name: 🇨🇳 国内域名落地页 · 部署

# ═══════════════════════════════════════════════════════════
# 国内域名ICP备案落地页部署工作流
# 编号: ZY-WF-CN-LANDING
# 服务器: ZY-SVR-004 · 43.139.217.141 · 广州七区
# 守护: 铸渊 · ICE-GL-ZY001
# 版权: 国作登字-2026-A-00037559
# ═══════════════════════════════════════════════════════════
#
# 部署内容:
#   1. 国内落地页 (server/sites/cn-landing/) → /opt/zhuyuan-cn/sites/cn-landing/
#   2. Nginx 配置 (server/nginx/cn-domain.conf) → Nginx sites-enabled
#   3. LLM API 密钥注入 (四大国内模型)
#
# 架构: GitHub Actions(美国) → SG(新加坡·跳板) → CN(广州·目标)

on:
  push:
    branches: [main]
    paths:
      - 'server/sites/cn-landing/**'
      - 'server/nginx/cn-domain.conf'
  workflow_dispatch:
    inputs:
      action:
        description: '部署动作'
        required: true
        default: 'deploy'
        type: choice
        options:
          - deploy
          - health-check
          - setup-ssl

concurrency:
  group: cn-landing-deploy
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  deploy:
    name: 🚀 部署国内落地页
    if: github.event.inputs.action == 'deploy' || github.event.inputs.action == '' || github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: 🔐 配置SSH跳板 (SG→CN)
        env:
          SG_SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
          CN_SSH_KEY: ${{ secrets.ZY_CN_SERVER_KEY }}
          CN_SSH_PORT: ${{ secrets.ZY_CN_SSH_PORT }}
        run: |
          CN_PORT="${CN_SSH_PORT:-22}"
          echo "🔧 SSH跳板: GitHub Actions → SG → CN (端口 ${CN_PORT})"

          mkdir -p ~/.ssh
          echo "$SG_SSH_KEY" > ~/.ssh/id_sg
          echo "$CN_SSH_KEY" > ~/.ssh/id_cn
          chmod 600 ~/.ssh/id_sg ~/.ssh/id_cn

          for key_file in id_sg id_cn; do
            if ! head -1 ~/.ssh/${key_file} | grep -q "BEGIN"; then
              echo "❌ SSH密钥格式异常: ${key_file}"
              exit 1
            fi
          done
          echo "✅ SG + CN 密钥格式正确"

          ssh-keyscan -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

          cat > ~/.ssh/config << EOF
          Host sg-jump
              HostName ${{ secrets.ZY_SERVER_HOST }}
              User ${{ secrets.ZY_SERVER_USER }}
              IdentityFile ~/.ssh/id_sg
              StrictHostKeyChecking accept-new
              BatchMode yes

          Host cn-target
              HostName ${{ secrets.ZY_CN_SERVER_HOST }}
              User ${{ secrets.ZY_CN_SERVER_USER }}
              Port ${CN_PORT}
              IdentityFile ~/.ssh/id_cn
              ProxyJump sg-jump
              StrictHostKeyChecking accept-new
              BatchMode yes
              ConnectTimeout 30
          EOF
          chmod 600 ~/.ssh/config

      - name: 🔍 SSH连接测试
        run: |
          echo "🔍 测试SSH跳板连接到广州服务器..."
          ssh cn-target 'echo "✅ SSH连接成功 · $(hostname) · $(date)"' || {
            echo "❌ SSH跳板连接失败"
            exit 1
          }

      - name: 📂 准备目标目录
        run: |
          ssh cn-target << 'PREP_CMD'
          set -e
          mkdir -p /opt/zhuyuan-cn/sites/cn-landing
          mkdir -p /opt/zhuyuan-cn/data/logs
          mkdir -p /opt/zhuyuan-cn/config/nginx
          echo "✅ 目录结构就绪"
          PREP_CMD

      - name: 📦 同步落地页文件
        run: |
          rsync -avz --delete \
            server/sites/cn-landing/ \
            cn-target:/opt/zhuyuan-cn/sites/cn-landing/
          echo "✅ 落地页已同步到 /opt/zhuyuan-cn/sites/cn-landing/"

