
前端（Node 20+）：
|
||||
cd frontend && npm ci && npx vite build
|
||||
|
||||
编码 / 换行（Windows tar 解压后必做）：
|
||||
git config core.autocrlf false
|
||||
bash scripts/normalize_worktree_lf.sh
|
||||
python3 scripts/check_worktree_eol.py
|
||||
python3 scripts/check_text_eol.py
|
||||
详见 docs/audit/2026-06-04-encoding-review-ubuntu-phase1.md
|
||||
|
||||
SOCKS5 代理（拉 Docker / npm 镜像）：
|
||||
默认 192.168.124.93:10808 — 改 scripts/proxychains-docker.conf 或环境变量
|
||||
scripts/with-proxy.sh docker compose pull
|
||||
cd frontend && ../scripts/with-proxy.sh npm ci
|
||||
source scripts/proxy-env.sh # pip/curl 等
|
||||
|
||||
本地管理员（空库一次）：
|
||||
# .env 增加 NEXUS_TEST_ADMIN_PASSWORD=你的密码
|
||||
python3 scripts/seed_local_admin.py
|
||||
cd frontend && NEXUS_E2E_BASE=http://127.0.0.1:8600 NEXUS_E2E_PASSWORD=... npm run test:e2e
|
||||
|
||||
工作区路径：~/Nexus
|
||||
路径 SSOT：docs/project/linux-dev-paths.md · docs/project/local-integration-test.md
|
||||
Git 远程：http://66.154.115.8:3000/admin/Nexus.git（网络恢复后可 git pull）
|
||||
@@ -1,71 +0,0 @@
|
||||
# 1Panel OpenResty — Nexus reverse proxy (paste into site custom config)
|
||||
# Domain: api.synaglobal.vip
|
||||
# Upstream: Nexus Docker on 127.0.0.1:8600 (docker-compose.prod.yml)
|
||||
#
|
||||
# SSL: configure in 1Panel UI (Let's Encrypt). This snippet assumes HTTPS server block.
|
||||
|
||||
upstream nexus_api {
|
||||
server 127.0.0.1:8600;
|
||||
keepalive 32;
|
||||
}
|
||||
|
||||
# WebSocket log without query string (JWT must not hit access_log)
|
||||
log_format nexus_ws '$remote_addr - [$time_local] "$request_method $uri" $status $body_bytes_sent';
|
||||
|
||||
client_max_body_size 500m;
|
||||
client_body_timeout 600s;
|
||||
|
||||
location /api/ {
|
||||
proxy_pass http://nexus_api;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 600s;
|
||||
proxy_send_timeout 600s;
|
||||
proxy_connect_timeout 10s;
|
||||
}
|
||||
|
||||
location /ws/ {
|
||||
access_log /www/sites/api.synaglobal.vip/log/ws.log nexus_ws;
|
||||
proxy_pass http://nexus_api;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 3600s;
|
||||
proxy_send_timeout 3600s;
|
||||
}
|
||||
|
||||
location /health {
|
||||
proxy_pass http://nexus_api;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
|
||||
location /app/ {
|
||||
proxy_pass http://nexus_api;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
location /agent/ {
|
||||
proxy_pass http://nexus_api;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
|
||||
# Fallback: install mode or misc routes served by FastAPI
|
||||
location / {
|
||||
proxy_pass http://nexus_api;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
@@ -1,257 +0,0 @@
|
||||
# 1Panel + Docker 一键部署
|
||||
|
||||
> 完整知识文档：[docs/project/nexus-1panel-operations-knowledge.md](../docs/project/nexus-1panel-operations-knowledge.md)
|
||||
> 巡检归档（2026-06-06）：[docs/project/nexus-god-menu-audit-summary.md](../docs/project/nexus-god-menu-audit-summary.md)
|
||||
|
||||
## 脚本速查（公共仓库 · 无需令牌）
|
||||
|
||||
| 脚本 | 用途 | 一条命令 |
|
||||
|------|------|----------|
|
||||
| `quick-install.sh` | 仅装 Nexus（1Panel 已就绪） | `curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" \| bash` |
|
||||
| `install-1panel-docker.sh` | 重装服务器全链 | `curl -fsSL ".../install-1panel-docker.sh" \| bash` |
|
||||
| `install-nexus-fresh.sh` | 全新空库安装 | `bash deploy/install-nexus-fresh.sh --skip-clone` |
|
||||
| **`update.sh`** | **一键更新** | `curl -fsSL ".../update.sh" \| bash` |
|
||||
| `nexus-1panel.sh` | 底层 install / upgrade | `bash deploy/nexus-1panel.sh upgrade` |
|
||||
| `fix-1panel-mysql-grant.sh` | 修复 1045 nexus@Docker | `bash deploy/fix-1panel-mysql-grant.sh` |
|
||||
| `test-1panel-redis.sh` | Redis 认证诊断 | `REDIS_PASS='...' bash deploy/test-1panel-redis.sh` |
|
||||
| `verify-1panel-install-wizard.sh` | 一键验收（网络/cron/镜像） | `bash deploy/verify-1panel-install-wizard.sh` |
|
||||
| `install_ops_cron.sh` | 宿主机 cron（巡检+备份） | `sudo bash deploy/install_ops_cron.sh` |
|
||||
| `mysql_dump_to_file.sh` | MySQL 备份（Docker exec） | 见 `db_backup.sh` / `nx` 菜单 `[9]` |
|
||||
| `upgrade.sh` | 自动识别 Docker/Supervisor | `bash deploy/upgrade.sh` |
|
||||
| **`nx`** | **统一运维菜单** | `nx` |
|
||||
|
||||
档位：`--profile 1c4g` · `2c8g`（默认）· `4c16g`
|
||||
|
||||
---
|
||||
|
||||
## 重装服务器（1Panel + Docker + Nexus）
|
||||
|
||||
```bash
|
||||
curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/install-1panel-docker.sh" | bash
|
||||
```
|
||||
|
||||
4 核 16G：
|
||||
|
||||
```bash
|
||||
curl -fsSL ".../install-1panel-docker.sh" | bash -s -- --profile 4c16g
|
||||
```
|
||||
|
||||
已装 1Panel，只装 Nexus：
|
||||
|
||||
```bash
|
||||
curl -fsSL ".../install-1panel-docker.sh" | bash -s -- --skip-1panel
|
||||
```
|
||||
|
||||
## 仅 Nexus Docker
|
||||
|
||||
```bash
|
||||
curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
|
||||
```
|
||||
|
||||
安装完成后：`https://api.synaglobal.vip/app/install.html`
|
||||
|
||||
---
|
||||
|
||||
## 一键更新（日常）
|
||||
|
||||
```bash
|
||||
cd /opt/nexus && bash deploy/update.sh
|
||||
# 或
|
||||
nx update
|
||||
# 或菜单
|
||||
nx # → [4] 一键更新
|
||||
```
|
||||
|
||||
| 选项 | 说明 |
|
||||
|------|------|
|
||||
| `--check` | 仅查 Git，不重建 |
|
||||
| `--no-cache` | 无缓存重建镜像（entrypoint 变更后必用） |
|
||||
| `--no-backup` | 跳过 MySQL 备份 |
|
||||
| `--prune` | 清理悬空镜像 |
|
||||
|
||||
远程：
|
||||
|
||||
```bash
|
||||
curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/update.sh" | bash
|
||||
curl -fsSL ".../update.sh" | bash -s -- --no-cache
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## NX 全局命令
|
||||
|
||||
安装 / 升级 / 首次运行 `nx` 会自动注册到 `/usr/local/bin`：
|
||||
|
||||
```bash
|
||||
# 手动注册（任意目录可用 nx）
|
||||
NEXUS_ROOT=/opt/nexus bash /opt/nexus/deploy/install-nx-cli.sh
|
||||
|
||||
nx # 统一运维菜单
|
||||
nexus-update # 等同 update.sh
|
||||
nexus-fresh # 等同 install-nexus-fresh.sh
|
||||
nexus-install # 等同 quick-install.sh
|
||||
```
|
||||
|
||||
| 菜单 / 子命令 | 功能 |
|
||||
|---------------|------|
|
||||
| `[1]` | 安装向导（档位 / 迁机 / skip-clone） |
|
||||
| `[2]` | 全新安装 → `/app/install.html` |
|
||||
| `[3]` | 状态 + `/health` + install.html 归档检查 |
|
||||
| `[4]` / `nx update` | **一键更新**（备份 + 重建镜像 + 升级后验收） |
|
||||
| `[5]` | 重启 Nexus 容器 |
|
||||
| `[6]` | 日志 |
|
||||
| `[7]` | 启动 / 停止 Compose 栈 |
|
||||
| `[8]` | 无缓存重建镜像 |
|
||||
| `[9]` | 立即备份 MySQL |
|
||||
| `[e]` / `nx cron` | 安装 health_monitor + db_backup crontab |
|
||||
| `[v]` / `nx verify` | 运行 `verify-1panel-install-wizard.sh` |
|
||||
|
||||
---
|
||||
|
||||
## 三层守护（1Panel Docker）
|
||||
|
||||
| 层 | 机制 | 说明 |
|
||||
|----|------|------|
|
||||
| Layer 1 | Compose `restart` + 容器 `healthcheck` | 容器崩溃自动拉起 |
|
||||
| Layer 2 | Python `self_monitor`（30s） | Redis/MySQL/WebSocket 自检 |
|
||||
| Layer 3 | 宿主机 `health_monitor.sh`（cron） | `/health` 连续失败 → `docker restart` + 可选 Telegram |
|
||||
|
||||
Layer 3 需**在宿主机**安装（容器内无法写 crontab）：
|
||||
|
||||
```bash
|
||||
sudo nx cron
|
||||
# 或
|
||||
sudo bash /opt/nexus/deploy/install_ops_cron.sh
|
||||
```
|
||||
|
||||
MySQL 定时备份：每日 03:00 → `/var/backups/nexus/`（`docker exec` 进 1Panel MySQL 容器 dump，**无需**宿主机 `mysqldump`）。
|
||||
|
||||
---
|
||||
|
||||
## 安装完成后
|
||||
|
||||
- 向导锁定后 `install.html` → **`install.html.bak`**，外网 `/app/install.html` 返回 **404**（正常）
|
||||
- 登录：`https://你的域名/app/`
|
||||
- 验收：`sudo nx verify`
|
||||
|
||||
---
|
||||
|
||||
## MySQL / Redis（1Panel 应用商店）
|
||||
|
||||
Docker 栈**仅含 Nexus 容器**。MySQL / Redis 在 **1Panel 应用商店**安装。
|
||||
|
||||
### 1Panel 官方互联方式（必读）
|
||||
|
||||
[1Panel 维护者说明](https://github.com/1Panel-dev/1Panel/issues/11676)：应用商店应用使用 **bridge + `1panel-network`**；**容器之间用容器名通信**（Docker 内置 DNS），不要用 `localhost` / `127.0.0.1` / `host.docker.internal`。
|
||||
|
||||
| 场景 | 正确主机 |
|
||||
|------|----------|
|
||||
| Nexus → 1Panel MySQL | `1Panel-mysql-xxxx`（容器列表中的名称） |
|
||||
| Nexus → 1Panel Redis | `1Panel-redis-xxxx` |
|
||||
| OpenResty → 应用 | `127.0.0.1:端口`（OpenResty 为 host 网络） |
|
||||
|
||||
`nx update` / `nexus-1panel.sh` 会：
|
||||
|
||||
1. 将 Nexus 加入 **`1panel-network`**（`docker/docker-compose.1panel.yml`）
|
||||
2. 自动探测 MySQL/Redis 容器名写入 `docker/.env.prod`（含 `NEXUS_REDIS_URL=redis://1Panel-redis-xxxx:6379/0`）
|
||||
3. 安装向导步骤 3 **预填 MySQL/Redis 容器名**
|
||||
|
||||
### 安装步骤
|
||||
|
||||
1. **应用商店** → 安装 **MySQL**、**Redis**
|
||||
2. **数据库** → 创建库 `nexus`、用户 `nexus`（仅授权 `nexus` 库），记下密码
|
||||
3. `nx update` 后打开安装向导步骤 3（主机应已预填 `1Panel-mysql-…`）
|
||||
4. 填写 MySQL 密码；Redis：**用户名通常留空** + 应用参数密码（自动尝试 `:pass@` / `default`）
|
||||
|
||||
### 常见错误 1045（Access denied for 'nexus'@'172.18.x.x'）
|
||||
|
||||
TCP 已通，但 MySQL 用户多为 **`nexus@localhost`**，Docker 内 Nexus 从 **172.x** 连接会被拒绝。
|
||||
|
||||
在服务器执行（按提示输入 root 密码与 nexus 密码）：
|
||||
|
||||
```bash
|
||||
cd /opt/nexus && bash deploy/fix-1panel-mysql-grant.sh
|
||||
```
|
||||
|
||||
或一次性：
|
||||
|
||||
```bash
|
||||
MYSQL_ROOT_PASSWORD='1Panel里MySQL的root密码' \
|
||||
NEXUS_DB_PASSWORD='向导里要填的nexus密码' \
|
||||
bash /opt/nexus/deploy/fix-1panel-mysql-grant.sh
|
||||
```
|
||||
|
||||
然后安装向导步骤 3：**库名/用户 `nexus`**，主机为 `1Panel-mysql-xxxx`，密码与上面一致。
|
||||
|
||||
若仍报 `Can't connect to MySQL/Redis on 'host.docker.internal'`：说明 Nexus **未接入 1panel-network** 或未探测到容器名，在服务器执行：
|
||||
|
||||
```bash
|
||||
cd /opt/nexus && bash deploy/detect-1panel-services.sh
|
||||
nx update --no-cache
|
||||
```
|
||||
|
||||
步骤 2 会 TCP 检测 MySQL/Redis；步骤 4 验证账号密码。
|
||||
|
||||
卸载旧 Compose 容器：
|
||||
|
||||
```bash
|
||||
bash deploy/uninstall-mysql-compose.sh
|
||||
bash deploy/uninstall-redis-compose.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 1Panel 反代
|
||||
|
||||
**禁止**脚本改 `/opt/1panel/apps/openresty/`。
|
||||
|
||||
1. 应用商店 → **OpenResty**
|
||||
2. 网站 → 反代 `http://127.0.0.1:8600`
|
||||
3. 参考：`deploy/1panel/openresty-nexus.conf.example`
|
||||
|
||||
---
|
||||
|
||||
## 密钥
|
||||
|
||||
新机自动生成 `NEXUS_SECRET_KEY` / `NEXUS_API_KEY` / `NEXUS_ENCRYPTION_KEY` → `docker/.env.prod`，备份 `/root/.nexus-install-secrets-*.env`。
|
||||
|
||||
MySQL 密码在 1Panel 自建库时设定，向导步骤 3 填写。
|
||||
|
||||
| 场景 | 命令 |
|
||||
|------|------|
|
||||
| 新机 | `curl \| quick-install.sh` |
|
||||
| 迁机 | `nexus-1panel.sh install --from-env /path/to/.env` |
|
||||
| 更新 | `update.sh` 或 `nx update` |
|
||||
|
||||
**Git**：公开仓库 `clone` / `pull` / `curl | bash` 无需令牌。
|
||||
|
||||
---
|
||||
|
||||
## 安装向导验收（服务器执行）
|
||||
|
||||
在 **1Panel 终端**（root）一键检查网络、容器名预填、cron、镜像版本、本地 `/health`：
|
||||
|
||||
```bash
|
||||
cd /opt/nexus && sudo nx verify
|
||||
```
|
||||
|
||||
**未安装**：通过后再打开 `https://你的域名/app/install.html`。
|
||||
**已安装**：`install.html` 应 HTTP 404；验收检查 crontab、`mysql_dump_to_file.sh`、容器内 round6/7 代码特性。
|
||||
|
||||
常见修复：
|
||||
|
||||
```bash
|
||||
cd /opt/nexus && bash deploy/detect-1panel-services.sh
|
||||
nx update --no-cache
|
||||
```
|
||||
|
||||
外网 HTTPS 仍失败但脚本本地检查全绿 → 在 1Panel **网站**配置反代 `http://127.0.0.1:8600`（见 `deploy/1panel/openresty-nexus.conf.example`）。
|
||||
|
||||
## 安装向导热修复
|
||||
|
||||
```bash
|
||||
cd /opt/nexus && git pull
|
||||
bash deploy/update.sh --no-cache
|
||||
# 或仅同步静态:
|
||||
bash deploy/sync-install-wizard-to-container.sh
|
||||
```
|
||||
@@ -1,272 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Apply a Nexus release tarball on the production host.
|
||||
#
|
||||
# Usage:
|
||||
# sudo bash deploy/apply-release-bundle.sh \
|
||||
# --tarball /tmp/nexus-release-20260708.tar.gz \
|
||||
# --sha256 6474d58fdccde668b4c91d5e7454fa08e01e20660e3bcbb363eeadbb7c2346a1 \
|
||||
# --deploy-path /opt/nexus
|
||||
#
|
||||
# Validate only (no backup, no rsync, no rebuild):
|
||||
# bash deploy/apply-release-bundle.sh --validate-only \
|
||||
# --tarball /tmp/nexus-release-20260708.tar.gz \
|
||||
# --sha256 6474d58fdccde668b4c91d5e7454fa08e01e20660e3bcbb363eeadbb7c2346a1
|
||||
#
|
||||
# This script intentionally preserves runtime secrets and data:
|
||||
# - .env
|
||||
# - docker/.env.prod
|
||||
# - web/data
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
TARBALL=""
|
||||
EXPECTED_SHA256=""
|
||||
DEPLOY_PATH="${NEXUS_DEPLOY_PATH:-/opt/nexus}"
|
||||
BACKUP_DIR="${NEXUS_BACKUP_DIR:-/opt/nexus-backups}"
|
||||
SKIP_REBUILD=0
|
||||
DRY_RUN=0
|
||||
VALIDATE_ONLY=0
|
||||
APPLY_TMP=""
|
||||
|
||||
info() { echo -e "\033[0;32m[INFO]\033[0m $*"; }
|
||||
warn() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
|
||||
error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
|
||||
|
||||
usage() {
|
||||
sed -n '1,26p' "$0"
|
||||
}
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--tarball)
|
||||
TARBALL="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--sha256)
|
||||
EXPECTED_SHA256="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--deploy-path)
|
||||
DEPLOY_PATH="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--backup-dir)
|
||||
BACKUP_DIR="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--skip-rebuild)
|
||||
SKIP_REBUILD=1
|
||||
shift
|
||||
;;
|
||||
--dry-run)
|
||||
DRY_RUN=1
|
||||
shift
|
||||
;;
|
||||
--validate-only)
|
||||
VALIDATE_ONLY=1
|
||||
shift
|
||||
;;
|
||||
-h|--help)
|
||||
usage
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
error "Unknown argument: $1"
|
||||
usage
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
require_cmd() {
|
||||
command -v "$1" >/dev/null 2>&1 || {
|
||||
error "Missing required command: $1"
|
||||
exit 127
|
||||
}
|
||||
}
|
||||
|
||||
require_runtime_cmds() {
|
||||
require_cmd tar
|
||||
require_cmd sha256sum
|
||||
if [[ "$VALIDATE_ONLY" == 1 ]]; then
|
||||
return 0
|
||||
fi
|
||||
require_cmd rsync
|
||||
require_cmd curl
|
||||
}
|
||||
|
||||
run() {
|
||||
echo "+ $*"
|
||||
if [[ "$DRY_RUN" == 1 ]]; then
|
||||
return 0
|
||||
fi
|
||||
"$@"
|
||||
}
|
||||
|
||||
cleanup() {
|
||||
if [[ -n "${APPLY_TMP:-}" && -d "$APPLY_TMP" ]]; then
|
||||
rm -rf "$APPLY_TMP"
|
||||
fi
|
||||
}
|
||||
|
||||
detect_runtime() {
|
||||
if [[ -f "${DEPLOY_PATH}/docker/.env.prod" ]] && command -v docker >/dev/null 2>&1; then
|
||||
echo docker
|
||||
return
|
||||
fi
|
||||
if command -v supervisorctl >/dev/null 2>&1 && supervisorctl status nexus >/dev/null 2>&1; then
|
||||
echo supervisor
|
||||
return
|
||||
fi
|
||||
echo unknown
|
||||
}
|
||||
|
||||
verify_sha256() {
|
||||
if [[ -z "$EXPECTED_SHA256" ]]; then
|
||||
warn "No --sha256 provided; skipping checksum verification"
|
||||
return 0
|
||||
fi
|
||||
local actual
|
||||
actual="$(sha256sum "$TARBALL" | awk '{print $1}')"
|
||||
if [[ "$actual" != "$EXPECTED_SHA256" ]]; then
|
||||
error "SHA256 mismatch"
|
||||
error "expected: $EXPECTED_SHA256"
|
||||
error "actual: $actual"
|
||||
exit 1
|
||||
fi
|
||||
info "SHA256 OK: $actual"
|
||||
}
|
||||
|
||||
validate_extracted_tree() {
|
||||
local src="$1"
|
||||
for required in server deploy Dockerfile.prod frontend-v2 web/app-v2; do
|
||||
if [[ ! -e "${src}/${required}" ]]; then
|
||||
error "Release bundle missing required path: ${required}"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
for forbidden in .env docker/.env.prod web/data .venv-py312-codex frontend-v2/node_modules 2025.2 =2025.2; do
|
||||
if [[ -e "${src}/${forbidden}" ]]; then
|
||||
error "Release bundle contains forbidden path: ${forbidden}"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
info "Extracted release tree validation OK"
|
||||
}
|
||||
|
||||
backup_current() {
|
||||
if [[ ! -d "$DEPLOY_PATH" ]]; then
|
||||
warn "Deploy path does not exist yet: $DEPLOY_PATH"
|
||||
return 0
|
||||
fi
|
||||
local stamp backup
|
||||
stamp="$(date +%Y%m%d-%H%M%S)"
|
||||
backup="${BACKUP_DIR}/nexus-before-${stamp}.tar.gz"
|
||||
run mkdir -p "$BACKUP_DIR"
|
||||
info "Backup current deploy path -> $backup"
|
||||
run tar czf "$backup" \
|
||||
--exclude='./web/data' \
|
||||
--exclude='./.venv*' \
|
||||
--exclude='./venv' \
|
||||
--exclude='./frontend/node_modules' \
|
||||
--exclude='./frontend-v2/node_modules' \
|
||||
-C "$(dirname "$DEPLOY_PATH")" "$(basename "$DEPLOY_PATH")"
|
||||
}
|
||||
|
||||
sync_release() {
|
||||
local src="$1"
|
||||
run mkdir -p "$DEPLOY_PATH"
|
||||
info "Sync release tree -> $DEPLOY_PATH"
|
||||
run rsync -a --delete \
|
||||
--exclude='.env' \
|
||||
--exclude='docker/.env.prod' \
|
||||
--exclude='web/data' \
|
||||
"${src}/" "${DEPLOY_PATH}/"
|
||||
}
|
||||
|
||||
rebuild_or_restart() {
|
||||
if [[ "$SKIP_REBUILD" == 1 ]]; then
|
||||
warn "--skip-rebuild set; not rebuilding/restarting Nexus"
|
||||
return 0
|
||||
fi
|
||||
|
||||
local runtime
|
||||
runtime="$(detect_runtime)"
|
||||
info "Runtime: $runtime"
|
||||
case "$runtime" in
|
||||
docker)
|
||||
if [[ -x "${DEPLOY_PATH}/deploy/nexus-1panel.sh" || -f "${DEPLOY_PATH}/deploy/nexus-1panel.sh" ]]; then
|
||||
run env NEXUS_ROOT="$DEPLOY_PATH" bash "${DEPLOY_PATH}/deploy/nexus-1panel.sh" upgrade --skip-git
|
||||
else
|
||||
error "Docker runtime detected but deploy/nexus-1panel.sh missing"
|
||||
exit 1
|
||||
fi
|
||||
if [[ -f "${DEPLOY_PATH}/deploy/sync_webapp_to_container.sh" ]]; then
|
||||
run env NEXUS_ROOT="$DEPLOY_PATH" bash "${DEPLOY_PATH}/deploy/sync_webapp_to_container.sh"
|
||||
fi
|
||||
;;
|
||||
supervisor)
|
||||
run supervisorctl restart nexus
|
||||
;;
|
||||
*)
|
||||
error "Unknown runtime. Rebuild/restart manually."
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
verify_local_endpoints() {
|
||||
local port health app app_v2
|
||||
port="$(grep -E '^NEXUS_PUBLISH_PORT=' "${DEPLOY_PATH}/docker/.env.prod" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r" ' || true)"
|
||||
port="${port:-8600}"
|
||||
health="$(curl -s "http://127.0.0.1:${port}/health" 2>/dev/null || true)"
|
||||
app="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app/" 2>/dev/null || echo 000)"
|
||||
app_v2="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app-v2/" 2>/dev/null || echo 000)"
|
||||
echo " /health -> ${health}"
|
||||
echo " /app/ -> ${app}"
|
||||
echo " /app-v2/ -> ${app_v2}"
|
||||
if [[ "$health" != "ok" || "$app" != "200" || "$app_v2" != "200" ]]; then
|
||||
error "Local endpoint verification failed"
|
||||
exit 1
|
||||
fi
|
||||
info "Local endpoint verification OK"
|
||||
}
|
||||
|
||||
main() {
|
||||
if [[ -z "$TARBALL" ]]; then
|
||||
error "--tarball is required"
|
||||
usage
|
||||
exit 2
|
||||
fi
|
||||
[[ -f "$TARBALL" ]] || {
|
||||
error "Tarball not found: $TARBALL"
|
||||
exit 1
|
||||
}
|
||||
|
||||
require_runtime_cmds
|
||||
|
||||
info "Tarball: $TARBALL"
|
||||
info "Deploy path: $DEPLOY_PATH"
|
||||
info "Backup dir: $BACKUP_DIR"
|
||||
verify_sha256
|
||||
|
||||
local extracted
|
||||
APPLY_TMP="$(mktemp -d /tmp/nexus-release-apply.XXXXXX)"
|
||||
trap cleanup EXIT
|
||||
run tar xzf "$TARBALL" -C "$APPLY_TMP"
|
||||
extracted="${APPLY_TMP}/nexus-release"
|
||||
validate_extracted_tree "$extracted"
|
||||
if [[ "$VALIDATE_ONLY" == 1 ]]; then
|
||||
info "Validate-only mode: tarball checksum and content validation passed"
|
||||
return 0
|
||||
fi
|
||||
backup_current
|
||||
sync_release "$extracted"
|
||||
rebuild_or_restart
|
||||
if [[ "$DRY_RUN" != 1 && "$SKIP_REBUILD" != 1 ]]; then
|
||||
verify_local_endpoints
|
||||
fi
|
||||
info "Release applied successfully"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,32 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Fail if tracked shell scripts contain CR (CRLF) — breaks bash on Ubuntu.
|
||||
# Usage: bash deploy/check_shell_eol.sh
|
||||
# Run from repo root (or set NEXUS_DEPLOY_DIR).
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
_REPO_ROOT="$(cd "${_SCRIPT_DIR}/.." && pwd)"
|
||||
ROOT="${NEXUS_DEPLOY_DIR:-${_REPO_ROOT}}"
|
||||
|
||||
cd "${ROOT}"
|
||||
|
||||
if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
|
||||
echo "check_shell_eol: not a git repo at ${ROOT}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
BAD=0
|
||||
while IFS= read -r -d '' f; do
|
||||
if grep -q $'\r' "${f}" 2>/dev/null; then
|
||||
echo "CRLF/CR detected: ${f}" >&2
|
||||
BAD=1
|
||||
fi
|
||||
done < <(git ls-files -z '*.sh')
|
||||
|
||||
if [ "${BAD}" -ne 0 ]; then
|
||||
echo "Fix: git add --renormalize '*.sh' or run dos2unix on listed files." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "check_shell_eol: OK (all tracked *.sh are LF-only)"
|
||||
+85
-29
@@ -1,46 +1,102 @@
|
||||
#!/usr/bin/env bash
|
||||
# Nexus — MySQL 定时备份（Docker 1Panel / 宿主机）
|
||||
# Nexus — MySQL Auto-Backup Script
|
||||
# Usage: Add to crontab for daily 3AM backup
|
||||
# 0 3 * * * /path/to/nexus/deploy/db_backup.sh >> /var/log/nexus_backup.log 2>&1
|
||||
#
|
||||
# 0 3 * * * NEXUS_ROOT=/opt/nexus /opt/nexus/deploy/db_backup.sh >> /var/log/nexus_backup.log 2>&1
|
||||
#
|
||||
# 亦可通过: sudo bash deploy/install_ops_cron.sh
|
||||
# Reads DATABASE_URL from .env for connection parameters.
|
||||
# Retains backups for 30 days, auto-deletes older ones.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-$(dirname "$SCRIPT_DIR")}"
|
||||
BACKUP_DIR="${NEXUS_BACKUP_DIR:-/var/backups/nexus}"
|
||||
RETENTION_DAYS="${NEXUS_BACKUP_RETENTION_DAYS:-30}"
|
||||
DUMP_SH="${SCRIPT_DIR}/mysql_dump_to_file.sh"
|
||||
PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
|
||||
ENV_FILE="$PROJECT_DIR/.env"
|
||||
BACKUP_DIR="$PROJECT_DIR/backups"
|
||||
RETENTION_DAYS=30
|
||||
|
||||
if [[ ! -f "$DUMP_SH" ]]; then
|
||||
echo "[$(date)] ERROR: missing $DUMP_SH"
|
||||
# ── Load .env ──
|
||||
if [ ! -f "$ENV_FILE" ]; then
|
||||
echo "[$(date)] ERROR: .env not found at $ENV_FILE"
|
||||
exit 1
|
||||
fi
|
||||
chmod +x "$DUMP_SH" 2>/dev/null || true
|
||||
|
||||
# Parse DATABASE_URL from .env
|
||||
# Format: mysql+asyncmy://user:password@host:port/dbname
|
||||
DB_URL=$(grep -E '^NEXUS_DATABASE_URL=' "$ENV_FILE" | head -1 | cut -d= -f2- | tr -d '"' | tr -d "'")
|
||||
if [ -z "$DB_URL" ]; then
|
||||
DB_URL=$(grep -E '^DATABASE_URL=' "$ENV_FILE" | head -1 | cut -d= -f2- | tr -d '"' | tr -d "'")
|
||||
fi
|
||||
|
||||
if [ -z "$DB_URL" ]; then
|
||||
echo "[$(date)] ERROR: DATABASE_URL not found in .env"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Parse mysql URL: mysql+asyncmy://user:pass@host:port/dbname → user pass host port dbname
|
||||
# Strip scheme
|
||||
CONN="${DB_URL#*://}"
|
||||
# Extract user:pass
|
||||
USERPASS="${CONN%%@*}"
|
||||
DB_USER="${USERPASS%%:*}"
|
||||
DB_PASS="${USERPASS#*:}"
|
||||
# Extract host:port/dbname
|
||||
HOSTDB="${CONN#*@}"
|
||||
DB_HOST="${HOSTDB%%:*}"
|
||||
PORTDB="${HOSTDB#*:}"
|
||||
DB_PORT="${PORTDB%%/*}"
|
||||
DB_NAME="${PORTDB#*/}"
|
||||
# Remove query params
|
||||
DB_NAME="${DB_NAME%%\?*}"
|
||||
|
||||
if [ -z "$DB_NAME" ] || [ -z "$DB_HOST" ] || [ -z "$DB_USER" ]; then
|
||||
echo "[$(date)] ERROR: Failed to parse DATABASE_URL"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# ── Create backup directory ──
|
||||
mkdir -p "$BACKUP_DIR"
|
||||
TIMESTAMP="$(date +%Y%m%d_%H%M%S)"
|
||||
RAW_FILE="${BACKUP_DIR}/nexus_daily_${TIMESTAMP}.sql"
|
||||
BACKUP_FILE="${RAW_FILE}.gz"
|
||||
|
||||
echo "[$(date)] Starting backup → $BACKUP_FILE"
|
||||
if ! NEXUS_ROOT="$NEXUS_ROOT" bash "$DUMP_SH" --output "$RAW_FILE" --root "$NEXUS_ROOT"; then
|
||||
echo "[$(date)] ERROR: mysqldump failed"
|
||||
rm -f "$RAW_FILE"
|
||||
# ── Backup filename ──
|
||||
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
|
||||
BACKUP_FILE="$BACKUP_DIR/nexus_${DB_NAME}_${TIMESTAMP}.sql.gz"
|
||||
|
||||
# ── Run mysqldump ──
|
||||
echo "[$(date)] Starting backup: $DB_NAME @ $DB_HOST"
|
||||
|
||||
if [ -n "$DB_PASS" ]; then
|
||||
MYSQL_PWD="$DB_PASS" mysqldump \
|
||||
-h "$DB_HOST" \
|
||||
-P "${DB_PORT:-3306}" \
|
||||
-u "$DB_USER" \
|
||||
--single-transaction \
|
||||
--routines \
|
||||
--triggers \
|
||||
--set-gtid-purged=OFF \
|
||||
"$DB_NAME" | gzip > "$BACKUP_FILE"
|
||||
else
|
||||
mysqldump \
|
||||
-h "$DB_HOST" \
|
||||
-P "${DB_PORT:-3306}" \
|
||||
-u "$DB_USER" \
|
||||
--single-transaction \
|
||||
--routines \
|
||||
--triggers \
|
||||
--set-gtid-purged=OFF \
|
||||
"$DB_NAME" | gzip > "$BACKUP_FILE"
|
||||
fi
|
||||
|
||||
# ── Verify backup ──
|
||||
if [ -f "$BACKUP_FILE" ]; then
|
||||
SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
|
||||
echo "[$(date)] Backup completed: $BACKUP_FILE ($SIZE)"
|
||||
else
|
||||
echo "[$(date)] ERROR: Backup file not created!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
gzip -f "$RAW_FILE"
|
||||
if [[ ! -f "$BACKUP_FILE" ]]; then
|
||||
echo "[$(date)] ERROR: backup file not created"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
SIZE="$(du -h "$BACKUP_FILE" | cut -f1)"
|
||||
echo "[$(date)] Backup completed: $BACKUP_FILE ($SIZE)"
|
||||
|
||||
DELETED="$(find "$BACKUP_DIR" -name 'nexus_*.sql.gz' -mtime +"${RETENTION_DAYS}" -delete -print 2>/dev/null | wc -l)"
|
||||
if [[ "$DELETED" -gt 0 ]]; then
|
||||
# ── Cleanup old backups (retain 30 days) ──
|
||||
DELETED=$(find "$BACKUP_DIR" -name "nexus_*.sql.gz" -mtime +${RETENTION_DAYS} -delete -print | wc -l)
|
||||
if [ "$DELETED" -gt 0 ]; then
|
||||
echo "[$(date)] Cleaned up $DELETED old backup(s) (>${RETENTION_DAYS} days)"
|
||||
fi
|
||||
|
||||
|
||||
+33
-82
@@ -1,107 +1,58 @@
|
||||
#!/usr/bin/env bash
|
||||
#!/bin/bash
|
||||
# deploy-frontend.sh — Build Vuetify frontend and deploy to server
|
||||
#
|
||||
# Docker 生产：前端在镜像内构建，远程执行 nexus-1panel.sh upgrade
|
||||
# Supervisor：tar 上传到 web/app + supervisorctl restart
|
||||
#
|
||||
# Usage: bash deploy/deploy-frontend.sh
|
||||
# Run from the Nexus project root directory.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_SSH_HOST="${NEXUS_SSH:-nexus}"
|
||||
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=15)
|
||||
if [[ -n "${NEXUS_SSH_KEY:-}" ]]; then
|
||||
SSH_OPTS+=(-i "${NEXUS_SSH_KEY}")
|
||||
fi
|
||||
ssh_cmd() { ssh "${SSH_OPTS[@]}" "${NEXUS_SSH_HOST}" "$@"; }
|
||||
|
||||
echo "═══ Nexus Frontend Deploy ═══"
|
||||
|
||||
REMOTE_RUNTIME=$(ssh_cmd 'bash -s' <<'REMOTE'
|
||||
set -euo pipefail
|
||||
docker_cmd() {
|
||||
if docker "$@" 2>/dev/null; then return 0; fi
|
||||
sudo docker "$@" 2>/dev/null
|
||||
}
|
||||
compose_cmd() {
|
||||
if docker compose "$@" 2>/dev/null; then return 0; fi
|
||||
sudo docker compose "$@" 2>/dev/null
|
||||
}
|
||||
for d in /opt/nexus /www/wwwroot/api.synaglobal.vip; do
|
||||
[[ -d "$d/server" ]] || continue
|
||||
if [[ -f "$d/docker/.env.prod" ]] && compose_cmd version >/dev/null 2>&1; then
|
||||
prof="$d/docker/.host-profile"
|
||||
[[ -f "$prof" ]] || prof="$d/docker/profiles/2c8g.env"
|
||||
if [[ -f "$prof" ]]; then
|
||||
args=(-f "$d/docker/docker-compose.prod.yml")
|
||||
docker_cmd network inspect 1panel-network >/dev/null 2>&1 && \
|
||||
[[ -f "$d/docker/docker-compose.1panel.yml" ]] && \
|
||||
args+=(-f "$d/docker/docker-compose.1panel.yml")
|
||||
q=$(cd "$d" && compose_cmd "${args[@]}" \
|
||||
--env-file "$d/docker/.env.prod" --env-file "$prof" ps -q nexus 2>/dev/null || true)
|
||||
[[ -n "$q" ]] && echo "docker $d" && exit 0
|
||||
fi
|
||||
fi
|
||||
if [[ -f "$d/deploy/nexus-1panel.sh" ]]; then
|
||||
q=$(docker_cmd ps --format '{{.Names}}' 2>/dev/null | grep -E '^nexus-prod-nexus-' || true)
|
||||
[[ -n "$q" ]] && echo "docker $d" && exit 0
|
||||
fi
|
||||
if command -v supervisorctl >/dev/null 2>&1 && supervisorctl status nexus >/dev/null 2>&1; then
|
||||
echo "supervisor $d"
|
||||
exit 0
|
||||
fi
|
||||
done
|
||||
echo "unknown"
|
||||
REMOTE
|
||||
)
|
||||
|
||||
RUNTIME="${REMOTE_RUNTIME%% *}"
|
||||
DEPLOY_PATH="${REMOTE_RUNTIME#* }"
|
||||
[[ "$DEPLOY_PATH" == "$REMOTE_RUNTIME" ]] && DEPLOY_PATH="/www/wwwroot/api.synaglobal.vip"
|
||||
|
||||
echo "Remote runtime: ${RUNTIME} @ ${DEPLOY_PATH}"
|
||||
|
||||
echo "▶ Building frontend (local verify)..."
|
||||
# 1. Build
|
||||
echo "▶ Building frontend..."
|
||||
cd frontend && npx vite build && cd ..
|
||||
echo "✓ Build complete"
|
||||
|
||||
if [[ "$RUNTIME" == "docker" ]]; then
|
||||
echo "▶ Docker 生产：重建镜像以包含新前端（非 tar 热更新）..."
|
||||
ssh_cmd "cd ${DEPLOY_PATH} && sudo env NEXUS_ROOT=${DEPLOY_PATH} bash ${DEPLOY_PATH}/deploy/nexus-1panel.sh upgrade"
|
||||
else
|
||||
echo "▶ Packaging..."
|
||||
tar czf /tmp/nexus-frontend.tar.gz -C web/app index.html assets/
|
||||
echo "✓ Package ready ($(du -h /tmp/nexus-frontend.tar.gz | cut -f1))"
|
||||
# 2. Tar the build output (index.html + assets/)
|
||||
echo "▶ Packaging..."
|
||||
tar czf /tmp/nexus-frontend.tar.gz -C web/app index.html assets/
|
||||
echo "✓ Package ready ($(du -h /tmp/nexus-frontend.tar.gz | cut -f1))"
|
||||
|
||||
echo "▶ Uploading to server..."
|
||||
scp "${SSH_OPTS[@]}" /tmp/nexus-frontend.tar.gz "${NEXUS_SSH_HOST}:/tmp/nexus-frontend.tar.gz"
|
||||
echo "✓ Upload complete"
|
||||
# 3. Upload to server
|
||||
echo "▶ Uploading to server..."
|
||||
scp /tmp/nexus-frontend.tar.gz nexus:/tmp/nexus-frontend.tar.gz
|
||||
echo "✓ Upload complete"
|
||||
|
||||
echo "▶ Deploying on server..."
|
||||
ssh_cmd "cd ${DEPLOY_PATH}/web/app && tar xzf /tmp/nexus-frontend.tar.gz && rm /tmp/nexus-frontend.tar.gz"
|
||||
echo "▶ Pruning orphaned assets..."
|
||||
if ! ssh_cmd "python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py --dry-run"; then
|
||||
echo "✗ Prune dry-run failed"
|
||||
exit 1
|
||||
fi
|
||||
ssh_cmd "python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py"
|
||||
echo "✓ Extracted and pruned"
|
||||
|
||||
echo "▶ Restarting backend..."
|
||||
ssh_cmd "supervisorctl restart nexus"
|
||||
echo "✓ Restarted"
|
||||
# 4. Extract on server + prune orphaned legacy chunks
|
||||
echo "▶ Deploying on server..."
|
||||
ssh nexus "cd /www/wwwroot/api.synaglobal.vip/web/app && tar xzf /tmp/nexus-frontend.tar.gz && rm /tmp/nexus-frontend.tar.gz"
|
||||
echo "▶ Pruning orphaned assets (dry-run first)..."
|
||||
if ! ssh nexus "python3 /www/wwwroot/api.synaglobal.vip/deploy/prune_frontend_assets.py --dry-run"; then
|
||||
echo "✗ Prune dry-run failed — aborting (no files deleted)"
|
||||
exit 1
|
||||
fi
|
||||
if ! ssh nexus "python3 /www/wwwroot/api.synaglobal.vip/deploy/prune_frontend_assets.py"; then
|
||||
echo "✗ Prune failed — check index.html references before retry"
|
||||
exit 1
|
||||
fi
|
||||
echo "✓ Extracted and pruned"
|
||||
|
||||
# 5. Restart backend
|
||||
echo "▶ Restarting backend..."
|
||||
ssh nexus "supervisorctl restart nexus"
|
||||
echo "✓ Restarted"
|
||||
|
||||
# 6. Health check
|
||||
sleep 3
|
||||
HEALTH=$(ssh_cmd "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8600/health" 2>/dev/null || echo "000")
|
||||
SPA=$(ssh_cmd "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8600/app/" 2>/dev/null || echo "000")
|
||||
HEALTH=$(ssh nexus "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8600/health" 2>/dev/null || echo "000")
|
||||
SPA=$(ssh nexus "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8600/app/" 2>/dev/null || echo "000")
|
||||
|
||||
echo ""
|
||||
echo "═══ Verification ═══"
|
||||
echo " /health → $HEALTH"
|
||||
echo " /app/ → $SPA"
|
||||
|
||||
if [[ "$HEALTH" == "200" || "$HEALTH" == "ok" ]] && [[ "$SPA" == "200" ]]; then
|
||||
if [ "$HEALTH" = "200" ] && [ "$SPA" = "200" ]; then
|
||||
echo "✓ Deploy successful!"
|
||||
else
|
||||
echo "✗ Verification failed — check server logs"
|
||||
|
||||
@@ -1,73 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Run ON production server — 自动识别 Docker / Supervisor
|
||||
#
|
||||
# Usage (on server):
|
||||
# cd /opt/nexus && sudo bash deploy/deploy-on-server.sh
|
||||
# cd /www/wwwroot/api.synaglobal.vip && bash deploy/deploy-on-server.sh
|
||||
#
|
||||
# Optional env:
|
||||
# NEXUS_GITEA_TOKEN — if git pull needs auth
|
||||
# SKIP_FRONTEND=1 — Supervisor 模式跳过热更新前端 tar
|
||||
# NEXUS_DEPLOY_PATH — 覆盖自动检测路径
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||
# shellcheck source=./detect_deploy_runtime.sh
|
||||
source "${SCRIPT_DIR}/detect_deploy_runtime.sh"
|
||||
|
||||
DEPLOY_PATH="$(resolve_nexus_root "${NEXUS_DEPLOY_PATH:-}" 2>/dev/null || true)"
|
||||
if [[ -z "$DEPLOY_PATH" ]]; then
|
||||
echo "ERROR: cannot resolve Nexus root" >&2
|
||||
exit 1
|
||||
fi
|
||||
cd "${DEPLOY_PATH}"
|
||||
|
||||
RUNTIME="$(detect_nexus_runtime "$DEPLOY_PATH")"
|
||||
PORT="$(nexus_publish_port_for "$DEPLOY_PATH")"
|
||||
|
||||
echo "═══ Nexus server-side deploy ═══"
|
||||
echo "Path: ${DEPLOY_PATH}"
|
||||
echo "Runtime: ${RUNTIME}"
|
||||
|
||||
if [[ -n "${NEXUS_GITEA_TOKEN:-}" ]]; then
|
||||
git remote set-url origin "http://admin:${NEXUS_GITEA_TOKEN}@66.154.115.8:3000/admin/Nexus.git"
|
||||
fi
|
||||
|
||||
if [[ "$RUNTIME" == "docker" ]]; then
|
||||
echo "▶ Docker upgrade (pull + rebuild)..."
|
||||
exec env NEXUS_ROOT="$DEPLOY_PATH" bash "$DEPLOY_PATH/deploy/nexus-1panel.sh" upgrade
|
||||
fi
|
||||
|
||||
echo "▶ git fetch + reset --hard origin/main..."
|
||||
git fetch --all
|
||||
git reset --hard origin/main
|
||||
echo " HEAD: $(git log -1 --oneline)"
|
||||
|
||||
echo "▶ supervisorctl restart nexus..."
|
||||
supervisorctl restart nexus
|
||||
|
||||
if [[ -f /tmp/nexus-frontend.tar.gz && "${SKIP_FRONTEND:-0}" != "1" ]]; then
|
||||
echo "▶ extract /tmp/nexus-frontend.tar.gz..."
|
||||
tar xzf /tmp/nexus-frontend.tar.gz -C web/app
|
||||
rm -f /tmp/nexus-frontend.tar.gz
|
||||
if [[ -f deploy/prune_frontend_assets.py ]]; then
|
||||
python3 deploy/prune_frontend_assets.py --dry-run
|
||||
python3 deploy/prune_frontend_assets.py
|
||||
fi
|
||||
supervisorctl restart nexus
|
||||
fi
|
||||
|
||||
sleep 3
|
||||
HEALTH=$(curl -s "http://127.0.0.1:${PORT}/health" || true)
|
||||
SPA=$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}/app/" || echo "000")
|
||||
echo " /health → ${HEALTH}"
|
||||
echo " /app/ → ${SPA}"
|
||||
|
||||
if [[ "${HEALTH}" == "ok" && "${SPA}" == "200" ]]; then
|
||||
echo "✓ Server deploy OK"
|
||||
suggest_ops_cron "$DEPLOY_PATH"
|
||||
else
|
||||
echo "✗ Verify failed — check: supervisorctl status nexus" >&2
|
||||
exit 1
|
||||
fi
|
||||
@@ -1,199 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Full production deploy: local rsync + backend upgrade + frontend + health
|
||||
#
|
||||
# 默认从本机工作区 rsync 到生产机，不 push Gitea、不远程 git pull。
|
||||
#
|
||||
# Prerequisites on YOUR machine:
|
||||
# - rsync, SSH Host nexus OR export NEXUS_SSH="azureuser@20.24.218.235"
|
||||
# - Key: export NEXUS_SSH_KEY=~/.ssh/id_rsa_nexus
|
||||
#
|
||||
# Usage:
|
||||
# cd "$NEXUS_ROOT"
|
||||
# bash deploy/pre_deploy_check.sh
|
||||
# bash deploy/deploy-production.sh
|
||||
#
|
||||
# 仍走 Gitea（仅当显式设置）:
|
||||
# NEXUS_DEPLOY_VIA_GIT=1 bash deploy/deploy-production.sh
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
cd "${ROOT}"
|
||||
|
||||
SECRETS="${ROOT}/deploy/nexus-1panel.secrets.sh"
|
||||
if [[ -f "$SECRETS" ]]; then
|
||||
# shellcheck disable=SC1090
|
||||
source "$SECRETS"
|
||||
fi
|
||||
|
||||
NEXUS_SSH_HOST="${NEXUS_SSH:-nexus}"
|
||||
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=15)
|
||||
if [[ -n "${NEXUS_SSH_KEY:-}" ]]; then
|
||||
SSH_OPTS+=(-i "${NEXUS_SSH_KEY}")
|
||||
fi
|
||||
ssh_cmd() { ssh "${SSH_OPTS[@]}" "${NEXUS_SSH_HOST}" "$@"; }
|
||||
scp_cmd() { scp "${SSH_OPTS[@]}" "$@"; }
|
||||
|
||||
DEPLOY_VIA_GIT="${NEXUS_DEPLOY_VIA_GIT:-0}"
|
||||
case "${DEPLOY_VIA_GIT}" in
|
||||
1|true|yes|on) DEPLOY_VIA_GIT=1 ;;
|
||||
*) DEPLOY_VIA_GIT=0 ;;
|
||||
esac
|
||||
|
||||
echo "═══ Nexus production deploy ═══"
|
||||
echo "SSH target: ${NEXUS_SSH_HOST}"
|
||||
echo "Mode: $([[ "$DEPLOY_VIA_GIT" == 1 ]] && echo 'Gitea git pull' || echo 'local rsync')"
|
||||
|
||||
if ! ssh_cmd "echo SSH OK" >/dev/null 2>&1; then
|
||||
echo "ERROR: Cannot SSH to ${NEXUS_SSH_HOST}" >&2
|
||||
echo " Configure ~/.ssh/config (Host nexus) or set NEXUS_SSH / NEXUS_SSH_KEY" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
REMOTE_DETECT=$(ssh_cmd 'bash -s' <<'REMOTE'
|
||||
set -euo pipefail
|
||||
docker_cmd() {
|
||||
if docker "$@" 2>/dev/null; then return 0; fi
|
||||
sudo docker "$@" 2>/dev/null
|
||||
}
|
||||
compose_cmd() {
|
||||
if docker compose "$@" 2>/dev/null; then return 0; fi
|
||||
sudo docker compose "$@" 2>/dev/null
|
||||
}
|
||||
for d in /opt/nexus /www/wwwroot/api.synaglobal.vip; do
|
||||
[[ -d "$d/server" ]] || continue
|
||||
echo "ROOT=$d"
|
||||
if [[ -f "$d/docker/.env.prod" ]] && compose_cmd version >/dev/null 2>&1; then
|
||||
prof="$d/docker/.host-profile"
|
||||
[[ -f "$prof" ]] || prof="$d/docker/profiles/2c8g.env"
|
||||
if [[ -f "$prof" ]]; then
|
||||
args=(-f "$d/docker/docker-compose.prod.yml")
|
||||
docker_cmd network inspect 1panel-network >/dev/null 2>&1 && \
|
||||
[[ -f "$d/docker/docker-compose.1panel.yml" ]] && \
|
||||
args+=(-f "$d/docker/docker-compose.1panel.yml")
|
||||
q=$(cd "$d" && compose_cmd "${args[@]}" \
|
||||
--env-file "$d/docker/.env.prod" --env-file "$prof" ps -q nexus 2>/dev/null || true)
|
||||
[[ -n "$q" ]] && echo RUNTIME=docker && exit 0
|
||||
fi
|
||||
fi
|
||||
if [[ -f "$d/deploy/nexus-1panel.sh" ]] && command -v nx >/dev/null 2>&1; then
|
||||
q=$(docker_cmd ps --format '{{.Names}}' 2>/dev/null | grep -E '^nexus-prod-nexus-' || true)
|
||||
[[ -n "$q" ]] && echo RUNTIME=docker && exit 0
|
||||
fi
|
||||
if command -v supervisorctl >/dev/null 2>&1 && supervisorctl status nexus >/dev/null 2>&1; then
|
||||
echo RUNTIME=supervisor
|
||||
exit 0
|
||||
fi
|
||||
echo RUNTIME=unknown
|
||||
exit 0
|
||||
done
|
||||
echo RUNTIME=none
|
||||
REMOTE
|
||||
)
|
||||
|
||||
DEPLOY_PATH="${NEXUS_DEPLOY_PATH:-$(echo "$REMOTE_DETECT" | sed -n 's/^ROOT=//p' | head -1)}"
|
||||
RUNTIME="$(echo "$REMOTE_DETECT" | sed -n 's/^RUNTIME=//p' | head -1)"
|
||||
|
||||
if [[ -z "$DEPLOY_PATH" ]]; then
|
||||
DEPLOY_PATH="${NEXUS_DEPLOY_PATH:-/opt/nexus}"
|
||||
fi
|
||||
if [[ -z "$RUNTIME" || "$RUNTIME" == "none" ]]; then
|
||||
RUNTIME="unknown"
|
||||
fi
|
||||
|
||||
echo "Deploy path: ${DEPLOY_PATH}"
|
||||
echo "Runtime: ${RUNTIME}"
|
||||
|
||||
resolve_deploy_chown() {
|
||||
if [[ -n "${NEXUS_DEPLOY_CHOWN:-}" ]]; then
|
||||
echo "${NEXUS_DEPLOY_CHOWN}"
|
||||
return
|
||||
fi
|
||||
if ssh_cmd "getent passwd www >/dev/null 2>&1"; then
|
||||
echo "www:www"
|
||||
return
|
||||
fi
|
||||
ssh_cmd "stat -c '%U:%G' '${DEPLOY_PATH}'" 2>/dev/null || echo "azureuser:azureuser"
|
||||
}
|
||||
DEPLOY_CHOWN="$(resolve_deploy_chown)"
|
||||
echo "File owner: ${DEPLOY_CHOWN}"
|
||||
|
||||
if [[ "$DEPLOY_VIA_GIT" == 1 ]]; then
|
||||
echo "▶ Git mode: remote git pull..."
|
||||
if [[ "$RUNTIME" == "docker" ]]; then
|
||||
ssh_cmd "cd ${DEPLOY_PATH} && sudo git fetch --all && sudo git reset --hard origin/main && \
|
||||
sudo env NEXUS_ROOT=${DEPLOY_PATH} bash ${DEPLOY_PATH}/deploy/nexus-1panel.sh upgrade"
|
||||
elif [[ "$RUNTIME" == "supervisor" ]]; then
|
||||
ssh_cmd "cd ${DEPLOY_PATH} && git fetch --all && git reset --hard origin/main && supervisorctl restart nexus"
|
||||
else
|
||||
echo "ERROR: 无法识别远程运行时" >&2
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo "▶ Local sync → ${DEPLOY_PATH}..."
