65 lines
2.1 KiB
Bash
65 lines
2.1 KiB
Bash
#!/usr/bin/env bash
|
||
#
|
||
# 把仓库里的 nginx 配置同步到宿主机 nginx（非容器部署路径）。
|
||
#
|
||
set -euo pipefail
|
||
|
||
# 检查并创建nginx用户
|
||
if ! id -u nginx >/dev/null 2>&1; then
|
||
echo "创建nginx用户..."
|
||
sudo useradd -r -s /sbin/nologin nginx
|
||
fi
|
||
|
||
# 创建配置目录（ssl.d 必须存在，nginx.conf 里的 wildcard include 在目录缺失时会报 emerg）
|
||
sudo mkdir -p /etc/nginx/conf.d /etc/nginx/ssl.d
|
||
|
||
# 备份并覆盖 nginx.conf 文件
|
||
sudo cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak
|
||
sudo cp nginx.conf /etc/nginx/
|
||
|
||
# 备份并覆盖 conf.d 目录下的所有 .conf 文件（只放不依赖证书的配置）
|
||
for conf in conf.d/*.conf; do
|
||
filename=$(basename "$conf")
|
||
sudo cp "/etc/nginx/conf.d/$filename" "/etc/nginx/conf.d/${filename}.bak" 2>/dev/null || true
|
||
sudo cp "$conf" /etc/nginx/conf.d/
|
||
done
|
||
|
||
# HTTPS 配置：证书就绪后才启用，避免 nginx 因证书缺失拒绝启动
|
||
# 5 个域名共用一张 SAN 证书，统一放在 CERT_NAME 目录下
|
||
CERT_NAME="${CERT_NAME:-stonelan.cn}"
|
||
CERT_FULL="/etc/letsencrypt/live/$CERT_NAME/fullchain.pem"
|
||
DOMAINS="${DOMAINS:-fastgpt.stonelan.cn gitea.stonelan.cn image.stonelan.cn registry.stonelan.cn www.stonelan.cn}"
|
||
|
||
if [ -f "$CERT_FULL" ]; then
|
||
for d in $DOMAINS; do
|
||
src="ssl.d.available/$d.conf"
|
||
if [ -f "$src" ]; then
|
||
sudo cp "$src" "/etc/nginx/ssl.d/$d.conf"
|
||
echo "已启用 $d"
|
||
else
|
||
echo "跳过 $d：缺少 $src"
|
||
fi
|
||
done
|
||
else
|
||
echo "证书尚未生成（$CERT_FULL），跳过 HTTPS 配置"
|
||
fi
|
||
|
||
# 测试并重载配置
|
||
if sudo nginx -t; then
|
||
if sudo systemctl is-active --quiet nginx; then
|
||
sudo systemctl reload nginx
|
||
echo "配置已重载"
|
||
else
|
||
sudo systemctl start nginx
|
||
echo "nginx 已启动"
|
||
fi
|
||
else
|
||
echo "配置测试失败，已恢复备份"
|
||
sudo cp /etc/nginx/nginx.conf.bak /etc/nginx/nginx.conf
|
||
for conf in conf.d/*.conf; do
|
||
filename=$(basename "$conf")
|
||
sudo mv -f "/etc/nginx/conf.d/${filename}.bak" "/etc/nginx/conf.d/$filename" 2>/dev/null || true
|
||
done
|
||
exit 1
|
||
fi
|