fix: CN服务器SSH端口可配置 · 修复Connection timed out · 添加ZY_CN_SSH_PORT支持

问题: 铸渊专线#17 CN中转配置失败 — ssh: connect to host port 22: Connection timed out
根因: 腾讯云CN服务器SSH端口可能非默认22端口，硬编码端口22导致连接超时
修复:
- deploy-proxy-service.yml: CN中转job所有SSH/SCP/ssh-keyscan命令添加-p端口参数
- deploy-to-cn-server.yml: 所有CN服务器SSH连接添加-p端口参数
- 新增ZY_CN_SSH_PORT Secret支持(默认回退22)
- 添加详细的连接失败诊断信息和排查建议
- 更新secrets-manifest.json、cn-server-profile.json、SSL-GUIDE文档

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/fb793e24-d5d6-4f39-a86f-a5d1f00db508

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>

.github/workflows/deploy-proxy-service.yml

@@ -205,7 +205,13 @@ jobs:
       - name: '🔑 配置CN服务器SSH密钥'
         env:
           SSH_KEY: ${{ secrets.ZY_CN_SERVER_KEY }}
+          CN_SSH_PORT: ${{ secrets.ZY_CN_SSH_PORT }}
         run: |
+          # 端口配置 (支持自定义SSH端口，腾讯云服务器常用非22端口)
+          SSH_PORT="${CN_SSH_PORT:-22}"
+          echo "SSH_PORT=${SSH_PORT}" >> $GITHUB_ENV
+          echo "🔧 CN服务器SSH端口: ${SSH_PORT}"
+
           mkdir -p ~/.ssh
           echo "$SSH_KEY" > ~/.ssh/id_cn
           chmod 600 ~/.ssh/id_cn
@@ -216,18 +222,31 @@ jobs:
             exit 1
           fi
 
-          ssh-keyscan -H ${{ secrets.ZY_CN_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+          echo "🔍 扫描CN服务器主机密钥 (端口 ${SSH_PORT})..."
+          ssh-keyscan -p ${SSH_PORT} -H ${{ secrets.ZY_CN_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
 
+          echo "🔗 测试SSH连接..."
           ssh -i ~/.ssh/id_cn \
+              -p ${SSH_PORT} \
               -o StrictHostKeyChecking=accept-new \
               -o BatchMode=yes \
               -o ConnectTimeout=15 \
               ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} \
-              "echo '✅ CN服务器SSH连接成功'"
+              "echo '✅ CN服务器SSH连接成功'" || {
+            echo ""
+            echo "❌ SSH连接失败 · 排查清单:"
+            echo "  1. 确认 ZY_CN_SSH_PORT Secret 已设置为CN服务器的SSH端口 (当前: ${SSH_PORT})"
+            echo "  2. 腾讯云控制台 → 安全组 → 确认入站规则允许端口 ${SSH_PORT}"
+            echo "  3. 确认 ZY_CN_SERVER_HOST 地址正确"
+            echo "  4. 确认 ZY_CN_SERVER_KEY 密钥与服务器匹配"
+            echo "  5. 确认CN服务器已开机且SSH服务正在运行"
+            exit 1
+          }
 
       - name: '📦 上传CN中转脚本'
         run: |
           scp -i ~/.ssh/id_cn \
+            -P ${{ env.SSH_PORT }} \
             -o StrictHostKeyChecking=accept-new \
             server/proxy/setup/setup-cn-relay.sh \
             ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }}:/tmp/setup-cn-relay.sh
@@ -235,6 +254,7 @@ jobs:
       - name: '🇨🇳 执行CN中转配置'
         run: |
           ssh -i ~/.ssh/id_cn \
+              -p ${{ env.SSH_PORT }} \
               -o StrictHostKeyChecking=accept-new \
               ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} \
               "chmod +x /tmp/setup-cn-relay.sh && \

