name: 🇨🇳 阿里云落地页 · guanghulab.com 部署

# ═══════════════════════════════════════════════════════════
# 阿里云临时服务器 · 国内ICP备案落地页部署
# 编号: ALI-WF-CN-LANDING
# 服务器: ALI-SVR · 8.155.62.235 · 阿里云
# 守护: 铸渊 · ICE-GL-ZY001
# 版权: 国作登字-2026-A-00037559
# ═══════════════════════════════════════════════════════════
#
# 背景:
#   域名 guanghulab.com 在阿里云购买并备案。
#   备案迁移到腾讯云期间，域名解析回阿里云服务器。
#   此工作流将落地页部署到阿里云，确保备案期间网站正常显示。
#
# 部署内容:
#   1. 国内落地页 (server/sites/cn-landing/) → /opt/guanghulab-landing/sites/cn-landing/
#   2. Nginx 配置 (server/nginx/ali-cn-domain.conf) → Nginx sites-enabled
#
# 密钥:
#   ALI_SERVER_HOST — 阿里云服务器IP (8.155.62.235)
#   ALI_SERVER_USER — SSH用户名 (root)
#   ALI_SERVER_PASSWORD — SSH密码
#
# 连接策略: 直连 → 如失败 → 通过SG跳板中转
#   路径A: GitHub Actions → ALI (直连)
#   路径B: GitHub Actions → SG(新加坡·跳板) → ALI (中转)
#
# 隔离: 所有文件部署在 /opt/guanghulab-landing/ 下
#   不干扰服务器上已有的服务和配置

on:
  push:
    branches: [main]
    paths:
      - 'server/sites/cn-landing/**'
      - 'server/nginx/ali-cn-domain.conf'
  workflow_dispatch:
    inputs:
      action:
        description: '部署动作'
        required: true
        default: 'deploy'
        type: choice
        options:
          - deploy
          - health-check
          - setup-ssl

concurrency:
  group: ali-cn-landing-deploy
  cancel-in-progress: false

permissions:
  contents: read

env:
  DEPLOY_PATH: /opt/guanghulab-landing
  CN_DOMAIN: guanghulab.com

jobs:
  # ═══════════════════════════════════════
  # §1 部署落地页
  # ═══════════════════════════════════════
  deploy:
    name: 🚀 部署 guanghulab.com 到阿里云
    if: github.event.inputs.action == 'deploy' || github.event.inputs.action == '' || github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: 📦 安装SSH工具
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq sshpass
          echo "✅ sshpass 已安装"

      - name: 🔐 配置SSH连接 (双路径)
        env:
          ALI_HOST: ${{ secrets.ALI_SERVER_HOST }}
          ALI_USER: ${{ secrets.ALI_SERVER_USER }}
          ALI_PASS: ${{ secrets.ALI_SERVER_PASSWORD }}
          SG_SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
          SG_HOST: ${{ secrets.ZY_SERVER_HOST }}
          SG_USER: ${{ secrets.ZY_SERVER_USER }}
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh

          # ─── 路径A: 直连 ───
          echo "🔍 尝试直连阿里云服务器 ${ALI_HOST}..."
          export SSHPASS="${ALI_PASS}"

          DIRECT_OK=false
          sshpass -e ssh -o StrictHostKeyChecking=accept-new \
            -o ConnectTimeout=15 \
            -o BatchMode=no \
            "${ALI_USER}@${ALI_HOST}" \
            'echo "✅ 直连成功 · $(hostname) · $(date)"' 2>/dev/null && DIRECT_OK=true || true

          if [ "$DIRECT_OK" = "true" ]; then
            echo "SSH_MODE=direct" >> $GITHUB_ENV
            echo "✅ 使用直连模式"

            # 写入SSH config用于后续步骤
            cat > ~/.ssh/config << EOF
          Host ali-target
              HostName ${ALI_HOST}
              User ${ALI_USER}
              StrictHostKeyChecking accept-new
              ConnectTimeout 30
          EOF
          else
            echo "⚠️ 直连失败，尝试SG跳板中转..."

            # ─── 路径B: SG跳板中转 ───
            if [ -n "$SG_SSH_KEY" ] && [ -n "$SG_HOST" ]; then
              echo "$SG_SSH_KEY" > ~/.ssh/id_sg
              chmod 600 ~/.ssh/id_sg
              ssh-keyscan -H "${SG_HOST}" >> ~/.ssh/known_hosts 2>/dev/null

              cat > ~/.ssh/config << EOF
          Host sg-jump
              HostName ${SG_HOST}
              User ${SG_USER}
              IdentityFile ~/.ssh/id_sg
              StrictHostKeyChecking accept-new
              BatchMode yes

          Host ali-target
              HostName ${ALI_HOST}
              User ${ALI_USER}
              ProxyJump sg-jump
              StrictHostKeyChecking accept-new
              ConnectTimeout 30
          EOF

              # 测试SG跳板连接
              sshpass -e ssh -F ~/.ssh/config -o BatchMode=no ali-target \
                'echo "✅ SG跳板连接成功 · $(hostname) · $(date)"' || {
                echo "❌ SG跳板连接也失败"
                exit 1
              }

              echo "SSH_MODE=proxy" >> $GITHUB_ENV
              echo "✅ 使用SG跳板模式"
            else
              echo "❌ 直连失败且无SG跳板密钥可用"
              exit 1
            fi
          fi

          chmod 600 ~/.ssh/config

      - name: 📂 初始化目标目录
        env:
          SSHPASS: ${{ secrets.ALI_SERVER_PASSWORD }}
        run: |
          sshpass -e ssh -F ~/.ssh/config -o BatchMode=no ali-target << INIT_CMD
          set -e

          echo "═══ 初始化隔离部署目录 ═══"

