114 lines
5.2 KiB
Bash
Executable File
114 lines
5.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Run from an operator machine that can SSH to both hw.imruyi.top and aihost.
|
|
# No secrets are embedded; the script uses existing server-side Docker/env state.
|
|
|
|
HW_HOST="${HW_HOST:-hw.imruyi.top}"
|
|
AIHOST_HOST="${AIHOST_HOST:-aihost}"
|
|
PRIMARY_AUTH="${PRIMARY_AUTH:-https://auth.cnnetmkt.top}"
|
|
PRIMARY_ENTRY="${PRIMARY_ENTRY:-https://cnnetmkt.top}"
|
|
UCC_DEPLOY_DIR="${UCC_DEPLOY_DIR:-/data/aios/aios_r13_v18_runtime_portable_silent_20260704/components/user-control-center/deploy}"
|
|
|
|
printf '== update Casdoor application on %s ==\n' "$AIHOST_HOST"
|
|
ssh "$AIHOST_HOST" bash -s <<'AIHOST'
|
|
set -euo pipefail
|
|
TS=$(date -u +%Y%m%dT%H%M%SZ)
|
|
BACKUP_DIR="/data/aios/backups/casdoor-cnnetmkt-primary-$TS"
|
|
sudo mkdir -p "$BACKUP_DIR"
|
|
sudo chown "$USER":"$USER" "$BACKUP_DIR"
|
|
docker exec casdoor-postgres pg_dump -U casdoor -d casdoor -t application > "$BACKUP_DIR/application-before.sql"
|
|
docker exec -i casdoor-postgres psql -U casdoor -d casdoor -v ON_ERROR_STOP=1 <<'SQL'
|
|
UPDATE application
|
|
SET
|
|
homepage_url = 'https://cnnetmkt.top/',
|
|
signin_url = 'https://cnnetmkt.top/portal/login/',
|
|
signup_url = 'https://cnnetmkt.top/portal/register/',
|
|
redirect_uris = '["https://cnnetmkt.top/api/auth/callback/casdoor", "https://cnnetmkt.top/casdoor/callback/", "https://portal.cnnetmkt.top/api/auth/callback/casdoor", "https://portal.cnnetmkt.top/casdoor/callback/", "https://user.cnnetmkt.top/api/auth/callback/casdoor", "https://user.cnnetmkt.top/casdoor/callback/", "https://portal.h.imruyi.top:8443/api/auth/callback/casdoor", "https://portal.h.imruyi.top:8443/casdoor/callback/"]'
|
|
WHERE owner = 'admin' AND name = 'aios-portal';
|
|
SQL
|
|
docker exec casdoor-postgres psql -U casdoor -d casdoor -P pager=off -c "select owner,name,homepage_url,signin_url,signup_url,redirect_uris from application where owner='admin' and name='aios-portal';" > "$BACKUP_DIR/application-after.txt"
|
|
cat "$BACKUP_DIR/application-after.txt"
|
|
printf 'casdoor_backup_dir=%s\n' "$BACKUP_DIR"
|
|
AIHOST
|
|
|
|
printf '\n== update HW ingress and UCC runtime on %s ==\n' "$HW_HOST"
|
|
ssh "$HW_HOST" bash -s <<HW
|
|
set -euo pipefail
|
|
TS=\$(date -u +%Y%m%dT%H%M%SZ)
|
|
BACKUP_DIR="/data/aios-gitops/backups/auth-cnnetmkt-primary-\$TS"
|
|
ENV_FILE="$UCC_DEPLOY_DIR/.env"
|
|
NGINX_AUTH="/etc/nginx/sites-available/auth-cnnetmkt-casdoor.conf"
|
|
sudo mkdir -p "\$BACKUP_DIR"
|
|
sudo cp -a "\$ENV_FILE" "\$BACKUP_DIR/user-control.env.before"
|
|
sudo cp -a /etc/nginx/sites-available "\$BACKUP_DIR/nginx-sites-available.before"
|
|
|
|
set_env() {
|
|
local key="\$1" value="\$2"
|
|
