441 lines
15 KiB
Bash
441 lines
15 KiB
Bash
#!/usr/bin/env bash
|
||
# ════════════════════════════════════════════════════════════════
|
||
# 国内域名机 · Forgejo 二进制装机脚本
|
||
# Sovereign: TCS-0002∞ · ICE-GL∞ · 国作登字-2026-A-00037559
|
||
# 守护: 铸渊 · ICE-GL-ZY001
|
||
#
|
||
# 用途:
|
||
# 在广州 2C2G 域名机 (ZY-SVR-CN01) 上装 Forgejo (二进制方式, 不用 docker —
|
||
# 2C2G 内存紧, docker layers 还要再吃 200MB+).
|
||
#
|
||
# 被 .github/workflows/migrate-to-cn-restore.yml 远端调用. 不通过 bootstrap.sh,
|
||
# 因为只有真正搬家时才需要 forgejo.
|
||
#
|
||
# 用法:
|
||
# sudo bash setup-forgejo.sh \
|
||
# --data-root /data/guanghulab \
|
||
# --version 7.0.10 \
|
||
# [--port 3001] \
|
||
# [--ssh-port 2222]
|
||
#
|
||
# 关键设计:
|
||
# - cc-001 涌现洁净: 国内 forgejo 起一段独立历史, 不 mirror GitHub
|
||
# - cc-003 动态适配: tune tier=tiny 强制以下让步:
|
||
# max-conn=20 / 关 LFS / 关内置 actions runner / SQLite 而非 PostgreSQL
|
||
# - cc-004 中文一次性: 首启 user/pass 落 _logs/forgejo-credentials-FIRST-BOOT.txt 抄完删
|
||
# - 监听 127.0.0.1:3001 (永远不公网), nginx 反代到 /git/
|
||
# - SSH-git 默认关掉 (tiny 档省内存, 真要 ssh git 升档再开)
|
||
# ════════════════════════════════════════════════════════════════
|
||
|
||
set -euo pipefail
|
||
|
||
DATA_ROOT="/data/guanghulab"
|
||
DEPLOY_ROOT="/opt/guanghulab"
|
||
FORGEJO_VERSION="7.0.10" # LTS 系列, 2C2G 跑得动. 如要升级先在霜砚环境验证.
|
||
FORGEJO_HTTP_PORT="3001" # 监听端口 (loopback)
|
||
FORGEJO_SSH_ENABLED="false" # tiny 档默认关
|
||
FORGEJO_MAX_CONN="20" # tiny 档严限
|
||
FORGEJO_LFS_ENABLED="false"
|
||
DOMAIN="guanghulab.com"
|
||
|
||
while [ $# -gt 0 ]; do
|
||
case "$1" in
|
||
--data-root) DATA_ROOT="$2"; shift 2 ;;
|
||
--deploy-root) DEPLOY_ROOT="$2"; shift 2 ;;
|
||
--version) FORGEJO_VERSION="$2"; shift 2 ;;
|
||
--port) FORGEJO_HTTP_PORT="$2"; shift 2 ;;
|
||
--enable-ssh) FORGEJO_SSH_ENABLED="true"; shift ;;
|
||
--max-conn) FORGEJO_MAX_CONN="$2"; shift 2 ;;
|
||
--enable-lfs) FORGEJO_LFS_ENABLED="true"; shift ;;
|
||
--domain) DOMAIN="$2"; shift 2 ;;
|
||
-h|--help) head -n 30 "$0"; exit 0 ;;
|
||
*) echo "❌ 未知参数: $1" >&2; exit 1 ;;
|
||
esac
|
||
done
|
||
|
||
if [ "$EUID" -ne 0 ]; then
|
||
echo "❌ 需要 root (sudo bash setup-forgejo.sh ...)" >&2; exit 2
|
||
fi
|
||
|
||
# 读 .env.tune 让档位决策接管 (tune 已经在 bootstrap 时跑过)
|
||
if [ -f "$DATA_ROOT/.env.tune" ]; then
|
||
# shellcheck disable=SC1091
|
||
. "$DATA_ROOT/.env.tune"
|
||
case "${SIZE_TIER:-tiny}" in
|
||
tiny)
|
||
FORGEJO_MAX_CONN="20"
|
||
FORGEJO_LFS_ENABLED="false"
|
||
FORGEJO_SSH_ENABLED="false"
|
||
;;
|
||
small)
|
||
FORGEJO_MAX_CONN="50"
|
||
FORGEJO_LFS_ENABLED="false"
|
||
