287 lines
10 KiB
YAML
287 lines
10 KiB
YAML
# ═══════════════════════════════════════════════
|
||
# 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001
|
||
# 📜 Copyright: 国作登字-2026-A-00037559
|
||
# ═══════════════════════════════════════════════
|
||
# 🌐 铸渊专线 · 部署与管理
|
||
#
|
||
# 铸渊核心身体 · 锻心器官扩展
|
||
# 管理代理服务的安装、更新、订阅发送
|
||
# ═══════════════════════════════════════════════
|
||
|
||
name: '🌐 铸渊专线 · 部署'
|
||
|
||
on:
|
||
workflow_dispatch:
|
||
inputs:
|
||
action:
|
||
description: '操作类型'
|
||
required: true
|
||
type: choice
|
||
options:
|
||
- install
|
||
- update
|
||
- status
|
||
- restart
|
||
- send-subscription
|
||
- update-dashboard
|
||
- setup-cn-relay
|
||
default: 'status'
|
||
email:
|
||
description: '目标邮箱 (仅send-subscription时需要)'
|
||
required: false
|
||
type: string
|
||
|
||
permissions:
|
||
contents: write
|
||
|
||
jobs:
|
||
# ═══ §1 代理服务部署 ═══
|
||
deploy-proxy:
|
||
name: '🌐 代理服务 · ${{ github.event.inputs.action }}'
|
||
runs-on: ubuntu-latest
|
||
if: >-
|
||
github.event.inputs.action == 'install' ||
|
||
github.event.inputs.action == 'update' ||
|
||
github.event.inputs.action == 'status' ||
|
||
github.event.inputs.action == 'restart'
|
||
|
||
steps:
|
||
- name: '📥 检出代码'
|
||
uses: actions/checkout@v4
|
||
|
||
- name: '🔑 配置SSH密钥'
|
||
env:
|
||
SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
|
||
run: |
|
||
mkdir -p ~/.ssh
|
||
echo "$SSH_KEY" > ~/.ssh/id_deploy
|
||
chmod 600 ~/.ssh/id_deploy
|
||
|
||
# 验证密钥格式
|
||
if ! head -1 ~/.ssh/id_deploy | grep -q "BEGIN"; then
|
||
echo "❌ SSH密钥格式异常"
|
||
exit 1
|
||
fi
|
||
|
||
ssh-keyscan -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
|
||
|
||
# 连接测试
|
||
ssh -i ~/.ssh/id_deploy \
|
||
-o StrictHostKeyChecking=accept-new \
|
||
-o BatchMode=yes \
|
||
-o ConnectTimeout=15 \
|
||
${{ secrets.ZY_SERVER_USER }}@${{ secrets.ZY_SERVER_HOST }} \
|
||
"echo '✅ SSH连接成功'"
|
||
|
||
- name: '📦 上传代理服务代码'
|
||
if: >-
|
||
github.event.inputs.action == 'install' ||
|
||
github.event.inputs.action == 'update'
|
||
run: |
|
||
rsync -avz --delete \
|
||
-e "ssh -i ~/.ssh/id_deploy -o StrictHostKeyChecking=accept-new" \
|
||
server/proxy/ \
|
||
${{ secrets.ZY_SERVER_USER }}@${{ secrets.ZY_SERVER_HOST }}:/opt/zhuyuan/proxy-deploy/
|
||
|
||
- name: '🚀 执行部署'
|
||
run: |
|
||
ssh -i ~/.ssh/id_deploy \
|
||
-o StrictHostKeyChecking=accept-new \
|
||
${{ secrets.ZY_SERVER_USER }}@${{ secrets.ZY_SERVER_HOST }} \
|
||
"cd /opt/zhuyuan/proxy-deploy && \
|
||
export ZY_SERVER_HOST='${{ secrets.ZY_SERVER_HOST }}' && \
|
||
export ZY_CN_RELAY_HOST='${{ secrets.ZY_CN_SERVER_HOST }}' && \
|
||
bash deploy-proxy.sh ${{ github.event.inputs.action }}"
|
||
|
||
- name: '🧹 清理SSH密钥'
|
||
if: always()
|
||
run: rm -f ~/.ssh/id_deploy
|
||
|
||
# ═══ §2 发送订阅链接 ═══
|
||
send-subscription:
|
||
name: '📧 发送订阅链接'
|
||
runs-on: ubuntu-latest
|
||
if: github.event.inputs.action == 'send-subscription'
|
||
|
||
steps:
|
||
- name: '📥 检出代码'
|
||
uses: actions/checkout@v4
|
||
|
||
- name: '🔑 配置SSH密钥'
|
||
env:
|
||
SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
|
||
run: |
|
||
mkdir -p ~/.ssh
|
||