          # 创建隔离的部署目录结构
          mkdir -p ${DEPLOY_PATH}/sites/cn-landing
          mkdir -p ${DEPLOY_PATH}/logs
          mkdir -p ${DEPLOY_PATH}/config/nginx

          echo "✅ 目录结构就绪: ${DEPLOY_PATH}/"
          ls -la ${DEPLOY_PATH}/

          # ─── 检查并开放防火墙端口 (80/443) ───
          echo ""
          echo "═══ 防火墙端口检查 ═══"
          if command -v firewall-cmd &> /dev/null && systemctl is-active --quiet firewalld; then
            echo "🔥 检测到 firewalld 运行中"
            # 开放HTTP/HTTPS端口
            if ! firewall-cmd --query-port=80/tcp --quiet 2>/dev/null; then
              firewall-cmd --permanent --add-port=80/tcp
              echo "  ✅ 已开放端口 80/tcp"
            else
              echo "  ✅ 端口 80/tcp 已开放"
            fi
            if ! firewall-cmd --query-port=443/tcp --quiet 2>/dev/null; then
              firewall-cmd --permanent --add-port=443/tcp
              echo "  ✅ 已开放端口 443/tcp"
            else
              echo "  ✅ 端口 443/tcp 已开放"
            fi
            # 也尝试添加http/https服务
            firewall-cmd --permanent --add-service=http 2>/dev/null || true
            firewall-cmd --permanent --add-service=https 2>/dev/null || true
            firewall-cmd --reload
            echo "  ✅ firewalld 规则已重载"
          elif command -v iptables &> /dev/null; then
            echo "🔥 检测到 iptables"
            # 检查并添加ACCEPT规则（先用-C检测是否已存在，避免重复）
            if ! iptables -C INPUT -p tcp --dport 80 -j ACCEPT 2>/dev/null; then
              iptables -I INPUT -p tcp --dport 80 -j ACCEPT
              echo "  ✅ 已添加 iptables 规则: 允许端口 80"
            else
              echo "  ✅ 端口 80 ACCEPT 规则已存在"
            fi
            if ! iptables -C INPUT -p tcp --dport 443 -j ACCEPT 2>/dev/null; then
              iptables -I INPUT -p tcp --dport 443 -j ACCEPT
              echo "  ✅ 已添加 iptables 规则: 允许端口 443"
            else
              echo "  ✅ 端口 443 ACCEPT 规则已存在"
            fi
            echo "  ✅ iptables 检查完成"
          else
            echo "ℹ️ 未检测到活跃防火墙"
          fi
          INIT_CMD

      - name: 📦 上传落地页文件
        env:
          SSHPASS: ${{ secrets.ALI_SERVER_PASSWORD }}
        run: |
          echo "📦 打包并上传落地页文件..."

          # 使用tar打包上传（兼容性最好）
          tar czf /tmp/cn-landing.tar.gz -C server/sites/cn-landing .

          sshpass -e scp -F ~/.ssh/config -o BatchMode=no \
            /tmp/cn-landing.tar.gz \
            ali-target:/tmp/cn-landing.tar.gz

          sshpass -e ssh -F ~/.ssh/config -o BatchMode=no ali-target << 'EXTRACT_CMD'
          set -e
          DEPLOY_PATH=/opt/guanghulab-landing

          # 备份旧文件（如果有）
          if [ -f "${DEPLOY_PATH}/sites/cn-landing/index.html" ]; then
            cp "${DEPLOY_PATH}/sites/cn-landing/index.html" "${DEPLOY_PATH}/sites/cn-landing/index.html.bak"
          fi

          # 解压新文件
          tar xzf /tmp/cn-landing.tar.gz -C ${DEPLOY_PATH}/sites/cn-landing/
          rm -f /tmp/cn-landing.tar.gz

          echo "✅ 落地页文件已部署"
          ls -la ${DEPLOY_PATH}/sites/cn-landing/
          EXTRACT_CMD

          rm -f /tmp/cn-landing.tar.gz

      - name: 📦 上传并配置Nginx
        env:
          SSHPASS: ${{ secrets.ALI_SERVER_PASSWORD }}
          ZY_CN_DOMAIN: ${{ secrets.ZY_CN_DOMAIN }}
        run: |
          # 处理域名占位符替换
          BARE_DOMAIN="${ZY_CN_DOMAIN:-guanghulab.com}"
          BARE_DOMAIN="${BARE_DOMAIN#www.}"
          echo "🌐 配置域名: ${BARE_DOMAIN}"

          # 替换域名占位符
          cp server/nginx/ali-cn-domain.conf /tmp/ali-cn-domain.conf
          sed -i "s/ALI_CN_DOMAIN_PLACEHOLDER/${BARE_DOMAIN}/g" /tmp/ali-cn-domain.conf