FORGEJO_SSH_ENABLED="false"
|
||
;;
|
||
medium|large|xlarge)
|
||
FORGEJO_MAX_CONN="100"
|
||
FORGEJO_LFS_ENABLED="true"
|
||
FORGEJO_SSH_ENABLED="true"
|
||
;;
|
||
esac
|
||
fi
|
||
|
||
FORGEJO_HOME="$DATA_ROOT/forgejo"
|
||
FORGEJO_BIN="/usr/local/bin/forgejo"
|
||
FORGEJO_USER="forgejo"
|
||
FORGEJO_GROUP="forgejo"
|
||
LOG_DIR="$DATA_ROOT/logs/forgejo"
|
||
CRED_FILE="$DEPLOY_ROOT/_logs/forgejo-credentials-FIRST-BOOT.txt"
|
||
RECEIPT_TS="$(date +%Y%m%d-%H%M%S)"
|
||
SETUP_RECEIPT="$DEPLOY_ROOT/_logs/forgejo-setup-$RECEIPT_TS.json"
|
||
|
||
mkdir -p "$DEPLOY_ROOT/_logs" "$LOG_DIR"
|
||
|
||
echo "═══════════════════════════════════════════════════════════"
|
||
echo " Forgejo 装机 · ZY-SVR-CN01"
|
||
echo " 版本: $FORGEJO_VERSION"
|
||
echo " 端口: 127.0.0.1:$FORGEJO_HTTP_PORT (loopback only)"
|
||
echo " 数据根: $FORGEJO_HOME"
|
||
echo " 日志根: $LOG_DIR"
|
||
echo " 域名: $DOMAIN (走 nginx /git/ 反代)"
|
||
echo " max-conn: $FORGEJO_MAX_CONN"
|
||
echo " LFS: $FORGEJO_LFS_ENABLED"
|
||
echo " SSH-git: $FORGEJO_SSH_ENABLED"
|
||
echo " 档位: ${SIZE_TIER:-tiny}"
|
||
echo "═══════════════════════════════════════════════════════════"
|
||
|
||
# ─── 1. 建用户 ────────────────────────────────────────────────
|
||
if ! id -u "$FORGEJO_USER" >/dev/null 2>&1; then
|
||
groupadd --system "$FORGEJO_GROUP"
|
||
useradd --system --gid "$FORGEJO_GROUP" \
|
||
--home-dir "$FORGEJO_HOME" \
|
||
--shell /usr/sbin/nologin \
|
||
--comment "Forgejo self-hosted git for guanghulab.com" \
|
||
"$FORGEJO_USER"
|
||
echo "✅ 创建用户 $FORGEJO_USER"
|
||
else
|
||
echo "ℹ️ 用户 $FORGEJO_USER 已存在"
|
||
fi
|
||
|
||
# ─── 2. 建目录 ────────────────────────────────────────────────
|
||
mkdir -p "$FORGEJO_HOME"/{custom/conf,data,repos,lfs,tmp/uploads}
|
||
mkdir -p "$LOG_DIR"
|
||
chown -R "$FORGEJO_USER:$FORGEJO_GROUP" "$FORGEJO_HOME" "$LOG_DIR"
|
||
chmod 750 "$FORGEJO_HOME"
|
||
|
||
# ─── 3. 下载 Forgejo 二进制 ───────────────────────────────────
|
||
ARCH="$(uname -m)"
|
||
case "$ARCH" in
|
||
x86_64) FORGEJO_ARCH="amd64" ;;
|
||
aarch64) FORGEJO_ARCH="arm64" ;;
|
||
*) echo "❌ 不支持架构: $ARCH" >&2; exit 1 ;;
|
||
esac
|
||
|
||
NEED_DOWNLOAD="true"
|
||
if [ -x "$FORGEJO_BIN" ]; then
|
||
CUR_VER="$($FORGEJO_BIN --version 2>/dev/null | head -1 | awk '{print $3}' || true)"
|
||
if [ "$CUR_VER" = "$FORGEJO_VERSION" ]; then
|
||
echo "ℹ️ Forgejo $FORGEJO_VERSION 已装 (跳过下载)"
|
||
NEED_DOWNLOAD="false"
|
||
fi
|
||
fi
|
||
|
||
if [ "$NEED_DOWNLOAD" = "true" ]; then
|
||
echo "[1/6] 下载 Forgejo $FORGEJO_VERSION ($FORGEJO_ARCH) ..."