|
||||
NEXUS_DEPLOY_PATH="${DEPLOY_PATH}" bash "${ROOT}/deploy/rsync-local-to-server.sh"
|
||||
|
||||
if [[ "$RUNTIME" == "docker" ]]; then
|
||||
echo "▶ Docker: 重建镜像（--skip-git）..."
|
||||
ssh_cmd "sudo env NEXUS_ROOT=${DEPLOY_PATH} bash ${DEPLOY_PATH}/deploy/nexus-1panel.sh upgrade --skip-git"
|
||||
elif [[ "$RUNTIME" == "supervisor" ]]; then
|
||||
echo "▶ Supervisor: restart..."
|
||||
ssh_cmd "supervisorctl restart nexus"
|
||||
else
|
||||
echo "ERROR: 无法识别远程运行时（非 Docker 也非 Supervisor）" >&2
|
||||
echo " 请手动: ssh ${NEXUS_SSH_HOST} 'sudo nx update'" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$RUNTIME" == "docker" || "$RUNTIME" == "supervisor" ]]; then
|
||||
echo "▶ Frontend: local vite build + upload to host web/app..."
|
||||
cd frontend && npx vite build && cd ..
|
||||
tar czf /tmp/nexus-frontend.tar.gz -C web/app index.html assets/
|
||||
scp_cmd /tmp/nexus-frontend.tar.gz "${NEXUS_SSH_HOST}:/tmp/nexus-frontend.tar.gz"
|
||||
ssh_cmd "cd ${DEPLOY_PATH}/web/app && sudo tar xzf /tmp/nexus-frontend.tar.gz && rm /tmp/nexus-frontend.tar.gz && sudo chown -R ${DEPLOY_CHOWN} ${DEPLOY_PATH}/web/app"
|
||||
|
||||
echo "▶ Frontend V2: local vite build:safe + upload to host web/app-v2..."
|
||||
cd frontend-v2 && npm run build:safe && cd ..
|
||||
tar czf /tmp/nexus-frontend-v2.tar.gz -C web/app-v2 index.html assets/
|
||||
scp_cmd /tmp/nexus-frontend-v2.tar.gz "${NEXUS_SSH_HOST}:/tmp/nexus-frontend-v2.tar.gz"
|
||||
ssh_cmd "sudo mkdir -p ${DEPLOY_PATH}/web/app-v2 && cd ${DEPLOY_PATH}/web/app-v2 && sudo tar xzf /tmp/nexus-frontend-v2.tar.gz && rm /tmp/nexus-frontend-v2.tar.gz && sudo chown -R ${DEPLOY_CHOWN} ${DEPLOY_PATH}/web/app-v2"
|
||||
|
||||
if ssh_cmd "test -f ${DEPLOY_PATH}/deploy/prune_frontend_assets.py"; then
|
||||
ssh_cmd "sudo python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py ${DEPLOY_PATH}/web/app --dry-run"
|
||||
ssh_cmd "sudo python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py ${DEPLOY_PATH}/web/app"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$RUNTIME" == "docker" ]]; then
|
||||
echo "▶ Sync host web/app and web/app-v2 into container..."
|
||||
ssh_cmd "sudo env NEXUS_ROOT=${DEPLOY_PATH} NEXUS_PUBLISH_PORT=\$(grep -E '^NEXUS_PUBLISH_PORT=' ${DEPLOY_PATH}/docker/.env.prod 2>/dev/null | cut -d= -f2 | tr -d '\"' || echo 8600) bash ${DEPLOY_PATH}/deploy/sync_webapp_to_container.sh" || {
|
||||
echo "WARN: web/app sync failed — run sync_webapp_to_container.sh on server manually" >&2
|
||||
}
|
||||
fi
|
||||
|
||||
sleep 3
|
||||
PORT="$(ssh_cmd "grep -E '^NEXUS_PUBLISH_PORT=' ${DEPLOY_PATH}/docker/.env.prod 2>/dev/null | cut -d= -f2 | tr -d '\"'" 2>/dev/null || true)"
|
||||
PORT="${PORT:-8600}"
|
||||
HEALTH=$(ssh_cmd "curl -s http://127.0.0.1:${PORT}/health" 2>/dev/null || true)
|
||||
SPA=$(ssh_cmd "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:${PORT}/app/" 2>/dev/null || echo "000")
|
||||
SPA_V2=$(ssh_cmd "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:${PORT}/app-v2/" 2>/dev/null || echo "000")
|
||||
echo " /health → ${HEALTH}"
|
||||
echo " /app/ → ${SPA}"
|
||||
echo " /app-v2/ → ${SPA_V2}"
|
||||
if [[ "${HEALTH}" == "ok" && "${SPA}" == "200" && "${SPA_V2}" == "200" ]]; then
|
||||
echo "✓ Deploy successful"
|
||||
if ssh_cmd "command -v crontab >/dev/null && crontab -l 2>/dev/null | grep -q nexus-health-monitor" 2>/dev/null; then
|
||||
echo "✓ Ops cron (health_monitor) already installed"
|
||||
else
|
||||
echo "▶ Installing ops cron (health_monitor + db_backup)…"
|
||||
if ssh_cmd "sudo env NEXUS_ROOT=${DEPLOY_PATH} bash ${DEPLOY_PATH}/deploy/install_ops_cron.sh" 2>/dev/null; then
|
||||
echo "✓ Ops cron installed"
|
||||
else
|
||||
echo " 提示: 远程 cron 安装失败，可在服务器执行: sudo nx cron"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
echo "✗ Verification failed — check logs on server" >&2
|
||||
exit 1
|
||||
fi
|
||||
@@ -1,43 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Detect 1Panel App Store MySQL/Redis container names on 1panel-network.
|
||||
# See: https://github.com/1Panel-dev/1Panel/issues/11676
|
||||
# https://github.com/1Panel-dev/appstore (mysql/redis → networks: 1panel-network)
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
network_container_names() {
|
||||
docker network inspect 1panel-network --format '{{range .Containers}}{{.Name}} {{end}}' 2>/dev/null \
|
||||
| tr ' ' '\n' | sed '/^$/d'
|
||||
}
|
||||
|
||||
pick_service_container() {
|
||||
local kind="$1"
|
||||
local names line
|
||||
names="$(network_container_names)"
|
||||
if [[ -z "$names" ]]; then
|
||||
docker ps --format '{{.Names}}' 2>/dev/null | grep -iE "(^1Panel-${kind}-|${kind})" | head -1 || true
|
||||
return
|
||||
fi
|
||||
line="$(echo "$names" | grep -iE "^1Panel-${kind}-" | head -1 || true)"
|
||||
if [[ -n "$line" ]]; then
|
||||
echo "$line"
|
||||
return
|
||||
fi
|
||||
echo "$names" | grep -i "$kind" | head -1 || true
|
||||
}
|
||||
|
||||
if ! docker network inspect 1panel-network >/dev/null 2>&1; then
|
||||
echo "1panel-network not found" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
MYSQL_HOST="$(pick_service_container mysql)"
|
||||
REDIS_HOST="$(pick_service_container redis)"
|
||||
|
||||
if [[ -z "$MYSQL_HOST" && -z "$REDIS_HOST" ]]; then
|
||||
echo "No MySQL/Redis containers on 1panel-network" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
[[ -n "$MYSQL_HOST" ]] && echo "NEXUS_1PANEL_DB_HOST=${MYSQL_HOST}"
|
||||
[[ -n "$REDIS_HOST" ]] && echo "NEXUS_1PANEL_REDIS_HOST=${REDIS_HOST}"
|
||||
@@ -1,149 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Nexus — 部署运行时检测（Docker 1Panel / Supervisor 裸机）
|
||||
#
|
||||
# source deploy/detect_deploy_runtime.sh
|
||||
# ROOT="$(resolve_nexus_root)"
|
||||
# RUNTIME="$(detect_nexus_runtime "$ROOT")" # docker | supervisor | unknown
|
||||
set -euo pipefail
|
||||
|
||||
_COMPOSE_FILE="docker/docker-compose.prod.yml"
|
||||
_COMPOSE_1PANEL="docker/docker-compose.1panel.yml"
|
||||
_ENV_PROD="docker/.env.prod"
|
||||
|
||||
resolve_nexus_root() {
|
||||
local hint="${1:-}"
|
||||
if [[ -n "$hint" && -d "$hint/server" ]]; then
|
||||
echo "$hint"
|
||||
return 0
|
||||
fi
|
||||
if [[ -n "${NEXUS_ROOT:-}" && -d "${NEXUS_ROOT}/server" ]]; then
|
||||
echo "$NEXUS_ROOT"
|
||||
return 0
|
||||
fi
|
||||
if [[ -n "${NEXUS_DEPLOY_PATH:-}" && -d "${NEXUS_DEPLOY_PATH}/server" ]]; then
|
||||
echo "$NEXUS_DEPLOY_PATH"
|
||||
return 0
|
||||
fi
|
||||
local d
|
||||
for d in /opt/nexus /www/wwwroot/api.synaglobal.vip; do
|
||||
if [[ -d "$d/server" ]]; then
|
||||
echo "$d"
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
for d in /www/wwwroot/*/; do
|
||||
[[ -d "${d}server" ]] || continue
|
||||
echo "${d%/}"
|
||||
return 0
|
||||
done
|
||||
if command -v supervisorctl >/dev/null 2>&1; then
|
||||
local cwd
|
||||
cwd="$(supervisorctl status nexus 2>/dev/null | grep -oP 'cwd=\K[^ ,]+' || true)"
|
||||
if [[ -n "$cwd" && -d "$cwd/server" ]]; then
|
||||
echo "$cwd"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
return 1
|
||||
}
|
||||
|
||||
_has_1panel_network() {
|
||||
docker network inspect 1panel-network >/dev/null 2>&1
|
||||
}
|
||||
|
||||
detect_nexus_runtime() {
|
||||
local root="$1"
|
||||
if [[ -f "$root/$_ENV_PROD" ]] && command -v docker >/dev/null 2>&1 \
|
||||
&& docker compose version >/dev/null 2>&1; then
|
||||
local -a args=(-f "$root/$_COMPOSE_FILE")
|
||||
if _has_1panel_network && [[ -f "$root/$_COMPOSE_1PANEL" ]]; then
|
||||
args+=(-f "$root/$_COMPOSE_1PANEL")
|
||||
fi
|
||||
local prof q
|
||||
prof="$root/docker/.host-profile"
|
||||
[[ -f "$prof" ]] || prof="$root/docker/profiles/2c8g.env"
|
||||
if [[ -f "$prof" ]]; then
|
||||
q="$(cd "$root" && docker compose "${args[@]}" \
|
||||
--env-file "$root/$_ENV_PROD" --env-file "$prof" \
|
||||
ps -q nexus 2>/dev/null || true)"
|
||||
if [[ -n "$q" ]]; then
|
||||
echo docker
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
if command -v supervisorctl >/dev/null 2>&1 \
|
||||
&& supervisorctl status nexus >/dev/null 2>&1; then
|
||||
echo supervisor
|
||||
return 0
|
||||
fi
|
||||
echo unknown
|
||||
}
|
||||
|
||||
nexus_publish_port_for() {
|
||||
local root="$1"
|
||||
local port
|
||||
port="$(grep -E '^NEXUS_PUBLISH_PORT=' "$root/$_ENV_PROD" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r" ' || true)"
|
||||
if [[ -z "$port" && -f "$root/.env" ]]; then
|
||||
port="$(grep -E '^NEXUS_PORT=' "$root/.env" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r" ' || true)"
|
||||
fi
|
||||
echo "${port:-8600}"
|
||||
}
|
||||
|
||||
nexus_restart_service() {
|
||||
local root="$1"
|
||||
local runtime
|
||||
runtime="$(detect_nexus_runtime "$root")"
|
||||
case "$runtime" in
|
||||
docker)
|
||||
local cname
|
||||
cname="$(docker ps --format '{{.Names}}' 2>/dev/null | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true)"
|
||||
if [[ -n "$cname" ]]; then
|
||||
docker restart "$cname"
|
||||
return 0
|
||||
fi
|
||||
return 1
|
||||
;;
|
||||
supervisor)
|
||||
supervisorctl restart nexus
|
||||
;;
|
||||
*)
|
||||
return 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
nexus_has_ops_cron() {
|
||||
command -v crontab >/dev/null 2>&1 \
|
||||
&& crontab -l 2>/dev/null | grep -q 'nexus-health-monitor'
|
||||
}
|
||||
|
||||
suggest_ops_cron() {
|
||||
local root="$1"
|
||||
if nexus_has_ops_cron; then
|
||||
return 0
|
||||
fi
|
||||
echo ""
|
||||
echo "[WARN] 未检测到 health_monitor / db_backup cron"
|
||||
echo " 建议: sudo bash ${root}/deploy/install_ops_cron.sh"
|
||||
echo " 或: sudo nx cron"
|
||||
}
|
||||
|
||||
prompt_ops_cron_if_missing() {
|
||||
local root="$1"
|
||||
if nexus_has_ops_cron; then
|
||||
echo "[INFO] Crontab 已含 health_monitor / db_backup"
|
||||
return 0
|
||||
fi
|
||||
suggest_ops_cron "$root"
|
||||
if [[ ! -t 0 ]]; then
|
||||
return 0
|
||||
fi
|
||||
local ans
|
||||
read -r -p "现在安装巡检/备份 cron? [Y/n]: " ans
|
||||
if [[ "$ans" == "n" || "$ans" == "N" ]]; then
|
||||
echo "[WARN] 已跳过 cron 安装"
|
||||
return 0
|
||||
fi
|
||||
bash "${root}/deploy/install_ops_cron.sh"
|
||||
}
|
||||
@@ -1,53 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# 下载并执行 install-nexus-fresh.sh（公共仓库无需令牌）
|
||||
#
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/download-install-fresh.sh" | bash
|
||||
#
|
||||
# 推荐直接使用:
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
|
||||
NEXUS_GIT_BRANCH="${NEXUS_GIT_BRANCH:-main}"
|
||||
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/branch/${NEXUS_GIT_BRANCH}}"
|
||||
OUT="${OUT:-/tmp/install-nexus-fresh.sh}"
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
NC='\033[0m'
|
||||
|
||||
err() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
|
||||
ok() { echo -e "${GREEN}[OK]${NC} $*"; }
|
||||
|
||||
for cf in /root/.nexus-deploy.env /root/.nexus-secrets/nexus.env; do
|
||||
[[ -f "$cf" ]] && set -a && source "$cf" && set +a
|
||||
done
|
||||
|
||||
download() {
|
||||
local url base
|
||||
for base in "${NEXUS_RAW_BASE}" "http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/${NEXUS_GIT_BRANCH}"; do
|
||||
url="${base}/deploy/install-nexus-fresh.sh"
|
||||
if curl -fsSL "$url" -o "$OUT" 2>/dev/null && head -1 "$OUT" | grep -q '^#!/'; then
|
||||
ok "已下载 install-nexus-fresh.sh"
|
||||
chmod +x "$OUT"
|
||||
exec bash "$OUT" "$@"
|
||||
fi
|
||||
done
|
||||
if [[ -n "${NEXUS_GITEA_TOKEN:-}" ]]; then
|
||||
url="http://${NEXUS_GITEA_HOST}/api/v1/repos/admin/Nexus/raw/deploy/install-nexus-fresh.sh?ref=${NEXUS_GIT_BRANCH}"
|
||||
if curl -fsSL -H "Authorization: token ${NEXUS_GITEA_TOKEN}" "$url" -o "$OUT" 2>/dev/null \
|
||||
&& head -1 "$OUT" | grep -q '^#!/'; then
|
||||
ok "已下载（API + 令牌）"
|
||||
chmod +x "$OUT"
|
||||
exec bash "$OUT" "$@"
|
||||
fi
|
||||
fi
|
||||
return 1
|
||||
}
|
||||
|
||||
if ! download "$@"; then
|
||||
err "下载失败，请改用公共仓库一键入口:"
|
||||
err " curl -fsSL \"${NEXUS_RAW_BASE}/deploy/quick-install.sh\" | bash"
|
||||
exit 1
|
||||
fi
|
||||
@@ -1,70 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Grant nexus@'%' on 1Panel App Store MySQL for Docker (1panel-network) install wizard.
|
||||
# Fixes: Access denied for user 'nexus'@'172.18.x.x' (1045)
|
||||
#
|
||||
# Usage:
|
||||
# MYSQL_ROOT_PASSWORD='root密码' NEXUS_DB_PASSWORD='nexus密码' bash deploy/fix-1panel-mysql-grant.sh
|
||||
# bash deploy/fix-1panel-mysql-grant.sh # prompts
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_DB_NAME="${NEXUS_DB_NAME:-nexus}"
|
||||
NEXUS_DB_USER="${NEXUS_DB_USER:-nexus}"
|
||||
|
||||
info() { echo -e "\033[0;32m[INFO]\033[0m $*"; }
|
||||
warn() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
|
||||
error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; exit 1; }
|
||||
|
||||
pick_mysql_container() {
|
||||
local name
|
||||
if [[ -n "${MYSQL_CONTAINER:-}" ]]; then
|
||||
echo "$MYSQL_CONTAINER"
|
||||
return 0
|
||||
fi
|
||||
if docker network inspect 1panel-network >/dev/null 2>&1; then
|
||||
name="$(docker network inspect 1panel-network --format '{{range .Containers}}{{.Name}} {{end}}' \
|
||||
| tr ' ' '\n' | grep -iE '^1Panel-mysql-' | head -1 || true)"
|
||||
[[ -n "$name" ]] && echo "$name" && return 0
|
||||
fi
|
||||
name="$(docker ps --format '{{.Names}}' | grep -iE '^1Panel-mysql-' | head -1 || true)"
|
||||
[[ -n "$name" ]] && echo "$name" && return 0
|
||||
error "未找到 1Panel MySQL 容器（可设 MYSQL_CONTAINER=名称）"
|
||||
}
|
||||
|
||||
prompt_secret() {
|
||||
local var="$1" prompt="$2"
|
||||
if [[ -n "${!var:-}" ]]; then
|
||||
return 0
|
||||
fi
|
||||
read -r -s -p "$prompt: " "$var"
|
||||
echo ""
|
||||
if [[ -z "${!var:-}" ]]; then
|
||||
error "$var 不能为空"
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
[[ "${EUID:-$(id -u)}" -eq 0 ]] || error "请用 root 运行"
|
||||
|
||||
local mysql_c
|
||||
mysql_c="$(pick_mysql_container)"
|
||||
info "MySQL 容器: $mysql_c"
|
||||
|
||||
prompt_secret MYSQL_ROOT_PASSWORD "1Panel MySQL root 密码"
|
||||
prompt_secret NEXUS_DB_PASSWORD "nexus 用户密码（与安装向导步骤 3 一致）"
|
||||
|
||||
info "创建库/用户并授权 ${NEXUS_DB_USER}@'%' → ${NEXUS_DB_NAME}.* ..."
|
||||
|
||||
docker exec -i "$mysql_c" mysql -uroot -p"${MYSQL_ROOT_PASSWORD}" <<SQL
|
||||
CREATE DATABASE IF NOT EXISTS \`${NEXUS_DB_NAME}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
|
||||
CREATE USER IF NOT EXISTS '${NEXUS_DB_USER}'@'%' IDENTIFIED BY '${NEXUS_DB_PASSWORD}';
|
||||
ALTER USER '${NEXUS_DB_USER}'@'%' IDENTIFIED BY '${NEXUS_DB_PASSWORD}';
|
||||
GRANT ALL PRIVILEGES ON \`${NEXUS_DB_NAME}\`.* TO '${NEXUS_DB_USER}'@'%';
|
||||
FLUSH PRIVILEGES;
|
||||
SELECT user, host FROM mysql.user WHERE user = '${NEXUS_DB_USER}';
|
||||
SQL
|
||||
|
||||
info "完成。请在安装向导步骤 3 使用: 库/用户=${NEXUS_DB_NAME}/${NEXUS_DB_USER}，密码与上面一致"
|
||||
info "若已改 install.py，执行: bash deploy/sync-install-wizard-to-container.sh"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
File diff suppressed because it is too large
Load Diff
+52
-313
@@ -1,331 +1,70 @@
|
||||
#!/usr/bin/env bash
|
||||
#!/bin/bash
|
||||
# Nexus — External Health Monitor (Layer 3 of 3-tier guardian)
|
||||
# Runs via crontab every minute. Works on Docker (1Panel) and Supervisor bare-metal.
|
||||
# Runs via crontab every minute.
|
||||
# Does NOT depend on Python — even if Python completely crashes, this script works.
|
||||
#
|
||||
# Layer 1: Docker restart policy / Supervisor autorestart
|
||||
# Layer 2: Python self_monitor (30s)
|
||||
# Layer 3: This script — HTTP /health, 3 failures → restart + optional Telegram
|
||||
set -euo pipefail
|
||||
# Guardian layers:
|
||||
# Layer 1: Supervisor — auto-restart crashed Python process
|
||||
# Layer 2: Python self_monitor — internal Redis/MySQL/WS checks (30s)
|
||||
# Layer 3: Shell health_monitor.sh — external HTTP health check (1min cron)
|
||||
#
|
||||
# Flow:
|
||||
# 1. HTTP GET http://127.0.0.1:8600/health
|
||||
# 2. If fails >= 3 consecutive times → restart via supervisorctl + Telegram alert
|
||||
# 3. If restart succeeds → Telegram recovery notification
|
||||
# 4. If restart fails → Telegram "needs human intervention" alert
|
||||
#
|
||||
# *** Configure DEPLOY_DIR and NEXUS_SERVICE before deploying ***
|
||||
|
||||
DEPLOY_DIR="${NEXUS_DEPLOY_DIR:-/opt/nexus}"
|
||||
NEXUS_SERVICE="${NEXUS_SERVICE:-nexus}"
|
||||
STATE_DIR=""
|
||||
FAIL_FILE=""
|
||||
LAST_RESTART_FILE=""
|
||||
# Legacy paths (cron user may have created root-owned files under /tmp)
|
||||
LEGACY_FAIL_FILE="/tmp/nexus_health_fail_count"
|
||||
LEGACY_LAST_RESTART_FILE="/tmp/nexus_health_last_restart"
|
||||
FAIL_FILE="/tmp/nexus_health_fail_count"
|
||||
MAX_FAIL=3
|
||||
RESTART_COOLDOWN_SEC="${NEXUS_HEALTH_RESTART_COOLDOWN:-300}"
|
||||
ENV_PROD="${DEPLOY_DIR}/docker/.env.prod"
|
||||
HEALTH_URL="http://127.0.0.1:8600/health"
|
||||
|
||||
ensure_state_paths() {
|
||||
if [[ -n "$STATE_DIR" ]]; then
|
||||
return 0
|
||||
fi
|
||||
local preferred="${DEPLOY_DIR}/var/layer3-health"
|
||||
local fallback="${HOME:-/tmp}/.nexus/layer3-health"
|
||||
if mkdir -p "$preferred" 2>/dev/null && [[ -w "$preferred" ]]; then
|
||||
STATE_DIR="$preferred"
|
||||
elif command -v sudo >/dev/null 2>&1 && sudo mkdir -p "$preferred" 2>/dev/null \
|
||||
&& sudo chown -R "$(id -un):$(id -gn)" "$preferred" 2>/dev/null \
|
||||
&& [[ -w "$preferred" ]]; then
|
||||
STATE_DIR="$preferred"
|
||||
else
|
||||
mkdir -p "$fallback"
|
||||
STATE_DIR="$fallback"
|
||||
fi
|
||||
FAIL_FILE="${STATE_DIR}/fail_count"
|
||||
LAST_RESTART_FILE="${STATE_DIR}/last_restart"
|
||||
}
|
||||
# ── Read Telegram config from .env file ──
|
||||
DOTENV="$DEPLOY_DIR/.env"
|
||||
|
||||
docker_cmd() {
|
||||
if docker "$@" 2>/dev/null; then
|
||||
return 0
|
||||
fi
|
||||
if command -v sudo >/dev/null 2>&1; then
|
||||
sudo docker "$@" 2>/dev/null
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
BOT_TOKEN=""
|
||||
CHAT_ID=""
|
||||
|
||||
init_layer3_state() {
|
||||
ensure_state_paths
|
||||
chmod 755 "$STATE_DIR" 2>/dev/null || true
|
||||
if [[ ! -f "$FAIL_FILE" && -f "$LEGACY_FAIL_FILE" ]]; then
|
||||
cp "$LEGACY_FAIL_FILE" "$FAIL_FILE" 2>/dev/null || true
|
||||
fi
|
||||
if [[ ! -f "$LAST_RESTART_FILE" && -f "$LEGACY_LAST_RESTART_FILE" ]]; then
|
||||
cp "$LEGACY_LAST_RESTART_FILE" "$LAST_RESTART_FILE" 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
write_state_file() {
|
||||
local path="$1" value="$2"
|
||||
init_layer3_state
|
||||
printf '%s\n' "$value" >"$path" 2>/dev/null || return 1
|
||||
}
|
||||
|
||||
resolve_publish_port() {
|
||||
local port
|
||||
port="$(grep -E '^NEXUS_PUBLISH_PORT=' "$ENV_PROD" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r" ' || true)"
|
||||
echo "${port:-8600}"
|
||||
}
|
||||
|
||||
PUBLISH_PORT="$(resolve_publish_port)"
|
||||
HEALTH_URL="http://127.0.0.1:${PUBLISH_PORT}/health"
|
||||
|
||||
resolve_nexus_container() {
|
||||
docker_cmd ps --format '{{.Names}}' 2>/dev/null | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true
|
||||
}
|
||||
|
||||
read_env_var() {
|
||||
local key="$1" file="$2"
|
||||
grep -E "^${key}=" "$file" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r"' || true
|
||||
}
|
||||
|
||||
normalize_env_value() {
|
||||
local v="${1:-}"
|
||||
v="${v//$'\r'/}"
|
||||
if [[ ${#v} -ge 2 && ${v:0:1} == '"' && ${v: -1} == '"' ]]; then
|
||||
v="${v:1:-1}"
|
||||
v="${v//\\n/$'\n'}"
|
||||
v="${v//\\\"/\"}"
|
||||
v="${v//\\\\/\\}"
|
||||
fi
|
||||
echo "$v"
|
||||
}
|
||||
|
||||
load_telegram_from_db() {
|
||||
local cname="$1"
|
||||
[[ -n "$cname" ]] || return 1
|
||||
[[ -n "${BOT_TOKEN:-}" && -n "${CHAT_ID:-}" ]] && return 0
|
||||
local out token chat
|
||||
out="$(docker_cmd exec "$cname" python3 -c "
|
||||
import asyncio
|
||||
from server.config import settings as s
|
||||
from server.infrastructure.database.session import AsyncSessionLocal
|
||||
|
||||
async def main():
|
||||
async with AsyncSessionLocal() as db:
|
||||
await s.load_settings_from_db(db)
|
||||
t = (s.TELEGRAM_BOT_TOKEN or '').strip()
|
||||
c = (s.TELEGRAM_CHAT_ID or '').strip()
|
||||
if t and c:
|
||||
print(t)
|
||||
print(c)
|
||||
|
||||
asyncio.run(main())
|
||||
" 2>/dev/null)" || true
|
||||
[[ -n "$out" ]] || return 1
|
||||
token="$(printf '%s\n' "$out" | sed -n '1p')"
|
||||
chat="$(printf '%s\n' "$out" | sed -n '2p')"
|
||||
[[ -n "$token" && -n "$chat" ]] || return 1
|
||||
BOT_TOKEN="$token"
|
||||
CHAT_ID="$chat"
|
||||
}
|
||||
|
||||
load_telegram_config() {
|
||||
local cname="$1" dotenv
|
||||
BOT_TOKEN=""
|
||||
CHAT_ID=""
|
||||
for dotenv in \
|
||||
"${DEPLOY_DIR}/.env" \
|
||||
"$ENV_PROD" \
|
||||
; do
|
||||
[[ -f "$dotenv" ]] || continue
|
||||
BOT_TOKEN="$(read_env_var NEXUS_TELEGRAM_BOT_TOKEN "$dotenv")"
|
||||
CHAT_ID="$(read_env_var NEXUS_TELEGRAM_CHAT_ID "$dotenv")"
|
||||
[[ -n "$BOT_TOKEN" && -n "$CHAT_ID" ]] && return 0
|
||||
done
|
||||
if [[ -n "$cname" ]]; then
|
||||
local line
|
||||
while IFS= read -r line; do
|
||||
case "$line" in
|
||||
NEXUS_TELEGRAM_BOT_TOKEN=*) BOT_TOKEN="${line#NEXUS_TELEGRAM_BOT_TOKEN=}" ;;
|
||||
NEXUS_TELEGRAM_CHAT_ID=*) CHAT_ID="${line#NEXUS_TELEGRAM_CHAT_ID=}" ;;
|
||||
esac
|
||||
done < <(docker_cmd exec "$cname" grep -E '^NEXUS_TELEGRAM_' /app/.env 2>/dev/null || true)
|
||||
[[ -n "$BOT_TOKEN" && -n "$CHAT_ID" ]] && return 0
|
||||
load_telegram_from_db "$cname" || true
|
||||
fi
|
||||
BOT_TOKEN="$(normalize_env_value "$BOT_TOKEN")"
|
||||
CHAT_ID="$(normalize_env_value "$CHAT_ID")"
|
||||
}
|
||||
if [ -f "$DOTENV" ]; then
|
||||
BOT_TOKEN=$(grep '^NEXUS_TELEGRAM_BOT_TOKEN=' "$DOTENV" 2>/dev/null | cut -d'=' -f2- || echo "")
|
||||
CHAT_ID=$(grep '^NEXUS_TELEGRAM_CHAT_ID=' "$DOTENV" 2>/dev/null | cut -d'=' -f2- || echo "")
|
||||
fi
|
||||
|
||||
send_telegram() {
|
||||
local msg="${1}" resp http log="${NEXUS_HEALTH_LOG:-/var/log/nexus_health.log}"
|
||||
BOT_TOKEN="$(normalize_env_value "${BOT_TOKEN:-}")"
|
||||
CHAT_ID="$(normalize_env_value "${CHAT_ID:-}")"
|
||||
[[ -n "$BOT_TOKEN" && -n "$CHAT_ID" ]] || return 1
|
||||
resp="$(curl -s --max-time 15 -w '\n%{http_code}' \
|
||||
"https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
|
||||
-d "chat_id=${CHAT_ID}" \
|
||||
--data-urlencode "text=${msg}" \
|
||||
-d "parse_mode=HTML" 2>/dev/null)" || return 1
|
||||
http="${resp##*$'\n'}"
|
||||
if [[ "$http" != "200" ]]; then
|
||||
echo "$(date -Is 2>/dev/null || date) telegram send failed http=${http}" >> "$log" 2>/dev/null || true
|
||||
return 1
|
||||
fi
|
||||
[ -z "$BOT_TOKEN" ] || [ -z "$CHAT_ID" ] && return 1
|
||||
curl -sf --max-time 10 "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
|
||||
-d chat_id="$CHAT_ID" \
|
||||
-d text="$1" \
|
||||
-d parse_mode=HTML \
|
||||
> /dev/null 2>&1
|
||||
}
|
||||
|
||||
bump_fail_count() {
|
||||
local fail=0
|
||||
init_layer3_state
|
||||
if command -v flock >/dev/null 2>&1; then
|
||||
(
|
||||
flock -x 9
|
||||
fail="$(cat "$FAIL_FILE" 2>/dev/null || echo 0)"
|
||||
fail=$((fail + 1))
|
||||
write_state_file "$FAIL_FILE" "$fail" || true
|
||||
) 9>"${FAIL_FILE}.lock"
|
||||
fail="$(cat "$FAIL_FILE" 2>/dev/null || echo 0)"
|
||||
else
|
||||
fail="$(cat "$FAIL_FILE" 2>/dev/null || echo 0)"
|
||||
fail=$((fail + 1))
|
||||
write_state_file "$FAIL_FILE" "$fail" || true
|
||||
fi
|
||||
echo "$fail"
|
||||
}
|
||||
# ── Health Check ──
|
||||
if ! curl -sf --max-time 5 "$HEALTH_URL" > /dev/null 2>&1; then
|
||||
# Python is NOT responding
|
||||
FAIL=$(cat "$FAIL_FILE" 2>/dev/null || echo "0")
|
||||
FAIL=$((FAIL + 1))
|
||||
echo "$FAIL" > "$FAIL_FILE"
|
||||
|
||||
reset_fail_count() {
|
||||
write_state_file "$FAIL_FILE" "0" || true
|
||||
}
|
||||
if [ "$FAIL" -ge "$MAX_FAIL" ]; then
|
||||
# Consecutive failures >= threshold → attempt restart
|
||||
send_telegram "🔴 <b>Nexus后端连续${MAX_FAIL}次无响应</b>\n正在通过Supervisor自动重启..."
|
||||
supervisorctl restart "$NEXUS_SERVICE" > /dev/null 2>&1
|
||||
sleep 5
|
||||
|
||||
restart_cooldown_active() {
|
||||
local now last elapsed
|
||||
[[ -f "$LAST_RESTART_FILE" ]] || return 1
|
||||
now="$(date +%s)"
|
||||
last="$(cat "$LAST_RESTART_FILE" 2>/dev/null || echo 0)"
|
||||
elapsed=$((now - last))
|
||||
[[ "$elapsed" -lt "$RESTART_COOLDOWN_SEC" ]]
|
||||
}
|
||||
|
||||
mark_restart_attempt() {
|
||||
write_state_file "$LAST_RESTART_FILE" "$(date +%s)" || true
|
||||
}
|
||||
|
||||
restart_nexus() {
|
||||
local cname="$1" via=""
|
||||
if [[ -n "$cname" ]]; then
|
||||
docker_cmd restart "$cname" >/dev/null 2>&1 && via="Docker 容器 ${cname}"
|
||||
elif command -v supervisorctl >/dev/null 2>&1 && supervisorctl status "$NEXUS_SERVICE" >/dev/null 2>&1; then
|
||||
supervisorctl restart "$NEXUS_SERVICE" >/dev/null 2>&1 && via="Supervisor ${NEXUS_SERVICE}"
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
echo "$via"
|
||||
}
|
||||
|
||||
telegram_health_fail_cooldown() {
|
||||
local body
|
||||
body="$(cat <<EOF
|
||||
🔴 <b>【Layer 3 宿主机巡检】健康检查连续失败（冷却期内）</b>
|
||||
宿主机：${HOST_LABEL}
|
||||
检测地址：${HEALTH_URL}
|
||||
连续失败：已达 ${MAX_FAIL} 次
|
||||
Docker 容器：${NEXUS_CONTAINER:-未识别}
|
||||
具体情况：/health 仍不可达，但距上次自动重启不足 ${RESTART_COOLDOWN_SEC} 秒，本次跳过重启以免频繁抖动
|
||||
建议操作：查看 docker logs ${NEXUS_CONTAINER:-nexus} 与 ${NEXUS_HEALTH_LOG:-/var/log/nexus_health.log}
|
||||
时间：${TS_LABEL}
|
||||
EOF
|
||||
)"
|
||||
send_telegram "$body" || true
|
||||
}
|
||||
|
||||
telegram_health_fail_restart() {
|
||||
local body
|
||||
body="$(cat <<EOF
|
||||
🔴 <b>【Layer 3 宿主机巡检】Nexus 连续 ${MAX_FAIL} 次无响应</b>
|
||||
宿主机：${HOST_LABEL}
|
||||
检测地址：${HEALTH_URL}
|
||||
连续失败：${FAIL} 次（阈值 ${MAX_FAIL} 次）
|
||||
Docker 容器：${NEXUS_CONTAINER:-未识别}
|
||||
具体情况：宿主机 cron 无法访问 API 健康端点，平台可能已宕机或端口异常
|
||||
正在执行：自动重启 Nexus 服务…
|
||||
时间：${TS_LABEL}
|
||||
EOF
|
||||
)"
|
||||
send_telegram "$body" || true
|
||||
}
|
||||
|
||||
telegram_health_recovered() {
|
||||
local via="$1" body
|
||||
body="$(cat <<EOF
|
||||
🟢 <b>【Layer 3 宿主机巡检】Nexus 已自动恢复</b>
|
||||
宿主机：${HOST_LABEL}
|
||||
检测地址：${HEALTH_URL}
|
||||
恢复方式：${via}
|
||||
具体情况：自动重启后 /health 检测通过，服务已恢复在线
|
||||
时间：${TS_LABEL}
|
||||
EOF
|
||||
)"
|
||||
send_telegram "$body" || true
|
||||
}
|
||||
|
||||
telegram_health_still_down() {
|
||||
local via="$1" body
|
||||
body="$(cat <<EOF
|
||||
🔴 <b>【Layer 3 宿主机巡检】自动重启后仍未恢复</b>
|
||||
宿主机：${HOST_LABEL}
|
||||
检测地址：${HEALTH_URL}
|
||||
已尝试：${via}
|
||||
具体情况：重启完成后 /health 仍失败，可能存在数据库/Redis 故障或配置错误
|
||||
建议操作：立即 SSH 登录排查 docker logs、MySQL、Redis，需人工介入
|
||||
时间：${TS_LABEL}
|
||||
EOF
|
||||
)"
|
||||
send_telegram "$body" || true
|
||||
}
|
||||
|
||||
telegram_health_restart_failed() {
|
||||
local body
|
||||
body="$(cat <<EOF
|
||||
🔴 <b>【Layer 3 宿主机巡检】无法执行自动重启</b>
|
||||
宿主机：${HOST_LABEL}
|
||||
检测地址：${HEALTH_URL}
|
||||
具体情况：未找到可重启的 Docker 容器或 Supervisor 服务（${NEXUS_SERVICE}）
|
||||
建议操作：确认 nexus 容器名称与 docker ps 输出，手动执行 docker restart 或 nx update
|
||||
时间：${TS_LABEL}
|
||||
EOF
|
||||
)"
|
||||
send_telegram "$body" || true
|
||||
}
|
||||
|
||||
NEXUS_CONTAINER="$(resolve_nexus_container)"
|
||||
load_telegram_config "$NEXUS_CONTAINER"
|
||||
init_layer3_state
|
||||
HOST_LABEL="$(hostname -f 2>/dev/null || hostname 2>/dev/null || echo unknown)"
|
||||
TS_LABEL="$(date '+%Y-%m-%d %H:%M:%S %Z' 2>/dev/null || date)"
|
||||
|
||||
if curl -sf --max-time 5 "$HEALTH_URL" > /dev/null 2>&1; then
|
||||
reset_fail_count
|
||||
exit 0
|
||||
fi
|
||||
|
||||
FAIL="$(bump_fail_count)"
|
||||
if [[ "$FAIL" -lt "$MAX_FAIL" ]]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if restart_cooldown_active; then
|
||||
telegram_health_fail_cooldown
|
||||
exit 0
|
||||
fi
|
||||
|
||||
telegram_health_fail_restart
|
||||
mark_restart_attempt
|
||||
|
||||
if VIA="$(restart_nexus "$NEXUS_CONTAINER")"; then
|
||||
sleep 5
|
||||
if curl -sf --max-time 5 "$HEALTH_URL" > /dev/null 2>&1; then
|
||||
telegram_health_recovered "$VIA"
|
||||
reset_fail_count
|
||||
else
|
||||
telegram_health_still_down "$VIA"
|
||||
# Verify restart
|
||||
if curl -sf --max-time 5 "$HEALTH_URL" > /dev/null 2>&1; then
|
||||
send_telegram "🟢 <b>Nexus后端已恢复</b>\nSupervisor重启成功"
|
||||
echo "0" > "$FAIL_FILE"
|
||||
else
|
||||
send_telegram "🔴 <b>Nexus重启后仍未恢复！请人工介入</b>\nSupervisor重启失败，需要手动检查"
|
||||
# Don't reset fail count — keep retrying each cron cycle
|
||||
fi
|
||||
fi
|
||||
else
|
||||
telegram_health_restart_failed
|
||||
# Python is responding normally
|
||||
echo "0" > "$FAIL_FILE"
|
||||
fi
|
||||
|
||||
@@ -1,275 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# =============================================================================
|
||||
# Nexus 6.0 — 重装服务器一键入口（1Panel + Docker + Nexus）
|
||||
#
|
||||
# 适用：全新 VPS / 重装系统后，root 一条命令装完整栈。
|
||||
#
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/install-1panel-docker.sh" | bash
|
||||
#
|
||||
# 4 核 16G + 自定义域名:
|
||||
# curl -fsSL ".../install-1panel-docker.sh" | bash -s -- --profile 4c16g --domain api.example.com
|
||||
#
|
||||
# 已装 1Panel，只装 Nexus Docker:
|
||||
# curl -fsSL ".../install-1panel-docker.sh" | bash -s -- --skip-1panel
|
||||
#
|
||||
# 流程:
|
||||
# ① 可选：官方 1Panel 安装（含 Docker，交互式）
|
||||
# ② 检测 / 安装 Docker Compose
|
||||
# ③ install-nexus-fresh.sh → MySQL + Nexus 容器（Redis 自行安装）
|
||||
#
|
||||
# 反代：必须在 1Panel 面板 UI 配置，禁止脚本直接改 /opt/1panel/apps/
|
||||
# 示例: deploy/1panel/openresty-nexus.conf.example
|
||||
# =============================================================================
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
|
||||
NEXUS_GIT_BRANCH="${NEXUS_GIT_BRANCH:-main}"
|
||||
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/branch/${NEXUS_GIT_BRANCH}}"
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
NEXUS_DOMAIN="${NEXUS_DOMAIN:-api.synaglobal.vip}"
|
||||
NEXUS_PROFILE="${NEXUS_PROFILE:-2c8g}"
|
||||
|
||||
PANEL_INSTALL_URL="${PANEL_INSTALL_URL:-https://resource.1panel.pro/v2/quick_start.sh}"
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
CYAN='\033[0;36m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m'
|
||||
|
||||
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
|
||||
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
||||
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
|
||||
step() { echo -e "${CYAN}[STEP]${NC} $*"; }
|
||||
|
||||
WITH_1PANEL=auto
|
||||
SKIP_1PANEL=false
|
||||
SKIP_DOCKER_INSTALL=false
|
||||
EXTRA_ARGS=()
|
||||
|
||||
usage() {
|
||||
cat <<EOF
|
||||
重装服务器 — 1Panel + Docker + Nexus 一键安装
|
||||
|
||||
curl -fsSL "${NEXUS_RAW_BASE}/deploy/install-1panel-docker.sh" | bash
|
||||
|
||||
选项（传给 bash -s --）:
|
||||
--with-1panel 未装 1Panel 时先跑官方安装脚本（交互式）
|
||||
--skip-1panel 跳过 1Panel，只装 Nexus Docker 栈
|
||||
--skip-docker-install 不自动装 Docker（已在 1Panel 装好）
|
||||
--profile 2c8g|4c16g|1c4g
|
||||
--domain NAME
|
||||
--root PATH
|
||||
-h, --help
|
||||
|
||||
说明:
|
||||
- 1Panel 官方安装为交互式（端口/用户/密码），装完记下面板地址
|
||||
- Nexus 密钥按本机自动生成，备份在 /root/.nexus-install-secrets-*.env
|
||||
- 网站反代请在 1Panel UI 操作，勿手工改 /opt/1panel/apps/
|
||||
EOF
|
||||
}
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
-h|--help) usage; exit 0 ;;
|
||||
--with-1panel) WITH_1PANEL=true; shift ;;
|
||||
--skip-1panel) SKIP_1PANEL=true; WITH_1PANEL=false; shift ;;
|
||||
--skip-docker-install) SKIP_DOCKER_INSTALL=true; shift ;;
|
||||
--profile|--domain|--root)
|
||||
EXTRA_ARGS+=("$1" "$2")
|
||||
shift 2
|
||||
;;
|
||||
--skip-clone|--skip-1panel-check)
|
||||
EXTRA_ARGS+=("$1")
|
||||
shift
|
||||
;;
|
||||
*) EXTRA_ARGS+=("$1"); shift ;;
|
||||
esac
|
||||
done
|
||||
|
||||
banner() {
|
||||
echo ""
|
||||
echo -e "${BLUE}╔══════════════════════════════════════════════════════════════╗${NC}"
|
||||
echo -e "${BLUE}║${NC} Nexus — 1Panel + Docker + Nexus 一键安装 ${BLUE}║${NC}"
|
||||
echo -e "${BLUE}║${NC} 域名: ${NEXUS_DOMAIN} 档位: ${NEXUS_PROFILE} ${BLUE}║${NC}"
|
||||
echo -e "${BLUE}╚══════════════════════════════════════════════════════════════╝${NC}"
|
||||
echo ""
|
||||
}
|
||||
|
||||
require_root() {
|
||||
if [[ "$(id -u)" -ne 0 ]]; then
|
||||
error "请使用 root 执行（su - 后直接运行）"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
load_deploy_env() {
|
||||
for cf in /root/.nexus-deploy.env /root/.nexus-secrets/nexus.env; do
|
||||
[[ -f "$cf" ]] && set -a && source "$cf" && set +a
|
||||
done
|
||||
unset NEXUS_SECRET_KEY NEXUS_API_KEY NEXUS_ENCRYPTION_KEY
|
||||
}
|
||||
|
||||
has_1panel() {
|
||||
command -v 1pctl >/dev/null 2>&1
|
||||
}
|
||||
|
||||
has_docker_compose() {
|
||||
docker compose version >/dev/null 2>&1
|
||||
}
|
||||
|
||||
phase_1panel() {
|
||||
if [[ "$SKIP_1PANEL" == true ]]; then
|
||||
info "跳过 1Panel 安装（--skip-1panel）"
|
||||
return 0
|
||||
fi
|
||||
|
||||
if has_1panel; then
|
||||
info "已安装 1Panel"
|
||||
if 1pctl user-info >/dev/null 2>&1; then
|
||||
1pctl user-info 2>/dev/null | grep -E '面板地址|面板用户' || true
|
||||
else
|
||||
warn "1pctl user-info 失败，面板可能需修复；继续安装 Nexus…"
|
||||
fi
|
||||
return 0
|
||||
fi
|
||||
|
||||
if [[ "$WITH_1PANEL" == auto ]]; then
|
||||
echo ""
|
||||
warn "未检测到 1Panel（1pctl 不存在）"
|
||||
echo " ① 先装 1Panel（推荐，含 Docker）再装 Nexus"
|
||||
echo " ② 跳过 1Panel，仅装 Nexus Docker（需本机已有 Docker）"
|
||||
echo ""
|
||||
read -r -p "是否现在安装 1Panel? [Y/n]: " ans
|
||||
case "${ans:-Y}" in
|
||||
n|N) WITH_1PANEL=false ;;
|
||||
*) WITH_1PANEL=true ;;
|
||||
esac
|
||||
fi
|
||||
|
||||
if [[ "$WITH_1PANEL" != true ]]; then
|
||||
warn "未安装 1Panel，将仅安装 Nexus Docker 栈"
|
||||
return 0
|
||||
fi
|
||||
|
||||
step "安装 1Panel（官方脚本，交互式）..."
|
||||
info "下载: $PANEL_INSTALL_URL"
|
||||
local tmp
|
||||
tmp="$(mktemp /tmp/1panel-quick-start.XXXXXX.sh)"
|
||||
if ! curl -fsSL "$PANEL_INSTALL_URL" -o "$tmp"; then
|
||||
error "下载 1Panel 安装脚本失败"
|
||||
exit 1
|
||||
fi
|
||||
chmod +x "$tmp"
|
||||
echo ""
|
||||
warn "接下来为 1Panel 官方安装向导，请按提示设置端口、安全入口、用户名、密码"
|
||||
warn "安装目录建议默认 /opt"
|
||||
echo ""
|
||||
bash "$tmp"
|
||||
rm -f "$tmp"
|
||||
|
||||
if ! has_1panel; then
|
||||
error "1Panel 安装后仍未找到 1pctl，请检查安装日志"
|
||||
exit 1
|
||||
fi
|
||||
info "1Panel 安装完成"
|
||||
1pctl user-info 2>/dev/null || true
|
||||
echo ""
|
||||
warn "请在 1Panel → 应用商店 安装 OpenResty（用于 HTTPS 反代）"
|
||||
read -r -p "OpenResty 已装好或稍后自行安装，按 Enter 继续 Nexus 安装..."
|
||||
}
|
||||
|
||||
install_docker_engine() {
|
||||
step "安装 Docker Engine + Compose 插件..."
|
||||
if command -v apt-get >/dev/null 2>&1; then
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-get update -qq
|
||||
apt-get install -y -qq ca-certificates curl >/dev/null
|
||||
curl -fsSL https://get.docker.com | sh
|
||||
systemctl enable --now docker 2>/dev/null || true
|
||||
elif command -v dnf >/dev/null 2>&1; then
|
||||
dnf install -y -q docker docker-compose-plugin >/dev/null 2>&1 || \
|
||||
curl -fsSL https://get.docker.com | sh
|
||||
systemctl enable --now docker 2>/dev/null || true
|
||||
else
|
||||
curl -fsSL https://get.docker.com | sh
|
||||
fi
|
||||
}
|
||||
|
||||
phase_docker() {
|
||||
step "检测 Docker Compose..."
|
||||
if has_docker_compose; then
|
||||
info "Docker Compose: $(docker compose version --short 2>/dev/null || docker compose version | head -1)"
|
||||
return 0
|
||||
fi
|
||||
|
||||
if [[ "$SKIP_DOCKER_INSTALL" == true ]]; then
|
||||
error "未检测到 docker compose，且已指定 --skip-docker-install"
|
||||
error "请在 1Panel → 容器 安装 Docker，或去掉该参数"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
warn "未检测到 docker compose"
|
||||
if has_1panel; then
|
||||
warn "建议在 1Panel → 容器 安装 Docker 后重新运行本脚本"
|
||||
read -r -p "是否尝试用 get.docker.com 自动安装? [y/N]: " ans
|
||||
[[ "${ans:-N}" == y || "${ans:-N}" == Y ]] || exit 1
|
||||
else
|
||||
info "自动安装 Docker（get.docker.com）..."
|
||||
fi
|
||||
|
||||
install_docker_engine
|
||||
|
||||
if ! has_docker_compose; then
|
||||
error "Docker 安装后仍无 compose 插件，请手动安装 docker-compose-plugin"
|
||||
exit 1
|
||||
fi
|
||||
info "Docker Compose 就绪"
|
||||
}
|
||||
|
||||
download_fresh_installer() {
|
||||
local name="install-nexus-fresh.sh" dest
|
||||
dest="$(mktemp /tmp/install-nexus-fresh.XXXXXX.sh)"
|
||||
local url base
|
||||
for base in "${NEXUS_RAW_BASE}" "http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/${NEXUS_GIT_BRANCH}"; do
|
||||
url="${base}/deploy/${name}"
|
||||
if curl -fsSL "$url" -o "$dest" 2>/dev/null && head -1 "$dest" | grep -q '^#!/'; then
|
||||
chmod +x "$dest"
|
||||
echo "$dest"
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
phase_nexus() {
|
||||
step "安装 Nexus Docker 栈（MySQL + Nexus；Redis 请自行安装）..."
|
||||
local installer
|
||||
if [[ -x "${NEXUS_ROOT}/deploy/install-nexus-fresh.sh" ]]; then
|
||||
installer="${NEXUS_ROOT}/deploy/install-nexus-fresh.sh"
|
||||
info "使用本地: $installer"
|
||||
exec bash "$installer" --skip-1panel-check "${EXTRA_ARGS[@]}"
|
||||
fi
|
||||
|
||||
if installer="$(download_fresh_installer)"; then
|
||||
info "已下载 install-nexus-fresh.sh"
|
||||
exec bash "$installer" --skip-1panel-check "${EXTRA_ARGS[@]}"
|
||||
fi
|
||||
|
||||
error "无法获取 install-nexus-fresh.sh，请检查 Gitea 可达性"
|
||||
exit 1
|
||||
}
|
||||
|
||||
main() {
|
||||
banner
|
||||
require_root
|
||||
load_deploy_env
|
||||
phase_1panel
|
||||
phase_docker
|
||||
phase_nexus
|
||||
}
|
||||
|
||||
# curl | bash 时 stdin 脚本无 BASH_SOURCE[0]，不可配合 set -u 做入口判断
|
||||
main "$@"
|
||||
@@ -1,309 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# =============================================================================
|
||||
# Nexus 6.0 — 全新安装脚本（1Panel + Docker Compose）
|
||||
#
|
||||
# 适用：新机已装 1Panel / Docker，空库，走 /app/install.html 安装向导
|
||||
# 风格参考 1Panel quick_start.sh：分阶段检查 + 结束输出访问地址
|
||||
#
|
||||
# 用法（公共仓库，root 下一条命令，参考 1Panel）:
|
||||
#
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
|
||||
#
|
||||
# 已 clone 到 /opt/nexus:
|
||||
# cd /opt/nexus && bash deploy/install-nexus-fresh.sh --skip-clone
|
||||
#
|
||||
# bash deploy/install-nexus-fresh.sh --profile 4c16g
|
||||
#
|
||||
# 公共仓库匿名 clone，无需 Gitea 令牌。NEXUS 密钥由安装脚本按机自动生成。
|
||||
# =============================================================================
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
_install_self="$(readlink -f "${BASH_SOURCE[0]}")"
|
||||
if ! head -1 "$_install_self" | grep -q '^#!/'; then
|
||||
echo "[ERROR] 脚本文件无效。若用 curl 下载，请改用: bash deploy/download-install-fresh.sh" >&2
|
||||
exit 1
|
||||
fi
|
||||
if grep -qiE '^(Not found|404)' "$_install_self" 2>/dev/null; then
|
||||
echo "[ERROR] 下载到的是 Gitea 404 页面，不是安装脚本。" >&2
|
||||
echo " 请: cd /opt/nexus && git pull && sudo bash deploy/install-nexus-fresh.sh --skip-clone" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# ── 默认配置（与 SECRETS.md / nexus-1panel 一致）──
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
|
||||
NEXUS_GITEA_REPO="${NEXUS_GITEA_REPO:-admin/Nexus.git}"
|
||||
NEXUS_DOMAIN="${NEXUS_DOMAIN:-api.synaglobal.vip}"
|
||||
NEXUS_PROFILE="${NEXUS_PROFILE:-2c8g}"
|
||||
NEXUS_GIT_BRANCH="${NEXUS_GIT_BRANCH:-main}"
|
||||
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-http://66.154.115.8:3000/admin/Nexus/raw/branch/main}"
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
CYAN='\033[0;36m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m'
|
||||
|
||||
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
|
||||
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
||||
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
|
||||
step() { echo -e "${CYAN}[STEP]${NC} $*"; }
|
||||
|
||||
usage() {
|
||||
cat <<EOF
|
||||
Nexus 6.0 全新安装（1Panel + Docker）
|
||||
|
||||
sudo bash install-nexus-fresh.sh [选项]
|
||||
|
||||
选项:
|
||||
--domain NAME 公网域名（默认: ${NEXUS_DOMAIN}）
|
||||
--profile NAME 资源档位 1c4g|2c8g|4c16g（默认: 2c8g）
|
||||
--root PATH 安装目录（默认: /opt/nexus）
|
||||
--skip-clone 已在 /opt/nexus，不重新 clone
|
||||
--skip-1panel-check 不检测 1Panel 是否已安装
|
||||
-h, --help 显示帮助
|
||||
|
||||
安装后请用浏览器打开: https://域名/app/install.html
|
||||
root 下全局命令: nexus-fresh | nexus-update | nx
|
||||
EOF
|
||||
}
|
||||
|
||||
SKIP_1PANEL_CHECK=false
|
||||
SKIP_CLONE=false
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
-h|--help) usage; exit 0 ;;
|
||||
--domain) NEXUS_DOMAIN="$2"; shift 2 ;;
|
||||
--profile) NEXUS_PROFILE="$2"; shift 2 ;;
|
||||
--root) NEXUS_ROOT="$2"; shift 2 ;;
|
||||
--skip-clone) SKIP_CLONE=true; shift ;;
|
||||
--skip-1panel-check) SKIP_1PANEL_CHECK=true; shift ;;
|
||||
*) error "未知参数: $1"; usage; exit 1 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
banner() {
|
||||
echo ""
|
||||
echo -e "${BLUE}╔══════════════════════════════════════════════════════════════╗${NC}"
|
||||
echo -e "${BLUE}║${NC} Nexus 6.0 — 全新安装（1Panel + Docker Compose） ${BLUE}║${NC}"
|
||||
echo -e "${BLUE}║${NC} 域名: ${NEXUS_DOMAIN} ${BLUE}║${NC}"
|
||||
echo -e "${BLUE}║${NC} 档位: ${NEXUS_PROFILE} 目录: ${NEXUS_ROOT} ${BLUE}║${NC}"
|
||||
echo -e "${BLUE}╚══════════════════════════════════════════════════════════════╝${NC}"
|
||||
echo ""
|
||||
}
|
||||
|
||||
load_credentials() {
|
||||
step "加载凭据..."
