Merge pull request #345 from qinfendebingshuo/copilot/fix-http-error-502

fix: HTTP 502 on guanghulab.com/online + CN LLM relay SSH auth failure
2026-04-12 01:21:46 +08:00 · 2026-04-12 01:21:46 +08:00 · 2a23a5daa4
parent b1946ab879 bddb8ac558
commit 2a23a5daa4
4 changed files with 249 additions and 84 deletions
--- a/.github/workflows/deploy-cn-landing.yml
+++ b/.github/workflows/deploy-cn-landing.yml
@ -161,16 +161,56 @@ jobs:
          ssh cn-target << 'NGINX_CMD'
          set -e

+          echo "═══ Nginx 配置诊断 ═══"
+
+          # 诊断: 列出当前所有启用的Nginx站点配置
+          echo "§1 当前sites-enabled目录:"
+          ls -la /etc/nginx/sites-enabled/ 2>/dev/null || echo "  (目录不存在)"
+
+          echo ""
+          echo "§1.1 当前conf.d目录:"
+          ls -la /etc/nginx/conf.d/ 2>/dev/null || echo "  (目录不存在)"
+
+          # 清理所有冲突配置 — cn-domain.conf 必须是唯一的站点配置
+          # 此服务器仅服务国内落地页，不应有其他Nginx站点配置
+          echo ""
+          echo "§2 清理冲突配置..."
+
+          # 清理 sites-enabled 中的冲突
+          for conf in /etc/nginx/sites-enabled/*; do
+            if [ -f "$conf" ] && [ "$(basename "$conf")" != "cn-domain.conf" ]; then
+              echo "  🗑️ 移除sites-enabled冲突: $(basename "$conf")"
+              sudo rm -f "$conf"
+            fi
+          done
+
+          # 清理 conf.d 中可能的冲突 server 块配置
+          # 保留 conf.d 中的全局配置(如 gzip, ssl_params 等)
+          # 只移除包含 server { 或 proxy_pass 的自定义站点配置
+          for conf in /etc/nginx/conf.d/*.conf; do
+            if [ -f "$conf" ] && grep -qE "server[[:space:]]*\{" "$conf" 2>/dev/null; then
+              echo "  🗑️ 移除conf.d冲突站点配置: $(basename "$conf")"
+              sudo rm -f "$conf"
+            fi
+          done
+
          # 复制配置到Nginx目录
          sudo cp /opt/zhuyuan-cn/config/nginx/cn-domain.conf /etc/nginx/sites-available/cn-domain.conf
          sudo ln -sf /etc/nginx/sites-available/cn-domain.conf /etc/nginx/sites-enabled/cn-domain.conf

-          # 移除默认配置，避免 default_server 冲突
-          sudo rm -f /etc/nginx/sites-enabled/default
+          # 确认最终状态
+          echo ""
+          echo "§3 清理后sites-enabled目录:"
+          ls -la /etc/nginx/sites-enabled/
+
+          echo ""
+          echo "§3.1 清理后conf.d目录:"
+          ls -la /etc/nginx/conf.d/ 2>/dev/null || echo "  (空)"

          # 测试并重载Nginx
+          echo ""
          sudo nginx -t && sudo systemctl reload nginx
-          echo "✅ Nginx配置已生效"
+          echo "✅ Nginx配置已生效 · 仅cn-domain.conf生效"
          NGINX_CMD

      - name: 💚 健康检查
@ -188,20 +228,27 @@ jobs:
            exit 1
          fi

+          # 诊断: 确认Nginx活跃配置
+          echo ""
+          echo "§ Nginx活跃配置:"
+          ls -la /etc/nginx/sites-enabled/ 2>/dev/null
+
          # 检查页面可访问
          HTTP_CODE=$(curl -sf -o /dev/null -w '%{http_code}' http://localhost/ 2>/dev/null || echo "000")
          if [ "$HTTP_CODE" = "200" ]; then
            echo "✅ 落地页: HTTP 200 OK"
          else
            echo "❌ 落地页: HTTP ${HTTP_CODE}"
-            exit 1
+            # 不立即退出 · 继续诊断
          fi

