zhizhi/.github/workflows/deploy-cn-landing.yml

name: 🇨🇳 国内域名落地页 · 部署

# ═══════════════════════════════════════════════════════════
# 国内域名ICP备案落地页部署工作流
# 编号: ZY-WF-CN-LANDING
# 服务器: ZY-SVR-004 · 43.139.217.141 · 广州七区
# 守护: 铸渊 · ICE-GL-ZY001
# 版权: 国作登字-2026-A-00037559
# ═══════════════════════════════════════════════════════════
#
# 部署内容:
#   1. 国内落地页 (server/sites/cn-landing/) → /opt/zhuyuan-cn/sites/cn-landing/
#   2. Nginx 配置 (server/nginx/cn-domain.conf) → Nginx sites-enabled
#   3. LLM API 密钥注入 (四大国内模型)
#
# 架构: GitHub Actions(美国) → SG(新加坡·跳板) → CN(广州·目标)

on:
  push:
    branches: [main]
    paths:
      - 'server/sites/cn-landing/**'
      - 'server/nginx/cn-domain.conf'
  workflow_dispatch:
    inputs:
      action:
        description: '部署动作'
        required: true
        default: 'deploy'
        type: choice
        options:
          - deploy
          - health-check

concurrency:
  group: cn-landing-deploy
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  deploy:
    name: 🚀 部署国内落地页
    if: github.event.inputs.action == 'deploy' || github.event.inputs.action == '' || github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: 🔐 配置SSH跳板 (SG→CN)
        env:
          SG_SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
          CN_SSH_KEY: ${{ secrets.ZY_CN_SERVER_KEY }}
          CN_SSH_PORT: ${{ secrets.ZY_CN_SSH_PORT }}
        run: |
          CN_PORT="${CN_SSH_PORT:-22}"
          echo "🔧 SSH跳板: GitHub Actions → SG → CN (端口 ${CN_PORT})"

          mkdir -p ~/.ssh
          echo "$SG_SSH_KEY" > ~/.ssh/id_sg
          echo "$CN_SSH_KEY" > ~/.ssh/id_cn
          chmod 600 ~/.ssh/id_sg ~/.ssh/id_cn

          for key_file in id_sg id_cn; do
            if ! head -1 ~/.ssh/${key_file} | grep -q "BEGIN"; then
              echo "❌ SSH密钥格式异常: ${key_file}"
              exit 1
            fi
          done
          echo "✅ SG + CN 密钥格式正确"

          ssh-keyscan -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

          cat > ~/.ssh/config << EOF
          Host sg-jump
              HostName ${{ secrets.ZY_SERVER_HOST }}
              User ${{ secrets.ZY_SERVER_USER }}
              IdentityFile ~/.ssh/id_sg
              StrictHostKeyChecking accept-new
              BatchMode yes

          Host cn-target
              HostName ${{ secrets.ZY_CN_SERVER_HOST }}
              User ${{ secrets.ZY_CN_SERVER_USER }}
              Port ${CN_PORT}
              IdentityFile ~/.ssh/id_cn
              ProxyJump sg-jump
              StrictHostKeyChecking accept-new
              BatchMode yes
              ConnectTimeout 30
          EOF
          chmod 600 ~/.ssh/config          

      - name: 🔍 SSH连接测试
        run: |
          echo "🔍 测试SSH跳板连接到广州服务器..."
          ssh cn-target 'echo "✅ SSH连接成功 · $(hostname) · $(date)"' || {
            echo "❌ SSH跳板连接失败"
            exit 1
          }          

      - name: 📂 准备目标目录
        run: |
          ssh cn-target << 'PREP_CMD'
          set -e
          mkdir -p /opt/zhuyuan-cn/sites/cn-landing
          mkdir -p /opt/zhuyuan-cn/data/logs
          mkdir -p /opt/zhuyuan-cn/config/nginx
          echo "✅ 目录结构就绪"
          PREP_CMD          

      - name: 📦 同步落地页文件
        run: |
          rsync -avz --delete \
            server/sites/cn-landing/ \
            cn-target:/opt/zhuyuan-cn/sites/cn-landing/
          echo "✅ 落地页已同步到 /opt/zhuyuan-cn/sites/cn-landing/"          