      - name: 📦 同步Nginx配置
        env:
          ZY_CN_DOMAIN: ${{ secrets.ZY_CN_DOMAIN }}
        run: |
          cp server/nginx/cn-domain.conf /tmp/cn-domain.conf

          if [ -n "$ZY_CN_DOMAIN" ]; then
            # 去除可能的 www. 前缀，获取裸域名
            BARE_DOMAIN="${ZY_CN_DOMAIN#www.}"
            sed -i "s/ZY_CN_BARE_DOMAIN_PLACEHOLDER/${BARE_DOMAIN}/g" /tmp/cn-domain.conf
            echo "✅ 国内域名已注入: ${BARE_DOMAIN} + www.${BARE_DOMAIN}"
          else
            echo "⚠️ ZY_CN_DOMAIN 未配置，使用IP直接访问"
            sed -i "s/ZY_CN_BARE_DOMAIN_PLACEHOLDER www.ZY_CN_BARE_DOMAIN_PLACEHOLDER/_/g" /tmp/cn-domain.conf
          fi

          scp -F ~/.ssh/config \
            /tmp/cn-domain.conf \
            cn-target:/opt/zhuyuan-cn/config/nginx/cn-domain.conf
          echo "✅ Nginx配置已上传"

      - name: 🔑 注入LLM API密钥
        env:
          ZY_DEEPSEEK_API_KEY: ${{ secrets.ZY_DEEPSEEK_API_KEY }}
          ZY_QIANWEN_API_KEY: ${{ secrets.ZY_QIANWEN_API_KEY }}
          ZY_KIMI_API_KEY: ${{ secrets.ZY_KIMI_API_KEY }}
          ZY_QINGYAN_API_KEY: ${{ secrets.ZY_QINGYAN_API_KEY }}
        run: |
          # 在本地生成密钥文件（变量在此展开）
          cat > /tmp/.env.llm << ENVEOF
          ZY_DEEPSEEK_API_KEY=${ZY_DEEPSEEK_API_KEY}
          ZY_QIANWEN_API_KEY=${ZY_QIANWEN_API_KEY}
          ZY_KIMI_API_KEY=${ZY_KIMI_API_KEY}
          ZY_QINGYAN_API_KEY=${ZY_QINGYAN_API_KEY}
          ENVEOF

          # 上传到目标服务器
          scp -F ~/.ssh/config /tmp/.env.llm cn-target:/opt/zhuyuan-cn/config/.env.llm
          ssh cn-target 'chmod 600 /opt/zhuyuan-cn/config/.env.llm'
          rm -f /tmp/.env.llm
          echo "✅ 四大国内模型API密钥已注入"

      - name: 🔧 启用Nginx配置 & 重载
        env:
          ZY_CN_DOMAIN: ${{ secrets.ZY_CN_DOMAIN }}
        run: |
          BARE_DOMAIN="${ZY_CN_DOMAIN#www.}"
          ssh cn-target << NGINX_CMD
          set -e

          echo "═══ Nginx 配置诊断 ═══"

          # 诊断: 列出当前所有启用的Nginx站点配置
          echo "§1 当前sites-enabled目录:"
          ls -la /etc/nginx/sites-enabled/ 2>/dev/null || echo "  (目录不存在)"

          echo ""
          echo "§1.1 当前conf.d目录:"
          ls -la /etc/nginx/conf.d/ 2>/dev/null || echo "  (目录不存在)"

          # 清理所有冲突配置 — cn-domain.conf 必须是唯一的站点配置
          # 此服务器仅服务国内落地页，不应有其他Nginx站点配置
          echo ""
          echo "§2 清理冲突配置..."

          # 清理 sites-enabled 中的冲突
          for conf in /etc/nginx/sites-enabled/*; do
            if [ -f "\$conf" ] && [ "\$(basename "\$conf")" != "cn-domain.conf" ]; then
              echo "  🗑️ 移除sites-enabled冲突: \$(basename "\$conf")"
              sudo rm -f "\$conf"
            fi
          done

          # 清理 conf.d 中可能的冲突 server 块配置
          # 保留 conf.d 中的全局配置(如 gzip, ssl_params 等)
          # 只移除包含 server { 或 proxy_pass 的自定义站点配置
          for conf in /etc/nginx/conf.d/*.conf; do
            if [ -f "\$conf" ] && grep -qE "server[[:space:]]*\{" "\$conf" 2>/dev/null; then
              echo "  🗑️ 移除conf.d冲突站点配置: \$(basename "\$conf")"
              sudo rm -f "\$conf"
            fi
          done

          # 复制配置到Nginx目录
          sudo cp /opt/zhuyuan-cn/config/nginx/cn-domain.conf /etc/nginx/sites-available/cn-domain.conf
          sudo ln -sf /etc/nginx/sites-available/cn-domain.conf /etc/nginx/sites-enabled/cn-domain.conf