          # 上传Nginx配置模板（SSL占位符稍后在服务器上替换）
          sshpass -e scp -F ~/.ssh/config -o BatchMode=no \
            /tmp/ali-cn-domain.conf \
            ali-target:/tmp/ali-cn-domain.conf

          sshpass -e ssh -F ~/.ssh/config -o BatchMode=no ali-target << 'NGINX_CMD'
          set -e
          DEPLOY_PATH=/opt/guanghulab-landing
          BARE_DOMAIN=$(grep server_name /tmp/ali-cn-domain.conf 2>/dev/null | grep -v '#' | head -1 | awk '{print $2}' | sed 's/;//' || echo "guanghulab.com")

          echo "═══ Nginx 配置 · ${BARE_DOMAIN} 落地页 ═══"

          # §1 检查Nginx是否已安装
          if ! command -v nginx &> /dev/null; then
            echo "📦 安装Nginx..."
            if command -v apt-get &> /dev/null; then
              apt-get update -qq
              apt-get install -y -qq nginx
            elif command -v yum &> /dev/null; then
              yum install -y -q epel-release 2>/dev/null || true
              yum install -y -q nginx
            elif command -v dnf &> /dev/null; then
              dnf install -y -q nginx
            else
              echo "❌ 无法安装Nginx：未找到包管理器"
              exit 1
            fi
            systemctl enable nginx
            echo "✅ Nginx 已安装"
          else
            echo "✅ Nginx 已存在: $(nginx -v 2>&1)"
          fi

          # §2 智能选择配置目录
          CONF_DIR=""
          if grep -q "include.*sites-enabled" /etc/nginx/nginx.conf 2>/dev/null; then
            CONF_DIR="/etc/nginx/sites-enabled"
            mkdir -p /etc/nginx/sites-available 2>/dev/null || true
            mkdir -p /etc/nginx/sites-enabled 2>/dev/null || true
            echo "✅ 检测到 sites-enabled 模式"
          elif grep -q "include.*conf\.d" /etc/nginx/nginx.conf 2>/dev/null; then
            CONF_DIR="/etc/nginx/conf.d"
            echo "✅ 检测到 conf.d 模式 (CentOS/RHEL)"
          else
            CONF_DIR="/etc/nginx/conf.d"
            mkdir -p /etc/nginx/conf.d 2>/dev/null || true
            echo "⚠️ 未检测到明确的配置目录，使用 conf.d"
          fi
          echo "📁 配置部署目录: ${CONF_DIR}"

          # ═══════════════════════════════════════════════════
          # §2.5 全面清理冲突配置
          # 此服务器唯一用途: guanghulab.com 落地页
          # 必须移除所有其他server块，防止旧配置劫持流量
          # ═══════════════════════════════════════════════════
          echo ""
          echo "§2.5 全面清理冲突配置..."
          CONFLICT_FOUND=false

          # ─── A. 清理 conf.d 中所有非我们的 .conf 文件 ───
          for conf in /etc/nginx/conf.d/*.conf; do
            [ -f "$conf" ] || continue
            BASENAME=$(basename "$conf")
            [ "$BASENAME" = "guanghulab-landing.conf" ] && continue
            # 移除所有包含server块的配置（保留纯全局配置如gzip等）
            if grep -vE '^\s*#' "$conf" 2>/dev/null | grep -qE "server\s*\{|listen\s|server_name\s"; then
              echo "  🗑️ 移除conf.d冲突: $BASENAME"
              mv "$conf" "${conf}.disabled.by-landing"
              CONFLICT_FOUND=true
            fi
          done

          # ─── B. 清理 sites-enabled 中所有非我们的配置 ───
          if [ -d "/etc/nginx/sites-enabled" ]; then
            for conf in /etc/nginx/sites-enabled/*; do
              [ -f "$conf" ] || [ -L "$conf" ] || continue
              BASENAME=$(basename "$conf")
              [ "$BASENAME" = "guanghulab-landing.conf" ] && continue
              echo "  🗑️ 移除sites-enabled冲突: $BASENAME"
              rm -f "$conf"
              CONFLICT_FOUND=true
            done
          fi

          # ─── C. 中和 nginx.conf 内嵌的 default server 块 ───
          # CentOS/RHEL 默认nginx.conf通常包含一个内嵌的server块
          # 人类开发者手动部署可能使用了任意root路径
          # 必须用通用正则替换所有root指令，而非仅匹配已知路径
          echo ""
          echo "§C 诊断 nginx.conf 内嵌 server 块..."
          # 先显示nginx.conf中所有非注释的server和root行，用于诊断
          echo "  nginx.conf 中活跃的 server/root/listen 行:"
          grep -nE '^\s*(server\s*\{|root\s|listen\s|ssl_certificate)' /etc/nginx/nginx.conf 2>/dev/null | grep -vE '^\s*#' | head -20 || echo "    (无)"
          echo ""

          # 使用更宽松的匹配：检测server块中的listen或root关键词（不仅仅是 server {）
          HAS_EMBEDDED_SERVER=false
          if grep -vE '^\s*#' /etc/nginx/nginx.conf 2>/dev/null | grep -qE '^\s*server\s*\{'; then
            HAS_EMBEDDED_SERVER=true
          fi
          # 也检测root指令（即使server块格式不匹配正则）
          if grep -vE '^\s*#' /etc/nginx/nginx.conf 2>/dev/null | grep -qE '^\s*root\s+'; then
            HAS_EMBEDDED_SERVER=true
          fi

          if [ "$HAS_EMBEDDED_SERVER" = "true" ]; then
            echo "  ⚠️ 检测到 nginx.conf 内嵌 server 块或 root 指令"
            cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak.by-landing