|
||
TMP_BIN="/tmp/forgejo-$FORGEJO_VERSION-$FORGEJO_ARCH"
|
||
# codeberg.org 国内可达 (Cloudflare); 不行降级 GH proxy 镜像
|
||
URL_PRIMARY="https://codeberg.org/forgejo/forgejo/releases/download/v${FORGEJO_VERSION}/forgejo-${FORGEJO_VERSION}-linux-${FORGEJO_ARCH}"
|
||
URL_FALLBACK="https://gh-proxy.com/https://codeberg.org/forgejo/forgejo/releases/download/v${FORGEJO_VERSION}/forgejo-${FORGEJO_VERSION}-linux-${FORGEJO_ARCH}"
|
||
if ! curl -fsSL --max-time 120 -o "$TMP_BIN" "$URL_PRIMARY"; then
|
||
echo " 主源失败, 改用代理镜像..."
|
||
curl -fsSL --max-time 120 -o "$TMP_BIN" "$URL_FALLBACK" || {
|
||
echo "❌ Forgejo 下载失败 (主源 + 镜像都不通)"; exit 1
|
||
}
|
||
fi
|
||
chmod +x "$TMP_BIN"
|
||
mv "$TMP_BIN" "$FORGEJO_BIN"
|
||
echo " ✅ 安装到 $FORGEJO_BIN"
|
||
fi
|
||
|
||
# ─── 4. 生成 app.ini ──────────────────────────────────────────
|
||
APP_INI="$FORGEJO_HOME/custom/conf/app.ini"
|
||
|
||
# 生成随机 SECRET_KEY / INTERNAL_TOKEN / JWT_SECRET / LFS_JWT_SECRET
|
||
# (用 -hex: 直接 64 个十六进制字符 = 256 bits 熵 · review 建议: 比 base64+filter 更干净)
|
||
gen_secret() { openssl rand -hex 32; }
|
||
|
||
if [ ! -f "$APP_INI" ]; then
|
||
echo "[2/6] 生成 app.ini ..."
|
||
SECRET_KEY="$(gen_secret)"
|
||
INTERNAL_TOKEN="$(gen_secret)"
|
||
JWT_SECRET="REDACTED_PASSWORD"
|
||
LFS_JWT_SECRET="REDACTED_PASSWORD"
|
||
|
||
cat > "$APP_INI" <<EOF
|
||
; Forgejo · 国内自托管 git · ZY-SVR-CN01
|
||
; Sovereign: TCS-0002∞ · 国作登字-2026-A-00037559
|
||
; 守护: 铸渊 · ICE-GL-ZY001
|
||
; 生成时间: $(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||
; 档位: ${SIZE_TIER:-tiny}
|
||
;
|
||
; ⚠️ 此文件含 SECRET_KEY/INTERNAL_TOKEN/JWT_SECRET, chmod 640 不上 git 不上 COS
|
||
|
||
APP_NAME = 光湖 · 国内自托管 git
|
||
RUN_USER = $FORGEJO_USER
|
||
RUN_MODE = prod
|
||
WORK_PATH = $FORGEJO_HOME
|
||
|
||
[server]
|
||
PROTOCOL = http
|
||
DOMAIN = $DOMAIN
|
||
ROOT_URL = https://$DOMAIN/git/
|
||
HTTP_ADDR = 127.0.0.1
|
||
HTTP_PORT = $FORGEJO_HTTP_PORT
|
||
DISABLE_SSH = $([ "$FORGEJO_SSH_ENABLED" = "true" ] && echo "false" || echo "true")
|
||
SSH_DOMAIN = $DOMAIN
|
||
LFS_START_SERVER = $FORGEJO_LFS_ENABLED
|
||
LFS_JWT_SECRET = $LFS_JWT_SECRET
|
||
OFFLINE_MODE = true
|
||
LANDING_PAGE = login
|
||
APP_DATA_PATH = $FORGEJO_HOME/data
|
||
ENABLE_GZIP = false
|
||
|
||
[database]
|
||
DB_TYPE = sqlite3
|
||