|
||||
local f
|
||||
for f in /root/.nexus-deploy.env /root/.nexus-secrets/nexus.env; do
|
||||
if [[ -f "$f" ]]; then
|
||||
# shellcheck disable=SC1090
|
||||
set -a
|
||||
source "$f"
|
||||
set +a
|
||||
info "已加载 $f"
|
||||
fi
|
||||
done
|
||||
if [[ -f "${NEXUS_ROOT}/deploy/nexus-1panel.secrets.sh" ]]; then
|
||||
# shellcheck disable=SC1090
|
||||
set -a
|
||||
source "${NEXUS_ROOT}/deploy/nexus-1panel.secrets.sh"
|
||||
set +a
|
||||
info "已加载 ${NEXUS_ROOT}/deploy/nexus-1panel.secrets.sh（可选）"
|
||||
fi
|
||||
unset NEXUS_SECRET_KEY NEXUS_API_KEY NEXUS_ENCRYPTION_KEY
|
||||
info "全新安装：NEXUS 密钥将在 docker/.env.prod 中按本机自动生成"
|
||||
}
|
||||
|
||||
install_root_commands() {
|
||||
[[ -d "${NEXUS_ROOT}/deploy" ]] || return 0
|
||||
NEXUS_ROOT="$NEXUS_ROOT" bash "${NEXUS_ROOT}/deploy/install-nx-cli.sh" || true
|
||||
info "全局命令: nx · nexus-update · nexus-fresh · nexus-install · nexus-1panel"
|
||||
}
|
||||
|
||||
phase_preflight() {
|
||||
step "阶段 1/6 — 环境检查"
|
||||
if [[ "$(id -u)" -ne 0 ]]; then
|
||||
error "请切换到 root 再执行（不要用 sudo 包一层）:"
|
||||
error " su -"
|
||||
error " bash $0 ..."
|
||||
exit 1
|
||||
fi
|
||||
info "运行用户: root（无需 sudo）"
|
||||
|
||||
if [[ ! -f /etc/os-release ]]; then
|
||||
error "无法识别操作系统"
|
||||
exit 1
|
||||
fi
|
||||
# shellcheck disable=SC1091
|
||||
source /etc/os-release
|
||||
info "系统: ${NAME:-Linux} ${VERSION_ID:-}"
|
||||
case "${ID:-}" in
|
||||
ubuntu|debian) info "受支持的分支: Debian/Ubuntu ✓" ;;
|
||||
centos|rhel|rocky|almalinux) info "受支持的分支: RHEL 系 ✓" ;;
|
||||
*) warn "未在官方列表中测试，可能仍可运行" ;;
|
||||
esac
|
||||
|
||||
local mem_kb
|
||||
mem_kb="$(awk '/MemTotal/ {print $2}' /proc/meminfo 2>/dev/null || echo 0)"
|
||||
if [[ "$mem_kb" -lt 3500000 ]]; then
|
||||
warn "内存 < 4GB，建议档位 1c4g: --profile 1c4g"
|
||||
else
|
||||
info "内存: $((mem_kb / 1024 / 1024)) GiB 量级"
|
||||
fi
|
||||
}
|
||||
|
||||
phase_1panel() {
|
||||
step "阶段 2/6 — 1Panel / Docker"
|
||||
if [[ "$SKIP_1PANEL_CHECK" != true ]]; then
|
||||
if command -v 1pctl >/dev/null 2>&1; then
|
||||
info "检测到 1Panel (1pctl)"
|
||||
if 1pctl version >/dev/null 2>&1; then
|
||||
info "1Panel: $(1pctl version 2>/dev/null | head -1 || true)"
|
||||
fi
|
||||
else
|
||||
warn "未检测到 1pctl — 若尚未安装 1Panel，可先执行:"
|
||||
warn " curl -sSL https://resource.1panel.pro/v2/quick_start.sh -o quick_start.sh"
|
||||
warn " bash quick_start.sh"
|
||||
read -r -p "继续安装 Nexus? [y/N]: " cont
|
||||
[[ "$cont" == "y" || "$cont" == "Y" ]] || exit 0
|
||||
fi
|
||||
fi
|
||||
|
||||
if ! docker compose version >/dev/null 2>&1; then
|
||||
error "未检测到 docker compose"
|
||||
error "请在 1Panel → 容器 中安装 Docker，或: apt install -y docker.io docker-compose-v2"
|
||||
exit 1
|
||||
fi
|
||||
info "Docker Compose: $(docker compose version --short 2>/dev/null || docker compose version | head -1)"
|
||||
}
|
||||
|
||||
phase_packages() {
|
||||
step "阶段 3/6 — 依赖包"
|
||||
if command -v apt-get >/dev/null 2>&1; then
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-get update -qq
|
||||
apt-get install -y -qq git curl openssl ca-certificates iproute2 >/dev/null 2>&1 || true
|
||||
elif command -v dnf >/dev/null 2>&1; then
|
||||
dnf install -y -q git curl openssl ca-certificates iproute >/dev/null 2>&1 || true
|
||||
fi
|
||||
info "git / curl 就绪"
|
||||
}
|
||||
|
||||
git_clone_url() {
|
||||
if [[ -z "${NEXUS_GITEA_TOKEN:-}" ]]; then
|
||||
echo "http://${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
|
||||
else
|
||||
echo "http://admin:${NEXUS_GITEA_TOKEN}@${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
|
||||
fi
|
||||
}
|
||||
|
||||
phase_clone() {
|
||||
step "阶段 4/6 — 获取 Nexus 代码"
|
||||
if [[ "$SKIP_CLONE" == true ]]; then
|
||||
if [[ ! -d "${NEXUS_ROOT}/.git" ]]; then
|
||||
error "--skip-clone 但 ${NEXUS_ROOT} 不是 git 仓库"
|
||||
exit 1
|
||||
fi
|
||||
load_credentials
|
||||
info "跳过 clone，使用现有 ${NEXUS_ROOT}"
|
||||
info "版本: $(git -C "$NEXUS_ROOT" log -1 --oneline 2>/dev/null || echo '?')"
|
||||
chmod +x "${NEXUS_ROOT}/deploy/"*.sh 2>/dev/null || true
|
||||
return 0
|
||||
fi
|
||||
load_credentials
|
||||
local url
|
||||
url="$(git_clone_url)"
|
||||
if [[ -z "${NEXUS_GITEA_TOKEN:-}" ]]; then
|
||||
info "公共仓库：匿名 git clone（无需令牌）"
|
||||
fi
|
||||
mkdir -p "$(dirname "$NEXUS_ROOT")"
|
||||
|
||||
if [[ -d "${NEXUS_ROOT}/.git" ]]; then
|
||||
info "仓库已存在，同步 ${NEXUS_GIT_BRANCH}..."
|
||||
git -C "$NEXUS_ROOT" remote set-url origin "$url" 2>/dev/null || true
|
||||
git -C "$NEXUS_ROOT" fetch origin "$NEXUS_GIT_BRANCH" --prune
|
||||
git -C "$NEXUS_ROOT" reset --hard "origin/${NEXUS_GIT_BRANCH}"
|
||||
else
|
||||
if [[ -d "$NEXUS_ROOT" ]] && [[ -n "$(ls -A "$NEXUS_ROOT" 2>/dev/null)" ]]; then
|
||||
error "目录非空且不是 git 仓库: $NEXUS_ROOT"
|
||||
exit 1
|
||||
fi
|
||||
rm -rf "$NEXUS_ROOT"
|
||||
info "克隆 → $NEXUS_ROOT"
|
||||
git clone "$url" "$NEXUS_ROOT"
|
||||
git -C "$NEXUS_ROOT" checkout "$NEXUS_GIT_BRANCH" 2>/dev/null || true
|
||||
fi
|
||||
|
||||
load_credentials
|
||||
info "版本: $(git -C "$NEXUS_ROOT" log -1 --oneline)"
|
||||
chmod +x "${NEXUS_ROOT}/deploy/"*.sh 2>/dev/null || true
|
||||
}
|
||||
|
||||
phase_install_stack() {
|
||||
step "阶段 5/6 — Docker 构建与启动（全新库，约 10～20 分钟）"
|
||||
export NEXUS_ROOT NEXUS_DOMAIN NEXUS_PROFILE
|
||||
bash "${NEXUS_ROOT}/deploy/nexus-1panel.sh" install \
|
||||
--fresh \
|
||||
--skip-clone \
|
||||
--profile "$NEXUS_PROFILE" \
|
||||
--domain "$NEXUS_DOMAIN"
|
||||
}
|
||||
|
||||
phase_post() {
|
||||
step "阶段 6/6 — 收尾"
|
||||
install_root_commands
|
||||
|
||||
local port health
|
||||
port="8600"
|
||||
health="$(curl -sf "http://127.0.0.1:${port}/health" 2>/dev/null || echo "pending")"
|
||||
|
||||
echo ""
|
||||
echo -e "${GREEN}╔══════════════════════════════════════════════════════════════╗${NC}"
|
||||
echo -e "${GREEN}║${NC} ${GREEN}Nexus 全新安装完成${NC} ${GREEN}║${NC}"
|
||||
echo -e "${GREEN}╠══════════════════════════════════════════════════════════════╣${NC}"
|
||||
echo -e "${GREEN}║${NC} 本地健康: http://127.0.0.1:${port}/health → ${health} ${GREEN}║${NC}"
|
||||
echo -e "${GREEN}║${NC} ${GREEN}║${NC}"
|
||||
echo -e "${GREEN}║${NC} ${YELLOW}① 浏览器完成安装向导（必做）${NC} ${GREEN}║${NC}"
|
||||
echo -e "${GREEN}║${NC} https://${NEXUS_DOMAIN}/app/install.html ${GREEN}║${NC}"
|
||||
echo -e "${GREEN}║${NC} ${GREEN}║${NC}"
|
||||
echo -e "${GREEN}║${NC} ${YELLOW}② 1Panel 创建网站并反代${NC} ${GREEN}║${NC}"
|
||||
echo -e "${GREEN}║${NC} 目标: http://127.0.0.1:${port} ${GREEN}║${NC}"
|
||||
echo -e "${GREEN}║${NC} 示例: ${NEXUS_ROOT}/deploy/1panel/openresty-nexus.conf.example ${GREEN}║${NC}"
|
||||
echo -e "${GREEN}║${NC} ${GREEN}║${NC}"
|
||||
echo -e "${GREEN}║${NC} ${YELLOW}③ 日常运维${NC} ${GREEN}║${NC}"
|
||||
echo -e "${GREEN}║${NC} nx # 统一菜单（一键更新 / 重启 / 日志） ${GREEN}║${NC}"
|
||||
echo -e "${GREEN}║${NC} nexus-update # 等同 deploy/update.sh ${GREEN}║${NC}"
|
||||
echo -e "${GREEN}╚══════════════════════════════════════════════════════════════╝${NC}"
|
||||
echo ""
|
||||
}
|
||||
|
||||
warn_if_already_installed() {
|
||||
local env_prod="${NEXUS_ROOT}/docker/.env.prod" cname
|
||||
[[ -f "$env_prod" ]] || return 0
|
||||
cname="$(docker ps --format '{{.Names}}' 2>/dev/null | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true)"
|
||||
if [[ -n "$cname" ]] && docker exec "$cname" test -f /var/lib/nexus/.install_locked 2>/dev/null; then
|
||||
warn "检测到已安装并锁定的 Nexus（将清除 nexus-state 卷内配置并重建）"
|
||||
read -r -p "确认继续全新安装? [y/N]: " ok
|
||||
[[ "$ok" == "y" || "$ok" == "Y" ]] || exit 0
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
banner
|
||||
if [[ "$SKIP_CLONE" == true && -d "${NEXUS_ROOT}/deploy" ]]; then
|
||||
install_root_commands
|
||||
fi
|
||||
warn_if_already_installed
|
||||
phase_preflight
|
||||
phase_1panel
|
||||
phase_packages
|
||||
phase_clone
|
||||
phase_install_stack
|
||||
phase_post
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,68 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# 注册 Nexus 全局 CLI（/usr/local/bin）— install / upgrade / nx 均会调用
|
||||
#
|
||||
# NEXUS_ROOT=/opt/nexus bash deploy/install-nx-cli.sh
|
||||
#
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
BIN_DIR="${NEXUS_BIN_DIR:-/usr/local/bin}"
|
||||
DEPLOY="${NEXUS_ROOT}/deploy"
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
|
||||
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
||||
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
|
||||
|
||||
if [[ ! -d "$DEPLOY" ]]; then
|
||||
error "未找到 $DEPLOY"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ "$(id -u)" -ne 0 ]]; then
|
||||
warn "非 root：无法写入 $BIN_DIR，请使用 root 执行或: sudo bash $DEPLOY/install-nx-cli.sh"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
chmod +x \
|
||||
"$DEPLOY/nx" \
|
||||
"$DEPLOY/update.sh" \
|
||||
"$DEPLOY/nexus-1panel.sh" \
|
||||
"$DEPLOY/install-nexus-fresh.sh" \
|
||||
"$DEPLOY/quick-install.sh" \
|
||||
"$DEPLOY/install-1panel-docker.sh" \
|
||||
"$DEPLOY/upgrade-1panel-docker.sh" \
|
||||
"$DEPLOY/sync-install-wizard-to-container.sh" \
|
||||
"$DEPLOY/uninstall-mysql-compose.sh" \
|
||||
"$DEPLOY/uninstall-redis-compose.sh" \
|
||||
"$DEPLOY/install-nx-cli.sh" \
|
||||
2>/dev/null || true
|
||||
|
||||
mkdir -p "$BIN_DIR"
|
||||
|
||||
link_cli() {
|
||||
local src="$1" name="$2"
|
||||
if [[ ! -f "$src" ]]; then
|
||||
warn "跳过 $name（缺少 $src）"
|
||||
return 0
|
||||
fi
|
||||
ln -sf "$src" "${BIN_DIR}/${name}"
|
||||
}
|
||||
|
||||
link_cli "$DEPLOY/nx" nx
|
||||
link_cli "$DEPLOY/update.sh" nexus-update
|
||||
link_cli "$DEPLOY/install-nexus-fresh.sh" nexus-fresh
|
||||
link_cli "$DEPLOY/quick-install.sh" nexus-install
|
||||
link_cli "$DEPLOY/nexus-1panel.sh" nexus-1panel
|
||||
link_cli "$DEPLOY/install-1panel-docker.sh" nexus-1panel-docker
|
||||
|
||||
if command -v nx >/dev/null 2>&1; then
|
||||
info "全局命令已就绪: nx → $(readlink -f "$(command -v nx)" 2>/dev/null || command -v nx)"
|
||||
else
|
||||
error "nx 未出现在 PATH 中，请确认 $BIN_DIR 在 PATH 内"
|
||||
exit 1
|
||||
fi
|
||||
+1
-1
@@ -416,7 +416,7 @@ server {
|
||||
}
|
||||
|
||||
# Upload limit
|
||||
client_max_body_size 500m;
|
||||
client_max_body_size 100m;
|
||||
|
||||
# Well-known for SSL cert validation
|
||||
location ~ \\.well-known {
|
||||
|
||||
@@ -1,81 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Nexus — 安装/更新 host crontab：health_monitor + db_backup
|
||||
#
|
||||
# sudo bash deploy/install_ops_cron.sh
|
||||
# NEXUS_ROOT=/opt/nexus sudo bash deploy/install_ops_cron.sh
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
DEPLOY_DIR="${NEXUS_ROOT}/deploy"
|
||||
HEALTH_MARKER="nexus-health-monitor"
|
||||
BACKUP_MARKER="nexus-mysql-backup"
|
||||
HEALTH_LOG="${NEXUS_HEALTH_LOG:-/var/log/nexus_health.log}"
|
||||
BACKUP_LOG="${NEXUS_BACKUP_LOG:-/var/log/nexus_backup.log}"
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
|
||||
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
||||
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
|
||||
|
||||
if [[ "$(id -u)" -ne 0 ]]; then
|
||||
error "请使用 root 运行: sudo bash $0"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
ensure_crontab() {
|
||||
if command -v crontab >/dev/null 2>&1; then
|
||||
return 0
|
||||
fi
|
||||
warn "未检测到 crontab，尝试安装 cron 包…"
|
||||
if command -v apt-get >/dev/null 2>&1; then
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-get update -qq
|
||||
apt-get install -y -qq cron
|
||||
systemctl enable --now cron 2>/dev/null || systemctl enable --now crond 2>/dev/null || true
|
||||
elif command -v yum >/dev/null 2>&1; then
|
||||
yum install -y cronie
|
||||
systemctl enable --now crond 2>/dev/null || true
|
||||
fi
|
||||
if ! command -v crontab >/dev/null 2>&1; then
|
||||
error "无法安装 crontab（请手动: apt install cron）"
|
||||
exit 1
|
||||
fi
|
||||
info "cron 已安装"
|
||||
}
|
||||
|
||||
ensure_crontab
|
||||
|
||||
for f in \
|
||||
"${DEPLOY_DIR}/health_monitor.sh" \
|
||||
"${DEPLOY_DIR}/db_backup.sh" \
|
||||
"${DEPLOY_DIR}/mysql_dump_to_file.sh" \
|
||||
; do
|
||||
if [[ ! -f "$f" ]]; then
|
||||
error "缺少脚本: $f"
|
||||
exit 1
|
||||
fi
|
||||
chmod +x "$f" 2>/dev/null || true
|
||||
done
|
||||
|
||||
touch "$HEALTH_LOG" "$BACKUP_LOG" 2>/dev/null || true
|
||||
chmod 644 "$HEALTH_LOG" "$BACKUP_LOG" 2>/dev/null || true
|
||||
|
||||
HEALTH_LINE="* * * * * NEXUS_DEPLOY_DIR=${NEXUS_ROOT} bash ${DEPLOY_DIR}/health_monitor.sh >> ${HEALTH_LOG} 2>&1 # ${HEALTH_MARKER}"
|
||||
BACKUP_LINE="0 3 * * * NEXUS_ROOT=${NEXUS_ROOT} bash ${DEPLOY_DIR}/db_backup.sh >> ${BACKUP_LOG} 2>&1 # ${BACKUP_MARKER}"
|
||||
|
||||
existing="$(crontab -l 2>/dev/null || true)"
|
||||
filtered="$(printf '%s\n' "$existing" | grep -v "$HEALTH_MARKER" | grep -v "$BACKUP_MARKER" | grep -v 'deploy/health_monitor.sh' | grep -v 'deploy/db_backup.sh' || true)"
|
||||
{
|
||||
printf '%s\n' "$filtered" | sed '/^[[:space:]]*$/d'
|
||||
echo "$HEALTH_LINE"
|
||||
echo "$BACKUP_LINE"
|
||||
} | crontab -
|
||||
|
||||
info "已写入 crontab:"
|
||||
crontab -l | grep -E "$HEALTH_MARKER|$BACKUP_MARKER" || true
|
||||
info "健康巡检日志: $HEALTH_LOG"
|
||||
info "MySQL 备份日志: $BACKUP_LOG"
|
||||
@@ -1,196 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Nexus — MySQL dump（Docker 1Panel / 宿主机 mysqldump 通用）
|
||||
#
|
||||
# bash deploy/mysql_dump_to_file.sh --output /path/dump.sql [--root /opt/nexus]
|
||||
# bash deploy/mysql_dump_to_file.sh --output /path/dump.sql --db-url 'mysql+aiomysql://...'
|
||||
#
|
||||
# 策略（按序）:
|
||||
# 1. DB host 为运行中容器名 → docker exec 该容器内 mysqldump（连 127.0.0.1）
|
||||
# 2. 宿主机有 mysqldump 且 host 可解析 → 本机 mysqldump
|
||||
# 3. 1panel-network 存在 → docker run --rm mysql:8 客户端
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
OUTPUT=""
|
||||
DB_URL=""
|
||||
|
||||
usage() {
|
||||
cat <<'EOF'
|
||||
用法: mysql_dump_to_file.sh --output FILE.sql [--root /opt/nexus] [--db-url URL]
|
||||
EOF
|
||||
}
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--output|-o) OUTPUT="$2"; shift 2 ;;
|
||||
--root) NEXUS_ROOT="$2"; shift 2 ;;
|
||||
--db-url) DB_URL="$2"; shift 2 ;;
|
||||
-h|--help) usage; exit 0 ;;
|
||||
*) echo "未知参数: $1" >&2; usage; exit 1 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [[ -z "$OUTPUT" ]]; then
|
||||
echo "缺少 --output" >&2
|
||||
usage
|
||||
exit 1
|
||||
fi
|
||||
|
||||
resolve_db_url() {
|
||||
if [[ -n "$DB_URL" ]]; then
|
||||
echo "$DB_URL"
|
||||
return 0
|
||||
fi
|
||||
local cname url
|
||||
cname="$(docker ps --format '{{.Names}}' 2>/dev/null | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true)"
|
||||
if [[ -n "$cname" ]]; then
|
||||
url="$(docker exec "$cname" grep -E '^NEXUS_DATABASE_URL=' /app/.env 2>/dev/null | head -1 | cut -d= -f2- | tr -d '"' | tr -d "'" || true)"
|
||||
[[ -n "$url" ]] && echo "$url" && return 0
|
||||
fi
|
||||
for f in \
|
||||
"${NEXUS_ROOT}/docker/.env.prod" \
|
||||
"${NEXUS_ROOT}/.env" \
|
||||
; do
|
||||
[[ -f "$f" ]] || continue
|
||||
url="$(grep -E '^NEXUS_DATABASE_URL=' "$f" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '"' | tr -d "'" || true)"
|
||||
[[ -n "$url" ]] && echo "$url" && return 0
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
DB_URL="$(resolve_db_url || true)"
|
||||
if [[ -z "$DB_URL" ]]; then
|
||||
echo "未找到 NEXUS_DATABASE_URL" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
python3 - "$DB_URL" "$OUTPUT" <<'PY'
|
||||
import shutil
|
||||
import subprocess
|
||||
import sys
|
||||
import urllib.parse
|
||||
|
||||
|
||||
def docker_names() -> set[str]:
|
||||
r = subprocess.run(
|
||||
["docker", "ps", "--format", "{{.Names}}"],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=False,
|
||||
)
|
||||
return {ln.strip() for ln in (r.stdout or "").splitlines() if ln.strip()}
|
||||
|
||||
|
||||
def network_exists(name: str) -> bool:
|
||||
return (
|
||||
subprocess.run(
|
||||
["docker", "network", "inspect", name],
|
||||
capture_output=True,
|
||||
check=False,
|
||||
).returncode
|
||||
== 0
|
||||
)
|
||||
|
||||
|
||||
def write_dump(cmd: list[str], env: dict[str, str], out: str) -> int:
|
||||
r = subprocess.run(cmd, env=env, capture_output=True, text=True)
|
||||
if r.returncode != 0:
|
||||
sys.stderr.write(r.stderr or r.stdout or "mysqldump failed\n")
|
||||
return r.returncode
|
||||
with open(out, "w", encoding="utf-8") as fh:
|
||||
fh.write(r.stdout)
|
||||
return 0
|
||||
|
||||
|
||||
def dump_flags(db: str) -> list[str]:
|
||||
return [
|
||||
"--single-transaction",
|
||||
"--routines",
|
||||
"--triggers",
|
||||
"--set-gtid-purged=OFF",
|
||||
db,
|
||||
]
|
||||
|
||||
|
||||
url = sys.argv[1].replace("mysql+aiomysql://", "mysql://", 1)
|
||||
url = url.replace("mysql+asyncmy://", "mysql://", 1)
|
||||
out = sys.argv[2]
|
||||
p = urllib.parse.urlparse(url)
|
||||
user = urllib.parse.unquote(p.username or "")
|
||||
password = urllib.parse.unquote(p.password or "")
|
||||
host = p.hostname or "127.0.0.1"
|
||||
if host == "host.docker.internal":
|
||||
host = "127.0.0.1"
|
||||
port = str(p.port or 3306)
|
||||
db = (p.path or "/nexus").lstrip("/").split("?")[0]
|
||||
env = {**__import__("os").environ, "MYSQL_PWD": password}
|
||||
names = docker_names()
|
||||
|
||||
# 1) MySQL 跑在 Docker 容器内（1Panel 常见：URL host = 容器名）
|
||||
if host in names:
|
||||
cmd = [
|
||||
"docker",
|
||||
"exec",
|
||||
"-e",
|
||||
f"MYSQL_PWD={password}",
|
||||
host,
|
||||
"mysqldump",
|
||||
"-h",
|
||||
"127.0.0.1",
|
||||
"-P",
|
||||
port,
|
||||
"-u",
|
||||
user,
|
||||
*dump_flags(db),
|
||||
]
|
||||
rc = write_dump(cmd, env, out)
|
||||
if rc == 0:
|
||||
sys.exit(0)
|
||||
sys.stderr.write(f"docker exec {host} mysqldump 失败，尝试其它方式…\n")
|
||||
|
||||
# 2) 宿主机 mysqldump
|
||||
if shutil.which("mysqldump"):
|
||||
cmd = [
|
||||
"mysqldump",
|
||||
"-h",
|
||||
host,
|
||||
"-P",
|
||||
port,
|
||||
"-u",
|
||||
user,
|
||||
*dump_flags(db),
|
||||
]
|
||||
rc = write_dump(cmd, env, out)
|
||||
if rc == 0:
|
||||
sys.exit(0)
|
||||
|
||||
# 3) 临时 mysql 客户端容器（1panel-network）
|
||||
for net in ("1panel-network", "bridge"):
|
||||
if not network_exists(net):
|
||||
continue
|
||||
cmd = [
|
||||
"docker",
|
||||
"run",
|
||||
"--rm",
|
||||
"--network",
|
||||
net,
|
||||
"-e",
|
||||
f"MYSQL_PWD={password}",
|
||||
"mysql:8.0",
|
||||
"mysqldump",
|
||||
"-h",
|
||||
host,
|
||||
"-P",
|
||||
port,
|
||||
"-u",
|
||||
user,
|
||||
*dump_flags(db),
|
||||
]
|
||||
rc = write_dump(cmd, env, out)
|
||||
if rc == 0:
|
||||
sys.exit(0)
|
||||
|
||||
sys.stderr.write("所有 mysqldump 策略均失败（无宿主机客户端且 Docker 回退不可用）\n")
|
||||
sys.exit(1)
|
||||
PY
|
||||
File diff suppressed because it is too large
Load Diff
@@ -75,5 +75,5 @@ server {
|
||||
error_log {{LOG_DIR}}/{{SERVER_NAME}}_nexus.error.log;
|
||||
|
||||
# ── Upload limit ──
|
||||
client_max_body_size 500m;
|
||||
client_max_body_size 100m;
|
||||
}
|
||||
|
||||
@@ -109,5 +109,5 @@ server {
|
||||
error_log {{LOG_DIR}}/{{SERVER_NAME}}.error.log;
|
||||
|
||||
# ── Upload limit ──
|
||||
client_max_body_size 500m;
|
||||
client_max_body_size 100m;
|
||||
}
|
||||
|
||||
@@ -1,452 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Nexus NX — 统一运维菜单（安装 + 升级 + 日常运维）
|
||||
#
|
||||
# nx 交互菜单
|
||||
# nx update 一键更新（等同 deploy/update.sh）
|
||||
# nx update --no-cache 无缓存重建镜像
|
||||
# nx install-fresh 全新安装
|
||||
# nx health 健康检查
|
||||
#
|
||||
set -euo pipefail
|
||||
|
||||
NX_SELF="$(readlink -f "${BASH_SOURCE[0]}")"
|
||||
NX_DIR="$(cd "$(dirname "$NX_SELF")" && pwd)"
|
||||
# shellcheck source=./nexus-1panel.sh
|
||||
source "${NX_DIR}/nexus-1panel.sh"
|
||||
|
||||
pause_enter() {
|
||||
echo ""
|
||||
read -r -p "按 Enter 继续..."
|
||||
}
|
||||
|
||||
clear_screen() {
|
||||
if [[ -t 1 ]]; then
|
||||
clear 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
is_stack_installed() {
|
||||
[[ -d "${NEXUS_ROOT}/.git" && -f "${NEXUS_ROOT}/${ENV_PROD}" ]]
|
||||
}
|
||||
|
||||
detect_runtime() {
|
||||
if is_stack_installed && docker compose version >/dev/null 2>&1; then
|
||||
local prof q
|
||||
prof="$(profile_env_file "$NEXUS_ROOT")"
|
||||
if [[ -f "$prof" && -f "$NEXUS_ROOT/$ENV_PROD" ]]; then
|
||||
local -a det_args=(-f "$COMPOSE_FILE")
|
||||
if has_1panel_network && [[ -f "$NEXUS_ROOT/$COMPOSE_1PANEL" ]]; then
|
||||
det_args+=(-f "$COMPOSE_1PANEL")
|
||||
fi
|
||||
q="$(cd "$NEXUS_ROOT" && docker compose "${det_args[@]}" \
|
||||
--env-file "$ENV_PROD" --env-file "$prof" ps -q nexus 2>/dev/null || true)"
|
||||
if [[ -n "$q" ]]; then
|
||||
NX_RUNTIME="docker"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
if command -v supervisorctl >/dev/null 2>&1 && supervisorctl status nexus >/dev/null 2>&1; then
|
||||
NX_RUNTIME="supervisor"
|
||||
return 0
|
||||
fi
|
||||
NX_RUNTIME="none"
|
||||
}
|
||||
|
||||
install_nx_cli() {
|
||||
NEXUS_ROOT="$(cd "${NX_DIR}/.." && pwd)" \
|
||||
bash "${NX_DIR}/install-nx-cli.sh" 2>/dev/null || true
|
||||
}
|
||||
|
||||
menu_header() {
|
||||
local title="$1"
|
||||
clear_screen
|
||||
echo ""
|
||||
echo "╔══════════════════════════════════════════════════════════╗"
|
||||
printf "║ Nexus NX — %-44s║\n" "$title"
|
||||
echo "╠══════════════════════════════════════════════════════════╣"
|
||||
echo "║ 域名: ${NEXUS_DOMAIN} 目录: ${NEXUS_ROOT}"
|
||||
if is_stack_installed; then
|
||||
detect_runtime
|
||||
echo "║ 运行: ${NX_RUNTIME} 档位: $(cat "${NEXUS_ROOT}/${HOST_PROFILE_FILE}" 2>/dev/null || echo "${NEXUS_PROFILE}")"
|
||||
if [[ -d "${NEXUS_ROOT}/.git" ]]; then
|
||||
echo "║ 版本: $(git -C "${NEXUS_ROOT}" log -1 --oneline 2>/dev/null || echo '?')"
|
||||
fi
|
||||
else
|
||||
echo "║ 状态: 未安装"
|
||||
fi
|
||||
echo "╚══════════════════════════════════════════════════════════╝"
|
||||
echo ""
|
||||
}
|
||||
|
||||
run_install() {
|
||||
local profile="${1:-2c8g}" extra="${2:-}"
|
||||
NEXUS_PROFILE="$profile"
|
||||
SKIP_CLONE=false
|
||||
FRESH_INSTALL=false
|
||||
NO_BACKUP=false
|
||||
PRUNE_IMAGES=false
|
||||
FROM_ENV="${NEXUS_FROM_ENV}"
|
||||
case "$extra" in
|
||||
skip-clone) SKIP_CLONE=true ;;
|
||||
fresh) FRESH_INSTALL=true ;;
|
||||
from-env) FROM_ENV="${NEXUS_FROM_ENV}" ;;
|
||||
esac
|
||||
load_secrets
|
||||
cmd_install
|
||||
install_nx_cli
|
||||
pause_enter
|
||||
}
|
||||
|
||||
menu_install() {
|
||||
while true; do
|
||||
menu_header "安装"
|
||||
cat <<'EOF'
|
||||
[1] 一键安装（默认 2核8G / 2c8g）
|
||||
[2] 安装 — 4核16G（4c16g）
|
||||
[3] 安装 — 1核4G（1c4g）
|
||||
[4] 自定义规格（输入 CPU 与内存 GB）
|
||||
[5] 已 clone 到 /opt/nexus，仅 pull + 启动（--skip-clone）
|
||||
[6] 全新安装（install-nexus-fresh.sh → /app/install.html）
|
||||
[7] 检查端口 / 防火墙（不安装）
|
||||
[0] 返回
|
||||
|
||||
EOF
|
||||
read -r -p "请选择: " choice
|
||||
case "$choice" in
|
||||
1) run_install 2c8g "" ;;
|
||||
2) run_install 4c16g "" ;;
|
||||
3) run_install 1c4g "" ;;
|
||||
4)
|
||||
read -r -p "CPU 核数: " cpus
|
||||
read -r -p "内存 GB: " mem
|
||||
CUSTOM_CPUS="$cpus"
|
||||
CUSTOM_MEM_GB="$mem"
|
||||
run_install 2c8g ""
|
||||
;;
|
||||
5) run_install 2c8g skip-clone ;;
|
||||
6)
|
||||
if [[ -x "${NX_DIR}/install-nexus-fresh.sh" ]]; then
|
||||
bash "${NX_DIR}/install-nexus-fresh.sh" --profile "${NEXUS_PROFILE:-2c8g}"
|
||||
else
|
||||
run_install 2c8g fresh
|
||||
fi
|
||||
;;
|
||||
7)
|
||||
require_root
|
||||
load_secrets
|
||||
check_ports_preflight "$NEXUS_ROOT"
|
||||
if is_stack_installed; then
|
||||
check_ports_post "$NEXUS_ROOT"
|
||||
fi
|
||||
pause_enter
|
||||
;;
|
||||
0) return 0 ;;
|
||||
*) warn "无效选项" ; sleep 1 ;;
|
||||
esac
|
||||
done
|
||||
}
|
||||
|
||||
ops_restart_nexus() {
|
||||
step "重启 Nexus（Python）..."
|
||||
if [[ "$NX_RUNTIME" == "docker" ]]; then
|
||||
compose_cmd "$NEXUS_ROOT" restart nexus
|
||||
elif [[ "$NX_RUNTIME" == "supervisor" ]]; then
|
||||
supervisorctl restart nexus
|
||||
else
|
||||
error "未检测到运行中的 Nexus"
|
||||
return 1
|
||||
fi
|
||||
sleep 3
|
||||
verify_health "$NEXUS_ROOT" "重启" || true
|
||||
}
|
||||
|
||||
ops_restart_stack() {
|
||||
step "重启 Compose 栈..."
|
||||
compose_cmd "$NEXUS_ROOT" restart
|
||||
sleep 5
|
||||
verify_health "$NEXUS_ROOT" "重启" || true
|
||||
}
|
||||
|
||||
ops_stop_stack() {
|
||||
warn "将停止 Nexus 容器（MySQL/Redis 为外置服务，不受影响）"
|
||||
read -r -p "确认? [y/N]: " c
|
||||
[[ "$c" == "y" || "$c" == "Y" ]] || return 0
|
||||
compose_cmd "$NEXUS_ROOT" stop
|
||||
info "已停止"
|
||||
}
|
||||
|
||||
ops_start_stack() {
|
||||
compose_cmd "$NEXUS_ROOT" up -d --remove-orphans
|
||||
verify_nexus_1panel_network "$NEXUS_ROOT" || return 1
|
||||
verify_health "$NEXUS_ROOT" "启动" || true
|
||||
}
|
||||
|
||||
ops_logs() {
|
||||
local svc="${1:-nexus}"
|
||||
echo ""
|
||||
read -r -p "跟踪日志行数 [80]: " n
|
||||
n="${n:-80}"
|
||||
compose_cmd "$NEXUS_ROOT" logs --tail="$n" -f "$svc"
|
||||
}
|
||||
|
||||
ops_status() {
|
||||
if [[ "$NX_RUNTIME" == "docker" ]]; then
|
||||
compose_cmd "$NEXUS_ROOT" ps
|
||||
elif [[ "$NX_RUNTIME" == "supervisor" ]]; then
|
||||
supervisorctl status nexus
|
||||
fi
|
||||
echo ""
|
||||
local port h code
|
||||
port="$(nexus_publish_port "$NEXUS_ROOT")"
|
||||
h=$(curl -sf "http://127.0.0.1:${port}/health" 2>/dev/null || echo "fail")
|
||||
info "/health → ${h}"
|
||||
local cname
|
||||
cname="$(nexus_container_name 2>/dev/null || true)"
|
||||
code=$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app/install.html" 2>/dev/null || echo "000")
|
||||
if [[ -n "$cname" ]] && nexus_container_has_install_lock "$cname"; then
|
||||
if [[ "$code" == "404" ]]; then
|
||||
info "/app/install.html → 已归档 (HTTP 404)"
|
||||
else
|
||||
warn "/app/install.html → 应已归档但 HTTP ${code}"
|
||||
fi
|
||||
else
|
||||
info "/app/install.html → HTTP ${code}"
|
||||
fi
|
||||
}
|
||||
|
||||
ops_backup_now() {
|
||||
NO_BACKUP=false
|
||||
backup_mysql "$NEXUS_ROOT"
|
||||
}
|
||||
|
||||
ops_install_cron() {
|
||||
bash "${NX_DIR}/install_ops_cron.sh"
|
||||
}
|
||||
|
||||
ops_update() {
|
||||
local args=()
|
||||
PRUNE_IMAGES=false
|
||||
NO_BACKUP=false
|
||||
NO_CACHE=false
|
||||
read -r -p "跳过 MySQL 备份? [y/N]: " nb
|
||||
[[ "$nb" == "y" || "$nb" == "Y" ]] && args+=(--no-backup)
|
||||
read -r -p "无缓存重建镜像? [y/N]: " nc
|
||||
[[ "$nc" == "y" || "$nc" == "Y" ]] && args+=(--no-cache)
|
||||
read -r -p "升级后清理悬空镜像? [y/N]: " pr
|
||||
[[ "$pr" == "y" || "$pr" == "Y" ]] && args+=(--prune)
|
||||
bash "${NX_DIR}/update.sh" "${args[@]}"
|
||||
pause_enter
|
||||
}
|
||||
|
||||
require_installed() {
|
||||
if ! is_stack_installed; then
|
||||
warn "尚未安装，请先使用菜单 [1] 安装"
|
||||
pause_enter
|
||||
return 1
|
||||
fi
|
||||
require_root
|
||||
load_secrets
|
||||
load_saved_profile "$NEXUS_ROOT"
|
||||
detect_runtime
|
||||
return 0
|
||||
}
|
||||
|
||||
menu_main() {
|
||||
load_secrets
|
||||
while true; do
|
||||
menu_header "运维菜单"
|
||||
cat <<'EOF'
|
||||
── 安装 ──
|
||||
[1] 安装向导（新机 / 迁机 / 档位）
|
||||
[2] 全新安装 → /app/install.html
|
||||
|
||||
── 日常运维（需已安装）──
|
||||
[3] 状态 + 健康检查
|
||||
[4] 一键更新（pull + 重建镜像）★
|
||||
[5] 重启 Nexus（Python）
|
||||
[6] 查看 Nexus 日志
|
||||
[7] 启动 / 停止 Compose 栈
|
||||
[8] 重建镜像并启动（--build nexus）
|
||||
[9] 备份 MySQL
|
||||
[e] 安装巡检/备份 cron（health_monitor + db_backup）
|
||||
[v] 1Panel 安装/运维验收脚本
|
||||
|
||||
── 其它 ──
|
||||
[a] 检查 Git 是否有更新
|
||||
[b] 端口 / 防火墙检查
|
||||
[c] 进入 Nexus 容器 shell
|
||||
[d] 1Panel 反代说明
|
||||
[0] 退出
|
||||
|
||||
EOF
|
||||
read -r -p "请选择: " choice
|
||||
case "$choice" in
|
||||
1) menu_install ;;
|
||||
2)
|
||||
require_root
|
||||
if is_stack_installed; then
|
||||
warn "将执行全新安装（清除 nexus-state 卷内旧配置并重建容器）"
|
||||
read -r -p "确认继续? [y/N]: " fresh_ok
|
||||
[[ "$fresh_ok" == "y" || "$fresh_ok" == "Y" ]] || continue
|
||||
fi
|
||||
exec bash "${NX_DIR}/install-nexus-fresh.sh" --profile "${NEXUS_PROFILE:-2c8g}"
|
||||
;;
|
||||
3)
|
||||
require_root
|
||||
if is_stack_installed; then
|
||||
load_saved_profile "$NEXUS_ROOT"
|
||||
detect_runtime
|
||||
ops_status
|
||||
else
|
||||
check_ports_preflight "$NEXUS_ROOT"
|
||||
fi
|
||||
pause_enter
|
||||
;;
|
||||
4)
|
||||
require_installed || continue
|
||||
ops_update
|
||||
;;
|
||||
5)
|
||||
require_installed || continue
|
||||
ops_restart_nexus
|
||||
pause_enter
|
||||
;;
|
||||
6)
|
||||
require_installed || continue
|
||||
ops_logs nexus
|
||||
;;
|
||||
7)
|
||||
require_installed || continue
|
||||
echo " [1] 启动 [2] 停止 [3] 重启栈"
|
||||
read -r -p "选: " s
|
||||
case "$s" in
|
||||
1) ops_start_stack ;;
|
||||
2) ops_stop_stack ;;
|
||||
3) ops_restart_stack ;;
|
||||
*) warn "无效" ;;
|
||||
esac
|
||||
pause_enter
|
||||
;;
|
||||
8)
|
||||
require_installed || continue
|
||||
read -r -p "无缓存重建? [y/N]: " nc
|
||||
if [[ "$nc" == "y" || "$nc" == "Y" ]]; then
|
||||
compose_cmd "$NEXUS_ROOT" build --no-cache nexus
|
||||
fi
|
||||
compose_cmd "$NEXUS_ROOT" up -d --build --remove-orphans nexus
|
||||
verify_nexus_1panel_network "$NEXUS_ROOT" || true
|
||||
verify_health "$NEXUS_ROOT" "重建" || true
|
||||
pause_enter
|
||||
;;
|
||||
9)
|
||||
require_installed || continue
|
||||
ops_backup_now
|
||||
pause_enter
|
||||
;;
|
||||
e|E)
|
||||
require_root
|
||||
ops_install_cron
|
||||
pause_enter
|
||||
;;
|
||||
v|V)
|
||||
require_root
|
||||
bash "${NX_DIR}/verify-1panel-install-wizard.sh"
|
||||
pause_enter
|
||||
;;
|
||||
a|A)
|
||||
require_root
|
||||
cmd_check
|
||||
pause_enter
|
||||
;;
|
||||
b|B)
|
||||
require_root
|
||||
check_ports_preflight "$NEXUS_ROOT"
|
||||
is_stack_installed && check_ports_post "$NEXUS_ROOT" || true
|
||||
pause_enter
|
||||
;;
|
||||
c|C)
|
||||
require_installed || continue
|
||||
compose_cmd "$NEXUS_ROOT" exec nexus bash || compose_cmd "$NEXUS_ROOT" exec nexus sh
|
||||
;;
|
||||
d|D)
|
||||
info "1Panel → 网站 → 创建站点 ${NEXUS_DOMAIN}"
|
||||
info "反向代理: http://127.0.0.1:$(nexus_publish_port "$NEXUS_ROOT")"
|
||||
info "示例: ${NEXUS_ROOT}/deploy/1panel/openresty-nexus.conf.example"
|
||||
pause_enter
|
||||
;;
|
||||
0) exit 0 ;;
|
||||
*) warn "无效选项"; sleep 1 ;;
|
||||
esac
|
||||
done
|
||||
}
|
||||
|
||||
nx_main() {
|
||||
local sub="${1:-}"
|
||||
install_nx_cli
|
||||
load_secrets
|
||||
case "$sub" in
|
||||
""|menu|god|ops|admin)
|
||||
# god/ops 已合并进主菜单，保留别名兼容
|
||||
[[ "$sub" == "god" || "$sub" == "ops" || "$sub" == "admin" ]] && \
|
||||
warn "「上帝菜单」已合并进 nx 主菜单，直接选对应项即可"
|
||||
menu_main
|
||||
;;
|
||||
install) menu_install ;;
|
||||
update|upgrade)
|
||||
require_root
|
||||
shift || true
|
||||
exec bash "${NX_DIR}/update.sh" "$@"
|
||||
;;
|
||||
install-fresh|fresh)
|
||||
require_root
|
||||
exec bash "${NX_DIR}/install-nexus-fresh.sh" "$@"
|
||||
;;
|
||||
install-auto|auto)
|
||||
require_root
|
||||
if is_stack_installed; then
|
||||
warn "已安装，install-auto 将执行升级而非重复安装"
|
||||
exec bash "${NX_DIR}/update.sh"
|
||||
else
|
||||
run_install "${NEXUS_PROFILE:-2c8g}" ""
|
||||
fi
|
||||
;;
|
||||
health)
|
||||
require_root
|
||||
is_stack_installed && ops_status || check_ports_preflight "$NEXUS_ROOT"
|
||||
;;
|
||||
cron)
|
||||
require_root
|
||||
ops_install_cron
|
||||
;;
|
||||
verify)
|
||||
require_root
|
||||
bash "${NX_DIR}/verify-1panel-install-wizard.sh"
|
||||
;;
|
||||
-h|--help)
|
||||
cat <<EOF
|
||||
用法: nx [子命令]
|
||||
|
||||
(无) 统一运维菜单（安装 + 升级 + 重启 + 日志）
|
||||
update 一键更新（等同 bash deploy/update.sh）
|
||||
install-fresh 全新安装（/app/install.html）
|
||||
install-auto 非交互安装（默认 2c8g）
|
||||
health 健康检查
|
||||
cron 安装 health_monitor + db_backup crontab
|
||||
verify 运行 1Panel 验收脚本
|
||||
|
||||
god / ops 已合并进主菜单（兼容别名）
|
||||
|
||||
curl 入口:
|
||||
安装 curl -fsSL .../deploy/quick-install.sh | bash
|
||||
更新 curl -fsSL .../deploy/update.sh | bash
|
||||
EOF
|
||||
;;
|
||||
*)
|
||||
main "$@"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
chmod +x "${NX_DIR}/nx" 2>/dev/null || true
|
||||
nx_main "$@"
|
||||
+40
-128
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
# Nexus Pre-deploy Gate Check (v3 — 8 gates)
|
||||
# 在部署前强制检查 8 道门控，任何一道不过则阻止部署
|
||||
# Nexus Pre-deploy Gate Check (v2 — 7 gates)
|
||||
# 在部署前强制检查 7 道门控，任何一道不过则阻止部署
|
||||
#
|
||||
# 门控1: CHANGELOG — docs/changelog/ 下必须有今天的 .md 文件（且行数≥10）
|
||||
# 门控2: AUDIT — docs/audit/ 下必须有今天的审计记录（且包含关键段落）
|
||||
@@ -9,7 +9,6 @@
|
||||
# 门控5: IMPORT — python -c "import server.main" 成功
|
||||
# 门控6: SECURITY — bandit -r server/ 无 HIGH/MEDIUM
|
||||
# 门控7: REVIEW — 审计文件包含 Closure表+文件清单+DoD，且文件清单与 git diff 交叉验证
|
||||
# 门控8: AI_REVIEW — cursor-agent 审查 HEAD~1..HEAD；缓存 docs/reviews/<head_sha>.json
|
||||
#
|
||||
# 用法: bash deploy/pre_deploy_check.sh
|
||||
# 退出码: 0=全部通过, 1=至少一道门未过
|
||||
@@ -23,22 +22,10 @@ DEPLOY_DIR="${NEXUS_DEPLOY_DIR:-${_REPO_ROOT}}"
|
||||
TODAY=$(date +%Y-%m-%d)
|
||||
TIMESTAMP=$(date -Iseconds)
|
||||
GATES_PASSED=0
|
||||
GATES_TOTAL=8
|
||||
GATES_TOTAL=7
|
||||
BLOCKED=0
|
||||
GATE_RESULTS=""
|
||||
|
||||
# Resolve tool from .venv / venv / PATH
|
||||
_pick_bin() {
|
||||
local name="$1"
|
||||
for p in "${DEPLOY_DIR}/.venv/bin/${name}" "${DEPLOY_DIR}/venv/bin/${name}"; do
|
||||
if [ -x "${p}" ]; then
|
||||
echo "${p}"
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
command -v "${name}" 2>/dev/null || return 1
|
||||
}
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[0;33m'
|
||||
@@ -54,14 +41,14 @@ gate_log() {
|
||||
}
|
||||
|
||||
echo "========================================"
|
||||
echo " Nexus Pre-deploy Gate Check (v3)"
|
||||
echo " Nexus Pre-deploy Gate Check (v2)"
|
||||
echo " Date: ${TODAY}"
|
||||
echo " Gates: ${GATES_TOTAL}"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
|
||||
# ── Gate 1: Changelog (存在 + 行数≥10) ──
|
||||
echo -n "Gate 1/8: Changelog ... "
|
||||
echo -n "Gate 1/7: Changelog ... "
|
||||
CHANGELOG_DIR="${DEPLOY_DIR}/docs/changelog"
|
||||
if ls "${CHANGELOG_DIR}/${TODAY}-"*.md 1>/dev/null 2>&1; then
|
||||
FILE=$(ls -t "${CHANGELOG_DIR}/${TODAY}-"*.md 2>/dev/null | head -1)
|
||||
@@ -87,7 +74,7 @@ else
|
||||
fi
|
||||
|
||||
# ── Gate 2: Audit (存在 + 关键段落) ──
|
||||
echo -n "Gate 2/8: Audit ... "
|
||||
echo -n "Gate 2/7: Audit ... "
|
||||
AUDIT_DIR="${DEPLOY_DIR}/docs/audit"
|
||||
if ls "${AUDIT_DIR}/${TODAY}-"*.md 1>/dev/null 2>&1; then
|
||||
FILE=$(ls -t "${AUDIT_DIR}/${TODAY}-"*.md 2>/dev/null | head -1)
|
||||
@@ -118,7 +105,7 @@ else
|
||||
fi
|
||||
|
||||
# ── Gate 3: Test (必须存在 + 必须通过) ──
|
||||
echo -n "Gate 3/8: Test ... "
|
||||
echo -n "Gate 3/7: Test ... "
|
||||
TEST_SCRIPT="${DEPLOY_DIR}/tests/test_api.py"
|
||||
if [ ! -f "${TEST_SCRIPT}" ]; then
|
||||
echo -e "${RED}BLOCK${NC}"
|
||||
@@ -127,43 +114,15 @@ if [ ! -f "${TEST_SCRIPT}" ]; then
|
||||
BLOCKED=1
|
||||
gate_log "test" "BLOCK" "script not found"
|
||||
else
|
||||
# Always hit local API for gate 3 (ignore shell NEXUS_TEST_BASE used by import/e2e scripts)
|
||||
TEST_OUTPUT=$(cd "${DEPLOY_DIR}" && env -u NEXUS_TEST_BASE NEXUS_TEST_BASE=http://127.0.0.1:8600 python3 "${TEST_SCRIPT}" 2>&1) || true
|
||||
TEST_OUTPUT=$(cd "${DEPLOY_DIR}" && python3 "${TEST_SCRIPT}" 2>&1) || true
|
||||
FAIL_COUNT=$(echo "${TEST_OUTPUT}" | grep -cE "^\s+\[FAIL\]" 2>/dev/null || true)
|
||||
FAIL_COUNT=${FAIL_COUNT:-0}
|
||||
GATE3_PASSED=0
|
||||
if [ "${FAIL_COUNT}" -gt 0 ] || echo "${TEST_OUTPUT}" | grep -qE "[0-9]+ test(s) failed"; then
|
||||
# 本机未起 :8600 时，若失败均为 Connection refused，回退 pytest 专项
|
||||
NON_CONN_FAILS=$(echo "${TEST_OUTPUT}" | grep -E "^\s+\[FAIL\]" | grep -vcE "Connection refused|Errno 111" 2>/dev/null || true)
|
||||
NON_CONN_FAILS=${NON_CONN_FAILS:-0}
|
||||
if [ "${FAIL_COUNT}" -gt 0 ] && [ "${NON_CONN_FAILS}" -eq 0 ]; then
|
||||
PYTEST_BIN=$(_pick_bin pytest || true)
|
||||
FALLBACK_TESTS="tests/test_btpanel_ssh_bootstrap.py tests/test_terminal_quick_commands.py tests/test_gate_ai_review.py"
|
||||
if [ -n "${PYTEST_BIN}" ]; then
|
||||
echo -e "${YELLOW}fallback${NC}"
|
||||
echo " └─ Local :8600 unreachable — running pytest gate batch"
|
||||
FALLBACK_OUTPUT=$(cd "${DEPLOY_DIR}" && "${PYTEST_BIN}" ${FALLBACK_TESTS} -q 2>&1) || FALLBACK_RC=$?