            # 通用方案：替换 nginx.conf 中 ALL root 指令为落地页目录
            # 使用通用正则匹配任意路径（不再硬编码特定目录）
            sed -i 's|^\(\s*\)root\s\+[^;]*;|\1root /opt/guanghulab-landing/sites/cn-landing;|g' /etc/nginx/nginx.conf
            echo "  ✅ nginx.conf 中所有 root 指令已重定向到落地页目录"
            CONFLICT_FOUND=true

            # 显示替换后的结果
            echo "  替换后的 root 行:"
            grep -n 'root\s' /etc/nginx/nginx.conf 2>/dev/null | head -10 || echo "    (无)"
          else
            echo "  ✅ nginx.conf 中无内嵌 server 块"
          fi

          # ─── C2. 清理 /etc/nginx/default.d/ (CentOS/RHEL 特有) ───
          # CentOS nginx.conf 的 server 块通常 include /etc/nginx/default.d/*.conf
          # certbot 或手动部署可能在此目录添加了SSL/root配置
          if [ -d "/etc/nginx/default.d" ]; then
            for conf in /etc/nginx/default.d/*.conf; do
              [ -f "$conf" ] || continue
              echo "  🗑️ 移除 default.d 冲突: $(basename "$conf")"
              mv "$conf" "${conf}.disabled.by-landing"
              CONFLICT_FOUND=true
            done
          fi

          # ─── D. 清理旧web目录中的内容（防止被其他配置引用） ───
          echo ""
          echo "§2.6 清理旧网站内容..."
          # 扩展搜索范围：包含人类开发者可能手动部署的目录
          for old_dir in /var/www/guanghulab /var/www/html /usr/share/nginx/html /root/guanghulab /home/www /opt/guanghulab /var/www/hololake; do
            if [ -d "$old_dir" ] && [ -f "$old_dir/index.html" ]; then
              # 检查是否是旧的铸渊助手/HoloLake页面
              if grep -iqE "铸渊助手|hololake|age.os|HoloLake" "$old_dir/index.html" 2>/dev/null; then
                echo "  🗑️ 备份并清理旧内容: $old_dir/index.html"
                mv "$old_dir/index.html" "$old_dir/index.html.old.by-landing"
                # 放一个简单的重定向提示页
                echo '<!DOCTYPE html><html><head><meta charset="UTF-8"><meta http-equiv="refresh" content="0;url=/"></head><body>Redirecting...</body></html>' > "$old_dir/index.html"
              fi
            fi
          done
          # 也用find搜索系统中可能的旧页面（限制搜索深度和web相关目录）
          echo "  全局搜索旧内容..."
          find /var/www /usr/share/nginx /opt -maxdepth 3 -name "index.html" -type f 2>/dev/null | while read f; do
            if grep -iqE "铸渊助手|hololake|age\.os|HoloLake" "$f" 2>/dev/null; then
              # 不重复处理已备份的文件（匹配 .old. .bak. .disabled. 等后缀）
              echo "$f" | grep -qE '\.(old|bak|disabled)($|\.)' && continue
              # 不处理我们自己的落地页
              echo "$f" | grep -q 'guanghulab-landing' && continue
              echo "  🗑️ 发现旧内容: $f"
              mv "$f" "${f}.old.by-landing"
              echo '<!DOCTYPE html><html><head><meta charset="UTF-8"><meta http-equiv="refresh" content="0;url=/"></head><body>Redirecting...</body></html>' > "$f"
            fi
          done

          if [ "$CONFLICT_FOUND" = "true" ]; then
            echo "  ✅ 冲突配置已全面清理"
          else
            echo "  ✅ 未发现冲突配置"
          fi

          # ═══════════════════════════════════════════════════
          # §3 处理SSL并生成最终配置
          # ═══════════════════════════════════════════════════
          echo ""
          echo "§3 处理SSL配置..."

          if [ -n "$BARE_DOMAIN" ] && [ -d "/etc/letsencrypt/live/${BARE_DOMAIN}" ] && [ -f "/etc/letsencrypt/live/${BARE_DOMAIN}/fullchain.pem" ]; then
            echo "🔐 检测到SSL证书，生成HTTPS配置..."

            # 构建SSL选项行
            SSL_OPTS_LINE=""
            if [ -f "/etc/letsencrypt/options-ssl-nginx.conf" ]; then
              SSL_OPTS_LINE="    include /etc/letsencrypt/options-ssl-nginx.conf;"
            fi
            SSL_DH_LINE=""
            if [ -f "/etc/letsencrypt/ssl-dhparams.pem" ]; then
              SSL_DH_LINE="    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;"
            fi

