john
229805a070
Add WeChat service account routing with sync acks, connectivity tests, and context isolation; document deploy runbooks; and bundle related MindSpace, voice, Plaza, and server gateway changes for production rollout. Co-authored-by: Cursor <cursoragent@cursor.com>
98 lines
3.5 KiB
Bash
Executable File
98 lines
3.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# g2.tkmind.cn：Let's Encrypt + 阿里云 DNS-01，供 Caddy :8444 使用
|
||
#
|
||
# 前置（阿里云控制台）：
|
||
# 1. 云解析 DNS 添加域名 tkmind.cn，NS 改到阿里云（见脚本末尾说明）
|
||
# 2. 添加 A 记录：g2 -> 58.38.22.103
|
||
# 3. RAM 创建 AccessKey，权限 AliyunDNSFullAccess
|
||
# 4. cp scripts/g2-aliyun-cert.env.example scripts/g2-aliyun-cert.env 并填入密钥
|
||
#
|
||
# 用法：
|
||
# ./scripts/install-g2-aliyun-cert.sh
|
||
set -euo pipefail
|
||
|
||
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||
ENV_FILE="${ROOT}/scripts/g2-aliyun-cert.env"
|
||
CADDYFILE="${ROOT}/scripts/g2-lb.Caddyfile"
|
||
CADDY="/opt/homebrew/bin/caddy"
|
||
ACME="${HOME}/.acme.sh/acme.sh"
|
||
CERT_DIR="${HOME}/Downloads/g2.tkmind.cn-certs"
|
||
DOMAIN="${G2_DOMAIN:-g2.tkmind.cn}"
|
||
GUI="gui/$(id -u)"
|
||
|
||
die() { echo "错误: $*" >&2; exit 1; }
|
||
|
||
[[ -f "$ENV_FILE" ]] || die "请先创建 ${ENV_FILE}（参考 g2-aliyun-cert.env.example）"
|
||
# shellcheck disable=SC1090
|
||
source "$ENV_FILE"
|
||
[[ -n "${Ali_Key:-}" && "${Ali_Key}" != YOUR_* ]] || die "请在 ${ENV_FILE} 填入 Ali_Key"
|
||
[[ -n "${Ali_Secret:-}" && "${Ali_Secret}" != YOUR_* ]] || die "请在 ${ENV_FILE} 填入 Ali_Secret"
|
||
DOMAIN="${G2_DOMAIN:-g2.tkmind.cn}"
|
||
|
||
[[ -x "$ACME" ]] || die "未找到 acme.sh，请先安装: curl https://get.acme.sh | sh"
|
||
|
||
export Ali_Key Ali_Secret
|
||
|
||
echo "==> 签发证书（DNS-01 / 阿里云）: ${DOMAIN}"
|
||
"$ACME" --set-default-ca --server letsencrypt
|
||
"$ACME" --issue --dns dns_ali -d "$DOMAIN" --keylength ec-256
|
||
|
||
CERT_HOME="${HOME}/.acme.sh/${DOMAIN}_ecc"
|
||
[[ -d "${HOME}/.acme.sh/${DOMAIN}_ecc" ]] && CERT_HOME="${HOME}/.acme.sh/${DOMAIN}_ecc"
|
||
[[ -d "${HOME}/.acme.sh/${DOMAIN}" ]] && CERT_HOME="${HOME}/.acme.sh/${DOMAIN}"
|
||
[[ -f "${CERT_HOME}/fullchain.cer" ]] || die "证书签发失败，请检查阿里云 DNS 权限与域名是否在云解析"
|
||
|
||
echo "==> 配置 Caddy 使用证书"
|
||
cp "$CADDYFILE" "${CADDYFILE}.bak-$(date +%Y%m%d-%H%M%S)"
|
||
|
||
python3 <<PY
|
||
from pathlib import Path
|
||
path = Path("${CADDYFILE}")
|
||
text = path.read_text()
|
||
cert = "${CERT_HOME}/fullchain.cer"
|
||
key = "${CERT_HOME}/${DOMAIN}.key"
|
||
block = f'''# g2.tkmind.cn：公网入口转发到 Studio 本机 H5 (:8081)
|
||
{DOMAIN} {{
|
||
\ttls {cert} {key}
|
||
|
||
\treverse_proxy 127.0.0.1:8081 {{'''
|
||
import re
|
||
text = re.sub(
|
||
r'# g2\.tkmind\.cn：.*?\n' + re.escape("${DOMAIN}") + r' \{.*?\n\treverse_proxy 127\.0\.0\.1:8081 \{',
|
||
block,
|
||
text,
|
||
count=1,
|
||
flags=re.DOTALL,
|
||
)
|
||
path.write_text(text)
|
||
PY
|
||
|
||
"$CADDY" validate --config "$CADDYFILE"
|
||
|
||
echo "==> 安装续期后自动 reload Caddy"
|
||
RELOAD="launchctl kickstart -k ${GUI}/cn.tkmind.g2-lb"
|
||
"$ACME" --install-cert -d "$DOMAIN" \
|
||
--reloadcmd "$RELOAD"
|
||
|
||
launchctl kickstart -k "${GUI}/cn.tkmind.g2-lb" 2>/dev/null || true
|
||
sleep 2
|
||
|
||
mkdir -p "$CERT_DIR"
|
||
cp "${CERT_HOME}/fullchain.cer" "${CERT_DIR}/fullchain.pem"
|
||
cp "${CERT_HOME}/${DOMAIN}.key" "${CERT_DIR}/${DOMAIN}.key"
|
||
cp "${CERT_HOME}/fullchain.cer" "${CERT_DIR}/g2.tkmind.cn.crt"
|
||
openssl x509 -in "${CERT_DIR}/fullchain.pem" -noout -subject -issuer -dates
|
||
|
||
echo ""
|
||
echo "==> 完成"
|
||
echo " 证书: ${CERT_HOME}/"
|
||
echo " 导出: ${CERT_DIR}/"
|
||
echo " 验证: curl -s https://${DOMAIN}/api/status"
|
||
echo ""
|
||
echo "==> 阿里云 DNS 迁移检查清单"
|
||
echo " 1. 云解析 DNS 已添加 tkmind.cn"
|
||
echo " 2. 域名注册商 NS 已改为阿里云（例如 vip1.alidns.com / vip2.alidns.com）"
|
||
echo " 3. A 记录 g2 -> ${G2_PUBLIC_IP:-58.38.22.103}"
|
||
echo " 4. 删除 Cloudflare 上 g2 的 CNAME/代理记录，避免冲突"
|
||
echo " 5. dig @223.5.5.5 +short ${DOMAIN} A 应返回 ${G2_PUBLIC_IP:-58.38.22.103}"
|