PATH = $FORGEJO_HOME/data/forgejo.db
|
||
LOG_SQL = false
|
||
|
||
[repository]
|
||
ROOT = $FORGEJO_HOME/repos
|
||
DEFAULT_BRANCH = main
|
||
DEFAULT_PRIVATE = private
|
||
ENABLE_PUSH_CREATE_USER = false
|
||
ENABLE_PUSH_CREATE_ORG = false
|
||
|
||
[security]
|
||
INSTALL_LOCK = true
|
||
SECRET_KEY = $SECRET_KEY
|
||
INTERNAL_TOKEN = $INTERNAL_TOKEN
|
||
PASSWORD_HASH_ALGO = pbkdf2_hi
|
||
DISABLE_GIT_HOOKS = true
|
||
IMPORT_LOCAL_PATHS = false
|
||
|
||
[oauth2]
|
||
JWT_SECRET = $JWT_SECRET
|
||
|
||
[service]
|
||
DISABLE_REGISTRATION = true
|
||
REQUIRE_SIGNIN_VIEW = true
|
||
REGISTER_EMAIL_CONFIRM = false
|
||
ENABLE_NOTIFY_MAIL = false
|
||
ENABLE_CAPTCHA = false
|
||
DEFAULT_KEEP_EMAIL_PRIVATE = true
|
||
DEFAULT_ALLOW_CREATE_ORGANIZATION = true
|
||
|
||
[session]
|
||
PROVIDER = file
|
||
PROVIDER_CONFIG = $FORGEJO_HOME/data/sessions
|
||
|
||
[picture]
|
||
AVATAR_UPLOAD_PATH = $FORGEJO_HOME/data/avatars
|
||
REPOSITORY_AVATAR_UPLOAD_PATH = $FORGEJO_HOME/data/repo-avatars
|
||
DISABLE_GRAVATAR = true
|
||
|
||
[attachment]
|
||
PATH = $FORGEJO_HOME/data/attachments
|
||
|
||
[lfs]
|
||
PATH = $FORGEJO_HOME/lfs
|
||
|
||
[log]
|
||
ROOT_PATH = $LOG_DIR
|
||
MODE = file
|
||
LEVEL = warn
|
||
ROUTER = none
|
||
|
||
[ui]
|
||
DEFAULT_THEME = forgejo-auto
|
||
SHOW_USER_EMAIL = false
|
||
|
||
[other]
|
||
SHOW_FOOTER_VERSION = false
|
||
SHOW_FOOTER_TEMPLATE_LOAD_TIME = false
|
||
|
||
[mailer]
|
||
ENABLED = false
|
||
|
||
[indexer]
|
||
REPO_INDEXER_ENABLED = false
|
||
ISSUE_INDEXER_TYPE = bleve
|
||
|
||
[git.timeout]
|
||
DEFAULT = 360
|
||
MIGRATE = 600
|
||
MIRROR = 300
|
||
CLONE = 300
|
||
PULL = 300
|
||
GC = 60
|
||
|
||
[cron]
|
||
ENABLED = true
|
||
|
||
[actions]
|
||
; 2C2G 关掉内置 Actions runner 节省内存 (cc-003 tune tiny)
|
||
ENABLED = false
|
||
|
||
[migrations]
|
||
ALLOWED_DOMAINS = ""
|
||
ALLOW_LOCALNETWORKS = false
|
||
EOF
|
||
chown "$FORGEJO_USER:$FORGEJO_GROUP" "$APP_INI"
|
||
chmod 640 "$APP_INI"
|
||
echo " ✅ app.ini 写入 $APP_INI"
|
||
else
|
||
echo "[2/6] app.ini 已存在, 不覆盖 (改配置请手编 $APP_INI)"
|
||
fi
|
||
|
||
# ─── 5. systemd unit ──────────────────────────────────────────
|
||
UNIT="/etc/systemd/system/forgejo.service"
|
||
if [ ! -f "$UNIT" ]; then
|
||
echo "[3/6] 写 systemd unit $UNIT ..."