            # 直接生成完整的带SSL的Nginx配置（避免fragile占位符替换）
            {
              echo "# guanghulab.com 落地页 · SSL模式 · 由部署工作流自动生成"
              echo "# 生成时间: $(date -u '+%Y-%m-%d %H:%M UTC')"
              echo ""
              echo "# HTTP → HTTPS 重定向"
              echo "server {"
              echo "    listen 80;"
              echo "    listen [::]:80;"
              echo "    server_name ${BARE_DOMAIN} www.${BARE_DOMAIN};"
              echo '    return 301 https://$host$request_uri;'
              echo "}"
              echo ""
              echo "# HTTPS 主站点"
              echo "server {"
              echo "    listen 443 ssl default_server;"
              echo "    listen [::]:443 ssl default_server;"
              echo "    server_name ${BARE_DOMAIN} www.${BARE_DOMAIN};"
              echo ""
              echo "    ssl_certificate /etc/letsencrypt/live/${BARE_DOMAIN}/fullchain.pem;"
              echo "    ssl_certificate_key /etc/letsencrypt/live/${BARE_DOMAIN}/privkey.pem;"
              [ -n "$SSL_OPTS_LINE" ] && echo "$SSL_OPTS_LINE"
              [ -n "$SSL_DH_LINE" ] && echo "$SSL_DH_LINE"
              echo ""
              echo '    add_header X-Frame-Options "SAMEORIGIN" always;'
              echo '    add_header X-Content-Type-Options "nosniff" always;'
              echo '    add_header X-XSS-Protection "1; mode=block" always;'
              echo '    add_header X-Server-Identity "ALI-SVR-CN-LANDING" always;'
              echo '    add_header X-Site-Mode "cn-landing-ali" always;'
              echo ""
              echo "    root /opt/guanghulab-landing/sites/cn-landing;"
              echo "    index index.html;"
              echo ""
              echo "    location / {"
              echo '        try_files $uri $uri/ /index.html;'
              echo "    }"
              echo ""
              echo "    location = /health {"
              echo "        access_log off;"
              echo "        return 200 '{\"status\":\"ok\",\"server\":\"ali-cn\",\"role\":\"cn-landing\",\"domain\":\"${BARE_DOMAIN}\",\"ssl\":true}';"
              echo "        add_header Content-Type application/json;"
              echo "    }"
              echo ""
              echo '    location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {'
              echo "        expires 7d;"
              echo '        add_header Cache-Control "public, immutable";'
              echo "    }"
              echo ""
              echo "    error_page 404 /index.html;"
              echo "    error_page 500 502 503 504 /index.html;"
              echo ""
              echo "    access_log /opt/guanghulab-landing/logs/nginx-access.log;"
              echo "    error_log /opt/guanghulab-landing/logs/nginx-error.log;"
              echo "}"
            } > /tmp/ali-cn-domain.conf

            echo "✅ SSL配置已生成 · HTTPS + HTTP→HTTPS重定向"
          else
            echo "ℹ️ 未检测到SSL证书 · 仅HTTP模式"
            echo "  运行 setup-ssl 动作安装Let's Encrypt证书"
            # 无SSL：清除占位符，保留原始HTTP配置
            sed -i '/__SSL_BLOCK_PLACEHOLDER__/d' /tmp/ali-cn-domain.conf
            sed -i '/__HTTP_REDIRECT_BLOCK_PLACEHOLDER__/d' /tmp/ali-cn-domain.conf
          fi

          # §3.5 部署配置文件
          CONF_FILE="${CONF_DIR}/guanghulab-landing.conf"

          if [ "$CONF_DIR" = "/etc/nginx/sites-enabled" ]; then
            cp /tmp/ali-cn-domain.conf /etc/nginx/sites-available/guanghulab-landing.conf
            ln -sf /etc/nginx/sites-available/guanghulab-landing.conf "${CONF_FILE}"
          else
            cp /tmp/ali-cn-domain.conf "${CONF_FILE}"
          fi
          rm -f /tmp/ali-cn-domain.conf
          echo "✅ 配置已部署: ${CONF_FILE}"

          # §4 诊断：显示最终配置状态
          echo ""
          echo "§4 最终Nginx配置状态:"
          echo "─── conf.d 目录 ───"
          ls -la /etc/nginx/conf.d/*.conf 2>/dev/null || echo "  (无.conf文件)"
          if [ -d "/etc/nginx/sites-enabled" ]; then
            echo "─── sites-enabled 目录 ───"
            ls -la /etc/nginx/sites-enabled/ 2>/dev/null || echo "  (空)"
          fi
          echo "─── 配置文件内容 ───"
          cat "${CONF_FILE}"

          # §4.5 最终冲突检查：扫描所有可能的监听80/443的配置
          echo ""
          echo "§4.5 最终冲突检查:"
          REMAINING=false
          for dir in /etc/nginx/conf.d /etc/nginx/sites-enabled; do
            [ -d "$dir" ] || continue
            for conf in "$dir"/*.conf "$dir"/*; do
              [ -f "$conf" ] || continue
              BASENAME=$(basename "$conf")
              [ "$BASENAME" = "guanghulab-landing.conf" ] && continue
              # 排除非.conf和已disabled的文件
              echo "$BASENAME" | grep -qE '\.(disabled|bak|old)|by-landing' && continue
              if grep -vE '^\s*#' "$conf" 2>/dev/null | grep -qE "listen\s.*(80|443)"; then
                echo "  ⚠️ 残留冲突: $dir/$BASENAME"
                echo "    → 强制移除"
                rm -f "$conf"
                REMAINING=true
              fi
            done
          done
          [ "$REMAINING" = "false" ] && echo "  ✅ 无残留冲突"

          # §5 诊断：导出完整nginx.conf（去注释版）帮助定位问题
          echo ""
          echo "§5 nginx.conf 生效的完整 server/root 行:"
          nginx -T 2>/dev/null | grep -E '^\s*(server\s*\{|root\s|listen\s|server_name\s|ssl_certificate)' | head -30 || echo "  (nginx -T 不可用)"

