gentpan
480a7b551d
- server/sync：Go 写的同步服务（GitHub / Google / Apple 登录、PKCE、设置文档存 SQLite），附 systemd 单元、Caddy 片段、install.sh 部署到官网源站、configure.sh 填写各平台密钥 - server/geoip：configure.sh 填 MaxMind 账号与许可证；install.sh 的主机改为官网源站 - 官网新增隐私说明页，首页补隐私条目与 ⌘ 拖动排序的常见问题；部署与发布脚本的默认主机改为 51.38.126.148
69 lines
3.1 KiB
Bash
Executable File
69 lines
3.1 KiB
Bash
Executable File
#!/bin/bash
|
||
# 把各登录方式的 Client ID / Secret 写到服务器的 /etc/openstats/sync.env 并重启同步服务。
|
||
# 值在本机终端里输入（Secret 不回显），只经 ssh 传到服务器，不进仓库、不进日志。
|
||
# 留空表示保持服务器上现有的值不变。
|
||
#
|
||
# ./server/sync/configure.sh
|
||
set -euo pipefail
|
||
HOST="${SITE_HOST:-debian@51.38.126.148}"
|
||
KEY="${SITE_KEY:-$HOME/.ssh/gentpan.pem}"
|
||
SSH=(ssh -i "$KEY" -o BatchMode=yes "$HOST")
|
||
|
||
ask() { # ask 变量名 提示
|
||
local value; read -r -p "$2（留空跳过）: " value; printf -v "$1" '%s' "$value"
|
||
}
|
||
ask_secret() { # 不回显
|
||
local value; read -r -s -p "$2（留空跳过）: " value; echo; printf -v "$1" '%s' "$value"
|
||
}
|
||
|
||
echo "写入 $HOST:/etc/openstats/sync.env"
|
||
ask GITHUB_CLIENT_ID "GitHub Client ID"
|
||
ask_secret GITHUB_CLIENT_SECRET "GitHub Client Secret"
|
||
ask GOOGLE_CLIENT_ID "Google Client ID"
|
||
ask_secret GOOGLE_CLIENT_SECRET "Google Client Secret"
|
||
ask APPLE_CLIENT_ID "Apple Services ID（例如 com.openstats.web）"
|
||
ask APPLE_TEAM_ID "Apple Team ID"
|
||
ask APPLE_KEY_ID "Apple Key ID"
|
||
ask APPLE_P8 "Apple .p8 文件的本机路径"
|
||
|
||
APPLE_PRIVATE_KEY_FILE=""
|
||
if [ -n "$APPLE_P8" ]; then
|
||
[ -r "$APPLE_P8" ] || { echo "读不到 $APPLE_P8" >&2; exit 1; }
|
||
scp -i "$KEY" -o BatchMode=yes "$APPLE_P8" "$HOST:/tmp/apple-signin.p8"
|
||
"${SSH[@]}" 'sudo install -m 640 -o root -g openstats-sync /tmp/apple-signin.p8 /etc/openstats/apple-signin.p8 && rm -f /tmp/apple-signin.p8'
|
||
APPLE_PRIVATE_KEY_FILE=/etc/openstats/apple-signin.p8
|
||
fi
|
||
export GITHUB_CLIENT_ID GITHUB_CLIENT_SECRET GOOGLE_CLIENT_ID GOOGLE_CLIENT_SECRET \
|
||
APPLE_CLIENT_ID APPLE_TEAM_ID APPLE_KEY_ID APPLE_PRIVATE_KEY_FILE
|
||
|
||
# 本机 python 把要改的键值编成一段远端 python（repr 保证转义），经标准输入交给服务器执行；
|
||
# 有值的键覆盖，没值的保留，不出现在任何命令行参数里
|
||
python3 - <<'PYEOF' | "${SSH[@]}" 'sudo python3 -'
|
||
import os
|
||
keys = ["GITHUB_CLIENT_ID", "GITHUB_CLIENT_SECRET", "GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET",
|
||
"APPLE_CLIENT_ID", "APPLE_TEAM_ID", "APPLE_KEY_ID", "APPLE_PRIVATE_KEY_FILE"]
|
||
updates = {k: os.environ[k] for k in keys if os.environ.get(k)}
|
||
print("""import os, re
|
||
path = "/etc/openstats/sync.env"
|
||
updates = %r
|
||
text = open(path).read() if os.path.exists(path) else ""
|
||
lines = text.split("\\n")
|
||
seen = set()
|
||
for i, line in enumerate(lines):
|
||
m = re.match(r"^([A-Z_]+)=", line)
|
||
if m and m.group(1) in updates:
|
||
lines[i] = m.group(1) + "=" + updates[m.group(1)]
|
||
seen.add(m.group(1))
|
||
for k, v in updates.items():
|
||
if k not in seen:
|
||
lines.append(k + "=" + v)
|
||
tmp = path + ".new"
|
||
with open(tmp, "w") as f:
|
||
f.write("\\n".join(lines).rstrip("\\n") + "\\n")
|
||
os.chmod(tmp, 0o640)
|
||
os.replace(tmp, path)
|
||
print("已更新", ", ".join(sorted(updates)) if updates else "（没有改动）")
|
||
""" % (updates,))
|
||
PYEOF
|
||
"${SSH[@]}" 'sudo chgrp openstats-sync /etc/openstats/sync.env && sudo chmod 640 /etc/openstats/sync.env && sudo systemctl restart openstats-sync && sleep 1 && curl -s http://127.0.0.1:8787/api/v1/auth/providers && echo'
|