      - name: 📦 同步Nginx配置
        env:
          ZY_CN_DOMAIN: ${{ secrets.ZY_CN_DOMAIN }}
        run: |
          cp server/nginx/cn-domain.conf /tmp/cn-domain.conf

          if [ -n "$ZY_CN_DOMAIN" ]; then
            sed -i "s/ZY_CN_DOMAIN_PLACEHOLDER/${ZY_CN_DOMAIN}/g" /tmp/cn-domain.conf
            echo "✅ 国内域名已注入: ${ZY_CN_DOMAIN}"
          else
            echo "⚠️ ZY_CN_DOMAIN 未配置，使用IP直接访问"
            sed -i "s/ZY_CN_DOMAIN_PLACEHOLDER/_/g" /tmp/cn-domain.conf
          fi

          scp -F ~/.ssh/config \
            /tmp/cn-domain.conf \
            cn-target:/opt/zhuyuan-cn/config/nginx/cn-domain.conf
          echo "✅ Nginx配置已上传"          

      - name: 🔑 注入LLM API密钥
        env:
          ZY_DEEPSEEK_API_KEY: ${{ secrets.ZY_DEEPSEEK_API_KEY }}
          ZY_QIANWEN_API_KEY: ${{ secrets.ZY_QIANWEN_API_KEY }}
          ZY_KIMI_API_KEY: ${{ secrets.ZY_KIMI_API_KEY }}
          ZY_QINGYAN_API_KEY: ${{ secrets.ZY_QINGYAN_API_KEY }}
        run: |
          # 在本地生成密钥文件（变量在此展开）
          cat > /tmp/.env.llm << ENVEOF
          ZY_DEEPSEEK_API_KEY=${ZY_DEEPSEEK_API_KEY}
          ZY_QIANWEN_API_KEY=${ZY_QIANWEN_API_KEY}
          ZY_KIMI_API_KEY=${ZY_KIMI_API_KEY}
          ZY_QINGYAN_API_KEY=${ZY_QINGYAN_API_KEY}
          ENVEOF

          # 上传到目标服务器
          scp -F ~/.ssh/config /tmp/.env.llm cn-target:/opt/zhuyuan-cn/config/.env.llm
          ssh cn-target 'chmod 600 /opt/zhuyuan-cn/config/.env.llm'
          rm -f /tmp/.env.llm
          echo "✅ 四大国内模型API密钥已注入"          

      - name: 🔧 启用Nginx配置 & 重载
        run: |
          ssh cn-target << 'NGINX_CMD'
          set -e

          # 复制配置到Nginx目录
          sudo cp /opt/zhuyuan-cn/config/nginx/cn-domain.conf /etc/nginx/sites-available/cn-domain.conf
          sudo ln -sf /etc/nginx/sites-available/cn-domain.conf /etc/nginx/sites-enabled/cn-domain.conf

          # 移除默认配置，避免 default_server 冲突
          sudo rm -f /etc/nginx/sites-enabled/default

          # 测试并重载Nginx
          sudo nginx -t && sudo systemctl reload nginx
          echo "✅ Nginx配置已生效"
          NGINX_CMD          

      - name: 💚 健康检查
        run: |
          ssh cn-target << 'HEALTH_CMD'
          set -e

          echo "═══ 国内落地页部署验证 ═══"

          # 检查Nginx
          if systemctl is-active --quiet nginx; then
            echo "✅ Nginx: 运行中"
          else
            echo "❌ Nginx: 已停止"
            exit 1
          fi

          # 检查页面可访问
          HTTP_CODE=$(curl -sf -o /dev/null -w '%{http_code}' http://localhost/ 2>/dev/null || echo "000")
          if [ "$HTTP_CODE" = "200" ]; then
            echo "✅ 落地页: HTTP 200 OK"
          else
            echo "❌ 落地页: HTTP ${HTTP_CODE}"
            exit 1
          fi