          # §6 测试并重载Nginx
          echo ""
          nginx -t 2>&1
          if [ $? -eq 0 ]; then
            # 使用 restart 而非 reload，确保完全加载新配置
            systemctl restart nginx 2>/dev/null || systemctl start nginx
            echo "✅ Nginx已重启 · guanghulab-landing.conf 为唯一站点"
          else
            echo "❌ Nginx配置测试失败，尝试恢复..."
            # 显示错误详情
            nginx -t 2>&1 || true
            # 恢复nginx.conf
            if [ -f /etc/nginx/nginx.conf.bak.by-landing ]; then
              cp /etc/nginx/nginx.conf.bak.by-landing /etc/nginx/nginx.conf
              echo "  ↩️ 已恢复 nginx.conf"
            fi
            rm -f "${CONF_FILE}"
            if [ -f "/etc/nginx/sites-available/guanghulab-landing.conf" ]; then
              rm -f /etc/nginx/sites-available/guanghulab-landing.conf
            fi
            # 恢复被禁用的冲突配置
            for disabled in /etc/nginx/conf.d/*.disabled.by-landing; do
              [ -f "$disabled" ] || continue
              ORIGINAL="${disabled%.disabled.by-landing}"
              mv "$disabled" "$ORIGINAL"
              echo "  ↩️ 已恢复: $(basename "$ORIGINAL")"
            done
            nginx -t && systemctl reload nginx
            exit 1
          fi
          NGINX_CMD

          rm -f /tmp/ali-cn-domain.conf

      - name: 💚 健康检查
        env:
          SSHPASS: ${{ secrets.ALI_SERVER_PASSWORD }}
        run: |
          sshpass -e ssh -F ~/.ssh/config -o BatchMode=no ali-target << 'HEALTH_CMD'
          set -e

          echo "═══ 阿里云落地页部署验证 ═══"

          # §1 Nginx状态
          if systemctl is-active --quiet nginx; then
            echo "✅ Nginx: 运行中"
          else
            echo "❌ Nginx: 已停止"
            systemctl start nginx
            echo "⚠️ Nginx: 已重新启动"
          fi

          # §1.5 确认Nginx活跃配置
          echo ""
          echo "§ Nginx活跃配置:"
          echo "  conf.d:"
          ls /etc/nginx/conf.d/*.conf 2>/dev/null || echo "    (无)"
          echo "  sites-enabled:"
          ls /etc/nginx/sites-enabled/ 2>/dev/null || echo "    (无)"

          # §2 页面访问测试
          # 先尝试HTTPS（可能配置了SSL），再尝试HTTP
          echo ""
          HTTPS_CODE=$(curl -s -o /tmp/page_https.html -w '%{http_code}' -k https://localhost/ 2>/dev/null || echo "000")
          HTTP_CODE=$(curl -s -o /tmp/page_http.html -w '%{http_code}' http://localhost/ 2>/dev/null || echo "000")
          echo "§ 页面访问: HTTP=${HTTP_CODE} HTTPS=${HTTPS_CODE}"

          # 确定最终使用的页面内容
          PAGE_CONTENT=""
          if [ "$HTTPS_CODE" = "200" ]; then
            PAGE_CONTENT=$(cat /tmp/page_https.html 2>/dev/null || echo "")
            echo "  → 使用HTTPS响应内容"
          elif [ "$HTTP_CODE" = "200" ]; then
            PAGE_CONTENT=$(cat /tmp/page_http.html 2>/dev/null || echo "")
            echo "  → 使用HTTP响应内容"
          elif [ "$HTTP_CODE" = "301" ] || [ "$HTTP_CODE" = "302" ]; then
            # HTTP redirects to HTTPS, follow it
            PAGE_CONTENT=$(curl -sLk http://localhost/ 2>/dev/null || echo "")
            echo "  → HTTP重定向到HTTPS，跟随重定向"
          else
            echo "  ❌ HTTP和HTTPS都无法访问"
            PAGE_CONTENT=$(curl -sLk http://localhost/ 2>/dev/null || echo "")
          fi

          # §3 ICP备案号检查
          if echo "$PAGE_CONTENT" | grep -q "陕ICP备2025071211号"; then
            echo "✅ ICP备案号: 已显示"
          else
            echo "❌ ICP备案号: 未找到"
            echo "  页面title:"
            echo "$PAGE_CONTENT" | grep -o '<title>[^<]*</title>' | head -1 || echo "    (无title)"
            echo "  页面前300字符:"
            echo "$PAGE_CONTENT" | head -c 300
            echo ""
          fi

          # §4 正确内容验证 — 确认是新落地页而不是旧内容
          if echo "$PAGE_CONTENT" | grep -q "光湖实验室"; then
            echo "✅ 正确内容: 光湖实验室落地页"
          elif echo "$PAGE_CONTENT" | grep -iqE "铸渊助手|hololake|age.os"; then
            echo "❌ 错误内容: 仍显示旧的铸渊助手/AGE OS页面"
            echo "  ⚠️ 可能仍有Nginx配置冲突或旧文件被引用"
          else
            echo "⚠️ 未知内容 — 请手动检查"
          fi