echo "$SSH_KEY" > ~/.ssh/id_deploy
|
||
chmod 600 ~/.ssh/id_deploy
|
||
ssh-keyscan -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
|
||
|
||
- name: '📧 发送订阅邮件'
|
||
run: |
|
||
TARGET_EMAIL="${{ github.event.inputs.email }}"
|
||
if [ -z "$TARGET_EMAIL" ]; then
|
||
TARGET_EMAIL="${{ secrets.ZY_SMTP_USER }}"
|
||
fi
|
||
|
||
echo "📧 发送订阅到: $TARGET_EMAIL"
|
||
|
||
ssh -i ~/.ssh/id_deploy \
|
||
-o StrictHostKeyChecking=accept-new \
|
||
${{ secrets.ZY_SERVER_USER }}@${{ secrets.ZY_SERVER_HOST }} \
|
||
"cd /opt/zhuyuan/proxy && \
|
||
ZY_SMTP_USER='${{ secrets.ZY_SMTP_USER }}' \
|
||
ZY_SMTP_PASS='${{ secrets.ZY_SMTP_PASS }}' \
|
||
ZY_SERVER_HOST='${{ secrets.ZY_SERVER_HOST }}' \
|
||
node service/send-subscription.js send '$TARGET_EMAIL'"
|
||
|
||
- name: '🧹 清理SSH密钥'
|
||
if: always()
|
||
run: rm -f ~/.ssh/id_deploy
|
||
|
||
# ═══ §3 更新仪表盘 ═══
|
||
update-dashboard:
|
||
name: '📊 更新仪表盘'
|
||
runs-on: ubuntu-latest
|
||
if: github.event.inputs.action == 'update-dashboard'
|
||
|
||
steps:
|
||
- name: '📥 检出代码'
|
||
uses: actions/checkout@v4
|
||
with:
|
||
token: ${{ secrets.ZY_GITHUB_PAT }}
|
||
|
||
- name: '🔑 配置SSH密钥'
|
||
env:
|
||
SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
|
||
run: |
|
||
mkdir -p ~/.ssh
|
||
echo "$SSH_KEY" > ~/.ssh/id_deploy
|
||
chmod 600 ~/.ssh/id_deploy
|
||
ssh-keyscan -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
|
||
|
||
- name: '📊 获取流量数据'
|
||
run: |
|
||
# 从服务器获取配额数据
|
||
ssh -i ~/.ssh/id_deploy \
|
||
-o StrictHostKeyChecking=accept-new \
|
||
${{ secrets.ZY_SERVER_USER }}@${{ secrets.ZY_SERVER_HOST }} \
|
||
"cat /opt/zhuyuan/proxy/data/quota-status.json 2>/dev/null || echo '{}'" \
|
||
> /tmp/quota-status.json
|
||
|
||
cat /tmp/quota-status.json
|
||
|
||
- name: '📝 更新README仪表盘'
|
||
run: |
|
||
node server/proxy/dashboard/update-dashboard.js --json /tmp/quota-status.json
|
||
|
||
- name: '📤 提交更新'
|
||
run: |
|
||
git config user.name "铸渊 · ZhuYuan"
|
||
git config user.email "zhuyuan-bot@guanghulab.com"
|
||
|
||
if git diff --quiet README.md; then
|
||
echo "仪表盘无变化"
|
||
else
|
||
git add README.md
|
||
git commit -m "📊 铸渊专线仪表盘更新 · $(date -u +%Y-%m-%d)"
|
||
git push
|
||
echo "✅ 仪表盘已更新并推送"
|
||
fi
|
||
|
||
- name: '🧹 清理'
|
||
if: always()
|
||
run: rm -f ~/.ssh/id_deploy /tmp/quota-status.json
|
||
|
||
# ═══ §4 CN中转配置 ═══
|
||
setup-cn-relay:
|
||
name: '🇨🇳 CN中转配置'
|
||
runs-on: ubuntu-latest
|
||
if: github.event.inputs.action == 'setup-cn-relay'
|
||
|
||
steps:
|
||
- name: '📥 检出代码'
|
||
uses: actions/checkout@v4
|
||
|
||
- name: '🔑 配置CN服务器SSH密钥'
|
||
env:
|
||
SSH_KEY: ${{ secrets.ZY_CN_SERVER_KEY }}
|
||
CN_SSH_PORT: ${{ secrets.ZY_CN_SSH_PORT }}
|
||
run: |
|
||
# 端口配置 (支持自定义SSH端口，腾讯云服务器常用非22端口)
|
||
SSH_PORT="${CN_SSH_PORT:-22}"
|
||
echo "SSH_PORT=${SSH_PORT}" >> $GITHUB_ENV
|
||
echo "🔧 CN服务器SSH端口: ${SSH_PORT}"
|
||
|
||
mkdir -p ~/.ssh
|
||
echo "$SSH_KEY" > ~/.ssh/id_cn
|
||
chmod 600 ~/.ssh/id_cn
|
||
|
||
if ! head -1 ~/.ssh/id_cn | grep -q "BEGIN"; then
|
||
echo "❌ CN服务器SSH密钥格式异常"
|
||
echo " 请检查 ZY_CN_SERVER_KEY Secret"
|
||
exit 1
|
||
fi
|
||
|
||
echo "🔍 扫描CN服务器主机密钥 (端口 ${SSH_PORT})..."