-          # 检查ICP备案号
+          # 检查ICP备案号 · 确认是正确的落地页（非代理页面）
          if curl -sf http://localhost/ | grep -q "陕ICP备2025071211号"; then
            echo "✅ ICP备案号: 已显示"
          else
-            echo "⚠️ ICP备案号: 未找到（请检查页面内容）"
+            echo "❌ ICP备案号: 未找到 — 可能有冲突配置覆盖了落地页"
+            echo "  诊断: 页面前200字符:"
+            curl -sf http://localhost/ 2>/dev/null | head -c 200 || echo "(无响应)"
          fi

          # 检查备案链接
@ -211,10 +258,22 @@ jobs:
            echo "⚠️ 工信部链接: 未找到"
          fi

-          # 健康端点
+          # 健康端点 · 验证返回的是cn-landing而不是其他服务
          HEALTH=$(curl -sf http://localhost/health 2>/dev/null || echo '{}')
          echo "✅ 健康探针: ${HEALTH}"

+          # 验证健康端点来自cn-domain.conf而非其他服务
+          if echo "$HEALTH" | grep -q "cn-landing"; then
+            echo "✅ 健康端点: 来自cn-domain.conf（正确）"
+          elif echo "$HEALTH" | grep -qE "relay|proxy|mcp"; then
+            echo "❌ 健康端点: 来自其他服务 — Nginx配置冲突未完全解决"
+          fi
+
+          # 确认没有端口冲突: 检查是否有其他服务监听80端口
+          echo ""
+          echo "§ 端口80监听进程:"
+          sudo ss -tlnp | grep ':80 ' || echo "  (无)"
+
          echo ""
          echo "═══ 部署完成 ═══"
          HEALTH_CMD
@ -280,24 +339,40 @@ jobs:
          systemctl is-active nginx && echo "Nginx: 运行中" || echo "Nginx: 已停止"
          echo ""

-          echo "§3 落地页文件:"
+          echo "§3 Nginx sites-enabled 诊断:"
+          ls -la /etc/nginx/sites-enabled/ 2>/dev/null || echo "  (目录不存在)"
+          echo ""
+
+          echo "§4 落地页文件:"
          ls -la /opt/zhuyuan-cn/sites/cn-landing/ 2>/dev/null || echo "目录不存在"
          echo ""

-          echo "§4 页面访问测试:"
+          echo "§5 页面访问测试:"
          HTTP_CODE=$(curl -sf -o /dev/null -w '%{http_code}' http://localhost/ 2>/dev/null || echo "000")
          echo "HTTP状态码: ${HTTP_CODE}"
          echo ""

-          echo "§5 ICP备案号检查:"
+          echo "§6 ICP备案号检查:"
          if curl -sf http://localhost/ | grep -q "陕ICP备2025071211号"; then
            echo "✅ ICP备案号已显示"
          else
            echo "❌ ICP备案号未找到"
+            echo "  页面前200字符:"
+            curl -sf http://localhost/ 2>/dev/null | head -c 200 || echo "(无响应)"
          fi

          echo ""
-          echo "§6 LLM API密钥状态:"
+          echo "§7 健康端点验证:"
+          HEALTH=$(curl -sf http://localhost/health 2>/dev/null || echo '{}')
+          echo "响应: ${HEALTH}"
+          if echo "$HEALTH" | grep -q "cn-landing"; then
+            echo "✅ 来自cn-domain.conf（正确）"
+          elif echo "$HEALTH" | grep -qE "relay|proxy|mcp"; then
+            echo "❌ 来自其他服务 — 存在Nginx配置冲突"
+          fi
+
+          echo ""
+          echo "§8 LLM API密钥状态:"
          if [ -f /opt/zhuyuan-cn/config/.env.llm ]; then
            KEY_COUNT=$(grep -c "API_KEY" /opt/zhuyuan-cn/config/.env.llm 2>/dev/null || echo "0")
            echo "已配置密钥数: ${KEY_COUNT}"
@ -305,6 +380,10 @@ jobs:
            echo "⚠️ LLM密钥文件不存在"
          fi

