admin/common-server-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

0908

Browse Source
This commit is contained in:
张威33321
2026-09-09 15:04:54 +08:00
parent fb87be680d
commit a9ec40a289
22 changed files with 303 additions and 352 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
nginx/conf.d/00-http.conf
View File

@@ -17,8 +17,8 @@ server {
}
# ACME HTTP-01 验证
# certbot 通过 webroot 写入 /var/www/certbot/.well-known/acme-challenge/<token>
# 该目录是 certbot-webroot 卷，nginx 以只读方式挂载
# acme.sh 通过 webroot 写入 /var/www/certbot/.well-known/acme-challenge/<token>
# 这是宿主机目录，nginx 容器以只读方式 bind mount
location /.well-known/acme-challenge/ {
root /var/www/certbot;
default_type text/plain;

15
nginx/docker-compose.yml
View File

@@ -6,23 +6,16 @@ services:
- "8081:80"
- "8443:8443"
volumes:
# 证书（只读）
- certbot-certs:/etc/letsencrypt:ro
# ACME 验证目录（只读）：certbot 写入挑战文件，nginx 直接对外提供
- certbot-webroot:/var/www/certbot:ro
# 证书：宿主机 acme.sh 写入，nginx 只读
- /etc/letsencrypt:/etc/letsencrypt:ro
# ACME HTTP-01 挑战文件：宿主机 acme.sh 写入，nginx 只读
- /var/www/certbot:/var/www/certbot:ro
# HTTPS server 块：默认为空，证书就绪后由 enable-ssl.sh 写入
- ./ssl.d:/etc/nginx/ssl.d:ro
restart: unless-stopped
networks:
- trim-default
volumes:
# 与 certbot/docker-compose.yml 共用，物理卷名由 certbot 侧固定为同名
certbot-certs:
external: true
certbot-webroot:
external: true
networks:
trim-default:
external: true

28
nginx/enable-ssl.sh
View File

@@ -1,23 +1,29 @@
#!/usr/bin/env bash
#
# 启用 HTTPS 配置：只把"已经拿到证书"的域名对应的 server 块
# 从 ssl.d.available/ 复制到 ssl.d/（nginx 挂载并 include 的目录），
# 然后校验配置并优雅重载 nginx。
# 启用 HTTPS 配置：证书就绪后，把 ssl.d.available/ 下的 server 块
# 复制进 ssl.d/（nginx 容器 bind mount 并 include 的目录），校验后优雅重载 nginx。
#
# 冷启动时 ssl.d/ 为空，nginx 只加载 conf.d/00-http.conf（不引用证书），
# 因此可以在没有证书的情况下正常启动并提供 80 端口 —— 这是打破
# 因此可以在没有证书的情况下启动并提供 80 端口 —— 这是打破
# "先有证书还是先有 nginx" 死锁的关键。
#
set -euo pipefail
# cron / 非登录 shell 下 PATH 极简，显式补齐
export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin${PATH:+:$PATH}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
AVAILABLE="$SCRIPT_DIR/ssl.d.available"
ENABLED="$SCRIPT_DIR/ssl.d"
CERT_NAME="${CERT_NAME:-stonelan.cn}"
CERT_FULL="/etc/letsencrypt/live/$CERT_NAME/fullchain.pem"
DOMAINS="${DOMAINS:-fastgpt.stonelan.cn gitea.stonelan.cn image.stonelan.cn registry.stonelan.cn www.stonelan.cn}"
# 证书在宿主机上，直接判断即可（不再需要进容器）
if [ ! -f "$CERT_FULL" ]; then
echo "证书尚未生成：$CERT_FULL"
echo "请先执行 acme/issue.sh，成功后再运行本脚本"
exit 0
fi
mkdir -p "$ENABLED"
cd "$SCRIPT_DIR"
@@ -29,12 +35,6 @@ for d in $DOMAINS; do
continue
fi
# nginx 容器以只读方式挂载了 certbot-certs 卷，用它判断证书是否就绪
if ! docker compose exec -T nginx-proxy test -f "/etc/letsencrypt/live/$d/fullchain.pem" 2>/dev/null; then
echo "跳过 $d：证书不存在（/etc/letsencrypt/live/$d/fullchain.pem）"
continue
fi
if ! cmp -s "$conf" "$ENABLED/$d.conf" 2>/dev/null; then
cp "$conf" "$ENABLED/$d.conf"
copied+=("$ENABLED/$d.conf")
@@ -43,7 +43,7 @@ for d in $DOMAINS; do
done
if [ "${#copied[@]}" -eq 0 ]; then
echo "没有需要变更的 HTTPS 配置"
echo "HTTPS 配置已是最新，无需变更"
exit 0
fi

8
nginx/ssl.d.available/fastgpt.conf
View File

@@ -1,12 +1,12 @@
# HTTPS 配置 —— fastgpt.stonelan.cn
# 仅在 /etc/letsencrypt/live/fastgpt.stonelan.cn/fullchain.pem 存在时，
# 由 nginx/enable-ssl.sh 复制到 ssl.d/ 才会被 nginx 加载。
# 5 个域名共用一张 SAN 证书，统一放在 /etc/letsencrypt/live/stonelan.cn/。
# 由 nginx/enable-ssl.sh 在证书就绪后复制到 ssl.d/ 才会被 nginx 加载。
server {
listen 8443 ssl;
server_name fastgpt.stonelan.cn;
ssl_certificate /etc/letsencrypt/live/fastgpt.stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/fastgpt.stonelan.cn/privkey.pem;
ssl_certificate /etc/letsencrypt/live/stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/stonelan.cn/privkey.pem;
# SSL 优化配置
ssl_protocols TLSv1.2 TLSv1.3;

