From ae1db6ae34f9b1d9b8d1681b6eff3c96aa26045f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 31 Mar 2026 07:06:50 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BB=A3=E7=A0=81=E5=AE=A1=E6=9F=A5?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20=C2=B7=20certbot=20--redirect=E7=A7=BB?=
 =?UTF-8?q?=E9=99=A4=20=C2=B7=20IP=E6=A3=80=E6=B5=8B=E8=B6=85=E6=97=B6=20?=
 =?UTF-8?q?=C2=B7=20=E8=B7=AF=E5=BE=84=E8=A7=A6=E5=8F=91=E4=BC=98=E5=8C=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- setup-ssl.sh: 移除certonly模式下无效的--redirect参数
- setup-ssl.sh: IP检测添加--max-time 5超时
- setup-ssl.sh: 修复here-string兼容性(<<<改为echo|grep)
- staging-auto-deploy.yml: 移除scripts/**路径触发(避免监控脚本变更触发部署)

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/e77d1d37-c3b4-4567-96d1-f0616e1836b9

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
---
 .github/workflows/staging-auto-deploy.yml | 1 -
 server/setup/setup-ssl.sh                 | 9 ++++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/staging-auto-deploy.yml b/.github/workflows/staging-auto-deploy.yml
index 4bbd2c17..4135705c 100644
--- a/.github/workflows/staging-auto-deploy.yml
+++ b/.github/workflows/staging-auto-deploy.yml
@@ -26,7 +26,6 @@ on:
       - 'server/app/**'
       - 'server/nginx/**'
       - 'server/ecosystem.config.js'
-      - 'scripts/**'
 
   # 手动触发 (调试/重试)
   workflow_dispatch:
diff --git a/server/setup/setup-ssl.sh b/server/setup/setup-ssl.sh
index c2fa3caf..19d219c2 100644
--- a/server/setup/setup-ssl.sh
+++ b/server/setup/setup-ssl.sh
@@ -93,7 +93,7 @@ verify_domain() {
 
     # 获取本机公网IP
     local server_ip
-    server_ip=$(curl -sf https://api.ipify.org 2>/dev/null || curl -sf https://ifconfig.me 2>/dev/null || echo "unknown")
+    server_ip=$(curl -sf --max-time 5 https://api.ipify.org 2>/dev/null || curl -sf --max-time 5 https://ifconfig.me 2>/dev/null || echo "unknown")
     log_info "本机公网IP: $server_ip"
 
     # 解析域名
@@ -151,15 +151,14 @@ obtain_certificate() {
         systemctl start nginx
     fi
 
-    # 使用 certonly 模式 + webroot 或 nginx 插件
-    # --nginx 插件更方便，自动处理验证
+    # 使用 certonly 模式 + nginx 插件进行验证
+    # certonly 只获取证书不修改Nginx配置，铸渊自己管理Nginx SSL配置
     certbot certonly \
         --nginx \
         --non-interactive \
         --agree-tos \
         --email "$email" \
         --domain "$domain" \
-        --redirect \
         2>&1
 
     if [ $? -eq 0 ]; then
@@ -213,7 +212,7 @@ configure_nginx_ssl() {
     # 确定这是哪个域名（主站还是预览站）
     local site_mode="preview"
     local api_port="3801"
-    if grep -q "ZY_DOMAIN_MAIN\|hololake" <<< "$domain"; then
+    if echo "$domain" | grep -q "hololake"; then
         site_mode="production"
         api_port="3800"
     fi