0908

nginx/updateConfig.sh

@@ -1,4 +1,8 @@
-#!/bin/bash
+#!/usr/bin/env bash
+#
+# 把仓库里的 nginx 配置同步到宿主机 nginx（非容器部署路径）。
+#
+set -euo pipefail
 
 # 检查并创建nginx用户
 if ! id -u nginx >/dev/null 2>&1; then
@@ -6,31 +10,49 @@ if ! id -u nginx >/dev/null 2>&1; then
     sudo useradd -r -s /sbin/nologin nginx
 fi
 
-# 创建 conf.d 目录（如果不存在）
-sudo mkdir -p /etc/nginx/conf.d
+# 创建配置目录（ssl.d 必须存在，nginx.conf 里的 wildcard include 在目录缺失时会报 emerg）
+sudo mkdir -p /etc/nginx/conf.d /etc/nginx/ssl.d
 
 # 备份并覆盖 nginx.conf 文件
 sudo cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak
 sudo cp nginx.conf /etc/nginx/
 
-# 备份并覆盖 conf.d 目录下的所有 .conf 文件
+# 备份并覆盖 conf.d 目录下的所有 .conf 文件（只放不依赖证书的配置）
 for conf in conf.d/*.conf; do
     filename=$(basename "$conf")
     sudo cp "/etc/nginx/conf.d/$filename" "/etc/nginx/conf.d/${filename}.bak" 2>/dev/null || true
     sudo cp "$conf" /etc/nginx/conf.d/
 done
 
+# HTTPS 配置：只有证书已就绪的域名才启用，避免 nginx 因证书缺失拒绝启动
+DOMAINS="${DOMAINS:-fastgpt.stonelan.cn gitea.stonelan.cn image.stonelan.cn registry.stonelan.cn www.stonelan.cn}"
+for d in $DOMAINS; do
+    src="ssl.d.available/$d.conf"
+    [ -f "$src" ] || { echo "跳过 $d：缺少 $src"; continue; }
+
+    if [ -f "/etc/letsencrypt/live/$d/fullchain.pem" ]; then
+        sudo cp "$src" "/etc/nginx/ssl.d/$d.conf"
+        echo "已启用 $d"
+    else
+        echo "跳过 $d：证书尚未生成"
+    fi
+done
+
 # 测试并重载配置
 if sudo nginx -t; then
-    sudo systemctl reload nginx
-    echo "配置已生效，HTTPS已启用"
+    if sudo systemctl is-active --quiet nginx; then
+        sudo systemctl reload nginx
+        echo "配置已重载"
+    else
+        sudo systemctl start nginx
+        echo "nginx 已启动"
+    fi
 else
     echo "配置测试失败，已恢复备份"
-    # 恢复 nginx.conf 备份
     sudo cp /etc/nginx/nginx.conf.bak /etc/nginx/nginx.conf
-    # 恢复 conf.d 目录下的所有 .conf 文件备份
     for conf in conf.d/*.conf; do
         filename=$(basename "$conf")
         sudo mv -f "/etc/nginx/conf.d/${filename}.bak" "/etc/nginx/conf.d/$filename" 2>/dev/null || true
     done
-fi
+    exit 1
+fi