if sudo grep -q "^\${key}=" "\$ENV_FILE"; then
|
|
sudo sed -i "s#^\${key}=.*#\${key}=\${value}#" "\$ENV_FILE"
|
|
else
|
|
printf '%s=%s\n' "\$key" "\$value" | sudo tee -a "\$ENV_FILE" >/dev/null
|
|
fi
|
|
}
|
|
|
|
set_env ALLOWED_HOSTS 'cnnetmkt.top,portal.cnnetmkt.top,user.cnnetmkt.top,auth.cnnetmkt.top,127.0.0.1,localhost,hw.imruyi.top,1.95.164.183,portal.h.imruyi.top'
|
|
set_env CSRF_TRUSTED_ORIGINS 'https://cnnetmkt.top,https://portal.cnnetmkt.top,https://user.cnnetmkt.top,https://auth.cnnetmkt.top,http://portal.cnnetmkt.top,http://hw.imruyi.top,http://1.95.164.183,https://portal.h.imruyi.top:8443,http://portal.h.imruyi.top,http://user.cnnetmkt.top'
|
|
set_env UCC_PUBLIC_BASE_URL '$PRIMARY_ENTRY'
|
|
set_env CASDOOR_PUBLIC_BASE_URL '$PRIMARY_AUTH'
|
|
set_env CASDOOR_INTERNAL_BASE_URL '$PRIMARY_AUTH'
|
|
set_env CASDOOR_INVITE_SYNC_BASE_URL '$PRIMARY_AUTH'
|
|
|
|
sudo tee "\$NGINX_AUTH" >/dev/null <<'NGINX'
|
|
# AIOS primary public Casdoor entry for cnnetmkt.top.
|
|
# The upstream remains the existing backup/home Casdoor service; public clients should see auth.cnnetmkt.top only.
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
server_name auth.cnnetmkt.top;
|
|
|
|
access_log /var/log/nginx/aios-auth-cnnetmkt.access.log;
|
|
error_log /var/log/nginx/aios-auth-cnnetmkt.error.log;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/cnnetmkt-wildcard/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/cnnetmkt-wildcard/privkey.pem;
|
|
include /etc/letsencrypt/options-ssl-nginx.conf;
|
|
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
|
|
|
location / {
|
|
proxy_pass https://auth.h.imruyi.top:8443;
|
|
proxy_http_version 1.1;
|
|
proxy_ssl_server_name on;
|
|
proxy_ssl_name auth.h.imruyi.top;
|
|
proxy_ssl_verify off;
|
|
proxy_set_header Host auth.h.imruyi.top;
|
|
proxy_set_header X-Real-IP \$remote_addr;
|
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Forwarded-Host \$host;
|
|
proxy_set_header X-Forwarded-Port 443;
|
|
proxy_set_header Upgrade \$http_upgrade;
|
|
proxy_set_header Connection \$connection_upgrade;
|
|
proxy_redirect https://auth.h.imruyi.top:8443/ https://auth.cnnetmkt.top/;
|
|
proxy_redirect https://auth.h.imruyi.top/ https://auth.cnnetmkt.top/;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name auth.cnnetmkt.top;
|
|
return 301 https://\$host\$request_uri;
|
|
}
|
|
NGINX
|
|
|
|
sudo ln -sf "\$NGINX_AUTH" /etc/nginx/sites-enabled/auth-cnnetmkt-casdoor.conf
|
|
sudo nginx -t
|
|
sudo systemctl reload nginx
|
|
cd "$UCC_DEPLOY_DIR"
|
|
sudo docker compose up -d --force-recreate user-control-web user-control-worker user-control-beat
|
|
printf 'hw_backup_dir=%s\n' "\$BACKUP_DIR"
|
|
HW
|
|
|
|
"$(dirname "$0")/check_cnnetmkt_auth_primary.sh"
|