          # 检查ICP备案号
          if curl -sf http://localhost/ | grep -q "陕ICP备2025071211号"; then
            echo "✅ ICP备案号: 已显示"
          else
            echo "⚠️ ICP备案号: 未找到（请检查页面内容）"
          fi

          # 检查备案链接
          if curl -sf http://localhost/ | grep -q "beian.miit.gov.cn"; then
            echo "✅ 工信部链接: 已配置"
          else
            echo "⚠️ 工信部链接: 未找到"
          fi

          # 健康端点
          HEALTH=$(curl -sf http://localhost/health 2>/dev/null || echo '{}')
          echo "✅ 健康探针: ${HEALTH}"

          echo ""
          echo "═══ 部署完成 ═══"
          HEALTH_CMD          

      - name: 🧹 清理SSH密钥
        if: always()
        run: rm -f ~/.ssh/id_sg ~/.ssh/id_cn ~/.ssh/config

  health-check:
    name: 💚 国内落地页健康检查
    if: github.event.inputs.action == 'health-check'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: 🔐 配置SSH跳板 (SG→CN)
        env:
          SG_SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
          CN_SSH_KEY: ${{ secrets.ZY_CN_SERVER_KEY }}
          CN_SSH_PORT: ${{ secrets.ZY_CN_SSH_PORT }}
        run: |
          CN_PORT="${CN_SSH_PORT:-22}"

          mkdir -p ~/.ssh
          echo "$SG_SSH_KEY" > ~/.ssh/id_sg
          echo "$CN_SSH_KEY" > ~/.ssh/id_cn
          chmod 600 ~/.ssh/id_sg ~/.ssh/id_cn

          ssh-keyscan -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

          cat > ~/.ssh/config << EOF
          Host sg-jump
              HostName ${{ secrets.ZY_SERVER_HOST }}
              User ${{ secrets.ZY_SERVER_USER }}
              IdentityFile ~/.ssh/id_sg
              StrictHostKeyChecking accept-new
              BatchMode yes

          Host cn-target
              HostName ${{ secrets.ZY_CN_SERVER_HOST }}
              User ${{ secrets.ZY_CN_SERVER_USER }}
              Port ${CN_PORT}
              IdentityFile ~/.ssh/id_cn
              ProxyJump sg-jump
              StrictHostKeyChecking accept-new
              BatchMode yes
              ConnectTimeout 30
          EOF
          chmod 600 ~/.ssh/config          

      - name: 💚 执行健康检查
        run: |
          ssh cn-target << 'HEALTH_CMD'

          echo "═══ 国内落地页健康报告 ═══"
          echo ""

          echo "§1 系统状态:"
          uptime
          echo ""

          echo "§2 Nginx 状态:"
          systemctl is-active nginx && echo "Nginx: 运行中" || echo "Nginx: 已停止"
          echo ""

          echo "§3 落地页文件:"
          ls -la /opt/zhuyuan-cn/sites/cn-landing/ 2>/dev/null || echo "目录不存在"
          echo ""

          echo "§4 页面访问测试:"
          HTTP_CODE=$(curl -sf -o /dev/null -w '%{http_code}' http://localhost/ 2>/dev/null || echo "000")
          echo "HTTP状态码: ${HTTP_CODE}"
          echo ""

          echo "§5 ICP备案号检查:"
          if curl -sf http://localhost/ | grep -q "陕ICP备2025071211号"; then
            echo "✅ ICP备案号已显示"
          else
            echo "❌ ICP备案号未找到"
          fi

          echo ""
          echo "§6 LLM API密钥状态:"
          if [ -f /opt/zhuyuan-cn/config/.env.llm ]; then
            KEY_COUNT=$(grep -c "API_KEY" /opt/zhuyuan-cn/config/.env.llm 2>/dev/null || echo "0")
            echo "已配置密钥数: ${KEY_COUNT}"
          else
            echo "⚠️ LLM密钥文件不存在"
          fi

          HEALTH_CMD          

      - name: 🧹 清理SSH密钥
        if: always()
        run: rm -f ~/.ssh/id_sg ~/.ssh/id_cn ~/.ssh/config