+          echo ""
+          echo "§9 端口80监听进程:"
+          sudo ss -tlnp | grep ':80 ' 2>/dev/null || echo "  (无)"
+
          HEALTH_CMD

      - name: 🧹 清理SSH密钥
--- a/.github/workflows/deploy-cn-llm-relay.yml
+++ b/.github/workflows/deploy-cn-llm-relay.yml
@ -7,9 +7,18 @@ name: 🇨🇳 CN LLM中继 · 部署
 # 守护: 铸渊 · ICE-GL-ZY001
 # 版权: 国作登字-2026-A-00037559
 #
-# 功能: 将 cn-llm-relay 代理服务部署到广州服务器
-#       注入国内LLM API密钥 + 中继鉴权密钥
-#       PM2 守护进程管理
+# 连接方式: GitHub Actions → SG(ZY-SVR-002) → 广州(ZY-SVR-003)
+#           通过新加坡服务器作为SSH跳板，避免直连中国大陆网络问题
+#
+# 所需 Secrets:
+#   ZY_SERVER_HOST     — 新加坡跳板主机
+#   ZY_SERVER_USER     — 新加坡跳板用户
+#   ZY_SERVER_KEY      — 新加坡跳板私钥
+#   ZY_CN_LLM_HOST     — 广州目标主机
+#   ZY_CN_LLM_USER     — 广州目标用户
+#   ZY_CN_LLM_KEY      — 广州目标私钥
+#   ZY_CN_LLM_RELAY_KEY — 中继API鉴权密钥
+#   ZY_DEEPSEEK_API_KEY / ZY_QIANWEN_API_KEY / ZY_KIMI_API_KEY / ZY_QINGYAN_API_KEY
 # ═══════════════════════════════════════════════════════════

 on:
@ -40,78 +49,108 @@ jobs:
    steps:
      - uses: actions/checkout@v4

-      - name: 🔐 配置SSH
+      - name: 🔐 配置SSH跳板 (SG→广州)
        env:
-          SSH_KEY: ${{ secrets.ZY_CN_LLM_KEY }}
+          SG_SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
+          CN_SSH_KEY: ${{ secrets.ZY_CN_LLM_KEY }}
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh

-          # 写入私钥 · 确保末尾有换行符
-          printf '%s\n' "$SSH_KEY" > ~/.ssh/cn_key
-          chmod 600 ~/.ssh/cn_key
+          # 写入新加坡跳板私钥
+          printf '%s\n' "$SG_SSH_KEY" > ~/.ssh/id_sg
+          chmod 600 ~/.ssh/id_sg
+
+          # 写入广州目标私钥
+          printf '%s\n' "$CN_SSH_KEY" > ~/.ssh/id_cn
+          chmod 600 ~/.ssh/id_cn

          # 格式校验
-          if head -1 ~/.ssh/cn_key | grep -q "BEGIN" && tail -1 ~/.ssh/cn_key | grep -q "END"; then
-            echo "✅ SSH私钥格式正确"
-          else
-            echo "❌ SSH私钥格式异常 — 请检查 ZY_CN_LLM_KEY"
-            echo "首行: $(head -1 ~/.ssh/cn_key)"
-            echo "末行: $(tail -1 ~/.ssh/cn_key)"
-            exit 1
-          fi
+          for key_file in id_sg id_cn; do
+            if head -1 ~/.ssh/${key_file} | grep -q "BEGIN" && tail -1 ~/.ssh/${key_file} | grep -q "END"; then
+              echo "✅ ${key_file}: 格式正确"
+            else
+              echo "❌ ${key_file}: 格式异常"
+              echo "  首行: $(head -1 ~/.ssh/${key_file})"
+              echo "  末行: $(tail -1 ~/.ssh/${key_file})"
+              exit 1
+            fi
+          done

