272 lines
7.5 KiB
Bash
272 lines
7.5 KiB
Bash
#!/bin/bash
|
|
# 服务器一键配置脚本
|
|
# 在 micecola.top 上执行此脚本
|
|
|
|
set -e
|
|
|
|
echo "=========================================="
|
|
echo " kb-web 自动部署环境配置"
|
|
echo "=========================================="
|
|
|
|
# 创建目录结构
|
|
echo "[1/5] 创建目录结构..."
|
|
mkdir -p /var/www/kb-web-test
|
|
mkdir -p /var/www/kb-web-prod
|
|
mkdir -p /var/www/kb-web-test-backups
|
|
mkdir -p /var/www/kb-web-prod-backups
|
|
mkdir -p /var/www/webhook
|
|
mkdir -p /var/log
|
|
|
|
# 创建部署脚本
|
|
echo "[2/5] 创建部署脚本..."
|
|
cat > /var/www/webhook/deploy.sh << 'DEPLOY_SCRIPT'
|
|
#!/bin/bash
|
|
set -e
|
|
|
|
DEPLOY_ENV=${1:-test}
|
|
BRANCH=${2:-main}
|
|
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
|
|
|
|
case $DEPLOY_ENV in
|
|
test) DEPLOY_DIR="/var/www/kb-web-test"; BACKUP_DIR="/var/www/kb-web-test-backups" ;;
|
|
prod) DEPLOY_DIR="/var/www/kb-web-prod"; BACKUP_DIR="/var/www/kb-web-prod-backups" ;;
|
|
*) echo "用法: $0 [test|prod] [branch]"; exit 1 ;;
|
|
esac
|
|
|
|
REPO_URL="ssh://sc-gitea@192.168.1.22:2223/starmen1265/kb-web.git"
|
|
LOG_FILE="/var/log/kb-web-deploy.log"
|
|
|
|
log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"; }
|
|
|
|
log "开始部署 $DEPLOY_ENV 环境, 分支: $BRANCH"
|
|
mkdir -p "$DEPLOY_DIR" "$BACKUP_DIR"
|
|
|
|
if [ -d "$DEPLOY_DIR/.git" ]; then
|
|
log "备份当前版本..."
|
|
CURRENT_COMMIT=$(cd "$DEPLOY_DIR" && git rev-parse --short HEAD 2>/dev/null || echo "unknown")
|
|
tar -czf "$BACKUP_DIR/backup_${CURRENT_COMMIT}_${TIMESTAMP}.tar.gz" -C "$DEPLOY_DIR" . 2>/dev/null || true
|
|
cd "$BACKUP_DIR" && ls -t | tail -n +6 | xargs -r rm -f
|
|
|
|
log "更新代码..."
|
|
cd "$DEPLOY_DIR"
|
|
git fetch origin
|
|
git reset --hard "origin/$BRANCH"
|
|
else
|
|
log "克隆代码..."
|
|
git clone -b "$BRANCH" "$REPO_URL" "$DEPLOY_DIR"
|
|
cd "$DEPLOY_DIR"
|
|
fi
|
|
|
|
log "设置权限..."
|
|
chown -R www-data:www-data "$DEPLOY_DIR" 2>/dev/null || chown -R nginx:nginx "$DEPLOY_DIR" 2>/dev/null || true
|
|
|
|
DEPLOY_INFO="$DEPLOY_DIR/.deploy_info"
|
|
cat > "$DEPLOY_INFO" << EOF
|
|
环境: $DEPLOY_ENV
|
|
分支: $BRANCH
|
|
提交: $(git rev-parse HEAD)
|
|
时间: $(date '+%Y-%m-%d %H:%M:%S')
|
|
EOF
|
|
|
|
log "部署完成: $(git log -1 --oneline)"
|
|
DEPLOY_SCRIPT
|
|
|
|
chmod +x /var/www/webhook/deploy.sh
|
|
|
|
# 创建 webhook 接收器
|
|
echo "[3/5] 创建 webhook 接收器..."