          # ─── SSL自动注入: 检测已有Let's Encrypt证书 ───
          # 如果之前运行过 setup-ssl，证书文件会存在
          # 每次deploy都重新注入SSL配置，避免模板覆盖导致SSL丢失
          if [ -d "/etc/letsencrypt/live/${BARE_DOMAIN}" ] && [ -f "/etc/letsencrypt/live/${BARE_DOMAIN}/fullchain.pem" ]; then
            echo ""
            echo "§2.5 🔐 检测到SSL证书，注入HTTPS配置..."
            # 在 listen 80 后添加 listen 443 ssl 和证书配置
            sudo sed -i '/listen 80 default_server;/a\\n    listen 443 ssl default_server;\n    ssl_certificate /etc/letsencrypt/live/'"${BARE_DOMAIN}"'/fullchain.pem;\n    ssl_certificate_key /etc/letsencrypt/live/'"${BARE_DOMAIN}"'/privkey.pem;\n    include /etc/letsencrypt/options-ssl-nginx.conf;\n    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;' \
              /etc/nginx/sites-available/cn-domain.conf
            echo "✅ SSL配置已注入 · HTTPS已启用"
          else
            echo ""
            echo "§2.5 ℹ️ 未检测到SSL证书 · 仅HTTP模式"
            echo "  运行 setup-ssl 动作安装Let's Encrypt证书"
          fi

          # 确认最终状态
          echo ""
          echo "§3 清理后sites-enabled目录:"
          ls -la /etc/nginx/sites-enabled/

          echo ""
          echo "§3.1 清理后conf.d目录:"
          ls -la /etc/nginx/conf.d/ 2>/dev/null || echo "  (空)"

          # 测试并重载Nginx
          echo ""
          sudo nginx -t && sudo systemctl reload nginx
          echo "✅ Nginx配置已生效 · 仅cn-domain.conf生效"
          NGINX_CMD

      - name: 💚 健康检查
        run: |
          ssh cn-target << 'HEALTH_CMD'
          set -e

          echo "═══ 国内落地页部署验证 ═══"

          # 检查Nginx
          if systemctl is-active --quiet nginx; then
            echo "✅ Nginx: 运行中"
          else
            echo "❌ Nginx: 已停止"
            exit 1
          fi

          # 诊断: 确认Nginx活跃配置
          echo ""
          echo "§ Nginx活跃配置:"
          ls -la /etc/nginx/sites-enabled/ 2>/dev/null

          # 检查页面可访问
          HTTP_CODE=$(curl -sf -o /dev/null -w '%{http_code}' http://localhost/ 2>/dev/null || echo "000")
          if [ "$HTTP_CODE" = "200" ]; then
            echo "✅ 落地页: HTTP 200 OK"
          else
            echo "❌ 落地页: HTTP ${HTTP_CODE}"
            # 不立即退出 · 继续诊断
          fi

          # 检查ICP备案号 · 确认是正确的落地页（非代理页面）
          if curl -sf http://localhost/ | grep -q "陕ICP备2025071211号"; then
            echo "✅ ICP备案号: 已显示"
          else
            echo "❌ ICP备案号: 未找到 — 可能有冲突配置覆盖了落地页"
            echo "  诊断: 页面前200字符:"
            curl -sf http://localhost/ 2>/dev/null | head -c 200 || echo "(无响应)"
          fi

          # 检查备案链接
          if curl -sf http://localhost/ | grep -q "beian.miit.gov.cn"; then
            echo "✅ 工信部链接: 已配置"
          else
            echo "⚠️ 工信部链接: 未找到"
          fi

          # 健康端点 · 验证返回的是cn-landing而不是其他服务
          HEALTH=$(curl -sf http://localhost/health 2>/dev/null || echo '{}')
          echo "✅ 健康探针: ${HEALTH}"

          # 验证健康端点来自cn-domain.conf而非其他服务
          if echo "$HEALTH" | grep -q "cn-landing"; then
            echo "✅ 健康端点: 来自cn-domain.conf（正确）"
          elif echo "$HEALTH" | grep -qE "relay|proxy|mcp"; then
            echo "❌ 健康端点: 来自其他服务 — Nginx配置冲突未完全解决"
          fi