          # §5 备案链接检查
          if echo "$PAGE_CONTENT" | grep -q "beian.miit.gov.cn"; then
            echo "✅ 工信部链接: 已配置"
          else
            echo "⚠️ 工信部链接: 未找到"
          fi

          # §6 健康端点
          HEALTH=$(curl -sLk http://localhost/health 2>/dev/null || curl -sk https://localhost/health 2>/dev/null || echo '{}')
          echo "✅ 健康探针: ${HEALTH}"

          if echo "$HEALTH" | grep -q "cn-landing"; then
            echo "✅ 健康端点来自 guanghulab-landing.conf（正确）"
          elif echo "$HEALTH" | grep -qE "relay|proxy|mcp|hololake"; then
            echo "❌ 健康端点来自其他服务 — 仍有Nginx配置冲突"
          fi

          # §7 文件验证
          if [ -f "/opt/guanghulab-landing/sites/cn-landing/index.html" ]; then
            echo "✅ 落地页文件: 存在"
            ls -la /opt/guanghulab-landing/sites/cn-landing/
          else
            echo "❌ 落地页文件: 不存在"
          fi

          echo ""
          echo "═══ 部署完成 · guanghulab.com ═══"
          HEALTH_CMD

      - name: 🧹 清理
        if: always()
        run: |
          rm -f ~/.ssh/id_sg ~/.ssh/config
          rm -f /tmp/cn-landing.tar.gz /tmp/ali-cn-domain.conf

  # ═══════════════════════════════════════
  # §2 健康检查
  # ═══════════════════════════════════════
  health-check:
    name: 💚 阿里云落地页健康检查
    if: github.event.inputs.action == 'health-check'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: 📦 安装SSH工具
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq sshpass

      - name: 🔐 配置SSH连接
        env:
          ALI_HOST: ${{ secrets.ALI_SERVER_HOST }}
          ALI_USER: ${{ secrets.ALI_SERVER_USER }}
          ALI_PASS: ${{ secrets.ALI_SERVER_PASSWORD }}
          SG_SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
          SG_HOST: ${{ secrets.ZY_SERVER_HOST }}
          SG_USER: ${{ secrets.ZY_SERVER_USER }}
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          export SSHPASS="${ALI_PASS}"

          # 尝试直连
          DIRECT_OK=false
          sshpass -e ssh -o StrictHostKeyChecking=accept-new \
            -o ConnectTimeout=15 -o BatchMode=no \
            "${ALI_USER}@${ALI_HOST}" 'echo ok' 2>/dev/null && DIRECT_OK=true || true

          if [ "$DIRECT_OK" = "true" ]; then
            cat > ~/.ssh/config << EOF
          Host ali-target
              HostName ${ALI_HOST}
              User ${ALI_USER}
              StrictHostKeyChecking accept-new
              ConnectTimeout 30
          EOF
          else
            echo "$SG_SSH_KEY" > ~/.ssh/id_sg
            chmod 600 ~/.ssh/id_sg
            ssh-keyscan -H "${SG_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
            cat > ~/.ssh/config << EOF
          Host sg-jump
              HostName ${SG_HOST}
              User ${SG_USER}
              IdentityFile ~/.ssh/id_sg
              StrictHostKeyChecking accept-new
              BatchMode yes

          Host ali-target
              HostName ${ALI_HOST}
              User ${ALI_USER}
              ProxyJump sg-jump
              StrictHostKeyChecking accept-new
              ConnectTimeout 30
          EOF
          fi
          chmod 600 ~/.ssh/config

      - name: 💚 执行健康检查
        env:
          SSHPASS: ${{ secrets.ALI_SERVER_PASSWORD }}
        run: |
          sshpass -e ssh -F ~/.ssh/config -o BatchMode=no ali-target << 'HEALTH_CMD'

          echo "═══ 阿里云落地页健康报告 ═══"
          echo ""

          echo "§1 系统状态:"
          uptime
          echo ""

          echo "§2 Nginx 状态:"
          systemctl is-active nginx && echo "Nginx: 运行中" || echo "Nginx: 已停止"
          echo ""

          echo "§3 Nginx 站点配置:"
          ls -la /etc/nginx/sites-enabled/ 2>/dev/null || echo "  (目录不存在)"
          echo ""

          echo "§4 落地页文件:"
          ls -la /opt/guanghulab-landing/sites/cn-landing/ 2>/dev/null || echo "  目录不存在"
          echo ""

          echo "§5 页面访问测试:"
          HTTP_CODE=$(curl -sf -o /dev/null -w '%{http_code}' -H "Host: guanghulab.com" http://localhost/ 2>/dev/null || echo "000")
          echo "HTTP状态码: ${HTTP_CODE}"
          echo ""

          echo "§6 ICP备案号检查:"
          PAGE=$(curl -sf -H "Host: guanghulab.com" http://localhost/ 2>/dev/null || curl -sf http://localhost/ 2>/dev/null || echo "")
          if echo "$PAGE" | grep -q "陕ICP备2025071211号"; then
            echo "✅ ICP备案号已显示"
          else
            echo "❌ ICP备案号未找到"
            echo "  页面前300字符:"
            echo "$PAGE" | head -c 300
          fi

          echo ""
          echo "§7 健康端点:"
          HEALTH=$(curl -sf -H "Host: guanghulab.com" http://localhost/health 2>/dev/null || echo '{}')
          echo "响应: ${HEALTH}"

          echo ""
          echo "§8 HTTPS状态:"
          HTTPS_CODE=$(curl -sf -o /dev/null -w '%{http_code}' -H "Host: guanghulab.com" https://localhost/ -k 2>/dev/null || echo "000")
          echo "HTTPS状态码: ${HTTPS_CODE}"

          echo ""
          echo "§9 SSL证书:"
          certbot certificates 2>/dev/null || echo "  certbot未安装"

          echo ""
          echo "§10 磁盘使用:"
          df -h /
          echo ""
          echo "§11 内存使用:"
          free -m