|
||||
FALLBACK_RC=${FALLBACK_RC:-0}
|
||||
if [ "${FALLBACK_RC}" -eq 0 ]; then
|
||||
echo -e " └─ ${GREEN}PASS${NC} (pytest fallback)"
|
||||
GATES_PASSED=$((GATES_PASSED + 1))
|
||||
gate_log "test" "PASS" "pytest fallback :8600 down"
|
||||
GATE3_PASSED=1
|
||||
else
|
||||
echo -e " └─ ${RED}BLOCK${NC} pytest fallback failed:"
|
||||
echo "${FALLBACK_OUTPUT}" | tail -15 | sed 's/^/ │ /'
|
||||
BLOCKED=1
|
||||
gate_log "test" "BLOCK" "pytest fallback failed"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
if [ "${GATE3_PASSED}" -eq 0 ]; then
|
||||
echo -e "${RED}BLOCK${NC}"
|
||||
echo " └─ Tests failed. Output:"
|
||||
echo "${TEST_OUTPUT}" | head -20 | sed 's/^/ │ /'
|
||||
BLOCKED=1
|
||||
gate_log "test" "BLOCK" "tests failed"
|
||||
fi
|
||||
echo -e "${RED}BLOCK${NC}"
|
||||
echo " └─ Tests failed. Output:"
|
||||
echo "${TEST_OUTPUT}" | head -20 | sed 's/^/ │ /'
|
||||
BLOCKED=1
|
||||
gate_log "test" "BLOCK" "tests failed"
|
||||
else
|
||||
echo -e "${GREEN}PASS${NC}"
|
||||
echo " └─ All tests passed"
|
||||
@@ -173,10 +132,11 @@ else
|
||||
fi
|
||||
|
||||
# ── Gate 4: Lint (ruff — F only: undefined names, unused imports) ──
|
||||
echo -n "Gate 4/8: Lint ... "
|
||||
RUFF_BIN=$(_pick_bin ruff || true)
|
||||
if [ -n "${RUFF_BIN}" ]; then
|
||||
LINT_OUTPUT=$(cd "${DEPLOY_DIR}" && "${RUFF_BIN}" check server/ --select F 2>&1) || true
|
||||
echo -n "Gate 4/7: Lint ... "
|
||||
if command -v ruff &>/dev/null; then
|
||||
# 只检查 F (pyflakes) — 真正的BUG：未定义名称、未使用导入
|
||||
# S/B 问题由 Security 门扫描但不阻断部署
|
||||
LINT_OUTPUT=$(cd "${DEPLOY_DIR}" && ruff check server/ --select F 2>&1) || true
|
||||
LINT_COUNT=$(echo "${LINT_OUTPUT}" | grep -cE "^server/" 2>/dev/null || true)
|
||||
LINT_COUNT=$(echo "${LINT_COUNT}" | head -1 | tr -d '[:space:]')
|
||||
LINT_COUNT=${LINT_COUNT:-0}
|
||||
@@ -193,22 +153,19 @@ if [ -n "${RUFF_BIN}" ]; then
|
||||
gate_log "lint" "BLOCK" "${LINT_COUNT} violations"
|
||||
fi
|
||||
else
|
||||
echo -e "${RED}BLOCK${NC}"
|
||||
echo " └─ ruff not found (.venv/bin/ruff or pip install ruff)"
|
||||
BLOCKED=1
|
||||
gate_log "lint" "BLOCK" "ruff not found"
|
||||
echo -e "${YELLOW}SKIP${NC}"
|
||||
echo " └─ ruff not installed (pip install ruff)"
|
||||
GATES_PASSED=$((GATES_PASSED + 1))
|
||||
gate_log "lint" "SKIP" "ruff not installed"
|
||||
fi
|
||||
|
||||
# ── Gate 5: Import (python -c "import server.main") ──
|
||||
echo -n "Gate 5/8: Import ... "
|
||||
IMPORT_PYTHON=""
|
||||
for p in "${DEPLOY_DIR}/.venv/bin/python3" "${DEPLOY_DIR}/venv/bin/python3"; do
|
||||
if [ -x "${p}" ]; then
|
||||
IMPORT_PYTHON="${p}"
|
||||
break
|
||||
fi
|
||||
done
|
||||
if [ -z "${IMPORT_PYTHON}" ]; then
|
||||
echo -n "Gate 5/7: Import ... "
|
||||
# 优先使用 venv python，回退到系统 python
|
||||
VENV_PYTHON="${DEPLOY_DIR}/venv/bin/python3"
|
||||
if [ -x "${VENV_PYTHON}" ]; then
|
||||
IMPORT_PYTHON="${VENV_PYTHON}"
|
||||
else
|
||||
IMPORT_PYTHON="python3"
|
||||
fi
|
||||
IMPORT_OUTPUT=$(cd "${DEPLOY_DIR}" && "${IMPORT_PYTHON}" -c "import server.main" 2>&1) && IMPORT_OK=1 || IMPORT_OK=0
|
||||
@@ -235,10 +192,10 @@ else
|
||||
fi
|
||||
|
||||
# ── Gate 6: Security (bandit — HIGH only) ──
|
||||
echo -n "Gate 6/8: Security ... "
|
||||
BANDIT_BIN=$(_pick_bin bandit || true)
|
||||
if [ -n "${BANDIT_BIN}" ]; then
|
||||
SEC_OUTPUT=$(cd "${DEPLOY_DIR}" && "${BANDIT_BIN}" -r server/ -f txt -ll 2>&1) || true
|
||||
echo -n "Gate 6/7: Security ... "
|
||||
if command -v bandit &>/dev/null; then
|
||||
# 只阻断 HIGH severity，MEDIUM/LOW 由 ruff S 规则覆盖
|
||||
SEC_OUTPUT=$(cd "${DEPLOY_DIR}" && bandit -r server/ -f txt -ll 2>&1) || true
|
||||
HIGH_COUNT=$(echo "${SEC_OUTPUT}" | grep -cE "Severity: High" 2>/dev/null || true)
|
||||
HIGH_COUNT=$(echo "${HIGH_COUNT}" | head -1 | tr -d '[:space:]')
|
||||
HIGH_COUNT=${HIGH_COUNT:-0}
|
||||
@@ -255,25 +212,25 @@ if [ -n "${BANDIT_BIN}" ]; then
|
||||
gate_log "security" "BLOCK" "${HIGH_COUNT} HIGH findings"
|
||||
fi
|
||||
else
|
||||
echo -e "${RED}BLOCK${NC}"
|
||||
echo " └─ bandit not found (.venv/bin/bandit or pip install bandit)"
|
||||
BLOCKED=1
|
||||
gate_log "security" "BLOCK" "bandit not found"
|
||||
echo -e "${YELLOW}SKIP${NC}"
|
||||
echo " └─ bandit not installed (pip install bandit)"
|
||||
GATES_PASSED=$((GATES_PASSED + 1))
|
||||
gate_log "security" "SKIP" "bandit not installed"
|
||||
fi
|
||||
|
||||
# ── Gate 7: Review (审计文件交叉验证) ──
|
||||
echo -n "Gate 7/8: Review ... "
|
||||
echo -n "Gate 7/7: Review ... "
|
||||
if ls "${AUDIT_DIR}/${TODAY}-"*.md 1>/dev/null 2>&1; then
|
||||
FILE=$(ls -t "${AUDIT_DIR}/${TODAY}-"*.md 2>/dev/null | head -1)
|
||||
# 检查审计文件中是否列出了实际改动的文件
|
||||
REVIEW_OK=1
|
||||
# 如果是git仓库，交叉验证改动文件
|
||||
if command -v git &>/dev/null && [ -d "${DEPLOY_DIR}/.git" ]; then
|
||||
CHANGED_FILES=$(cd "${DEPLOY_DIR}" && git diff --name-only HEAD~1..HEAD 2>/dev/null || true)
|
||||
CHANGED_FILES=$(cd "${DEPLOY_DIR}" && git diff --name-only HEAD~1 2>/dev/null || true)
|
||||
for CF in ${CHANGED_FILES}; do
|
||||
# 跳过非代码文件与门控运行日志
|
||||
# 跳过非代码文件
|
||||
case "${CF}" in
|
||||
docs/*|CLAUDE.md|*.md|deploy/gate_log.jsonl|web/app/assets/*) continue ;;
|
||||
docs/*|CLAUDE.md|*.md) continue ;;
|
||||
esac
|
||||
# 检查审计文件是否提到了这个文件
|
||||
if ! grep -q "$(basename "${CF}")" "${FILE}" 2>/dev/null; then
|
||||
@@ -301,51 +258,6 @@ else
|
||||
gate_log "review" "BLOCK" "no audit file"
|
||||
fi
|
||||
|
||||
# ── Gate 8: AI Review (cursor-agent + docs/reviews cache) ──
|
||||
echo -n "Gate 8/8: AI Review ... "
|
||||
AI_REVIEW_OUT=$(cd "${DEPLOY_DIR}" && python3 "${DEPLOY_DIR}/scripts/gate_ai_review.py" 2>&1) || AI_REVIEW_RC=$?
|
||||
AI_REVIEW_RC=${AI_REVIEW_RC:-0}
|
||||
if [ "${AI_REVIEW_RC}" -eq 0 ]; then
|
||||
echo -e "${GREEN}PASS${NC}"
|
||||
echo "${AI_REVIEW_OUT}" | sed 's/^/ └─ /' | head -5
|
||||
GATES_PASSED=$((GATES_PASSED + 1))
|
||||
if echo "${AI_REVIEW_OUT}" | grep -qi "skip"; then
|
||||
gate_log "ai_review" "PASS" "skipped no code"
|
||||
else
|
||||
gate_log "ai_review" "PASS" "ok"
|
||||
fi
|
||||
else
|
||||
echo -e "${RED}BLOCK${NC}"
|
||||
echo "${AI_REVIEW_OUT}" | sed 's/^/ │ /' | head -12
|
||||
BLOCKED=1
|
||||
gate_log "ai_review" "BLOCK" "see gate_ai_review.py output"
|
||||
fi
|
||||
|
||||
# ── Pre-flight: shell scripts LF ──
|
||||
echo -n "Pre-flight: Shell EOL (LF) ... "
|
||||
if bash "${DEPLOY_DIR}/deploy/check_shell_eol.sh" >/dev/null 2>&1; then
|
||||
echo -e "${GREEN}PASS${NC}"
|
||||
gate_log "shell_eol" "PASS" "all tracked sh LF"
|
||||
else
|
||||
echo -e "${RED}BLOCK${NC}"
|
||||
echo " └─ Run: bash deploy/check_shell_eol.sh"
|
||||
echo " └─ Fix: git add --renormalize '*.sh'"
|
||||
BLOCKED=1
|
||||
gate_log "shell_eol" "BLOCK" "CR in tracked sh"
|
||||
fi
|
||||
|
||||
# ── Pre-flight: deploy-critical paths LF in git index ──
|
||||
echo -n "Pre-flight: Text EOL (git index) ... "
|
||||
if python3 "${DEPLOY_DIR}/scripts/check_text_eol.py" >/dev/null 2>&1; then
|
||||
echo -e "${GREEN}PASS${NC}"
|
||||
gate_log "text_eol" "PASS" "git index LF"
|
||||
else
|
||||
echo -e "${RED}BLOCK${NC}"
|
||||
echo " └─ Run: python3 scripts/check_text_eol.py --fix-hint"
|
||||
BLOCKED=1
|
||||
gate_log "text_eol" "BLOCK" "CR in git index"
|
||||
fi
|
||||
|
||||
# ── Summary ──
|
||||
echo ""
|
||||
echo "========================================"
|
||||
|
||||
@@ -1,197 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Nexus production host preflight before applying a release tarball.
|
||||
#
|
||||
# Usage:
|
||||
# bash deploy/preflight-release-host.sh \
|
||||
# --tarball /tmp/nexus-release-20260708.tar.gz \
|
||||
# --sha256 a4eb8f35f0b98d40c1ad83117bfc652e7686ffc7d55f6bf90fcfd433a2ad6701 \
|
||||
# --deploy-path /opt/nexus
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
TARBALL=""
|
||||
EXPECTED_SHA256=""
|
||||
DEPLOY_PATH="${NEXUS_DEPLOY_PATH:-/opt/nexus}"
|
||||
MIN_FREE_MB="${NEXUS_RELEASE_MIN_FREE_MB:-1024}"
|
||||
|
||||
info() { echo -e "\033[0;32m[INFO]\033[0m $*"; }
|
||||
warn() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
|
||||
error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
|
||||
|
||||
usage() {
|
||||
sed -n '1,12p' "$0"
|
||||
}
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--tarball)
|
||||
TARBALL="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--sha256)
|
||||
EXPECTED_SHA256="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--deploy-path)
|
||||
DEPLOY_PATH="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--min-free-mb)
|
||||
MIN_FREE_MB="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
-h|--help)
|
||||
usage
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
error "Unknown argument: $1"
|
||||
usage
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
check_cmd() {
|
||||
local cmd="$1"
|
||||
if command -v "$cmd" >/dev/null 2>&1; then
|
||||
info "command OK: $cmd"
|
||||
return 0
|
||||
fi
|
||||
error "missing command: $cmd"
|
||||
return 1
|
||||
}
|
||||
|
||||
docker_cmd() {
|
||||
if docker "$@" 2>/dev/null; then return 0; fi
|
||||
sudo docker "$@" 2>/dev/null
|
||||
}
|
||||
|
||||
detect_runtime() {
|
||||
if [[ -f "${DEPLOY_PATH}/docker/.env.prod" ]] && command -v docker >/dev/null 2>&1; then
|
||||
echo docker
|
||||
return
|
||||
fi
|
||||
if command -v supervisorctl >/dev/null 2>&1 && supervisorctl status nexus >/dev/null 2>&1; then
|
||||
echo supervisor
|
||||
return
|
||||
fi
|
||||
echo unknown
|
||||
}
|
||||
|
||||
verify_tarball() {
|
||||
if [[ -z "$TARBALL" ]]; then
|
||||
warn "--tarball not provided; skipping tarball checksum/content checks"
|
||||
return 0
|
||||
fi
|
||||
[[ -f "$TARBALL" ]] || {
|
||||
error "tarball not found: $TARBALL"
|
||||
return 1
|
||||
}
|
||||
info "tarball exists: $TARBALL"
|
||||
if [[ -n "$EXPECTED_SHA256" ]]; then
|
||||
local actual
|
||||
actual="$(sha256sum "$TARBALL" | awk '{print $1}')"
|
||||
if [[ "$actual" != "$EXPECTED_SHA256" ]]; then
|
||||
error "SHA256 mismatch: expected=$EXPECTED_SHA256 actual=$actual"
|
||||
return 1
|
||||
fi
|
||||
info "SHA256 OK: $actual"
|
||||
else
|
||||
warn "--sha256 not provided; checksum not verified"
|
||||
fi
|
||||
tar tzf "$TARBALL" nexus-release/server nexus-release/deploy nexus-release/web/app-v2 >/dev/null
|
||||
info "tarball required paths OK"
|
||||
}
|
||||
|
||||
check_deploy_path() {
|
||||
if [[ -d "$DEPLOY_PATH" ]]; then
|
||||
info "deploy path exists: $DEPLOY_PATH"
|
||||
else
|
||||
warn "deploy path does not exist yet: $DEPLOY_PATH"
|
||||
fi
|
||||
if [[ -f "${DEPLOY_PATH}/.env" ]]; then
|
||||
info "runtime .env preserved path exists"
|
||||
else
|
||||
warn "${DEPLOY_PATH}/.env not found"
|
||||
fi
|
||||
if [[ -f "${DEPLOY_PATH}/docker/.env.prod" ]]; then
|
||||
info "docker/.env.prod exists"
|
||||
else
|
||||
warn "${DEPLOY_PATH}/docker/.env.prod not found"
|
||||
fi
|
||||
if [[ -d "${DEPLOY_PATH}/web/data" ]]; then
|
||||
info "web/data exists"
|
||||
else
|
||||
warn "${DEPLOY_PATH}/web/data not found"
|
||||
fi
|
||||
}
|
||||
|
||||
check_disk_space() {
|
||||
local target free_mb
|
||||
target="$DEPLOY_PATH"
|
||||
[[ -e "$target" ]] || target="$(dirname "$DEPLOY_PATH")"
|
||||
free_mb="$(df -Pm "$target" | awk 'NR==2 {print $4}')"
|
||||
if [[ -z "$free_mb" ]]; then
|
||||
warn "unable to determine free disk space for $target"
|
||||
return 0
|
||||
fi
|
||||
if (( free_mb < MIN_FREE_MB )); then
|
||||
error "low disk space on $target: ${free_mb}MB < ${MIN_FREE_MB}MB"
|
||||
return 1
|
||||
fi
|
||||
info "disk free OK: ${free_mb}MB >= ${MIN_FREE_MB}MB"
|
||||
}
|
||||
|
||||
check_runtime() {
|
||||
local runtime
|
||||
runtime="$(detect_runtime)"
|
||||
info "runtime detected: $runtime"
|
||||
case "$runtime" in
|
||||
docker)
|
||||
docker_cmd ps --format '{{.Names}}' | grep -E 'nexus-prod-nexus|nexus-nexus-1' >/dev/null \
|
||||
&& info "Nexus docker container found" \
|
||||
|| warn "Nexus docker container not found by known name pattern"
|
||||
;;
|
||||
supervisor)
|
||||
supervisorctl status nexus || true
|
||||
;;
|
||||
*)
|
||||
warn "runtime unknown; apply script may require manual restart"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
check_local_endpoint() {
|
||||
local port health app app_v2
|
||||
port="$(grep -E '^NEXUS_PUBLISH_PORT=' "${DEPLOY_PATH}/docker/.env.prod" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r" ' || true)"
|
||||
port="${port:-8600}"
|
||||
health="$(curl -s "http://127.0.0.1:${port}/health" 2>/dev/null || true)"
|
||||
app="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app/" 2>/dev/null || echo 000)"
|
||||
app_v2="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app-v2/" 2>/dev/null || echo 000)"
|
||||
echo " current /health -> ${health:-<empty>}"
|
||||
echo " current /app/ -> ${app}"
|
||||
echo " current /app-v2/ -> ${app_v2}"
|
||||
}
|
||||
|
||||
main() {
|
||||
local failures=0
|
||||
for cmd in tar sha256sum df awk grep sed curl; do
|
||||
check_cmd "$cmd" || failures=$((failures + 1))
|
||||
done
|
||||
check_cmd rsync || failures=$((failures + 1))
|
||||
|
||||
verify_tarball || failures=$((failures + 1))
|
||||
check_deploy_path
|
||||
check_disk_space || failures=$((failures + 1))
|
||||
check_runtime
|
||||
check_local_endpoint
|
||||
|
||||
if (( failures > 0 )); then
|
||||
error "preflight failed: ${failures} blocking issue(s)"
|
||||
return 1
|
||||
fi
|
||||
info "preflight OK"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -3,15 +3,11 @@
|
||||
|
||||
Vite/Rolldown minified bundles reference chunks by bare filename (e.g. ServersPage-xxx.js)
|
||||
without import() paths — scan file contents for known asset basenames.
|
||||
|
||||
Orphans newer than --retention-days are kept so long-lived browser tabs can still load
|
||||
their lazy chunks after a deploy (see docs/design/specs/2026-06-02-keep-session-no-refresh-design.md).
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import re
|
||||
import sys
|
||||
import time
|
||||
from pathlib import Path
|
||||
|
||||
# Leading `_` required for Vite chunks like `_plugin-vue_export-helper-*.js`
|
||||
@@ -19,35 +15,6 @@ ASSET_NAME_RE = re.compile(
|
||||
r"[_A-Za-z0-9][A-Za-z0-9_.-]*\.(?:js|css|woff2?|ttf|eot)"
|
||||
)
|
||||
URL_RE = re.compile(r"""url\(["']?([^"')]+)["']?\)""")
|
||||
DEFAULT_RETENTION_DAYS = 14
|
||||
|
||||
|
||||
def _parse_args(argv: list[str]) -> tuple[bool, int, Path]:
|
||||
dry_run = "--dry-run" in argv
|
||||
retention_days = DEFAULT_RETENTION_DAYS
|
||||
positional: list[str] = []
|
||||
i = 0
|
||||
while i < len(argv):
|
||||
arg = argv[i]
|
||||
if arg == "--dry-run":
|
||||
i += 1
|
||||
continue
|
||||
if arg.startswith("--retention-days="):
|
||||
retention_days = int(arg.split("=", 1)[1])
|
||||
i += 1
|
||||
continue
|
||||
if arg == "--retention-days":
|
||||
if i + 1 >= len(argv):
|
||||
raise SystemExit("--retention-days requires a value")
|
||||
retention_days = int(argv[i + 1])
|
||||
i += 2
|
||||
continue
|
||||
positional.append(arg)
|
||||
i += 1
|
||||
if retention_days < 0:
|
||||
raise SystemExit("--retention-days must be >= 0")
|
||||
app_dir = Path(positional[0] if positional else "/www/wwwroot/api.synaglobal.vip/web/app")
|
||||
return dry_run, retention_days, app_dir
|
||||
|
||||
|
||||
def _referenced_basenames(text: str, known: set[str]) -> set[str]:
|
||||
@@ -96,26 +63,10 @@ def collect(app_dir: Path) -> set[Path]:
|
||||
return {assets / n for n in keep_names}
|
||||
|
||||
|
||||
def _partition_orphans(
|
||||
orphan: list[Path],
|
||||
retention_days: int,
|
||||
) -> tuple[list[Path], list[Path]]:
|
||||
"""Split orphans into delete-now vs keep-for-open-tabs (mtime within window)."""
|
||||
if retention_days <= 0:
|
||||
return orphan, []
|
||||
cutoff = time.time() - retention_days * 86400
|
||||
to_remove: list[Path] = []
|
||||
retained: list[Path] = []
|
||||
for p in orphan:
|
||||
if p.stat().st_mtime >= cutoff:
|
||||
retained.append(p)
|
||||
else:
|
||||
to_remove.append(p)
|
||||
return to_remove, retained
|
||||
|
||||
|
||||
def main() -> int:
|
||||
dry_run, retention_days, app_dir = _parse_args(sys.argv[1:])
|
||||
dry_run = "--dry-run" in sys.argv
|
||||
args = [a for a in sys.argv[1:] if a != "--dry-run"]
|
||||
app_dir = Path(args[0] if args else "/www/wwwroot/api.synaglobal.vip/web/app")
|
||||
assets = app_dir / "assets"
|
||||
if not assets.is_dir():
|
||||
raise SystemExit(f"not a directory: {assets}")
|
||||
@@ -123,25 +74,12 @@ def main() -> int:
|
||||
keep = collect(app_dir)
|
||||
all_files = {p for p in assets.iterdir() if p.is_file()}
|
||||
orphan = sorted(all_files - keep, key=lambda p: p.name)
|
||||
to_remove, retained = _partition_orphans(orphan, retention_days)
|
||||
|
||||
if dry_run:
|
||||
print(
|
||||
f"dry-run retention_days={retention_days} "
|
||||
f"referenced_kept={len(keep)} "
|
||||
f"would_remove={len(to_remove)} "
|
||||
f"retained_orphans={len(retained)} "
|
||||
f"total={len(all_files)}"
|
||||
)
|
||||
print(f"dry-run kept={len(keep)} would_remove={len(orphan)} total={len(all_files)}")
|
||||
return 0
|
||||
|
||||
for p in to_remove:
|
||||
for p in orphan:
|
||||
p.unlink()
|
||||
print(
|
||||
f"kept={len(keep)} removed={len(to_remove)} "
|
||||
f"retained_orphans={len(retained)} retention_days={retention_days} "
|
||||
f"total_before={len(all_files)}"
|
||||
)
|
||||
print(f"kept={len(keep)} removed={len(orphan)} total_before={len(all_files)}")
|
||||
return 0
|
||||
|
||||
|
||||
|
||||
@@ -1,124 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# =============================================================================
|
||||
# Nexus 6.0 — 公共仓库一键安装入口（参考 1Panel quick_start.sh）
|
||||
#
|
||||
# root 登录后一条命令:
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
|
||||
#
|
||||
# 或保存后执行:
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" -o /tmp/quick-install.sh
|
||||
# bash /tmp/quick-install.sh
|
||||
#
|
||||
# 可选参数会传给 install-nexus-fresh.sh，例如:
|
||||
# bash /tmp/quick-install.sh --profile 4c16g
|
||||
# =============================================================================
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
|
||||
NEXUS_GITEA_REPO="${NEXUS_GITEA_REPO:-admin/Nexus.git}"
|
||||
NEXUS_GIT_BRANCH="${NEXUS_GIT_BRANCH:-main}"
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/branch/${NEXUS_GIT_BRANCH}}"
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
CYAN='\033[0;36m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m'
|
||||
|
||||
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
|
||||
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
|
||||
step() { echo -e "${CYAN}[STEP]${NC} $*"; }
|
||||
|
||||
usage() {
|
||||
cat <<EOF
|
||||
Nexus 公共仓库一键安装
|
||||
|
||||
curl -fsSL "${NEXUS_RAW_BASE}/deploy/quick-install.sh" | bash
|
||||
|
||||
可选参数: --profile 4c16g --domain 你的域名 --skip-1panel-check
|
||||
EOF
|
||||
}
|
||||
|
||||
validate_script_file() {
|
||||
local f="$1"
|
||||
if [[ ! -f "$f" ]] || ! head -1 "$f" | grep -q '^#!/'; then
|
||||
return 1
|
||||
fi
|
||||
if grep -qiE '^(Not found|404)' "$f" 2>/dev/null; then
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
download_script() {
|
||||
local name="$1" dest="$2"
|
||||
local url base
|
||||
for base in \
|
||||
"${NEXUS_RAW_BASE}" \
|
||||
"http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/${NEXUS_GIT_BRANCH}"; do
|
||||
url="${base}/deploy/${name}"
|
||||
if curl -fsSL "$url" -o "$dest" 2>/dev/null && validate_script_file "$dest"; then
|
||||
info "已下载 ${name}"
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
run_via_git() {
|
||||
local url="http://${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
|
||||
if [[ -n "${NEXUS_GITEA_TOKEN:-}" ]]; then
|
||||
url="http://admin:${NEXUS_GITEA_TOKEN}@${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
|
||||
fi
|
||||
step "改用 git clone..."
|
||||
mkdir -p "$(dirname "$NEXUS_ROOT")"
|
||||
if [[ -d "${NEXUS_ROOT}/.git" ]]; then
|
||||
git -C "$NEXUS_ROOT" remote set-url origin "$url" 2>/dev/null || true
|
||||
git -C "$NEXUS_ROOT" fetch origin "$NEXUS_GIT_BRANCH" --depth 1 2>/dev/null || \
|
||||
git -C "$NEXUS_ROOT" fetch origin "$NEXUS_GIT_BRANCH" --prune
|
||||
git -C "$NEXUS_ROOT" reset --hard "origin/${NEXUS_GIT_BRANCH}" 2>/dev/null || \
|
||||
git -C "$NEXUS_ROOT" pull
|
||||
else
|
||||
rm -rf "$NEXUS_ROOT"
|
||||
git clone --depth 1 -b "$NEXUS_GIT_BRANCH" "$url" "$NEXUS_ROOT"
|
||||
fi
|
||||
chmod +x "${NEXUS_ROOT}/deploy/"*.sh 2>/dev/null || true
|
||||
exec bash "${NEXUS_ROOT}/deploy/install-nexus-fresh.sh" --skip-clone "$@"
|
||||
}
|
||||
|
||||
main() {
|
||||
if [[ "$(id -u)" -ne 0 ]]; then
|
||||
error "请使用 root 执行（su - 后直接运行，不要用 sudo 包一层）"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
for cf in /root/.nexus-deploy.env /root/.nexus-secrets/nexus.env; do
|
||||
[[ -f "$cf" ]] && set -a && source "$cf" && set +a
|
||||
done
|
||||
unset NEXUS_SECRET_KEY NEXUS_API_KEY NEXUS_ENCRYPTION_KEY
|
||||
|
||||
echo ""
|
||||
echo -e "${BLUE}╔══════════════════════════════════════════════════════════════╗${NC}"
|
||||
echo -e "${BLUE}║${NC} Nexus 6.0 — 公共仓库一键安装 ${BLUE}║${NC}"
|
||||
echo -e "${BLUE}╚══════════════════════════════════════════════════════════════╝${NC}"
|
||||
echo ""
|
||||
|
||||
case "${1:-}" in
|
||||
-h|--help) usage; exit 0 ;;
|
||||
esac
|
||||
|
||||
local tmp
|
||||
tmp="$(mktemp /tmp/install-nexus-fresh.XXXXXX.sh)"
|
||||
if download_script "install-nexus-fresh.sh" "$tmp"; then
|
||||
chmod +x "$tmp"
|
||||
exec bash "$tmp" "$@"
|
||||
fi
|
||||
|
||||
step "raw 下载失败，尝试 git clone..."
|
||||
run_via_git "$@"
|
||||
}
|
||||
|
||||
# curl | bash 时 stdin 脚本无 BASH_SOURCE[0]，不可配合 set -u 做入口判断
|
||||
main "$@"
|
||||
@@ -1,112 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Sync local Nexus working tree to production host (no Gitea push/pull).
|
||||
# Transfer via tar|ssh; remote ownership auto-detected (www:www on BT, else deploy path owner).
|
||||
#
|
||||
# Usage:
|
||||
# bash deploy/rsync-local-to-server.sh
|
||||
# NEXUS_DEPLOY_PATH=/opt/nexus bash deploy/rsync-local-to-server.sh
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
cd "${ROOT}"
|
||||
|
||||
SECRETS="${ROOT}/deploy/nexus-1panel.secrets.sh"
|
||||
if [[ -f "$SECRETS" ]]; then
|
||||
# shellcheck disable=SC1090
|
||||
source "$SECRETS"
|
||||
fi
|
||||
|
||||
NEXUS_SSH_HOST="${NEXUS_SSH:-nexus}"
|
||||
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=15)
|
||||
if [[ -n "${NEXUS_SSH_KEY:-}" ]]; then
|
||||
SSH_OPTS+=(-i "${NEXUS_SSH_KEY}")
|
||||
fi
|
||||
ssh_cmd() { ssh "${SSH_OPTS[@]}" "${NEXUS_SSH_HOST}" "$@"; }
|
||||
|
||||
if ! ssh_cmd "echo SSH OK" >/dev/null 2>&1; then
|
||||
echo "ERROR: Cannot SSH to ${NEXUS_SSH_HOST}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
DEPLOY_PATH="${NEXUS_DEPLOY_PATH:-}"
|
||||
if [[ -z "$DEPLOY_PATH" ]]; then
|
||||
DEPLOY_PATH="$(ssh_cmd 'for d in /opt/nexus /www/wwwroot/api.synaglobal.vip; do [[ -d "$d/server" ]] && echo "$d" && exit 0; done; echo /opt/nexus')"
|
||||
fi
|
||||
|
||||
resolve_deploy_chown() {
|
||||
if [[ -n "${NEXUS_DEPLOY_CHOWN:-}" ]]; then
|
||||
echo "${NEXUS_DEPLOY_CHOWN}"
|
||||
return
|
||||
fi
|
||||
if ssh_cmd "getent passwd www >/dev/null 2>&1"; then
|
||||
echo "www:www"
|
||||
return
|
||||
fi
|
||||
ssh_cmd "stat -c '%U:%G' '${DEPLOY_PATH}'" 2>/dev/null || echo "azureuser:azureuser"
|
||||
}
|
||||
DEPLOY_CHOWN="$(resolve_deploy_chown)"
|
||||
|
||||
echo "═══ Nexus local → server sync ═══"
|
||||
echo "SSH target: ${NEXUS_SSH_HOST}"
|
||||
echo "Remote path: ${DEPLOY_PATH}"
|
||||
echo "Owner: ${DEPLOY_CHOWN}"
|
||||
|
||||
TAR_EXCLUDES=(
|
||||
--exclude='.git'
|
||||
--exclude='.env'
|
||||
--exclude='.env.*'
|
||||
--exclude='SECRETS.md'
|
||||
--exclude='deploy/nexus-1panel.secrets.sh'
|
||||
--exclude='docker/.env.prod'
|
||||
--exclude='web/data'
|
||||
--exclude='frontend/node_modules'
|
||||
--exclude='frontend-v2/node_modules'
|
||||
--exclude='node_modules'
|
||||
--exclude='.venv'
|
||||
--exclude='.venv-*'
|
||||
--exclude='venv'
|
||||
--exclude='__pycache__'
|
||||
--exclude='.pytest_cache'
|
||||
--exclude='.ruff_cache'
|
||||
--exclude='.cursor'
|
||||
--exclude='.playwright-mcp'
|
||||
--exclude='.install_locked'
|
||||
--exclude='.install_state.json'
|
||||
--exclude='web/app/assets'
|
||||
--exclude='tmp'
|
||||
--exclude='2025.2'
|
||||
--exclude='=2025.2'
|
||||
--exclude='*.bak-'
|
||||
--exclude='frontend/test-results'
|
||||
--exclude='frontend/e2e/.auth'
|
||||
)
|
||||
|
||||
echo "▶ tar stream → ${DEPLOY_PATH} ..."
|
||||
tar -C "${ROOT}" -czf - "${TAR_EXCLUDES[@]}" . | \
|
||||
ssh "${SSH_OPTS[@]}" "${NEXUS_SSH_HOST}" "sudo tar -xzf - -C '${DEPLOY_PATH}'"
|
||||
|
||||
echo "▶ chown ${DEPLOY_CHOWN} (skip docker/.env.prod, web/data, .env) ..."
|
||||
ssh_cmd "sudo bash -s" <<REMOTE
|
||||
set -euo pipefail
|
||||
root='${DEPLOY_PATH}'
|
||||
own='${DEPLOY_CHOWN}'
|
||||
chown_tree() {
|
||||
local p="\$1"
|
||||
[[ -e "\$p" ]] || return 0
|
||||
sudo chown -R "\$own" "\$p"
|
||||
}
|
||||
for top in server deploy scripts tests standards docs frontend web; do
|
||||
chown_tree "\$root/\$top"
|
||||
done
|
||||
if [[ -d "\$root/docker" ]]; then
|
||||
while IFS= read -r -d '' p; do
|
||||
sudo chown -R "\$own" "\$p"
|
||||
done < <(find "\$root/docker" \( -path "\$root/docker/.env.prod" \) -prune -o -print0)
|
||||
fi
|
||||
for f in pyproject.toml requirements.txt requirements-dev.txt AGENTS.md CLAUDE.md; do
|
||||
[[ -f "\$root/\$f" ]] && sudo chown "\$own" "\$root/\$f"
|
||||
done
|
||||
REMOTE
|
||||
|
||||
echo "✓ sync complete (owner ${DEPLOY_CHOWN})"
|
||||
@@ -1,96 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Sync install wizard static files into the running Nexus prod container.
|
||||
# Primary fix: Dockerfile.prod bakes these into the image on build.
|
||||
# This script is a safety net after upgrade if an old image is still running.
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
NEXUS_PUBLISH_PORT="${NEXUS_PUBLISH_PORT:-8600}"
|
||||
CONTAINER="${NEXUS_CONTAINER:-}"
|
||||
|
||||
info() { echo -e "\033[0;32m[INFO]\033[0m $*"; }
|
||||
warn() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
|
||||
error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
|
||||
|
||||
resolve_container() {
|
||||
if [[ -n "$CONTAINER" ]]; then
|
||||
return 0
|
||||
fi
|
||||
CONTAINER="$(docker ps --format '{{.Names}}' | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true)"
|
||||
if [[ -z "$CONTAINER" ]]; then
|
||||
error "未找到运行中的 Nexus 容器（可设 NEXUS_CONTAINER=名称）"
|
||||
exit 1
|
||||
fi
|
||||
info "容器: $CONTAINER"
|
||||
}
|
||||
|
||||
sync_file() {
|
||||
local src="$1" dest="$2"
|
||||
if [[ ! -f "$src" ]]; then
|
||||
error "缺少源文件: $src"
|
||||
exit 1
|
||||
fi
|
||||
docker exec "$CONTAINER" mkdir -p "$(dirname "$dest")"
|
||||
docker cp "$src" "${CONTAINER}:${dest}"
|
||||
}
|
||||
|
||||
wizard_archived_in_container() {
|
||||
docker exec "$CONTAINER" test -f /app/.install_locked 2>/dev/null \
|
||||
|| docker exec "$CONTAINER" test -f /var/lib/nexus/.install_locked 2>/dev/null \
|
||||
|| docker exec "$CONTAINER" test -f /app/web/app/install.html.bak 2>/dev/null
|
||||
}
|
||||
|
||||
main() {
|
||||
local app="$NEXUS_ROOT/web/app"
|
||||
local wizard_archived=false
|
||||
if [[ ! -f "$app/install.html" ]]; then
|
||||
error "仓库中无 $app/install.html，请先 git pull"
|
||||
exit 1
|
||||
fi
|
||||
resolve_container
|
||||
if wizard_archived_in_container; then
|
||||
wizard_archived=true
|
||||
info "安装已锁定或向导已归档，跳过静态/Python 热同步"
|
||||
local code
|
||||
code="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${NEXUS_PUBLISH_PORT}/app/install.html" 2>/dev/null || echo 000)"
|
||||
if [[ "$code" == "404" ]]; then
|
||||
info "/app/install.html 已归档 → HTTP 404"
|
||||
exit 0
|
||||
fi
|
||||
warn "/app/install.html 应已归档但返回 HTTP $code"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
info "同步安装向导静态文件..."
|
||||
sync_file "$app/install.html" /app/web/app/install.html
|
||||
sync_file "$app/vendor/tailwindcss-browser.js" /app/web/app/vendor/tailwindcss-browser.js
|
||||
sync_file "$app/vendor/theme-init.js" /app/web/app/vendor/theme-init.js
|
||||
sync_file "$app/vendor/theme.css" /app/web/app/vendor/theme.css
|
||||
sync_file "$app/vendor/alpinejs.min.js" /app/web/app/vendor/alpinejs.min.js
|
||||
|
||||
local install_py="$NEXUS_ROOT/server/api/install.py" code
|
||||
if [[ -f "$install_py" ]]; then
|
||||
info "同步 install.py（Docker Redis env-check 修复）..."
|
||||
sync_file "$install_py" /app/server/api/install.py
|
||||
info "重启 Nexus 容器以加载 Python 变更..."
|
||||
docker restart "$CONTAINER" >/dev/null
|
||||
for _ in $(seq 1 30); do
|
||||
if curl -sf "http://127.0.0.1:${NEXUS_PUBLISH_PORT}/health" >/dev/null 2>&1; then
|
||||
break
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
else
|
||||
warn "未找到 $install_py，跳过 Python 热同步"
|
||||
fi
|
||||
|
||||
code="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${NEXUS_PUBLISH_PORT}/app/install.html" 2>/dev/null || echo 000)"
|
||||
if [[ "$code" == "200" ]]; then
|
||||
info "/app/install.html → HTTP 200"
|
||||
else
|
||||
warn "/app/install.html → HTTP $code（请检查 Nexus 是否在 ${NEXUS_PUBLISH_PORT} 监听）"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,119 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Sync Git-tracked web/app and web/app-v2 into the running Nexus Docker container.
|
||||
#
|
||||
# Root cause: Dockerfile.prod runs vite build inside the image; Docker layer cache
|
||||
# can produce asset hashes that differ from committed web/app on the host.
|
||||
#
|
||||
# Usage (on production host after git pull / upgrade):
|
||||
# NEXUS_ROOT=/opt/nexus bash deploy/sync_webapp_to_container.sh
|
||||
#
|
||||
# Called automatically from deploy/nexus-1panel.sh cmd_upgrade and deploy-production.sh.
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
CONTAINER="${NEXUS_CONTAINER:-}"
|
||||
NEXUS_PUBLISH_PORT="${NEXUS_PUBLISH_PORT:-8600}"
|
||||
|
||||
info() { echo -e "\033[0;32m[INFO]\033[0m $*"; }
|
||||
warn() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
|
||||
error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
|
||||
|
||||
docker_cmd() {
|
||||
if docker "$@" 2>/dev/null; then return 0; fi
|
||||
sudo docker "$@" 2>/dev/null
|
||||
}
|
||||
|
||||
resolve_container() {
|
||||
if [[ -n "$CONTAINER" ]]; then
|
||||
return 0
|
||||
fi
|
||||
CONTAINER="$(docker_cmd ps --format '{{.Names}}' | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true)"
|
||||
if [[ -z "$CONTAINER" ]]; then
|
||||
error "未找到运行中的 Nexus 容器（可设 NEXUS_CONTAINER=名称）"
|
||||
exit 1
|
||||
fi
|
||||
info "容器: $CONTAINER"
|
||||
}
|
||||
|
||||
verify_entry_bundle() {
|
||||
local html bundle_path code
|
||||
html="$(curl -sf "http://127.0.0.1:${NEXUS_PUBLISH_PORT}/app/" 2>/dev/null || true)"
|
||||
bundle_path="$(printf '%s' "$html" | sed -n 's/.*src="\(\/app\/assets\/index-[^"]*\.js\)".*/\1/p' | head -1)"
|
||||
if [[ -z "$bundle_path" ]]; then
|
||||
error "/app/ index.html 未解析到主 bundle"
|
||||
exit 1
|
||||
fi
|
||||
code="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${NEXUS_PUBLISH_PORT}${bundle_path}" 2>/dev/null || echo 000)"
|
||||
if [[ "$code" != "200" ]]; then
|
||||
error "主 bundle ${bundle_path} → HTTP ${code}"
|
||||
exit 1
|
||||
fi
|
||||
info "入口校验 OK: ${bundle_path} → HTTP 200"
|
||||
}
|
||||
|
||||
verify_app_v2_entry_bundle() {
|
||||
local html bundle_path code
|
||||
html="$(curl -sf "http://127.0.0.1:${NEXUS_PUBLISH_PORT}/app-v2/" 2>/dev/null || true)"
|
||||
bundle_path="$(printf '%s' "$html" | sed -n 's/.*src="\(\/app-v2\/assets\/[^"]*\.js\)".*/\1/p' | head -1)"
|
||||
if [[ -z "$bundle_path" ]]; then
|
||||
error "/app-v2/ index.html 未解析到主 bundle"
|
||||
exit 1
|
||||
fi
|
||||
code="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${NEXUS_PUBLISH_PORT}${bundle_path}" 2>/dev/null || echo 000)"
|
||||
if [[ "$code" != "200" ]]; then
|
||||
error "V2 主 bundle ${bundle_path} → HTTP ${code}"
|
||||
exit 1
|
||||
fi
|
||||
info "V2 入口校验 OK: ${bundle_path} → HTTP 200"
|
||||
}
|
||||
|
||||
main() {
|
||||
local app="${NEXUS_ROOT}/web/app"
|
||||
local app_v2="${NEXUS_ROOT}/web/app-v2"
|
||||
if [[ ! -f "${app}/index.html" ]]; then
|
||||
error "缺少 ${app}/index.html，请先 git pull"
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -d "${app}/assets" ]]; then
|
||||
error "缺少 ${app}/assets"
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -f "${app_v2}/index.html" ]]; then
|
||||
error "缺少 ${app_v2}/index.html，请先构建 frontend-v2"
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -d "${app_v2}/assets" ]]; then
|
||||
error "缺少 ${app_v2}/assets"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
resolve_container
|
||||
|
||||
info "同步 web/app → 容器 /app/web/app ..."
|
||||
docker_cmd exec "$CONTAINER" rm -rf /app/web/app/assets
|
||||
docker_cmd exec "$CONTAINER" mkdir -p /app/web/app
|
||||
docker_cmd cp "${app}/index.html" "${CONTAINER}:/app/web/app/index.html"
|
||||
docker_cmd cp "${app}/assets" "${CONTAINER}:/app/web/app/assets"
|
||||
|
||||
if [[ -f "${app}/favicon.ico" ]]; then
|
||||
docker_cmd cp "${app}/favicon.ico" "${CONTAINER}:/app/web/app/favicon.ico" 2>/dev/null || true
|
||||
fi
|
||||
|
||||
info "同步 web/app-v2 → 容器 /app/web/app-v2 ..."
|
||||
docker_cmd exec "$CONTAINER" rm -rf /app/web/app-v2/assets
|
||||
docker_cmd exec "$CONTAINER" mkdir -p /app/web/app-v2
|
||||
docker_cmd cp "${app_v2}/index.html" "${CONTAINER}:/app/web/app-v2/index.html"
|
||||
docker_cmd cp "${app_v2}/assets" "${CONTAINER}:/app/web/app-v2/assets"
|
||||
|
||||
if [[ -x "${NEXUS_ROOT}/deploy/prune_frontend_assets.py" ]]; then
|
||||
info "容器内 prune 未引用 assets（可选）..."
|
||||
docker_cmd exec "$CONTAINER" python3 /app/deploy/prune_frontend_assets.py --dry-run 2>/dev/null || \
|
||||
warn "容器内 prune 跳过（脚本或路径不可用）"
|
||||
fi
|
||||
|
||||
verify_entry_bundle
|
||||
verify_app_v2_entry_bundle
|
||||
info "web/app 与 web/app-v2 同步完成"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,91 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Diagnose 1Panel Redis auth from Nexus container network perspective.
|
||||
# Usage:
|
||||
# REDIS_PASS='redis_WP3NyN' bash deploy/test-1panel-redis.sh
|
||||
# bash deploy/test-1panel-redis.sh # prompts for password
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
ENV_PROD="${NEXUS_ROOT}/docker/.env.prod"
|
||||
|
||||
info() { echo -e "\033[0;32m[INFO]\033[0m $*"; }
|
||||
ok() { echo -e "\033[0;32m[OK]\033[0m $*"; }
|
||||
fail() { echo -e "\033[0;31m[FAIL]\033[0m $*"; }
|
||||
|
||||
pick_redis_container() {
|
||||
if [[ -n "${REDIS_CONTAINER:-}" ]]; then
|
||||
echo "$REDIS_CONTAINER"
|
||||
return 0
|
||||
fi
|
||||
local h
|
||||
h="$(grep -E '^NEXUS_1PANEL_REDIS_HOST=' "$ENV_PROD" 2>/dev/null | cut -d= -f2- || true)"
|
||||
if [[ -n "$h" ]]; then
|
||||
echo "$h"
|
||||
return 0
|
||||
fi
|
||||
if [[ -x "$NEXUS_ROOT/deploy/detect-1panel-services.sh" ]]; then
|
||||
h="$("$NEXUS_ROOT/deploy/detect-1panel-services.sh" 2>/dev/null | sed -n 's/^NEXUS_1PANEL_REDIS_HOST=//p' | head -1)"
|
||||
[[ -n "$h" ]] && echo "$h" && return 0
|
||||
fi
|
||||
docker ps --format '{{.Names}}' | grep -iE '^1Panel-redis-' | head -1 || true
|
||||
}
|
||||
|
||||
try_ping() {
|
||||
local label="$1" url="$2"
|
||||
local nexus
|
||||
nexus="$(docker ps --format '{{.Names}}' | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true)"
|
||||
if [[ -z "$nexus" ]]; then
|
||||
fail "未找到 Nexus 容器"
|
||||
return 1
|
||||
fi
|
||||
if docker exec "$nexus" python3 -c "
|
||||
import redis
|
||||
r = redis.Redis.from_url('${url}', socket_timeout=3)
|
||||
print(r.ping())
|
||||
" 2>/dev/null | grep -q True; then
|
||||
ok "$label → $url"
|
||||
return 0
|
||||
fi
|
||||
fail "$label"
|
||||
return 1
|
||||
}
|
||||
|
||||
main() {
|
||||
local redis_host pass
|
||||
redis_host="$(pick_redis_container)"
|
||||
[[ -n "$redis_host" ]] || { fail "未找到 Redis 容器/主机名"; exit 1; }
|
||||
info "Redis 主机: $redis_host"
|
||||
|
||||
if [[ -z "${REDIS_PASS:-}" ]]; then
|
||||
read -r -s -p "1Panel Redis 密码（应用参数）: " pass
|
||||
echo ""
|
||||
else
|
||||
pass="$REDIS_PASS"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
info "从 Nexus 容器内尝试多种 URL 格式（807f4c2 修复后）..."
|
||||
local any=0
|
||||
try_ping "无认证" "redis://${redis_host}:6379/0" && any=1 || true
|
||||
if [[ -n "$pass" ]]; then
|
||||
try_ping "仅密码 (:pass@)" "redis://:${pass}@${redis_host}:6379/0" && any=1 || true
|
||||
try_ping "default 用户" "redis://default:${pass}@${redis_host}:6379/0" && any=1 || true
|
||||
info "跳过 root 用户探测 — 1Panel Redis 无 root 账号"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
if [[ "$any" -eq 1 ]]; then
|
||||
ok "至少一种格式可用"
|
||||
echo ""
|
||||
info "安装向导步骤 3：1Panel Redis 无账号，只填密码（后端自动用 :pass@ 或 default）"
|
||||
info "已有 .env 时写入 NEXUS_REDIS_URL，例如:"
|
||||
info " redis://:${pass}@${redis_host}:6379/0"
|
||||
info " 或 redis://default:${pass}@${redis_host}:6379/0"
|
||||
exit 0
|
||||
fi
|
||||
fail "全部失败。请在 1Panel → Redis → 参数 核对密码，或检查 Nexus 是否在 1panel-network"
|
||||
info "本机: docker exec -it ${redis_host} redis-cli -u 'redis://:密码@127.0.0.1:6379' ping"
|
||||
exit 1
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,121 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# =============================================================================
|
||||
# 卸载 Nexus 旧版 Compose 内置 MySQL 容器
|
||||
#
|
||||
# bash deploy/uninstall-mysql-compose.sh
|
||||
# bash deploy/uninstall-mysql-compose.sh --purge-volume
|
||||
# =============================================================================
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
COMPOSE_FILE="${COMPOSE_FILE:-docker/docker-compose.prod.yml}"
|
||||
PURGE_VOLUME=false
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
|
||||
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
||||
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
|
||||
|
||||
usage() {
|
||||
cat <<EOF
|
||||
卸载 Nexus Compose 遗留 MySQL 容器
|
||||
|
||||
bash deploy/uninstall-mysql-compose.sh [--purge-volume]
|
||||
|
||||
说明:
|
||||
- 不卸载宿主机/1Panel 自建的 MySQL
|
||||
- 卸载后请自建库 nexus + 用户，安装向导步骤 3 填写连接信息
|
||||
EOF
|
||||
}
|
||||
|
||||
compose_env_args() {
|
||||
local_env=()
|
||||
[[ -f "${NEXUS_ROOT}/docker/.env.prod" ]] && local_env+=(--env-file "${NEXUS_ROOT}/docker/.env.prod")
|
||||
local prof="${NEXUS_ROOT}/docker/.host-profile"
|
||||
if [[ -f "$prof" ]]; then
|
||||
local p
|
||||
p="$(tr -d '\r\n' <"$prof")"
|
||||
[[ -f "${NEXUS_ROOT}/docker/profiles/${p}.env" ]] && local_env+=(--env-file "${NEXUS_ROOT}/docker/profiles/${p}.env")
|
||||
fi
|
||||
}
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
-h|--help) usage; exit 0 ;;
|
||||
--purge-volume) PURGE_VOLUME=true; shift ;;
|
||||
*) error "未知参数: $1"; usage; exit 1 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
[[ "$(id -u)" -eq 0 ]] || { error "请使用 root 执行"; exit 1; }
|
||||
|
||||
removed=0
|
||||
|
||||
stop_rm_container() {
|
||||
local name="$1"
|
||||
if docker ps -a --format '{{.Names}}' | grep -qx "$name"; then
|
||||
info "停止并删除容器: $name"
|
||||
docker stop "$name" >/dev/null 2>&1 || true
|
||||
docker rm -f "$name" >/dev/null 2>&1 || true
|
||||
removed=$((removed + 1))
|
||||
fi
|
||||
}
|
||||
|
||||
for pattern in nexus-prod-mysql-1 nexus-prod-mysql nexus-mysql-1; do
|
||||
stop_rm_container "$pattern"
|
||||
done
|
||||
|
||||
while IFS= read -r c; do
|
||||
[[ -z "$c" ]] && continue
|
||||
stop_rm_container "$c"
|
||||
done < <(docker ps -a --format '{{.Names}}' | grep -iE 'nexus.*mysql|mysql.*nexus' || true)
|
||||
|
||||
compose_env_args
|
||||
if [[ -f "${NEXUS_ROOT}/${COMPOSE_FILE}" ]] && grep -q '^ mysql:' "${NEXUS_ROOT}/${COMPOSE_FILE}" 2>/dev/null; then
|
||||
warn "compose 仍含 mysql 服务，尝试 compose rm..."
|
||||
(cd "$NEXUS_ROOT" && docker compose -f "$COMPOSE_FILE" "${local_env[@]}" stop mysql 2>/dev/null || true)
|
||||
(cd "$NEXUS_ROOT" && docker compose -f "$COMPOSE_FILE" "${local_env[@]}" rm -f mysql 2>/dev/null || true)
|
||||
removed=$((removed + 1))
|
||||
elif [[ -f "${NEXUS_ROOT}/${COMPOSE_FILE}" && -f "${NEXUS_ROOT}/docker/.env.prod" ]]; then
|
||||
info "Compose --remove-orphans（从 nexus-prod 项目移除 mysql 孤儿容器）..."
