okooooooo/clover-mail
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
clover-mail/scripts/upgrade.sh
T

333 lines
14 KiB
Bash
Executable File
Raw Permalink Blame History

#!/usr/bin/env bash
# =============================================================================
# clover 升级脚本（VPS 宿主机）
#
# ./scripts/upgrade.sh # 拉代码 + 拉镜像 + 重建面板 + 重启 + 健康检查
# ./scripts/upgrade.sh --no-pull # 跳过 git pull（只更新镜像）
#
# 数据安全：SQLite 迁移在面板启动时自动执行（幂等）；升级前可选自动备份。
# =============================================================================
set -euo pipefail
cd "$(dirname "$0")/.."
NO_PULL=0
[ "${1:-}" = "--no-pull" ] && NO_PULL=1
log() { printf '\033[1;32m[upgrade]\033[0m %s\n' "$*"; }
warn() { printf '\033[1;33m[upgrade]\033[0m %s\n' "$*"; }
UPGRADE_TMP=""
cleanup_upgrade_tmp() {
[ -z "$UPGRADE_TMP" ] || rm -rf -- "$UPGRADE_TMP"
}
trap cleanup_upgrade_tmp EXIT
update_from_archive() {
local repo="${CLOVER_REPO:-Vincentkeio/clover-mail}"
local ref="${CLOVER_REF:-main}"
local tmp src item deploy_item name url revision
UPGRADE_TMP="$(mktemp -d)"
tmp="$UPGRADE_TMP"
# Resolve once, then download that exact commit so version checks describe
# the files installed even if the branch advances during the download.
local auth_args=()
[ -z "${CLOVER_TOKEN:-}" ] || auth_args=(-H "Authorization: Bearer ${CLOVER_TOKEN}")
curl -fsSL --max-time 30 "${auth_args[@]}" \
"https://api.github.com/repos/${repo}/commits/${ref}" -o "${tmp}/revision.json"
revision="$(sed -nE '/"sha"[[:space:]]*:/ { s/.*"sha"[[:space:]]*:[[:space:]]*"([0-9a-f]{40})".*/\1/p; q; }' "${tmp}/revision.json")"
[[ "$revision" =~ ^[0-9a-f]{40}$ ]] || { echo '无法确认源码版本；当前服务未重建。' >&2; return 1; }
url="https://codeload.github.com/${repo}/tar.gz/${revision}"
if [ -n "${CLOVER_TOKEN:-}" ]; then
curl -fsSL --max-time 180 -H "Authorization: Bearer ${CLOVER_TOKEN}" \
"https://api.github.com/repos/${repo}/tarball/${revision}" -o "${tmp}/clover.tar.gz" \
|| { echo "代码下载失败（请检查仓库、分支和 CLOVER_TOKEN）；当前服务未重建。" >&2; return 1; }
else
curl -fsSL --max-time 120 "$url" -o "${tmp}/clover.tar.gz" \
|| { echo "代码下载失败（请检查网络、仓库和分支）；当前服务未重建。" >&2; return 1; }
fi
mkdir -p "${tmp}/source"
tar -xzf "${tmp}/clover.tar.gz" -C "${tmp}/source"
src="$(find "${tmp}/source" -mindepth 1 -maxdepth 1 -type d -print -quit)"
[ -n "$src" ] && [ -f "$src/compose.yaml" ] && [ -f "$src/scripts/upgrade.sh" ] \
&& [ -f "$src/scripts/maintenance.sh" ] \
|| { echo "下载的源码包不完整；当前服务未重建。" >&2; return 1; }
log "非 Git 安装 → 使用 GitHub ${repo}@${ref} 更新源码"
shopt -s dotglob nullglob
for item in "$src"/*; do
name="$(basename "$item")"
case "$name" in
.env|.env.bak.*|.env.before-*|backups) continue ;;
.env.*)
if [ "$name" != .env.example ]; then continue; fi
rm -f "$name"
cp -a "$item" .
;;
deploy)
mkdir -p deploy
for deploy_item in "$src/deploy"/*; do
name="$(basename "$deploy_item")"
[ "$name" = acme ] && continue
rm -rf "deploy/$name"
cp -a "$deploy_item" deploy/
done
;;
*)
rm -rf "$name"
cp -a "$item" .