          # 显示密钥指纹用于调试（不泄露私钥内容）
-          ssh-keygen -l -f ~/.ssh/cn_key && echo "✅ 密钥指纹读取成功" || echo "⚠️ 无法读取密钥指纹 — 密钥可能格式异常，请检查 ZY_CN_LLM_KEY 或重新生成密钥对"
+          echo ""
+          echo "═══ 密钥指纹 ═══"
+          echo "SG跳板:"
+          ssh-keygen -l -f ~/.ssh/id_sg || echo "⚠️ 无法读取SG密钥指纹"
+          echo "广州目标:"
+          ssh-keygen -l -f ~/.ssh/id_cn || echo "⚠️ 无法读取CN密钥指纹"
+
+          # 🔑 关键诊断: 从私钥导出公钥 · 冰朔可直接粘贴到广州服务器 authorized_keys
+          echo ""
+          echo "═══ 广州服务器所需公钥（如认证失败请将此公钥粘贴到广州 ~/.ssh/authorized_keys） ═══"
+          ssh-keygen -y -f ~/.ssh/id_cn 2>/dev/null || echo "⚠️ 无法从私钥导出公钥"
+          echo "═══ 公钥结束 ═══"
+
+          # 扫描SG跳板主机公钥
+          echo ""
+          echo "═══ 扫描SG跳板主机公钥 ═══"
+          ssh-keyscan -T 10 -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>&1 || echo "⚠️ SG主机公钥扫描失败"
+
+          # 写入SSH config · SG跳板 → 广州目标
+          cat > ~/.ssh/config << EOF
+          Host sg-jump
+            HostName ${{ secrets.ZY_SERVER_HOST }}
+            User ${{ secrets.ZY_SERVER_USER }}
+            IdentityFile ~/.ssh/id_sg
+            StrictHostKeyChecking accept-new
+            BatchMode yes

-          # 写入 SSH config · 统一连接参数
-          # 使用 heredoc 直接插值 Host/User（secrets 由 GitHub Actions 运行时注入，不会出现在日志中）
-          cat > ~/.ssh/config << SSHCONF
          Host cn-relay
            HostName ${{ secrets.ZY_CN_LLM_HOST }}
            User ${{ secrets.ZY_CN_LLM_USER }}
+            IdentityFile ~/.ssh/id_cn
+            ProxyJump sg-jump
            StrictHostKeyChecking accept-new
-            UserKnownHostsFile ~/.ssh/known_hosts
-            IdentityFile ~/.ssh/cn_key
-            IdentitiesOnly yes
+            BatchMode yes
+            ConnectTimeout 30
            ServerAliveInterval 15
            ServerAliveCountMax 3
-            ConnectTimeout 30
-          SSHCONF
+          EOF
          chmod 600 ~/.ssh/config

-          # 扫描主机公钥（不静默·便于排查）
-          echo "═══ 扫描目标主机公钥 ═══"
-          ssh-keyscan -T 10 ${{ secrets.ZY_CN_LLM_HOST }} >> ~/.ssh/known_hosts 2>&1 || echo "⚠️ ssh-keyscan 未返回主机密钥（可能被安全组拦截）"
-          echo "known_hosts 条目数: $(wc -l < ~/.ssh/known_hosts)"
-
      - name: 🔗 SSH连接测试
        run: |
-          echo "═══ SSH连接测试（verbose模式） ═══"
-          ssh -vvv -o BatchMode=yes -o ConnectTimeout=15 \
-            -i ~/.ssh/cn_key \
-            ${{ secrets.ZY_CN_LLM_USER }}@${{ secrets.ZY_CN_LLM_HOST }} \
+          echo "═══ SSH连接测试 (GitHub Actions → SG → 广州) ═══"
+          ssh cn-relay \
            "echo '✅ SSH连接成功 · $(hostname) · $(date)' && test -d /opt/cn-llm-relay && echo '✅ 部署目录存在' || echo '⚠️ /opt/cn-llm-relay 不存在·首次部署将自动创建'" \
            2>&1 || {
              echo ""
              echo "═══ SSH连接失败 · 排查方向 ═══"
-              echo "1. 检查广州服务器 ~/.ssh/authorized_keys 是否包含对应公钥"
-              echo "2. 检查权限: chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys"
-              echo "3. 检查 /etc/ssh/sshd_config: PubkeyAuthentication yes"
-              echo "4. 检查腾讯云安全组是否放行 GitHub Actions IP 的 22 端口"
-              echo "5. 查看服务器 SSH 日志: journalctl -u sshd -n 50"
+              echo "1. 检查SG跳板连通性: ZY_SERVER_HOST + ZY_SERVER_KEY 是否正确"
+              echo "2. 检查广州 authorized_keys 是否包含上方输出的公钥"
+              echo "3. 广州服务器执行: chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys"
+              echo "4. 检查 /etc/ssh/sshd_config: PubkeyAuthentication yes"
+              echo "5. 查看广州 SSH 日志: journalctl -u sshd -n 50"
              exit 1
            }