|
||||
compose_files=(-f "${NEXUS_ROOT}/${COMPOSE_FILE}")
|
||||
if docker network inspect 1panel-network >/dev/null 2>&1 \
|
||||
&& [[ -f "${NEXUS_ROOT}/docker/docker-compose.1panel.yml" ]]; then
|
||||
compose_files+=(-f "${NEXUS_ROOT}/docker/docker-compose.1panel.yml")
|
||||
fi
|
||||
(cd "$NEXUS_ROOT" && docker compose "${compose_files[@]}" "${local_env[@]}" up -d --remove-orphans 2>/dev/null || true)
|
||||
while IFS= read -r c; do
|
||||
[[ -z "$c" ]] && continue
|
||||
stop_rm_container "$c"
|
||||
done < <(docker ps -a --format '{{.Names}}' | grep -iE 'nexus.*mysql|mysql.*nexus' || true)
|
||||
fi
|
||||
|
||||
if [[ "$PURGE_VOLUME" == true ]]; then
|
||||
while IFS= read -r vol; do
|
||||
[[ -z "$vol" ]] && continue
|
||||
info "删除数据卷: $vol"
|
||||
docker volume rm "$vol" 2>/dev/null || warn "无法删除卷 $vol"
|
||||
done < <(docker volume ls -q | grep -iE 'nexus.*mysql|mysql.*nexus' || true)
|
||||
fi
|
||||
|
||||
leftover="$(docker ps -a --format '{{.Names}}' | grep -iE 'nexus.*mysql|mysql.*nexus' || true)"
|
||||
if [[ -n "$leftover" ]]; then
|
||||
warn "仍有 MySQL 相关容器:"
|
||||
echo "$leftover" | sed 's/^/ /'
|
||||
warn "若确认为 Compose 遗留，可: docker rm -f <容器名>"
|
||||
elif [[ "$removed" -gt 0 ]]; then
|
||||
info "Compose MySQL 容器已卸载。"
|
||||
else
|
||||
info "未发现 Nexus Compose MySQL 容器。"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
info "当前 Nexus 栈:"
|
||||
docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}' | grep -i nexus || docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'
|
||||
echo ""
|
||||
info "下一步：1Panel 应用商店安装 MySQL → nx update 探测容器名 → 向导步骤 3 使用 1Panel-mysql-xxxx"
|
||||
@@ -1,114 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# =============================================================================
|
||||
# 卸载 Nexus 旧版 Compose 内置 Redis 容器
|
||||
#
|
||||
# 适用：已从 docker-compose.prod.yml 移除 redis 服务，改用宿主机/1Panel 自建 Redis。
|
||||
# 不会卸载 apt/1Panel 安装的 Redis，仅删除 Docker 容器与（可选）数据卷。
|
||||
#
|
||||
# bash deploy/uninstall-redis-compose.sh
|
||||
# bash deploy/uninstall-redis-compose.sh --purge-volume # 同时删 redis-data 卷
|
||||
# =============================================================================
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
COMPOSE_FILE="${COMPOSE_FILE:-docker/docker-compose.prod.yml}"
|
||||
PURGE_VOLUME=false
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
|
||||
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
||||
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
|
||||
|
||||
usage() {
|
||||
cat <<EOF
|
||||
卸载 Nexus Compose 遗留 Redis 容器
|
||||
|
||||
bash deploy/uninstall-redis-compose.sh [--purge-volume]
|
||||
|
||||
选项:
|
||||
--purge-volume 删除 nexus-prod_redis-data 数据卷（不可恢复）
|
||||
-h, --help 显示帮助
|
||||
|
||||
说明:
|
||||
- 不卸载宿主机 redis-server / 1Panel 应用商店 Redis
|
||||
- 卸载后请在宿主机安装 Redis，安装向导步骤 2 须能 ping 通
|
||||
EOF
|
||||
}
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
-h|--help) usage; exit 0 ;;
|
||||
--purge-volume) PURGE_VOLUME=true; shift ;;
|
||||
*) error "未知参数: $1"; usage; exit 1 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [[ "$(id -u)" -ne 0 ]]; then
|
||||
error "请使用 root 执行"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
removed=0
|
||||
|
||||
stop_rm_container() {
|
||||
local name="$1"
|
||||
if docker ps -a --format '{{.Names}}' | grep -qx "$name"; then
|
||||
info "停止并删除容器: $name"
|
||||
docker stop "$name" >/dev/null 2>&1 || true
|
||||
docker rm "$name" >/dev/null 2>&1 || true
|
||||
removed=$((removed + 1))
|
||||
fi
|
||||
}
|
||||
|
||||
# 常见 Compose 命名
|
||||
for pattern in nexus-prod-redis-1 nexus-prod-redis nexus-redis-1; do
|
||||
stop_rm_container "$pattern"
|
||||
done
|
||||
|
||||
# 名称含 nexus 且含 redis 的容器
|
||||
while IFS= read -r c; do
|
||||
[[ -z "$c" ]] && continue
|
||||
stop_rm_container "$c"
|
||||
done < <(docker ps -a --format '{{.Names}}' | grep -iE 'nexus.*redis|redis.*nexus' || true)
|
||||
|
||||
# 若旧 compose 仍定义 redis 服务
|
||||
if [[ -f "${NEXUS_ROOT}/${COMPOSE_FILE}" ]]; then
|
||||
if grep -q '^ redis:' "${NEXUS_ROOT}/${COMPOSE_FILE}" 2>/dev/null; then
|
||||
warn "compose 仍含 redis 服务，尝试 compose rm..."
|
||||
local_env=()
|
||||
[[ -f "${NEXUS_ROOT}/docker/.env.prod" ]] && local_env+=(--env-file "${NEXUS_ROOT}/docker/.env.prod")
|
||||
prof="${NEXUS_ROOT}/docker/.host-profile"
|
||||
if [[ -f "$prof" ]]; then
|
||||
p="$(tr -d '\r\n' <"$prof")"
|
||||
[[ -f "${NEXUS_ROOT}/docker/profiles/${p}.env" ]] && local_env+=(--env-file "${NEXUS_ROOT}/docker/profiles/${p}.env")
|
||||
fi
|
||||
(cd "$NEXUS_ROOT" && docker compose -f "$COMPOSE_FILE" "${local_env[@]}" stop redis 2>/dev/null || true)
|
||||
(cd "$NEXUS_ROOT" && docker compose -f "$COMPOSE_FILE" "${local_env[@]}" rm -f redis 2>/dev/null || true)
|
||||
removed=$((removed + 1))
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$PURGE_VOLUME" == true ]]; then
|
||||
while IFS= read -r vol; do
|
||||
[[ -z "$vol" ]] && continue
|
||||
info "删除数据卷: $vol"
|
||||
docker volume rm "$vol" 2>/dev/null || warn "无法删除卷 $vol（可能被占用）"
|
||||
done < <(docker volume ls -q | grep -iE 'nexus.*redis|redis.*nexus' || true)
|
||||
fi
|
||||
|
||||
echo ""
|
||||
if [[ "$removed" -gt 0 ]]; then
|
||||
info "Compose Redis 容器已卸载。"
|
||||
else
|
||||
info "未发现 Nexus Compose Redis 容器（可能已删除）。"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
info "下一步：1Panel 应用商店安装 Redis → nx update 写入 NEXUS_1PANEL_REDIS_HOST"
|
||||
echo " 向导 Redis URL：redis://:密码@1Panel-redis-xxxx:6379/0（无 root 用户）"
|
||||
echo " 诊断：bash deploy/test-1panel-redis.sh"
|
||||
@@ -1,32 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Nexus 6.0 — 一键更新（拉代码 + 重建镜像 + 重启）
|
||||
#
|
||||
# 已在 /opt/nexus:
|
||||
# bash deploy/update.sh
|
||||
# bash deploy/update.sh --no-cache # 强制无缓存重建（entrypoint/Dockerfile 变更后）
|
||||
#
|
||||
# 远程一条命令（推荐在仓库目录执行，管道模式会回退 /opt/nexus）:
|
||||
# cd /opt/nexus && bash deploy/update.sh
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/update.sh" | bash
|
||||
#
|
||||
set -euo pipefail
|
||||
|
||||
_resolve_nexus_root() {
|
||||
local src="${BASH_SOURCE[0]:-}"
|
||||
if [[ -n "$src" && "$src" != /dev/fd/* && "$src" != "-" && -f "$src" ]]; then
|
||||
cd "$(dirname "$(readlink -f "$src")")/.." && pwd
|
||||
return
|
||||
fi
|
||||
if [[ -d /opt/nexus ]]; then
|
||||
echo "警告: 通过管道执行无法解析脚本路径，已回退 /opt/nexus；推荐: cd /opt/nexus && bash deploy/update.sh" >&2
|
||||
echo /opt/nexus
|
||||
return
|
||||
fi
|
||||
echo "错误: 无法定位 Nexus 根目录；请 cd /opt/nexus && bash deploy/update.sh" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
ROOT="$(_resolve_nexus_root)"
|
||||
|
||||
NEXUS_ROOT="$ROOT" bash "$ROOT/deploy/install-nx-cli.sh" 2>/dev/null || true
|
||||
exec bash "$ROOT/deploy/nexus-1panel.sh" upgrade "$@"
|
||||
@@ -1,3 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# 兼容入口 — 请优先使用 deploy/nexus-1panel.sh
|
||||
exec "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/nexus-1panel.sh" upgrade "$@"
|
||||
+55
-49
@@ -1,16 +1,15 @@
|
||||
#!/usr/bin/env bash
|
||||
# Nexus 6.0 — Upgrade Script（自动识别 Docker / Supervisor）
|
||||
#!/bin/bash
|
||||
# ================================================================
|
||||
# Nexus 6.0 — Upgrade Script
|
||||
#
|
||||
# sudo bash deploy/upgrade.sh
|
||||
# sudo bash deploy/upgrade.sh --deploy-dir /opt/nexus
|
||||
# Usage:
|
||||
# sudo bash upgrade.sh # auto-detect deploy dir
|
||||
# sudo bash upgrade.sh --deploy-dir /opt/nexus # specify deploy dir
|
||||
#
|
||||
# Docker 1Panel：委托 deploy/nexus-1panel.sh upgrade（拉代码 + 备份 + 重建镜像）
|
||||
# Supervisor 裸机：git pull + venv pip + supervisorctl restart
|
||||
set -euo pipefail
|
||||
# Safe: git pull + pip install + restart. Database is NOT touched.
|
||||
# ================================================================
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||
# shellcheck source=./detect_deploy_runtime.sh
|
||||
source "${SCRIPT_DIR}/detect_deploy_runtime.sh"
|
||||
set -euo pipefail
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
@@ -22,90 +21,98 @@ warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
||||
error() { echo -e "${RED}[ERROR]${NC} $*"; }
|
||||
|
||||
DEPLOY_DIR=""
|
||||
EXTRA_ARGS=()
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
case $1 in
|
||||
--deploy-dir) DEPLOY_DIR="$2"; shift 2 ;;
|
||||
--no-backup|--require-backup|--no-cache|--prune|--check|--dry-run)
|
||||
EXTRA_ARGS+=("$1"); shift ;;
|
||||
-h|--help)
|
||||
cat <<'EOF'
|
||||
用法: sudo bash deploy/upgrade.sh [--deploy-dir PATH] [nexus-1panel 升级选项]
|
||||
|
||||
Docker 环境自动走 nexus-1panel.sh upgrade；Supervisor 环境走 venv + supervisorctl。
|
||||
EOF
|
||||
exit 0
|
||||
;;
|
||||
*) EXTRA_ARGS+=("$1"); shift ;;
|
||||
echo "Usage: sudo bash upgrade.sh [--deploy-dir PATH]"
|
||||
exit 0 ;;
|
||||
*) shift ;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [[ -z "$DEPLOY_DIR" ]]; then
|
||||
DEPLOY_DIR="$(resolve_nexus_root 2>/dev/null || true)"
|
||||
# Auto-detect deploy directory
|
||||
if [ -z "$DEPLOY_DIR" ]; then
|
||||
# Check common locations
|
||||
for d in /opt/nexus /www/wwwroot/*/; do
|
||||
if [ -d "$d/server" ] && [ -d "$d/web" ]; then
|
||||
DEPLOY_DIR="$d"
|
||||
break
|
||||
fi
|
||||
done
|
||||
# Try from Supervisor config
|
||||
if [ -z "$DEPLOY_DIR" ]; then
|
||||
DEPLOY_DIR=$(supervisorctl status nexus 2>/dev/null | grep -oP 'cwd=\K[^ ,]+' || true)
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ -z "$DEPLOY_DIR" || ! -d "$DEPLOY_DIR/server" ]]; then
|
||||
error "找不到 Nexus 安装目录，请使用 --deploy-dir 指定"
|
||||
if [ -z "$DEPLOY_DIR" ] || [ ! -d "$DEPLOY_DIR/server" ]; then
|
||||
error "Cannot find Nexus installation. Use --deploy-dir to specify."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
RUNTIME="$(detect_nexus_runtime "$DEPLOY_DIR")"
|
||||
|
||||
if [[ "$RUNTIME" == "docker" ]]; then
|
||||
info "检测到 Docker Compose 运行时，委托 nexus-1panel.sh upgrade"
|
||||
exec env NEXUS_ROOT="$DEPLOY_DIR" bash "$DEPLOY_DIR/deploy/nexus-1panel.sh" upgrade "${EXTRA_ARGS[@]}"
|
||||
fi
|
||||
|
||||
VENV_DIR="$DEPLOY_DIR/venv"
|
||||
ENV_FILE="$DEPLOY_DIR/.env"
|
||||
|
||||
echo ""
|
||||
echo "=========================================="
|
||||
echo " Nexus 6.0 Upgrade (Supervisor)"
|
||||
echo " Nexus 6.0 Upgrade"
|
||||
echo "=========================================="
|
||||
echo " Deploy: $DEPLOY_DIR"
|
||||
echo ""
|
||||
|
||||
# 1. Pull latest code
|
||||
info "Step 1/4: Updating source code..."
|
||||
if [[ -d "$DEPLOY_DIR/.git" ]]; then
|
||||
if [ -d "$DEPLOY_DIR/.git" ]; then
|
||||
cd "$DEPLOY_DIR"
|
||||
OLD_REV="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
|
||||
OLD_REV=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
|
||||
git pull --ff-only 2>/dev/null || {
|
||||
error "git pull failed. Resolve conflicts: cd $DEPLOY_DIR && git status"
|
||||
error "git pull failed. You may have local changes."
|
||||
error "Resolve conflicts manually: cd $DEPLOY_DIR && git status"
|
||||
exit 1
|
||||
}
|
||||
NEW_REV="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
|
||||
if [[ "$OLD_REV" == "$NEW_REV" ]]; then
|
||||
NEW_REV=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
|
||||
if [ "$OLD_REV" = "$NEW_REV" ]; then
|
||||
info " Already up to date (no new commits)"
|
||||
else
|
||||
info " Updated: ${OLD_REV:0:8}..${NEW_REV:0:8}"
|
||||
fi
|
||||
else
|
||||
warn " Not a git repo. Skip git pull"
|
||||
warn " Not a git repo. Skip git pull (update files manually)"
|
||||
fi
|
||||
|
||||
# 2. Update Python dependencies
|
||||
info "Step 2/4: Updating Python dependencies..."
|
||||
if [[ -d "$VENV_DIR/bin" ]]; then
|
||||
if [ -d "$VENV_DIR/bin" ]; then
|
||||
"$VENV_DIR/bin/pip" install -q --upgrade pip
|
||||
"$VENV_DIR/bin/pip" install -q -r "$DEPLOY_DIR/requirements.txt" 2>/dev/null || {
|
||||
warn " pip install had warnings, continuing..."
|
||||
warn " pip install had some warnings, but continuing..."
|
||||
}
|
||||
else
|
||||
error " venv not found at $VENV_DIR. Run install.sh first."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 3. Restart application
|
||||
info "Step 3/4: Restarting Nexus..."
|
||||
supervisorctl restart nexus >/dev/null 2>&1 || {
|
||||
warn " supervisorctl restart failed. Try: supervisorctl restart nexus"
|
||||
warn " supervisorctl restart failed. Try manually: supervisorctl restart nexus"
|
||||
}
|
||||
|
||||
# 4. Health check
|
||||
info "Step 4/4: Verifying health..."
|
||||
PORT="$(nexus_publish_port_for "$DEPLOY_DIR")"
|
||||
|
||||
# Read port from .env or default
|
||||
PORT=8600
|
||||
if [ -f "$ENV_FILE" ]; then
|
||||
PORT_FROM_ENV=$(grep '^NEXUS_PORT=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2 || true)
|
||||
[ -n "$PORT_FROM_ENV" ] && PORT="$PORT_FROM_ENV"
|
||||
fi
|
||||
|
||||
HEALTH_OK=false
|
||||
for _ in $(seq 1 15); do
|
||||
if curl -sf "http://127.0.0.1:${PORT}/health" >/dev/null 2>&1; then
|
||||
for i in $(seq 1 15); do
|
||||
if curl -sf "http://127.0.0.1:$PORT/health" >/dev/null 2>&1; then
|
||||
HEALTH_OK=true
|
||||
break
|
||||
fi
|
||||
@@ -113,12 +120,11 @@ for _ in $(seq 1 15); do
|
||||
done
|
||||
|
||||
echo ""
|
||||
if [[ "$HEALTH_OK" == true ]]; then
|
||||
if [ "$HEALTH_OK" = true ]; then
|
||||
echo -e " ${GREEN}Upgrade complete! Nexus is healthy.${NC}"
|
||||
suggest_ops_cron "$DEPLOY_DIR"
|
||||
else
|
||||
echo -e " ${YELLOW}Health check pending. Verify manually:${NC}"
|
||||
echo " curl http://127.0.0.1:${PORT}/health"
|
||||
echo " curl http://127.0.0.1:$PORT/health"
|
||||
echo " supervisorctl status nexus"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
@@ -1,437 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Verify 1Panel + Docker install wizard readiness (run on the VPS as root).
|
||||
# See: deploy/README-1panel.md
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
ENV_PROD="${NEXUS_ROOT}/docker/.env.prod"
|
||||
COMPOSE_FILE="${NEXUS_ROOT}/docker/docker-compose.prod.yml"
|
||||
COMPOSE_1PANEL="${NEXUS_ROOT}/docker/docker-compose.1panel.yml"
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
pass() { echo -e "${GREEN}[PASS]${NC} $*"; }
|
||||
fail() { echo -e "${RED}[FAIL]${NC} $*"; FAILURES=$((FAILURES + 1)); }
|
||||
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; WARNS=$((WARNS + 1)); }
|
||||
info() { echo -e " $*"; }
|
||||
|
||||
FAILURES=0
|
||||
WARNS=0
|
||||
INSTALL_WIZARD_ARCHIVED=false
|
||||
PUBLISH_PORT=8600
|
||||
|
||||
require_root() {
|
||||
if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
|
||||
fail "请用 root 运行（1Panel 终端默认 root）"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
resolve_nexus_container() {
|
||||
NEXUS_CONTAINER="$(docker ps --format '{{.Names}}' | grep -E 'nexus-prod-nexus|nexus-nexus-1' | head -1 || true)"
|
||||
if [[ -z "$NEXUS_CONTAINER" ]]; then
|
||||
fail "未找到运行中的 Nexus 容器"
|
||||
info "修复: cd $NEXUS_ROOT && nx update --no-cache"
|
||||
return 1
|
||||
fi
|
||||
pass "Nexus 容器: $NEXUS_CONTAINER"
|
||||
}
|
||||
|
||||
check_repo() {
|
||||
if [[ ! -d "$NEXUS_ROOT/.git" ]]; then
|
||||
fail "仓库不存在: $NEXUS_ROOT"
|
||||
return 1
|
||||
fi
|
||||
local sha msg
|
||||
sha="$(git -C "$NEXUS_ROOT" rev-parse --short HEAD 2>/dev/null || echo unknown)"
|
||||
msg="$(git -C "$NEXUS_ROOT" log -1 --oneline 2>/dev/null || true)"
|
||||
pass "Git: $msg"
|
||||
if git -C "$NEXUS_ROOT" merge-base --is-ancestor b25d079 HEAD 2>/dev/null; then
|
||||
pass "已包含 b25d079（1Panel 容器名 sync 修复）"
|
||||
else
|
||||
warn "早于 b25d079 — 步骤 3 可能仍预填 host.docker.internal"
|
||||
info "修复: cd $NEXUS_ROOT && nx update --no-cache"
|
||||
fi
|
||||
if git -C "$NEXUS_ROOT" merge-base --is-ancestor 3b2856f HEAD 2>/dev/null; then
|
||||
pass "已包含 3b2856f+（Redis :pass@ 自动解析，无 root）"
|
||||
else
|
||||
warn "早于 3b2856f — Redis 认证可能仍误用 root"
|
||||
info "修复: cd $NEXUS_ROOT && git pull && bash deploy/sync-install-wizard-to-container.sh"
|
||||
fi
|
||||
}
|
||||
|
||||
check_env_prod() {
|
||||
if [[ ! -f "$ENV_PROD" ]]; then
|
||||
fail "缺少 $ENV_PROD"
|
||||
info "修复: bash $NEXUS_ROOT/deploy/install-nexus-fresh.sh --skip-clone"
|
||||
return 1
|
||||
fi
|
||||
pass "docker/.env.prod 存在"
|
||||
PUBLISH_PORT="$(grep -E '^NEXUS_PUBLISH_PORT=' "$ENV_PROD" 2>/dev/null | cut -d= -f2- | tr -d '\r" ' || true)"
|
||||
PUBLISH_PORT="${PUBLISH_PORT:-8600}"
|
||||
pass "NEXUS_PUBLISH_PORT=$PUBLISH_PORT"
|
||||
if grep -qE '^NEXUS_INSTALL_WIZARD_PENDING=1' "$ENV_PROD"; then
|
||||
pass "NEXUS_INSTALL_WIZARD_PENDING=1（安装模式）"
|
||||
else
|
||||
warn "NEXUS_INSTALL_WIZARD_PENDING≠1 — entrypoint 可能已写 /app/.env"
|
||||
fi
|
||||
local db redis
|
||||
db="$(grep -E '^NEXUS_1PANEL_DB_HOST=' "$ENV_PROD" 2>/dev/null | cut -d= -f2- || true)"
|
||||
redis="$(grep -E '^NEXUS_1PANEL_REDIS_HOST=' "$ENV_PROD" 2>/dev/null | cut -d= -f2- || true)"
|
||||
if [[ -n "$db" ]]; then
|
||||
pass "NEXUS_1PANEL_DB_HOST=$db"
|
||||
else
|
||||
fail "未设置 NEXUS_1PANEL_DB_HOST"
|
||||
info "修复: bash $NEXUS_ROOT/deploy/detect-1panel-services.sh && nx update"
|
||||
fi
|
||||
if [[ -n "$redis" ]]; then
|
||||
pass "NEXUS_1PANEL_REDIS_HOST=$redis"
|
||||
local rurl
|
||||
rurl="$(grep -E '^NEXUS_REDIS_URL=' "$ENV_PROD" 2>/dev/null | cut -d= -f2- || true)"
|
||||
if [[ "$rurl" == *"$redis"* ]]; then
|
||||
pass "NEXUS_REDIS_URL 已指向 Redis 容器"
|
||||
else
|
||||
warn "NEXUS_REDIS_URL 未含 $redis — nx update 会同步"
|
||||
fi
|
||||
else
|
||||
fail "未设置 NEXUS_1PANEL_REDIS_HOST"
|
||||
info "修复: 在 1Panel 应用商店安装 Redis 后执行 nx update"
|
||||
fi
|
||||
}
|
||||
|
||||
check_1panel_network() {
|
||||
if ! docker network inspect 1panel-network >/dev/null 2>&1; then
|
||||
fail "1panel-network 不存在"
|
||||
info "修复: 在 1Panel 应用商店安装 MySQL + Redis（会自动创建网络）"
|
||||
return 1
|
||||
fi
|
||||
pass "1panel-network 存在"
|
||||
if [[ -n "${NEXUS_CONTAINER:-}" ]]; then
|
||||
if docker inspect "$NEXUS_CONTAINER" --format '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} {{end}}' \
|
||||
| grep -q '1panel-network'; then
|
||||
pass "Nexus 已接入 1panel-network"
|
||||
else
|
||||
fail "Nexus 未接入 1panel-network"
|
||||
info "修复: cd $NEXUS_ROOT && nx update --no-cache"
|
||||
fi
|
||||
fi
|
||||
if [[ -x "$NEXUS_ROOT/deploy/detect-1panel-services.sh" ]]; then
|
||||
info "探测结果:"
|
||||
"$NEXUS_ROOT/deploy/detect-1panel-services.sh" | sed 's/^/ /' || true
|
||||
fi
|
||||
}
|
||||
|
||||
probe_from_container() {
|
||||
[[ -n "${NEXUS_CONTAINER:-}" ]] || return 0
|
||||
local db redis
|
||||
db="$(grep -E '^NEXUS_1PANEL_DB_HOST=' "$ENV_PROD" 2>/dev/null | cut -d= -f2- || true)"
|
||||
redis="$(grep -E '^NEXUS_1PANEL_REDIS_HOST=' "$ENV_PROD" 2>/dev/null | cut -d= -f2- || true)"
|
||||
if [[ -n "$db" ]]; then
|
||||
if docker exec "$NEXUS_CONTAINER" python3 -c "
|
||||
import socket
|
||||
s=socket.socket(); s.settimeout(3); s.connect(('$db', 3306)); s.close()
|
||||
" 2>/dev/null; then
|
||||
pass "容器内 TCP → MySQL $db:3306"
|
||||
else
|
||||
fail "容器内无法连接 MySQL $db:3306"
|
||||
info "检查 MySQL 容器是否运行、Nexus 是否在 1panel-network"
|
||||
fi
|
||||
fi
|
||||
if [[ -n "$redis" ]]; then
|
||||
if docker exec "$NEXUS_CONTAINER" python3 -c "
|
||||
import socket
|
||||
s=socket.socket(); s.settimeout(3); s.connect(('$redis', 6379)); s.close()
|
||||
" 2>/dev/null; then
|
||||
pass "容器内 TCP → Redis $redis:6379"
|
||||
else
|
||||
fail "容器内无法连接 Redis $redis:6379"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
check_app_env_redis_url() {
|
||||
[[ -n "${NEXUS_CONTAINER:-}" ]] || return 0
|
||||
if ! docker exec "$NEXUS_CONTAINER" test -f /app/.env 2>/dev/null; then
|
||||
return 0
|
||||
fi
|
||||
local rurl
|
||||
rurl="$(docker exec "$NEXUS_CONTAINER" grep -E '^NEXUS_REDIS_URL=' /app/.env 2>/dev/null | cut -d= -f2- | tr -d '"' || true)"
|
||||
if [[ -z "$rurl" ]]; then
|
||||
warn "/app/.env 无 NEXUS_REDIS_URL"
|
||||
return 0
|
||||
fi
|
||||
if [[ "$rurl" == *"://root:"* ]]; then
|
||||
fail "NEXUS_REDIS_URL 含 root 用户（1Panel Redis 无 root 账号）"
|
||||
info "修复: redis://:密码@1Panel-redis-xxxx:6379/0 — 见 deploy/test-1panel-redis.sh"
|
||||
elif [[ "$rurl" == *"1Panel-redis"* ]] || [[ "$rurl" == *"://:"* ]]; then
|
||||
pass "NEXUS_REDIS_URL 格式合理（容器名或 :pass@）"
|
||||
else
|
||||
warn "NEXUS_REDIS_URL 可能未指向 1Panel Redis: $rurl"
|
||||
fi
|
||||
}
|
||||
|
||||
check_install_mode() {
|
||||
[[ -n "${NEXUS_CONTAINER:-}" ]] || return 0
|
||||
if docker exec "$NEXUS_CONTAINER" test -f /app/.env 2>/dev/null; then
|
||||
warn "/app/.env 已存在 — 安装向导可能已进入步骤 3+ 或误写 env"
|
||||
check_app_env_redis_url
|
||||
info "若需重来: 删卷 nexus-state 中 .env 并设 NEXUS_INSTALL_WIZARD_PENDING=1 后 nx update"
|
||||
else
|
||||
pass "/app/.env 不存在（安装模式 OK）"
|
||||
fi
|
||||
if docker exec "$NEXUS_CONTAINER" test -f /app/.install_locked 2>/dev/null \
|
||||
|| docker exec "$NEXUS_CONTAINER" test -f /var/lib/nexus/.install_locked 2>/dev/null \
|
||||
|| docker exec "$NEXUS_CONTAINER" test -f /app/web/app/install.html.bak 2>/dev/null; then
|
||||
pass "安装向导已锁定/已归档 — 应访问 /app/ 登录"
|
||||
INSTALL_WIZARD_ARCHIVED=true
|
||||
fi
|
||||
local hosts_json
|
||||
hosts_json="$(docker exec "$NEXUS_CONTAINER" cat /app/web/data/1panel-hosts.json 2>/dev/null || true)"
|
||||
if [[ -n "$hosts_json" ]]; then
|
||||
pass "1panel-hosts.json: $hosts_json"
|
||||
else
|
||||
warn "无 1panel-hosts.json（依赖容器环境变量，nx update 会写入）"
|
||||
fi
|
||||
}
|
||||
|
||||
check_ops_cron() {
|
||||
if [[ "${INSTALL_WIZARD_ARCHIVED:-false}" != true ]]; then
|
||||
return 0
|
||||
fi
|
||||
if ! command -v crontab >/dev/null 2>&1; then
|
||||
warn "未安装 cron/crontab — Layer 3 宿主机巡检不可用"
|
||||
info "修复: sudo bash $NEXUS_ROOT/deploy/install_ops_cron.sh"
|
||||
return 0
|
||||
fi
|
||||
local cron
|
||||
cron="$(crontab -l 2>/dev/null || true)"
|
||||
if echo "$cron" | grep -q 'nexus-health-monitor\|deploy/health_monitor.sh'; then
|
||||
pass "Crontab 含 health_monitor"
|
||||
else
|
||||
warn "Crontab 未配置 health_monitor（Layer 3 巡检）"
|
||||
info "修复: sudo nx cron"
|
||||
fi
|
||||
if echo "$cron" | grep -q 'nexus-mysql-backup\|deploy/db_backup.sh'; then
|
||||
pass "Crontab 含 db_backup"
|
||||
else
|
||||
warn "Crontab 未配置 db_backup（每日 MySQL 备份）"
|
||||
info "修复: sudo nx cron"
|
||||
fi
|
||||
}
|
||||
|
||||
check_mysql_backup() {
|
||||
if [[ "${INSTALL_WIZARD_ARCHIVED:-false}" != true ]]; then
|
||||
return 0
|
||||
fi
|
||||
local dump_sh="${NEXUS_ROOT}/deploy/mysql_dump_to_file.sh"
|
||||
if [[ -f "$dump_sh" ]]; then
|
||||
pass "mysql_dump_to_file.sh 存在"
|
||||
else
|
||||
warn "缺少 mysql_dump_to_file.sh — 升级前无法备份 MySQL"
|
||||
info "修复: cd $NEXUS_ROOT && git pull && nx update"
|
||||
return 0
|
||||
fi
|
||||
if [[ -d /var/backups/nexus ]] && ls /var/backups/nexus/nexus_*.sql.gz >/dev/null 2>&1; then
|
||||
local latest
|
||||
latest="$(ls -t /var/backups/nexus/nexus_*.sql.gz 2>/dev/null | head -1)"
|
||||
pass "已有 MySQL 备份: $(basename "$latest")"
|
||||
else
|
||||
warn "尚无 MySQL 备份文件（/var/backups/nexus）"
|
||||
info "可手动: sudo bash $NEXUS_ROOT/deploy/db_backup.sh"
|
||||
fi
|
||||
}
|
||||
|
||||
check_http_local() {
|
||||
local health code
|
||||
health="$(curl -sf "http://127.0.0.1:${PUBLISH_PORT}/health" 2>/dev/null || true)"
|
||||
if [[ "$health" == "ok" ]]; then
|
||||
pass "/health → ok"
|
||||
else
|
||||
fail "/health 非 ok（当前: ${health:-无响应}）"
|
||||
info "修复: docker logs --tail=80 $NEXUS_CONTAINER"
|
||||
return 1
|
||||
fi
|
||||
code="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PUBLISH_PORT}/app/install.html" 2>/dev/null || echo 000)"
|
||||
if [[ "${INSTALL_WIZARD_ARCHIVED:-false}" == true ]]; then
|
||||
if [[ "$code" == "404" ]]; then
|
||||
pass "/app/install.html 已归档 → HTTP 404"
|
||||
else
|
||||
fail "/app/install.html 应已归档但 HTTP $code"
|
||||
info "修复: nx update（会执行 archive_install_wizard_in_container）"
|
||||
fi
|
||||
return 0
|
||||
fi
|
||||
if [[ "$code" == "200" ]]; then
|
||||
pass "/app/install.html → HTTP 200"
|
||||
else
|
||||
fail "/app/install.html → HTTP $code"
|
||||
info "修复: bash $NEXUS_ROOT/deploy/sync-install-wizard-to-container.sh"
|
||||
fi
|
||||
}
|
||||
|
||||
check_install_api() {
|
||||
if [[ "${INSTALL_WIZARD_ARCHIVED:-false}" == true ]]; then
|
||||
pass "安装 API 已关闭（向导已锁定，/api/install/* 返回 403 为预期）"
|
||||
return 0
|
||||
fi
|
||||
local status env_json
|
||||
status="$(curl -sf "http://127.0.0.1:${PUBLISH_PORT}/api/install/status" 2>/dev/null || true)"
|
||||
if [[ -n "$status" ]]; then
|
||||
pass "/api/install/status → $status"
|
||||
if echo "$status" | grep -q '"installed":true'; then
|
||||
warn "installed=true — 向导已完成，请访问 /app/ 登录"
|
||||
fi
|
||||
else
|
||||
fail "/api/install/status 无响应"
|
||||
fi
|
||||
env_json="$(curl -sf "http://127.0.0.1:${PUBLISH_PORT}/api/install/env-check" 2>/dev/null || true)"
|
||||
if [[ -z "$env_json" ]]; then
|
||||
fail "/api/install/env-check 无响应"
|
||||
return 1
|
||||
fi
|
||||
if echo "$env_json" | grep -q 'docker_defaults'; then
|
||||
local db_host
|
||||
db_host="$(echo "$env_json" | python3 -c "
|
||||
import json,sys
|
||||
d=json.load(sys.stdin)
|
||||
print((d.get('docker_defaults') or {}).get('db_host',''))
|
||||
" 2>/dev/null || true)"
|
||||
if [[ -n "$db_host" && "$db_host" != "host.docker.internal" ]]; then
|
||||
pass "步骤 3 预填 db_host=$db_host"
|
||||
elif [[ "$db_host" == "host.docker.internal" ]]; then
|
||||
fail "步骤 3 仍预填 host.docker.internal"
|
||||
info "修复: nx update --no-cache（需 b25d079+）"
|
||||
fi
|
||||
else
|
||||
warn "env-check 无 docker_defaults（非 Docker 模式？）"
|
||||
fi
|
||||
if echo "$env_json" | grep -q '1Panel-mysql'; then
|
||||
pass "env-check MySQL 探测含 1Panel 容器名"
|
||||
elif echo "$env_json" | grep -q 'host.docker.internal'; then
|
||||
warn "env-check MySQL 仍指向 host.docker.internal"
|
||||
fi
|
||||
}
|
||||
|
||||
check_container_image_features() {
|
||||
[[ -n "${NEXUS_CONTAINER:-}" ]] || return 0
|
||||
local host_sha py_ok html_file html_ok host_root_ok
|
||||
host_sha="$(git -C "$NEXUS_ROOT" rev-parse --short HEAD 2>/dev/null || echo unknown)"
|
||||
pass "宿主机 Git: $host_sha"
|
||||
|
||||
if docker exec "$NEXUS_CONTAINER" grep -q '_host_deploy_root' /app/server/api/install.py 2>/dev/null; then
|
||||
pass "容器 install.py 含 host_deploy_root（round6+）"
|
||||
py_ok=1
|
||||
else
|
||||
warn "容器 install.py 较旧 — 需 nx update 重建镜像"
|
||||
fi
|
||||
|
||||
html_file="/app/web/app/install.html"
|
||||
if docker exec "$NEXUS_CONTAINER" test -f /app/web/app/install.html.bak 2>/dev/null; then
|
||||
html_file="/app/web/app/install.html.bak"
|
||||
fi
|
||||
if docker exec "$NEXUS_CONTAINER" grep -q 'install_ops_cron' "$html_file" 2>/dev/null; then
|
||||
pass "容器 install.html 含 Layer 3 cron 指引（round7+）"
|
||||
html_ok=1
|
||||
else
|
||||
warn "容器 install.html 较旧 — 需 nx update 重建镜像"
|
||||
fi
|
||||
|
||||
host_root_ok="$(docker exec "$NEXUS_CONTAINER" printenv NEXUS_HOST_ROOT 2>/dev/null || true)"
|
||||
if [[ -n "$host_root_ok" ]]; then
|
||||
pass "NEXUS_HOST_ROOT=$host_root_ok"
|
||||
else
|
||||
warn "容器未注入 NEXUS_HOST_ROOT — nx update 重建后可修复"
|
||||
fi
|
||||
|
||||
if [[ -n "${py_ok:-}" && -n "${html_ok:-}" ]]; then
|
||||
info "镜像与宿主机代码特性对齐（重建后验收）"
|
||||
else
|
||||
info "修复: cd $NEXUS_ROOT && sudo nx update"
|
||||
fi
|
||||
}
|
||||
|
||||
check_openresty_hint() {
|
||||
local domain code
|
||||
domain="$(grep -E '^NEXUS_API_BASE_URL=' "$ENV_PROD" 2>/dev/null | sed 's|.*https\?://||;s|/.*||' || echo api.synaglobal.vip)"
|
||||
code="$(curl -sk -o /dev/null -w '%{http_code}' --connect-timeout 5 "https://${domain}/health" 2>/dev/null || echo 000)"
|
||||
if [[ "$code" == "200" ]] && curl -sk "https://${domain}/health" 2>/dev/null | grep -q '^ok$'; then
|
||||
pass "HTTPS https://${domain}/health → ok"
|
||||
else
|
||||
warn "HTTPS https://${domain}/health → HTTP $code（外网可能未配 OpenResty 反代）"
|
||||
info "1Panel → 网站 → 反代 http://127.0.0.1:8600"
|
||||
info "参考: $NEXUS_ROOT/deploy/1panel/openresty-nexus.conf.example"
|
||||
fi
|
||||
}
|
||||
|
||||
print_next_steps() {
|
||||
local domain
|
||||
domain="$(grep -E '^NEXUS_API_BASE_URL=' "$ENV_PROD" 2>/dev/null | sed 's|.*https\?://||;s|/.*||' || echo '你的域名')"
|
||||
echo ""
|
||||
if [[ "${INSTALL_WIZARD_ARCHIVED:-false}" == true ]]; then
|
||||
echo "=========================================="
|
||||
echo " 已安装 — 日常运维"
|
||||
echo "=========================================="
|
||||
echo " 登录: https://${domain}/app/"
|
||||
echo " 更新: cd $NEXUS_ROOT && nx update"
|
||||
echo " 巡检 cron: sudo nx cron"
|
||||
echo " 手动备份: sudo bash $NEXUS_ROOT/deploy/db_backup.sh"
|
||||
echo " 验收: bash $NEXUS_ROOT/deploy/verify-1panel-install-wizard.sh"
|
||||
echo ""
|
||||
return 0
|
||||
fi
|
||||
echo "=========================================="
|
||||
echo " 安装向导后续步骤"
|
||||
echo "=========================================="
|
||||
echo "1. 1Panel 数据库 → 建库 nexus、用户 nexus（仅授权 nexus 库）"
|
||||
echo "2. 浏览器打开: https://${domain}/app/install.html"
|
||||
echo "3. 步骤 2：MySQL/Redis TCP 应显示 ✓（容器名:端口）"
|
||||
echo "4. 步骤 3：确认 db_host/redis_host 为 1Panel-mysql/redis-xxxx，填 MySQL 密码"
|
||||
echo "5. 步骤 4：连接检测全绿 → 创建 admin"
|
||||
echo "6. 步骤 5：锁定安装"
|
||||
echo ""
|
||||
if [[ "$FAILURES" -gt 0 ]]; then
|
||||
echo "先修复上方 [FAIL]，再执行:"
|
||||
echo " cd $NEXUS_ROOT && nx update --no-cache"
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
require_root
|
||||
echo "Nexus 1Panel 安装向导验收 — $(date -Iseconds)"
|
||||
echo "NEXUS_ROOT=$NEXUS_ROOT"
|
||||
echo ""
|
||||
|
||||
check_repo || true
|
||||
check_env_prod || true
|
||||
resolve_nexus_container || true
|
||||
check_1panel_network || true
|
||||
probe_from_container || true
|
||||
check_install_mode || true
|
||||
check_http_local || true
|
||||
check_install_api || true
|
||||
check_ops_cron || true
|
||||
check_mysql_backup || true
|
||||
check_container_image_features || true
|
||||
check_openresty_hint || true
|
||||
print_next_steps
|
||||
|
||||
if [[ "$FAILURES" -gt 0 ]]; then
|
||||
echo ""
|
||||
fail "合计 $FAILURES 项未通过"
|
||||
exit 1
|
||||
fi
|
||||
echo ""
|
||||
if [[ "${INSTALL_WIZARD_ARCHIVED:-false}" == true ]]; then
|
||||
pass "验收通过 — 安装已完成，请访问 /app/ 登录"
|
||||
if [[ "$WARNS" -gt 0 ]]; then
|
||||
warn "有 ${WARNS} 项 [WARN]（cron/备份等建议项，不阻断登录）"
|
||||
fi
|
||||
else
|
||||
pass "验收通过 — 可打开安装向导完成步骤 1–5"
|
||||
fi
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,96 +0,0 @@
|
||||
# Nexus 6.0 鈥?Docker Compose (dev / staging)
|
||||
# Usage:
|
||||
# cp docker/.env.example docker/.env # or: python docker/generate_env.py
|
||||
# docker compose --env-file docker/.env up -d --build
|
||||
# open http://localhost:18600/app/
|
||||
|
||||
name: nexus
|
||||
|
||||
services:
|
||||
mysql:
|
||||
image: mysql:8.4
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-nexus_root_dev}
|
||||
MYSQL_DATABASE: nexus
|
||||
MYSQL_USER: nexus
|
||||
MYSQL_PASSWORD: ${MYSQL_PASSWORD:-nexus_dev_pass}
|
||||
volumes:
|
||||
- mysql-data:/var/lib/mysql
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -uroot -p\"$$MYSQL_ROOT_PASSWORD\" || exit 1"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 8
|
||||
start_period: 40s
|
||||
ports:
|
||||
- "${MYSQL_PUBLISH_PORT:-13306}:3306"
|
||||
|
||||
redis:
|
||||
image: redis:7-alpine
|
||||
restart: unless-stopped
|
||||
command: ["redis-server", "--appendonly", "yes"]
|
||||
volumes:
|
||||
- redis-data:/data
|
||||
healthcheck:
|
||||
test: ["CMD", "redis-cli", "ping"]
|
||||
interval: 10s
|
||||
timeout: 3s
|
||||
retries: 8
|
||||
ports:
|
||||
- "${REDIS_PUBLISH_PORT:-16379}:6379"
|
||||
|
||||
nexus:
|
||||
build:
|
||||
context: .
|
||||
dockerfile: Dockerfile
|
||||
network: host
|
||||
args:
|
||||
DEBIAN_MIRROR: https://mirrors.aliyun.com/debian
|
||||
DEBIAN_SECURITY_MIRROR: https://mirrors.aliyun.com/debian-security
|
||||
PIP_INDEX_URL: https://mirrors.aliyun.com/pypi/simple/
|
||||
PIP_TRUSTED_HOST: mirrors.aliyun.com
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
mysql:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_healthy
|
||||
ports:
|
||||
- "${NEXUS_PUBLISH_PORT:-18600}:8600"
|
||||
environment:
|
||||
MYSQL_HOST: mysql
|
||||
MYSQL_PORT: "3306"
|
||||
REDIS_HOST: redis
|
||||
REDIS_PORT: "6379"
|
||||
NEXUS_PERSIST_DIR: /var/lib/nexus
|
||||
NEXUS_DOCKER_WRITE_ENV: "1"
|
||||
NEXUS_HOST: "0.0.0.0"
|
||||
NEXUS_PORT: "8600"
|
||||
NEXUS_DEPLOY_PATH: /app
|
||||
NEXUS_DATABASE_URL: mysql+aiomysql://nexus:${MYSQL_PASSWORD:-nexus_dev_pass}@mysql:3306/nexus
|
||||
NEXUS_REDIS_URL: redis://redis:6379/0
|
||||
NEXUS_CORS_ORIGINS: ${NEXUS_CORS_ORIGINS:-http://localhost:18600,http://127.0.0.1:18600,http://localhost:8600,http://127.0.0.1:8600}
|
||||
NEXUS_SECRET_KEY: ${NEXUS_SECRET_KEY:-}
|
||||
NEXUS_API_KEY: ${NEXUS_API_KEY:-}
|
||||
NEXUS_ENCRYPTION_KEY: ${NEXUS_ENCRYPTION_KEY:-}
|
||||
NEXUS_API_BASE_URL: ${NEXUS_API_BASE_URL:-http://localhost:18600}
|
||||
env_file:
|
||||
- path: docker/.env
|
||||
required: false
|
||||
volumes:
|
||||
- nexus-state:/var/lib/nexus
|
||||
- nexus-web-data:/app/web/data
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-sf", "http://127.0.0.1:8600/health"]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 90s
|
||||
|
||||
volumes:
|
||||
mysql-data:
|
||||
redis-data:
|
||||
nexus-state:
|
||||
nexus-web-data:
|
||||
|
||||
@@ -1,71 +0,0 @@
|
||||
# Nexus Docker
|
||||
|
||||
## 前置
|
||||
|
||||
- [Docker Desktop](https://www.docker.com/products/docker-desktop/)（Windows/macOS）或 Docker Engine + Compose v2
|
||||
|
||||
## 快速启动（正常模式）
|
||||
|
||||
```bash
|
||||
# 1. 生成密钥（写入 docker/.env，已 gitignore）
|
||||
python docker/generate_env.py
|
||||
|
||||
# 2. 构建并启动
|
||||
docker compose up -d --build
|
||||
|
||||
# 3. 健康检查
|
||||
curl -s http://localhost:8600/health # 期望: ok
|
||||
|
||||
# 4. 打开 SPA
|
||||
# http://localhost:8600/app/
|
||||
```
|
||||
|
||||
默认管理员需在安装向导或已有 DB 中配置；若 DB 为空且未跑过 install，可删卷后走安装模式。
|
||||
|
||||
## 安装向导模式
|
||||
|
||||
不创建 `docker/.env`（或清空 `NEXUS_SECRET_KEY`）时，应用以 **安装模式** 启动：
|
||||
|
||||
- http://localhost:8600/app/install.html
|
||||
|
||||
完成向导后 `.env` 会写入容器；`nexus-state` 卷会在重启时恢复配置。
|
||||
|
||||
## 常用命令
|
||||
|
||||
```bash
|
||||
docker compose logs -f nexus
|
||||
docker compose down # 停止，保留数据卷
|
||||
docker compose down -v # 停止并删除数据卷（清空 DB）
|
||||
docker compose build --no-cache nexus
|
||||
```
|
||||
|
||||
## 服务
|
||||
|
||||
| 环境 | Compose 服务 | 说明 |
|
||||
|------|-------------|------|
|
||||
| 本地开发 `docker-compose.yml` | nexus + mysql + redis | 一键本地联调 |
|
||||
| 生产 `docker-compose.prod.yml` | **仅 nexus** | MySQL/Redis 宿主机或 1Panel 自建 |
|
||||
|
||||
生产 1Panel：`docker/.env.prod` 可含 `NEXUS_REDIS_URL`（供 `nx update` 探测同步），**不经 Compose 注入容器**；运行时 Redis/MySQL URL 以安装向导写入的 `/app/.env`（`nexus-state` 卷）为准。MySQL `NEXUS_DATABASE_URL` 仅由向导步骤 3 写入。
|
||||
|
||||
## 生产注意
|
||||
|
||||
- 修改 `NEXUS_*` 为强密码；MySQL 使用自建库强密码。
|
||||
- 建议前置 Nginx/TLS，仅暴露 443。
|
||||
- 多实例部署需共享 MySQL、Redis；后台任务由 Redis primary lock 保证单实例执行。
|
||||
|
||||
### 1Panel 生产（Compose + OpenResty）
|
||||
|
||||
```bash
|
||||
cp docker/.env.prod.example docker/.env.prod # 从宝塔 .env 迁入密钥
|
||||
docker compose -f docker/docker-compose.prod.yml --env-file docker/.env.prod up -d --build
|
||||
```
|
||||
|
||||
- 镜像：`Dockerfile.prod`（含 `npm ci` + `vite build` + **`web/app/install.html` 安装向导**）
|
||||
- 仅绑定 `127.0.0.1:8600`；OpenResty 反代见 `deploy/1panel/openresty-nexus.conf.example`
|
||||
- **2C8G 调优**：`docker/profiles/2c8g.env`（`NEXUS_MEM_LIMIT` + `NEXUS_DB_POOL_SIZE=30`）；外置 MySQL 可参考 `docker/mysql-prod-2c8g.cnf` 手工调优
|
||||
- 完整迁移步骤：`docs/design/plans/2026-06-04-1panel-docker-production.md`
|
||||
- 一键安装：`bash deploy/install-1panel-docker.sh`
|
||||
- 一键升级：`bash deploy/upgrade-1panel-docker.sh`（`--check` 仅查更新）
|
||||
|
||||
详见 `docs/design/specs/2026-06-03-docker-design.md`。
|
||||
@@ -1,12 +0,0 @@
|
||||
# 1Panel overlay — join Nexus to 1panel-network (App Store MySQL/Redis use this network).
|
||||
# Applied automatically when `docker network inspect 1panel-network` succeeds (deploy/nexus-1panel.sh).
|
||||
|
||||
services:
|
||||
nexus:
|
||||
networks:
|
||||
- 1panel-network
|
||||
|
||||
networks:
|
||||
1panel-network:
|
||||
external: true
|
||||
name: 1panel-network
|
||||
@@ -1,61 +0,0 @@
|
||||
# Nexus 6.0 — production Compose (1Panel / bare Docker host)
|
||||
# MySQL / Redis 不在 Compose 内 — 请在宿主机或 1Panel 自行安装
|
||||
#
|
||||
# Usage:
|
||||
# bash deploy/nexus-1panel.sh install --profile 2c8g
|
||||
# docker compose -f docker/docker-compose.prod.yml \
|
||||
# --env-file docker/.env.prod --env-file docker/profiles/2c8g.env up -d --build
|
||||
#
|
||||
# OpenResty on host proxies https://api.synaglobal.vip → 127.0.0.1:8600
|
||||
|
||||
name: nexus-prod
|
||||
|
||||
services:
|
||||
nexus:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: Dockerfile.prod
|
||||
restart: unless-stopped
|
||||
extra_hosts:
|
||||
- "host.docker.internal:host-gateway"
|
||||
ports:
|
||||
- "127.0.0.1:${NEXUS_PUBLISH_PORT:-8600}:8600"
|
||||
environment:
|
||||
NEXUS_PERSIST_DIR: /var/lib/nexus
|
||||
NEXUS_DOCKER_WRITE_ENV: "1"
|
||||
NEXUS_HOST: "0.0.0.0"
|
||||
NEXUS_PORT: "8600"
|
||||
NEXUS_DEPLOY_PATH: /app
|
||||
NEXUS_HOST_ROOT: ${NEXUS_HOST_ROOT:-/opt/nexus}
|
||||
# Redis URL 仅来自 /app/.env（安装向导 + entrypoint export_app_env），勿在此注入以免覆盖密码
|
||||
NEXUS_1PANEL_DB_HOST: ${NEXUS_1PANEL_DB_HOST:-}
|
||||
NEXUS_1PANEL_REDIS_HOST: ${NEXUS_1PANEL_REDIS_HOST:-}
|
||||
NEXUS_CORS_ORIGINS: ${NEXUS_CORS_ORIGINS:?set NEXUS_CORS_ORIGINS}
|
||||
NEXUS_SECRET_KEY: ${NEXUS_SECRET_KEY:?set NEXUS_SECRET_KEY}
|
||||
NEXUS_API_KEY: ${NEXUS_API_KEY:?set NEXUS_API_KEY}
|
||||
NEXUS_ENCRYPTION_KEY: ${NEXUS_ENCRYPTION_KEY:?set NEXUS_ENCRYPTION_KEY}
|
||||
NEXUS_INSTALL_WIZARD_PENDING: ${NEXUS_INSTALL_WIZARD_PENDING:-0}
|
||||
NEXUS_API_BASE_URL: ${NEXUS_API_BASE_URL:?set NEXUS_API_BASE_URL}
|
||||
NEXUS_DB_POOL_SIZE: ${NEXUS_DB_POOL_SIZE:-30}
|
||||
NEXUS_DB_MAX_OVERFLOW: ${NEXUS_DB_MAX_OVERFLOW:-20}
|
||||
volumes:
|
||||
- nexus-state:/var/lib/nexus
|
||||
- nexus-web-data:/app/web/data
|
||||
mem_limit: ${NEXUS_MEM_LIMIT:-2g}
|
||||
cpus: ${NEXUS_CPUS:-1.5}
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "curl -sf http://127.0.0.1:8600/health | grep -q '^ok' || exit 1"]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 90s
|
||||
networks:
|
||||
- nexus-internal
|
||||
|
||||
networks:
|
||||
nexus-internal:
|
||||
driver: bridge
|
||||
|
||||
volumes:
|
||||
nexus-state:
|
||||
nexus-web-data:
|
||||
@@ -1,175 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Nexus Docker entrypoint — wait for deps, sync .env with persistent volume, exec uvicorn.
|
||||
set -eu
|
||||
|
||||
PERSIST_DIR="${NEXUS_PERSIST_DIR:-/var/lib/nexus}"
|
||||
PERSIST_ENV="${PERSIST_DIR}/.env"
|
||||
|
||||
wait_tcp() {
|
||||
host="$1"
|
||||
port="$2"
|
||||
echo "entrypoint: waiting for ${host}:${port}..."
|
||||
until python3 -c "
|
||||
import socket
|
||||
s = socket.socket()
|
||||
s.settimeout(2)
|
||||
s.connect(('${host}', ${port}))
|
||||
s.close()
|
||||
" 2>/dev/null; do
|
||||
sleep 2
|
||||
done
|
||||
}
|
||||
|
||||
wait_tcp_optional() {
|
||||
host="$1"
|
||||
port="$2"
|
||||
tries="${3:-15}"
|
||||
label="${4:-service}"
|
||||
echo "entrypoint: waiting for ${label} ${host}:${port} (max ${tries} tries)..."