          HEALTH_CMD

      - name: 🧹 清理
        if: always()
        run: rm -f ~/.ssh/id_sg ~/.ssh/config

  # ═══════════════════════════════════════
  # §3 安装SSL证书
  # ═══════════════════════════════════════
  setup-ssl:
    name: 🔐 安装SSL证书 (Let's Encrypt)
    if: github.event.inputs.action == 'setup-ssl'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: 📦 安装SSH工具
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq sshpass

      - name: 🔐 配置SSH连接
        env:
          ALI_HOST: ${{ secrets.ALI_SERVER_HOST }}
          ALI_USER: ${{ secrets.ALI_SERVER_USER }}
          ALI_PASS: ${{ secrets.ALI_SERVER_PASSWORD }}
          SG_SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
          SG_HOST: ${{ secrets.ZY_SERVER_HOST }}
          SG_USER: ${{ secrets.ZY_SERVER_USER }}
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          export SSHPASS="${ALI_PASS}"

          DIRECT_OK=false
          sshpass -e ssh -o StrictHostKeyChecking=accept-new \
            -o ConnectTimeout=15 -o BatchMode=no \
            "${ALI_USER}@${ALI_HOST}" 'echo ok' 2>/dev/null && DIRECT_OK=true || true

          if [ "$DIRECT_OK" = "true" ]; then
            cat > ~/.ssh/config << EOF
          Host ali-target
              HostName ${ALI_HOST}
              User ${ALI_USER}
              StrictHostKeyChecking accept-new
              ConnectTimeout 30
          EOF
          else
            echo "$SG_SSH_KEY" > ~/.ssh/id_sg
            chmod 600 ~/.ssh/id_sg
            ssh-keyscan -H "${SG_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
            cat > ~/.ssh/config << EOF
          Host sg-jump
              HostName ${SG_HOST}
              User ${SG_USER}
              IdentityFile ~/.ssh/id_sg
              StrictHostKeyChecking accept-new
              BatchMode yes

          Host ali-target
              HostName ${ALI_HOST}
              User ${ALI_USER}
              ProxyJump sg-jump
              StrictHostKeyChecking accept-new
              ConnectTimeout 30
          EOF
          fi
          chmod 600 ~/.ssh/config

      - name: 🔐 安装certbot并申请证书
        env:
          SSHPASS: ${{ secrets.ALI_SERVER_PASSWORD }}
          ZY_CN_DOMAIN: ${{ secrets.ZY_CN_DOMAIN }}
        run: |
          BARE_DOMAIN="${ZY_CN_DOMAIN:-guanghulab.com}"
          BARE_DOMAIN="${BARE_DOMAIN#www.}"
          echo "🔐 为 ${BARE_DOMAIN} + www.${BARE_DOMAIN} 申请SSL证书..."

          sshpass -e ssh -F ~/.ssh/config -o BatchMode=no ali-target << SSLCMD
          set -e

          echo "═══ SSL证书安装 (阿里云) ═══"

          # 安装certbot
          if ! command -v certbot &> /dev/null; then
            echo "📦 安装certbot..."
            if command -v apt-get &> /dev/null; then
              apt-get update -qq
              apt-get install -y -qq certbot python3-certbot-nginx
            elif command -v yum &> /dev/null; then
              yum install -y -q certbot python3-certbot-nginx
            elif command -v dnf &> /dev/null; then
              dnf install -y -q certbot python3-certbot-nginx
            fi
          else
            echo "✅ certbot已安装: \$(certbot --version 2>&1)"
          fi

          # 确认Nginx运行中
          if ! systemctl is-active --quiet nginx; then
            systemctl start nginx
          fi

          # 验证域名格式
          if ! echo "${BARE_DOMAIN}" | grep -qE '^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)*\.[a-zA-Z]{2,}$'; then
            echo "❌ 域名格式无效: ${BARE_DOMAIN}"
            exit 1
          fi

          # 申请证书
          echo ""
          echo "§1 申请Let's Encrypt证书..."
          certbot --nginx \
            -d ${BARE_DOMAIN} \
            -d www.${BARE_DOMAIN} \
            --non-interactive \
            --agree-tos \
            --email admin@${BARE_DOMAIN} \
            --redirect \
            --no-eff-email

          # 验证
          echo ""
          echo "§2 验证证书..."
          certbot certificates

          echo ""
          echo "§3 HTTPS访问测试..."
          HTTP_CODE=\$(curl -sf -o /dev/null -w '%{http_code}' https://localhost/ -k 2>/dev/null || echo "000")
          echo "HTTPS状态码: \${HTTP_CODE}"

          echo ""
          echo "═══ SSL安装完成 ═══"
          echo "🌐 https://${BARE_DOMAIN} 已启用"
          SSLCMD

      - name: 🧹 清理
        if: always()
        run: rm -f ~/.ssh/id_sg ~/.ssh/config