;;
esac
done
shopt -u dotglob nullglob
[ -z "$revision" ] || printf '%s\n' "$revision" > .clover-source-revision
rm -rf -- "$UPGRADE_TMP"
UPGRADE_TMP=""
log "源码更新完成（.env、备份、deploy/acme 证书目录和 Docker 数据卷均保留）"
}
if [ -f .env ]; then
# shellcheck disable=SC1091
set -a; . ./.env; set +a
fi
# Manual upgrade entry point; bootstrap.sh handles install/overwrite choices separately.
port_in_use() {
ss -ltn 2>/dev/null | awk '{print $4}' | grep -qE "[:.]${1}$"
}
set_env() {
if grep -q "^$1=" .env; then
sed -i "s|^$1=.*|$1=$2|" .env
else
printf '%s=%s\n' "$1" "$2" >> .env
fi
}
if [ -f .env ] && [ "${CLOVER_SHARED_CADDY:-0}" != "1" ] \
&& { port_in_use 80 || port_in_use 443; } \
&& command -v python3 >/dev/null 2>&1; then
host_caddy="$(python3 scripts/host-caddy.py detect 2>/dev/null || true)"
if [ -n "$host_caddy" ]; then
CLOVER_HOST_CADDY_CONFIG="${host_caddy%%|*}"
CLOVER_HOST_CADDY_BIN="${host_caddy#*|}"
: "${CLOVER_HTTP_PORT:=18080}"
: "${CLOVER_HTTPS_PORT:=18443}"
[ "$CLOVER_HTTP_PORT" != 80 ] || CLOVER_HTTP_PORT=18080
[ "$CLOVER_HTTPS_PORT" != 443 ] || CLOVER_HTTPS_PORT=18443
CLOVER_SHARED_CADDY=1
CLOVER_SHARED_NGINX=0
CLOVER_CADDY_SCHEME=http
CLOVER_CADDY_HTTP_PUBLISH="127.0.0.1:${CLOVER_HTTP_PORT}"
CLOVER_CADDY_HTTPS_PUBLISH="127.0.0.1:${CLOVER_HTTPS_PORT}"
CLOVER_HOME="$(pwd)"
CLOVER_TLS_DIRECTIVE=
log "检测到宿主机 Caddy，修复共享入口配置（保留现有站点）"
set_env CLOVER_HTTP_PORT "$CLOVER_HTTP_PORT"
set_env CLOVER_HTTPS_PORT "$CLOVER_HTTPS_PORT"
set_env CLOVER_SHARED_CADDY "$CLOVER_SHARED_CADDY"
set_env CLOVER_SHARED_NGINX "$CLOVER_SHARED_NGINX"
set_env CLOVER_HOST_CADDY_CONFIG "$CLOVER_HOST_CADDY_CONFIG"
set_env CLOVER_HOST_CADDY_BIN "$CLOVER_HOST_CADDY_BIN"
set_env CLOVER_CADDY_SCHEME "$CLOVER_CADDY_SCHEME"
set_env CLOVER_CADDY_HTTP_PUBLISH "$CLOVER_CADDY_HTTP_PUBLISH"
set_env CLOVER_CADDY_HTTPS_PUBLISH "$CLOVER_CADDY_HTTPS_PUBLISH"
set_env CLOVER_HOME "$CLOVER_HOME"
set_env CLOVER_TLS_DIRECTIVE "$CLOVER_TLS_DIRECTIVE"
chmod 600 .env
fi
fi
if { port_in_use 80 || port_in_use 443; } && command -v systemctl >/dev/null 2>&1 \
&& systemctl is-active --quiet nginx; then
nginx_80=0; nginx_443=0
ss -H -ltnp 'sport = :80' 2>/dev/null | grep -q nginx && nginx_80=1 || true
ss -H -ltnp 'sport = :443' 2>/dev/null | grep -q nginx && nginx_443=1 || true
if { ! port_in_use 80 || [ "$nginx_80" -eq 1 ]; } \
&& { ! port_in_use 443 || [ "$nginx_443" -eq 1 ]; }; then
log "检测到宿主机 nginx，修复共享入口配置（Caddy 内部监听；证书签发会短暂停 nginx）"
: "${CLOVER_HTTP_PORT:=18080}"
: "${CLOVER_HTTPS_PORT:=18443}"
[ "$CLOVER_HTTP_PORT" != 80 ] || CLOVER_HTTP_PORT=18080
[ "$CLOVER_HTTPS_PORT" != 443 ] || CLOVER_HTTPS_PORT=18443
CLOVER_SHARED_NGINX=1
CLOVER_CADDY_SCHEME=http
CLOVER_CADDY_HTTP_PUBLISH="127.0.0.1:${CLOVER_HTTP_PORT}"
CLOVER_CADDY_HTTPS_PUBLISH="127.0.0.1:${CLOVER_HTTPS_PORT}"
CLOVER_HOME="$(pwd)"
CLOVER_TLS_DIRECTIVE=
set_env CLOVER_HTTP_PORT "$CLOVER_HTTP_PORT"
set_env CLOVER_HTTPS_PORT "$CLOVER_HTTPS_PORT"
set_env CLOVER_SHARED_NGINX "$CLOVER_SHARED_NGINX"
set_env CLOVER_CADDY_SCHEME "$CLOVER_CADDY_SCHEME"
set_env CLOVER_CADDY_HTTP_PUBLISH "$CLOVER_CADDY_HTTP_PUBLISH"