|
|
cat > /var/www/webhook/receiver.php << 'RECEIVER_PHP'
|
|
<?php
|
|
const SECRET = 'kb-web-webhook-secret-2024';
|
|
const DEPLOY_SCRIPT = '/var/www/webhook/deploy.sh';
|
|
const LOG_FILE = '/var/log/webhook.log';
|
|
|
|
function log_msg($msg) {
|
|
file_put_contents(LOG_FILE, "[".date('Y-m-d H:i:s')."] $msg\n", FILE_APPEND);
|
|
}
|
|
|
|
function verify_signature($payload, $signature) {
|
|
$expected = 'sha256=' . hash_hmac('sha256', $payload, SECRET);
|
|
return hash_equals($expected, $signature);
|
|
}
|
|
|
|
log_msg("收到 webhook 请求");
|
|
$payload = file_get_contents('php://input');
|
|
$headers = function_exists('getallheaders') ? getallheaders() : [];
|
|
|
|
$signature = '';
|
|
foreach ($headers as $k => $v) {
|
|
if (strtolower($k) === 'x-gitea-signature' || strtolower($k) === 'x-gitea-signature-sha256') {
|
|
$signature = $v;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!verify_signature($payload, $signature)) {
|
|
log_msg("签名验证失败");
|
|
http_response_code(401);
|
|
echo json_encode(['error' => 'Invalid signature']);
|
|
exit;
|
|
}
|
|
|
|
$data = json_decode($payload, true);
|
|
$repo = $data['repository']['name'] ?? '';
|
|
$branch = basename($data['ref'] ?? '');
|
|
|
|
log_msg("仓库: $repo, 分支: $branch");
|
|
|
|
if ($repo !== 'kb-web') {
|
|
echo json_encode(['status' => 'ignored']);
|
|
exit;
|
|
}
|
|
|
|
$env = 'test';
|
|
log_msg("开始部署到 $env");
|
|
exec(sprintf('%s %s %s 2>&1', DEPLOY_SCRIPT, $env, $branch), $output, $ret);
|
|
|
|
header('Content-Type: application/json');
|
|
echo json_encode(['status' => $ret === 0 ? 'success' : 'failed', 'output' => $output]);
|
|
RECEIVER_PHP
|
|
|
|
# 创建 SSH 密钥用于拉取代码
|
|
echo "[4/5] 配置 SSH 密钥..."
|
|
mkdir -p ~/.ssh
|
|
chmod 700 ~/.ssh
|
|
|
|
# 如果没有部署密钥，创建一个
|
|
if [ ! -f ~/.ssh/id_rsa_kb_deploy ]; then
|
|
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_kb_deploy -N "" -C "kb-deploy@micecola"
|
|
echo ""
|
|
echo "=========================================="
|
|
echo " 请将以下公钥添加到 Gitea 部署密钥:"
|
|
echo "=========================================="
|
|
cat ~/.ssh/id_rsa_kb_deploy.pub
|
|
echo "=========================================="
|
|
fi
|
|
|
|
# 配置 SSH config
|
|
cat >> ~/.ssh/config << 'SSH_CONFIG'
|
|
|
|
# kb-web 部署
|
|
Host sc-gitea
|
|
HostName 192.168.1.22
|
|
Port 2223
|
|
User sc-gitea
|
|
IdentityFile ~/.ssh/id_rsa_kb_deploy
|
|
StrictHostKeyChecking no
|
|
SSH_CONFIG
|
|
|
|
chmod 600 ~/.ssh/config
|
|
|
|
# 配置 Nginx
|
|
echo "[5/5] 配置 Nginx..."
