From e1c15e938ae3286c9d58b27793f6f4167fc15377 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 12 Apr 2026 01:37:08 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20=E6=94=B9=E8=BF=9B=E5=86=B2=E7=AA=81?=
 =?UTF-8?q?=E6=A3=80=E6=B5=8B=E9=80=BB=E8=BE=91=20=E2=80=94=20=E6=8E=92?=
 =?UTF-8?q?=E9=99=A4=E6=B3=A8=E9=87=8A=E8=A1=8C+iptables=E5=8E=BB=E9=87=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/cf7e00b0-8d2a-46c5-ae90-6b90088b3942

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
---
 .github/workflows/deploy-ali-cn-landing.yml | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/deploy-ali-cn-landing.yml b/.github/workflows/deploy-ali-cn-landing.yml
index ed668118..0a64749c 100644
--- a/.github/workflows/deploy-ali-cn-landing.yml
+++ b/.github/workflows/deploy-ali-cn-landing.yml
@@ -194,14 +194,18 @@ jobs:
             echo "  ✅ firewalld 规则已重载"
           elif command -v iptables &> /dev/null; then
             echo "🔥 检测到 iptables"
-            # 检查是否有DROP规则阻止80/443
-            if iptables -L INPUT -n 2>/dev/null | grep -q "DROP.*dpt:80"; then
+            # 检查并添加ACCEPT规则（先用-C检测是否已存在，避免重复）
+            if ! iptables -C INPUT -p tcp --dport 80 -j ACCEPT 2>/dev/null; then
               iptables -I INPUT -p tcp --dport 80 -j ACCEPT
               echo "  ✅ 已添加 iptables 规则: 允许端口 80"
+            else
+              echo "  ✅ 端口 80 ACCEPT 规则已存在"
             fi
-            if iptables -L INPUT -n 2>/dev/null | grep -q "DROP.*dpt:443"; then
+            if ! iptables -C INPUT -p tcp --dport 443 -j ACCEPT 2>/dev/null; then
               iptables -I INPUT -p tcp --dport 443 -j ACCEPT
               echo "  ✅ 已添加 iptables 规则: 允许端口 443"
+            else
+              echo "  ✅ 端口 443 ACCEPT 规则已存在"
             fi
             echo "  ✅ iptables 检查完成"
           else
@@ -318,9 +322,10 @@ jobs:
             if [ "$BASENAME" = "guanghulab-landing.conf" ]; then
               continue
             fi
-            # 检查是否包含 guanghulab 相关的 server_name 或 default_server
-            if grep -qE "(server_name.*guanghulab|default_server)" "$conf" 2>/dev/null; then
-              echo "  ⚠️ 冲突配置: $BASENAME"
+            # 检查是否包含未注释的 guanghulab 相关 server_name 或 default_server
+            # 排除注释行（以 # 开头），只匹配真正的指令
+            if grep -vE '^\s*#' "$conf" 2>/dev/null | grep -qE "server_name.*guanghulab"; then
+              echo "  ⚠️ 冲突配置: $BASENAME (server_name包含guanghulab)"
               echo "    → 备份到: ${conf}.disabled.by-landing"
               cp "$conf" "${conf}.disabled.by-landing"
               mv "$conf" "${conf%.conf}.conf.disabled"
@@ -339,7 +344,7 @@ jobs:
               # 检查链接目标或文件内容
               REAL_FILE="$conf"
               [ -L "$conf" ] && REAL_FILE=$(readlink -f "$conf")
-              if [ -f "$REAL_FILE" ] && grep -qE "(server_name.*guanghulab|default_server)" "$REAL_FILE" 2>/dev/null; then
+              if [ -f "$REAL_FILE" ] && grep -vE '^\s*#' "$REAL_FILE" 2>/dev/null | grep -qE "server_name.*guanghulab"; then
                 echo "  ⚠️ 冲突配置(sites-enabled): $BASENAME"
                 echo "    → 移除符号链接: $conf"
                 rm -f "$conf"