.github/workflows/deploy-to-cn-server.yml

@@ -48,7 +48,13 @@ jobs:
       - name: 🔐 配置SSH
         env:
           SSH_KEY: ${{ secrets.ZY_CN_SERVER_KEY }}
+          CN_SSH_PORT: ${{ secrets.ZY_CN_SSH_PORT }}
         run: |
+          # 端口配置 (支持自定义SSH端口，腾讯云服务器常用非22端口)
+          SSH_PORT="${CN_SSH_PORT:-22}"
+          echo "SSH_PORT=${SSH_PORT}" >> $GITHUB_ENV
+          echo "🔧 CN服务器SSH端口: ${SSH_PORT}"
+
           mkdir -p ~/.ssh
           echo "$SSH_KEY" > ~/.ssh/zy_cn_key
           chmod 600 ~/.ssh/zy_cn_key
@@ -58,29 +64,33 @@ jobs:
             echo "❌ SSH私钥格式异常 — 请检查 GitHub Secrets 中 ZY_CN_SERVER_KEY 的内容"
             exit 1
           fi
-          ssh-keyscan -H ${{ secrets.ZY_CN_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+          ssh-keyscan -p ${SSH_PORT} -H ${{ secrets.ZY_CN_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
 
       - name: 🔍 SSH连接测试
         run: |
-          echo "🔍 测试SSH连接到广州备用服务器..."
+          echo "🔍 测试SSH连接到广州备用服务器 (端口 ${{ env.SSH_PORT }})..."
-          ssh -i ~/.ssh/zy_cn_key -o BatchMode=yes -o ConnectTimeout=10 \
+          ssh -i ~/.ssh/zy_cn_key -p ${{ env.SSH_PORT }} -o BatchMode=yes -o ConnectTimeout=10 \
             ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} \
             'echo "✅ SSH连接成功 · $(hostname) · $(date)"' || {
             echo ""
             echo "❌ SSH连接失败"
-            echo "修复步骤: 登录腾讯云 → 广州服务器 → 远程登录 → 生成密钥 → 更新 ZY_CN_SERVER_KEY"
+            echo "修复步骤:"
+            echo "  1. 确认 ZY_CN_SSH_PORT Secret 已设置为CN服务器的SSH端口 (当前: ${{ env.SSH_PORT }})"
+            echo "  2. 登录腾讯云 → 安全组 → 确认入站规则允许端口 ${{ env.SSH_PORT }}"
+            echo "  3. 确认 ZY_CN_SERVER_HOST 地址正确"
+            echo "  4. 登录腾讯云 → 广州服务器 → 远程登录 → 生成密钥 → 更新 ZY_CN_SERVER_KEY"
             exit 1
           }
 
       - name: 📦 上传初始化脚本
         run: |
-          scp -i ~/.ssh/zy_cn_key \
+          scp -i ~/.ssh/zy_cn_key -P ${{ env.SSH_PORT }} \
             server/setup/cn-server-init.sh \
             ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }}:/tmp/
 
       - name: 🚀 执行初始化
         run: |
-          ssh -i ~/.ssh/zy_cn_key \
+          ssh -i ~/.ssh/zy_cn_key -p ${{ env.SSH_PORT }} \
             ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} \
             'chmod +x /tmp/cn-server-init.sh && sudo /tmp/cn-server-init.sh'
 
@@ -95,11 +105,15 @@ jobs:
       - name: 🔐 配置SSH
         env:
           SSH_KEY: ${{ secrets.ZY_CN_SERVER_KEY }}
+          CN_SSH_PORT: ${{ secrets.ZY_CN_SSH_PORT }}
         run: |
+          SSH_PORT="${CN_SSH_PORT:-22}"
+          echo "SSH_PORT=${SSH_PORT}" >> $GITHUB_ENV
+
           mkdir -p ~/.ssh
           echo "$SSH_KEY" > ~/.ssh/zy_cn_key
           chmod 600 ~/.ssh/zy_cn_key
-          ssh-keyscan -H ${{ secrets.ZY_CN_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+          ssh-keyscan -p ${SSH_PORT} -H ${{ secrets.ZY_CN_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
 
       - name: 📦 同步应用代码
         run: |
@@ -108,12 +122,12 @@ jobs:
           echo "📦 部署目标: ${CN_PATH}"
 
           # 确保目标目录存在
-          ssh -i ~/.ssh/zy_cn_key \
+          ssh -i ~/.ssh/zy_cn_key -p ${{ env.SSH_PORT }} \
             ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} \
             "mkdir -p ${CN_PATH}/app"
 
           rsync -avz --delete \
-            -e "ssh -i ~/.ssh/zy_cn_key" \
+            -e "ssh -i ~/.ssh/zy_cn_key -p ${{ env.SSH_PORT }}" \
             server/app/ \
             ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }}:${CN_PATH}/app/
 
