From b01afa7decb881b7c67a98c6de94188204035e5c Mon Sep 17 00:00:00 2001 From: codename-test Date: Mon, 27 Jul 2026 19:58:15 +0800 Subject: [PATCH 1/5] =?UTF-8?q?feat:=20T4=20=E8=AF=81=E4=B9=A6=E5=88=86?= =?UTF-8?q?=E7=A6=BB=E8=AE=BE=E8=AE=A1=EF=BC=8CEGo=20=E4=BD=BF=E7=94=A8?= =?UTF-8?q?=E8=87=AA=E7=AD=BE=E5=90=8D=E8=AF=81=E4=B9=A6=EF=BC=8Cnginx=20?= =?UTF-8?q?=E4=BD=BF=E7=94=A8=20Let's=20Encrypt=20=E8=AF=81=E4=B9=A6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- deploy/README.en.md | 6 +++++- deploy/README.md | 6 +++++- deploy/t4-certbot/docker-compose.yml | 7 ++++++- deploy/t4-certbot/nginx.conf | 4 +++- 4 files changed, 19 insertions(+), 4 deletions(-) diff --git a/deploy/README.en.md b/deploy/README.en.md index 576b417..222e1c6 100644 --- a/deploy/README.en.md +++ b/deploy/README.en.md @@ -66,6 +66,10 @@ Access `https:///`. Nginx terminates TLS on 443 (your cert), proxi ### T4 (Nginx + acme.sh Auto) +**Certificate separation design:** +- nginx 443: uses `certs/ego.crt` + `ego.key` (Let's Encrypt certificate) +- EGo 5001: uses `certs/ego-selfsigned.crt` + `ego-selfsigned.key` (self-signed certificate) + **One-click deployment:** ```bash @@ -94,7 +98,7 @@ docker compose exec acme acme.sh --issue --webroot /var/www/acme -d your.domain CF_Token=your_token docker compose up -d docker compose exec acme acme.sh --issue --dns dns_cf -d your.domain --server letsencrypt -# Copy certificates to correct location +# Copy certificates to correct location (Let's Encrypt cert for nginx) docker compose exec acme cp /acme.sh/your.domain/fullchain.cer /certs/ego.crt docker compose exec acme cp /acme.sh/your.domain/your.domain.key /certs/ego.key ``` diff --git a/deploy/README.md b/deploy/README.md index 4adc843..5d6716b 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -67,6 +67,10 @@ docker compose up -d ### T4（Nginx + acme.sh 自动证书） +**证书分离设计：** +- nginx 443: 使用 `certs/ego.crt` + `ego.key`（Let's Encrypt 证书） +- EGo 5001: 使用 `certs/ego-selfsigned.crt` + `ego-selfsigned.key`（自签名证书） + **一键部署：** ```bash @@ -95,7 +99,7 @@ docker compose exec acme acme.sh --issue --webroot /var/www/acme -d your.domain CF_Token=your_token docker compose up -d docker compose exec acme acme.sh --issue --dns dns_cf -d your.domain --server letsencrypt -# 复制证书到正确位置 +# 复制证书到正确位置（Let's Encrypt 证书给 nginx） docker compose exec acme cp /acme.sh/your.domain/fullchain.cer /certs/ego.crt docker compose exec acme cp /acme.sh/your.domain/your.domain.key /certs/ego.key ``` diff --git a/deploy/t4-certbot/docker-compose.yml b/deploy/t4-certbot/docker-compose.yml index 7c22e92..4de801c 100644 --- a/deploy/t4-certbot/docker-compose.yml +++ b/deploy/t4-certbot/docker-compose.yml @@ -1,6 +1,10 @@ # T4 — 懒人全自动（bridge + Nginx + acme.sh，Let's Encrypt） # 场景：个人 / 小团队云端，拥有公网域名。自动签发并续期免费证书。 # +# 证书分离设计： +# - nginx 443: 使用 certs/ego.crt + ego.key（Let's Encrypt 证书） +# - EGo 5001: 使用 certs/ego-selfsigned.crt + ego-selfsigned.key（自签名证书） +# # 默认使用 webroot 模式（需要 80 端口），也支持 Cloudflare DNS API 验证。 # # 方式一：webroot 模式（默认，需要域名解析到本机公网 IP） @@ -23,7 +27,8 @@ services: - WEB_SSL_PORT=5001 - DB_PATH=/app/data/ego.db - LOG_LEVEL=INFO - - EGO_SSL_DIR=/app/certs + - EGO_SSL_CERT=/app/certs/ego-selfsigned.crt + - EGO_SSL_KEY=/app/certs/ego-selfsigned.key volumes: - ego_data:/app/data - ego_config:/app/config diff --git a/deploy/t4-certbot/nginx.conf b/deploy/t4-certbot/nginx.conf index f2ab236..587eaca 100644 --- a/deploy/t4-certbot/nginx.conf +++ b/deploy/t4-certbot/nginx.conf @@ -1,5 +1,7 @@ # T4 Nginx — Let's Encrypt（acme.sh webroot 自动续期） -# 证书统一放在本目录 certs/ego.crt 与 certs/ego.key，与 T3 一致。 +# 证书分离设计： +# - nginx 443: 使用 certs/ego.crt + ego.key（Let's Encrypt 证书） +# - EGo 5001: 使用 certs/ego-selfsigned.crt + ego-selfsigned.key（自签名证书） # 首次签发后需把证书复制到 certs/ 目录（见 docker-compose 注释）。 # 把所有 your.domain 改成你的域名。 From a607ccb64982bff8bed015fdeaf0342d10402bea Mon Sep 17 00:00:00 2001 From: codename-test Date: Mon, 27 Jul 2026 20:01:35 +0800 Subject: [PATCH 2/5] =?UTF-8?q?feat:=20=E6=B7=BB=E5=8A=A0=20dev=20?= =?UTF-8?q?=E5=88=86=E6=94=AF=E6=89=93=E5=8C=85=E5=B7=A5=E4=BD=9C=E6=B5=81?= =?UTF-8?q?