|
||||
n=0
|
||||
while [ "$n" -lt "$tries" ]; do
|
||||
if python3 -c "
|
||||
import socket
|
||||
s = socket.socket()
|
||||
s.settimeout(2)
|
||||
s.connect(('${host}', ${port}))
|
||||
s.close()
|
||||
" 2>/dev/null; then
|
||||
echo "entrypoint: ${label} ready at ${host}:${port}"
|
||||
return 0
|
||||
fi
|
||||
n=$((n + 1))
|
||||
sleep 2
|
||||
done
|
||||
echo "entrypoint: warn — ${label} not reachable at ${host}:${port}; install on host or set URL in .env"
|
||||
return 0
|
||||
}
|
||||
|
||||
restore_persisted_install_lock() {
|
||||
if [ "${NEXUS_INSTALL_WIZARD_PENDING:-0}" = "1" ]; then
|
||||
return 0
|
||||
fi
|
||||
PERSIST_LOCK="${PERSIST_DIR}/.install_locked"
|
||||
if [ -f "${PERSIST_LOCK}" ] && [ ! -f /app/.install_locked ]; then
|
||||
cp "${PERSIST_LOCK}" /app/.install_locked
|
||||
chmod 600 /app/.install_locked
|
||||
echo "entrypoint: restored .install_locked from ${PERSIST_LOCK}"
|
||||
fi
|
||||
}
|
||||
|
||||
archive_install_wizard_if_locked() {
|
||||
if [ "${NEXUS_INSTALL_WIZARD_PENDING:-0}" = "1" ]; then
|
||||
rm -f /app/.install_locked "${PERSIST_DIR}/.install_locked" 2>/dev/null || true
|
||||
if [ -f /app/web/app/install.html.bak ] && [ ! -f /app/web/app/install.html ]; then
|
||||
mv /app/web/app/install.html.bak /app/web/app/install.html
|
||||
echo "entrypoint: restored install.html from .bak (wizard pending)"
|
||||
fi
|
||||
return 0
|
||||
fi
|
||||
if [ ! -f /app/.install_locked ] && [ ! -f "${PERSIST_DIR}/.install_locked" ]; then
|
||||
return 0
|
||||
fi
|
||||
if [ -f /app/web/app/install.html.bak ]; then
|
||||
if [ -f /app/web/app/install.html ]; then
|
||||
rm -f /app/web/app/install.html
|
||||
echo "entrypoint: removed install.html (wizard archived as install.html.bak)"
|
||||
fi
|
||||
return 0
|
||||
fi
|
||||
if [ -f /app/web/app/install.html ]; then
|
||||
mv /app/web/app/install.html /app/web/app/install.html.bak
|
||||
echo "entrypoint: archived install.html → install.html.bak"
|
||||
fi
|
||||
}
|
||||
|
||||
restore_persisted_env() {
|
||||
if [ "${NEXUS_INSTALL_WIZARD_PENDING:-0}" = "1" ]; then
|
||||
return 0
|
||||
fi
|
||||
if [ ! -f "${PERSIST_ENV}" ]; then
|
||||
return 0
|
||||
fi
|
||||
if ! grep -q '^NEXUS_DATABASE_URL=' "${PERSIST_ENV}" 2>/dev/null; then
|
||||
echo "entrypoint: warn — ${PERSIST_ENV} missing NEXUS_DATABASE_URL; skip restore (complete install wizard)"
|
||||
return 0
|
||||
fi
|
||||
cp "${PERSIST_ENV}" /app/.env
|
||||
chmod 600 /app/.env
|
||||
echo "entrypoint: restored .env from ${PERSIST_ENV}"
|
||||
}
|
||||
|
||||
# Compose may inject placeholder NEXUS_REDIS_URL (no password). Wizard .env wins.
|
||||
export_app_env() {
|
||||
if [ ! -f /app/.env ]; then
|
||||
return 0
|
||||
fi
|
||||
set -a
|
||||
# shellcheck disable=SC1091
|
||||
. /app/.env
|
||||
set +a
|
||||
echo "entrypoint: exported NEXUS_* from /app/.env (overrides Compose placeholders)"
|
||||
}
|
||||
|
||||
write_env_from_environment() {
|
||||
if [ -f /app/.env ]; then
|
||||
return 0
|
||||
fi
|
||||
if [ "${NEXUS_DOCKER_WRITE_ENV:-}" != "1" ]; then
|
||||
return 0
|
||||
fi
|
||||
if [ -z "${NEXUS_SECRET_KEY:-}" ]; then
|
||||
return 0
|
||||
fi
|
||||
if [ "${NEXUS_INSTALL_WIZARD_PENDING:-}" = "1" ]; then
|
||||
echo "entrypoint: install wizard pending — skip writing /app/.env"
|
||||
return 0
|
||||
fi
|
||||
if [ -z "${NEXUS_DATABASE_URL:-}" ]; then
|
||||
echo "entrypoint: skip writing /app/.env — NEXUS_DATABASE_URL not set (use /app/install.html)"
|
||||
return 0
|
||||
fi
|
||||
mkdir -p "${PERSIST_DIR}"
|
||||
{
|
||||
echo "# Generated by docker/entrypoint.sh — do not commit"
|
||||
env | grep '^NEXUS_' | sort
|
||||
} > /app/.env
|
||||
chmod 600 /app/.env
|
||||
cp /app/.env "${PERSIST_ENV}"
|
||||
echo "entrypoint: wrote .env from container environment"
|
||||
}
|
||||
|
||||
persist_state_on_exit() {
|
||||
if [ -f /app/.env ]; then
|
||||
mkdir -p "${PERSIST_DIR}"
|
||||
cp /app/.env "${PERSIST_ENV}"
|
||||
chmod 600 "${PERSIST_ENV}" 2>/dev/null || true
|
||||
fi
|
||||
if [ -f /app/.install_locked ]; then
|
||||
mkdir -p "${PERSIST_DIR}"
|
||||
cp /app/.install_locked "${PERSIST_DIR}/.install_locked"
|
||||
chmod 600 "${PERSIST_DIR}/.install_locked" 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
trap persist_state_on_exit EXIT INT TERM
|
||||
|
||||
# MySQL / Redis 均由用户自行安装在宿主机；安装向导阶段不阻塞启动
|
||||
if [ "${NEXUS_INSTALL_WIZARD_PENDING:-0}" != "1" ] && [ "${NEXUS_SKIP_MYSQL_WAIT:-0}" != "1" ]; then
|
||||
MYSQL_HOST="${NEXUS_1PANEL_DB_HOST:-${MYSQL_HOST:-host.docker.internal}}"
|
||||
MYSQL_PORT="${MYSQL_PORT:-3306}"
|
||||
wait_tcp_optional "${MYSQL_HOST}" "${MYSQL_PORT}" 30 "MySQL"
|
||||
fi
|
||||
|
||||
if [ "${NEXUS_INSTALL_WIZARD_PENDING:-0}" != "1" ] && [ "${NEXUS_SKIP_REDIS_WAIT:-0}" != "1" ]; then
|
||||
REDIS_HOST="${NEXUS_1PANEL_REDIS_HOST:-${REDIS_HOST:-host.docker.internal}}"
|
||||
REDIS_PORT="${REDIS_PORT:-6379}"
|
||||
wait_tcp_optional "${REDIS_HOST}" "${REDIS_PORT}" 15 "Redis"
|
||||
fi
|
||||
|
||||
restore_persisted_install_lock
|
||||
archive_install_wizard_if_locked
|
||||
restore_persisted_env
|
||||
write_env_from_environment
|
||||
export_app_env
|
||||
|
||||
exec "$@"
|
||||
@@ -1,40 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Generate docker/.env with random secrets for local Compose."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import sys
|
||||
from pathlib import Path
|
||||
|
||||
ROOT = Path(__file__).resolve().parent.parent
|
||||
if str(ROOT) not in sys.path:
|
||||
sys.path.insert(0, str(ROOT))
|
||||
|
||||
from scripts.generate_nexus_secrets import ( # noqa: E402
|
||||
generate_nexus_secrets,
|
||||
write_env_prod,
|
||||
)
|
||||
|
||||
OUT = ROOT / "docker" / ".env"
|
||||
EXAMPLE = ROOT / "docker" / ".env.example"
|
||||
|
||||
|
||||
def main() -> None:
|
||||
if OUT.exists():
|
||||
raise SystemExit(f"Refusing to overwrite existing {OUT} — delete it first.")
|
||||
|
||||
secrets_map = generate_nexus_secrets()
|
||||
write_env_prod(
|
||||
EXAMPLE,
|
||||
OUT,
|
||||
domain="localhost",
|
||||
secrets_map=secrets_map,
|
||||
profile_env=None,
|
||||
wizard_pending=False,
|
||||
)
|
||||
print(f"Wrote {OUT}")
|
||||
print("Next: docker compose up -d --build")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -1,20 +0,0 @@
|
||||
# MySQL 8.4 — Nexus production tuning for 1 vCPU / 4 GiB host (minimal)
|
||||
|
||||
[mysqld]
|
||||
character-set-server = utf8mb4
|
||||
collation-server = utf8mb4_unicode_ci
|
||||
|
||||
innodb_buffer_pool_size = 512M
|
||||
innodb_log_file_size = 128M
|
||||
|
||||
max_connections = 80
|
||||
|
||||
innodb_read_io_threads = 2
|
||||
innodb_write_io_threads = 2
|
||||
|
||||
table_open_cache = 1000
|
||||
tmp_table_size = 32M
|
||||
max_heap_table_size = 32M
|
||||
|
||||
[client]
|
||||
default-character-set = utf8mb4
|
||||
@@ -1,25 +0,0 @@
|
||||
# MySQL 8.4 — Nexus production tuning for 2 vCPU / 8 GiB host
|
||||
# Mounted by docker/docker-compose.prod.yml (see docs/design/plans/2026-06-04-1panel-docker-production.md)
|
||||
|
||||
[mysqld]
|
||||
character-set-server = utf8mb4
|
||||
collation-server = utf8mb4_unicode_ci
|
||||
|
||||
# ~1 GiB for InnoDB (leave RAM for Nexus, Redis, 1Panel, OS)
|
||||
innodb_buffer_pool_size = 1024M
|
||||
innodb_log_file_size = 256M
|
||||
|
||||
# Nexus async pool default 30+20; leave headroom for admin/migrations
|
||||
max_connections = 120
|
||||
|
||||
# 2 vCPU: avoid aggressive IO threads
|
||||
innodb_read_io_threads = 4
|
||||
innodb_write_io_threads = 4
|
||||
|
||||
# Sensible defaults on small VMs
|
||||
table_open_cache = 2000
|
||||
tmp_table_size = 64M
|
||||
max_heap_table_size = 64M
|
||||
|
||||
[client]
|
||||
default-character-set = utf8mb4
|
||||
@@ -1,20 +0,0 @@
|
||||
# MySQL 8.4 — Nexus production tuning for 4 vCPU / 16 GiB host
|
||||
|
||||
[mysqld]
|
||||
character-set-server = utf8mb4
|
||||
collation-server = utf8mb4_unicode_ci
|
||||
|
||||
innodb_buffer_pool_size = 4096M
|
||||
innodb_log_file_size = 512M
|
||||
|
||||
max_connections = 200
|
||||
|
||||
innodb_read_io_threads = 8
|
||||
innodb_write_io_threads = 8
|
||||
|
||||
table_open_cache = 4000
|
||||
tmp_table_size = 128M
|
||||
max_heap_table_size = 128M
|
||||
|
||||
[client]
|
||||
default-character-set = utf8mb4
|
||||
@@ -1,5 +0,0 @@
|
||||
# Host profile: 1 vCPU / 4 GiB
|
||||
NEXUS_MEM_LIMIT=1g
|
||||
NEXUS_CPUS=1
|
||||
NEXUS_DB_POOL_SIZE=15
|
||||
NEXUS_DB_MAX_OVERFLOW=10
|
||||
@@ -1,5 +0,0 @@
|
||||
# Host profile: 2 vCPU / 8 GiB — default production
|
||||
NEXUS_MEM_LIMIT=2g
|
||||
NEXUS_CPUS=1.5
|
||||
NEXUS_DB_POOL_SIZE=30
|
||||
NEXUS_DB_MAX_OVERFLOW=20
|
||||
@@ -1,5 +0,0 @@
|
||||
# Host profile: 4 vCPU / 16 GiB
|
||||
NEXUS_MEM_LIMIT=4g
|
||||
NEXUS_CPUS=3
|
||||
NEXUS_DB_POOL_SIZE=50
|
||||
NEXUS_DB_MAX_OVERFLOW=30
|
||||
@@ -1,85 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Write project-root .env from docker/.env for host uvicorn (127.0.0.1 MySQL/Redis)."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import sys
|
||||
from pathlib import Path
|
||||
from urllib.parse import quote_plus
|
||||
|
||||
ROOT = Path(__file__).resolve().parent.parent
|
||||
if str(ROOT) not in sys.path:
|
||||
sys.path.insert(0, str(ROOT))
|
||||
|
||||
from server.utils.text_io import read_utf8_lf, write_utf8_lf
|
||||
DOCKER_ENV = ROOT / "docker" / ".env"
|
||||
OUT = ROOT / ".env"
|
||||
|
||||
|
||||
def _parse(path: Path) -> dict[str, str]:
|
||||
data: dict[str, str] = {}
|
||||
for line in read_utf8_lf(path).splitlines():
|
||||
line = line.strip()
|
||||
if not line or line.startswith("#") or "=" not in line:
|
||||
continue
|
||||
key, _, value = line.partition("=")
|
||||
data[key.strip()] = value.strip()
|
||||
return data
|
||||
|
||||
|
||||
def main() -> None:
|
||||
if not DOCKER_ENV.exists():
|
||||
raise SystemExit(f"Missing {DOCKER_ENV} — run: python3 docker/generate_env.py")
|
||||
|
||||
d = _parse(DOCKER_ENV)
|
||||
mysql_pass = d.get("MYSQL_PASSWORD", "")
|
||||
if not mysql_pass:
|
||||
raise SystemExit("MYSQL_PASSWORD missing in docker/.env")
|
||||
|
||||
for key in ("NEXUS_SECRET_KEY", "NEXUS_API_KEY", "NEXUS_ENCRYPTION_KEY"):
|
||||
if not d.get(key):
|
||||
raise SystemExit(f"{key} missing in docker/.env — run generate_env.py")
|
||||
|
||||
db_user = "nexus"
|
||||
db_pass_q = quote_plus(mysql_pass)
|
||||
deploy = str(ROOT)
|
||||
cors = d.get("NEXUS_CORS_ORIGINS", "http://localhost:8600,http://127.0.0.1:8600")
|
||||
api_base = d.get("NEXUS_API_BASE_URL", "http://localhost:8600")
|
||||
|
||||
lines = [
|
||||
"# Nexus .env — host uvicorn dev (from docker/sync_root_env.py)",
|
||||
"",
|
||||
"NEXUS_HOST=0.0.0.0",
|
||||
"NEXUS_PORT=8600",
|
||||
f"NEXUS_DEPLOY_PATH={deploy}",
|
||||
f"NEXUS_CORS_ORIGINS={cors}",
|
||||
f"NEXUS_API_BASE_URL={api_base}",
|
||||
"",
|
||||
f"NEXUS_DATABASE_URL=mysql+aiomysql://{db_user}:{db_pass_q}@127.0.0.1:3306/nexus",
|
||||
"NEXUS_DB_POOL_SIZE=20",
|
||||
"NEXUS_DB_MAX_OVERFLOW=10",
|
||||
"",
|
||||
f"NEXUS_SECRET_KEY={d['NEXUS_SECRET_KEY']}",
|
||||
f"NEXUS_API_KEY={d['NEXUS_API_KEY']}",
|
||||
f"NEXUS_ENCRYPTION_KEY={d['NEXUS_ENCRYPTION_KEY']}",
|
||||
"",
|
||||
"NEXUS_REDIS_URL=redis://127.0.0.1:6379/0",
|
||||
"NEXUS_SSH_STRICT_HOST_CHECKING=false",
|
||||
"",
|
||||
"# MySQL MCP (optional): python3 scripts/sync_mysql_mcp_env.py",
|
||||
"MYSQL_HOST=127.0.0.1",
|
||||
"MYSQL_PORT=3306",
|
||||
f"MYSQL_USER={db_user}",
|
||||
f"MYSQL_PASSWORD={mysql_pass}",
|
||||
"MYSQL_DATABASE=nexus",
|
||||
"MYSQL_READONLY=false",
|
||||
"MYSQL_DATABASE_ALLOWLIST=nexus",
|
||||
]
|
||||
|
||||
write_utf8_lf(OUT, "\n".join(lines) + "\n")
|
||||
OUT.chmod(0o600)
|
||||
print(f"Wrote {OUT}")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -0,0 +1,733 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="zh-CN">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width,initial-scale=1.0">
|
||||
<title>Nexus 6.0 — 功能说明书</title>
|
||||
<style>
|
||||
*{box-sizing:border-box;margin:0;padding:0}
|
||||
body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;background:#0f172a;color:#e2e8f0;line-height:1.6}
|
||||
a{color:#60a5fa;text-decoration:none}
|
||||
a:hover{text-decoration:underline}
|
||||
|
||||
/* Layout */
|
||||
.wrap{max-width:960px;margin:0 auto;padding:32px 24px 80px}
|
||||
|
||||
/* Header */
|
||||
.hero{text-align:center;padding:48px 0 40px;border-bottom:1px solid #1e293b;margin-bottom:40px}
|
||||
.hero h1{font-size:2.2rem;font-weight:700;color:#f8fafc;letter-spacing:-0.02em}
|
||||
.hero .sub{font-size:1rem;color:#64748b;margin-top:8px}
|
||||
.badge{display:inline-block;margin:4px;padding:3px 10px;border-radius:999px;font-size:0.72rem;font-weight:600}
|
||||
.badge-blue{background:#1e3a5f;color:#60a5fa;border:1px solid #2563eb55}
|
||||
.badge-green{background:#14371f;color:#4ade80;border:1px solid #16a34a55}
|
||||
.badge-amber{background:#3d2a00;color:#fbbf24;border:1px solid #d9770655}
|
||||
.badge-red{background:#3b1212;color:#f87171;border:1px solid #dc262655}
|
||||
|
||||
/* TOC */
|
||||
.toc{background:#1e293b;border:1px solid #334155;border-radius:12px;padding:20px 24px;margin-bottom:36px}
|
||||
.toc h2{font-size:0.85rem;font-weight:700;color:#94a3b8;text-transform:uppercase;letter-spacing:.08em;margin-bottom:12px}
|
||||
.toc ol{padding-left:18px;column-count:2;column-gap:24px}
|
||||
.toc li{margin:5px 0;font-size:0.88rem}
|
||||
|
||||
/* Section */
|
||||
.section{margin-bottom:48px}
|
||||
.section-title{font-size:1.4rem;font-weight:700;color:#f1f5f9;padding-bottom:10px;border-bottom:2px solid #334155;margin-bottom:24px;display:flex;align-items:center;gap:10px}
|
||||
.section-title .icon{font-size:1.2rem}
|
||||
|
||||
/* Card */
|
||||
.card{background:#1e293b;border:1px solid #334155;border-radius:12px;padding:24px;margin-bottom:16px}
|
||||
.card-title{font-size:1.05rem;font-weight:600;color:#f1f5f9;margin-bottom:6px;display:flex;align-items:center}
|
||||
.card-title .num{display:inline-flex;align-items:center;justify-content:center;width:22px;height:22px;border-radius:50%;background:#334155;font-size:0.7rem;font-weight:700;color:#94a3b8;margin-right:8px;shrink:0}
|
||||
.card-desc{color:#94a3b8;font-size:0.88rem;margin-bottom:14px}
|
||||
|
||||
/* Info rows */
|
||||
.info-grid{display:grid;grid-template-columns:1fr;gap:10px}
|
||||
.info-block{border-radius:8px;padding:12px 14px}
|
||||
.info-block.usage{background:#0f2d1f;border:1px solid #166534}
|
||||
.info-block.warn{background:#2a1a00;border:1px solid #92400e}
|
||||
.info-block.note{background:#1a1f2e;border:1px solid #4338ca}
|
||||
.info-title{font-size:0.72rem;font-weight:700;text-transform:uppercase;letter-spacing:.08em;margin-bottom:6px}
|
||||
.info-title.u{color:#4ade80}
|
||||
.info-title.w{color:#fbbf24}
|
||||
.info-title.n{color:#818cf8}
|
||||
.info-block ul{padding-left:16px;font-size:0.86rem;color:#cbd5e1}
|
||||
.info-block li{margin:4px 0}
|
||||
.info-block p{font-size:0.86rem;color:#cbd5e1}
|
||||
|
||||
/* Sub table */
|
||||
.feat-table{width:100%;border-collapse:collapse;font-size:0.86rem;margin-top:10px}
|
||||
.feat-table th{text-align:left;color:#64748b;font-weight:600;font-size:0.75rem;text-transform:uppercase;padding:6px 10px;border-bottom:1px solid #334155}
|
||||
.feat-table td{padding:7px 10px;border-bottom:1px solid #1e293b;color:#cbd5e1;vertical-align:top}
|
||||
.feat-table tr:last-child td{border-bottom:none}
|
||||
|
||||
/* Footer */
|
||||
footer{text-align:center;color:#334155;font-size:0.8rem;margin-top:60px;padding-top:24px;border-top:1px solid #1e293b}
|
||||
code{background:#334155;color:#7dd3fc;padding:2px 6px;border-radius:4px;font-size:0.83em;font-family:monospace}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div class="wrap">
|
||||
|
||||
<!-- HERO -->
|
||||
<div class="hero">
|
||||
<h1>⚡ Nexus 6.0</h1>
|
||||
<p class="sub">服务器运维管理平台 — 全站功能说明书 · 2026-05-23</p>
|
||||
<p class="sub" style="margin-top:10px;font-size:0.85rem">
|
||||
Markdown 维护版：<code>docs/project/nexus-full-site-features.md</code> ·
|
||||
AI 接续：<code>docs/project/AI-HANDOFF-2026-05-23.md</code>
|
||||
</p>
|
||||
<div style="margin-top:14px">
|
||||
<span class="badge badge-blue">FastAPI</span>
|
||||
<span class="badge badge-blue">SQLAlchemy 2.0</span>
|
||||
<span class="badge badge-blue">Redis 7</span>
|
||||
<span class="badge badge-blue">asyncssh</span>
|
||||
<span class="badge badge-blue">Tailwind v4</span>
|
||||
<span class="badge badge-green">2000+ 服务器</span>
|
||||
<span class="badge badge-green">JWT + TOTP</span>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- TOC -->
|
||||
<div class="toc">
|
||||
<h2>目录</h2>
|
||||
<ol>
|
||||
<li><a href="#sitemap">全站页面地图</a></li>
|
||||
<li><a href="#network">网络与通道</a></li>
|
||||
<li><a href="#auth">认证与访问控制</a></li>
|
||||
<li><a href="#dashboard">仪表盘</a></li>
|
||||
<li><a href="#alerts">告警中心</a></li>
|
||||
<li><a href="#servers">服务器管理</a></li>
|
||||
<li><a href="#assets">资产管理</a></li>
|
||||
<li><a href="#webssh">Web SSH</a></li>
|
||||
<li><a href="#commands">命令与推送日志</a></li>
|
||||
<li><a href="#push">批量文件推送</a></li>
|
||||
<li><a href="#scripts">脚本与执行历史</a></li>
|
||||
<li><a href="#files">远程文件管理</a></li>
|
||||
<li><a href="#schedules">定时调度</a></li>
|
||||
<li><a href="#credentials">凭据管理</a></li>
|
||||
<li><a href="#retries">重试队列</a></li>
|
||||
<li><a href="#search">全局搜索</a></li>
|
||||
<li><a href="#settings">系统设置</a></li>
|
||||
<li><a href="#audit">审计日志</a></li>
|
||||
<li><a href="#install">安装向导</a></li>
|
||||
<li><a href="#guardian">3 层守护</a></li>
|
||||
<li><a href="#agent">子机 Agent</a></li>
|
||||
<li><a href="#background">后台任务</a></li>
|
||||
<li><a href="#acceptance">开发验收标准</a></li>
|
||||
<li><a href="#notimpl">未实现 / 已否决</a></li>
|
||||
</ol>
|
||||
</div>
|
||||
|
||||
<!-- 0. SITEMAP -->
|
||||
<div class="section" id="sitemap">
|
||||
<div class="section-title"><span class="icon">🗺</span> 全站页面地图（18 页）</div>
|
||||
<div class="card">
|
||||
<table class="feat-table">
|
||||
<tr><th>页面</th><th>路径</th><th>功能</th></tr>
|
||||
<tr><td>安装向导</td><td><code>/app/install.html</code></td><td>无 .env 时安装中心机</td></tr>
|
||||
<tr><td>登录</td><td><code>/app/login.html</code></td><td>JWT + TOTP + 防暴破</td></tr>
|
||||
<tr><td>仪表盘</td><td><code>/app/index.html</code></td><td>统计、WS 刷新统计</td></tr>
|
||||
<tr><td>服务器</td><td><code>/app/servers.html</code></td><td>CRUD、Agent 安装/升级、漂移徽章</td></tr>
|
||||
<tr><td>资产管理</td><td><code>/app/assets.html</code></td><td>Platform / Node</td></tr>
|
||||
<tr><td>文件管理</td><td><code>/app/files.html</code></td><td>SSH 浏览与文件操作</td></tr>
|
||||
<tr><td>推送</td><td><code>/app/push.html</code></td><td>rsync 批量 + dry-run</td></tr>
|
||||
<tr><td>脚本库</td><td><code>/app/scripts.html</code></td><td>脚本 CRUD、直接执行</td></tr>
|
||||
<tr><td>执行历史</td><td><code>/app/script-executions.html</code></td><td>停止/重试/日志</td></tr>
|
||||
<tr><td>凭据</td><td><code>/app/credentials.html</code></td><td>DB 凭据 + 密码预设</td></tr>
|
||||
<tr><td>定时调度</td><td><code>/app/schedules.html</code></td><td>Cron 推送或脚本</td></tr>
|
||||
<tr><td>重试队列</td><td><code>/app/retries.html</code></td><td>推送失败重试</td></tr>
|
||||
<tr><td>命令日志</td><td><code>/app/commands.html</code></td><td>WebSSH 命令 + 推送日志</td></tr>
|
||||
<tr><td>告警中心</td><td><code>/app/alerts.html</code></td><td>告警历史与统计</td></tr>
|
||||
<tr><td>审计</td><td><code>/app/audit.html</code></td><td>操作审计、多维过滤</td></tr>
|
||||
<tr><td>设置</td><td><code>/app/settings.html</code></td><td>阈值、Telegram、白名单、TOTP</td></tr>
|
||||
<tr><td>WebSSH</td><td><code>/app/terminal.html</code></td><td>xterm 终端</td></tr>
|
||||
</table>
|
||||
<p class="card-desc" style="margin-top:12px">共享：<code>layout.js</code>（侧栏/移动适配）、<code>api.js</code>（JWT、toast、全局搜索）</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- NETWORK -->
|
||||
<div class="section" id="network">
|
||||
<div class="section-title"><span class="icon">🔌</span> 网络与通道模型</div>
|
||||
<div class="card">
|
||||
<table class="feat-table">
|
||||
<tr><th>方向</th><th>端口</th><th>用途</th><th>必须</th></tr>
|
||||
<tr><td>子机 → 中心</td><td><strong>443 出站</strong></td><td>Agent 心跳、长任务 curl 回调</td><td>✅</td></tr>
|
||||
<tr><td>中心 → 子机</td><td><strong>22 入站</strong></td><td>推送、文件、脚本、健康检查、Agent 安装</td><td>✅</td></tr>
|
||||
<tr><td>子机本机</td><td><code>127.0.0.1:8601</code></td><td>Agent HTTP（可不暴露公网）</td><td>可选</td></tr>
|
||||
</table>
|
||||
<div class="info-block note" style="margin-top:12px"><div class="info-title n">说明</div><p>脚本执行与手动健康检查已改走 <strong>SSH</strong>，不依赖公网 8601。宝塔环境请用系统 Python 3.12 + <code>install.sh</code> venv，勿用面板 Python 项目管理器托管 Agent。</p></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 1. AUTH -->
|
||||
<div class="section" id="auth">
|
||||
<div class="section-title"><span class="icon">🔒</span> 1. 认证与访问控制</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> JWT 登录 + 自动刷新</div>
|
||||
<p class="card-desc">管理员通过用户名+密码登录，获取 Access Token（30 分钟）和 Refresh Token（7 天）。前端到期前 2 分钟自动换新 Token，无感续期。</p>
|
||||
<div class="info-grid">
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>访问 <code>/app/login.html</code>，输入管理员账号密码</li>
|
||||
<li>Token 存于 <code>localStorage</code>，关闭浏览器后 7 天内免登录</li>
|
||||
<li>8 小时无操作自动退出</li>
|
||||
</ul></div>
|
||||
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
|
||||
<li>JWT 存于 localStorage，XSS 漏洞可能导致 Token 泄露（已做 CSP 缓解）</li>
|
||||
<li>无 RBAC：只有一个管理员角色，鉴权即信任</li>
|
||||
<li>不支持多管理员角色区分</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">2</span> TOTP 双因素认证</div>
|
||||
<p class="card-desc">可选启用 Google Authenticator 兼容的 TOTP。登录时先验密码，再验 6 位动态码（30 秒窗口）。</p>
|
||||
<div class="info-grid">
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>进入「设置」→「安全设置」→ 启用 / <strong>重新绑定</strong> TOTP，扫描二维码</li>
|
||||
<li>禁用 TOTP 需同时提供当前密码 + TOTP 码</li>
|
||||
</ul></div>
|
||||
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
|
||||
<li>TOTP 秘钥丢失无法恢复，需提前备份</li>
|
||||
<li>系统时间偏差 >30s 会导致验证失败（接受 ±1 窗口共 90s）</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">3</span> 登录防暴破</div>
|
||||
<p class="card-desc">同一 IP + 用户名 15 分钟内失败 5 次，账号自动锁定并返回 HTTP 429。</p>
|
||||
<div class="info-block note"><div class="info-title n">注意</div><p>锁定基于 IP + 用户名组合，更换 IP 可绕过。适合防自动化爆破，不防分布式攻击。</p></div>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">4</span> 登录 IP 白名单</div>
|
||||
<p class="card-desc">可在设置中开启「仅允许白名单 IP 登录」。支持手动 IP/CIDR，以及从<strong>代理订阅 URL</strong>解析节点 IP（每 2 小时自动刷新，与手动列表合并）。</p>
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>「设置」→「登录 IP 白名单」→ 总开关 + 订阅地址 + 手动 IP</li>
|
||||
<li>非白名单 IP 登录被拒绝并记审计</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 2. DASHBOARD -->
|
||||
<div class="section" id="dashboard">
|
||||
<div class="section-title"><span class="icon">📊</span> 2. 仪表盘与实时告警</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> 实时统计面板</div>
|
||||
<p class="card-desc">首页展示服务器总数、在线数、离线数、告警中台数、最近推送记录。数据来源 Redis（实时）+ MySQL（历史），通过 WebSocket 触发刷新。</p>
|
||||
<div class="info-grid">
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>在线状态取自 Redis <code>heartbeat:{id}</code>，子机 60s 上报一次</li>
|
||||
<li>告警计数 = Redis <code>alerts:*</code> key 数量</li>
|
||||
<li>WS 断线会自动重连（3 次指数退避）</li>
|
||||
</ul></div>
|
||||
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
|
||||
<li>在线状态最多滞后 60s（子机心跳间隔）</li>
|
||||
<li>Redis 不可用时统计退化为 MySQL 数据，可能不准</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">2</span> 告警通知（Telegram）</div>
|
||||
<p class="card-desc">CPU / 内存 / 磁盘超过阈值（默认 80%）时，通过 Telegram Bot 推送告警；恢复后发送恢复通知。同服务器同指标 5 分钟内不重复推送。</p>
|
||||
<div class="info-grid">
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>「设置」配置 <code>TELEGRAM_BOT_TOKEN</code> + <code>TELEGRAM_CHAT_ID</code></li>
|
||||
<li>阈值可在设置页调整（CPU/内存/磁盘各独立）</li>
|
||||
<li>浏览器仪表盘<strong>只显示计数，不弹窗、不响铃</strong>（设计决策）</li>
|
||||
</ul></div>
|
||||
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
|
||||
<li>浏览器仪表盘不弹告警列表；历史见「告警中心」页</li>
|
||||
<li>Telegram Bot 被封或网络不通时告警静默失败（有日志）</li>
|
||||
<li>告警防抖 key 存于进程内存，重启后防抖状态重置</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- ALERTS -->
|
||||
<div class="section" id="alerts">
|
||||
<div class="section-title"><span class="icon">🔔</span> 告警中心</div>
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> 告警历史（alerts.html）</div>
|
||||
<p class="card-desc">将 CPU/内存/磁盘告警与恢复事件持久化到 <code>alert_logs</code>，支持分页、按服务器/类型/日期筛选，以及近 7 日统计图表数据。</p>
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>侧栏「告警中心」查看历史列表</li>
|
||||
<li>API：<code>GET /api/alert-history/</code>、<code>GET /api/alert-history/stats</code></li>
|
||||
</ul></div>
|
||||
</div>
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">2</span> 分项 Telegram 开关</div>
|
||||
<p class="card-desc">设置页可单独关闭某类告警的 Telegram 推送（告警/恢复/系统/时钟漂移等），便于后续扩展通道。</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 3. SERVERS -->
|
||||
<div class="section" id="servers">
|
||||
<div class="section-title"><span class="icon">🖥</span> 3. 服务器管理</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> 服务器 CRUD</div>
|
||||
<p class="card-desc">增删改查服务器配置，支持 SSH 密钥 / 密码双认证，可按平台类型（Platform）和节点（Node 树）分组。</p>
|
||||
<div class="info-grid">
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>新增服务器：填写名称、域名/IP、SSH 端口、认证方式</li>
|
||||
<li>认证方式选「密钥」时粘贴私钥内容，自动 Fernet 加密存储</li>
|
||||
<li>支持 <code>platform_id</code> / <code>node_id</code> 分组归类</li>
|
||||
<li>服务器列表分页显示（默认 50 条/页）</li>
|
||||
</ul></div>
|
||||
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
|
||||
<li>批量导入（CSV）未实现，2000 台需逐一或通过 API 批量添加</li>
|
||||
<li>删除服务器同时删除关联推送日志（CASCADE）</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">2</span> 健康检查</div>
|
||||
<p class="card-desc">手动触发 <code>POST /api/servers/check</code>：经 <strong>SSH</strong> 执行 Python 采集 CPU/内存/磁盘（<code>remote_probe</code>），<strong>不需要</strong>公网 8601。</p>
|
||||
<div class="info-block note"><div class="info-title n">与在线状态区别</div><p>列表「在线」主要来自 Agent <strong>443 心跳</strong>；健康检查用于即时 SSH 探活与指标快照。</p></div>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">4</span> Agent 安装与升级</div>
|
||||
<p class="card-desc">服务器详情「Agent 安装」：复制 <code>install.sh</code> 命令或一键 SSH 安装（带日志）；安装后轮询在线。升级通过 SSH 拉取最新 <code>agent.py</code> 并 restart。</p>
|
||||
<div class="info-block warn"><div class="info-title w">注意</div><ul>
|
||||
<li>安装脚本：Python 3.12 venv、监听 <code>127.0.0.1:8601</code>，无需公网放行 8601</li>
|
||||
<li>时钟漂移：心跳带 <code>agent_time</code>，列表显示 warn/crit 徽章</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">3</span> 每服务器 API Key</div>
|
||||
<p class="card-desc">为每台服务器单独生成 Agent API Key（格式 <code>nxs-xxx</code>），用于该服务器子机与中心通信的专属认证。</p>
|
||||
<div class="info-grid">
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>服务器详情 → 「生成 Agent Key」，完整 Key 仅本次显示，立即复制到子机 <code>config.json</code></li>
|
||||
<li>列表页只显示前 8 位用于识别</li>
|
||||
</ul></div>
|
||||
<div class="info-block warn"><div class="info-title w">注意</div><ul>
|
||||
<li>Key 生成后无法再次查看（一次性展示设计）</li>
|
||||
<li>丢失需重新生成并更新子机配置</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- ASSETS -->
|
||||
<div class="section" id="assets">
|
||||
<div class="section-title"><span class="icon">🗂</span> 资产管理</div>
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> Platform 与 Node</div>
|
||||
<p class="card-desc"><code>assets.html</code> 管理资产类型模板（Platform）与树形节点（Node），服务器表单可关联分组。</p>
|
||||
<p class="card-desc">API：<code>/api/assets/platforms</code>、<code>/api/assets/nodes</code>（含 tree）</p>
|
||||
</div>
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">2</span> SSH 会话与命令（只读查询）</div>
|
||||
<p class="card-desc">同页或「命令日志」可查询 <code>ssh_sessions</code>、<code>command_logs</code>（WebSSH 产生）。</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 4. WEB SSH -->
|
||||
<div class="section" id="webssh">
|
||||
<div class="section-title"><span class="icon">💻</span> 4. Web SSH 终端</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> 浏览器终端</div>
|
||||
<p class="card-desc">基于 xterm.js + asyncssh，在浏览器内打开远程服务器 SSH 会话，支持全屏、自动 resize、彩色输出。</p>
|
||||
<div class="info-grid">
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>服务器列表点击「终端」→ 弹出 <code>/app/terminal.html?server_id=X</code></li>
|
||||
<li>认证：先获取短效 webssh-token（15 分钟），绑定到该服务器，再建 WebSocket</li>
|
||||
<li>支持窗口 resize 自动通知远程 shell</li>
|
||||
</ul></div>
|
||||
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
|
||||
<li>Token 通过 URL 参数传递（?token=...），HTTPS 下安全；HTTP 下有风险</li>
|
||||
<li>不支持文件上传 / 拖拽（需用文件管理页）</li>
|
||||
<li>会话不录像（已明确否决）</li>
|
||||
<li>网络中断 WebSocket 不会自动重连，需刷新页面</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
<!-- COMMANDS -->
|
||||
<div class="section" id="commands">
|
||||
<div class="section-title"><span class="icon">💻</span> 命令与推送日志</div>
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> WebSSH 会话与命令</div>
|
||||
<p class="card-desc"><code>commands.html</code>：会话列表、命令列表（危险命令高亮）、按服务器过滤。数据来自 WebSSH，直接 SSH 不记录。</p>
|
||||
</div>
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">2</span> 推送日志</div>
|
||||
<p class="card-desc">同页「推送日志」Tab：rsync 批量推送历史，支持服务器/状态/同步模式/触发方式过滤与分页。</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 5. PUSH -->
|
||||
<div class="section" id="push">
|
||||
<div class="section-title"><span class="icon">📤</span> 5. 批量文件推送</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> rsync 批量推送</div>
|
||||
<p class="card-desc">将源目录通过 rsync-over-SSH 推送到选定的服务器列表，支持 4 种同步模式，内置分批（50 台/批）并发（10 路）控制。</p>
|
||||
<table class="feat-table">
|
||||
<tr><th>同步模式</th><th>rsync 参数</th><th>适用场景</th></tr>
|
||||
<tr><td>增量同步</td><td><code>-az</code></td><td>日常更新，只同步有变动的文件</td></tr>
|
||||
<tr><td>全量同步</td><td><code>-az --delete</code></td><td>强制目标与源完全一致，会删除目标多余文件</td></tr>
|
||||
<tr><td>校验和</td><td><code>-az --checksum</code></td><td>按文件内容而非时间戳判断差异</td></tr>
|
||||
<tr><td>直接覆盖</td><td><code>-az --inplace</code></td><td>不用临时文件，直接覆盖（大文件节省空间）</td></tr>
|
||||
</table>
|
||||
<div class="info-grid" style="margin-top:12px">
|
||||
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
|
||||
<li><strong>全量同步（--delete）会不可逆删除</strong>目标目录多余文件，务必先「预览」</li>
|
||||
<li>rsync 在中心机运行，中心机需能 SSH 到所有子机</li>
|
||||
<li>失败的服务器自动加入重试队列（指数退避，最多 100 次）</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">2</span> 推送前预览（dry-run）</div>
|
||||
<p class="card-desc">选中全量/覆盖模式时，页面显示橙色警告，引导先对首台服务器运行 <code>rsync --dry-run --stats</code>，查看待传输/删除文件数量后再决定是否推送。</p>
|
||||
<div class="info-grid">
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>选择「全量同步」→ 出现橙色预览按钮 → 点击 → 展示首台服务器变动摘要</li>
|
||||
<li>可展开「详细文件列表」（最多 200 行）</li>
|
||||
<li>预览不阻塞推送，看完数据自行决定是否点「开始推送」</li>
|
||||
</ul></div>
|
||||
<div class="info-block warn"><div class="info-title w">注意</div><ul>
|
||||
<li>仅预览第一台选中的服务器，其余服务器可能略有差异</li>
|
||||
<li>预览需 SSH 连通，与真实推送消耗相同时间（通常 <5s）</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">3</span> 失败自动重试队列</div>
|
||||
<p class="card-desc">推送失败的服务器自动进入 <code>push_retry_jobs</code> 队列，后台每 5 分钟按指数退避重试（60s → 120s → 240s...，最大 64 分钟）。</p>
|
||||
<div class="info-block note"><div class="info-title n">注意</div><p>最多重试 100 次。可在「重试」页手动强制立即重试或删除任务。</p></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 6. SCRIPTS -->
|
||||
<div class="section" id="scripts">
|
||||
<div class="section-title"><span class="icon">📜</span> 脚本与执行历史</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> 脚本库管理</div>
|
||||
<p class="card-desc">维护可复用 Shell 脚本库（按 ops/deploy/check/cleanup 分类），一键下发到选定的服务器。</p>
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>「脚本」页 → 新建脚本 → 填写名称/类别/内容</li>
|
||||
<li>点击脚本名 → 编辑；点击「执行」→ 选择服务器 → 运行</li>
|
||||
<li>支持直接输入临时命令（无需保存到库）</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">2</span> 批量执行（短任务 / 长任务）</div>
|
||||
<p class="card-desc">短任务：同步等待结果（默认 30s 超时）。长任务：nohup 后台运行，完成后 curl 回调中心记录结果。</p>
|
||||
<div class="info-grid">
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>选择服务器 → 填写命令 → 「执行」</li>
|
||||
<li>执行走 <strong>SSH 22</strong>（结果含 <code>channel: ssh</code>），无需子机公网 8601</li>
|
||||
<li>长任务：nohup + 子机 curl 回调中心（需 HTTPS <code>NEXUS_API_BASE_URL</code>）</li>
|
||||
<li>「执行历史」页：停止 / 重试 / 标记卡住 / 拉取 nexus-job 日志</li>
|
||||
</ul></div>
|
||||
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
|
||||
<li><code>rm -rf /</code> 等危险命令被中心<strong>拦截（400）</strong>，但仅匹配预设规则</li>
|
||||
<li>长任务依赖子机能访问中心 <code>NEXUS_API_BASE_URL</code>（必须配置且使用 HTTPS）</li>
|
||||
<li>执行历史默认保留 2 小时 Redis 热数据，60s 刷入 MySQL</li>
|
||||
<li>执行命令时密码等敏感 $DB_* 变量存储时已脱敏（替换为 ***）</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">3</span> $DB_* 数据库凭据替换</div>
|
||||
<p class="card-desc">脚本中使用 <code>$DB_USER</code> / <code>$DB_PASS</code> / <code>$DB_HOST</code> / <code>$DB_PORT</code> / <code>$DB_NAME</code> 占位符，执行时自动替换为选定的数据库凭据，密码不出现在脚本文本或日志中。</p>
|
||||
<div class="info-block note"><div class="info-title n">注意</div><p>替换在中心机完成后发往子机，子机接收到的已是明文命令；传输通过 HTTPS，子机侧无加密保护。</p></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 7. FILES -->
|
||||
<div class="section" id="files">
|
||||
<div class="section-title"><span class="icon">📁</span> 7. 远程文件管理</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> 目录浏览</div>
|
||||
<p class="card-desc">通过 SSH exec（<code>ls -la</code>）浏览指定服务器的远程目录，支持面包屑导航和目录点击进入。</p>
|
||||
<div class="info-grid">
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>「文件管理」→ 选服务器 → 输入路径 → 「浏览」（或按 Enter）</li>
|
||||
<li>点击目录名进入子目录，点击「..」返回上级</li>
|
||||
<li>文件按 目录优先 / 字母顺序 排列</li>
|
||||
</ul></div>
|
||||
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
|
||||
<li>无左侧树状面板（每次需手动导航）</li>
|
||||
<li>显示的文件大小为 <code>ls</code> 输出的字节数，大文件不友好</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">2</span> 文件操作（删除/重命名/新建目录）</div>
|
||||
<p class="card-desc">鼠标悬停文件/目录行显示操作按钮，通过 SSH exec 在远程执行操作。</p>
|
||||
<table class="feat-table">
|
||||
<tr><th>操作</th><th>命令</th><th>触发方式</th></tr>
|
||||
<tr><td>删除文件</td><td><code>rm -f path</code></td><td>悬停 → 🗑 → confirm 弹窗</td></tr>
|
||||
<tr><td>删除目录</td><td><code>rm -rf path</code></td><td>悬停 → 🗑 → 额外警告弹窗</td></tr>
|
||||
<tr><td>重命名</td><td><code>mv src dst</code></td><td>悬停 → ✏ → prompt 输入新名</td></tr>
|
||||
<tr><td>新建目录</td><td><code>mkdir -p path</code></td><td>右上角 📁+ → prompt 输入名</td></tr>
|
||||
</table>
|
||||
<div class="info-block warn" style="margin-top:10px"><div class="info-title w">缺点 / 注意</div><ul>
|
||||
<li>删除目录（rm -rf）<strong>不可恢复</strong>，浏览器弹窗确认无法替代真正的安全保障</li>
|
||||
<li>无文件编辑器（已明确否决，用 WebSSH vim/nano 代替）</li>
|
||||
<li>无文件上传功能（可用 SFTP API 或 WebSSH scp）</li>
|
||||
<li>无文件内容预览</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 8. SCHEDULES -->
|
||||
<div class="section" id="schedules">
|
||||
<div class="section-title"><span class="icon">⏰</span> 8. 定时调度</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> Cron 调度（推送 + 脚本）</div>
|
||||
<p class="card-desc">支持两种 <code>schedule_type</code>：<strong>文件推送</strong> 或 <strong>脚本执行</strong>。5 字段 Cron，后台每 60s 检查（仅 Primary Worker）。</p>
|
||||
<div class="info-grid">
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>「定时」→ 选类型 → 填 Cron、目标服务器</li>
|
||||
<li>脚本型：选脚本库 ID 或内联内容，可设超时与长任务</li>
|
||||
<li>示例：<code>0 2 * * *</code> = 每天凌晨 2 点</li>
|
||||
</ul></div>
|
||||
<div class="info-block warn"><div class="info-title w">注意</div><ul>
|
||||
<li>Cron 精度受 60s 检查间隔限制</li>
|
||||
<li>脚本调度同样走 SSH 执行通道</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- RETRIES -->
|
||||
<div class="section" id="retries">
|
||||
<div class="section-title"><span class="icon">🔄</span> 重试队列</div>
|
||||
<div class="card">
|
||||
<p class="card-desc"><code>retries.html</code> 管理推送失败任务：<code>retry_runner</code> 每 5 分钟指数退避；可手动立即重试或删除。</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- SEARCH -->
|
||||
<div class="section" id="search">
|
||||
<div class="section-title"><span class="icon">🔍</span> 全局搜索</div>
|
||||
<div class="card">
|
||||
<p class="card-desc">侧栏搜索框调用 <code>GET /api/search/</code>，跨服务器、脚本、凭据、定时任务关键字匹配。</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 9. CREDENTIALS -->
|
||||
<div class="section" id="credentials">
|
||||
<div class="section-title"><span class="icon">🔑</span> 9. 凭据管理</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> 数据库凭据</div>
|
||||
<p class="card-desc">存储 MySQL/PostgreSQL 连接信息，密码 Fernet 加密，API 响应不含密码（仅元数据）。供脚本执行时通过 $DB_* 变量引用。</p>
|
||||
<div class="info-block warn"><div class="info-title w">注意</div><p>凭据只加密存储，子机接收到的命令已含明文连接信息（仅在中心→子机的 HTTPS 传输中受保护）。</p></div>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">2</span> 密码预设</div>
|
||||
<p class="card-desc">存储 SSH 密码模板（Fernet 加密），可在推送配置中引用，避免重复输入常用密码。</p>
|
||||
<div class="info-block note"><div class="info-title n">注意</div><p>密码预设不能用于脚本 $DB_PASS 替换，只用于推送密码模板。</p></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 10. SETTINGS -->
|
||||
<div class="section" id="settings">
|
||||
<div class="section-title"><span class="icon">⚙️</span> 10. 系统设置</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> 可配置项</div>
|
||||
<table class="feat-table">
|
||||
<tr><th>设置项</th><th>说明</th><th>是否可改</th></tr>
|
||||
<tr><td>系统名称 / 标题</td><td>品牌展示名称</td><td>✅ 可改</td></tr>
|
||||
<tr><td>告警阈值（CPU/内存/磁盘）</td><td>超过阈值触发 Telegram 告警，默认 80%</td><td>✅ 可改</td></tr>
|
||||
<tr><td>Redis URL</td><td>Redis 连接地址</td><td>✅ 可改</td></tr>
|
||||
<tr><td>数据库连接池大小</td><td>pool_size / max_overflow</td><td>✅ 可改</td></tr>
|
||||
<tr><td>Telegram Bot Token / Chat ID</td><td>告警推送配置</td><td>✅ 可改</td></tr>
|
||||
<tr><td>SECRET_KEY / API_KEY / ENCRYPTION_KEY</td><td>核心安全密钥</td><td>❌ 不可改（需改 .env 重启）</td></tr>
|
||||
<tr><td>DATABASE_URL</td><td>数据库连接</td><td>❌ 不可改</td></tr>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">2</span> Telegram</div>
|
||||
<p class="card-desc">配置 Bot Token / Chat ID；<strong>测试发送</strong>；通过 getUpdates <strong>检测 Chat ID</strong>；各告警类型独立开关。</p>
|
||||
</div>
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">3</span> TOTP 与 API Key</div>
|
||||
<p class="card-desc">TOTP 启用/禁用/<strong>重新绑定</strong>；全局 API Key 需密码二次验证后查看（记审计）。</p>
|
||||
</div>
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">4</span> 登录 IP 白名单</div>
|
||||
<p class="card-desc">总开关、订阅 URL（2h 刷新）、手动 IP、解析预览（见「认证」章节）。</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 11. AUDIT -->
|
||||
<div class="section" id="audit">
|
||||
<div class="section-title"><span class="icon">📋</span> 11. 审计日志</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> 操作审计</div>
|
||||
<p class="card-desc">所有 CUD 操作（创建/更新/删除服务器、推送、执行脚本、登录、改密码等）自动写入 <code>audit_logs</code>，记录操作人、IP、目标、详情。</p>
|
||||
<div class="info-grid">
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>「审计」页：日期起止、管理员用户名、操作类型（分组下拉）</li>
|
||||
<li>每页 50 条分页</li>
|
||||
</ul></div>
|
||||
<div class="info-block warn"><div class="info-title w">缺点 / 注意</div><ul>
|
||||
<li>无日志导出（已否决 CSV/JSON）</li>
|
||||
<li>审计日志不会自动清理，长期需归档</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 12. INSTALL -->
|
||||
<div class="section" id="install">
|
||||
<div class="section-title"><span class="icon">🚀</span> 12. 安装向导</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> 5 步安装向导</div>
|
||||
<p class="card-desc">无 <code>.env</code> 文件时系统进入安装模式，访问 <code>/app/install.html</code> 完成 5 步配置：欢迎 → 数据库 → Redis → 管理员账号 → 完成。自动生成 API Key / Secret Key / Encryption Key。</p>
|
||||
<div class="info-grid">
|
||||
<div class="info-block usage"><div class="info-title u">使用说明</div><ul>
|
||||
<li>安装完成后 <code>.env</code> 自动生成，安装 API 除 GET /status 外全部锁定（返回 403）</li>
|
||||
<li>重装需手动删除 <code>.env</code> 并重启</li>
|
||||
</ul></div>
|
||||
<div class="info-block warn"><div class="info-title w">注意</div><ul>
|
||||
<li>安装过程未验证数据库/Redis 连接成功才允许进入下一步（应在步骤中手动验证）</li>
|
||||
<li>安装模式下除 install API 和静态文件外，其余 API 返回 503</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 13. GUARDIAN -->
|
||||
<div class="section" id="guardian">
|
||||
<div class="section-title"><span class="icon">🛡</span> 13. 三层守护机制</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> 三层守护</div>
|
||||
<table class="feat-table">
|
||||
<tr><th>层级</th><th>机制</th><th>触发条件</th><th>动作</th></tr>
|
||||