@@ -124,7 +138,7 @@ jobs:
 
           # 同步大脑核心文件到备用服务器
           rsync -avz \
-            -e "ssh -i ~/.ssh/zy_cn_key" \
+            -e "ssh -i ~/.ssh/zy_cn_key -p ${{ env.SSH_PORT }}" \
             brain/ \
             ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }}:${CN_PATH}/brain-backup/
 
@@ -133,7 +147,7 @@ jobs:
           CN_PATH="${{ secrets.ZY_CN_SERVER_PATH }}"
           CN_PATH="${CN_PATH:-${{ env.CN_DEFAULT_PATH }}}"
           COMMIT_SHA="${{ github.sha }}"
-          ssh -i ~/.ssh/zy_cn_key \
+          ssh -i ~/.ssh/zy_cn_key -p ${{ env.SSH_PORT }} \
             ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} << DEPLOY_CMD
 
           set -e
@@ -170,15 +184,19 @@ jobs:
       - name: 🔐 配置SSH
         env:
           SSH_KEY: ${{ secrets.ZY_CN_SERVER_KEY }}
+          CN_SSH_PORT: ${{ secrets.ZY_CN_SSH_PORT }}
         run: |
+          SSH_PORT="${CN_SSH_PORT:-22}"
+          echo "SSH_PORT=${SSH_PORT}" >> $GITHUB_ENV
+
           mkdir -p ~/.ssh
           echo "$SSH_KEY" > ~/.ssh/zy_cn_key
           chmod 600 ~/.ssh/zy_cn_key
-          ssh-keyscan -H ${{ secrets.ZY_CN_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+          ssh-keyscan -p ${SSH_PORT} -H ${{ secrets.ZY_CN_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
 
       - name: 💚 执行健康检查
         run: |
-          ssh -i ~/.ssh/zy_cn_key \
+          ssh -i ~/.ssh/zy_cn_key -p ${{ env.SSH_PORT }} \
             ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} << 'HEALTH_CMD'
 
           echo "═══ 冰朔大陆备用服务器健康报告 ═══"

brain/secrets-manifest.json

@@ -282,6 +282,20 @@
         ],
         "note": "国内服务器上的部署根目录"
       },
+      {
+        "id": 42,
+        "name": "ZY_CN_SSH_PORT",
+        "category": "国内服务器 · 部署",
+        "description": "国内服务器SSH端口（腾讯云默认可能非22）",
+        "type": "port",
+        "example_format": "22",
+        "replaces": [],
+        "used_by_workflows": [
+          "deploy-to-cn-server.yml",
+          "deploy-proxy-service.yml"
+        ],
+        "note": "腾讯云服务器SSH端口·默认22·如果服务器使用自定义端口需要配置此密钥"
+      },
       {
         "id": 7,
         "name": "ZY_DOMAIN_MAIN",

docs/SSL-GUIDE-FOR-BINGSUO.md

@@ -177,6 +177,12 @@ Reality协议的`dest`是GFW反探测的关键。当GFW探测443端口时:
 | 2053 | TCP | Nginx stream | VPN中转 → SG:443 |
 | 80 | TCP | Nginx | 订阅API反代 → SG |
 
+### CN服务器SSH端口配置
+⚠️ 腾讯云服务器的SSH端口可能不是默认的22端口。如果部署CN中转时遇到 `Connection timed out` 错误：
+1. 登录腾讯云控制台 → 服务器详情 → 查看SSH端口
+2. 在仓库 Settings → Secrets → 添加 `ZY_CN_SSH_PORT` = 实际端口号
+3. 确认腾讯云安全组入站规则允许该端口
+
 ---
 
 *📝 由铸渊(ICE-GL-ZY001)编写 · 第十八次对话 · 2026-03-31*

server/cn-server-profile.json

@@ -71,6 +71,12 @@
         "name": "ZY_CN_SERVER_PATH",
         "value": "/opt/zhuyuan-cn",
         "status": "待冰朔配置"
+      },
+      {
+        "name": "ZY_CN_SSH_PORT",
+        "value": "CN服务器SSH端口 (默认22，腾讯云可能为其他端口)",
+        "status": "待冰朔配置",
+        "note": "登录腾讯云控制台 → 服务器详情 → 查看SSH端口"
       }
     ]
   }