7
nginx/ssl.d.available/gitea.conf
View File

@@ -1,12 +1,13 @@
# HTTPS 配置 —— gitea.stonelan.cn
# 仅在证书存在时由 nginx/enable-ssl.sh 复制到 ssl.d/ 才会生效。
# 5 个域名共用一张 SAN 证书，统一放在 /etc/letsencrypt/live/stonelan.cn/。
# 由 nginx/enable-ssl.sh 在证书就绪后复制到 ssl.d/ 才会生效。
server {
listen 8443 ssl;
server_name gitea.stonelan.cn;
client_max_body_size 200m;
ssl_certificate /etc/letsencrypt/live/gitea.stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/gitea.stonelan.cn/privkey.pem;
ssl_certificate /etc/letsencrypt/live/stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/stonelan.cn/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

7
nginx/ssl.d.available/image.conf
View File

@@ -1,11 +1,12 @@
# HTTPS 配置 —— image.stonelan.cn
# 仅在证书存在时由 nginx/enable-ssl.sh 复制到 ssl.d/ 才会生效。
# 5 个域名共用一张 SAN 证书，统一放在 /etc/letsencrypt/live/stonelan.cn/。
# 由 nginx/enable-ssl.sh 在证书就绪后复制到 ssl.d/ 才会生效。
server {
listen 8443 ssl;
server_name image.stonelan.cn;
ssl_certificate /etc/letsencrypt/live/image.stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/image.stonelan.cn/privkey.pem;
ssl_certificate /etc/letsencrypt/live/stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/stonelan.cn/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

7
nginx/ssl.d.available/registry.conf
View File

@@ -1,12 +1,13 @@
# HTTPS 配置 —— registry.stonelan.cn
# 仅在证书存在时由 nginx/enable-ssl.sh 复制到 ssl.d/ 才会生效。
# 5 个域名共用一张 SAN 证书，统一放在 /etc/letsencrypt/live/stonelan.cn/。
# 由 nginx/enable-ssl.sh 在证书就绪后复制到 ssl.d/ 才会生效。
server {
listen 8443 ssl;
server_name registry.stonelan.cn;
client_max_body_size 500m;
ssl_certificate /etc/letsencrypt/live/registry.stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/registry.stonelan.cn/privkey.pem;
ssl_certificate /etc/letsencrypt/live/stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/stonelan.cn/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

7
nginx/ssl.d.available/www.conf
View File

@@ -1,11 +1,12 @@
# HTTPS 配置 —— www.stonelan.cn
# 仅在证书存在时由 nginx/enable-ssl.sh 复制到 ssl.d/ 才会生效。
# 5 个域名共用一张 SAN 证书，统一放在 /etc/letsencrypt/live/stonelan.cn/。
# 由 nginx/enable-ssl.sh 在证书就绪后复制到 ssl.d/ 才会生效。
server {
listen 8443 ssl;
server_name www.stonelan.cn;
ssl_certificate /etc/letsencrypt/live/www.stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www.stonelan.cn/privkey.pem;
ssl_certificate /etc/letsencrypt/live/stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/stonelan.cn/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

28
nginx/updateConfig.sh
View File

@@ -24,19 +24,25 @@ for conf in conf.d/*.conf; do
sudo cp "$conf" /etc/nginx/conf.d/
done
# HTTPS 配置：只有证书已就绪的域名才启用，避免 nginx 因证书缺失拒绝启动
# HTTPS 配置：证书就绪后才启用，避免 nginx 因证书缺失拒绝启动
# 5 个域名共用一张 SAN 证书，统一放在 CERT_NAME 目录下
CERT_NAME="${CERT_NAME:-stonelan.cn}"
CERT_FULL="/etc/letsencrypt/live/$CERT_NAME/fullchain.pem"
DOMAINS="${DOMAINS:-fastgpt.stonelan.cn gitea.stonelan.cn image.stonelan.cn registry.stonelan.cn www.stonelan.cn}"
for d in $DOMAINS; do
src="ssl.d.available/$d.conf"
[ -f "$src" ] || { echo "跳过 $d：缺少 $src"; continue; }
if [ -f "/etc/letsencrypt/live/$d/fullchain.pem" ]; then
sudo cp "$src" "/etc/nginx/ssl.d/$d.conf"
echo "已启用 $d"
else
echo "跳过 $d：证书尚未生成"
fi
done
if [ -f "$CERT_FULL" ]; then
for d in $DOMAINS; do
src="ssl.d.available/$d.conf"
if [ -f "$src" ]; then
sudo cp "$src" "/etc/nginx/ssl.d/$d.conf"
echo "已启用 $d"
else
echo "跳过 $d：缺少 $src"
fi
done
else
echo "证书尚未生成（$CERT_FULL），跳过 HTTPS 配置"
fi
# 测试并重载配置
if sudo nginx -t; then