=EF=BC=8C=E4=BD=BF=E7=94=A8=20dev=20tag?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/docker-build.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 2b7a582..a7d3b0f 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -2,7 +2,7 @@ name: Docker Build on: push: - branches: [main] + branches: [main, dev] tags: ["v*"] workflow_dispatch: @@ -30,6 +30,7 @@ jobs: type=semver,pattern={{major}}.{{minor}} type=sha,format=long type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} + type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }} - name: Login to GHCR uses: docker/login-action@v3 @@ -66,6 +67,7 @@ jobs: type=semver,pattern={{major}}.{{minor}} type=sha,format=long type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} + type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }} - name: Push to Docker Hub if: steps.login_dh.outcome == 'success' From 439fc7bb7dc9e78c5cce248884ce9ead7da5b8cb Mon Sep 17 00:00:00 2001 From: codename-test Date: Mon, 27 Jul 2026 20:21:05 +0800 Subject: [PATCH 3/5] =?UTF-8?q?fix:=20T4=20=E6=B7=BB=E5=8A=A0=20EGO=5FSECR?= =?UTF-8?q?ET=5FKEY=20=E7=8E=AF=E5=A2=83=E5=8F=98=E9=87=8F=E9=85=8D?= =?UTF-8?q?=E7=BD=AE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- deploy/t4-certbot/docker-compose.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/deploy/t4-certbot/docker-compose.yml b/deploy/t4-certbot/docker-compose.yml index 4de801c..1f917ae 100644 --- a/deploy/t4-certbot/docker-compose.yml +++ b/deploy/t4-certbot/docker-compose.yml @@ -29,6 +29,7 @@ services: - LOG_LEVEL=INFO - EGO_SSL_CERT=/app/certs/ego-selfsigned.crt - EGO_SSL_KEY=/app/certs/ego-selfsigned.key + - EGO_SECRET_KEY=${EGO_SECRET_KEY:-} volumes: - ego_data:/app/data - ego_config:/app/config From 2ac213e998b2beabbeff15bc6614429fba3332a0 Mon Sep 17 00:00:00 2001 From: codename-test Date: Mon, 27 Jul 2026 20:44:24 +0800 Subject: [PATCH 4/5] =?UTF-8?q?fix:=20=E6=97=A0=E8=AF=81=E4=B9=A6=E6=97=B6?= =?UTF-8?q?=205001=20=E7=AB=AF=E5=8F=A3=E4=B9=9F=E5=90=AF=E5=8A=A8=20HTTP?= =?UTF-8?q?=20=E6=9C=8D=E5=8A=A1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- web_ui.py | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/web_ui.py b/web_ui.py index 1be152c..5c499ec 100644 --- a/web_ui.py +++ b/web_ui.py @@ -63,13 +63,25 @@ def run_web_ui(port: int = 5000, ssl_port: int = 5001): """由 main.py 调用，启动 Flask 开发服务器。 - 有证书：HTTP 跑在 `port`（webhook/健康检查），HTTPS 跑在 `ssl_port`（管理页面）。 - - 无证书：仅 HTTP 跑在 `port`，并告警。 + - 无证书：HTTP 跑在 `port`（webhook/健康检查），HTTP 也跑在 `ssl_port`（管理页面，不加密）。 """ ssl_ctx = _ssl_context() if ssl_ctx is None: import log - log.logger.warning("SSL cert not found, serving HTTP only on port %s " - "(admin UI will not be encrypted).", port) + log.logger.warning("SSL cert not found, serving HTTP on both ports %s and %s " + "(admin UI will not be encrypted).", port, ssl_port) + + # 无证书时，ssl_port 也启动 HTTP 服务 + http_thread = threading.Thread( + target=run_simple, + args=("0.0.0.0", ssl_port, app), + kwargs={"threaded": True, "use_reloader": False}, + daemon=True, + name="http-admin-server", + ) + http_thread.start() + + # 主线程跑 webhook/health run_simple("0.0.0.0", port, app, threaded=True, use_reloader=False) return From 255f21c2fcca8809d36624082245fdef1d07daed Mon Sep 17 00:00:00 2001 From: codename-test Date: Mon, 27 Jul 2026 20:46:21 +0800 Subject: [PATCH 5/5] =?UTF-8?q?feat:=20T4=20=E9=83=A8=E7=BD=B2=E6=97=B6?= =?UTF-8?q?=E8=87=AA=E5=8A=A8=E7=94=9F=E6=88=90=E8=87=AA=E7=AD=BE=E5=90=8D?= =?UTF-8?q?=E8=AF=81=E4=B9=A6=E7=BB=99=20EGo=205001=20=E7=AB=AF=E5=8F=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- deploy/init.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/deploy/init.sh b/deploy/init.sh index 7db3d40..1feb022 100644 --- a/deploy/init.sh +++ b/deploy/init.sh @@ -146,6 +146,10 @@ case $DEPLOY_DIR in cp "$HOME/.acme.sh/$DOMAIN/fullchain.cer" certs/ego.crt cp "$HOME/.acme.sh/$DOMAIN/$DOMAIN.key" certs/ego.key fi + + # 生成自签名证书给 EGo 5001 端口使用 + echo "生成自签名证书给 EGo..." + openssl req -x509 -newkey rsa:2048 -keyout certs/ego-selfsigned.key -out certs/ego-selfsigned.crt -days 365 -nodes -subj "/CN=$DOMAIN" ;; esac