          # 确认没有端口冲突: 检查是否有其他服务监听80端口
          echo ""
          echo "§ 端口80监听进程:"
          sudo ss -tlnp | grep ':80 ' || echo "  (无)"

          echo ""
          echo "═══ 部署完成 ═══"
          HEALTH_CMD

      - name: 🧹 清理SSH密钥
        if: always()
        run: rm -f ~/.ssh/id_sg ~/.ssh/id_cn ~/.ssh/config

  health-check:
    name: 💚 国内落地页健康检查
    if: github.event.inputs.action == 'health-check'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: 🔐 配置SSH跳板 (SG→CN)
        env:
          SG_SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
          CN_SSH_KEY: ${{ secrets.ZY_CN_SERVER_KEY }}
          CN_SSH_PORT: ${{ secrets.ZY_CN_SSH_PORT }}
        run: |
          CN_PORT="${CN_SSH_PORT:-22}"

          mkdir -p ~/.ssh
          echo "$SG_SSH_KEY" > ~/.ssh/id_sg
          echo "$CN_SSH_KEY" > ~/.ssh/id_cn
          chmod 600 ~/.ssh/id_sg ~/.ssh/id_cn

          ssh-keyscan -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

          cat > ~/.ssh/config << EOF
          Host sg-jump
              HostName ${{ secrets.ZY_SERVER_HOST }}
              User ${{ secrets.ZY_SERVER_USER }}
              IdentityFile ~/.ssh/id_sg
              StrictHostKeyChecking accept-new
              BatchMode yes

          Host cn-target
              HostName ${{ secrets.ZY_CN_SERVER_HOST }}
              User ${{ secrets.ZY_CN_SERVER_USER }}
              Port ${CN_PORT}
              IdentityFile ~/.ssh/id_cn
              ProxyJump sg-jump
              StrictHostKeyChecking accept-new
              BatchMode yes
              ConnectTimeout 30
          EOF
          chmod 600 ~/.ssh/config

      - name: 💚 执行健康检查
        run: |
          ssh cn-target << 'HEALTH_CMD'

          echo "═══ 国内落地页健康报告 ═══"
          echo ""

          echo "§1 系统状态:"
          uptime
          echo ""

          echo "§2 Nginx 状态:"
          systemctl is-active nginx && echo "Nginx: 运行中" || echo "Nginx: 已停止"
          echo ""

          echo "§3 Nginx sites-enabled 诊断:"
          ls -la /etc/nginx/sites-enabled/ 2>/dev/null || echo "  (目录不存在)"
          echo ""

          echo "§4 落地页文件:"
          ls -la /opt/zhuyuan-cn/sites/cn-landing/ 2>/dev/null || echo "目录不存在"
          echo ""

          echo "§5 页面访问测试:"
          HTTP_CODE=$(curl -sf -o /dev/null -w '%{http_code}' http://localhost/ 2>/dev/null || echo "000")
          echo "HTTP状态码: ${HTTP_CODE}"
          echo ""

          echo "§6 ICP备案号检查:"
          if curl -sf http://localhost/ | grep -q "陕ICP备2025071211号"; then
            echo "✅ ICP备案号已显示"
          else
            echo "❌ ICP备案号未找到"
            echo "  页面前200字符:"
            curl -sf http://localhost/ 2>/dev/null | head -c 200 || echo "(无响应)"
          fi

          echo ""
          echo "§7 健康端点验证:"
          HEALTH=$(curl -sf http://localhost/health 2>/dev/null || echo '{}')
          echo "响应: ${HEALTH}"
          if echo "$HEALTH" | grep -q "cn-landing"; then
            echo "✅ 来自cn-domain.conf（正确）"
          elif echo "$HEALTH" | grep -qE "relay|proxy|mcp"; then
            echo "❌ 来自其他服务 — 存在Nginx配置冲突"
          fi

          echo ""
          echo "§8 LLM API密钥状态:"
          if [ -f /opt/zhuyuan-cn/config/.env.llm ]; then
            KEY_COUNT=$(grep -c "API_KEY" /opt/zhuyuan-cn/config/.env.llm 2>/dev/null || echo "0")
            echo "已配置密钥数: ${KEY_COUNT}"
          else
            echo "⚠️ LLM密钥文件不存在"
          fi

          echo ""
          echo "§9 端口80监听进程:"
          sudo ss -tlnp | grep ':80 ' 2>/dev/null || echo "  (无)"