|
||
ssh-keyscan -p ${SSH_PORT} -H ${{ secrets.ZY_CN_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
|
||
|
||
echo "🔗 测试SSH连接..."
|
||
ssh -i ~/.ssh/id_cn \
|
||
-p ${SSH_PORT} \
|
||
-o StrictHostKeyChecking=accept-new \
|
||
-o BatchMode=yes \
|
||
-o ConnectTimeout=15 \
|
||
${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} \
|
||
"echo '✅ CN服务器SSH连接成功'" || {
|
||
echo ""
|
||
echo "❌ SSH连接失败 · 排查清单:"
|
||
echo " 1. 确认 ZY_CN_SSH_PORT Secret 已设置为CN服务器的SSH端口 (当前: ${SSH_PORT})"
|
||
echo " 2. 腾讯云控制台 → 安全组 → 确认入站规则允许端口 ${SSH_PORT}"
|
||
echo " 3. 确认 ZY_CN_SERVER_HOST 地址正确"
|
||
echo " 4. 确认 ZY_CN_SERVER_KEY 密钥与服务器匹配"
|
||
echo " 5. 确认CN服务器已开机且SSH服务正在运行"
|
||
exit 1
|
||
}
|
||
|
||
- name: '📦 上传CN中转脚本'
|
||
run: |
|
||
scp -i ~/.ssh/id_cn \
|
||
-P ${{ env.SSH_PORT }} \
|
||
-o StrictHostKeyChecking=accept-new \
|
||
server/proxy/setup/setup-cn-relay.sh \
|
||
${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }}:/tmp/setup-cn-relay.sh
|
||
|
||
- name: '🇨🇳 执行CN中转配置'
|
||
run: |
|
||
ssh -i ~/.ssh/id_cn \
|
||
-p ${{ env.SSH_PORT }} \
|
||
-o StrictHostKeyChecking=accept-new \
|
||
${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} \
|
||
"chmod +x /tmp/setup-cn-relay.sh && \
|
||
export ZY_SG_SERVER_HOST='${{ secrets.ZY_SERVER_HOST }}' && \
|
||
sudo -E bash /tmp/setup-cn-relay.sh"
|
||
|
||
- name: '💚 CN中转验证'
|
||
run: |
|
||
CN_HOST="${{ secrets.ZY_CN_SERVER_HOST }}"
|
||
echo "🔍 验证CN中转..."
|
||
|
||
# 检查中转端口
|
||
if nc -z -w5 "$CN_HOST" 2053 2>/dev/null; then
|
||
echo "✅ CN中转端口 2053: 可达"
|
||
else
|
||
echo "⚠️ CN中转端口 2053: 暂不可达 (可能需要等待防火墙生效)"
|
||
fi
|
||
|
||
# 检查HTTP健康
|
||
HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" "http://${CN_HOST}/health" 2>/dev/null || echo "000")
|
||
if [ "$HTTP_CODE" = "200" ]; then
|
||
echo "✅ CN HTTP健康检查: 正常"
|
||
else
|
||
echo "⚠️ CN HTTP: 状态码 $HTTP_CODE (可能需要等待)"
|
||
fi
|
||
|
||
- name: '🧹 清理SSH密钥'
|
||
if: always()
|
||
run: rm -f ~/.ssh/id_cn
|