+      - name: 📂 准备目标目录
+        run: |
+          ssh cn-relay << 'PREP_CMD'
+          set -e
+          mkdir -p /opt/cn-llm-relay/logs
+          echo "✅ 目录结构就绪"
+          PREP_CMD
+
      - name: 📦 同步代码到广州
        run: |
          rsync -avz --delete \
-            -e "ssh -i ~/.ssh/cn_key -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30" \
+            -e "ssh -F ~/.ssh/config" \
            --exclude='node_modules' \
            --exclude='.env.relay' \
            --exclude='logs' \
            server/cn-llm-relay/ \
-            ${{ secrets.ZY_CN_LLM_USER }}@${{ secrets.ZY_CN_LLM_HOST }}:/opt/cn-llm-relay/
+            cn-relay:/opt/cn-llm-relay/

      - name: 📥 安装依赖 & 配置 & 启动
        env:
@ -121,23 +160,16 @@ jobs:
          ZY_QINGYAN_API_KEY: ${{ secrets.ZY_QINGYAN_API_KEY }}
          ZY_CN_RELAY_API_KEY: ${{ secrets.ZY_CN_LLM_RELAY_KEY }}
        run: |
-          ssh -i ~/.ssh/cn_key \
-            ${{ secrets.ZY_CN_LLM_USER }}@${{ secrets.ZY_CN_LLM_HOST }} << 'DEPLOY_CMD'
-
+          ssh cn-relay << 'DEPLOY_CMD'
          set -e
          cd /opt/cn-llm-relay

-          # 创建日志目录
-          mkdir -p /opt/cn-llm-relay/logs
-
          # 安装依赖
          npm install --production 2>&1
-
          DEPLOY_CMD

-          # 写入环境变量（在本地构建后通过SSH写入，避免heredoc变量展开问题）
-          ssh -i ~/.ssh/cn_key \
-            ${{ secrets.ZY_CN_LLM_USER }}@${{ secrets.ZY_CN_LLM_HOST }} \
+          # 写入环境变量（通过SSH写入，避免heredoc变量展开问题）
+          ssh cn-relay \
            "cat > /opt/cn-llm-relay/.env.relay << 'ENVEOF'
          RELAY_PORT=3900
          ZY_CN_RELAY_API_KEY=${ZY_CN_RELAY_API_KEY}
@ -149,8 +181,7 @@ jobs:
          chmod 600 /opt/cn-llm-relay/.env.relay"

          # PM2 启动
-          ssh -i ~/.ssh/cn_key \
-            ${{ secrets.ZY_CN_LLM_USER }}@${{ secrets.ZY_CN_LLM_HOST }} << 'PM2_CMD'
+          ssh cn-relay << 'PM2_CMD'
          set -e
          cd /opt/cn-llm-relay
          pm2 delete cn-llm-relay 2>/dev/null || true
@ -169,24 +200,48 @@ jobs:
          fi
          PM2_CMD