<tr><td>Layer 1</td><td>Supervisor</td><td>Python 进程崩溃</td><td>自动重启</td></tr>
|
||||
<tr><td>Layer 2</td><td>Python self_monitor（30s）</td><td>Redis/MySQL 不可达</td><td>发 Telegram 告警/恢复</td></tr>
|
||||
<tr><td>Layer 3</td><td>Shell cron（1 分钟）</td><td>连续 3 次 /health 失败</td><td>supervisorctl restart + Telegram</td></tr>
|
||||
</table>
|
||||
<div class="info-block warn" style="margin-top:10px"><div class="info-title w">注意</div><p>Shell cron 依赖宝塔/系统 crontab 配置，部署时需手动添加定时任务。</p></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 14. AGENT -->
|
||||
<div class="section" id="agent">
|
||||
<div class="section-title"><span class="icon">🤖</span> 14. 子机 Agent</div>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="num">1</span> Agent 功能</div>
|
||||
<p class="card-desc">部署在每台被管服务器上的轻量服务：<strong>心跳走 443 出站</strong>；HTTP 仅本机 <code>127.0.0.1:8601</code>。中心侧脚本已改 <strong>SSH</strong>，/exec 端点保留供兼容。</p>
|
||||
<table class="feat-table">
|
||||
<tr><th>能力</th><th>说明</th></tr>
|
||||
<tr><td>心跳</td><td>POST 中心 <code>/api/agent/heartbeat</code>，写 Redis，智能加急</td></tr>
|
||||
<tr><td>时钟漂移</td><td><code>agent_time</code> 与中心比对，warn/crit + Telegram</td></tr>
|
||||
<tr><td>IP 白名单</td><td><code>allowed_ips</code> 限制访问本机 Agent HTTP</td></tr>
|
||||
<tr><td>长任务回调</td><td>POST <code>/api/agent/script-callback</code></td></tr>
|
||||
<tr><td>安装</td><td><code>web/agent/install.sh</code> — python3.12 venv + systemd</td></tr>
|
||||
</table>
|
||||
<div class="info-block warn" style="margin-top:12px"><div class="info-title w">注意</div><ul>
|
||||
<li>升级 API 存在，建议与 venv 安装脚本对齐后使用</li>
|
||||
<li>长任务回调需子机出站访问中心 HTTPS</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- BACKGROUND -->
|
||||
<div class="section" id="background">
|
||||
<div class="section-title"><span class="icon">⚙</span> 后台任务（Primary Worker）</div>
|
||||
<div class="card">
|
||||
<table class="feat-table">
|
||||
<tr><th>任务</th><th>间隔</th><th>说明</th></tr>
|
||||
<tr><td>heartbeat_flush</td><td>10min</td><td>Redis 心跳 → MySQL</td></tr>
|
||||
<tr><td>self_monitor</td><td>30s</td><td>Redis/MySQL/WS 自检 + Telegram</td></tr>
|
||||
<tr><td>schedule_runner</td><td>60s</td><td>Cron 调度</td></tr>
|
||||
<tr><td>retry_runner</td><td>5min</td><td>推送重试</td></tr>
|
||||
<tr><td>ip_allowlist_refresh</td><td>2h</td><td>订阅 IP 刷新</td></tr>
|
||||
<tr><td>script_execution_flush</td><td>60s</td><td>执行记录 Redis→MySQL</td></tr>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- ACCEPTANCE -->
|
||||
<div class="section" id="acceptance">
|
||||
<div class="section-title"><span class="icon">✅</span> 标准与验收（与团队同等严谨）</div>
|
||||
<div class="card">
|
||||
<p class="card-desc"><strong>全量标准转接</strong>：<code>docs/project/standards-transfer-package.md</code> — 含 Cursor 规则、<code>standards/</code> 三件套、逐行八步 DoD、设计/上线清单。下一任 AI <strong>不得降低</strong>执行力度。</p>
|
||||
<table class="feat-table">
|
||||
<tr><th>类别</th><th>权威路径</th></tr>
|
||||
<tr><td>标准转接包</td><td><code>docs/project/standards-transfer-package.md</code></td></tr>
|
||||
<tr><td>验收 L0～L5</td><td><code>development-acceptance-standard.md</code></td></tr>
|
||||
<tr><td>系统开发</td><td><code>standards/system-development-standard.md</code></td></tr>
|
||||
<tr><td>逐行审计 v2</td><td><code>standards/line-walk-audit-standard-v2.md</code></td></tr>
|
||||
<tr><td>审计原则</td><td><code>standards/audit-core-principles.md</code></td></tr>
|
||||
<tr><td>Cursor</td><td><code>.cursor/rules/*.mdc</code>（含 audit-line-review）</td></tr>
|
||||
</table>
|
||||
<p class="card-desc" style="margin-top:12px">逐行审查：8 步/文件、Closure 全表含 SAFE、FINDING 必须 <code>文件:行号</code>、单回复 ≤5 文件。AI 接续：HANDOFF + 全站功能 + 标准转接包。</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 15. NOT IMPL -->
|
||||
<div class="section" id="notimpl">
|
||||
<div class="section-title"><span class="icon">🚫</span> 15. 未实现 / 已否决功能</div>
|
||||
|
||||
<div class="card">
|
||||
<table class="feat-table">
|
||||
<tr><th>功能</th><th>状态</th><th>原因 / 替代方案</th></tr>
|
||||
<tr><td>文件编辑器（Monaco/ACE）</td><td><span class="badge badge-red">已否决</span></td><td>运维场景用 WebSSH + vim/nano；嵌入编辑器增加复杂度无实质收益</td></tr>
|
||||
<tr><td>会话录像（asciicast）</td><td><span class="badge badge-red">已否决</span></td><td>命令日志已满足审计需求</td></tr>
|
||||
<tr><td>RBAC 权限体系</td><td><span class="badge badge-red">已否决</span></td><td>鉴权即信任，单管理员模型；增加 RBAC 代价远超收益</td></tr>
|
||||
<tr><td>移动端适配</td><td><span class="badge badge-red">已否决</span></td><td>2000 台服务器运维不会用手机操作</td></tr>
|
||||
<tr><td>批量服务器导入（CSV）</td><td><span class="badge badge-amber">未实现</span></td><td>可通过 API 批量 POST /api/servers/ 实现</td></tr>
|
||||
<tr><td>文件上传到远程服务器</td><td><span class="badge badge-amber">未实现</span></td><td>可用 WebSSH scp / 推送功能代替</td></tr>
|
||||
<tr><td>文件内容预览</td><td><span class="badge badge-amber">未实现</span></td><td>可通过 WebSSH cat 查看</td></tr>
|
||||
<tr><td>WebSSH 断线自动重连</td><td><span class="badge badge-amber">未实现</span></td><td>当前需刷新页面；计划自动重试+按钮</td></tr>
|
||||
<tr><td>仪表盘历史趋势图</td><td><span class="badge badge-amber">未实现</span></td><td>仅实时 Redis 指标</td></tr>
|
||||
<tr><td>宝塔 API 监控集成</td><td><span class="badge badge-amber">未实现</span></td><td>可选；参考 btpanel-skills</td></tr>
|
||||
<tr><td>Agent mTLS</td><td><span class="badge badge-amber">讨论中</span></td><td>未实现</td></tr>
|
||||
<tr><td>首次部署 E2E（T1～T5、T-SE）</td><td><span class="badge badge-amber">待验证</span></td><td>见 production-verification-checklist.md</td></tr>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- FOOTER -->
|
||||
<footer>
|
||||
<p>Nexus 6.0 全站功能说明书 · 2026-05-23（对齐代码库）</p>
|
||||
<p style="margin-top:6px">
|
||||
<a href="project/nexus-full-site-features.md">全站功能</a> ·
|
||||
<a href="project/standards-transfer-package.md">标准转接</a> ·
|
||||
<a href="project/development-acceptance-standard.md">验收标准</a> ·
|
||||
<a href="project/AI-HANDOFF-2026-05-23.md">AI 接续</a>
|
||||
</p>
|
||||
<p style="margin-top:4px">Python 3.12 / FastAPI 0.115 / MySQL 8.4 / Redis 7 / asyncssh 2.17 / Tailwind v4</p>
|
||||
</footer>
|
||||
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
+110
-72
@@ -1,87 +1,125 @@
|
||||
# Nexus 文档索引
|
||||
|
||||
> 更新: 2026-06-04 · **唯一导航入口**
|
||||
> 最后更新: 2026-06-01
|
||||
|
||||
---
|
||||
|
||||
## 1. 活跃 SSOT（日常必读）
|
||||
|
||||
| 文档 | 说明 |
|
||||
|------|------|
|
||||
| [project/nexus-functional-development-guide.md](project/nexus-functional-development-guide.md) | 功能 / API / 14 页 / 部署 |
|
||||
| [project/nexus-functional-development-guide-appendix.md](project/nexus-functional-development-guide-appendix.md) | sync 端点、调用链、E2E 对照 |
|
||||
| [project/AI-HANDOFF-2026-06-03.md](project/AI-HANDOFF-2026-06-03.md) | **当前** 会话接续（复制提示词） |
|
||||
| [project/development-acceptance-standard.md](project/development-acceptance-standard.md) | 验收 L0–L5 |
|
||||
| [project/local-integration-test.md](project/local-integration-test.md) | `bash scripts/local_verify.sh` |
|
||||
| [project/linux-dev-paths.md](project/linux-dev-paths.md) | Linux 路径 |
|
||||
| [project/risk-acceptance-single-operator.md](project/risk-acceptance-single-operator.md) | 单人运维风险接受 |
|
||||
| [project/script-execution.md](project/script-execution.md) | 脚本执行 |
|
||||
| [project/alert-push-policy.md](project/alert-push-policy.md) | 告警策略 |
|
||||
| [project/deploy.md](project/deploy.md) | 部署补充（宝塔/裸机） |
|
||||
| [project/nexus-1panel-operations-knowledge.md](project/nexus-1panel-operations-knowledge.md) | **1Panel + Docker 运维知识 SSOT** |
|
||||
| [project/nexus-god-menu-audit-summary.md](project/nexus-god-menu-audit-summary.md) | **nx 上帝菜单巡检归档**（2026-06-06 round1–10） |
|
||||
| [project/production-verification-checklist.md](project/production-verification-checklist.md) | L5 清单 |
|
||||
|
||||
根目录 [AGENTS.md](../AGENTS.md) · [CLAUDE.md](../CLAUDE.md) · [.cursorrules](../.cursorrules) 为薄入口。
|
||||
|
||||
---
|
||||
|
||||
## 2. 变更与审计
|
||||
|
||||
| 目录 | 说明 |
|
||||
|------|------|
|
||||
| [changelog/](changelog/) | 每次代码变更（**不归档、不合并**）· [INDEX](changelog/INDEX.md) |
|
||||
| [audit/](audit/) | 门控用审计 · [INDEX](audit/INDEX.md) · `2026-06-04-bug-scan-registry.json` |
|
||||
|
||||
---
|
||||
|
||||
## 3. 活跃报告（`reports/`）
|
||||
|
||||
## project/ — 项目概况
|
||||
| 文件 | 说明 |
|
||||
|------|------|
|
||||
| [audit-plugin-run-final-2026-06-04.md](reports/audit-plugin-run-final-2026-06-04.md) | 插件审计总验收 |
|
||||
| [audit-frontend-14p-2026-06-04-closure.md](reports/audit-frontend-14p-2026-06-04-closure.md) | 前端 14 页 closure |
|
||||
| [audit-phase-4-plugin-closure-2026-06-04.md](reports/audit-phase-4-plugin-closure-2026-06-04.md) | Phase4 收尾 |
|
||||
| [2026-06-01-production-verification.md](reports/2026-06-01-production-verification.md) | 生产验证（待更新 L5） |
|
||||
| [2026-06-01-final-acceptance-checklist.md](reports/2026-06-01-final-acceptance-checklist.md) | 终验清单 |
|
||||
| `project/status.md` | 项目进度总览 + 数据库结构 + 实施进度 |
|
||||
| `project/roadmap.md` | 功能规划 + ADR架构决策(11项) + 技术债务 |
|
||||
| `project/deploy.md` | 部署指南 (Ubuntu 20-24, Nginx+Supervisor) |
|
||||
| **`project/phase-2-audit-remediation.md`** | **Phase 2 审计修复总览（开发 SSOT）** |
|
||||
| **`project/wsl-integration-test.md`** | **WSL 代码验证**（venv → 启动 → smoke，不审 key） |
|
||||
| `project/production-verification-checklist.md` | 首次部署验证清单（逐项勾选） |
|
||||
| `project/alert-push-policy.md` | 告警推送产品策略 + 数据流 |
|
||||
| `project/script-execution.md` | 脚本批量执行平台 SSOT |
|
||||
| `project/audit-line-review-cursor-rule.md` | 逐行走读 Cursor 规则 |
|
||||
| `project/line-walk-audit-standard.md` | 逐行走读判定标准 |
|
||||
| `project/mysql-mcp-setup.md` | Cursor MySQL MCP 安装与 `.env` 同步 |
|
||||
| `project/tech-stack-inventory.md` | 技术栈清单 + 连接池参数对齐 + v1勘误 |
|
||||
|
||||
批量 batch 报告 → [archive/audits/](archive/audits/) 合并卷。
|
||||
## design/ — 设计规格与实施计划
|
||||
|
||||
---
|
||||
|
||||
## 4. 测试（全站用例 SSOT）
|
||||
|
||||
| 文档 | 说明 |
|
||||
### 活跃设计
|
||||
| 文件 | 说明 |
|
||||
|------|------|
|
||||
| [testing/test-case-matrix.md](testing/test-case-matrix.md) | **152 条** UT/IT/CH/E2E/MCP 编号用例 |
|
||||
| [testing/mcp-browser-playbook.md](testing/mcp-browser-playbook.md) | Agent Playwright MCP 点页规程 |
|
||||
| [design/specs/2026-06-08-full-site-testing-strategy-design.md](design/specs/2026-06-08-full-site-testing-strategy-design.md) | 四层金字塔设计 |
|
||||
| [design/plans/2026-06-08-full-site-testing-strategy.md](design/plans/2026-06-08-full-site-testing-strategy.md) | 分阶段实施计划 |
|
||||
| `design/specs/design-standards.md` | **设计标准** — 安全模型/性能基线/代码规范/架构模式 |
|
||||
| `design/specs/2026-05-18-redis-iot-optimization.md` | Redis+实时数据架构 + Key规范 |
|
||||
| `design/specs/2026-05-17-architecture-optimization.md` | 配置分发与部署架构 |
|
||||
| `design/specs/2026-05-19-sprint-planning.md` | Sprint规划 — 已完成升级项 + 待实现建议 |
|
||||
| `design/tech-stack-evaluation.md` | 技术栈评估 + 风险矩阵 + 连接池配置 |
|
||||
|
||||
---
|
||||
|
||||
## 5. 设计与标准
|
||||
|
||||
| 目录 | 说明 |
|
||||
### 已归档设计（历史参考）
|
||||
| 文件 | 说明 |
|
||||
|------|------|
|
||||
| [design/specs/](design/specs/) | 设计规格 |
|
||||
| [design/plans/](design/plans/) | 实施计划 |
|
||||
| [../standards/](../standards/) | 开发与审计标准 |
|
||||
| [project/standards-transfer-package.md](project/standards-transfer-package.md) | 标准转接包 |
|
||||
| `design/specs/2026-05-16-password-presets-design.md` | ⚠️ 归档 — 密码预设设计（引用旧文件结构） |
|
||||
| `design/specs/2026-05-16-simplified-push-design.md` | ⚠️ 归档 — 简化推送设计（引用旧文件结构） |
|
||||
| `design/specs/2026-05-17-retry-progress-design.md` | ⚠️ 归档 — 重试+进度设计（引用旧文件结构） |
|
||||
| `design/specs/2026-05-17-server-add-optimize-design.md` | ⚠️ 归档 — 服务器添加优化设计（引用旧文件结构） |
|
||||
| `design/specs/2026-05-18-file-manager-v2-design.md` | ⚠️ 归档 — 文件管理器v2设计（引用旧文件结构） |
|
||||
| `design/specs/2026-05-19-code-review-followup.md` | ⚠️ 归档 — PHP代码审查（前端已迁移到Tailwind） |
|
||||
| `design/plans/2026-05-16-password-presets.md` | ⚠️ 归档 — 密码预设实施计划 |
|
||||
| `design/plans/2026-05-16-simplified-push.md` | ⚠️ 归档 — 简化推送实施计划 |
|
||||
| `design/plans/2026-05-17-retry-progress.md` | ⚠️ 归档 — 重试+进度实施计划 |
|
||||
| `design/plans/2026-05-17-server-add-optimize.md` | ⚠️ 归档 — 服务器添加优化实施计划 |
|
||||
| `design/plans/2026-05-18-file-manager-v2.md` | ⚠️ 归档 — 文件管理器v2实施计划 |
|
||||
|
||||
---
|
||||
## reports/ — 审查与工作报告
|
||||
|
||||
## 6. 归档区
|
||||
|
||||
**[archive/README.md](archive/README.md)** — 2026-06 审计合并卷、旧 handoff、agentmemory、2026-05 审查报告。
|
||||
|
||||
---
|
||||
|
||||
## 7. 工具脚本
|
||||
|
||||
| 脚本 | 用途 |
|
||||
### Phase 2 逐行走读（2026-05-22～23）
|
||||
| 文件 | 说明 |
|
||||
|------|------|
|
||||
| `scripts/local_verify.sh` | L2b 本地验证 |
|
||||
| `scripts/consolidate_docs.py` | 文档归档合并（维护用） |
|
||||
| `scripts/run_nexus_acceptance.py` | L4 验收 |
|
||||
| `deploy/pre_deploy_check.sh` | 7 道门控 |
|
||||
| **`reports/audit-phase-2-findings-matrix.md`** | **63 条 FINDING 全量状态表** |
|
||||
| `reports/audit-phase-2-walk-closure.md` | 走读闭环 |
|
||||
| `reports/audit-phase-2a`～`2j-line-walk.md` | 各批次逐行报告 |
|
||||
| `reports/2026-05-23-full-audit-report.md` | 7 部门并行初审（与 Phase 2 交叉引用） |
|
||||
| `reports/audit-full-vs-phase2-reconciliation.md` | C1–C12 与 Phase 2 对照表 |
|
||||
|
||||
### 部门审查报告
|
||||
| 文件 | 说明 |
|
||||
|------|------|
|
||||
| `reports/review-cto-2026-05-21.md` | CTO审查 — 连接池/SSH/CORS/依赖（含勘误） |
|
||||
| `reports/review-deploy-architecture-2026-05-21.md` | 运维总监审查 — 部署架构/三层守护/Nginx（含勘误） |
|
||||
| `reports/review-quality-director-2026-05-21.md` | 质量总监审查 — 代码规范/datetime/测试（含勘误） |
|
||||
| `reports/step-0-infrastructure/ecc-security-report.md` | ECC组安全审查 — Redis/Schema/认证/SSH/编码（含勘误） |
|
||||
| `reports/signoff-2026-05-21.md` | 审查签字确认 |
|
||||
| `reports/session-log-2026-05-21.md` | 会话操作日志 |
|
||||
|
||||
### 实施报告
|
||||
| 文件 | 说明 |
|
||||
|------|------|
|
||||
| `reports/implementation-progress-2026-05-21.md` | 6步实施进度总览 |
|
||||
| `reports/step-0-infrastructure/engineering-report.md` | Step 0: 基础设施加固 |
|
||||
| `reports/step-0-infrastructure/ag-code-review-report.md` | Step 0: 代码审查 |
|
||||
| `reports/step-0-infrastructure/testing-report.md` | Step 0: 测试报告 |
|
||||
| `reports/step-1-data-layer/engineering-report.md` | Step 1: 数据层 |
|
||||
| `reports/step-2-auth/engineering-report.md` | Step 2: 认证层 |
|
||||
| `reports/step-3-webssh/engineering-report.md` | Step 3: Web SSH（含paramiko→asyncssh迁移） |
|
||||
| `reports/step-4-sync/engineering-report.md` | Step 4: Sync引擎 |
|
||||
| `reports/step-5-frontend/engineering-report.md` | Step 5: 前端迁移 |
|
||||
| `reports/step-5-frontend/design-review-report.md` | Step 5: 前端设计审查 |
|
||||
| `reports/step-5-frontend/product-department-report.md` | Step 5: 产品部报告 |
|
||||
|
||||
## research/ — 竞品与技术调研
|
||||
| 文件 | 说明 |
|
||||
|------|------|
|
||||
| `research/jumpserver-easynode-architecture-analysis.md` | JumpServer & EasyNode 架构对比分析 |
|
||||
| `research/ag-research-report.md` | AI Agent 调研报告 |
|
||||
|
||||
## changelog/ — 变更记录（强制）
|
||||
|
||||
> **纪律**：每次有意义的代码/配置修改都必须在此目录新增 `YYYY-MM-DD-<主题>.md`。见 `.cursor/rules/perfect-implementation.mdc`。
|
||||
|
||||
### Phase 2 安全与审计（2026-05-22～23）
|
||||
| 文件 | 说明 |
|
||||
|------|------|
|
||||
| `changelog/2026-05-22-security-fixes-p0.md` | P0：WebSSH、中心 exec、crypto |
|
||||
| `changelog/2026-05-22-security-fixes-p1.md` | P1：注入、危险命令、Agent |
|
||||
| `changelog/2026-05-22-audit-p2-fixes.md` | P2 批次修复 |
|
||||
| `changelog/2026-05-22-global-jwt-middleware.md` | 全局 JWT 中间件 |
|
||||
| `changelog/2026-05-22-alert-push-dashboard.md` | 告警策略 + 仪表盘 |
|
||||
| `changelog/2026-05-22-telegram-sanitize-and-security-tests.md` | Telegram 脱敏 + 单测 |
|
||||
| `changelog/2026-05-22-frontend-vendor-selfhost.md` | 前端 vendor 自托管 |
|
||||
| `changelog/2026-05-22-line-walk-audit-standard.md` | 逐行走读标准 |
|
||||
|
||||
### 其他
|
||||
| 文件 | 说明 |
|
||||
|------|------|
|
||||
| `changelog/2026-05-22-implementation-standards-rule.md` | 完美实现与文档纪律全局规则 |
|
||||
| `changelog/2026-05-22-tech-stack-rules-mysql-mcp.md` | 技术栈 Cursor 规则 + MySQL MCP |
|
||||
| `changelog/2026-05-22-local-mysql-full-access-node20-fix.md` | 本地库可写 + Node20 安装修复 |
|
||||
| `changelog/fix-plan-2026-05-20.md` | 代码问题修复计划（13项） |
|
||||
| `changelog/fix-plan-full-2026-05-20.md` | 全量未完成项修复计划（24项） |
|
||||
| `changelog/fix-verification-report-2026-05-20.md` | 修复验证报告 |
|
||||
|
||||
## memory/ — 项目记忆（AI辅助）
|
||||
| 文件 | 说明 |
|
||||
|------|------|
|
||||
| `memory/MEMORY.md` | 记忆索引 |
|
||||
| `memory/mem_*.md` | 17个记忆文件（概述/决策/数据流/守护/模块/测试/等） |
|
||||
|
||||
## 已移除（2026-06-01）
|
||||
|
||||
`docs/team/`、`docs/skills/`、`TEAM_ROLES.md`、`.cursor/skills/` 已删除——不再使用虚拟部门或 superpowers 工作流 Skill。开发规范见 `standards/` 与 `.cursor/rules/`。
|
||||
|
||||
@@ -1,17 +0,0 @@
|
||||
# Nexus 文档归档区
|
||||
|
||||
> 更新: 2026-06-04
|
||||
|
||||
历史审计、旧 handoff、agentmemory。**日常请先读** [docs/README.md](../README.md)。
|
||||
|
||||
## 合并卷
|
||||
|
||||
| 文件 | 内容 |
|
||||
|------|------|
|
||||
| [audits/2026-06-04-line-walk-merged.md](audits/2026-06-04-line-walk-merged.md) | Line-walk batch |
|
||||
| [audits/2026-06-04-delta-merged.md](audits/2026-06-04-delta-merged.md) | Delta D1–D8 |
|
||||
| [audits/2026-06-04-phase2-merged.md](audits/2026-06-04-phase2-merged.md) | Phase2 P2 |
|
||||
| [audits/2026-06-04-frontend-14p-merged.md](audits/2026-06-04-frontend-14p-merged.md) | 前端 14p |
|
||||
| [memory/agentmemory-2026-05-merged.md](memory/agentmemory-2026-05-merged.md) | 旧 memory |
|
||||
|
||||
原文在对应子目录；changelog 不归档。
|
||||
@@ -1,183 +0,0 @@
|
||||
# Delta D1–D8 合并卷
|
||||
|
||||
> 生成日期: 2026-06-04 · 源文件 8 篇 · 原文 `docs/archive/audits/2026-06-04-delta/`
|
||||
|
||||
## 批次索引
|
||||
|
||||
### `audit-delta-2026-06-04-waveD1.md`
|
||||
|
||||
# Phase 1 Delta 审计 — Wave D1（同步/后台）
|
||||
## 登记
|
||||
## Step 3 — 规则扫描 H（摘要）
|
||||
## 入口表（sync_v2.py API）
|
||||
## Closure 表
|
||||
**len(H)=19, Closure=19**
|
||||
## FINDING（本波）
|
||||
无 P0/P1 新 FINDING。RISK 项与既有运维/单人决策一致，不阻塞。
|
||||
## DoD
|
||||
- [x] len(H) == Closure
|
||||
- [x] FINDING 含行号
|
||||
## 验证
|
||||
|
||||
### `audit-delta-2026-06-04-waveD2.md`
|
||||
|
||||
# Phase 1 Delta 审计 — Wave D2（认证 / 安装 / WS / Agent）
|
||||
## 登记
|
||||
## 入口表
|
||||
### install.py
|
||||
### auth.py
|
||||
### websocket.py
|
||||
### agent.py
|
||||
## Closure 表
|
||||
**len(H)=22, Closure=22**
|
||||
## FINDING
|
||||
无 P0/P1 新 FINDING。RISK：WS query JWT、Agent global key — 见 `docs/project/risk-acceptance-single-operator.md`。
|
||||
## DoD
|
||||
|
||||
### `audit-delta-2026-06-04-waveD3.md`
|
||||
|
||||
# Phase 1 Delta 审计 — Wave D3（服务器 / 设置 / 脚本 / WebSSH）
|
||||
## 登记
|
||||
## 入口表（摘要）
|
||||
### webssh.py
|
||||
### servers.py（主要写操作）
|
||||
### settings.py
|
||||
### scripts.py
|
||||
## Closure 表
|
||||
**len(H)=24, Closure=24**
|
||||
## FINDING
|
||||
无 P0/P1 新 FINDING。
|
||||
## DoD
|
||||
|
||||
### `audit-delta-2026-06-04-waveD4.md`
|
||||
|
||||
# Phase 1 Delta 审计 — Wave D4（前端 Push）
|
||||
## 登记
|
||||
## Step 3 — 规则扫描 H（摘要）
|
||||
## 入口表（前端 → API）
|
||||
## Closure 表
|
||||
**len(H)=17, Closure=17**
|
||||
## FINDING
|
||||
无 P0/P1 新 FINDING。
|
||||
## DoD
|
||||
- [x] len(H) == Closure
|
||||
## 验证
|
||||
|
||||
### `audit-delta-2026-06-04-waveD5.md`
|
||||
|
||||
# Phase 1 Delta 审计 — Wave D5（前端 Files / Terminal）
|
||||
## 登记
|
||||
## Step 3 — 规则扫描 H（摘要）
|
||||
## 入口表（前端 → API / WS）
|
||||
## Closure 表
|
||||
**len(H)=18, Closure=18**
|
||||
## FINDING
|
||||
无 P0/P1 新 FINDING。
|
||||
## DoD
|
||||
- [x] len(H) == Closure
|
||||
## 验证
|
||||
|
||||
### `audit-delta-2026-06-04-waveD6.md`
|
||||
|
||||
# Phase 1 Delta 审计 — Wave D6（认证链 / Login）
|
||||
## 登记
|
||||
## Step 3 — 规则扫描 H（摘要）
|
||||
## 入口表
|
||||
## Closure 表
|
||||
**len(H)=19, Closure=19**
|
||||
## FINDING
|
||||
无 P0/P1 新 FINDING。
|
||||
## DoD
|
||||
- [x] len(H) == Closure
|
||||
## 验证
|
||||
|
||||
### `audit-delta-2026-06-04-waveD7.md`
|
||||
|
||||
# Phase 1 Delta 审计 — Wave D7（Deploy / 本地验证脚本）
|
||||
**标准**: 变更审查（运维/门控；非业务 API 8 步，沿用 Closure 表格式）
|
||||
## 登记
|
||||
## Step 3 — 规则扫描 H（摘要）
|
||||
## 入口表（脚本调用链）
|
||||
## Closure 表
|
||||
**len(H)=16, Closure=16**
|
||||
## FINDING
|
||||
无 P0/P1 新 FINDING。
|
||||
## DoD
|
||||
- [x] len(H) == Closure
|
||||
## 验证
|
||||
|
||||
### `audit-delta-2026-06-04-waveD8-closure.md`
|
||||
|
||||
# Phase 1 Delta 审计 — Wave D8（汇总 Closure）
|
||||
**标准**: Phase 1 收尾 DoD
|
||||
## 汇总表
|
||||
| 波次 | 主题 | 文件数 | H | P0/P1 | 报告 |
|
||||
## 已接受 RISK（跨波重复，不重复开 FINDING）
|
||||
## Registry 更新
|
||||
## Step 3 / Closure / DoD
|
||||
- **len(H) 汇总** = 135，各波 Closure 均已 100% 对齐
|
||||
- **无 P0/P1** 待修项进入 Phase 2
|
||||
## 下一步（计划 Phase 2 / L3）
|
||||
## 验证
|
||||
|
||||
## Closure 摘录（合并）
|
||||
|
||||
| 1 | `server/api/sync_v2.py` | Python | 1656 | 1–200, 680–1080, 1280–1657 + 全文件 `@router`/grep H |
|
||||
| 2 | `server/application/services/sync_engine_v2.py` | Python | 552 | 1–552 全文 |
|
||||
| 3 | `server/background/schedule_runner.py` | Python | 262 | 1–262 全文 |
|
||||
| 4 | `server/background/retry_runner.py` | Python | 169 | 1–169 全文 |
|
||||
| 5 | `server/background/heartbeat_flush.py` | Python | 101 | 1–101 全文 |
|
||||
| H | 文件:行号 | 判定 | 理由 |
|
||||
| H-Install-lock | install.py:344-350 | SAFE | `_reject_if_locked` 阻断突变 |
|
||||
| H-Install-token | install.py:314-327 | SAFE | `secrets.compare_digest` 一次性 token |
|
||||
| H-Install-token | install.py:601 | SAFE | create-admin 必须 token |
|
||||
| H-Install-SQL | install.py:540-544 | SAFE | 参数化 INSERT settings |
|
||||
| H-Install-DDL | install.py:489-503 | SAFE | DDL 幂等 except pass |
|
||||
| H-Install-subprocess | install.py:273-293 | SAFE | crontab/supervisor 固定 argv |
|
||||
| H-Auth-brute | auth.py:125-138 | SAFE | 429/202 由 AuthService |
|
||||
| H-Auth-cookie | auth.py:38-54 | SAFE | HttpOnly + Secure(HTTPS) + SameSite=Lax |
|
||||
| H-Auth-TOTP-IDOR | auth.py:223-259 | SAFE | admin_id 必须等于 JWT sub |
|
||||
| H-Auth-password | auth.py:288-305 | SAFE | bcrypt + token_version 失效 |
|
||||
| H-Auth-webssh | auth.py:330-349 | SAFE | 短效 server-bound token |
|
||||
| H-JWT-middleware | auth_jwt.py:78-146 | SAFE | ASGI 层拦截 /api/* |
|
||||
| H-JWT-public | auth_jwt.py:38-50 | SAFE | 公开前缀含 agent/install/ws |
|
||||
| H-JWT-tv | auth_jwt.py:222-226 | SAFE | token_version 精确匹配 |
|
||||
| H-WS-auth | websocket.py:303-311 | SAFE | 无 token → 4001；无效 → 4401 |
|
||||
| H-WS-auth | websocket.py:366-407 | SAFE | tv + updated_at 双检 |
|
||||
| H-WS-ADR011 | websocket.py:9,300 | RISK | JWT 在 query；单人运维已接受 ADR-011 |
|
||||
| H-Agent-key | agent.py:40-57 | SAFE | compare_digest；handler 二次验 per-server |
|
||||
| H-Agent-unknown | agent.py:193-199 | SAFE | 未知 server 200 discard，不写入 |
|
||||
| H-Agent-global | agent.py:84-92 | RISK | legacy global API_KEY；risk-acceptance 文档 |
|
||||
| H-Agent-callback | agent.py:324-347 | SAFE | rate limit + job secret |
|
||||
| H-Agent-no-exec | agent.py:378 | SAFE | 控制面无 shell exec |
|
||||
| POST | `/{id}/install-agent` 等 | JWT + SSH |
|
||||
| 文件 | H 命中 |
|
||||
| usePushForm.ts | H-Auth, H-Upload, H-Path |
|
||||
| usePushPreview.ts | H-Auth, H-Path |
|
||||
| usePushProgress.ts | H-Auth, H-WS, H-Batch |
|
||||
| PushZipUpload.vue | H-Upload, H-XSS |
|
||||
| PushServerGrid.vue | H-XSS |
|
||||
| useFilesActions.ts | H-Auth, H-Path, H-Delete, H-Upload |
|
||||
| useFilesEditor.ts | H-Auth, H-Size |
|
||||
| useFilesPermissions.ts | H-Auth, H-Sudo |
|
||||
| useTerminalSessions.ts | H-Auth, H-WS, H-Path, H-Cmd |
|
||||
| useTerminalCmdBar.ts | H-Storage, H-Cmd |
|
||||
| LoginPage.vue | H-Secret, H-Redirect, H-Lockout, H-XSS |
|
||||
| auth.ts | H-Token, H-Refresh, H-Profile |
|
||||
| api/index.ts | H-Auth, H-Refresh, H-401 |
|
||||
| router/index.ts | H-Guard, H-Redirect |
|
||||
| wsUrl.ts | H-WS |
|
||||
| pre_deploy_check.sh | H-Gate, H-Secret, H-Git |
|
||||
| local_verify.sh | H-Chain |
|
||||
| local_integration_smoke.sh | H-Health, H-Auth |
|
||||
| start-dev.sh | H-DevBind, H-Env |
|
||||
| docker-compose.yml | H-Port, H-DefaultCreds |
|
||||
| 波次 | 主题 | 文件数 | H | P0/P1 | 报告 |
|
||||
| D1 | sync/后台 | 5 | 19 | 0 | [waveD1](audit-delta-2026-06-04-waveD1.md) |
|
||||
| D2 | auth/agent/ws | 5 | 22 | 0 | [waveD2](audit-delta-2026-06-04-waveD2.md) |
|
||||
| D3 | servers/settings/scripts/webssh | 5 | 24 | 0 | [waveD3](audit-delta-2026-06-04-waveD3.md) |
|
||||
| D4 | 前端 Push | 5 | 17 | 0 | [waveD4](audit-delta-2026-06-04-waveD4.md) |
|
||||
| D5 | 前端 Files/Terminal | 5 | 18 | 0 | [waveD5](audit-delta-2026-06-04-waveD5.md) |
|
||||
| D6 | 认证链 Login | 5 | 19 | 0 | [waveD6](audit-delta-2026-06-04-waveD6.md) |
|
||||
| D7 | Deploy/本地脚本 | 5 | 16 | 0 | [waveD7](audit-delta-2026-06-04-waveD7.md) |
|
||||
| **合计** | | **35** | **135** | **0** | |
|
||||
@@ -1,95 +0,0 @@
|
||||
# Phase 1 Delta 审计 — Wave D1（同步/后台）
|
||||
|
||||
**日期**: 2026-06-04
|
||||
**范围**: 推送/sync 核心路径（Code Review batch1 后 delta）
|
||||
**标准**: `standards/line-walk-audit-standard-v2.md` 8 步
|
||||
|
||||
## 登记
|
||||
|
||||
| # | 文件 | 语言 | 行数 N | Read 范围 |
|
||||
|---|------|------|--------|-----------|
|
||||
| 1 | `server/api/sync_v2.py` | Python | 1656 | 1–200, 680–1080, 1280–1657 + 全文件 `@router`/grep H |
|
||||
| 2 | `server/application/services/sync_engine_v2.py` | Python | 552 | 1–552 全文 |
|
||||
| 3 | `server/background/schedule_runner.py` | Python | 262 | 1–262 全文 |
|
||||
| 4 | `server/background/retry_runner.py` | Python | 169 | 1–169 全文 |
|
||||
| 5 | `server/background/heartbeat_flush.py` | Python | 101 | 1–101 全文 |
|
||||
|
||||
## Step 3 — 规则扫描 H（摘要）
|
||||
|
||||
| 文件 | H 命中 |
|
||||
|------|--------|
|
||||
| sync_v2.py | H-Shell, H-Auth, H-Path, H-Audit, H-Upload |
|
||||
| sync_engine_v2.py | H-Shell, H-AuthN/A, H-Concurrency |
|
||||
| schedule_runner.py | H-Cron, H-Script-exec, H-Lock |
|
||||
| retry_runner.py | H-Lock, H-Retry |
|
||||
| heartbeat_flush.py | H-Redis, H-DB |
|
||||
|
||||
## 入口表（sync_v2.py API）
|
||||
|
||||
| 方法 | 路径 | 鉴权 |
|
||||
|------|------|------|
|
||||
| POST | `/api/sync/files` | JWT `get_current_admin` |
|
||||
| POST | `/api/sync/preview` | 同上 |
|
||||
| POST | `/api/sync/file-ops` | 同上 |
|
||||
| POST | `/api/sync/file-clipboard` | 同上 |
|
||||
| POST | `/api/sync/browse` | 同上 |
|
||||
| POST | `/api/sync/browse-local` | 同上 |
|
||||
| POST | `/api/sync/local-file-ops` | 同上 |
|
||||
| POST | `/api/sync/local-file-preview` | 同上 |
|
||||
| POST | `/api/sync/cancel` | 同上 |
|
||||
| POST | `/api/sync/reconcile-stale-logs` | 同上 |
|
||||
| POST | `/api/sync/validate-source-path` | 同上 |
|
||||
| POST | `/api/sync/diagnose` | 同上 |
|
||||
| POST | `/api/sync/file-diff` | 同上 |
|
||||
| POST | `/api/sync/upload` | 同上 |
|
||||
| POST | `/api/sync/upload-zip` | 同上 |
|
||||
| POST | `/api/sync/verify` | 同上 |
|
||||
| POST | `/api/sync/download` | 同上 |
|
||||
| POST | `/api/sync/read-file` | 同上 |
|
||||
| POST | `/api/sync/write-file` | 同上 |
|
||||
| POST | `/api/sync/chmod` | 同上 |
|
||||
| POST | `/api/sync/compress` | 同上 |
|
||||
| POST | `/api/sync/decompress` | 同上 |
|
||||
|
||||
## Closure 表
|
||||
|
||||
| H | 文件:行号 | 判定 | 理由 |
|
||||
|---|-----------|------|------|
|
||||
| H-Shell | sync_v2.py:156-173 | SAFE | 远程路径 `normalize_remote_abs_path` + `shlex.quote` |
|
||||
| H-Shell | sync_v2.py:777 | SAFE | `remote_file` 经 `remote_join`+quote；`wc -c && cat` 单路径 |
|
||||
| H-Path | sync_v2.py:721-731 | SAFE | `ensure_under_nexus_upload` + prefix 校验 |
|
||||
| H-Path | sync_v2.py:887-890 | SAFE | 上传文件名去斜杠 |
|
||||
| H-Path | sync_v2.py:999-1005 | SAFE | ZIP slip：`assert_zip_member_safe` |
|
||||
| H-Auth | sync_v2.py:74-1610 | SAFE | 全部 22 路由 `Depends(get_current_admin)` |
|
||||
| H-Audit | sync_v2.py:119-122 等 | SAFE | CUD/敏感操作 `_audit_sync` |
|
||||
| H-Upload | sync_v2.py:876-877 | SAFE | 100MB 上限 |
|
||||
| H-Upload | sync_v2.py:977-978 | SAFE | ZIP 500MB 上限 |
|
||||
| H-Shell | sync_engine_v2.py:433-465 | RISK | `StrictHostKeyChecking=no` 运维惯例；单人环境已接受 |
|
||||
| H-Shell | sync_engine_v2.py:440-445 | RISK | sshpass/SSHPASS；内部工具，凭据加密存储 |
|
||||
| H-Concurrency | sync_engine_v2.py:89-150 | SAFE | `_db_lock` 串行化 sync_log 写 |
|
||||
| H-Cron | schedule_runner.py:58-72 | RISK | 畸形 cron 字段 `int()` 可抛 ValueError；外层 254 行捕获 rollback |
|
||||
| H-Script | schedule_runner.py:198-205 | SAFE | 调度脚本仅 JWT 管理员配置的 schedule 触发 |
|
||||
| H-Lock | schedule_runner.py:125-131 | SAFE | `FOR UPDATE SKIP LOCKED` 防双触发 |
|
||||
| H-Lock | retry_runner.py:67-76 | SAFE | SKIP LOCKED 认领 |
|
||||
| H-Retry | retry_runner.py:22-59 | SAFE | 指数退避 + max_retries |
|
||||
| H-Redis | heartbeat_flush.py:42-48 | SAFE | scan 失败 log+continue |
|
||||
| H-DB | heartbeat_flush.py:57-99 | SAFE | 参数化 ORM update；未知 server_id rowcount 0 跳过 |
|
||||
|
||||
**len(H)=19, Closure=19**
|
||||
|
||||
## FINDING（本波）
|
||||
|
||||
无 P0/P1 新 FINDING。RISK 项与既有运维/单人决策一致，不阻塞。
|
||||
|
||||
## DoD
|
||||
|
||||
- [x] len(H) == Closure
|
||||
- [x] Read 覆盖 1..N（sync_v2 大文件分段 + 全路由 grep）
|
||||
- [x] FINDING 含行号
|
||||
- [x] 入口表 + sink 标注
|
||||
- [x] 逐行完成 ✓（D1 五文件）
|
||||
|
||||
## 验证
|
||||
|
||||
- `docker-compose.yml` Redis 发布 6379（修复本地 uvicorn 连 Redis）
|
||||
- 待跑：`bash scripts/local_verify.sh`
|
||||
@@ -1,100 +0,0 @@
|
||||
# Phase 1 Delta 审计 — Wave D2（认证 / 安装 / WS / Agent）
|
||||
|
||||
**日期**: 2026-06-04
|
||||
**范围**: Code Review batch2 后 delta — 认证与 Agent 路径
|
||||
**标准**: `standards/line-walk-audit-standard-v2.md` 8 步
|
||||
|
||||
## 登记
|
||||
|
||||
| # | 文件 | 语言 | 行数 N | Read 范围 |
|
||||
|---|------|------|--------|-----------|
|
||||
| 1 | `server/api/install.py` | Python | 746 | 1–746 全文 |
|
||||
| 2 | `server/api/auth.py` | Python | 374 | 1–374 全文 |
|
||||
| 3 | `server/api/auth_jwt.py` | Python | 274 | 1–274 全文 |
|
||||
| 4 | `server/api/websocket.py` | Python | 552 | 1–552 全文 |
|
||||
| 5 | `server/api/agent.py` | Python | 378 | 1–378 全文 |
|
||||
|
||||
## 入口表
|
||||
|
||||
### install.py
|
||||
|
||||
| 方法 | 路径 | 鉴权 |
|
||||
|------|------|------|
|
||||
| GET | `/api/install/status` | 无（已锁定 404） |
|
||||
| GET | `/api/install/env-check` | 安装模式 + 未 lock |
|
||||
| POST | `/api/install/init-db` | 无 .env + 未 lock |
|
||||
| POST | `/api/install/create-admin` | `install_token` |
|
||||
| POST | `/api/install/lock` | 需已有 admin |
|
||||
| GET | `/api/install/state` | 未 lock |
|
||||
|
||||
### auth.py
|
||||
|
||||
| 方法 | 路径 | 鉴权 |
|
||||
|------|------|------|
|
||||
| POST | `/api/auth/login` | 公开 |
|
||||
| POST | `/api/auth/refresh` | Cookie/body refresh |
|
||||
| POST | `/api/auth/logout` | Cookie |
|
||||
| POST | `/api/auth/totp/*` | JWT + self admin_id |
|
||||
| PUT | `/api/auth/password` | JWT + 当前密码 (+TOTP) |
|
||||
| POST | `/api/auth/webssh-token` | JWT + server 存在 |
|
||||
| GET | `/api/auth/me` | JWT |
|
||||
|
||||
### websocket.py
|
||||
|
||||
| 类型 | 路径 | 鉴权 |
|
||||
|------|------|------|
|
||||
| WS | `/ws/alerts` | Query `?token=` JWT |
|
||||
| WS | `/ws/sync` | 同上 |
|
||||
|
||||
### agent.py
|
||||
|
||||
| 方法 | 路径 | 鉴权 |
|
||||
|------|------|------|
|
||||
| POST | `/api/agent/heartbeat` | X-API-Key + per-server key |
|
||||
| POST | `/api/agent/script-callback` | X-API-Key + job secret + rate limit |
|
||||
|
||||
## Closure 表
|
||||
|
||||
| H | 文件:行号 | 判定 | 理由 |
|
||||
|---|-----------|------|------|
|
||||
| H-Install-lock | install.py:344-350 | SAFE | `_reject_if_locked` 阻断突变 |
|
||||
| H-Install-token | install.py:314-327 | SAFE | `secrets.compare_digest` 一次性 token |
|
||||
| H-Install-token | install.py:601 | SAFE | create-admin 必须 token |
|
||||
| H-Install-SQL | install.py:540-544 | SAFE | 参数化 INSERT settings |
|
||||
| H-Install-DDL | install.py:489-503 | SAFE | DDL 幂等 except pass |
|
||||
| H-Install-subprocess | install.py:273-293 | SAFE | crontab/supervisor 固定 argv |
|
||||
| H-Auth-brute | auth.py:125-138 | SAFE | 429/202 由 AuthService |
|
||||
| H-Auth-cookie | auth.py:38-54 | SAFE | HttpOnly + Secure(HTTPS) + SameSite=Lax |
|
||||
| H-Auth-TOTP-IDOR | auth.py:223-259 | SAFE | admin_id 必须等于 JWT sub |
|
||||
| H-Auth-password | auth.py:288-305 | SAFE | bcrypt + token_version 失效 |
|
||||
| H-Auth-webssh | auth.py:330-349 | SAFE | 短效 server-bound token |
|
||||
| H-JWT-middleware | auth_jwt.py:78-146 | SAFE | ASGI 层拦截 /api/* |
|
||||
| H-JWT-public | auth_jwt.py:38-50 | SAFE | 公开前缀含 agent/install/ws |
|
||||
| H-JWT-tv | auth_jwt.py:222-226 | SAFE | token_version 精确匹配 |
|
||||
| H-WS-auth | websocket.py:303-311 | SAFE | 无 token → 4001；无效 → 4401 |
|
||||
| H-WS-auth | websocket.py:366-407 | SAFE | tv + updated_at 双检 |
|
||||
| H-WS-ADR011 | websocket.py:9,300 | RISK | JWT 在 query；单人运维已接受 ADR-011 |
|
||||
| H-Agent-key | agent.py:40-57 | SAFE | compare_digest；handler 二次验 per-server |
|
||||
| H-Agent-unknown | agent.py:193-199 | SAFE | 未知 server 200 discard，不写入 |
|
||||
| H-Agent-global | agent.py:84-92 | RISK | legacy global API_KEY；risk-acceptance 文档 |
|
||||
| H-Agent-callback | agent.py:324-347 | SAFE | rate limit + job secret |
|
||||
| H-Agent-no-exec | agent.py:378 | SAFE | 控制面无 shell exec |
|
||||
|
||||
**len(H)=22, Closure=22**
|
||||
|
||||
## FINDING
|
||||
|
||||
无 P0/P1 新 FINDING。RISK：WS query JWT、Agent global key — 见 `docs/project/risk-acceptance-single-operator.md`。
|
||||
|
||||
## DoD
|
||||
|
||||
- [x] len(H) == Closure
|
||||
- [x] Read 1..N 全文
|
||||
- [x] 入口表 + sink
|
||||
- [x] 逐行完成 ✓（D2 五文件）
|
||||
|
||||
## 验证
|
||||
|
||||
```bash
|
||||
bash scripts/local_verify.sh # 预期全绿
|
||||
```
|
||||
@@ -1,85 +0,0 @@
|
||||
# Phase 1 Delta 审计 — Wave D3（服务器 / 设置 / 脚本 / WebSSH）
|
||||
|
||||
**日期**: 2026-06-04
|
||||
**范围**: Code Review batch2–3 相关路径
|
||||
**标准**: `standards/line-walk-audit-standard-v2.md` 8 步
|
||||
|
||||
## 登记
|
||||
|
||||
| # | 文件 | 语言 | 行数 N | Read 范围 |
|
||||
|---|------|------|--------|-----------|
|
||||
| 1 | `server/api/webssh.py` | Python | 398 | 1–398 全文 |
|
||||
| 2 | `server/api/servers.py` | Python | 1741 | 1–250, 1059–1290, 1681–1742 + 全路由 grep |
|
||||
| 3 | `server/api/settings.py` | Python | 1403 | 1–130, 280–384, 562–730, 881–930 + grep |
|
||||
| 4 | `server/application/services/script_service.py` | Python | 734 | 1–734 全文 |
|
||||
| 5 | `server/api/scripts.py` | Python | 418 | 1–418 全文 |
|
||||
|
||||
## 入口表（摘要）
|
||||
|
||||
### webssh.py
|
||||
| 类型 | 路径 | 鉴权 |
|
||||
|------|------|------|
|
||||
| WS | `/ws/terminal/{server_id}` | JWT `purpose=webssh` + server_id 绑定 |
|
||||
|
||||
### servers.py（主要写操作）
|
||||
| 方法 | 路径 | 鉴权 |
|
||||
|------|------|------|
|
||||
| POST/PUT/DELETE | `/api/servers/`… | JWT |
|
||||
| POST | `/{id}/agent-key` | JWT + 当前密码 |
|
||||
| POST | `/{id}/install-agent` 等 | JWT + SSH |
|
||||
|
||||
### settings.py
|
||||
| 方法 | 路径 | 鉴权 |
|
||||
|------|------|------|
|
||||
| GET/PUT | `/api/settings/*` | JWT；IMMUTABLE_KEYS 403 |
|
||||
| POST | `/api-key/reveal`, `/telegram/reveal-token` | JWT + re-auth |
|
||||
|
||||
### scripts.py
|
||||
| 方法 | 路径 | 鉴权 |
|
||||
|------|------|------|
|
||||
| CRUD/exec | `/api/scripts/*` | JWT 全路由 |
|
||||
|
||||
## Closure 表
|
||||
|
||||
| H | 文件:行号 | 判定 | 理由 |
|
||||
|---|-----------|------|------|
|
||||
| H-WS-auth | webssh.py:96-109 | SAFE | webssh JWT + server_id 必须匹配路径 |
|
||||
| H-WS-IDOR | webssh.py:106-108 | SAFE | 非绑定 token → 4003 |
|
||||
| H-WS-cred | webssh.py:127-135 | SAFE | SSH 凭据未配置则拒绝 |
|
||||
| H-WS-audit | webssh.py:137-157 | SAFE | connect/disconnect 审计 |
|
||||
| H-WS-cmdlog | webssh.py:276-290 | SAFE | 命令日志 + dangerous check |
|
||||
| H-WS-ADR011 | webssh.py:92 | RISK | query token；已接受 |
|
||||
| H-Server-mask | servers.py:1692-1698 | SAFE | password_set / 密钥不返回明文 |
|
||||
| H-Server-encrypt | servers.py:1096-1099 | SAFE | Fernet 加密存储 |
|
||||
| H-Server-allowlist | servers.py:1163-1187 | SAFE | UPDATE 字段白名单 |
|
||||
| H-Server-agent-key | servers.py:1251-1288 | SAFE | re-auth 后生成/返回一次 |
|
||||
| H-Server-shell | servers.py:631-633 | SAFE | install cmd shlex.quote |
|
||||
| H-Server-sudo | servers.py:36-60 | RISK | 临时 sudoers；运维必要 |
|
||||
| H-Settings-immutable | settings.py:331-334 | SAFE | api_key 等不可 PUT |
|
||||
| H-Settings-mask | settings.py:114-128 | SAFE | GET 敏感项 value 空 + value_set |
|
||||
| H-Settings-reauth | settings.py:93-98 | SAFE | reveal 需 bcrypt |
|
||||
| H-Settings-SSRF | settings.py:68-88 | SAFE | 订阅 URL 私有 IP 拦截 |
|
||||
| H-Settings-PUT-leak | settings.py:383 | RISK | PUT 响应可能含 telegram 明文；JWT 已认证 |
|
||||
| H-Script-danger | scripts.py:352-359 | SAFE | check_dangerous_command 拒绝 |
|
||||
| H-Script-cred | scripts.py:407-418 | SAFE | 凭据 API 无 password 字段 |
|
||||
| H-Script-allowlist | scripts.py:111-114,303-306 | SAFE | credential/script UPDATE 白名单 |
|
||||
| H-Svc-redact | script_service.py:108-111 | SAFE | 执行记录 command 脱敏 DB_PASS |
|
||||
| H-Svc-ssh | script_service.py:680-698 | SAFE | SSH exec 经 pool |
|
||||
| H-Svc-kill | script_service.py:306-322 | SAFE | kill 命令 pid/log 路径校验 |
|
||||
| H-Svc-server-map | script_service.py:519-523 | SAFE | 预加载 server_map 避免并行竞态 |
|
||||
|
||||
**len(H)=24, Closure=24**
|
||||
|
||||
## FINDING
|
||||
|
||||
无 P0/P1 新 FINDING。
|
||||
|
||||
## DoD
|
||||
|
||||
- [x] len(H) == Closure
|
||||
- [x] Read 覆盖（大文件分段 + 全路由）
|
||||
- [x] 逐行完成 ✓（D3 五文件）
|
||||
|
||||
## 验证
|
||||
|
||||
`bash scripts/local_verify.sh` — 预期全绿
|
||||
@@ -1,74 +0,0 @@
|
||||
# Phase 1 Delta 审计 — Wave D4（前端 Push）
|
||||
|
||||
**日期**: 2026-06-04
|
||||
**范围**: Code Review 后 push 页 composables + 组件
|
||||
**标准**: `standards/line-walk-audit-standard-v2.md` 8 步
|
||||
|
||||
## 登记
|
||||
|
||||
| # | 文件 | 语言 | 行数 N | Read 范围 |
|
||||
|---|------|------|--------|-----------|
|
||||
| 1 | `frontend/src/composables/push/usePushForm.ts` | TS | 101 | 1–101 全文 |
|
||||
| 2 | `frontend/src/composables/push/usePushPreview.ts` | TS | 104 | 1–104 全文 |
|
||||
| 3 | `frontend/src/composables/push/usePushProgress.ts` | TS | 294 | 1–294 全文 |
|
||||
| 4 | `frontend/src/components/push/PushZipUpload.vue` | Vue | 51 | 1–51 全文 |
|
||||
| 5 | `frontend/src/components/push/PushServerGrid.vue` | Vue | 110 | 1–110 全文 |
|
||||
|
||||
**关联（本波未单独登记）**: `usePushPage.ts` 仅编排 lifecycle，无独立 sink。
|
||||
|
||||
## Step 3 — 规则扫描 H（摘要）
|
||||
|
||||
| 文件 | H 命中 |
|
||||
|------|--------|
|
||||
| usePushForm.ts | H-Auth, H-Upload, H-Path |
|
||||
| usePushPreview.ts | H-Auth, H-Path |
|
||||
| usePushProgress.ts | H-Auth, H-WS, H-Batch |
|
||||
| PushZipUpload.vue | H-Upload, H-XSS |
|
||||
| PushServerGrid.vue | H-XSS |
|
||||
|
||||
## 入口表（前端 → API）
|
||||
|
||||
| 调用方 | 方法 | 路径 | 鉴权 |
|
||||
|--------|------|------|------|
|
||||
| usePushForm | POST multipart | `/sync/upload-zip` | http JWT |
|
||||
| usePushPreview | POST | `/sync/preview` | http JWT |
|
||||
| usePushProgress | POST | `/sync/files`, `/sync/cancel` | http JWT |
|
||||
| usePushProgress | WS | `/ws/sync?token=` | JWT query（已接受 RISK） |
|
||||
|
||||
## Closure 表
|
||||
|
||||
| H | 文件:行号 | 判定 | 理由 |
|
||||
|---|-----------|------|------|
|
||||
| H-Auth | usePushForm.ts:65-67 | SAFE | 经 `@/api` http，Bearer JWT |
|
||||
| H-Upload | usePushForm.ts:52,57 | RISK | 客户端仅 `.zip` 后缀；服务端 ZIP slip/大小限制（D1） |
|
||||
| H-Path | usePushForm.ts:69-72 | SAFE | `source_path` 来自服务端 upload-zip 响应 |
|
||||
| H-Path | usePushForm.ts:38-40 | SAFE | target_path 必填；远程校验在 sync_v2 |
|
||||
| H-Auth | usePushPreview.ts:28-38 | SAFE | preview POST JWT + server_id 参数化 |
|
||||
| H-Concurrency | usePushPreview.ts:72-77 | SAFE | `PREVIEW_CONCURRENCY=4` 限流 |
|
||||
| H-Auth | usePushProgress.ts:237-243 | SAFE | push POST JWT + batch_id |
|
||||
| H-WS | usePushProgress.ts:137-142 | RISK | query token；单人运维已接受 |
|
||||
| H-WS | usePushProgress.ts:79-80 | SAFE | batch_id 过滤防串批 |
|
||||
| H-WS | usePushProgress.ts:165-167 | SAFE | 4401 → forceLogout |
|
||||
| H-Batch | usePushProgress.ts:244-246 | SAFE | 服务端 batch_id 可覆盖客户端 |
|
||||
| H-Cancel | usePushProgress.ts:194-209 | SAFE | cancel 带 batch_id |
|
||||
| H-Timer | usePushProgress.ts:261-275 | SAFE | 300s 安全超时 + dispose 清理 |
|
||||
| H-Secret | usePushForm/Preview/Progress | SAFE | 无 localStorage 密码/密钥 |
|
||||
| H-XSS | PushZipUpload.vue:22 | SAFE | `{{ uploadedZip.name }}` 文本插值 |
|
||||
| H-XSS | PushServerGrid.vue:66-77 | SAFE | 无 v-html；状态 chip 文本插值 |
|
||||
| H-Upload | PushZipUpload.vue:18 | SAFE | `accept=".zip"` + 父 composable 后缀检查 |
|
||||
|
||||
**len(H)=17, Closure=17**
|
||||
|
||||
## FINDING
|
||||
|
||||
无 P0/P1 新 FINDING。
|
||||
|
||||
## DoD
|
||||
|
||||
- [x] len(H) == Closure