|
||
cat > "$UNIT" <<EOF
|
||
# Forgejo · 国内自托管 git · ZY-SVR-CN01
|
||
# Sovereign: TCS-0002∞ · 国作登字-2026-A-00037559
|
||
|
||
[Unit]
|
||
Description=Forgejo (Beyond coding. We forge.) for guanghulab.com
|
||
After=network.target
|
||
|
||
[Service]
|
||
RestartSec=5s
|
||
Type=simple
|
||
User=$FORGEJO_USER
|
||
Group=$FORGEJO_GROUP
|
||
WorkingDirectory=$FORGEJO_HOME
|
||
ExecStart=$FORGEJO_BIN web --config $APP_INI
|
||
Restart=on-failure
|
||
Environment=USER=$FORGEJO_USER HOME=$FORGEJO_HOME GITEA_WORK_DIR=$FORGEJO_HOME
|
||
# 2C2G 内存严控 (tune tier=tiny)
|
||
MemoryHigh=350M
|
||
MemoryMax=500M
|
||
TasksMax=200
|
||
LimitNOFILE=4096
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
EOF
|
||
systemctl daemon-reload
|
||
echo " ✅ unit 写入 $UNIT"
|
||
else
|
||
echo "[3/6] systemd unit 已在, daemon-reload 一下"
|
||
systemctl daemon-reload
|
||
fi
|
||
|
||
# ─── 6. 启动并等待健康 ──────────────────────────────────────
|
||
echo "[4/6] 启动 forgejo.service ..."
|
||
systemctl enable forgejo.service >/dev/null 2>&1 || true
|
||
systemctl restart forgejo.service
|
||
|
||
# 等待 forgejo 监听 :3001
|
||
HEALTH_OK="false"
|
||
for i in $(seq 1 30); do
|
||
if curl -fsS -m 3 "http://127.0.0.1:$FORGEJO_HTTP_PORT/api/v1/version" >/dev/null 2>&1; then
|
||
HEALTH_OK="true"
|
||
break
|
||
fi
|
||
sleep 2
|
||
done
|
||
|
||
if [ "$HEALTH_OK" != "true" ]; then
|
||
echo "❌ Forgejo 60 秒内没起来"
|
||
systemctl status forgejo.service --no-pager | tail -30
|
||
exit 1
|
||
fi
|
||
echo " ✅ Forgejo 已起 (127.0.0.1:$FORGEJO_HTTP_PORT)"
|
||
|
||
# ─── 7. 创建首个管理员 + 仓库 ────────────────────────────────
|
||
ADMIN_USER="bingshuo"
|
||
ADMIN_EMAIL="bingshuo@guanghulab.com"
|
||
|
||
# 首启凭据文件 (chmod 600, 抄完删)
|
||
if [ ! -f "$CRED_FILE" ]; then
|
||
echo "[5/6] 创建管理员 $ADMIN_USER ..."