+      - name: 🧹 清理SSH密钥
+        if: always()
+        run: rm -f ~/.ssh/id_sg ~/.ssh/id_cn ~/.ssh/config
+
  health-check:
    name: 🩺 健康检查
    if: github.event.inputs.action == 'health-check'
    runs-on: ubuntu-latest
    steps:
-      - name: 🔐 配置SSH
+      - name: 🔐 配置SSH跳板 (SG→广州)
        env:
-          SSH_KEY: ${{ secrets.ZY_CN_LLM_KEY }}
+          SG_SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
+          CN_SSH_KEY: ${{ secrets.ZY_CN_LLM_KEY }}
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%s\n' "$SSH_KEY" > ~/.ssh/cn_key
-          chmod 600 ~/.ssh/cn_key
-          ssh-keyscan -T 10 ${{ secrets.ZY_CN_LLM_HOST }} >> ~/.ssh/known_hosts 2>&1 || true
+          printf '%s\n' "$SG_SSH_KEY" > ~/.ssh/id_sg
+          printf '%s\n' "$CN_SSH_KEY" > ~/.ssh/id_cn
+          chmod 600 ~/.ssh/id_sg ~/.ssh/id_cn
+          ssh-keyscan -T 10 -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>&1 || true
+
+          cat > ~/.ssh/config << EOF
+          Host sg-jump
+            HostName ${{ secrets.ZY_SERVER_HOST }}
+            User ${{ secrets.ZY_SERVER_USER }}
+            IdentityFile ~/.ssh/id_sg
+            StrictHostKeyChecking accept-new
+            BatchMode yes
+
+          Host cn-relay
+            HostName ${{ secrets.ZY_CN_LLM_HOST }}
+            User ${{ secrets.ZY_CN_LLM_USER }}
+            IdentityFile ~/.ssh/id_cn
+            ProxyJump sg-jump
+            StrictHostKeyChecking accept-new
+            BatchMode yes
+            ConnectTimeout 30
+          EOF
+          chmod 600 ~/.ssh/config

      - name: 🩺 检查服务状态
        run: |
-          ssh -i ~/.ssh/cn_key -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15 \
-            ${{ secrets.ZY_CN_LLM_USER }}@${{ secrets.ZY_CN_LLM_HOST }} << 'CMD'
+          ssh cn-relay << 'CMD'
          echo "═══ PM2 状态 ═══"
          pm2 list
          echo ""
@ -197,26 +252,54 @@ jobs:
          pm2 logs cn-llm-relay --lines 10 --nostream 2>/dev/null || echo "无日志"
          CMD

+      - name: 🧹 清理SSH密钥
+        if: always()
+        run: rm -f ~/.ssh/id_sg ~/.ssh/id_cn ~/.ssh/config
+
  restart:
    name: 🔄 重启服务
    if: github.event.inputs.action == 'restart'
    runs-on: ubuntu-latest
    steps:
-      - name: 🔐 配置SSH
+      - name: 🔐 配置SSH跳板 (SG→广州)
        env:
-          SSH_KEY: ${{ secrets.ZY_CN_LLM_KEY }}
+          SG_SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
+          CN_SSH_KEY: ${{ secrets.ZY_CN_LLM_KEY }}
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%s\n' "$SSH_KEY" > ~/.ssh/cn_key
-          chmod 600 ~/.ssh/cn_key
-          ssh-keyscan -T 10 ${{ secrets.ZY_CN_LLM_HOST }} >> ~/.ssh/known_hosts 2>&1 || true
+          printf '%s\n' "$SG_SSH_KEY" > ~/.ssh/id_sg
+          printf '%s\n' "$CN_SSH_KEY" > ~/.ssh/id_cn
+          chmod 600 ~/.ssh/id_sg ~/.ssh/id_cn
+          ssh-keyscan -T 10 -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>&1 || true
+
+          cat > ~/.ssh/config << EOF
+          Host sg-jump
+            HostName ${{ secrets.ZY_SERVER_HOST }}
+            User ${{ secrets.ZY_SERVER_USER }}
+            IdentityFile ~/.ssh/id_sg
+            StrictHostKeyChecking accept-new
+            BatchMode yes
+
+          Host cn-relay
+            HostName ${{ secrets.ZY_CN_LLM_HOST }}
+            User ${{ secrets.ZY_CN_LLM_USER }}
+            IdentityFile ~/.ssh/id_cn
+            ProxyJump sg-jump
+            StrictHostKeyChecking accept-new
+            BatchMode yes
+            ConnectTimeout 30
+          EOF
+          chmod 600 ~/.ssh/config