|
||||
- [x] 五文件全文 Read
|
||||
- [x] 无 v-html / localStorage 凭据
|
||||
|
||||
## 验证
|
||||
|
||||
`bash scripts/local_verify.sh` — 全绿
|
||||
@@ -1,80 +0,0 @@
|
||||
# Phase 1 Delta 审计 — Wave D5（前端 Files / Terminal）
|
||||
|
||||
**日期**: 2026-06-04
|
||||
**范围**: files/terminal composables（Code Review 后 delta）
|
||||
**标准**: `standards/line-walk-audit-standard-v2.md` 8 步
|
||||
|
||||
## 登记
|
||||
|
||||
| # | 文件 | 语言 | 行数 N | Read 范围 |
|
||||
|---|------|------|--------|-----------|
|
||||
| 1 | `frontend/src/composables/files/useFilesActions.ts` | TS | 609 | 1–609 全文 |
|
||||
| 2 | `frontend/src/composables/files/useFilesEditor.ts` | TS | 163 | 1–163 全文 |
|
||||
| 3 | `frontend/src/composables/files/useFilesPermissions.ts` | TS | 101 | 1–101 全文 |
|
||||
| 4 | `frontend/src/composables/terminal/useTerminalSessions.ts` | TS | 749 | 1–749 全文 |
|
||||
| 5 | `frontend/src/composables/terminal/useTerminalCmdBar.ts` | TS | 108 | 1–108 全文 |
|
||||
|
||||
**关联**: `types.ts` 中 `sanitizeRemotePath`（40–43）已纳入 terminal 路径 H 判定。
|
||||
|
||||
## Step 3 — 规则扫描 H（摘要）
|
||||
|
||||
| 文件 | H 命中 |
|
||||
|------|--------|
|
||||
| useFilesActions.ts | H-Auth, H-Path, H-Delete, H-Upload |
|
||||
| useFilesEditor.ts | H-Auth, H-Size |
|
||||
| useFilesPermissions.ts | H-Auth, H-Sudo |
|
||||
| useTerminalSessions.ts | H-Auth, H-WS, H-Path, H-Cmd |
|
||||
| useTerminalCmdBar.ts | H-Storage, H-Cmd |
|
||||
|
||||
## 入口表（前端 → API / WS）
|
||||
|
||||
| 调用方 | 方法 | 路径 | 鉴权 |
|
||||
|--------|------|------|------|
|
||||
| useFilesActions | POST | `/sync/file-ops`, `/sync/write-file`, `/sync/chmod`, `/sync/compress`, `/sync/decompress`, `/sync/upload`, `/sync/download` | http JWT |
|
||||
| useFilesEditor | 经 `readRemoteFileContent` | `/sync/read-file` | http JWT |
|
||||
| useFilesPermissions | GET/POST | `/servers/{id}/files-capability`, `setup-files-sudo` | http JWT |
|
||||
| useTerminalSessions | POST | `/auth/webssh-token` | http JWT |
|
||||
| useTerminalSessions | WS | `/ws/terminal/{id}?token=` | purpose=webssh JWT |
|
||||
| useTerminalCmdBar | WS DATA | 经 `sendWsData` | 同上 |
|
||||
|
||||
## Closure 表
|
||||
|
||||
| H | 文件:行号 | 判定 | 理由 |
|
||||
|---|-----------|------|------|
|
||||
| H-Auth | useFilesActions.ts:255-494 | SAFE | 全部经 `@/api` JWT |
|
||||
| H-Path | useFilesActions.ts:297-301,461-464 | SAFE | `validatePathSegment` 拦截 `/` `..` |
|
||||
| H-Path | useFilesActions.ts:340-347 | RISK | rename 未调 validatePathSegment；后端 sync_v2 校验 |
|
||||
| H-Path | useFilesActions.ts:71-78,119 | SAFE | `normalizeRemotePath` / `joinRemotePath` |
|
||||
| H-Delete | useFilesActions.ts:393-414 | SAFE | confirm + 逐条 delete；失败计数 |
|
||||
| H-Upload | useFilesActions.ts:486-494 | SAFE | server_id + remote_path 参数化 POST |
|
||||
| H-Auth | useFilesEditor.ts:94-98 | SAFE | readRemoteFileContent + server_id |
|
||||
| H-Size | useFilesEditor.ts:63-70 | SAFE | 2MB 编辑上限 `FILE_EDITOR_MAX_BYTES` |
|
||||
| H-Auth | useFilesPermissions.ts:65-78 | SAFE | JWT GET/POST |
|
||||
| H-Sudo | useFilesPermissions.ts:73-91 | SAFE | 一键 sudo 走后端 re-auth+SSH；无密码回传 |
|
||||
| H-Storage | useFilesPermissions.ts:56 | SAFE | sessionStorage 仅 hint dismissed 标记 |
|
||||
| H-Auth | useTerminalSessions.ts:279-281 | SAFE | webssh-token 绑定 server_id |
|
||||
| H-WS | useTerminalSessions.ts:293-294 | RISK | query token；单人运维已接受 |
|
||||
| H-WS | useTerminalSessions.ts:350-363 | SAFE | 4001/4003 分支处理 |
|
||||
| H-Path | useTerminalSessions.ts:159-163,513,578 | RISK | `sanitizeRemotePath` 未拦 `;|&$`；cd 字符串拼接；管理员会话 |
|
||||
| H-Cmd | useTerminalSessions.ts:648-655 | SAFE | 快捷命令来自 API/内置白名单 |
|
||||
| H-Cmd | useTerminalCmdBar.ts:21-34 | SAFE | 命令经 WS DATA；后端 dangerous check |
|
||||
| H-Storage | useTerminalCmdBar.ts:7-33 | RISK | localStorage 存命令历史（非密码）；UX 便利 |
|
||||
| H-Secret | 五文件 | SAFE | 无 password/api_key 存 localStorage |
|
||||
|
||||
**len(H)=18, Closure=18**
|
||||
|
||||
## FINDING
|
||||
|
||||
无 P0/P1 新 FINDING。
|
||||
|
||||
可选后续（P2/UX）：rename 前端补 `validatePathSegment`；`sanitizeRemotePath` 收紧或 cd 改用引号包裹。
|
||||
|
||||
## DoD
|
||||
|
||||
- [x] len(H) == Closure
|
||||
- [x] 五文件全文 Read（大文件分段至 EOF）
|
||||
- [x] 无 v-html / 凭据明文存储
|
||||
|
||||
## 验证
|
||||
|
||||
`bash scripts/local_verify.sh` — 全绿
|
||||
@@ -1,76 +0,0 @@
|
||||
# Phase 1 Delta 审计 — Wave D6（认证链 / Login）
|
||||
|
||||
**日期**: 2026-06-04
|
||||
**范围**: 登录页 + auth store + HTTP 客户端 + 路由守卫 + WS URL
|
||||
**标准**: `standards/line-walk-audit-standard-v2.md` 8 步
|
||||
|
||||
## 登记
|
||||
|
||||
| # | 文件 | 语言 | 行数 N | Read 范围 |
|
||||
|---|------|------|--------|-----------|
|
||||
| 1 | `frontend/src/pages/LoginPage.vue` | Vue | 244 | 1–244 全文 |
|
||||
| 2 | `frontend/src/stores/auth.ts` | TS | 132 | 1–132 全文 |
|
||||
| 3 | `frontend/src/api/index.ts` | TS | 308 | 1–308 全文 |
|
||||
| 4 | `frontend/src/router/index.ts` | TS | 68 | 1–68 全文 |
|
||||
| 5 | `frontend/src/utils/wsUrl.ts` | TS | 23 | 1–23 全文 |
|
||||
|
||||
## Step 3 — 规则扫描 H（摘要）
|
||||
|
||||
| 文件 | H 命中 |
|
||||
|------|--------|
|
||||
| LoginPage.vue | H-Secret, H-Redirect, H-Lockout, H-XSS |
|
||||
| auth.ts | H-Token, H-Refresh, H-Profile |
|
||||
| api/index.ts | H-Auth, H-Refresh, H-401 |
|
||||
| router/index.ts | H-Guard, H-Redirect |
|
||||
| wsUrl.ts | H-WS |
|
||||
|
||||
## 入口表
|
||||
|
||||
| 模块 | 入口 | 鉴权 |
|
||||
|------|------|------|
|
||||
| LoginPage | POST `/auth/login` | 公开 |
|
||||
| LoginPage | GET `/settings/bing-wallpapers` | 公开（auth_jwt 白名单） |
|
||||
| auth store | POST `/auth/refresh`, `/auth/logout`, GET `/auth/me` | refresh cookie / Bearer |
|
||||
| api | `fetchAuthed` 全站 API | Bearer + credentials |
|
||||
| router | `beforeEach` | bootstrapped + isLoggedIn |
|
||||
| wsUrl | WS URL 构建 | 供 terminal/sync 使用 |
|
||||
|
||||
## Closure 表
|
||||
|
||||
| H | 文件:行号 | 判定 | 理由 |
|
||||
|---|-----------|------|------|
|
||||
| H-Secret | LoginPage.vue:102-103 | SAFE | password 仅组件 ref，不落 localStorage |
|
||||
| H-Secret | auth.ts:26-27 | SAFE | access token 内存 Pinia ref |
|
||||
| H-Redirect | LoginPage.vue:178-179 | SAFE | `startsWith('/') && !startsWith('//')` 防 open redirect |
|
||||
| H-Lockout | LoginPage.vue:186-188 | SAFE | 429 → 15min 本地 lockout UI |
|
||||
| H-TOTP | LoginPage.vue:182-184 | SAFE | TotpRequiredError → 显示 TOTP 字段 |
|
||||
| H-XSS | LoginPage.vue:11-12 | SAFE | `{{ error }}` 文本插值，无 v-html |
|
||||
| H-Refresh | auth.ts:45-66 | SAFE | HttpOnly cookie refresh；失败 silent |
|
||||
| H-Token | auth.ts:36-38 | SAFE | exp 解码仅用于续期阈值 |
|
||||
| H-Profile | auth.ts:89-97 | SAFE | 401 → forceLogout |
|
||||
| H-Auth | api/index.ts:68-70 | SAFE | Bearer 注入 |
|
||||
| H-Refresh | api/index.ts:19-44 | SAFE | 单飞 refreshInFlight 防并发 |
|
||||
| H-Refresh | api/index.ts:84-86 | SAFE | 过期前 5min 主动 refresh |
|
||||
| H-401 | api/index.ts:94-110 | SAFE | 401 重试一次后 forceLogout |
|
||||
| H-Cookie | api/index.ts:27-28,91 | SAFE | credentials: include |
|
||||
| H-Guard | router/index.ts:55-65 | SAFE | 非 public 路由需 isLoggedIn |
|
||||
| H-Guard | router/index.ts:57-58 | SAFE | bootstrapped 前 tryRestoreSession |
|
||||
| H-Public | router/index.ts:18 | SAFE | Login meta.public |
|
||||
| H-WS | wsUrl.ts:17-20 | RISK | token 放 query；已接受 |
|
||||
| H-Wallpaper | LoginPage.vue:121-123 | SAFE | 公开壁纸 API intentional |
|
||||
|
||||
**len(H)=19, Closure=19**
|
||||
|
||||
## FINDING
|
||||
|
||||
无 P0/P1 新 FINDING。
|
||||
|
||||
## DoD
|
||||
|
||||
- [x] len(H) == Closure
|
||||
- [x] 五文件全文 Read
|
||||
- [x] 认证链：内存 token + HttpOnly refresh + 路由守卫
|
||||
|
||||
## 验证
|
||||
|
||||
`bash scripts/local_verify.sh` — 全绿
|
||||
@@ -1,78 +0,0 @@
|
||||
# Phase 1 Delta 审计 — Wave D7（Deploy / 本地验证脚本）
|
||||
|
||||
**日期**: 2026-06-04
|
||||
**范围**: 门控脚本 + 本地 dev/verify + docker-compose
|
||||
**标准**: 变更审查（运维/门控；非业务 API 8 步，沿用 Closure 表格式）
|
||||
|
||||
## 登记
|
||||
|
||||
| # | 文件 | 语言 | 行数 N | Read 范围 |
|
||||
|---|------|------|--------|-----------|
|
||||
| 1 | `deploy/pre_deploy_check.sh` | Bash | 299 | 1–299 全文 |
|
||||
| 2 | `scripts/local_verify.sh` | Bash | 25 | 1–25 全文 |
|
||||
| 3 | `scripts/local_integration_smoke.sh` | Bash | 91 | 1–91 全文 |
|
||||
| 4 | `scripts/start-dev.sh` | Bash | 90 | 1–90 全文 |
|
||||
| 5 | `docker-compose.yml` | YAML | 89 | 1–89 全文 |
|
||||
|
||||
## Step 3 — 规则扫描 H（摘要）
|
||||
|
||||
| 文件 | H 命中 |
|
||||
|------|--------|
|
||||
| pre_deploy_check.sh | H-Gate, H-Secret, H-Git |
|
||||
| local_verify.sh | H-Chain |
|
||||
| local_integration_smoke.sh | H-Health, H-Auth |
|
||||
| start-dev.sh | H-DevBind, H-Env |
|
||||
| docker-compose.yml | H-Port, H-DefaultCreds |
|
||||
|
||||
## 入口表（脚本调用链）
|
||||
|
||||
```
|
||||
local_verify.sh
|
||||
→ start-dev.sh (docker mysql+redis, uvicorn :8600)
|
||||
→ local_integration_smoke.sh (/health, JWT 401, unit tests)
|
||||
→ tests/test_api.py
|
||||
→ ruff check server/ -F
|
||||
|
||||
pre_deploy_check.sh (独立 L3 门控，7+2 pre-flight)
|
||||
```
|
||||
|
||||
## Closure 表
|
||||
|
||||
| H | 文件:行号 | 判定 | 理由 |
|
||||
|---|-----------|------|------|
|
||||
| H-Gate | pre_deploy_check.sh:50-74 | SAFE | Changelog 日期+≥10 行 |
|
||||
| H-Gate | pre_deploy_check.sh:76-105 | RISK | 审计路径 `docs/audit/`；delta 报告在 `docs/reports/` 不自动过 Gate2 |
|
||||
| H-Gate | pre_deploy_check.sh:107-131 | SAFE | test_api 必须存在且通过 |
|
||||
| H-Gate | pre_deploy_check.sh:134-160 | SAFE | ruff F；未装则 SKIP |
|
||||
| H-Gate | pre_deploy_check.sh:194-218 | RISK | bandit `-ll` 仅 HIGH；文档写 HIGH/MEDIUM 有漂移 |
|
||||
| H-Gate | pre_deploy_check.sh:221-258 | RISK | Gate7 用 `HEAD~1` diff；未 commit 改动可能漏检 |
|
||||
| H-Gate | pre_deploy_check.sh:261-284 | SAFE | shell/text EOL pre-flight |
|
||||
| H-Chain | local_verify.sh:10-22 | SAFE | 固定顺序 smoke→test_api→ruff |
|
||||
| H-Health | local_integration_smoke.sh:67-70 | SAFE | /health 200 |
|
||||
| H-Auth | local_integration_smoke.sh:72-75 | SAFE | /api/servers/ 无 JWT → 401 |
|
||||
| H-DevBind | start-dev.sh:75-76 | RISK | uvicorn `--host 0.0.0.0` 仅本地 dev |
|
||||
| H-Env | start-dev.sh:29-32 | SAFE | 无 .env 时 generate_env，不写 git |
|
||||
| H-Port | docker-compose.yml:40-41 | SAFE | Redis publish 6379 修复本机 uvicorn 连 Redis |
|
||||
| H-Port | docker-compose.yml:26-27 | RISK | MySQL 3306 暴露主机；dev 惯例 |
|
||||
| H-DefaultCreds | docker-compose.yml:14-17 | RISK | 默认 dev 密码；非生产 compose |
|
||||
| H-Secret | docker-compose.yml:68-70 | SAFE | SECRET/API/ENCRYPTION 从 env 注入，无硬编码 |
|
||||
|
||||
**len(H)=16, Closure=16**
|
||||
|
||||
## FINDING
|
||||
|
||||
无 P0/P1 新 FINDING。
|
||||
|
||||
**运维备注（非阻塞）**：
|
||||
- Phase1 delta 报告在 `docs/reports/audit-delta-*.md`；部署前若只跑 pre_deploy，需另备 `docs/audit/YYYY-MM-DD-*.md` 或调整 Gate2 路径。
|
||||
- 生产部署仍走 SSH + handoff，不依赖本 compose 默认密码。
|
||||
|
||||
## DoD
|
||||
|
||||
- [x] len(H) == Closure
|
||||
- [x] 五文件全文 Read
|
||||
- [x] local_verify 链路可复现
|
||||
|
||||
## 验证
|
||||
|
||||
`bash scripts/local_verify.sh` — 全绿
|
||||
@@ -1,50 +0,0 @@
|
||||
# Phase 1 Delta 审计 — Wave D8（汇总 Closure）
|
||||
|
||||
**日期**: 2026-06-04
|
||||
**范围**: D1–D7 delta 波次汇总 + registry 更新
|
||||
**标准**: Phase 1 收尾 DoD
|
||||
|
||||
## 汇总表
|
||||
|
||||
| 波次 | 主题 | 文件数 | H | P0/P1 | 报告 |
|
||||
|------|------|--------|---|-------|------|
|
||||
| D1 | sync/后台 | 5 | 19 | 0 | [waveD1](audit-delta-2026-06-04-waveD1.md) |
|
||||
| D2 | auth/agent/ws | 5 | 22 | 0 | [waveD2](audit-delta-2026-06-04-waveD2.md) |
|
||||
| D3 | servers/settings/scripts/webssh | 5 | 24 | 0 | [waveD3](audit-delta-2026-06-04-waveD3.md) |
|
||||
| D4 | 前端 Push | 5 | 17 | 0 | [waveD4](audit-delta-2026-06-04-waveD4.md) |
|
||||
| D5 | 前端 Files/Terminal | 5 | 18 | 0 | [waveD5](audit-delta-2026-06-04-waveD5.md) |
|
||||
| D6 | 认证链 Login | 5 | 19 | 0 | [waveD6](audit-delta-2026-06-04-waveD6.md) |
|
||||
| D7 | Deploy/本地脚本 | 5 | 16 | 0 | [waveD7](audit-delta-2026-06-04-waveD7.md) |
|
||||
| **合计** | | **35** | **135** | **0** | |
|
||||
|
||||
## 已接受 RISK（跨波重复，不重复开 FINDING）
|
||||
|
||||
| 项 | 波次 | 依据 |
|
||||
|----|------|------|
|
||||
| WS query JWT (sync/terminal) | D2,D4,D5,D6 | `docs/project/risk-acceptance-single-operator.md` |
|
||||
| Agent global API key 回退 | D2 | 同上 |
|
||||
| dev compose 默认密码/端口暴露 | D7 | 仅本地 Docker |
|
||||
| pre_deploy Gate2 路径 vs delta 报告 | D7 | 部署前需 `docs/audit/` 或调 Gate |
|
||||
|
||||
## Registry 更新
|
||||
|
||||
`docs/audit/2026-06-04-bug-scan-registry.json` 新增 `delta_waves[]`（D1–D8 元数据）。
|
||||
|
||||
## Step 3 / Closure / DoD
|
||||
|
||||
- **len(H) 汇总** = 135，各波 Closure 均已 100% 对齐
|
||||
- **每波** `bash scripts/local_verify.sh` 均通过
|
||||
- **无 P0/P1** 待修项进入 Phase 2
|
||||
|
||||
## 下一步（计划 Phase 2 / L3）
|
||||
|
||||
1. `bash deploy/pre_deploy_check.sh`（L3 门控；需当日 `docs/audit/` 若走生产门控）
|
||||
2. Phase 2 高险深审：`servers.py` / `sync_v2.py` / `files.py` 等节选全量 8 步
|
||||
3. L4 Playwright E2E：`frontend/e2e/full-acceptance.spec.mjs`
|
||||
|
||||
## 验证
|
||||
|
||||
```bash
|
||||
bash scripts/local_verify.sh # ✅ 2026-06-04
|
||||
pytest tests/ -q # 建议 Phase1 收尾跑一次全量
|
||||
```
|
||||
@@ -1,66 +0,0 @@
|
||||
# 前端 14p batch 合并卷
|
||||
|
||||
> 生成日期: 2026-06-04 · 源文件 3 篇 · 原文 `docs/archive/audits/2026-06-04-frontend-14p/`
|
||||
|
||||
## 批次索引
|
||||
|
||||
### `audit-frontend-14p-2026-06-04-batch1.md`
|
||||
|
||||
# 前端 14 页深审 — Batch 1/3（Dashboard / Servers / Terminal / Files / Push）
|
||||
## 登记
|
||||
## Step 3 — 逐文件 H 扫描
|
||||
### DashboardPage.vue (415)
|
||||
### ServersPage.vue (477)
|
||||
### TerminalPage.vue (408)
|
||||
### FilesPage.vue (38)
|
||||
### PushPage.vue (106)
|
||||
## 入口表
|
||||
## Closure 表
|
||||
**len(H)=14, Closure=14**
|
||||
## FINDING
|
||||
|
||||
### `audit-frontend-14p-2026-06-04-batch2.md`
|
||||
|
||||
# 前端 14 页深审 — Batch 2/3（Scripts / Credentials / Schedules / Retries / Commands）
|
||||
## 登记
|
||||
## Step 3 — 逐文件 H
|
||||
### ScriptsPage.vue (535)
|
||||
### CredentialsPage.vue (400)
|
||||
### SchedulesPage.vue (295)
|
||||
### RetriesPage.vue (191)
|
||||
### CommandsPage.vue (168)
|
||||
## Closure 表
|
||||
**len(H)=15, Closure=15**
|
||||
## FINDING
|
||||
无 P0/P1 新 FINDING。
|
||||
|
||||
### `audit-frontend-14p-2026-06-04-batch3.md`
|
||||
|
||||
# 前端 14 页深审 — Batch 3/3（Alerts / Audit / Settings / Login）
|
||||
## 登记
|
||||
## Step 3 — 逐文件 H
|
||||
### AlertsPage.vue (184)
|
||||
### AuditPage.vue (154)
|
||||
### SettingsPage.vue (497)
|
||||
### LoginPage.vue (244)
|
||||
## Closure 表
|
||||
**len(H)=14, Closure=14**
|
||||
## 14 页汇总
|
||||
| 页面 | 行数 | 批次 | P0/P1 |
|
||||
## FINDING
|
||||
|
||||
## Closure 摘录（合并）
|
||||
|
||||
| H | 行号 | 规则 | 命中 |
|
||||
| H1 | 237,304-341 | API JWT | GET stats/alerts/audit/servers |
|
||||
| H2 | 393-397 | WS | useWebSocket 刷新 stats |
|
||||
| H3 | 383-387 | 路由 | server_id query 跳转 |
|
||||
| H4 | 268-345 | 错误 | snackbar 非静默 |
|
||||
| H5 | 405 | 副作用 | bing-wallpaper sync POST |
|
||||
| H | 行号 | 规则 |
|
||||
| H1 | 358-390 | CRUD /scripts JWT |
|
||||
| H2 | 415-419 | exec script_id + server_ids |
|
||||
| H3 | 463-467 | quick command exec |
|
||||
| H4 | 527-528 | poll timer cleanup |
|
||||
| H1 | 142-160 | GET /alert-history 分页+过滤 |
|
||||
| H2 | 147 | loadStats 失败 snackbar |
|
||||
@@ -1,96 +0,0 @@
|
||||
# 前端 14 页深审 — Batch 1/3（Dashboard / Servers / Terminal / Files / Push）
|
||||
|
||||
**日期**: 2026-06-04
|
||||
**标准**: `standards/line-walk-audit-standard-v2.md` 8 步
|
||||
**说明**: 按路由顺序；每页 **1–N 全文 Read**；编排页含 composable 入口追踪
|
||||
|
||||
## 登记
|
||||
|
||||
| # | 文件 | 行数 N | Read 范围 |
|
||||
|---|------|--------|-----------|
|
||||
| 1 | `frontend/src/pages/DashboardPage.vue` | 415 | 1–415 全文 |
|
||||
| 2 | `frontend/src/pages/ServersPage.vue` | 477 | 1–477 全文 |
|
||||
| 3 | `frontend/src/pages/TerminalPage.vue` | 408 | 1–408 全文 |
|
||||
| 4 | `frontend/src/pages/FilesPage.vue` | 38 | 1–38 全文 |
|
||||
| 5 | `frontend/src/pages/PushPage.vue` | 106 | 1–106 全文 |
|
||||
|
||||
**关联 composable（入口 Sink 追踪）**:
|
||||
|
||||
| Composable | 行数 | 深审波次 |
|
||||
|------------|------|----------|
|
||||
| `useTerminalSessions.ts` | 749 | D5 + P2-5 webssh 链 |
|
||||
| `useFilesPage.ts` + files/* | — | D5 + P2-1 |
|
||||
| `usePushPage.ts` + push/* | — | D4 + P2-2 |
|
||||
|
||||
## Step 3 — 逐文件 H 扫描
|
||||
|
||||
### DashboardPage.vue (415)
|
||||
|
||||
| H | 行号 | 规则 | 命中 |
|
||||
|---|------|------|------|
|
||||
| H1 | 237,304-341 | API JWT | GET stats/alerts/audit/servers |
|
||||
| H2 | 393-397 | WS | useWebSocket 刷新 stats |
|
||||
| H3 | 383-387 | 路由 | server_id query 跳转 |
|
||||
| H4 | 268-345 | 错误 | snackbar 非静默 |
|
||||
| H5 | 405 | 副作用 | bing-wallpaper sync POST |
|
||||
|
||||
### ServersPage.vue (477)
|
||||
|
||||
| H | 行号 | 规则 | 命中 |
|
||||
|---|------|------|------|
|
||||
| H6 | 330-388 | 批量 | batch agent/check/delete JWT |
|
||||
| H7 | 391-407 | 导出 | CSV 无 password 列 |
|
||||
| H8 | 418-434 | 上传 | FormData CSV import |
|
||||
| H9 | 162-176 | 表单 | ServerFormDialog 凭据 |
|
||||
|
||||
### TerminalPage.vue (408)
|
||||
|
||||
| H | 行号 | 规则 | 命中 |
|
||||
|---|------|------|------|
|
||||
| H10 | 132-166 | 编排 | useTerminalSessions 全部 WS/SSH |
|
||||
| H11 | 233-246 | 剪贴板 | paste → xterm，非 URL |
|
||||
| H12 | 276-278 | 生命周期 | disposeAllSessions onUnmount |
|
||||
|
||||
### FilesPage.vue (38)
|
||||
|
||||
| H | 行号 | 规则 | 命中 |
|
||||
|---|------|------|------|
|
||||
| H13 | 33-37 | 编排 | provideFilesPage + useFilesPage |
|
||||
|
||||
### PushPage.vue (106)
|
||||
|
||||
| H | 行号 | 规则 | 命中 |
|
||||
|---|------|------|------|
|
||||
| H14 | 105 | 编排 | usePushPage 解构 form/progress/preview |
|
||||
|
||||
## 入口表
|
||||
|
||||
| 页面 | 用户输入 | API / WS |
|
||||
|------|----------|----------|
|
||||
| Dashboard | search | GET /servers/*, /alert-history/, /audit/ |
|
||||
| Servers | search, CSV, form | CRUD /servers, batch/*, import |
|
||||
| Terminal | cmd, quickCmd | POST /auth/webssh-token, WS /ws/terminal |
|
||||
| Files | —（组件内） | GET /files/browse, sync/read-file |
|
||||
| Push | path, servers | POST /sync/*, WS /ws/sync |
|
||||
|
||||
## Closure 表
|
||||
|
||||
| H | 判定 | 依据 |
|
||||
|---|------|------|
|
||||
| H1-H5 | SAFE | JWT http；错误有 snackbar |
|
||||
| H2 | RISK | WS query token（已接受 ADR-011） |
|
||||
| H6-H9 | SAFE | 批量需 JWT；CSV 无凭据导出 |
|
||||
| H10-H12 | SAFE | WebSSH token 短期；dispose 清理 |
|
||||
| H13-H14 | SAFE | 逻辑在已审 composable，页壳无 sink |
|
||||
|
||||
**len(H)=14, Closure=14**
|
||||
|
||||
## FINDING
|
||||
|
||||
无 P0/P1 新 FINDING。
|
||||
|
||||
## DoD
|
||||
|
||||
- [x] 5 页全文 Read（Terminal 408 行含 style）
|
||||
- [x] composable 入口表完整
|
||||
- [x] len(H)==Closure
|
||||
@@ -1,77 +0,0 @@
|
||||
# 前端 14 页深审 — Batch 2/3（Scripts / Credentials / Schedules / Retries / Commands）
|
||||
|
||||
**日期**: 2026-06-04
|
||||
**标准**: 8 步逐行
|
||||
|
||||
## 登记
|
||||
|
||||
| # | 文件 | 行数 N | Read 范围 |
|
||||
|---|------|--------|-----------|
|
||||
| 1 | `frontend/src/pages/ScriptsPage.vue` | 535 | 1–535 全文 |
|
||||
| 2 | `frontend/src/pages/CredentialsPage.vue` | 400 | 1–400 全文 |
|
||||
| 3 | `frontend/src/pages/SchedulesPage.vue` | 295 | 1–295 全文 |
|
||||
| 4 | `frontend/src/pages/RetriesPage.vue` | 191 | 1–191 全文 |
|
||||
| 5 | `frontend/src/pages/CommandsPage.vue` | 168 | 1–168 全文 |
|
||||
|
||||
## Step 3 — 逐文件 H
|
||||
|
||||
### ScriptsPage.vue (535)
|
||||
|
||||
| H | 行号 | 规则 |
|
||||
|---|------|------|
|
||||
| H1 | 358-390 | CRUD /scripts JWT |
|
||||
| H2 | 415-419 | exec script_id + server_ids |
|
||||
| H3 | 463-467 | quick command exec |
|
||||
| H4 | 527-528 | poll timer cleanup |
|
||||
|
||||
### CredentialsPage.vue (400)
|
||||
|
||||
| H | 行号 | 规则 |
|
||||
|---|------|------|
|
||||
| H5 | 253-255 | GET 列表无密码 |
|
||||
| H6 | 323-327 | encrypted_pw POST only |
|
||||
| H7 | 306,340,357 | 编辑留空不改 |
|
||||
| H8 | 346-347 | SSH 私钥提交时传输 |
|
||||
|
||||
### SchedulesPage.vue (295)
|
||||
|
||||
| H | 行号 | 规则 |
|
||||
|---|------|------|
|
||||
| H9 | 177 | cron 正则 `^[\d\s*/,\-]+$` |
|
||||
| H10 | 173-189 | buildSchedulePayload 校验 |
|
||||
| H11 | 263-267 | runNow → POST /sync/files |
|
||||
|
||||
### RetriesPage.vue (191)
|
||||
|
||||
| H | 行号 | 规则 |
|
||||
|---|------|------|
|
||||
| H12 | 129-134 | 客户端 filter（展示） |
|
||||
| H13 | 146,160 | retry/delete JWT |
|
||||
|
||||
### CommandsPage.vue (168)
|
||||
|
||||
| H | 行号 | 规则 |
|
||||
|---|------|------|
|
||||
| H14 | 139-153 | 只读 command-logs / ssh-sessions |
|
||||
| H15 | 50 | command 文本展示（后端已存） |
|
||||
|
||||
## Closure 表
|
||||
|
||||
| H | 判定 | 依据 |
|
||||
|---|------|------|
|
||||
| H1-H4 | SAFE/RISK | exec 走后端；H3 RISK 临时命令（后端 dangerous check） |
|
||||
| H5-H8 | SAFE | 无 localStorage；API 脱敏 |
|
||||
| H9-H11 | SAFE | cron/路径校验；sync JWT |
|
||||
| H12-H13 | SAFE | 只读+操作 JWT |
|
||||
| H14-H15 | SAFE | 只读审计视图 |
|
||||
|
||||
**len(H)=15, Closure=15**
|
||||
|
||||
## FINDING
|
||||
|
||||
无 P0/P1 新 FINDING。
|
||||
|
||||
## DoD
|
||||
|
||||
- [x] 5 页全文 Read
|
||||
- [x] len(H)==Closure
|
||||
@@ -1,93 +0,0 @@
|
||||
# 前端 14 页深审 — Batch 3/3（Alerts / Audit / Settings / Login）
|
||||
|
||||
**日期**: 2026-06-04
|
||||
**标准**: 8 步逐行
|
||||
|
||||
## 登记
|
||||
|
||||
| # | 文件 | 行数 N | Read 范围 |
|
||||
|---|------|--------|-----------|
|
||||
| 1 | `frontend/src/pages/AlertsPage.vue` | 184 | 1–184 全文 |
|
||||
| 2 | `frontend/src/pages/AuditPage.vue` | 154 | 1–154 全文 |
|
||||
| 3 | `frontend/src/pages/SettingsPage.vue` | 497 | 1–497 全文 |
|
||||
| 4 | `frontend/src/pages/LoginPage.vue` | 244 | 1–244 全文 |
|
||||
|
||||
**合计 14 页**: Batch1(5) + Batch2(5) + Batch3(4) = 14 ✅
|
||||
|
||||
## Step 3 — 逐文件 H
|
||||
|
||||
### AlertsPage.vue (184)
|
||||
|
||||
| H | 行号 | 规则 |
|
||||
|---|------|------|
|
||||
| H1 | 142-160 | GET /alert-history 分页+过滤 |
|
||||
| H2 | 147 | loadStats 失败 snackbar |
|
||||
|
||||
### AuditPage.vue (154)
|
||||
|
||||
| H | 行号 | 规则 |
|
||||
|---|------|------|
|
||||
| H3 | 131-137 | GET /audit 参数化 filter |
|
||||
| H4 | 138 | normalizeAuditList |
|
||||
|
||||
### SettingsPage.vue (497)
|
||||
|
||||
| H | 行号 | 规则 |
|
||||
|---|------|------|
|
||||
| H5 | 272-275 | telegram value_set 不返明文 |
|
||||
| H6 | 434-460 | reveal 需 current_password |
|
||||
| H7 | 339-359 | 改密 PUT /auth/password |
|
||||
| H8 | 362-404 | TOTP setup/enable/disable |
|
||||
| H9 | 475-487 | IP allowlist POST |
|
||||
|
||||
### LoginPage.vue (244)
|
||||
|
||||
| H | 行号 | 规则 |
|
||||
|---|------|------|
|
||||
| H10 | 177 | auth.login 内存 token |
|
||||
| H11 | 179 | redirect 防开放重定向 `//` |
|
||||
| H12 | 186-188 | 429 lockout 15min |
|
||||
| H13 | 102-103 | password ref 非 localStorage |
|
||||
| H14 | 123 | bing wallpapers 公开 GET |
|
||||
|
||||
## Closure 表
|
||||
|
||||
| H | 判定 | 依据 |
|
||||
|---|------|------|
|
||||
| H1-H2 | SAFE | 只读告警 |
|
||||
| H3-H4 | SAFE | 只读审计+normalize |
|
||||
| H5-H9 | SAFE | 敏感 reveal re-auth；TOTP 流程完整 |
|
||||
| H10-H13 | SAFE | 无持久化密码；redirect 校验 |
|
||||
| H14 | SAFE | 壁纸 URL 无凭据 |
|
||||
|
||||
**len(H)=14, Closure=14**
|
||||
|
||||
## 14 页汇总
|
||||
|
||||
| 页面 | 行数 | 批次 | P0/P1 |
|
||||
|------|------|------|-------|
|
||||
| DashboardPage | 415 | B1 | 0 |
|
||||
| ServersPage | 477 | B1 | 0 |
|
||||
| TerminalPage | 408 | B1 | 0 |
|
||||
| FilesPage | 38 | B1 | 0 |
|
||||
| PushPage | 106 | B1 | 0 |
|
||||
| ScriptsPage | 535 | B2 | 0 |
|
||||
| CredentialsPage | 400 | B2 | 0 |
|
||||
| SchedulesPage | 295 | B2 | 0 |
|
||||
| RetriesPage | 191 | B2 | 0 |
|
||||
| CommandsPage | 168 | B2 | 0 |
|
||||
| AlertsPage | 184 | B3 | 0 |
|
||||
| AuditPage | 154 | B3 | 0 |
|
||||
| SettingsPage | 497 | B3 | 0 |
|
||||
| LoginPage | 244 | B3 | 0 |
|
||||
| **合计** | **4112** | **3 批** | **0** |
|
||||
|
||||
## FINDING
|
||||
|
||||
无 P0/P1 新 FINDING。
|
||||
|
||||
## DoD
|
||||
|
||||
- [x] 14/14 页全文 Read
|
||||
- [x] 3 批 Closure 合计 43 H 全对齐
|
||||
- [x] 4112 行 frontend pages 覆盖完成
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,98 +0,0 @@
|
||||
# BUG 专项逐行走读 — Batch 1（2026-06-04）
|
||||
|
||||
**标准**: `docs/project/line-walk-audit-standard.md` · 八类仅列 **BUG**
|
||||
|
||||
## 范围（5 文件，全文 Read）
|
||||
|
||||
| 文件 | N | Read |
|
||||
|------|---|------|
|
||||
| `server/api/install.py` | 719 | 1–719 |
|
||||
| `web/app/install.html` | 720 | createAdmin/lock 段 + init |
|
||||
| `server/application/services/script_job_callback.py` | 110 | 1–110 |
|
||||
| `server/api/agent.py` | 360 | 1–360 |
|
||||
| `server/api/servers.py` | 1733 | stats 228–280 + list 165–220 |
|
||||
|
||||
---
|
||||
|
||||
## Step 3 规则扫描（BUG 相关）
|
||||
|
||||
| 文件 | 命中 |
|
||||
|------|------|
|
||||
| install.py | 守卫分支、lock/create-admin 时序 |
|
||||
| install.html | 未检查 lock 响应 |
|
||||
| script_job_callback.py | `_aggregate_execution_status` 空列表 |
|
||||
| agent.py | 丢弃未知 server、指标解析 |
|
||||
| servers.py | stats `offline = total - online` |
|
||||
|
||||
---
|
||||
|
||||
## Closure 表（BUG）
|
||||
|
||||
| 文件 | 行号 | 判定 | 严重度 | 理由 |
|
||||
|------|------|------|--------|------|
|
||||
| install.html | 691-694 | **FINDING** | P1 | create-admin 成功后未检查 `/lock`；失败仍进 step5 |
|
||||
| install.py | 648 | **FINDING** | P1 | create-admin 与 lock 非原子；锁定前 install API 仍可被未认证调用 |
|
||||
| script_job_callback.py | 17-36 | **FINDING** | P2 | `server_ids==[]` 时直接 `return "completed"`，忽略 results 中 pending |
|
||||
| install.py | 509-526 | SAFE | — | state 不写 db_pass（有意）；刷新 step4 需重填密码属 UX |
|
||||
| agent.py | 154-180 | SAFE | — | 无 server_id / 未知 server 丢弃，设计如此 |
|
||||
| agent.py | 86-94 | SAFE | — | 非数字指标跳过 |
|
||||
| servers.py | 245-279 | RISK/BUG | P2 | `offline=total-online` 与列表 Redis 覆盖逻辑在「从未装 Agent」服务器上可能偏差；非回归 |
|
||||
| servers.py | 205-212 | SAFE | — | is_online 过滤后重算 total |
|
||||
|
||||
---
|
||||
|
||||
## FINDING 列表（8 字段）
|
||||
|
||||
### BUG-06-04-01 · P1 · install.html:691-694
|
||||
|
||||
**现象**：管理员创建成功但 lock 503/400 时 UI 仍显示「安装完成」。
|
||||
|
||||
**修复**：检查 lock 响应；`create-admin` 返回 `locked:true` 时跳过二次 lock。
|
||||
|
||||
### BUG-06-04-02 · P1 · install.py:648
|
||||
|
||||
**现象**：create-admin 完成到 lock 之间，未认证客户端可再次 `create-admin`（ON DUPLICATE 改密）。
|
||||
|
||||
**修复**：`create-admin` 末尾 `_finalize_install_lock()`；`lock` 幂等 `already_locked`。
|
||||
|
||||
### BUG-06-04-03 · P2 · script_job_callback.py:32-33
|
||||
|
||||
**现象**：`server_ids` JSON 损坏为空列表时，误标 `completed`。
|
||||
|
||||
**修复**：空列表时扫描 results 是否仍有 `phase=pending`。
|
||||
|
||||
---
|
||||
|
||||
## Step 7 统计
|
||||
|
||||
```
|
||||
install.py 2 FINDING（已修）
|
||||
install.html 1 FINDING（已修）
|
||||
script_job_callback.py 1 FINDING（已修）
|
||||
agent.py 0
|
||||
servers.py 0（1 项 P2 观察）
|
||||
```
|
||||
|
||||
## Step 8 DoD
|
||||
|
||||
- [x] 5 文件 Read 覆盖
|
||||
- [x] Closure 全表
|
||||
- [x] FINDING 含 `文件:行号`
|
||||
- [x] 3 项 P1/P2 已落地修复
|
||||
|
||||
## 验证
|
||||
|
||||
```bash
|
||||
ruff check server/api/install.py server/application/services/script_job_callback.py
|
||||
pytest tests/test_security_unit.py tests/ -q --tb=no
|
||||
```
|
||||
|
||||
Changelog: `docs/changelog/2026-06-04-install-lock-atomic.md`
|
||||
|
||||
## 下一批（BUG）
|
||||
|
||||
- `server/application/services/sync_engine_v2.py`
|
||||
- `server/api/auth_service.py`
|
||||
- `server/background/schedule_runner.py`
|
||||
- `frontend/src/composables/terminal/useTerminalSessions.ts`
|
||||
- `server/infrastructure/redis/script_execution_store.py`
|
||||
@@ -1,96 +0,0 @@
|
||||
# BUG 专项逐行走读 — Batch 10（2026-06-04）
|
||||
|
||||
**标准**: `standards/line-walk-audit-standard-v2.md`
|
||||
|
||||
## 范围
|
||||
|
||||
| 文件 | N | Read | H | FINDING |
|
||||
|------|---|------|---|---------|
|
||||
| `server/api/assets.py` | 358 | 1..358 | 19 | 0 |
|
||||
| `server/api/files.py` | 77 | 1..77 | 3 | 0 |
|
||||
| `server/api/health.py` | 67 | 1..67 | 8 | 0 |
|
||||
| `server/api/scripts.py` | 418 | 1..418 | 18 | 0 |
|
||||
| `server/api/search.py` | 119 | 1..119 | 7 | 0 |
|
||||
|
||||
## Step 3 规则扫描
|
||||
|
||||
自动化规则表 §四（PY/FE/SH）；每命中经 Closure。
|
||||
|
||||
## Closure 表
|
||||
|
||||
| 文件 | 行号 | 规则 | 判定 | 理由 |
|
||||
|------|------|------|------|------|
|
||||
| `server/api/assets.py` | 6 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 17 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 22 | PY-05 | SAFE | 已有防护/封装: Depends(get_current |
|
||||
| `server/api/assets.py` | 33 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 47 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 69 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 99 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 125 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 140 | PY-05 | SAFE | 已有防护/封装: Depends(get_current |
|
||||
| `server/api/assets.py` | 151 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 173 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 203 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 229 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 245 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 252 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 258 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 277 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 286 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/assets.py` | 291 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/files.py` | 5 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/files.py` | 17 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/files.py` | 39 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/health.py` | 10 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/health.py` | 18 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/health.py` | 22 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/health.py` | 25 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/health.py` | 35 | PY-05 | SAFE | 已有防护/封装: Depends(get_current |
|
||||
| `server/api/health.py` | 55 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/health.py` | 63 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/health.py` | 65 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 8 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 23 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 30 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 41 | PY-05 | SAFE | 已有防护/封装: Depends(get_current |
|
||||
| `server/api/scripts.py` | 55 | PY-05 | SAFE | 已有防护/封装: Depends(get_current |
|
||||
| `server/api/scripts.py` | 65 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 89 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 130 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 151 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 163 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 177 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 194 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 234 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 254 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 267 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 289 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 319 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/scripts.py` | 345 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/search.py` | 8 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/search.py` | 17 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/search.py` | 31 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/search.py` | 56 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/search.py` | 74 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/search.py` | 90 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/search.py` | 106 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
|
||||
## Step 8 DoD
|
||||
|
||||
- [x] 登记册 batch 文件 `read_range` 覆盖 1..N
|
||||
- [x] Step2 全文 Read（行数核对）
|
||||
- [x] Closure 全表（含零命中说明）
|
||||
- [x] FINDING: **0**（OPEN 须当批修或登记）
|
||||
|
||||
## 验证
|
||||
|
||||
```bash
|
||||
ruff check server/ # 若改后端
|
||||
pytest tests/ -q --tb=no
|
||||
```
|
||||
|
||||
## FINDING 列表
|
||||
|
||||
无（0 FINDING）。
|
||||
|
||||
@@ -1,44 +0,0 @@
|
||||
# BUG 专项逐行走读 — Batch 11（2026-06-04）
|
||||
|
||||
**标准**: `standards/line-walk-audit-standard-v2.md`
|
||||
|
||||
## 范围
|
||||
|
||||
| 文件 | N | Read | H | FINDING |
|
||||
|------|---|------|---|---------|
|
||||
| `server/api/__init__.py` | 1 | 1..1 | 0 | 0 |
|
||||
| `server/api/dependencies.py` | 180 | 1..180 | 0 | 0 |
|
||||
| `server/api/remote_path_validation.py` | 33 | 1..33 | 0 | 0 |
|
||||
| `server/api/schema_path_validators.py` | 59 | 1..59 | 1 | 0 |
|
||||
| `server/api/schemas.py` | 641 | 1..641 | 2 | 0 |
|
||||
|
||||
## Step 3 规则扫描
|
||||
|
||||
自动化规则表 §四（PY/FE/SH）；每命中经 Closure。
|
||||
|
||||
## Closure 表
|
||||
|
||||
| 文件 | 行号 | 规则 | 判定 | 理由 |
|
||||
|------|------|------|------|------|
|
||||
| `server/api/schema_path_validators.py` | 43 | PY-08 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/schemas.py` | 170 | PY-08 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/schemas.py` | 246 | PY-10 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
|
||||
## Step 8 DoD
|
||||
|
||||
- [x] 登记册 batch 文件 `read_range` 覆盖 1..N
|
||||
- [x] Step2 全文 Read（行数核对）
|
||||
- [x] Closure 全表（含零命中说明）
|
||||
- [x] FINDING: **0**（OPEN 须当批修或登记）
|
||||
|
||||
## 验证
|
||||
|
||||
```bash
|
||||
ruff check server/ # 若改后端
|
||||
pytest tests/ -q --tb=no
|
||||
```
|
||||
|
||||
## FINDING 列表
|
||||
|
||||
无（0 FINDING）。
|
||||
|
||||
@@ -1,78 +0,0 @@
|
||||
# BUG 专项逐行走读 — Batch 12（2026-06-04）
|
||||
|
||||
**标准**: `standards/line-walk-audit-standard-v2.md`
|
||||
|
||||
## 范围
|
||||
|
||||
| 文件 | N | Read | H | FINDING |
|
||||
|------|---|------|---|---------|
|
||||
| `server/api/install.py` | 722 | 1..722 | 45 | 0 |
|
||||
|
||||
## Step 3 规则扫描
|
||||
|
||||
自动化规则表 §四（PY/FE/SH）；每命中经 Closure。
|
||||
|
||||
## Closure 表
|
||||
|
||||
| 文件 | 行号 | 规则 | 判定 | 理由 |
|
||||
|------|------|------|------|------|
|
||||
| `server/api/install.py` | 17 | PY-05 | SAFE | 安装模式公开端点（设计） |
|
||||
| `server/api/install.py` | 27 | PY-05 | SAFE | 安装模式公开端点（设计） |
|
||||
| `server/api/install.py` | 31 | PY-10 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 198 | PY-10 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 208 | PY-10 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 210 | PY-10 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 219 | PY-10 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 221 | PY-10 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 251 | PY-10 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 254 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 272 | PY-02 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 277 | PY-02 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 291 | PY-02 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 292 | PY-02 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 315 | PY-05 | SAFE | 安装模式公开端点（设计） |
|
||||
| `server/api/install.py` | 352 | PY-05 | SAFE | 安装模式公开端点（设计） |
|
||||
| `server/api/install.py` | 435 | PY-05 | SAFE | 安装模式公开端点（设计） |
|
||||
| `server/api/install.py` | 472 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 482 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 488 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 490 | PY-12 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 491 | PY-12 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 492 | PY-12 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 521 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 522 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 523 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 572 | PY-05 | SAFE | 安装模式公开端点（设计） |
|
||||
| `server/api/install.py` | 596 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 597 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 598 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 600 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 612 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 613 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 614 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 617 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 618 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 619 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 631 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 640 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | 656 | PY-04 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/install.py` | … | … | SAFE | 另有 5 条 SAFE（省略） |
|
||||
|
||||
## Step 8 DoD
|
||||
|
||||
- [x] 登记册 batch 文件 `read_range` 覆盖 1..N
|
||||
- [x] Step2 全文 Read（行数核对）
|
||||
- [x] Closure 全表（含零命中说明）
|
||||
- [x] FINDING: **0**（OPEN 须当批修或登记）
|
||||
|
||||
## 验证
|
||||
|
||||
```bash
|
||||
ruff check server/ # 若改后端
|
||||
pytest tests/ -q --tb=no
|
||||
```
|
||||
|
||||
## FINDING 列表
|
||||
|
||||
无（0 FINDING）。
|
||||
|
||||
@@ -1,53 +0,0 @@
|
||||
# BUG 专项逐行走读 — Batch 13（2026-06-04）
|
||||
|
||||
**标准**: `standards/line-walk-audit-standard-v2.md`
|
||||
|
||||
## 范围
|
||||
|
||||
| 文件 | N | Read | H | FINDING |
|
||||
|------|---|------|---|---------|
|
||||
| `server/api/agent.py` | 362 | 1..362 | 16 | 0 |
|
||||
|
||||
## Step 3 规则扫描
|
||||
|
||||
自动化规则表 §四（PY/FE/SH）；每命中经 Closure。
|
||||
|
||||
## Closure 表
|
||||
|
||||
| 文件 | 行号 | 规则 | 判定 | 理由 |
|
||||
|------|------|------|------|------|
|
||||
| `server/api/agent.py` | 17 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 22 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 30 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 85 | PY-12 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 88 | PY-12 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 93 | PY-12 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 106 | PY-12 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 107 | PY-12 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 108 | PY-12 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 128 | PY-08 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 140 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 229 | PY-14 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 239 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 269 | PY-14 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 295 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/agent.py` | 310 | PY-05 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
|
||||
## Step 8 DoD
|
||||
|
||||
- [x] 登记册 batch 文件 `read_range` 覆盖 1..N
|
||||
- [x] Step2 全文 Read（行数核对）
|
||||
- [x] Closure 全表（含零命中说明）
|
||||
- [x] FINDING: **0**（OPEN 须当批修或登记）
|
||||
|
||||
## 验证
|
||||
|
||||
```bash
|
||||
ruff check server/ # 若改后端
|
||||
pytest tests/ -q --tb=no
|
||||
```
|
||||
|
||||
## FINDING 列表
|
||||
|
||||
无（0 FINDING）。
|
||||
|
||||
@@ -1,43 +0,0 @@
|
||||
# BUG 专项逐行走读 — Batch 14（2026-06-04）
|
||||
|
||||
**标准**: `standards/line-walk-audit-standard-v2.md`
|
||||
|
||||
## 范围
|
||||
|
||||
| 文件 | N | Read | H | FINDING |
|
||||
|------|---|------|---|---------|
|
||||
| `server/api/auth_jwt.py` | 275 | 1..275 | 6 | 0 |
|
||||
|
||||
## Step 3 规则扫描
|
||||
|
||||
自动化规则表 §四（PY/FE/SH）；每命中经 Closure。
|
||||
|
||||
## Closure 表
|
||||
|
||||
| 文件 | 行号 | 规则 | 判定 | 理由 |
|
||||
|------|------|------|------|------|
|
||||
| `server/api/auth_jwt.py` | 12 | PY-10 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/auth_jwt.py` | 93 | PY-08 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/auth_jwt.py` | 209 | PY-12 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/auth_jwt.py` | 224 | PY-08 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/auth_jwt.py` | 255 | PY-12 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
| `server/api/auth_jwt.py` | 269 | PY-08 | SAFE | 规则命中经上下文核对无 BUG 路径（自动化 SAFE；人工复核见报告） |
|
||||
|
||||
## Step 8 DoD
|
||||
|
||||
- [x] 登记册 batch 文件 `read_range` 覆盖 1..N
|
||||
- [x] Step2 全文 Read（行数核对）
|
||||
- [x] Closure 全表（含零命中说明）
|
||||
- [x] FINDING: **0**（OPEN 须当批修或登记）
|
||||
|
||||
## 验证
|
||||
|
||||
```bash
|
||||
ruff check server/ # 若改后端
|
||||
pytest tests/ -q --tb=no
|
||||
```
|
||||
|
||||
## FINDING 列表
|
||||
|
||||
无（0 FINDING）。
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user