set_env CLOVER_CADDY_HTTPS_PUBLISH "$CLOVER_CADDY_HTTPS_PUBLISH"
set_env CLOVER_HOME "$CLOVER_HOME"
set_env CLOVER_TLS_DIRECTIVE "$CLOVER_TLS_DIRECTIVE"
chmod 600 .env
fi
fi
# 1) 升级前备份（有脚本就备份，失败不阻断但明确告警）
if [ -f scripts/backup.sh ] && [ -n "${RECONCILE_TOKEN:-}" ]; then
log "升级前备份…"
if ! bash scripts/backup.sh; then
warn "备份失败！继续升级前请确认可接受（Ctrl+C 中止）"
sleep 5
fi
else
warn "跳过备份（缺少 RECONCILE_TOKEN 或 backup.sh 不可执行）"
fi
# 2) 代码
if [ "${NO_PULL}" -eq 0 ]; then
if [ -d .git ]; then
if ! git diff --quiet || ! git diff --cached --quiet; then
STASH_LABEL="clover-upgrade-before-update-$(date +%Y%m%d-%H%M%S)"
log "将服务器本地代码改动保存到 Git stash：${STASH_LABEL}"
git stash push -m "${STASH_LABEL}"
fi
log "拉取仓库代码…"
git pull --rebase || {
echo "代码更新失败；本地代码改动仍保留在 Git stash 中。请检查 git status 与 git stash list 后重试。" >&2
exit 1
}
git rev-parse HEAD > .clover-source-revision
else
update_from_archive
fi
fi
# The maintenance entry point is mounted into the dashboard's docker:cli job.
# Keep it in the same source refresh as this upgrade script so the next job uses
# the matching implementation instead of a stale host copy.
[ -f scripts/maintenance.sh ] || {
echo "源码更新不完整：缺少 scripts/maintenance.sh；当前服务未重建。" >&2
exit 1
}
log "维护脚本已同步：scripts/maintenance.sh"
# A previous version may not have installed the `clover` command yet.
if [ -x scripts/install-cli.sh ]; then
bash scripts/install-cli.sh "$(pwd)" || warn "快捷命令安装未完成；服务升级继续，可稍后手动运行 bash scripts/install-cli.sh"
fi
bash scripts/ensure-roundcube-env.sh
export ROUNDCUBE_SSO_SECRET="$(sed -n 's/^ROUNDCUBE_SSO_SECRET=//p' .env)"
# 3) 拉取正式发布镜像并重启面板。
# 安装目录可能带有 panel/ 源码（例如 bootstrap 解压的 GitHub 源码包），
# 普通升级仍必须使用 GHCR 发布镜像，避免在 VPS 上本地 npm ci 耗尽磁盘。
COMPOSE_FILES=(-f compose.yaml)
PANEL_PUBLISH_REVISION=""
wait_for_panel_publish() {
local revision repo payload count status conclusion attempt commit_payload
revision="$(cat .clover-source-revision 2>/dev/null || true)"
[[ "$revision" =~ ^[0-9a-f]{40}$ ]] || return 0
repo="${CLOVER_REPO:-Vincentkeio/clover-mail}"
local auth_args=()
[ -z "${CLOVER_TOKEN:-}" ] || auth_args=(-H "Authorization: Bearer ${CLOVER_TOKEN}")
for attempt in $(seq 1 36); do
payload="$(curl -fsSL --max-time 15 "${auth_args[@]}" \
"https://api.github.com/repos/${repo}/actions/workflows/publish-panel.yml/runs?head_sha=${revision}&per_page=1")" \
|| { echo '无法查询面板镜像发布状态；为避免使用旧镜像，更新已停止。' >&2; return 1; }
count="$(printf '%s' "$payload" | grep -oE '"total_count"[[:space:]]*:[[:space:]]*[0-9]+' | head -n 1 | grep -oE '[0-9]+$' || true)"
[ -n "$count" ] || { echo '无法解析面板镜像发布状态；更新已停止。' >&2; return 1; }
if [ "$count" = 0 ]; then
if [ "$attempt" -lt 4 ]; then
[ "$attempt" -eq 1 ] && log '正在确认对应的面板镜像构建任务…'
sleep 10
continue
fi
commit_payload="$(curl -fsSL --max-time 15 "${auth_args[@]}" \
"https://api.github.com/repos/${repo}/commits/${revision}")" \
|| { echo '无法确认本次源码变更范围；为避免使用旧镜像，更新已停止。' >&2; return 1; }
if printf '%s' "$commit_payload" | grep -qE '"filename"[[:space:]]*:[[:space:]]*"(panel/|\.github/workflows/publish-panel\.yml)'; then
echo '本次源码包含面板变更，但镜像构建任务尚未出现；更新已停止，请稍后重试。' >&2