      - name: 🔄 重启
        run: |
-          ssh -i ~/.ssh/cn_key -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15 \
-            ${{ secrets.ZY_CN_LLM_USER }}@${{ secrets.ZY_CN_LLM_HOST }} << 'CMD'
+          ssh cn-relay << 'CMD'
          cd /opt/cn-llm-relay
          pm2 restart cn-llm-relay
          sleep 2
          curl -s http://127.0.0.1:3900/health || echo "❌ 重启后服务未响应"
          CMD
+
+      - name: 🧹 清理SSH密钥
+        if: always()
+        run: rm -f ~/.ssh/id_sg ~/.ssh/id_cn ~/.ssh/config
--- a/.github/workflows/deploy-to-zhuyuan-server.yml
+++ b/.github/workflows/deploy-to-zhuyuan-server.yml
@ -319,10 +319,11 @@ jobs:
          npm install --production 2>&1

          # ─── 写入主应用环境变量配置 ───
+          # 注意: PORT 和 ZY_SITE_MODE 不写入 .env.app
+          # 这两个值由 ecosystem.config.js 按实例设置 (主站3800/预览站3801)
+          # 写入 .env.app 会导致 loadEnvFile() 覆盖预览实例的端口 → 两实例抢端口 → 502
          echo "NODE_ENV=production" > /opt/zhuyuan/app/.env.app
-          echo "PORT=3800" >> /opt/zhuyuan/app/.env.app
          echo "ZY_ROOT=/opt/zhuyuan" >> /opt/zhuyuan/app/.env.app
-          echo "ZY_SITE_MODE=production" >> /opt/zhuyuan/app/.env.app
          echo "ZY_DEEPSEEK_API_KEY=${ZY_DEEPSEEK_API_KEY}" >> /opt/zhuyuan/app/.env.app
          echo "ZY_QIANWEN_API_KEY=${ZY_QIANWEN_API_KEY}" >> /opt/zhuyuan/app/.env.app
          echo "ZY_KIMI_API_KEY=${ZY_KIMI_API_KEY}" >> /opt/zhuyuan/app/.env.app
--- a/server/ecosystem.config.js
+++ b/server/ecosystem.config.js
@ -51,11 +51,12 @@ module.exports = {
      watch: false,
      max_memory_restart: '512M',
      env: {
+        ...appEnv,
+        // ⚠️ 实例专属值必须在 ...appEnv 之后 · 覆盖 .env.app 中可能残留的 PORT/ZY_SITE_MODE
        NODE_ENV: 'production',
        PORT: 3800,
        ZY_ROOT: '/opt/zhuyuan',
-        ZY_SITE_MODE: 'production',
-        ...appEnv
+        ZY_SITE_MODE: 'production'
      },
      log_file: '/opt/zhuyuan/data/logs/pm2-combined.log',
      error_file: '/opt/zhuyuan/data/logs/pm2-error.log',
@ -73,11 +74,12 @@ module.exports = {
      watch: false,
      max_memory_restart: '256M',
      env: {
+        ...appEnv,
+        // ⚠️ 实例专属值必须在 ...appEnv 之后 · 预览实例 PORT=3801 不能被 .env.app 的 PORT=3800 覆盖
        NODE_ENV: 'production',
        PORT: 3801,
        ZY_ROOT: '/opt/zhuyuan',
-        ZY_SITE_MODE: 'preview',
-        ...appEnv
+        ZY_SITE_MODE: 'preview'
      },
      log_file: '/opt/zhuyuan/data/logs/pm2-preview-combined.log',
      error_file: '/opt/zhuyuan/data/logs/pm2-preview-error.log',