|
||
# 24 位 alphanumeric ≈ 142 bits 熵, 远超现代标准. 不引入特殊字符是为了避免:
|
||
# 1. shell 转义 (这个密码会被嵌入 nginx/git URL 里短暂使用, 特殊字符会让 URL 编码出错)
|
||
# 2. 让冰朔抄起来麻烦 (特殊字符在 SSH 终端里看不清)
|
||
# 抄完即删 → 长期密码由冰朔在 forgejo Web UI 自行改成更复杂的就行.
|
||
ADMIN_PASS="$(LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 24)"
|
||
|
||
# forgejo admin user create (走 forgejo 二进制, 需要切到 RUN_USER)
|
||
sudo -u "$FORGEJO_USER" "$FORGEJO_BIN" \
|
||
admin user create \
|
||
--config "$APP_INI" \
|
||
--username "$ADMIN_USER" \
|
||
--password "$ADMIN_PASS" \
|
||
--email "$ADMIN_EMAIL" \
|
||
--admin \
|
||
--must-change-password=false 2>&1 | tail -5 || {
|
||
# 已存在则跳过
|
||
echo " (用户可能已存在, 继续)"
|
||
}
|
||
|
||
# 落首启凭据文件
|
||
umask 077
|
||
cat > "$CRED_FILE" <<EOF
|
||
# 光湖 Forgejo · 首启凭据 · 抄完后**手动删除本文件**
|
||
# 守护: 铸渊 · ICE-GL-ZY001
|
||
# 生成时间: $(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||
# 域名机: GH-CVM-DOMAIN-PROD-01 ($DOMAIN)
|
||
#
|
||
# 访问方式 (浏览器):
|
||
# https://$DOMAIN/git/
|
||
#
|
||
# 登录:
|
||
# 用户名: $ADMIN_USER
|
||
# 密码: $ADMIN_PASS
|
||
# 邮箱: $ADMIN_EMAIL
|
||
#
|
||
# 抄完密码请运行:
|
||
# sudo rm $CRED_FILE
|
||
EOF
|
||
chmod 600 "$CRED_FILE"
|
||
umask 022
|
||
echo " ✅ 凭据已落 $CRED_FILE (chmod 600, 抄完 sudo rm)"
|
||
else
|
||
echo "[5/6] 凭据文件已在 ($CRED_FILE), 不覆盖"
|
||
fi
|
||
|
||
# ─── 8. 决策回执 ─────────────────────────────────────────────
|
||
echo "[6/6] 写决策回执 ..."
|
||
cat > "$SETUP_RECEIPT" <<EOF
|
||
{
|
||
"_sovereign": "TCS-0002∞ · 国作登字-2026-A-00037559",
|
||
"_守护": "铸渊 · ICE-GL-ZY001",
|
||
"completed_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
|
||
"forgejo_version": "$FORGEJO_VERSION",
|
||
"forgejo_arch": "$FORGEJO_ARCH",
|
||
"forgejo_home": "$FORGEJO_HOME",
|
||
"http_addr": "127.0.0.1:$FORGEJO_HTTP_PORT",
|
||
"domain": "$DOMAIN",
|
||
"size_tier": "${SIZE_TIER:-tiny}",
|
||
"max_conn": $FORGEJO_MAX_CONN,
|
||
"lfs_enabled": $FORGEJO_LFS_ENABLED,
|
||
"ssh_git_enabled": $FORGEJO_SSH_ENABLED,
|
||
"actions_enabled": false,
|
||
"admin_user": "$ADMIN_USER",
|
||
"credentials_file": "$CRED_FILE",
|
||
"credentials_first_boot": $([ -f "$CRED_FILE" ] && echo "true" || echo "false"),
|
||
"systemd_status": "$(systemctl is-active forgejo.service 2>/dev/null || echo unknown)"
|
||
}
|
||
EOF
|
||
|
||
echo "═══════════════════════════════════════════════════════════"
|
||
echo " ✅ Forgejo 装机完成"
|
||
echo "═══════════════════════════════════════════════════════════"
|
||
echo " 端点: http://127.0.0.1:$FORGEJO_HTTP_PORT"
|
||
echo " 对外 (nginx): https://$DOMAIN/git/"
|
||
echo " 管理员凭据: $CRED_FILE (chmod 600 抄完删)"
|
||
echo " systemd: forgejo.service ($(systemctl is-active forgejo.service 2>/dev/null))"
|
||
echo " 决策回执: $SETUP_RECEIPT"
|
||
echo "═══════════════════════════════════════════════════════════"
|