          # SSL状态检查
          echo ""
          echo "§10 SSL证书状态:"
          sudo certbot certificates 2>/dev/null || echo "  certbot未安装 · 运行setup-ssl动作安装"

          echo ""
          echo "§11 HTTPS访问测试:"
          HTTPS_CODE=$(curl -sf -o /dev/null -w '%{http_code}' https://localhost/ -k 2>/dev/null || echo "000")
          echo "HTTPS状态码: ${HTTPS_CODE}"

          HEALTH_CMD

      - name: 🧹 清理SSH密钥
        if: always()
        run: rm -f ~/.ssh/id_sg ~/.ssh/id_cn ~/.ssh/config

  setup-ssl:
    name: 🔐 安装SSL证书 (Let's Encrypt)
    if: github.event.inputs.action == 'setup-ssl'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: 🔐 配置SSH跳板 (SG→CN)
        env:
          SG_SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
          CN_SSH_KEY: ${{ secrets.ZY_CN_SERVER_KEY }}
          CN_SSH_PORT: ${{ secrets.ZY_CN_SSH_PORT }}
        run: |
          CN_PORT="${CN_SSH_PORT:-22}"

          mkdir -p ~/.ssh
          echo "$SG_SSH_KEY" > ~/.ssh/id_sg
          echo "$CN_SSH_KEY" > ~/.ssh/id_cn
          chmod 600 ~/.ssh/id_sg ~/.ssh/id_cn

          ssh-keyscan -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

          cat > ~/.ssh/config << EOF
          Host sg-jump
              HostName ${{ secrets.ZY_SERVER_HOST }}
              User ${{ secrets.ZY_SERVER_USER }}
              IdentityFile ~/.ssh/id_sg
              StrictHostKeyChecking accept-new
              BatchMode yes

          Host cn-target
              HostName ${{ secrets.ZY_CN_SERVER_HOST }}
              User ${{ secrets.ZY_CN_SERVER_USER }}
              Port ${CN_PORT}
              IdentityFile ~/.ssh/id_cn
              ProxyJump sg-jump
              StrictHostKeyChecking accept-new
              BatchMode yes
              ConnectTimeout 30
          EOF
          chmod 600 ~/.ssh/config

      - name: 🔐 安装certbot并申请证书
        env:
          ZY_CN_DOMAIN: ${{ secrets.ZY_CN_DOMAIN }}
        run: |
          BARE_DOMAIN="${ZY_CN_DOMAIN#www.}"
          echo "🔐 为 ${BARE_DOMAIN} + www.${BARE_DOMAIN} 申请SSL证书..."

          ssh cn-target << SSLCMD
          set -e

          echo "═══ SSL证书安装 ═══"

          # 安装certbot (如果未安装)
          if ! command -v certbot &> /dev/null; then
            echo "📦 安装certbot..."
            sudo apt-get update -qq
            sudo apt-get install -y -qq certbot python3-certbot-nginx
          else
            echo "✅ certbot已安装: \$(certbot --version 2>&1)"
          fi

          # 确认Nginx正在运行
          if ! systemctl is-active --quiet nginx; then
            echo "❌ Nginx未运行，先启动Nginx"
            sudo systemctl start nginx
          fi

          # 申请证书 (--nginx模式会自动修改Nginx配置)
          echo ""
          echo "§1 申请Let's Encrypt证书..."
          sudo certbot --nginx \
            -d ${BARE_DOMAIN} \
            -d www.${BARE_DOMAIN} \
            --non-interactive \
            --agree-tos \
            --email admin@${BARE_DOMAIN} \
            --redirect \
            --no-eff-email

          # 验证证书
          echo ""
          echo "§2 验证证书..."
          sudo certbot certificates

          # 验证HTTPS可访问
          echo ""
          echo "§3 HTTPS访问测试..."
          HTTP_CODE=\$(curl -sf -o /dev/null -w '%{http_code}' https://localhost/ -k 2>/dev/null || echo "000")
          echo "HTTPS状态码: \${HTTP_CODE}"

          # 验证HTTP→HTTPS重定向
          echo ""
          echo "§4 HTTP→HTTPS重定向测试..."
          REDIR_CODE=\$(curl -sf -o /dev/null -w '%{http_code}' http://localhost/ 2>/dev/null || echo "000")
          echo "HTTP重定向码: \${REDIR_CODE} (301=正确重定向)"

          echo ""
          echo "═══ SSL安装完成 ═══"
          echo "🌐 现在可以通过 https://${BARE_DOMAIN} 访问"
          SSLCMD

      - name: 🧹 清理SSH密钥
        if: always()
        run: rm -f ~/.ssh/id_sg ~/.ssh/id_cn ~/.ssh/config