|
|
|
|
# 测试环境
|
|
cat > /etc/nginx/sites-available/kb-web-test.conf << 'NGINX_CONF'
|
|
server {
|
|
listen 8080;
|
|
server_name _;
|
|
root /var/www/kb-web-test;
|
|
index index.php index.html;
|
|
|
|
access_log /var/log/nginx/kb-web-test.access.log;
|
|
error_log /var/log/nginx/kb-web-test.error.log;
|
|
|
|
location / {
|
|
try_files $uri $uri/ /index.php?$query_string;
|
|
}
|
|
|
|
location ~ \.php$ {
|
|
fastcgi_pass unix:/run/php/php-fpm.sock;
|
|
fastcgi_index index.php;
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
include fastcgi_params;
|
|
}
|
|
|
|
location ~ /\. {
|
|
deny all;
|
|
}
|
|
}
|
|
NGINX_CONF
|
|
|
|
# 正式环境 (需要你配置 SSL)
|
|
cat > /etc/nginx/sites-available/kb-web-prod.conf << 'NGINX_CONF'
|
|
server {
|
|
listen 80;
|
|
server_name kb.micecola.top; # 修改为你的域名
|
|
|
|
root /var/www/kb-web-prod;
|
|
index index.php index.html;
|
|
|
|
access_log /var/log/nginx/kb-web-prod.access.log;
|
|
error_log /var/log/nginx/kb-web-prod.error.log;
|
|
|
|
# 强制 HTTPS (配置 SSL 后启用)
|
|
# return 301 https://$server_name$request_uri;
|
|
|
|
location / {
|
|
try_files $uri $uri/ /index.php?$query_string;
|
|
}
|
|
|
|
location ~ \.php$ {
|
|
fastcgi_pass unix:/run/php/php-fpm.sock;
|
|
fastcgi_index index.php;
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
include fastcgi_params;
|
|
}
|
|
|
|
location ~ /\. {
|
|
deny all;
|
|
}
|
|
}
|
|
|
|
# HTTPS 配置 (需要 SSL 证书后启用)
|
|
# server {
|
|
# listen 443 ssl http2;
|
|
# server_name kb.micecola.top;
|
|
#
|
|
# ssl_certificate /etc/nginx/ssl/kb.micecola.top.crt;
|
|
# ssl_certificate_key /etc/nginx/ssl/kb.micecola.top.key;
|
|
#
|
|
# root /var/www/kb-web-prod;
|
|
# index index.php index.html;
|
|
#
|
|
# location / {
|
|
# try_files $uri $uri/ /index.php?$query_string;
|
|
# }
|
|
#
|
|
# location ~ \.php$ {
|
|
# fastcgi_pass unix:/run/php/php-fpm.sock;
|
|
# fastcgi_index index.php;
|
|
# fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
# include fastcgi_params;
|
|
# }
|
|
# }
|
|
NGINX_CONF
|
|
|
|
# 启用站点
|
|
ln -sf /etc/nginx/sites-available/kb-web-test.conf /etc/nginx/sites-enabled/
|
|
ln -sf /etc/nginx/sites-available/kb-web-prod.conf /etc/nginx/sites-enabled/
|
|
|
|
# 测试并重载 Nginx
|
|
nginx -t && systemctl reload nginx
|
|
|
|
echo ""
|
|
echo "=========================================="
|
|
echo " 配置完成!"
|
|
echo "=========================================="
|
|
echo ""
|
|
echo "下一步操作:"
|
|
echo "1. 将上面的部署公钥添加到 Gitea 仓库的 Deploy Keys"
|
|
echo "2. 在 Gitea 仓库设置中添加 Webhook:"
|
|
echo " - URL: http://micecola.top:8080/webhook/receiver.php"
|
|
echo " - 密钥: kb-web-webhook-secret-2024"
|
|
echo " - 触发: Push 事件"
|
|
echo "3. 测试环境访问: http://micecola.top:8080"
|
|
echo "4. 正式环境域名: kb.micecola.top (需配置 DNS 和 SSL)"
|
|
echo ""
|
|
echo "手动部署命令:"
|
|
echo " 测试环境: /var/www/webhook/deploy.sh test main"
|
|
echo " 正式环境: /var/www/webhook/deploy.sh prod main"
|
|
echo "=========================================="
|