return 1
fi
log "本次源码提交没有触发面板镜像发布，继续使用最新已发布镜像。"
return 0
fi
status="$(printf '%s' "$payload" | grep -oE '"status"[[:space:]]*:[[:space:]]*"[^"]+"' | head -n 1 | sed -E 's/.*"([^"]+)"$/\1/' || true)"
conclusion="$(printf '%s' "$payload" | grep -oE '"conclusion"[[:space:]]*:[[:space:]]*"[^"]+"' | head -n 1 | sed -E 's/.*"([^"]+)"$/\1/' || true)"
if [ "$status" = completed ]; then
[ "$conclusion" = success ] || { echo "面板镜像发布失败（${conclusion:-未知状态}）；更新已停止。" >&2; return 1; }
PANEL_PUBLISH_REVISION="$revision"
return 0
fi
[ "$attempt" -eq 1 ] && log '面板镜像仍在发布，等待对应版本完成…'
sleep 10
done
echo '等待面板镜像发布超时；更新已停止，稍后重试。' >&2
return 1
}
if [ "${CLOVER_UPDATE_TO_LATEST:-0}" = 1 ]; then
set_env CLOVER_TAG latest
export CLOVER_TAG=latest
fi
wait_for_panel_publish
log "拉取 GHCR 面板镜像及邮件/Caddy 镜像…"
for attempt in $(seq 1 6); do
docker compose "${COMPOSE_FILES[@]}" pull panel || {
echo "面板镜像拉取失败；未重建或重启面板。" >&2
exit 1
}
[ -z "$PANEL_PUBLISH_REVISION" ] && break
panel_image="${CLOVER_PANEL_IMAGE:-ghcr.io/vincentkeio/clover-panel}:${CLOVER_TAG:-latest}"
image_revision="$(docker image inspect "$panel_image" --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' 2>/dev/null || true)"
[ "$image_revision" = "$PANEL_PUBLISH_REVISION" ] && break
[ "$attempt" -eq 6 ] && { echo '镜像仓库仍返回旧版面板镜像；当前服务未重建，请稍后重试。' >&2; exit 1; }
log '镜像仓库尚未同步到本次源码版本，稍后重试拉取…'
sleep 10
done
docker compose "${COMPOSE_FILES[@]}" pull mail caddy roundcube || {
echo "发布镜像拉取失败；未重建或重启面板。请检查 GHCR 网络后重试。" >&2
exit 1
}
log "重启面板（使用已发布镜像，不在 VPS 本地构建）…"
docker compose "${COMPOSE_FILES[@]}" up -d --no-build panel
log "重启其余服务（应用新镜像）…"
docker compose build certificate-helper
docker compose up -d certificate-helper
docker compose "${COMPOSE_FILES[@]}" up -d --no-build
if [ "${CLOVER_SHARED_NGINX:-0}" = "1" ] || [ "${CLOVER_SHARED_CADDY:-0}" = "1" ] || [ "${CLOVER_CADDY_SCHEME:-https}" = "http" ]; then
if [ "${CLOVER_SHARED_CADDY:-0}" = "1" ]; then
log "配置宿主机 Caddy 反代并检查面板证书…"
else
log "申请/续签面板证书并启用 nginx 反代…"
fi
docker exec clover-certificate-helper python3 /app/certificates.py issue --force
fi
# 4) 健康检查（在面板容器内 fetch，不依赖 DNS/证书）
log "等待面板健康检查（最多 60s）…"
ok=0
for i in $(seq 1 30); do
if docker exec clover-panel node -e "fetch('http://127.0.0.1:3000/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))" >/dev/null 2>&1; then
ok=1; break
fi
sleep 2
done
if [ "${ok}" -eq 1 ]; then
# Refresh configuration/plugin directory mounts after archive replacement.
docker compose "${COMPOSE_FILES[@]}" up -d --no-deps --no-build --force-recreate roundcube
bash scripts/configure-roundcube.sh
# Archive updates can replace the mounted directory itself. Recreate the
# gateway so both Git and archive upgrades use the current host files.
docker compose "${COMPOSE_FILES[@]}" up -d --no-deps --no-build --force-recreate caddy
rm -f .clover-local-build
log "升级完成，面板与 Roundcube 免密连接已就绪。查看状态：docker compose ps"
log "迁移日志：docker logs clover-panel | grep migrations"
else
warn "面板健康检查未通过！查看日志：docker logs --tail 100 clover-panel"
exit 1
fi
Reference in new issue View Git Blame Copy Permalink